[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP6-wr-umh_bA-hW_ogqDYO1LeP2gyH_mHHcVOnS4WIc":3},{"article":4,"iocs":55,"watch_terms":65,"solutions":66,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"487a8d66-31bc-4c1e-b193-deee6bf6f1c4","Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure","insignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-ex-456f89","Toronto, Canada, 6th November 2026, CyberNewswire","Insignary has released a free, read-only scanner called insignary-chk to help organizations identify exposure to PHP2Shell and Node2Shell vulnerabilities. These critical vulnerabilities, affecting PHP and Node.js respectively, allow for remote code execution and have been added to CISA's Known Exploited Vulnerabilities catalog. The tool checks Linux servers and container images, even for vulnerabilities within bundled libraries like Brotli, and prioritizes findings for urgent attention.","Insignary releases free tool to detect PHP2Shell and Node2Shell vulnerabilities.","https:\u002F\u002Fhackread.com\u002Finsignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-exposure\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Finsignary_logo_1791211062PNrqmaRSIt.jpg","2026-11-06T12:50:05+00:00","2026-11-06T13:00:34.55785+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"insignary-chk","product",{"name":21,"type":22},"Insignary","vendor",{"name":24,"type":25},"PHP","technology",{"name":27,"type":25},"Node.js",{"name":29,"type":19},"Brotli",{"name":31,"type":22},"Google","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62],{"type":57,"value":58,"context":59},"cve","CVE-2026-109618","PHP2Shell vulnerability in PHP runtime",{"type":57,"value":61,"context":59},"CVE-2026-109619",{"type":57,"value":63,"context":64},"CVE-2026-111497","Node2Shell vulnerability in Node.js Brotli decompression library",[31,21,18],{"controls":67,"vendors":151},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":127,"name":128,"problem":129,"products":130},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[131,139,146],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":141,"url":144,"description":145},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":147,"product_name":148,"url":149,"description":150},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":163},"php2shell-and-node2shell-rce-vulnerabilities-highlight-need-for-continuous-scanning","PHP2Shell and Node2Shell RCE Vulnerabilities Highlight Need for Continuous Scanning","Critical remote code execution vulnerabilities in PHP (PHP2Shell) and Node.js (Node2Shell) have been added to CISA's Known Exploited Vulnerabilities catalog, signaling active exploitation in the wild. A key complexity highlighted by this incident is that exposure can exist not just in directly installed packages but also within bundled or nested libraries—such as Brotli—making manual tracking unreliable. Organizations without automated vulnerability scanning across their servers and container images may remain exposed without knowing it. The release of a free detection tool underscores how widespread the exposure likely is, and how urgently organizations need structured processes to discover and remediate these flaws before attackers exploit them.",[157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":164,"PCI DSS Requirement 6":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"OWASP A06:2021 Vulnerable and Outdated Components":167,"CIS Control 7: Continuous Vulnerability Management":168,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":169},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities, requiring organizations to act promptly on known exploited vulnerabilities such as those catalogued by CISA.","Requirement 6 mandates the development and maintenance of secure systems by identifying and patching vulnerabilities in a risk-ranked, timely manner, which would have compelled remediation of these critical RCE flaws.","SI-2 requires organizations to identify, report, and correct information system flaws, and to test updates before installation—a process that would have ensured timely patching of these critical RCE vulnerabilities.","This risk category directly addresses the danger of using components—including nested libraries like Brotli—with known vulnerabilities, and mandates continuous inventory and monitoring of all dependencies.","Regularly scanning for known vulnerabilities—including within bundled libraries—and remediating them on a defined schedule is exactly what would have surfaced PHP2Shell and Node2Shell exposure before attackers exploited them.","A.8.8 requires timely identification and remediation of technical vulnerabilities across the organization's technology assets, which would have driven structured scanning and patching for PHP2Shell and Node2Shell."]