PHP2Shell Exposure Hunt: Vulnerable PHP Versions, Running Processes and CISA KEV Status (CVE-2026-109618, CVE-2026-109619)
Detects PHP exposure to CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): installed packages below the fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or on branches the advisories do not cover, devices that Defender Vulnerability Management flags for either CVE, and PHP processes that ran in the last 30 days on devices with no PHP package in the inventory. Every row carries the live CISA KEV status of both CVEs and internet facing devices are listed first. A last row shows the KEV feed row count and newest entry date, so an empty result can be told apart from an empty or outdated feed. It does not show whether exploitation took place and appliances that embed PHP need their vendor advisories. The query ran without errors in a live tenant.
Microsoft Sentinel (KQL)
