FOSTER CITY, Calif. - Oct. 23, 2026 - Qualys, Inc. (NASDAQ: QLYS), a leading cloud-native cyber risk management company, today announced it is offering its solutions for free as a service to the community to help organizations detect, validate, and mitigate their exposure to PHP2Shell, two critical vulnerabilities in PHP tracked as CVE-2026-109618 and CVE-2026-109619. The service is free for 15 days for up to 1000 assets from the time of activation.

The vulnerabilities are each rated CVSS v4.0 9.2 and attack traffic has already been reported. Both flaws allow unauthenticated remote code execution, and leaked PHP worker memory can expose passwords, tokens and API keys. While PHP has released fixes for both flaws, the Qualys Threat Research Unit (TRU) found nearly all PHP installations are either vulnerable or running unsupported versions. Over seven in 10 installations are running end-of-life or end-of support versions, for which a patch will not be available.

From anonymized data of more than 10,000 customers globally, the Qualys TRU team found 167 million PHP package installations with 73% of them on internet-facing assets, putting millions of websites and systems within reach of remote attackers.

Among the 156 million PHP package installations with a known version:

• Only 28% that are vulnerable (44 million) run supported branches, PHP 8.2 to 8.5. A fix is available for these versions.
• 110 million (71%) run end-of-life (EOL) or end-of-support (EOS) versions of PHP, from 5.4 to 8.1. Most of these will never get a vendor patch. As upgrading or patching PHP could have a business impact, mitigation is the recommended solution to reduce risk quickly.
• Only 581,000 (0.37%) were patched in the first 24 hours after disclosure.

The free trial includes products across the Qualys TruRisk Platform, including Qualys VMDR, Enterprise TruRisk Management (ETM), and TruRisk Eliminate, so security teams can move from discovery to a verified fix in one workflow.

Qualys solutions enable organizations to:

1. Discover - Detect every vulnerable PHP instance within 60 minutes, including PHP running in containers or bundled inside other applications.
2. Prioritize and validate - Prioritize internet-facing servers and legacy PHP versions, and validate which servers attackers can actually exploit given an organization's existing controls.
3. Patch supported PHP versions - Patch supported PHP versions, then restart PHP services so the fix takes effect.
4. Mitigate unsupported or EOS/ EOL versions - On PHP 8.1 and earlier, apply OS vendor backports where they exist, or isolate those systems and plan to retire them.
5. Verify - Rescan to confirm every exposure has been closed.

"PHP2Shell puts a large share of the web at risk, and over 70% of installations will not have a patch," said Shailesh Athalye, chief product solutions officer of Qualys. "With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately. Qualys is making our services available so organizations can find, prioritize and close these exposures before they are exploited."

For more information, visit qualys.com/php2shell-risk-assessment.

Additional Resources

• Read the Qualys Threat Research Unit blog on the PHP critical security release
• Sign up for the PHP2Shell free trial
• Follow Qualys on LinkedIn, Instagram and X

###

About Qualys

Qualys, Inc. (NASDAQ: QLYS) is a leading cloud-native cyber risk management company, helping organizations measure, communicate, and eliminate cyber risk. The Qualys platform and its solutions power the Risk Operations Center (ROC), unifying asset visibility, exposure management, risk prioritization, and remediation to help organizations continuously reduce risk across hybrid, multi-cloud, endpoint, and AI environments. Qualys equips security and IT teams for the Frontier AI Era with AI-speed detection, hyper-prioritization, and autonomous remediation. Trusted by more than 10,000 organizations globally, including most of the Fortune 100, Qualys helps customers transform cybersecurity into a measurable business function that strengthens resilience and drives business outcomes. For more information, visit www.qualys.com.

Media Contact:

Rachel Winship

Qualys

[email protected]

Media Contact:
Tami Casey
Qualys
[email protected]