PHP2Shell free service · Onboarding guide
Find and fix PHP2Shell on your internet-facing assets
This guide takes you from your first login to a verified fix. Each step tells you which application to open, what to scan and where your results appear.
15 days
Free service, from activation
1,000
Assets, maximum
Cloud
Scans run from the Qualys cloud
Steps 1-5
No agents, appliances or credentials
Table of Contents
START HERE
Three questions to answer before you begin
01
Which application do I open?
Start in CSAM. Every step names its application.
Open applications from the Application Picker in the upper-left corner of the Qualys platform.
02
What do I scan?
Your domains first. Nothing inside your network.
OEASM turns your domains into a list of public IPs and web applications (Step 1). You scan those hosts in Step 2 and those applications in Step 3, all from the Qualys cloud.
03
Where do my results appear?
ETM Findings and the Fightback dashboard.
Every detection appears in ETM > Risk Management > Findings. The dashboard you import in Step 5 brings them together in one view.
00 · BEFORE YOU START
Log in and find your applications
Your Registration – Start Now email contains your login credentials and a one-time link to your Qualys platform. The link works only once, so open it from the email when you are ready to begin.
Log in
- Open the link in the email and log in. Note your platform URL, for example
qualysguard.qg2.apps.qualys.com. If you have trouble, see the Login FAQ. - On first login, accept the End User License Agreement (EULA). The Qualys home page opens.
- Open the Application Picker in the upper-left corner. Your free service includes the applications used in this guide:
- CyberSecurity Asset Management (CSAM), including External Attack Surface Management (EASM)
- Vulnerability Management, Detection and Response (VMDR)
- TotalAppSec (or WAS), the updated version of Web Application Scanning
- Enterprise TruRisk Management (ETM)
- TruRisk Eliminate
- Keep the PHP2Shell blog open in a separate browser tab. It contains the QIDs, queries and dashboard download this guide uses.
Have this information ready
| Information | Used in |
|---|---|
Your organization's primary domains | Step 1 |
IP ranges, ASNs or certificate subjects your organization owns (optional) | Step 2 |
Public IP addresses or FQDNs of your PHP web servers, if known | Step 3 |
Your public web application URLs | Step 4 |
SAVE TIME
NOTE
Steps 1-5 need no Qualys Scanner Appliance, Cloud Agent or server credentials. Mitigating through the scanner in Step 6 needs a host login (SSH on Linux). If you can't share credentials, you can apply the setting by hand or deploy a Cloud Agent. Step 6 covers each option.
YOUR STEPS
Six steps from domain list to verified fix
Select a step to see what to do. Steps 1–4 find PHP2Shell and prove which hosts are exploitable. Steps 5–6 bring it into one view and fix it.
PHASE 1 · FIND PHP2SHELL (REQUIRES ONLY DOMAINS AND PUBLIC IP ADDRESSES)
What is this - Inventory of internet-facing hosts and web apps
YOU NEED
Your domains. Optionally your organization name, IP ranges, ASNs and certificate subjects.
YOU GET
An inventory and initial risk indicators for internet-facing hosts and web apps
USED IN
Step 2 (hosts) and Step 3 (web applications)
EASM finds the hosts, domains, subdomains and web applications your organization owns, using sources such as Shodan, WHOIS and multiple DNS providers. It performs no active scanning and needs no credentials.
Set up discovery
GO TO
CSAM > Configuration > EASM Configuration
IMPORTANT
The free service covers up to 1,000 assets, and the limit applies here. Seed only the domains and addresses you want assessed.
Review what EASM found
WHEN STATUS READS COMPLETED
- Open Inventory and turn on the EASM switch to see EASM columns such as Open ports, ISP and Domains. The EASM switch is available only in the CSAM Classic view. Use Group by to group assets by Organization, Domain/Subdomain and other attributes.
- Open the Domains tab to see every discovered domain and subdomain. Scan these in later steps using DNS tracking.
- Add any organizations, domains, subdomains or IP addresses that aren't yours to the profile's Exclude seeds filter, then click Save to schedule another discovery run. To remove assets from your inventory, use the right-click Quick Actions menu.
- To list the hosts that expose HTTP or HTTPS, enter this query in the asset or domain query control. Then click the download icon above the list to export the results.
