Qualys Releases Free Tools to Detect PHP Vulnerabilities
The services provide automated discovery for critical remote code execution flaws within 60 minutes of deployment.
Updated on Oct. 26, 2026 in Cybersecurity
Live Poll
Do you trust companies to protect your data from emerging cyber vulnerabilities?
Qualys has released free tools to identify and mitigate CVE-2026-109618 and CVE-2026-109619, a pair of vulnerabilities enabling unauthenticated remote code execution. These services provide discovery, prioritization, and patching workflows to address critical security gaps in PHP environments.
Why it matters
The release addresses a widespread security deficit where most PHP installations run end-of-life versions that no longer receive vendor patches. With active attack traffic already targeting these vulnerabilities, identifying and securing internet-facing assets has become a critical priority for IT security teams.
The vulnerabilities carry a CVSS v4.0 rating of 9.2, signaling a high risk of unauthenticated remote code execution. Analysis shows 167 million PHP installations exist across the studied customer base, with 73% of these currently operating on internet-facing infrastructure.
The players
Qualys
A provider of cloud-based security, compliance, and related IT solutions that maintains a large-scale database of global asset vulnerabilities.
The details
The PHP2Shell vulnerabilities allow remote attackers to execute arbitrary code on a server without requiring authentication. The Qualys service operates by scanning infrastructure to identify vulnerable instances, which can be completed within 60 minutes. The workflow encompasses discovery, prioritization, validation, patching, and final verification to ensure that legacy PHP environments are secured against exploitation.
Timeline
October 26, 2026: Qualys announced the release of the free mitigation services.
15 days: The duration for which the services are offered for free.
60 minutes: The time required to discover vulnerable PHP instances using the service.
The Tech Race
The PHP2Shell situation follows the pattern established by the Log4j discovery, where vulnerabilities in ubiquitous, deep-stack software components expose massive swaths of internet-facing infrastructure simultaneously. Security vendors are now in a race to automate discovery workflows before exploit kits become widely available.
Security administrators can access the 15-day free service to scan up to 1,000 assets for immediate vulnerability assessment. This tool is designed to expedite the patching of internet-facing PHP installations, which currently represent 73% of the monitored assets at high risk.
The takeaway
The high prevalence of end-of-life PHP software makes this a significant target for automated exploitation efforts. Organizations should prioritize updating internet-facing instances and track the 15-day availability window for the current security assessment tools.
Further reading
For broader trends in vulnerability management and remediation, visit Cybersecurity.
More information
To assess your environment for vulnerabilities, visit the Qualys PHP2Shell risk assessment portal.
Source note: This article includes information reported by ITWire.
Live Poll
Do you trust companies to protect your data from emerging cyber vulnerabilities?
