php2shell PHP Flaws: How to Find Every Server Before Attackers Do

Why the php2shell flaws change the urgency

The PHP project disclosed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026 after details leaked a day early. Both carry a CVSS v4.0 score of 9.2 and allow unauthenticated remote code execution on any PHP install that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Security firms reported exploitation attempts in the wild shortly after disclosure, though no confirmed break-ins had been published at that time. Updating WordPress, WooCommerce, Magento, Drupal, Laravel or any other PHP application does not fix the issue; the underlying runtime on the server or the hosting plan must be updated.

Where unknown PHP servers hide

Most UK organisations carry a long tail of PHP assets that never appear in the official CMDB. A marketing agency spun up a WordPress microsite for a 2019 campaign and left it on a subdomain. An internal team built a Laravel expense tracker on a development VPC that was later exposed by a security group change. A Magento 1 store migrated to a new platform but the old server remained online for "reference data". A FrankenPHP container runs a webhook receiver in a Kubernetes cluster nobody owns. Each of these is in scope for php2shell and each is invisible to a manual audit.

How an AI agent builds a live PHP inventory

An AI agent designed for asset discovery starts with your authoritative sources: Route 53 or Azure DNS zones, certificate transparency logs for your domains, AWS EC2 or Azure VM inventories, Kubernetes service lists and any CMDB exports. It then performs active fingerprinting against every HTTP and HTTPS endpoint it finds, extracting the PHP version header, the X-Powered-By value and behavioural quirks that reveal the runtime even when headers are suppressed. The agent normalises the data, deduplicates hosts that appear under multiple names and stores the result in a versioned knowledge graph that your team can query.

Automation that turns inventory into action

Discovery alone is not enough. A companion automation pipeline consumes the knowledge graph and, for each PHP endpoint, executes a safe version check via SSH, WinRM or the cloud provider's run-command API. It compares the detected version against the fixed releases and tags the asset as patched, vulnerable or end-of-life. For vulnerable assets it generates a remediation snippet tailored to the host: apt upgrade php8.3-fpm on Ubuntu, yum update php82-php-fpm on RHEL, a container image rebuild for Kubernetes workloads, or a support ticket for managed hosting where you lack OS access. The output lands in Jira, ServiceNow or GitHub Issues with a due date derived from your internal SLA.

What to do this week

1. Export every DNS zone your organisation controls and feed it to a discovery script.
2. Pull certificate transparency logs for your root domains and add any new subdomains to the target list.
3. Query your cloud providers for all compute instances, containers and serverless functions that listen on port 80 or 443.
4. Run a non-intrusive HTTP fingerprint scan against the combined target list and capture PHP version indicators.
5. Cross-reference every detected version with PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; flag anything older or any end-of-life branch.
6. Create remediation tickets for each vulnerable host with the exact package manager command or container rebuild step.
7. Schedule the discovery and fingerprinting loop to run daily and on every infrastructure-as-code merge.

Where 1real.ai fits

We build the AI agents and automation pipelines that turn a one-off audit into a continuous control. Our studio delivers the discovery agent that maps your PHP estate, the version-check automation that produces remediation-ready tickets, and the AEO layer that lets your leadership ask "are we exposed?" and get a sourced answer in seconds. The result is a repeatable process that survives staff turnover, cloud migrations and the next critical CVE.