PHP2Shell Response Playbook

Two critical CVEs let an unauthenticated attacker run code on any PHP that serves web requests, from PHP-FPM to mod_php. This playbook runs Tenable’s three-step response from the briefing: find the exposed hosts, fix them in the right order, and hunt for signs they were hit first.

• 📄 Read the briefing (PDF): Find, fix and hunt PHP2Shell, 7 slides. Share it with your team.
• ▶ Run it: /php2shell-playbook: runs all three steps in Claude Code and saves a handoff file after each.

PHP2Shell at a glance

9.2	CVSS v4.0 on both CVEs, no login needed
1.3M+	Internet-facing hosts that may be vulnerable
Oct 17	First exploitation attempt seen, four days before disclosure
8.1 and older	No official fix: upgrade

Fixed releases: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35

Interim only, until you can patch: memory_limit=-1 and session.upload_progress.enabled=0, then restart every PHP worker. On PHP 8.5, also set fatal_error_backtraces=0.

Source: Tenable Research PHP2Shell FAQ, Oct 21, 2026. The FAQ is updated continuously, so check it for current guidance. The playbook re-reads it on every run.

What it does

Step 1: Find it. Where are we exposed?

PHP2Shell Tenable Skill pulls PHP2Shell findings and PHP inventory from Tenable One through Hexa AI MCP, grades every asset against the fixed PHP releases, and writes an HTML, PDF and CSV report naming the ten worst assets.

Step 2: Fix it. What do we fix first?

Remediation Priority & Impact Agent ranks the hosts from step 1 by Asset Exposure Score, confirmed exploitation and attack path, as a FIRST / NEXT / SOON plan with Tenable’s exact fix for each. The playbook keeps only PHP2Shell hosts and CVEs, and lists anything else as out of scope.

Step 3: Hunt for it. Were we hit before we patched?

SOC-Hunter hunts for exploitation since Oct 17. It covers every host Tenable saw running PHP, patched ones included, and looks for PHP workers starting shells, curl or wget, new .php files under web roots, and outbound connections from PHP workers, across your SIEM, EDR and Tenable data. No SIEM or EDR connected? The playbook writes a hunt kit of ready-to-paste searches for Splunk, Microsoft Defender XDR / Sentinel and Elastic, plus a manual checklist.

How it works

/php2shell-playbook runs the three skills in order. After each step it writes a handoff file, in Markdown and JSON, and asks before going on. The vulnerability manager can stop after Fix it, and the SOC lead picks up from the handoff with /php2shell-playbook hunt <run folder>. The playbook only reads data: it never patches, scans or changes anything in Tenable, a SIEM, an EDR or a host.

Run all three today

1. Connect Tenable Hexa AI MCP. The playbook walks you through it if it’s missing.
2. Install the three skills and this playbook (see the README). The playbook offers to install any skill that’s missing.
3. Run /php2shell-playbook. Stop after any step; whoever runs the next step picks up from its handoff file.