# PHP2Shell Tenable Remediation Tracker

> Tracks PHP2Shell and Node2Shell remediation from Tenable data with SLA tracking, VPR and run-to-run comparison.

- Type: Skill
- Author: rafansmpj
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-10-26
- Source repository: https://github.com/rafansmpj/php2shell-tenable-remediation-tracker
- Repo state: not archived
- Last push: 2026-10-26T11:30:39Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: vulnerability-management
- Tags: php2shell, node2shell, cve-2026-109618, cve-2026-109619, cve-2026-111497, remediation-tracking, sla
- Date added: 2026-10-26
- Works with the Tenable Hexa AI MCP server: yes
- Compatible platforms: Claude Code, Claude Desktop, Claude Cowork
- Invocation: `/php2shell-tenable-remediation-tracker`
- Listing page: https://exchange.tenable.com/skills/php2shell-tenable-remediation-tracker
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/php2shell-tenable-remediation-tracker.md

Tracks exposure to and remediation of PHP2Shell, the pre-auth PHP remote code execution disclosed on 2026-10-21 (CVE-2026-109618, CVE-2026-109619), using live data from the Tenable Hexa AI MCP. It also tracks the related Node2Shell Brotli decoder RCE (CVE-2026-111497: Node.js, libbrotli, Python Brotli) in a separate section that is kept out of the PHP2Shell numbers. Every run produces an HTML, PDF and CSV report and adds to an execution history, so each new report shows what changed since the last one. The skill is read-only and never launches scans or changes anything in Tenable.

## What it does

- Asks up front whether this is the first run, which language the report should use (English, Portuguese-BR, Spanish or a custom translation) and which remediation SLA to measure against (7 days by default).
- Searches Tenable for every plugin mapped to each CVE on every run (WAS, VM and Cloud/container), so new distro and container checks are picked up automatically instead of relying on a fixed plugin list.
- Collects vulnerable (ACTIVE/RESURFACED) and fixed (FIXED) findings per plugin. Each finding comes with its first-seen and fixed dates, the installed version, the plugin's VPR, and the asset's ACR and AES.
- Tracks every finding against the SLA: due date, days open, and whether the SLA was met or missed.
- Compares the run with any earlier one. It shows new, remediated, regressed, still-open and no-longer-reported findings, KPI deltas and a trend chart across the full history.
- Produces a CISO-ready report with one section per vulnerability (PHP2Shell and Node2Shell). Each section has:
  - a posture label (CRITICAL / HIGH / GUARDED / CONTROLLED), an executive summary and business-risk asks
  - KPIs and an assets-by-version-status breakdown, where any figure can be clicked to list the assets behind it
  - a per-plugin drill-down with affected assets, target version, remediation steps and interim mitigations
- Includes an in-report export menu for the HTML and the JSON execution history.

## How it works

Claude follows `SKILL.md` to query Tenable through the Hexa AI MCP and check fixed releases against the Tenable Research PHP2Shell FAQ. It then writes the findings and plugin catalog for each vulnerability as JSON. A bundled Python renderer (`scripts/render.py`, standard library only, with optional Playwright for the PDF) turns them into timestamped report files. It also updates a rolling `history.json` ledger that the next run reads to build its comparison. Every finding is keyed on asset + plugin ID, and each report embeds the full history. Either the stamped `history_<stamp>.json` or `report_<stamp>.html` is enough to continue tracking in a later session.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/php2shell-tenable-remediation-tracker.json. The full index and how to read it: https://exchange.tenable.com/llms.txt