PHP2Shell Tenable Skill

Builds a PHP2Shell exposure report from your own Tenable data. Every asset, version and finding in it comes from a Tenable Hexa AI MCP call made during the run. The output is an HTML page, a PDF and a CSV.

What it does

• Checks that the Hexa AI MCP tools are loaded, and prints the setup command if they aren’t.
• Re-reads the Tenable Research PHP2Shell FAQ for the current CVE list, fixed releases and interim mitigations.
• Asks Tenable’s plugin database for every plugin covering those CVEs, across Vulnerability Management, Web App Scanning and cloud or container security.
• Pulls active findings by CVE, plus PHP inventory from the version detection plugins.
• Gives each asset a status against the fixed releases: one of three grades of vulnerable, patched, not affected, or unknown.
• Summarizes counts by status, the ten worst assets and the interim mitigations in chat.

It only reads data. It never launches scans, creates tags or changes anything in Tenable.

How it works

The skill calls tenable_one_search_findings by CVE for vulnerable findings and by detection plugin ID for inventory. For VM plugins it reads PHP versions from workbenches_get_vulnerability_outputs. Hexa returns at most 10 distinct outputs per call, so the skill repeats the call across age windows from 7 to 365 days and merges the results by asset.

It writes one row per asset and plugin to findings.json, then runs render.py, a standard-library Python script. render.py compares each version to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12) and writes the report. The PDF comes from a local headless Chrome, and render.py makes no network calls.

Status comes from the PHP version alone, so distro packages with backported fixes can show as vulnerable. Check those against the vendor advisory.