PHP2Shell Highlights Limits of Automated Pentesting and Value of Attack Simulation
Summary
Picus says PHP2Shell’s lack of a safe day-one exploit left automated pentesting limited to version fingerprinting, while its breach-and-attack simulation tested deployed controls and guided signature fixes; it urges patching PHP and revalidating defenses.
Key points
- The article says PHP disclosed two critical, unauthenticated remote-code-execution flaws in its core, CVE-2026-109618 and CVE-2026-109619, and issued out-of-cycle fixes.
- A scan cited in the article counted roughly 884,000 internet-facing hosts reporting PHP 8.1 or older before the patch.
- The article argues that without a safe, working exploit, automated pentesting could identify potentially exposed assets by PHP version but could not establish whether exploitation would succeed or deployed controls would stop it.
- Picus says its Threat Library added threat 60730, “PHP Php2Shell RCE Campaign,” to test defenses and provide per-control results; these are vendor-reported capabilities.
- Picus says simulations identified control gaps and provided prevention signatures, including a Check Point NGX signature, followed by re-testing to check whether gaps were closed.
- The article advises patching PHP, verifying the version used by production sites, simulating the attack against defenses, re-running tests after fixes, and monitoring web-worker processes.
Article Details
- Topic
- The limits of automated pentesting for the PHP2Shell vulnerabilities and how breach and attack simulation can test defensive controls while safe exploits are unavailable.
MITRE ATT&CK
CVE
CVE-2026-109618The trigger was php2shell: two critical, unauthenticated remote code execution flaws in PHP's core, CVE-2026-109618 and CVE-2026-109619, fixed in an out-of-cycle release after details leaked ahead of the embargo.CVE-2026-109619The trigger was php2shell: two critical, unauthenticated remote code execution flaws in PHP's core, CVE-2026-109618 and CVE-2026-109619, fixed in an out-of-cycle release after details leaked ahead of the embargo.
Vendors
Check PointEvery gap came with a fix: validated, vendor-specific prevention signatures, such as a Check Point NGX signature covering the php2shell exploitation attempt, and a re-run to confirm the gap was closed.PicusThis is not a criticism of any one vendor: these constraints apply with equal force to our own Picus Autonomous Penetration Testing.
Products
Check Point NGXEvery gap came with a fix: validated, vendor-specific prevention signatures, such as a Check Point NGX signature covering the php2shell exploitation attempt, and a re-run to confirm the gap was closed.PHPOn the morning of October 21, 2026, everyone responsible for infrastructure that runs PHP woke up to the same two questions.Picus Autonomous Exposure Validation PlatformThat last cell matters, because these motions are complementary, not rivals, and that is how the Picus Autonomous Exposure Validation Platform is built.Picus Autonomous Penetration TestingThis is not a criticism of any one vendor: these constraints apply with equal force to our own Picus Autonomous Penetration Testing.Picus Breach and Attack SimulationPicus Breach and Attack Simulation continuously proves what your stack blocks, detects, and misses, then re-validates after every fix.Picus Exposure ValidationPicus Exposure Validation maps a CVE to the techniques its exploitation requires and tests that chain against your controls, so exploitability gets an answer on day one with no exploit fired.Picus Threat LibraryWithin hours of PHP's advisory, Picus Labs released a ready-to-run threat in the Picus Threat Library: threat 60730, “PHP Php2Shell RCE Campaign”.