Qualys offers free services to find and fix PHP2Shell flaws

Qualys is providing free 15-day access to its platform to help organizations detect and remediate the two critical PHP2Shell PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Qualys TRU found 71% of 156 million PHP installations run unsupported versions with no patch, and only 0.37% were patched in the first 24 hours.

• Free 15-day access for up to 1,000 assets
• Both flaws rated CVSS 9.2 allow unauthenticated RCE
• 71% of 156M PHP installs run EOL/EOS versions 5.4–8.1
• Only 0.37% patched within the first 24 hours