PHP2Shell free service · Onboarding guide
Find and fix PHP2Shell on your internet-facing assets
This guide takes you from your first login to a verified fix. Each step tells you which application to open, what to scan and where your results appear.
15 days
Free service, from activation
1,000
Assets, maximum
Cloud
Scans run from the Qualys cloud
Steps 1-5
No agents, appliances or credentials
Table of Contents
START HERE
Three questions to answer before you begin
01
Which application do I open?
Start in CSAM. Every step names its application.
Open applications from the Application Picker in the upper-left corner of the Qualys platform.
02
What do I scan?
Your domains first. Nothing inside your network.
OEASM turns your domains into a list of public IPs and web applications (Step 1). You scan those hosts in Step 2 and those applications in Step 3, all from the Qualys cloud.
03
Where do my results appear?
ETM Findings and the Fightback dashboard.
Every detection appears in ETM > Risk Management > Findings. The dashboard you import in Step 5 brings them together in one view.
00 · BEFORE YOU START
Log in and find your applications
Your Registration – Start Now email contains your login credentials and a one-time link to your Qualys platform. The link works only once, so open it from the email when you are ready to begin.
Log in
- Open the link in the email and log in. Note your platform URL, for example
qualysguard.qg2.apps.qualys.com. If you have trouble, see the Login FAQ. - On first login, accept the End User License Agreement (EULA). The Qualys home page opens.
- Open the Application Picker in the upper-left corner. Your free service includes the applications used in this guide:
- CyberSecurity Asset Management (CSAM), including External Attack Surface Management (EASM)
- Vulnerability Management, Detection and Response (VMDR)
- TotalAppSec (or WAS), the updated version of Web Application Scanning
- Enterprise TruRisk Management (ETM)
- TruRisk Eliminate
- Keep the PHP2Shell blog open in a separate browser tab. It contains the QIDs, queries and dashboard download this guide uses.
Have this information ready
| Information | Used in |
|---|---|
Your organization's primary domains | Step 1 |
IP ranges, ASNs or certificate subjects your organization owns (optional) | Step 2 |
Public IP addresses or FQDNs of your PHP web servers, if known | Step 3 |
Your public web application URLs | Step 4 |
SAVE TIME
NOTE
Steps 1-5 need no Qualys Scanner Appliance, Cloud Agent or server credentials. Mitigating through the scanner in Step 6 needs a host login (SSH on Linux). If you can't share credentials, you can apply the setting by hand or deploy a Cloud Agent. Step 6 covers each option.
YOUR STEPS
Six steps from domain list to verified fix
Select a step to see what to do. Steps 1–4 find PHP2Shell and prove which hosts are exploitable. Steps 5–6 bring it into one view and fix it.
PHASE 1 · FIND PHP2SHELL (REQUIRES ONLY DOMAINS AND PUBLIC IP ADDRESSES)
OPTIONAL · GO DEEPER ONCE YOUR PERIMETER IS COVERED
REFERENCE
QIDs, fixed versions and support
PHP2Shell QIDs used in this guide
| QID | Title | Application | Step |
|---|---|---|---|
39033 | PHP2Shell, unauthenticated remote detection | VMDR | 2 |
389102 | PHP2Shell, version-based detection | VMDR | 2 |
45110 | PHP Server Detected (inventory only; doesn't confirm a CVE) | VMDR | 2 |
39036 | PHP session upload progress RCE (CVE-2026-115560), to be released | VMDR | 2 |
520310 | PHP Remote Code Execution (RCE) vulnerabilities (PHP2Shell) | TotalAppSec (or WAS) | 3 |
533086 | PHP Remote Code Execution vulnerability (PHP2Shell) | TotalAppSec (or WAS) | 3 |
520404 | PHP session upload progress enabled RCE (CVE-2026-115560) | TotalAppSec (or WAS) | 3 |
The PHP2Shell blog lists every related QID, including the distribution vendor advisories.
Fixed PHP releases
8.5.12
8.4.27
8.3.36
8.2.35
PHP 8.1 and earlier are outside regular upstream support. Use a fixed build from your OS or support vendor where one exists, or mitigate (Step 6a). Distribution backports can keep older version numbers, so check your vendor's advisory.
Further reading
- PHP2Shell: Find, Mitigate, and Patch Now · Qualys Threat Research Unit
- Can't Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own · Qualys blog
- PHP2Shell emergency briefing · on demand
- PHP2Shell free service
Support during your free service
| | |
|---|---|
Help with your account and the applications in this guide | |
Release notes, user guides and more for every Qualys application | |
Free training on Qualys applications |
