Enky Whitehat, a company specialising in offensive security, said on Thursday it has introduced a vulnerability diagnostic scanner that checks whether the high-risk PHP core remote code execution (RCE) flaws known as PHP2Shell (CVE-2026-109618, CVE-2026-109619), which can have a critical impact on web environments, are present.

Enky Whitehat said it is developing and providing a diagnostic tool that safely identifies PHP versions and related configuration settings without using actual attack code, enabling an initial determination of whether assets are at risk.

Enky Whitehat released the scanner free of charge so that companies not using OFFen ASM (Offensive Attack Surface Management) can quickly check on their own whether they are exposed to the flaws. Users can access the scanner webpage without a separate login and determine vulnerability status by entering only the URL to be inspected.

Enky Whitehat also released an analysis report covering the technical principles and impact of the flaws. The report includes a detailed analysis of the root causes behind CVE-2026-109618 (maintaining an incomplete state when memory is exhausted) and CVE-2026-109619 (UAF caused by reusing a previous request state), along with affected systems and version information, mitigation measures that can be applied immediately, and guidance on applying official patches.

Enky Whitehat said it plans to release follow-up materials on ways to identify and manage externally exposed assets and methodologies for responding quickly to new vulnerabilities.

Lee Seong-kwon (이성권), chief executive of Enky Whitehat, said: "For vulnerabilities with a large impact like this PHP2Shell, it is important to secure the 'golden time' by identifying exposed assets and taking action before attackers." He added: "Based on our offensive security capabilities, we will provide a stable security environment that does not disrupt corporate business operations."