CSAM QUERY · WEB-EXPOSED HOSTS
NOTE
Every EASM asset has a unique IP address. Several assets that share one name or subdomain usually indicate load balancing.
YOU'RE DONE WHEN
You have an exported list of public IPs and FQDNs that expose HTTP or HTTPS, plus the web applications EASM found.
RESULTS APPEAR IN
CSAM > Inventory, and as assets in ETM.
What is this - PHP2Shell detections on hosts
YOU NEED
Public IPs or FQDNs from Step 1, or your known PHP servers
YOU GET
PHP2Shell detections on hosts, prioritized by TruRisk
USED IN
Step 4 validation and the Step 5 dashboard
An unauthenticated scan from the Qualys cloud scanners identifies internet-facing hosts that may be vulnerable to PHP2Shell. If your subscription has no scanner appliances, VMDR uses external scanners automatically.
| QID | Detection |
|---|---|
39033 | PHP2Shell, unauthenticated remote detection |
389102 | PHP2Shell, version-based detection |
45110 | PHP Server Detected (identifies PHP; doesn't confirm the vulnerability) |
2a · Add your public hosts
GO TO
VMDR > Assets > Address Management > New > IP Tracked Hosts
VMDR > Assets > Address Management > New
> IP Tracked Hosts
2b · Create a PHP2Shell option profile
OPTIONAL
The Qualys Recommended Option Profile already includes the PHP2Shell QIDs. A dedicated search list and option profile shortens the scan and keeps the results focused on PHP2Shell.
- Go to KnowledgeBase > Search Lists > New > Static List. Create a list named
PHP2Shelland add QIDs45110,39033and389102. Add39036when it is released. - Go to Scans > Option Profiles > New > Option Profile and create a profile named
PHP2Shell-External. On the Scan tab, under Vulnerability Detection, choose Custom and add the PHP2Shell search list. Leave authentication disabled and save.
2c · Launch the scan
GO TO
VMDR > Scans > Scans > New > Scan
Review the findings in ETM
GO TO
ETM > Risk Management > Findings
ETM FINDINGS FILTER · QUALYS VMDR DETECTIONS (QID)
finding.qid:[39033, 389102]
ETM FINDINGS FILTER · ANY SOURCE (CVE)
finding.cveId: CVE-2026-109618 OR finding.cveId: CVE-2026-109619
The CVE filter finds PHP2Shell findings from Qualys and non-Qualys sources, including findings imported through the connectors in Phase 3. For the VMDR scan in this step, focus on QID 39033 or 389102.
| WHAT YOU SEE | WHAT IT MEANS AND WHAT TO DO |
|---|---|
QID 39033 or 389102 | Qualys identified a vulnerable PHP version or remotely validated PHP2Shell conditions. Prioritize with TruRisk scores, internet exposure, asset criticality and business context, then validate in Step 4. |
QID 45110 only | The host runs PHP, but remote assessment couldn't confirm a vulnerable version. These hosts may still need investigation using the authenticated techniques in Phase 2. |
YOU'RE DONE WHEN
You have an inventory of internet-facing PHP systems, initial PHP2Shell findings prioritized by TruRisk, and a list of hosts that need further validation in Phase 2.
RESULTS APPEAR IN
VMDR scan results, ETM > Risk Management > Findings, and the Fightback dashboard.
What is this - PHP2Shell detections on web apps and APIs
YOU NEED
Web application URLs from Step 1, or public PHP apps you know
YOU GET
PHP2Shell detections on web applications and APIs
USED IN
ETM findings and the Step 5 dashboard
A host can pass Step 2 while an application on it still exposes PHP2Shell through its upload or session path. TotalAppSec (or WAS) tests the application itself, again from the Qualys cloud scanners, with no appliance.
NOTE
TotalAppSec is the updated version of Web Application Scanning (WAS). If your subscription still uses WAS, use WAS for this step.
| QID | Detection |
|---|---|
520310 | PHP Remote Code Execution (RCE) vulnerabilities (PHP2Shell) |
533086 | PHP Remote Code Execution vulnerability (PHP2Shell) |
520404 | PHP session upload progress enabled RCE (CVE-2026-115560) |
3a · Add your web applications
GO TO
TotalAppSec (or WAS) > Web Applications > New Web Application
TotalAppSec (or WAS) > Web Applications
> New Web Application
3b · Create a PHP2Shell option profile
- Create a search list with QIDs
520310,533086and520404. - Create an option profile and, under detection scope, select the search list you just created.
