A Free Check for Two Actively Exploited Runtime Flaws
Insignary, an open-source security company based in Toronto, has released insignary-chk, a free, read-only scanning tool designed to help organizations determine whether their Linux servers and container images are exposed to two recently disclosed runtime vulnerabilities: PHP2Shell and Node2Shell. The tool arrives as both flaws are reportedly being exploited in the wild, making rapid exposure assessment a priority for teams running PHP or Node.js workloads.
According to the announcement, insignary-chk is intentionally simple in scope. It performs read-only checks, meaning it inspects systems without modifying files or configuration, which lowers the barrier to running it across production fleets and CI pipelines. The scanner targets Linux hosts and container images, two of the most common deployment environments for the affected runtimes.
What Are PHP2Shell and Node2Shell?
PHP2Shell and Node2Shell are runtime vulnerabilities affecting PHP and Node.js respectively. The naming convention mirrors earlier "shell"-style disclosures, where a flaw in a widely deployed component can be leveraged to achieve code execution or otherwise compromise the host. Both have been described as actively exploited, which changes the calculus for defenders: exposure is not a theoretical risk but a live one.
The source report does not detail the underlying technical mechanism of either vulnerability, so organizations should consult vendor advisories for PHP and Node.js, as well as their Linux distribution maintainers, before making patching decisions. What is clear is that the affected software is extremely common across web applications, APIs, and microservices, so the potential blast radius is broad.
Why a Dedicated Scanner Matters
Asset inventory is often the weakest link in vulnerability response. Organizations frequently know they run PHP or Node.js somewhere, but not precisely which versions are deployed across which hosts and container images. A focused scanner that answers a single question — "am I exposed to PHP2Shell or Node2Shell?" — can shortcut the triage process considerably.
The read-only design is a meaningful choice. Security teams are often reluctant to deploy new agents or run intrusive tooling against production, particularly during an active exploitation event when stability matters most. A scanner that only inspects should be easier to approve for broad rollout, including ephemeral container environments where traditional agents struggle.
Container images deserve particular attention. Images built months or years ago may bundle outdated PHP or Node.js runtimes that never received updates because the base image was pinned. Scanning registries and build artifacts helps catch these stale dependencies before they reach production.
Recommended Response Steps
For teams looking to act on this disclosure, a practical sequence looks like this:
- Inventory first. Identify where PHP and Node.js run across servers, virtual machines, and container images. Include CI/CD build images and internal tooling, not just customer-facing services.
- Scan broadly. Run insignary-chk or equivalent checks against hosts and image registries. Record results with hostnames, image tags, and runtime versions to support prioritization.
- Patch or mitigate. Follow guidance from the PHP and Node.js projects and your distribution vendor. Where immediate patching is not feasible, apply compensating controls such as network segmentation, WAF rules, or restricting exposure of affected services.
- Rebuild images. For containers, updating a running container is not enough; the underlying image must be rebuilt and redeployed so that new instances are not vulnerable.
- Verify and monitor. Re-scan after remediation and watch logs for signs of exploitation attempts against any systems that were exposed.
The Bigger Picture
Free tooling from vendors plays an important role during active exploitation events, when speed matters more than procurement cycles. That said, a scanner is a starting point, not a complete vulnerability management program. Organizations should pair point-in-time checks with continuous software composition analysis, timely patching of runtimes, and a maintained inventory of container images.
The release also underscores a recurring theme: runtime-level vulnerabilities in ubiquitous languages carry outsized risk because so much of the modern web depends on them. Teams that treat PHP and Node.js versions as first-class security assets — tracked, scanned, and updated deliberately — will be better positioned the next time a flaw like PHP2Shell or Node2Shell emerges.
Organizations can obtain insignary-chk directly from Insignary and should review the original announcement for usage details and any updates.
