PHP2Shell and Node2Shell: Find, Fix, and Verify Across Your Web Apps and APIs | Qualys
Summary: Fixes for PHP2Shell and Node2Shell shipped on October 21, and CISA added PHP2Shell to its Known Exploited Vulnerabilities catalog on October 26 and Node2Shell on October 27, after Amazon Threat Intelligence saw attackers probing PHP2Shell four days before patches existed. Qualys Threat Research Unit data on more than 10,000 customers found 167 million PHP installations, with 73% of the 156 million identifiable versions on internet-facing assets, about 71% running end-of-life or end-of-support versions, and only 199,000 patched in the first 12 hours after disclosure.
What's compelling: Roughly 71% of the identifiable PHP installations sit on end-of-life versions that will likely never receive a vendor patch, and only 199,000 were patched in the first 12 hours - so for most of that estate, an upgrade path does not exist and the exposure has to be managed some other way.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-111497
- Related
- Siemens Industrial Edge Management Cyber Risks · Nov 12, 2026Siemens Desigo, Gridscale Cyber Risks · Nov 12, 2026Node2Shell (CVE-2026-111497) in active exploitation Cyber Risks · Oct 28, 2026