3c · Launch the scan
GO TO
TotalAppSec (or WAS) > Scans > New Scan > Vulnerability Scan
TotalAppSec (or WAS) > Scans > New Scan >
Vulnerability Scan
OPTIONAL
To check where the scanner will go before testing, first run Scans > New Scan > Discovery Scan. A discovery scan only crawls and runs no vulnerability checks.
YOU'RE DONE WHEN
You have application-level PHP2Shell detections alongside the host detections from Step 2. Validate the hosts behind any flagged application in Step 4.
RESULTS APPEAR IN
TotalAppSec (or WAS) scan results, ETM > Risk Management > Findings, and the Fightback dashboard.
What is this - Proof of which hosts are reachable and exploitable
YOU NEED
PHP2Shell findings from Steps 2 and 3
YOU GET
Proof of which hosts are reachable and exploitable
USED IN
Your fix-first list in Step 6
Steps 2 and 3 identify hosts running potentially vulnerable versions of PHP. TruConfirm shows which of those hosts are exposed and exploitable from outside your network. It also shows whether your existing security controls and mitigations work as expected, so you can separate theoretical risk from what is genuinely open to attack.
The assessment uses a benign upload probe that simulates the first stage of an attack. It creates no files, executes no code and doesn't affect system resources. A successful validation confirms that the vulnerable entry point is reachable and that the session.upload_progress.enabled=0 mitigation is not in place.
TruConfirm assessments come from a dedicated IP pool, separate from the standard Qualys ranges. Don't allowlist these addresses, so the assessment sees what an attacker would see.
ANONYMIZED DATA
IMPORTANT
TruConfirm assessments come from a dedicated IP pool, separate from the standard Qualys ranges. Don't allowlist these addresses, so the assessment sees what an attacker would see.
Launch the assessment
GO TO
ETM > TruConfirm > Scan > Launch Scan
Review validated findings
GO TO
ETM > Risk Management > Findings > Vulnerabilities
ETM > Risk Management > Findings >
Vulnerabilities
ETM FINDINGS FILTER · VALIDATED PHP2SHELL (QID)
finding.truConfirm.status: "Exploitation Validated" and finding.qid:[39033, 389102]
ETM FINDINGS FILTER · VALIDATED PHP2SHELL (CVE)
finding.truConfirm.status: "Exploitation Validated" and (finding.cveId: CVE-2026-109618 OR finding.cveId: CVE-2026-109619)
| TRUCONFIRM STATUS | MEANING | ACTION |
|---|---|---|
Exploit Validated | Entry point reachable, mitigation absent | Fix first in Step 6. The QVSS is raised. |
Exploit Ruled Out | Blocked by configuration or controls | Patch on your normal cadence. The QVSS is unchanged or lowered. |
Exploit Inconclusive | Could not be determined | Re-run after Step 6, or validate with a Cloud Agent (Phase 2). |
Validation Available | Not yet tested | Include it in your next TruConfirm scan. |
YOU'RE DONE WHEN
You're done whenYou have evidence of which hosts are both vulnerable and reachable from the internet. Those hosts go to the top of your Step 6 queue.
RESULTS APPEAR IN
ETM Findings (TruConfirm status) and the dashboard's validation widgets.
What is this - One view of your PHP posture
YOU NEED
The dashboard file from the Qualys blog
YOU GET
One view of your PHP posture, from exposure to remediation
USED IN
Import it early. It fills in as each scan finishes.
The Qualys Threat Research Unit (TRU) built the PHP2Shell Fightback dashboard to bring the data from Steps 1–4 into one operational view. It shows your PHP footprint, internet-facing exposure, end-of-life PHP deployments, TruConfirm validation results and remediation progress.
| DASHBOARD SECTION | WHAT IT SHOWS |
|---|---|
PHP footprint | Assets running PHP, with supported deployments separated from end-of-life versions |
Exposure and risk | Internet-facing assets, end-of-life software, mod_php deployments and other risk indicators |
Remediation prioritization | PHP2Shell findings by operating system, finding age, validation status and remediation state |
Import the dashboard
- Download the dashboard (.zip) and extract the JSON file.
