Insignary has released a free scanner to help organisations find Linux servers and container images still exposed to PHP2Shell, the critical PHP flaws that the US Cybersecurity and Infrastructure Security Agency (CISA) added to its exploited-vulnerabilities catalogue on 26 October. The tool, insignary-chk, was released on 6 November and also checks for Node2Shell, the Brotli flaw tracked as CVE-2026-111497.

PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 under CVSS v4.0. Each can allow an unauthenticated attacker to run code remotely on a server handling web requests with PHP. PHP released fixes on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while Amazon saw exploit attempts from 17 October.

Why exposure can stay hidden

The flaw sits in the PHP runtime itself, not in application code, so reviewing a website's own code will not reveal whether it is exposed. PHP can also be bundled inside vendor software, control panels and container images, which may never be updated. Insignary says its scanner looks for those hidden copies, including Brotli copies outside Node.js.

The scanner is a single file for Linux x86_64, needs no installation, and is read-only by default: it only reads files, sends no data over the network, and changes nothing unless asked. Findings are ranked by urgency. Windows, macOS and Arm64 systems are not yet supported.

Scanning is not a substitute for patching

Every supported installation should be updated to a fixed PHP release and restarted. PHP 8.1 and older no longer receive official releases, so check with your Linux distribution for backported fixes. CISA's advice, as reported by Greenbone, is that organisations unable to update immediately, or still running PHP 8.1 or older, should take affected systems offline until they are patched or upgraded.