How host-based checks found a vulnerable PHP server that external scanning would have missed

Quick summary: When the PHP2Shell vulnerabilities were disclosed, our SOC used the Orbital agent to check the PHP versions installed across a customer's environment. Within minutes, they found a vulnerable internal server that external scanning would have missed. The customer patched it the same day. Scanning shows what your systems look like from outside; Orbital shows what's actually installed on them.

What happened?

On 21 October 2026, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical vulnerabilities affecting every version of PHP before the fixed releases. Attacks were already under way, so organizations needed to find vulnerable servers fast. Read our PHP2Shell advisory.

One of our customers has the Orbital agent deployed across their estate. Using Orbital's compliance checks, our SOC checked the PHP version installed on every host and found a vulnerable server within minutes.

The server was internal, so external scanning would never have reached it. Our SOC escalated it to the customer, who patched it the same day.

Why isn't external scanning enough on its own?

Application and infrastructure scanning are essential, but they look at your systems from the outside. That has limits:

• Scanners only see what's reachable from the internet. Internal servers are invisible to them, yet attackers who get inside your network can still exploit them.
• Scanners rely on what a server reveals. Many servers hide their PHP version, making it hard to tell whether they're vulnerable.
• Results take time. Scans run on a schedule and can take a while across a large estate.

How does the Orbital agent help?

The Orbital agent runs on each device, on Windows, Linux and macOS, and reports directly from the host. That means:

• Quicker results: checks run on the device itself, so you get answers in minutes.
• More reliable results: Orbital reads the version that's actually installed, rather than inferring it from outside.
• Complete coverage: every device with Orbital is checked, including internal servers that scanners can't reach.

Any issues are flagged as threats in your Defense.com dashboard, with clear steps to fix them, and our SOC can act on them, as they did here.

Orbital also gives you full asset visibility, isolates compromised devices in a few clicks, and runs automated compliance checks, such as whether firewalls and automatic updates are enabled.

Get Orbital working for you

• Already have access to Orbital? Deploy it across your estate with our step-by-step guides for Windows and Linux, or browse all our Orbital guides.
• Don't have Orbital yet? Speak to us about upgrading.