- In ETM, VMDR or Unified Dashboard, open the Dashboard tab.
- Open the Tools menu (or Manage Dashboards) and select Import New Dashboard.
- Enter
PHP2Shell Fightbackas the dashboard name, click Browse and select the JSON file. - To open the dashboard automatically when you enter the application, select Make this dashboard my default. Click Import.
Keep it one click away
OPTIONAL
- Favorite: open Manage Dashboards, locate the dashboard and select Mark as Favorite from the Quick Actions menu.
- Pin: open the dashboard selector, click the menu beside the dashboard and choose Pin Dashboard (or use the Settings icon on the Dashboard tab). Pinned dashboards stay in the dashboard bar across sessions. You can pin up to five.
NOTE
Widgets populate as scans and assessments complete; TruConfirm widgets populate after Step 4. As Qualys releases new PHP detections and remediation guidance, updated dashboards may become available. Re-import the dashboard to get the latest version.
Query the data directly
OPTIONAL
These CSAM queries from the blog work in CSAM > Inventory > Assets.
ALL ASSETS WITH PHP INSTALLED
(software: ((name: "php")))
ASSETS ON END-OF-LIFE PHP (8.1 AND EARLIER)
((software: (((name: "PHP") AND (version: (*..8.1))))))
END-OF-LIFE PHP ON CRITICAL ASSETS
((asset.criticalityScore: [4..*)) AND (software: (((name: "PHP") AND (version: (*..8.1))))))
YOU'RE DONE WHEN
The dashboard is imported and pinned, so you can monitor exposure, validation and remediation progress in one place.
FIND IT IN
The Dashboard tab of ETM, VMDR or Unified Dashboard.
What is this - Mitigation or patch, verified by rescan
YOU NEED
Findings from Steps 2–4. For scanner-based mitigation, a host login (SSH on Linux).
YOU GET
PHP2Shell mitigated or patched, and a rescan that proves it
USED IN
The Step 2 and Step 4 rescans, plus the dashboard
Work the queue in this order
1
TruConfirm-validated hosts
Exploit Validated in Step 4. These findings carry an amplified TruRisk QVSS score.
2
Internet-facing end-of-life PHP
PHP 8.1 and earlier, outside regular upstream support.
3
Everything else
Remaining PHP2Shell findings, on your normal cadence.
ETM already sorts this for you: validated findings carry an amplified TruRisk QVSS score, and the Fightback dashboard groups high-risk assets by operating system.
Choose your fix
ANY VERSION · CAN'T PATCH YET · PHP 8.1 OR EARLIER
6a · Mitigate now
Works without a patch, including on end-of-life PHP. Without a Cloud Agent, the scanner needs a host login. Otherwise, apply the setting by hand or deploy an agent (Phase 2).
SUPPORTED BRANCH · PHP 8.2 TO 8.5
6b · Patch
Update to the fixed release, then restart every service that loads PHP.
6a · Mitigate now
NO PATCH NEEDED
GO TO
ETM > TruConfirm > Scan > Launch Scan
IMPORTANT
The mitigation doesn't remove every exploitation path. After the change, test any application that relies on upload progress. Updating PHP is the complete fix.
6b · Patch
PHP 8.2–8.5
PHP has released fixed versions for each supported branch:
8.5.12
8.4.27
8.3.36
8.2.35
PHP 8.1 and earlier are outside regular upstream support. Use a fixed build from your OS or support vendor where one exists, or mitigate (6a).
6c · Verify
- Re-run the Step 2 VMDR scan and the Step 4 TruConfirm scan. Validated findings should move to Exploit Ruled Out, and QID 39033/389102 should clear or show the fixed version.
- Watch the Fightback dashboard's detection-state widget. Findings move from Active to Fixed. Reopened means a worker still runs the old build.
