PHP2Shell Readiness Check · CVE-2026-109618 and CVE-2026-109619
PHP2Shell was exploited four days before the patch landed. That's where Wiz and TENEX.AI can help.
Wiz finds every vulnerable PHP workload and checks your logs for signs of compromise.
Book your free Readiness Check✓ Get evidence your board, auditors and insurer can use, at no cost.
×TENEX.AIThe exposure window
9.2
CVSS for each of the two flaws
70%
of websites run PHP
4 days
of attacks before the 21 October patch
What is PHP2Shell?
PHP2Shell is two unauthenticated remote code execution flaws in PHP core, each rated CVSS 9.2. PHP runs 70% of websites.
Attacks started on 17 October, but the patch landed on 21 October. In-the-wild code execution was confirmed on 26 October.
PHP 7.4 to 8.1 get source backports only. Versions 5.4 to 7.3 are end of life and will never be fixed.
UK NCSC, Dutch NCSC and CERT-EU told organisations to patch or go offline. UK councils and the Met Police took sites offline.
If you patched after 17 October, you still need to know whether someone got in first. Wiz checks as far back as your logs go.
What your Readiness Check covers
01
Find your exposure
Wiz finds every PHP runtime across VMs, containers and PaaS, including end-of-life versions. Then it ranks what matters: internet-facing, unpatchable, with an attack path to key data.
02
Check for compromise
Wiz looks for web shells, crypto miners and Mirai botnet activity as far back as your connected logs allow. Existing TENEX.AI customers also get a hunt across the telemetry we already hold.
03
Prove it to your board
You get a readiness report for your board, plus evidence for NIS2, DORA and your insurer.
How it works
We confirm scope and set up your Wiz environment.
Wiz connects agentlessly with read-only access, so you install nothing on your servers.
Within 10 days you have your exposure findings, the results of the Wiz lookback and clear next steps for your team.
Why Wiz + TENEX.AI
Wiz shows you every vulnerable workload. TENEX.AI, the AI-native MDR, checks whether anyone used it and watches your estate 24x7.
Finds every vulnerable PHP workload and ranks it by real risk.
Hunts for compromise, then triages Wiz Defend signals in under a minute, 24x7.
Together
One team takes you from first scan to board evidence.
Watch it: after the check
A related flaw, CVE-2026-115560, is still unpatched. For what you can't fix yet, choose the next step that fits.
If the assessment finds signs of a compromise, we can refer you to Google Cloud's Mandiant incident response services.
Get Wiz CNAPP and TENEX.AI Agentic MDR together on one plan.
TENEX.AI watches the PHP 5.4 to 8.1 you can't patch yet, 24x7, for 6 to 12 months.
Yes. The 10-day Readiness Check costs nothing and carries no obligation.
Yes. Attacks started four days before the patch. Wiz checks your logs for signs of compromise so you know whether anyone got in first.
It depends on the log sources you connect and how long you keep them. If your logs go back to 17 October, the check covers the full exposure window. If they don't, your report states exactly which period it covers.
No. The check works whether or not you use either today.
Read-only access to the cloud accounts in scope, plus the log sources you choose to connect. Nothing is installed on your servers.
Wiz runs the scan and the lookback. TENEX.AI engineers walk you through the findings.
We can refer you to Google Cloud's Mandiant incident response services. TENEX.AI does not perform incident response or remediation.
Yes. Your report documents how you found and ranked your exposure and which period the lookback covered.
You keep your readiness report. For PHP you can't patch, we'll show you Legacy PHP Watch and Patched + Protected.
Yes. For large environments we set you up on a dedicated tenant from day one so there's no migration later.
Patched isn't protected
In 10 days, find out whether your logs show anyone got in before the patch.
Readiness Check delivered by Wiz and TENEX.AI. Wiz and the Wiz logo are trademarks of Wiz, Inc. Mandiant is a trademark of Google LLC.
The Readiness Check is provided free of charge for informational purposes only. The vulnerability assessment is performed using the Wiz platform, and its findings are generated by Wiz, Inc. TENEX.AI's participation is limited to the services expressly described in a separate written agreement with the participating organisation.
Retrospective analysis for indicators of compromise is performed by Wiz and is limited to the log sources the participating organisation connects and the retention period of those logs. TENEX.AI makes no representation that this analysis will cover any particular period, including the full period of known exploitation. Retrospective threat hunting by TENEX.AI is available only where TENEX.AI's services were already deployed and ingesting the relevant telemetry for the period under review.
The Readiness Check does not include remediation. Any patching, code changes, configuration changes or other corrective action is the sole responsibility of the participating organisation. Neither TENEX.AI nor Wiz will perform remediation as part of the Readiness Check.
If evidence of a security compromise is identified, TENEX.AI may, at its discretion, refer the participating organisation to incident response services offered by Google Cloud, including Mandiant. Any such services are provided solely by their provider under separate terms and fees agreed directly with that provider. TENEX.AI makes no representation regarding the availability, scope or outcome of those services.
The Readiness Check is provided as is. TENEX.AI makes no warranty, express or implied, that it will identify all vulnerabilities, exposures or indicators of compromise, and accepts no liability for any loss arising from reliance on its results.
