Do You Know If Your PHP Systems Are Actually Exposed?
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have put organisations around the world on alert. The UK’s National Cyber Security Centre (NCSC) is encouraging organisations to take immediate action, prioritising internet-facing PHP systems. Both vulnerabilities could, under certain conditions, allow an unauthenticated attacker to achieve remote code execution on an affected system. The immediate priority is clear: identify affected systems and patch them.
But for security teams managing hundreds or thousands of internet-facing assets, there is another important question: Do you know which systems represent a genuine, exploitable route into your organisation?
Why PHP2Shell Matters
PHP sits behind a huge number of websites, applications and other products. The NCSC recommends that organisations identify systems running PHP across their infrastructure, prioritise those that are internet-facing and update them to fixed versions.
CERT-EU has also warned that technical details and initial proof-of-concept exploits are circulating. That creates urgency. But it also highlights a wider problem faced by security teams whenever a major vulnerability appears. Knowing that a vulnerability exists is not the same as understanding your organisation’s actual exposure.
The Difference Between Vulnerable and Exploitable
Traditional vulnerability management may identify an affected version of PHP and generate a Critical finding. That’s important information. But a CISO or SOC still needs to answer:
- Where is PHP running?
- Which systems are externally accessible?
- Which affected systems are genuinely reachable by an attacker?
- Could an exposure actually be exploited?
- Could it form part of a wider attack path?
- Which systems should we prioritise first?
This is where Adversarial Exposure Validation, or AEV, becomes particularly relevant.
How Armory Defense Can Help
Armory Defense is an offensive security platform designed to continuously discover, test and validate potential attack paths across an organisation’s external environment. Rather than simply adding another vulnerability to the list, Armory approaches the environment from an attacker’s perspective.
For an incident such as PHP2Shell, an authorised Armory assessment can help organisations understand their external attack surface, identify potentially relevant internet-facing assets and determine where further investigation and remediation should be prioritised.
Armory combines:
- Next-Generation EASM to discover and monitor the external attack surface.
- Exposure Intelligence to provide additional context around external exposures.
- Offensive Agentic AI to simulate attacker behaviour and investigate potential attack paths.
- Human-controlled validation to provide evidence and context around validated findings.
The objective isn’t to generate more alerts. It’s to help answer:
“What could an attacker actually use against us?” go to Armory Defense page to learn more
EASM Finds the Exposure. AEV Validates the Risk.
PHP2Shell also demonstrates the difference between External Attack Surface Management and Adversarial Exposure Validation.
EASM asks: What is exposed? It helps organisations discover internet-facing systems, services and infrastructure.
AEV asks: Can it actually be exploited? It takes the next step by safely testing and validating potential attack paths within an authorised scope.
That distinction becomes particularly valuable when security teams are dealing with an emergency vulnerability and need to decide where to focus limited remediation resources.
Don’t Wait for the Next Critical CVE
PHP2Shell is today’s problem. Tomorrow it will be something else. The underlying challenge remains the same. External environments constantly change. New applications are deployed. Cloud infrastructure changes. APIs appear. Services become exposed. Suppliers connect to organisations. Credentials leak. New vulnerabilities are discovered.
A penetration test performed three months ago cannot assess an asset that appeared yesterday. That’s why continuous exposure validation is becoming increasingly important.
Instead of asking only: “What vulnerabilities do we have?” Security teams can begin asking: “Which of our exposures could an attacker actually use today?”
What Should Organisations Do About PHP2Shell Now?
The first priority remains remediation. Identify PHP installations across your environment, prioritising internet-facing systems, and apply the relevant security updates as quickly as possible.
The fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations running older or unsupported PHP versions should follow the relevant vendor and NCSC guidance. Where immediate remediation is not possible, organisations should follow the temporary mitigation and isolation guidance provided by PHP, NCSC and CERT-EU.
Offensive validation should complement this process, not replace patching.
Put Armory Defense to the Test
Wise Distribution is working with Armory Defense to bring continuous Adversarial Exposure Validation to UK organisations.
Armory offers a 14-day trial against an agreed and authorised scope, allowing security teams to see how the platform discovers, tests and validates potential exposures within their own external environment.
Don’t just find the vulnerability. Understand whether it could become an attack path.
Talk to Wise Distribution about a 14-day Armory Defense trial.