Manual fallback
IF YOU CAN'T RUN ELIMINATE ON A HOST YET
Set these values administratively in php.ini, the FPM pool or the Apache configuration, then restart every worker.
| SETTING | BLOCKS |
|---|---|
session.upload_progress.enabled = Off | Confirmed session paths (CVE-2026-109619) |
fatal_error_backtraces = Off (PHP 8.5) | mod_php backtrace path (CVE-2026-109619) |
memory_limit = -1 via php_admin_value post_max_size = 8M (32M with uploads) | Attacker-controllable out-of-memory (CVE-2026-109618) |
State carried over between requests, at a performance cost | Not yet tested |
Keep WAF, IPS and EDR signatures for both CVEs enabled as extra layers. The stopgap controls blog lists the vendor rule IDs.
YOU'RE DONE WHEN
Your validated hosts show Exploit Ruled Out on rescan and the dashboard shows their findings as Fixed.
RESULTS APPEAR IN
TruRisk Eliminate job logs, ETM Findings and the Fightback dashboard.
OPTIONAL · GO DEEPER ONCE YOUR PERIMETER IS COVERED
What is this - Exact PHP packages, versions and install paths
START WITH
Hosts validated in Step 4, and hosts that reported only QID 45110
YOU GET
The exact PHP packages, versions and install paths on each host
ALSO ENABLE
InstaScan, agent-based TruConfirm and agent-based mitigation
External scans assess only what is observable from the internet or your networks. A Qualys Cloud Agent provides host-level visibility, so Qualys can identify the exact PHP packages, versions and installation paths on the system. This matters most for assets where external scanning identified PHP (QID 45110) but couldn't confirm the vulnerability with high confidence.
A Cloud Agent also enables faster detection of newly disclosed vulnerabilities through InstaScan, supports agent-based TruConfirm assessments, and lets TruRisk Eliminate apply mitigations or remediation without scanner-based authentication.
| Requirements | ' |
|---|---|
Network | Outbound HTTPS (TCP 443) from the host to your Qualys platform URL |
Privileges | Local administrator on Windows, or root/sudo on Linux |
Footprint | The VMDR configuration adds about 20 MB of download traffic and uses about 100 MB of local disk per host |
Deploy the agent
GO TO
Cloud Agent > Agent Management > Activation Keys > Generate Key
Cloud Agent > Agent Management >
Activation Keys > Generate Key
- Create an activation key named
PHP2Shell, assign a static tag such asPHP2Shell, select the Vulnerability Management and Patch Management modules, and click Generate. - On the new key, select Quick Actions > Install Agent, then choose Install Instructions for your target operating system.
- Download the installer package (.rpm, .deb, .pkg or .exe) and note the installation command shown on the download screen.
- Install the agent on each target host with elevated privileges. The agent connects to the Qualys platform, retrieves its configuration profile and begins reporting inventory and vulnerability data.
- Verify that the host appears as Activated under Cloud Agent > Agents and is visible in ETM > Assets with the PHP2Shell tag.
Validate hosts the external probe couldn't reach
- Re-run the Step 4 TruConfirm assessment with Validation source: Cloud Agent. TruConfirm can then validate hosts the external probe couldn't reach because of network architecture, access controls or other constraints.
- In Step 6, run the mitigation job as agent-based instead of scanner-based.
WINDOWS: ENABLE DEEP SCAN
On Windows hosts with Cloud Agent 6.2 or later, enable Deep Scan. It finds PHP installed in non-standard directories, on secondary drives and in custom application locations, so duplicate or overlooked PHP binaries don't stay vulnerable after remediation.
ALTERNATIVE: INTERNAL SCANNING WITHOUT AGENTS
To scan internal subnets without agents, deploy a Virtual Scanner Appliance (OVA/VHD) from VMDR > Scans > Appliances > New. For internet-facing PHP2Shell exposure, Cloud Agents typically provide the most complete and actionable visibility.
What is this - EDR and scanner findings next to Qualys findings
YOU NOW HAVE
Host-level evidence of the PHP version, package inventory and vulnerability status of your highest-priority systems, to target patching, mitigation and validation in Step 6.
RESULTS APPEAR IN
Cloud Agent > Agents, ETM > Assets and ETM Findings.
