Insignary Releases Free Scanner for PHP2Shell and Node2Shell Vulnerabilities
Insignary has launched a free, read-only tool, insignary-chk, to help organizations detect exposure to critical PHP2Shell and Node2Shell vulnerabilities, both of which are actively exploited and have been added to CISA's KEV catalog.
Insignary, a global open-source security company, has released a new free tool named insignary-chk designed to identify systems vulnerable to two critical runtime vulnerabilities: PHP2Shell and Node2Shell. These vulnerabilities, affecting widely used server-side technologies PHP and Node.js respectively, have been actively exploited in the wild and are now listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, mandating immediate attention from federal agencies and increasing the urgency for all organizations.
PHP2Shell encompasses two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each carrying a CVSS v4.0 score of 9.2. These flaws reside within the PHP runtime itself, meaning they can be exploited without needing to compromise application code. This makes them particularly insidious, as traditional code reviews may not reveal exposure. Servers handling web requests via various PHP configurations, including Apache mod_php, PHP-FPM, and FrankenPHP, are at risk. The PHP Project has issued patches for supported versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35), but older, end-of-life versions remain vulnerable and unpatched.
The Node2Shell vulnerability (CVE-2026-111497) is an out-of-bounds write flaw found in Google's Brotli decompression library, which is bundled with Node.js. When processing specially crafted compressed data, affected applications can crash, leak memory, or allow for remote code execution. Patches are available in Node.js versions 22.23.4, 24.22.1, and 26.12.1. Similar to PHP, older, unsupported Node.js branches (like 20.x) are no longer receiving security fixes, posing an ongoing risk.
The insignary-chk tool is designed for ease of use and security. It is a single, installable file that operates in a read-only mode by default, ensuring no changes are made to the system unless explicitly requested by the user via a --fix option. The scanner checks Linux servers and container images for vulnerable PHP runtimes and Node.js instances. Notably, it also inspects Brotli library copies outside of Node.js, including system-level installations and Python packages, acknowledging that the vulnerability's origin is in the library itself.
Insignary's tool prioritizes findings, presenting results in a ranked order to help security teams focus on the most critical issues. It categorizes findings into "Act now" for vulnerable files used by running processes, "Fix soon" for installed but not actively running software, and "Review" for items requiring manual verification. This tiered approach allows for efficient remediation planning, especially in large or complex environments.
Beyond its standalone functionality, insignary-chk can complement Insignary's commercial product family, Insignary Clarity. Clarity utilizes binary software composition analysis (SCA) to identify components within compiled applications and infrastructure without source code. The --clarity option allows users to cross-reference insignary-chk findings with their existing Clarity server data, enhancing the accuracy and scope of vulnerability detection.
"PHP2Shell and Node2Shell sit in the runtime, not in application code, so reviewing source code alone won’t show whether you’re exposed," stated Taek Wan Kim, President & CEO of Insignary. "We built insignary-chk so any organization can check its Linux servers and containers within minutes, without making changes to its systems, and focus first on the issues that matter most." The tool is available for free download from Insignary's website and currently supports Linux x86_64, with plans for broader platform support in the future.
This release addresses a critical gap in vulnerability detection, particularly for runtime vulnerabilities that are difficult to spot through traditional code scanning. By providing a free, accessible tool, Insignary aims to empower organizations to proactively identify and mitigate risks associated with PHP2Shell and Node2Shell, thereby strengthening their overall security posture against these actively exploited threats.