Qualys Details Agent and Agentless PHP2Shell Remediation for Windows and macOS

Summary

Qualys describes CAR scripts that upgrade PHP on Windows and macOS to the latest release in the installed minor series, with verification and rollback on Windows, Homebrew handling on macOS, and agent-based or authenticated scanner-based deployment.

Key points

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution against exposed PHP servers.
Qualys says its CAR scripts upgrade PHP within the installed minor series; for end-of-life series, the scripts stop and report the issue, with a separate mitigation script offered.
The Windows script discovers PHP installations, selects a matching official build, verifies its SHA256, backs up the PHP folder, and rolls back if the post-upgrade check fails.
The macOS script upgrades Homebrew-managed PHP within its current series; it reports and leaves MacPorts, MAMP, and manual installations untouched.
The same scripts can run through a Cloud Agent or an authenticated Qualys scanner; scanner-based runs require Windows or SSH credentials with sufficient permissions.
Qualys advises scheduling a maintenance window because the upgrade can restart IIS, Apache, or php-fpm, then rescanning to confirm remediation.

Article Details

Defense Focus: Remediate PHP2Shell exposure on Windows and macOS by upgrading PHP within its installed minor series or applying the mitigation script when the series is end-of-life.
Detection Methods: Use ETM to identify Windows and macOS hosts flagged for CVE-2026-109618 or CVE-2026-109619.
Discover PHP installations across host paths, IIS FastCGI configuration, and Windows services; check the installed PHP version and build flavor.
Review remediation job output for before-and-after versions and, on Windows, SHA256 verification and rollback status.
Rescan after remediation and confirm the QID no longer reports.
Data Sources: ETM exposure findings and QID results
Authenticated scanner results
PHP installation paths, binary version output, and Windows IIS FastCGI configuration
CAR job output, including version changes, SHA256 verification, and service restart results
Platforms: Windows
macOS
Defensive Actions: Run the supplied PHP upgrade script through Cloud Agent or an authenticated Qualys scanner with appropriate Windows or SSH credentials.
Schedule a maintenance window because IIS, Apache, or php-fpm may be restarted.
Upgrade only within the installed PHP minor series; do not force a major or minor version change.
For end-of-life PHP series, use the PHP2Shell mitigation script and plan migration to a supported series.
On Windows, verify the downloaded build's SHA256 and retain the script's backup and rollback process.
Review job results, rescan affected hosts, and confirm the finding is closed.