PHP2shell: Prove It, Don't Assume It

On October 21, 2026, the PHP Project released fixed builds for two flaws that together let an unauthenticated attacker run code at the privilege of the web server account.

The details leaked a day early, and honeypot operators recorded probing attempts within hours, with at least one network reporting an attempt four days before disclosure.

The teams we have spoken with are trying to answer three questions: Where do we run PHP? And on which branch? And then: could anyone actually get in?

This whitepaper helps you answer those questions. Download it to understand:

• The details of PHP2shell
• Why a PHP inventory is not enough
• Why validation of PHP2shell is critical, and what it should look like
• How XBOW can help identify and validate PHP2shell