Andrzej Matykiewicz |
Friday, 23 October 2026 at 13:50 UTC
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you’re responsible for web applications, you’ve probably spent the last few days trying to work out if you’re exposed as quickly as possible, but without taking your systems offline.
That’s why within hours of disclosure, we made sure you could test for PHP2Shell safely using Burp Suite.
In this post, we’ll walk you through the options you’ve now got access to across the Burp Suite ecosystem, and what you can do right now to check your exposure.
Key highlights
Why this keeps happening, and faster
AI is speeding up vulnerability discovery. That’s true for researchers, and it’s true for attackers.
In practice, that means two things. First, we’ll see more critical bugs turn up in mature, widely used systems and codebases. Second, the time between a bug being discovered and it being exploited is getting shorter.
That’s why response speed matters even more now than it always did, both for us as a tool vendor and for those of you testing and defending applications.
Getting detection into your hands, fast
Our mission is to enable the world to secure the web. Moments like this are where that mission gets tested.
PortSwigger’s research team picked up the early signals around PHP2Shell and alerted our engineering teams straight away. From there, they dug into the details themselves, while keeping tabs on the latest developments and insights from the wider community.
What followed was a rolling series of enhancements across the Burp Suite ecosystem.
Passive detection, as early as possible
We were able to release passive detection almost straight away via our extensibility APIs, with a Java-based custom scan check and a DAST-compatible BCheck. James Kettle also updated his ActiveScan++ extension, which is compatible with both Burp Suite Professional and Burp Suite DAST.
This passive approach was fairly limited, but we wanted to get something in users’ hands quickly as the main detection method circulating at the time involved crashing the server. We shipped these checks immediately, while still working on more sophisticated active checks.
Active detection, tested for safety
Next came active detection, which involved sending a payload to the server. Any active probe can have potentially harmful knock-on effects, and these aren’t always obvious at first glance.
Time was still of the essence, hence the decision to release them as custom scan checks. However, we made sure to run the active checks across a range of servers and PHP versions to give us confidence we weren’t releasing something that would leave users spraying payloads at their production systems and inadvertently taking vulnerable ones offline.
Once released, you could then run active and passive detection across your applications with confidence.
With the next release of Burp Suite Professional, these checks will be natively integrated with Burp Scanner.
Beyond the scanner: Burp AT skills for PHP2Shell detection
At Black Hat USA 2026, we launched Burp AT, our approach to bringing agentic tooling into human-led pentesting. One of the things that sets it apart is its library of dedicated pentesting skills, including ones developed by the PortSwigger Research team.
That library now includes a skill for PHP2Shell, so you can simply ask an agent to test for it.
- Consistent and proven technique. A key advantage of these specialized skills is that Burp AT follows a consistent, proven approach. That matters for a bug like this. A general-purpose AI agent asked to “check for PHP2Shell” could easily come up with a destructive probe that causes real damage.
- Always current. We’re still actively improving the detection methodology and can push new and updated skills to Burp AT’s library at any time. If you use Burp AT, your agents keep up with the latest developments without you needing to check for updates. Every run uses the current version of the skill.
- Deterministic guardrails. When using agentic AI to test for vulnerabilities as dangerous as PHP2Shell, you need to combine capable reasoning with enforced boundaries. In addition to skills steering agents towards a more consistent and effective approach, Burp Suite’s robust and deterministic harness makes sure agents stay in scope and won’t perform risky actions without your approval.
All Burp Suite Professional users get free monthly usage of Burp AT, so try it now if you haven’t already. Open Burp AT
Scanning at scale
Active detection is now built natively into Burp Suite DAST, so you can scan for PHP2Shell across all of your web assets at scale. Just make sure you’re on Burp Scanner version 2026.10.54778 or above.
What to do now
To sum up, here are the ways you can check your exposure across the Burp Suite ecosystem:
- Burp Suite Professional users: Scan the apps you’re testing using ActiveScan++, or the custom scan check. ActiveScan++ is the recommended option as this will automatically update if we refine it. Native scanner detection is coming in the next Burp Suite release.
- Burp Suite DAST customers: Run a scan across your whole estate. The native PHP2Shell scan check is built in. Note that ActiveScan++ is also available for Burp Suite DAST. Just make sure you’re on Burp Scanner version 2026.10.54778 or above.
- Burp AT users: Ask an agent to test for PHP2Shell. It will automatically invoke its new skill to do this. Open Burp AT
- Haven’t tried Burp AT yet? All Burp Suite Professional users get free monthly usage, so you can try it at no cost. Find out more
