{
  "type": "playbook",
  "slug": "php2shell-response-playbook",
  "name": "PHP2Shell Response Playbook",
  "author": "jtbuchanan-tenb",
  "description": "Find, fix and hunt PHP2Shell (CVE-2026-109618, CVE-2026-109619) with three Exchange skills in one Claude Code command.",
  "github_url": "https://github.com/jtbuchanan-tenb/php2shell-playbook",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "php2shell",
    "cve-2026-109618",
    "cve-2026-109619",
    "php",
    "rce",
    "remediation",
    "threat-hunting"
  ],
  "integrations": [
    "Tenable",
    "Tenable Hexa AI MCP",
    "Splunk",
    "Microsoft Sentinel"
  ],
  "domains": [
    "vulnerability-management",
    "security-operations"
  ],
  "date_added": "2026-10-23",
  "last_reviewed": "2026-10-23",
  "works_with_tenable_hexa_mcp": true,
  "playbook_type": "standard",
  "agents_used": [
    {
      "name": "PHP2Shell Tenable Skill",
      "role": "Find it: grades every asset against the fixed PHP releases from Tenable One data.",
      "type": "exchange",
      "ref": "skills/php2shell-tenable-skill"
    },
    {
      "name": "Remediation Priority & Impact Agent",
      "role": "Fix it: ranks the PHP2Shell hosts by exposure and attack path, with Tenable's exact fix.",
      "type": "exchange",
      "ref": "skills/remediation-priority-impact-agent"
    },
    {
      "name": "SOC-Hunter",
      "role": "Hunt for it: hunts for exploitation across SIEM, EDR and Tenable data, back to Oct 17.",
      "type": "exchange",
      "ref": "skills/soc-hunter"
    }
  ],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-10-23T20:22:52Z",
    "stars": 1,
    "forks": 0,
    "open_issues": 0,
    "owner_type": "user",
    "language": "Python",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/playbooks/php2shell-response-playbook",
  "json_url": "https://exchange.tenable.com/api/playbooks/php2shell-response-playbook.json",
  "markdown_url": "https://exchange.tenable.com/playbooks/php2shell-response-playbook.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/playbooks/php2shell-response-playbook.md"
}