ANTERAS ASM now allows for impact investigation of the PHP2Shell vulnerability / CVE-2026-109618, CVE-2026-109619, which has been observed to be exploited even before its public release.

On October 21, 2026, vulnerabilities in PHP that allow for unauthenticated remote code execution, CVE-2026-109618 and CVE-2026-109619 (commonly known as PHP2Shell), were publicly disclosed*1. Since the disclosure of these vulnerabilities, numerous attacks attempting to exploit them have been observed.

As of October 22, 2026, Macnica 's ANTERAS Attack Surface Management (ANTERAS ASM) makes it possible to investigate the impact of this vulnerability. ANTERAS ASM externally investigates the usage and versions of PHP in publicly available assets and evaluates whether or not they are affected by this vulnerability. The investigation goes beyond simple version scanning and includes customized investigations tailored to the characteristics of PHP (such as considering backport fixes *2 depending on the Linux distribution and version estimation that does not rely solely on HTTP response headers).
PHP is used in approximately 70% of all websites, and this vulnerability is expected to affect numerous web systems that are written in PHP, such as WordPress, Joomla, and Drupal.

Our independent research has confirmed that approximately 70% of the web assets owned by the Japanese companies surveyed, for which we were able to identify the web framework used, utilize PHP. As of the morning of October 22, 2026, only about 2.5% of the assets using PHP were confirmed to be using a revised or updated version.

This vulnerability is highly likely to be exploited in the future, given the public availability of proof-of-concept (PoC) details regarding its exploitation. After investigating your organization's usage, if you find any websites affected by this vulnerability, please take appropriate measures such as applying patches and conducting breach investigations.

*1 https://www.jpcert.or.jp/at/2026/at260033.html
*2 Backport fixes: This is a method used by Linux distributions (such as Red Hat Enterprise Linux, Ubuntu, and Debian) to provide software such as PHP with only security fixes from newer versions, without changing the version number. In this case, vulnerabilities may be fixed even if the software version number is old.

For more details about ANTERAS ASM, please click here.