Free, read-only scanner assists companies discover Linux servers and container images exposed to 2 actively made use of vulnerabilities in PHP and Node.js
Insignaryan international open-source security business, today launched insignary-chk, a totally free tool that look for PHP2Shell and Node2Shell, 2 just recently divulged runtime vulnerabilities impacting PHP and Node.js.
PHP2Shell describes 2 vulnerabilities in the PHP runtime( CVE-2026-109618 and CVE-2026-109619), each ranked 9.2 (Critical) under CVSS v4.0, that can permit an unauthenticated enemy to perform code from another location. Servers that deal with web demands with PHP are at threat, consisting of releases utilizing Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. The PHP Project launched repairs on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier have actually reached end of life and no longer get authorities releases. Since the defects being in the runtime itself instead of in application code, code evaluation alone can not expose them, so companies likewise require to discover PHP circumstances bundled inside supplier software application and container images.
Node2Shell (CVE-2026-111497) is an out-of-bounds compose defect in Google’s Brotli decompression library, which Node.js packages. Specifically crafted compressed information can crash an afflicted application, expose its memory, or permit remote code execution. The problem is repaired in Node.js 22.23.4, 24.22.1, and 26.12.1. Node.js’s main end-of-life policy deals with any unsupported branch (e.g., 20.x and earlier) as bring continuous danger as soon as support ends, because no more security repairs are provided. insignary-chk shows this by style: it does not flag EOL branches like Node.js 20.x as “Likely susceptible”; rather, it surface areas them as “Check with OS supplier” when set up from a Linux circulation bundle, or “Unable to figure out” when set up from nodejs.org or developed from source, so administrators can validate the real spot status with their supplier or upgrade to a supported release. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has actually included both PHP2Shell and Node2Shell to its Known Exploited Vulnerabilities brochure.
insignary-chk is a file that needs no setup or registration. It is read-only by default: it just checks out files, never ever runs what it discovers, and makes no modifications unless the user picks the– repair choice. It sends out no information over the network, other than when the user picks a choice that links to an address they define. Due to the fact that Node2Shell comes from the Brotli library, insignary-chk likewise checks Brotli copies outside Node.js, consisting of the system Brotli library and Python’s brotli bundle. End-of-life PHP variations are similarly flagged for evaluation versus the Linux circulation’s security advisory, or for upgrade to a supported release. Outcomes are ranked by top priority, so groups can see at a look which problems require immediate attention.
The report’s order of business is arranged by seriousness:”Act now”for susceptible files in usage by a running procedure,” Fix quickly “for susceptible software application that is set up however not running, and “Review” for products that require a manual check, followed by comprehensive findings for each server or container image.
insignary-chk matches the Insignary Clarity item household. Insignary Clarity utilizes the business’s trademarked binary software application structure analysis (SCA) to determine parts and variations inside assembled applications, firmware, IT facilities, and container images, without needing source code. Insignary Clarity SC brings arise from Clarity, Clarity AIR, third-party SCA tools, and imported SBOMs (software application costs of products) into one platform, and maps freshly revealed CVEs to existing SBOMs without rescanning. Users who currently run Clarity can utilize insignary-chk’s– clearness choice to verify its findings with binary analysis by themselves Clarity server.
“PHP2Shell and Node2Shell being in the runtime, not in application code, so examining source code alone will not reveal whether you’re exposed,” stated Taek Wan Kim, President & & CEO of Insignary“We constructed insignary-chk so any company can examine its Linux servers and containers within minutes, without making modifications to its systems, and focus initially on the problems that matter many.”
insignary-chk is readily available as a totally free download, without any sign-up needed, at www.insignary.com/free-tools/php2shell-node2shell-checker. It works on Linux x86_64 and checks just the 3 CVEs noted above. Windows, macOS, and arm64 are not yet supported.
About Insignary
Insignary Inc. is a Toronto-based cybersecurity business focusing on binary structure analysis and software application supply chain security. Its trademarked innovation allows companies to determine open-source software application parts, vulnerabilities, and software application provenance straight from put together binaries without needing access to source code. The business serves business, federal governments, and software application suppliers around the world and is backed by tactical financiers and partners consisting of BearingPoint in Europe, Cybertrust Japan and TechMatrix in Japan, and TMA Solutions. Through its worldwide partner community, Insignary supports software application supply chain security efforts throughout North America, Europe, and Asia. To learn more, go to www.insignary.com
Contact
Principal Solutions Architect
Jessica Lee
Insignary
[email protected]
Discover more from PMN S.P.O.R.T.S - A PRIME MEDIA NETWORK BRAND
Subscribe to get the latest posts sent to your email.
