Logpresso releases free PHP2Shell scanner for SIEM and XDR customers

Logpresso released a free PHP2Shell Scanner through its Logpresso Store on October 26, 2026, for customers running its Logpresso SIEM and XDR products, according to datanet.co.kr.

The scanner is installed inside Logpresso SIEM and XDR. Users register target URLs and the tool diagnoses whether those addresses are vulnerable and records the PHP version it finds. Multiple URLs can be registered at once, and the scanner automatically detects whether access is over HTTP or HTTPS.

It also provides overall diagnosis statistics and a breakdown of assets by PHP version, keeps a history of scans and exports results as CSV. Assets reachable from the Logpresso server, such as internal admin tools and network device management screens, can be scanned as well. Detection query commands and detection rules are included, and the interface supports Korean, English and Japanese.

Query-based diagnosis is available on Logpresso Sonar 4.0.2308 or later, while a dedicated diagnosis screen is supported on version 5.0 or later. The scanner is provided free of charge to existing Logpresso customers.

Background

PHP2Shell refers to two remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS v4.0 by the PHP security team. Patches for the currently supported PHP 8.2 to 8.5 versions were released on October 21, and reports indicate that PHP versions from 5.4.0 onward are also in the affected range. Logpresso published a PHP2Shell response advisory on its blog the same day, covering identification of vulnerable assets, temporary mitigations and compromise checks.