TORONTO, Nov. 06, 2026 (GLOBE NEWSWIRE) --
Free, read-only scanner helps organizations find Linux servers and container images exposed to two actively exploited vulnerabilities in PHP and Node.js
Insignary, a global open-source security company, today released insignary-chk, a free tool that checks for PHP2Shell and Node2Shell, two recently disclosed runtime vulnerabilities affecting PHP and Node.js.
PHP2Shell refers to two vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619), each rated 9.2 (Critical) under CVSS v4.0, that can allow an unauthenticated attacker to execute code remotely. Servers that handle web requests with PHP are at risk, including deployments using Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. The PHP Project released fixes on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier have reached end of life and no longer receive official releases. Because the flaws sit in the runtime itself rather than in application code, code review alone cannot reveal them, so organizations also need to find PHP instances bundled inside vendor software and container images.
Node2Shell (CVE-2026-111497) is an out-of-bounds write flaw in Google’s Brotli decompression library, which Node.js bundles. Specially crafted compressed data can crash an affected application, expose its memory, or allow remote code execution. The issue is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. Node.js’s official end-of-life policy treats any unsupported branch (e.g., 20.x and earlier) as carrying ongoing risk once support ends, since no further security fixes are issued. insignary-chk reflects this by design: it does not flag EOL branches like Node.js 20.x as “Likely vulnerable”; instead, it surfaces them as “Check with OS vendor” when installed from a Linux distribution package, or “Unable to determine” when installed from nodejs.org or built from source, so administrators can verify the actual patch status with their vendor or upgrade to a supported release. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both PHP2Shell and Node2Shell to its Known Exploited Vulnerabilities catalog.
insignary-chk is a single file that requires no installation or registration. It is read-only by default: it only reads files, never runs what it finds, and makes no changes unless the user chooses the --fix option. It sends no data over the network, except when the user chooses an option that connects to an address they specify. Because Node2Shell originates in the Brotli library, insignary-chk also checks Brotli copies outside Node.js, including the system Brotli library and Python’s brotli package. End-of-life PHP versions are likewise flagged for review against the Linux distribution’s security advisory, or for upgrade to a supported release. Results are ranked by priority, so teams can see at a glance which issues need urgent attention.
The report’s to-do list is sorted by urgency: “Act now” for vulnerable files in use by a running process, “Fix soon” for vulnerable software that is installed but not running, and “Review” for items that need a manual check, followed by detailed findings for each server or container image.
insignary-chk complements the Insignary Clarity product family. Insignary Clarity uses the company’s patented binary software composition analysis (SCA) to identify components and versions inside compiled applications, firmware, IT infrastructure, and container images, without requiring source code. Insignary Clarity SC brings results from Clarity, Clarity AIR, third-party SCA tools, and imported SBOMs (software bills of materials) into one platform, and maps newly disclosed CVEs to existing SBOMs without rescanning. Users who already run Clarity can use insignary-chk’s --clarity option to confirm its findings with binary analysis on their own Clarity server.
“PHP2Shell and Node2Shell sit in the runtime, not in application code, so reviewing source code alone won’t show whether you’re exposed,” said Taek Wan Kim, President & CEO of Insignary. “We built insignary-chk so any organization can check its Linux servers and containers within minutes, without making changes to its systems, and focus first on the issues that matter most.”
insignary-chk is available as a free download, with no sign-up required, at www.insignary.com/free-tools/php2shell-node2shell-checker. It runs on Linux x86_64 and checks only the three CVEs listed above. Windows, macOS, and arm64 are not yet supported.
About Insignary
Insignary Inc. is a Toronto-based cybersecurity company specializing in binary composition analysis and software supply chain security. Its patented technology enables organizations to identify open-source software components, vulnerabilities, and software provenance directly from compiled binaries without requiring access to source code. The company serves enterprises, governments, and software vendors worldwide and is backed by strategic investors and partners including BearingPoint in Europe, Cybertrust Japan and TechMatrix in Japan, and TMA Solutions. Through its global partner ecosystem, Insignary supports software supply chain security initiatives across North America, Europe, and Asia. For more information, visit www.insignary.com.
Contact
Principal Solutions Architect
Jessica Lee
Insignary
jessicalee@insignary.com
Photos accompanying this announcement are available at:
https://www.globenewswire.com/NewsRoom/AttachmentNg/bce00d4b-2ca4-4138-bfc0-9adce6b0a78d
https://www.globenewswire.com/NewsRoom/AttachmentNg/c75d2c5d-0945-4185-a406-8020c6ed9bcb
https://www.globenewswire.com/NewsRoom/AttachmentNg/01919b88-d315-44b6-90a2-5be658119390
