Practical guidance and support from Defense.com

PHP2Shell: We're Here to Help

Following the recent disclosure of two PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), we want to help organisations understand whether they may be affected and what steps they can take.

Create a free account
A server rack in a dark data centre with a glowing magenta warning light

At Defense.com, we believe cybersecurity is about more than protecting our own customers. We have a wider responsibility to share our knowledge, expertise and tools when new security threats emerge.

That's why we're making both Application Scanning and our Orbital Agent available free of charge through the Defense.com platform, helping organisations assess their applications and gain additional visibility into potential vulnerabilities within their environments.

By making these complementary capabilities available, we hope to provide organisations with a more thorough understanding of their potential exposure and the steps they may need to take.

Whether you're an existing customer or have never used Defense.com before, this support is available to you.

Practical guidance

  1. Understand your potential exposure

    If your organisation operates websites or applications using PHP, it's worth checking whether your systems could be affected by these recently disclosed vulnerabilities.

  2. Check your applications and environment

    Create a free Defense.com account to access our Application Scanning capability and Orbital Agent. Application Scanning helps identify potential vulnerabilities in your websites and applications, while Orbital provides additional visibility within your environment. Together, they offer a broader assessment of potential exposure.

  3. Take the appropriate action

    Review the results, check your PHP versions and apply any necessary security updates. Our technical guidance explains the steps you can take.

Create a Free Account

This support is being provided at no cost, as part of our commitment to helping organisations respond to emerging security threats.

Access to security assessment tools

We have made our Application Scanning capability and Orbital Agent available to organisations that would find them helpful in assessing their potential exposure. To use these tools, you will need to create a free Defense.com account.

Once you submit the form, our team will set up your account and be in touch with your onboarding details.

Application scanning can help identify potential security weaknesses, but should be used alongside PHP version checks and appropriate security updates.

Additional guidance and support

If you'd like to understand more about the vulnerabilities or check your environment manually, we've also prepared some helpful resources.

PHP2Shell Security Advisory

An overview of the vulnerabilities, their potential impact and recommended actions.

Read our advisory

Step-by-Step Technical Help Guide

Practical instructions for checking whether your systems may be affected and what to do next.

View the guide

Our commitment

We believe that when new security threats emerge, the right response is to share knowledge, offer practical support and help organisations take informed action.

This initiative is part of that commitment. We simply want to make our expertise and technology available to organisations that may benefit from them.

Create a free account