What is this - EDR and scanner findings next to Qualys findings
YOU NEED
A read-only API client in the source tool
YOU GET
PHP2Shell findings from your EDR, XDR, scanner or cloud tools next to Qualys findings
INSTALLS
Nothing. Connectors pull data through an API.
Most organizations already hold PHP exposure data in a tool they run today. An ETM connector pulls it in through an API. EDR/XDR, vulnerability scanner and cloud findings for PHP2Shell then appear beside Qualys findings, and TruConfirm can validate them. Your EDR's own PHP2Shell protections can also count as a compensating control in the TruRisk score.
Set up a connector
GO TO
ETM > Connectors > Integration
- Find the connector in the marketplace and click Add (one time only). Then choose Manage Connections > Create.
- Complete Profile & Connectivity and click Test Connection.
- Choose Data to Sync (assets and findings) and a schedule.
- Review and save. The connector runs once immediately, then on schedule.
After the first sync, connector-sourced assets appear in ETM > Inventory with their inventory source. Risk Management > Findings gains a Source column, so you can filter Qualys and EDR detections for PHP.
Which connector first?
Start with the tools you already run. This list ranks connectors by how much PHP2Shell signal you get for the setup effort. See the full connector catalog.
| RANK | CONNECTOR | WHY IT HELPS WITH PHP2SHELL | DOCS |
|---|---|---|---|
1 | CrowdStrike Falcon (Spotlight) | Installed PHP packages and CVEs per host on every Falcon server; Falcon's PHP2Shell protections count as a control | |
1 | Microsoft Defender for Endpoint V2 | Defender Vulnerability Management inventory and CVEs per machine, Windows and Linux | |
2 | Tenable IO | Direct PHP2Shell plugin results per host; TruConfirm can validate them | |
2 | Rapid7 InsightVM | Findings from your Rapid7 InsightVM estate | |
2 | Tanium | Rich server software inventory; can run the mitigation itself | |
3 | AWS Inspector V2 | PHP CVEs on EC2 instances, AMIs and container images | |
3 | Wiz (VM Assets) | Cloud workload PHP CVEs, where end-of-life images hide | |
3 | Microsoft Defender for Cloud (VM Assets) | Azure VM PHP findings | |
3 | Orca Security (VM Assets) | Agentless cloud workload PHP CVEs | |
4 | SentinelOne, Cortex XDR, Cybereason, Symantec | Endpoint coverage; PHP package data on Linux servers is less consistent | |
4 | Burp Suite, Veracode DAST, Checkmarx DAST | Confirm that an application sits on vulnerable PHP; rarely give the version |
REFERENCE
QIDs, fixed versions and support
PHP2Shell QIDs used in this guide
| QID | Title | Application | Step |
|---|---|---|---|
39033 | PHP2Shell, unauthenticated remote detection | VMDR | 2 |
389102 | PHP2Shell, version-based detection | VMDR | 2 |
45110 | PHP Server Detected (inventory only; doesn't confirm a CVE) | VMDR | 2 |
39036 | PHP session upload progress RCE (CVE-2026-115560), to be released | VMDR | 2 |
520310 | PHP Remote Code Execution (RCE) vulnerabilities (PHP2Shell) | TotalAppSec (or WAS) | 3 |
533086 | PHP Remote Code Execution vulnerability (PHP2Shell) | TotalAppSec (or WAS) | 3 |
520404 | PHP session upload progress enabled RCE (CVE-2026-115560) | TotalAppSec (or WAS) | 3 |
The PHP2Shell blog lists every related QID, including the distribution vendor advisories.
Fixed PHP releases
8.5.12
8.4.27
8.3.36
8.2.35
PHP 8.1 and earlier are outside regular upstream support. Use a fixed build from your OS or support vendor where one exists, or mitigate (Step 6a). Distribution backports can keep older version numbers, so check your vendor's advisory.
Further reading
- PHP2Shell: Find, Mitigate, and Patch Now · Qualys Threat Research Unit
- Can't Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own · Qualys blog
- PHP2Shell emergency briefing · on demand
- PHP2Shell free service
Support during your free service
| | |
|---|---|
Help with your account and the applications in this guide | |
Release notes, user guides and more for every Qualys application | |
Free training on Qualys applications |
