Penta Security launches PHP2Shell exposure check and WAF response rules

Penta Security has introduced Cloudbric Security Check to help organizations quickly identify whether websites are exposed to newly disclosed PHP remote code execution flaws known as PHP2Shell. The company also pushed response rules to WAPPLES and Cloudbric WAF+ to help block attacks while affected systems are patched.

Why it matters: - PHP2Shell vulnerabilities can be exploited without authentication. - Organizations that cannot patch immediately need a faster way to assess exposure and reduce risk. - Penta Security’s new tools are aimed at helping teams identify affected environments and apply temporary protections.

What happened: - Penta Security launched Cloudbric Security Check in response to the newly disclosed PHP remote code execution vulnerabilities known as PHP2Shell. - The service lets organizations check whether a website may be exposed and see recommended remediation steps. - Penta Security also distributed custom rules and configuration guidance to WAPPLES intelligent web application firewall customers. - The company applied the same response rules to Cloudbric WAF+, its SaaS-based web security service.

The details: - Cloudbric Security Check requires no software installation. - Users enter a website URL to identify the externally exposed PHP version and assess whether the site may be affected by major vulnerabilities. - The service provides response measures and their priority order based on the results. - Penta Security said the assessment is non-intrusive and checks server response information without attempting to exploit vulnerabilities. - Results are returned within seconds. - The service is available through the Penta Security and Cloudbric websites. - If the PHP version cannot be identified through the website check alone, Penta Security provides an assessment script. - The script lets users check the PHP version installed on the server and related configuration settings directly. - The service is available in English, Korean and Japanese. - PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. - The two vulnerabilities affect PHP remote code execution and can be exploited without authentication. - The primary fix is to update to a PHP version where the vulnerabilities have been patched. - If immediate patching is difficult, a web application firewall can block exploit attempts and help mitigate risk until updates are applied.

Between the lines: - Penta Security is positioning the service as a fast triage tool for organizations that may not know their external PHP version or full exposure. - The company is also leaning on layered defense, combining exposure checking with firewall rules for short-term protection. - Jihae Lee, Penta Security’s chief compliance officer, said organizations need security response to keep pace as AI and automation accelerate vulnerability analysis and attacks. - Lee also said the Cloudbric Security Check site is meant to help organizations quickly understand exposure, identify response measures and take action.

What's next: - Organizations using PHP will need to confirm whether their public-facing systems are affected. - Affected teams are expected to prioritize patching to a fixed PHP version. - Where patching is delayed, security teams can use WAF-based blocking and the new response rules as interim protection. - Penta Security’s assessment script gives administrators another path to verify server-side PHP versions and configuration details.

The bottom line: - Penta Security is pairing vulnerability checking with defensive rules to help organizations move faster on PHP2Shell exposure and mitigation.