Identify PHP installations across your entire network instantly, with no agents or credentials — runZero 21-day free trial and urgent technical support available

KDSys Co., Ltd. (CEO Kim Seung-yong) announced a support program to help organizations immediately identify affected PHP assets in response to "php2shell" (CVE-2026-109618 and CVE-2026-109619), the critical remote code execution (RCE) vulnerabilities the PHP project urgently disclosed on October 21, 2026. Through the 21-day free trial of runZero, the Cyber Asset Attack Surface Management (CAASM) platform KDSys supplies, organizations can find where PHP is running in their environments.

"php2shell": remote code execution without authentication

The "php2shell" vulnerabilities, discovered and named by researchers at Wiz and OpenAI, are critical flaws that allow remote code execution without authentication. Security organizations including watchTowr have warned that real-world exploitation attempts have been observed.

Specifically, the issues include a vulnerability that occurs while PHP handles out-of-memory (OOM) errors (CVE-2026-109618) and a problem in which a PHP worker process points to a memory region that has already been freed (CVE-2026-109619). Both affect every way of running PHP that handles web requests, including Apache mod_php, PHP-FPM, and php-cgi, and environments that use PHP-based CMS platforms and frameworks such as WordPress and Laravel are exposed to the same risk.

Unmanaged PHP assets outside the administrator's view are the biggest blind spot

The real problem is unmanaged PHP assets that fall outside the administrator's view. In many enterprise environments, PHP is installed not only on primary web servers but also on development servers, internal portals, and legacy systems, often left unregistered in asset management records.

According to runZero's own research, on average more than 31% of an organization's assets are missing from its existing inventory. In an emergency that demands immediate patching, such shadow IT assets become a critical security blind spot.

Detect PHP-installed assets within 20 minutes with the runZero free trial

runZero scans the entire network without installing agents or entering credentials, and detects assets with PHP installed within 20 minutes. Organizations that need to respond to the PHP vulnerabilities can create an account through the Free Trial on the runZero website and use all features free of charge for 21 days.

KDSys provides urgent technical support

KDSys said, "PHP assets you haven't even identified can become a primary entry point for ransomware and hacking attacks," and added, "Organizations that need urgent technical support or professional consulting on identifying PHP versions, prioritizing patches, and adopting runZero can get prompt help by calling us." Information on runZero products and adoption is available on the KDSys runZero product page.

• Phone: +82-2-2659-2308
• Email: info@kdsys.co.kr
• Website: www.kdsys.co.kr

Frequently Asked Questions

Q. What are the "php2shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619)?
A. They are critical PHP vulnerabilities that allow remote code execution without authentication. CVE-2026-109618 arises while PHP handles out-of-memory (OOM) errors, and CVE-2026-109619 arises when a PHP worker process points to a memory region that has been freed. They affect every way of running PHP that handles web requests, including Apache mod_php, PHP-FPM, and php-cgi.

Q. How can we find out where PHP is installed on our network?
A. runZero scans the entire network without agents or credentials and detects PHP-installed assets within 20 minutes. You can start with a 21-day free trial by creating an account on the runZero website.

Q. Are development servers and internal portals affected, not just production servers?
A. The vulnerabilities affect every way of running PHP that handles web requests, including PHP-based CMS platforms and frameworks such as WordPress and Laravel. PHP assets missing from asset records, such as development servers, internal portals, and legacy systems, are especially risky, so the first step is to find out where PHP is installed.

Q. What support does KDSys provide?
A. KDSys provides urgent technical support and professional consulting on identifying PHP versions, prioritizing patches, and adopting runZero. Call KDSys at +82-2-2659-2308 for prompt support; for general inquiries, you can also email info@kdsys.co.kr.

About KDSys

KDSys is a provider of data protection and operational technology protection solutions that support business continuity. Through solutions including runZero, KDSys helps organizations use their data and protect their IT and OT operations.

Source: KDSys press release (October 26, 2026) · Reported by IT Daily (Korean)