Penta Security launches PHP2Shell exposure check tool
The free Cloudbric check needs only a website URL and reports the visible PHP version and whether major vulnerabilities apply, in seconds.
Penta Security on October 26 launched a Cloudbric security check service that lets website operators verify whether their site is exposed to the PHP2Shell vulnerability and get guidance on how to respond, according to datanet.co.kr.
The check requires only the website URL, with no separate program installation. It reports the externally visible PHP version and whether major vulnerabilities apply, and returns results within seconds.
The inspection is non-intrusive: it reads server response information rather than attacking the vulnerability itself. Where the PHP version cannot be determined from a website check alone, the company provides a check script that lets operators confirm directly which PHP version and related settings are installed on the server.
The service is available to anyone through the Penta Security and Cloudbric websites, in Korean, English and Japanese.
PHP2Shell refers collectively to CVE-2026-109618 and CVE-2026-109619, PHP remote code execution flaws that can be exploited without authentication. Penta Security said it distributed custom rules and configuration guides to WAPPLES customers and applied response rules to its SaaS web security service Cloudbric WAF+.
Jeong Tae-jun, a planning director at Penta Security, said vulnerability analysis and attacks are speeding up with AI and automation, so companies' security responses must keep pace.
Quick answers
What does the Cloudbric security check require?
Only the website URL. No separate program installation is needed, and results are returned within seconds.
What can the check tell me about my server's PHP version?
It reports the externally visible PHP version. If that cannot be determined from the website check alone, a separate check script allows direct confirmation of the PHP version and related settings installed on the server.
In which languages is the service available?
Korean, English and Japanese, through the Penta Security and Cloudbric websites.