Security Intelligence for your teams and their agents
A knowledge graph of what every vulnerability needs in order to be exploited, joined with what your environment actually gives it. Your team works in the app. Your agents, and ours, plug in over MCP.
Free account. No credit card.
Knowledge graph
Defendermate Security Intelligence
Curated
From security research
Computed
From your environment
PHP2Shell, through the knowledge graph
Two critical PHP flaws, disclosed on 21 October 2026, with exploitation attempts recorded four days earlier. Scanners flag every PHP host. Here is what Security Intelligence knows about them, and what that knowledge turns into once it meets an environment.
What we know
CuratedExploit conditions
Two things must hold: the PHP build lacks the fix, and attacker input reaches PHP from the network. Common hardening (memory limits, upload progress off, one request per worker) doesn’t rule it out.
Patch and fix availability
Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Ubuntu backported the fix under version numbers a scanner reads as vulnerable. Amazon Linux 2’s base php gets no patch.
Attack techniques
Initial access through a public-facing PHP app; from the web worker, whatever its cloud role can reach.
What it means for you
ComputedExploitability verdicts
14 hosts run PHP. Four of the nine are Ubuntu backports your scanner still lists as critical.
Ranked attack paths
One of the three reaches customer data:
Mitigation options
web-03, web-05: upgrade to 8.4.27. web-07 (Amazon Linux 2, no patch coming): take it off the internet path today with a security-group change, as code, then move it to a fixed build.
Ask it from wherever you work
The same knowledge graph sits behind the app and the MCP server, so your people and your agents get the same answer, with the same evidence.
- Your team sees verdicts, paths and options in the web app.
- Your agents query it over MCP from Claude, ChatGPT, Cursor or your own code. Built for agents
- Our Red, Blue and Compliance teammates work from it too.
Are we exposed to PHP2Shell?
▸ Checked exploitability assessments for CVE-2026-109618
▸ Checked attack paths for CVE-2026-109618
3 of your 14 PHP hosts are exploitable. The other 11 are patched (4 of them by Ubuntu backports) or take no network input.
Start with web-03: it has a path from the internet to the customer-data bucket. Upgrading it to 8.4.27 closes that path.
From finding to verified closure
Connect
One read-only connection to your cloud, plus the findings your tools already produce.
2Analyze
Five checks per finding. Only what’s exploitable, ranked by where it leads.
3Plan
Patch, mitigate or wait, with the mitigation ready as code.
4Act
Changes go through your policy gate, then get re-verified.
Works with the tools you run
Safe to connect
Read-only, nothing installed on your workloads, and no change without your policy. ISO 27001 certified and SOC 2 Type 1.
Run it on your own environment
Start free in the sandbox, or talk to our team.