[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5P0GaraCtJhAZwqr4kwDzTpQ43ncN9V2MdQ9m91LkNc":3},{"article":4,"iocs":55,"watch_terms":65,"solutions":66,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b70f3e36-e9df-43af-ad0b-9b81f001f479","Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure","insignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-ex-aa7c4a","Toronto, Canada, November 6th, 2026, CyberNewswire Free, read-only scanner helps organizations find Linux servers and container images exposed to two actively exploited vulnerabilities in PHP and Node.js Insignary, a global open-source security company, today released insignary-chk, a free tool that checks for PHP2Shell and Node2Shell, two recently disclosed runtime vulnerabilities affecting PHP and Node.js. PHP2Shell […] The post Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure appeared first on Cyber Security News.","Insignary has released a free, read-only scanner called insignary-chk to help organizations identify Linux servers and container images exposed to the PHP2Shell and Node2Shell vulnerabilities. These critical runtime vulnerabilities in PHP and Node.js are actively exploited and have been added to CISA's Known Exploited Vulnerabilities catalog. The tool checks for these flaws, as well as related issues in the Brotli decompression library, and prioritizes findings for urgent attention.","Insignary releases free tool to detect PHP2Shell and Node2Shell vulnerabilities.","https:\u002F\u002Fcybersecuritynews.com\u002Finsignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-exposure\u002F","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjR2BJe1Sq8YsZi51I159IrbS3JJ_QryD7WlctfsPN0Rp02xSkZ_Gd-HeJZ6rw9PyB5Sr43hLCho4Mt8XzCEm-1yM4IccdBBXZYZi5vv5hb-OQP-8su9oi2QSlU1rMN6z_66Q9EPk1w1_HzoOiLxrWslxwPQe0gr74EeTWOmYNqsVfbsaRitUFo6O3rSjk\u002Fs1600\u002FInsignary%20Launches%20Clarity%20On-Demand_%20SBOMs,%20No%20Annual%20Commitment%20Required%20Toronto,%20Canada,%20July%2015th,%202026,%20CyberNewswire%20Enterprise-grade%20binary%20software%20verification%20for%20one%20project,%20one%20team,%20or%20%20(66.webp","2026-11-07T02:06:17+00:00","2026-11-07T03:00:26.667173+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"insignary-chk","product",{"name":21,"type":22},"Insignary","vendor",{"name":24,"type":25},"PHP","technology",{"name":27,"type":25},"Node.js",{"name":29,"type":19},"Brotli",{"name":31,"type":22},"Google","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":32,"icon":34,"name":35,"slug":36},null,"Tools","tools",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62],{"type":57,"value":58,"context":59},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":57,"value":61,"context":59},"CVE-2026-109619",{"type":57,"value":63,"context":64},"CVE-2026-111497","Node2Shell vulnerability",[31,21,18],{"controls":67,"vendors":153},[68,97,125],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":98,"product_name":122,"url":123,"description":124},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":126,"name":127,"problem":128,"products":129},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":148,"url":151,"description":152},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"critical-php-and-nodejs-runtime-vulnerabilities-actively-exploited-in-the-wild","Critical PHP and Node.js Runtime Vulnerabilities Actively Exploited in the Wild","PHP2Shell and Node2Shell represent critical runtime vulnerabilities in two of the most widely deployed web technologies, meaning a vast number of Linux servers and container images are potentially exposed. These flaws have been actively exploited and added to CISA's Known Exploited Vulnerabilities catalog, indicating real-world threat actors are already taking advantage of unpatched systems. The release of a free scanner by Insignary highlights that many organizations still lack adequate visibility into whether their environments are affected. This matters because undetected exposure in runtime environments can lead to full server compromise, data exfiltration, and lateral movement through containerized infrastructure.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":167,"PCI DSS Requirement 6":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; failure to track and patch actively exploited vulnerabilities listed in CISA KEV is a direct violation of this obligation.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems and software by applying security patches in a timely manner, which would have directly prevented exposure to these actively exploited runtime vulnerabilities.","SI-2 mandates that organizations identify, report, and correct information system flaws; had this control been rigorously applied, patches for these critical runtime vulnerabilities would have been deployed before threat actors weaponized them.","PHP and Node.js are third-party runtime components, and A06 specifically warns that using vulnerable or outdated versions of such components is a leading cause of compromise—precisely the risk these vulnerabilities represent.","Regularly scanning for known vulnerabilities like PHP2Shell and Node2Shell—and remediating them on a defined schedule—is exactly what CIS Control 7 requires, which would have identified exposure before active exploitation occurred.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, directly addressing the failure to detect and remediate PHP2Shell and Node2Shell in a timely manner.","While primarily an access control reference, the shell-access nature of PHP2Shell and Node2Shell means that exploitation grants unauthorized runtime access—reinforcing the need to limit and monitor what processes can spawn interactive sessions."]