Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure
Insignary releases free tool to detect PHP2Shell and Node2Shell vulnerabilities.
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Insignary has released a free, read-only scanner called insignary-chk to help organizations identify Linux servers and container images exposed to the PHP2Shell and Node2Shell vulnerabilities. These critical runtime vulnerabilities in PHP and Node.js are actively exploited and have been added to CISA's Known Exploited Vulnerabilities catalog. The tool checks for these flaws, as well as related issues in the Brotli decompression library, and prioritizes findings for urgent attention.
The lesson from this incident
Full lessonPHP2Shell and Node2Shell represent critical runtime vulnerabilities in two of the most widely deployed web technologies, meaning a vast number of Linux servers and container images are potentially exposed. These flaws have been actively exploited and added to CISA's Known Exploited Vulnerabilities catalog, indicating real-world threat actors are already taking advantage of unpatched systems. The release of a free scanner by Insignary highlights that many organizations still lack adequate visibility into whether their environments are affected. This matters because undetected exposure in runtime environments can lead to full server compromise, data exfiltration, and lateral movement through containerized infrastructure.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
Indicators of Compromise
- cve — CVE-2026-109618
- cve — CVE-2026-109619
- cve — CVE-2026-111497