PHP Vulnerability Responses by Company

Corelight

Global cloud / infrastructure
Aliases / services
Corelight / Corelight Inc. / php2shell-detect / corelight.com
Official website
https://corelight.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

PHP2Shell Zeek detection package

Response status
Detection package published
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Network detection and investigation platform.

Publishes HTTP anomaly and PHP-version detections for Zeek 7+, requiring HTTP visibility.

Scope: Detection support does not patch PHP. Encrypted traffic needs suitable visibility.

What users should do

Review configuration in managed environments and investigate notices; update PHP separately.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://corelight.com/blog/php2shell-detection-before-disclosure?hs_amp=trueResponse evidence
  2. Zeek detection packagehttps://github.com/corelight/php2shell-detectResponse evidence

PHP2Shell Suricata rules

Response status
Detection rules published
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Publishes HTTP-marker and PHP-version rules; the README records validation with Suricata 8.0.6.

Scope: Detection is not patching and requires HTTP visibility.

What users should do

Install and validate rules separately from Zeek and assess false positives.

Source URLs

  1. PHP2Shell response and scopehttps://corelight.com/blog/php2shell-detection-before-disclosure?hs_amp=trueResponse evidence
  2. Zeek detection packagehttps://github.com/corelight/php2shell-detectResponse evidence

Corelight products

Response status
No PHP; not affected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The official security bulletin states Corelight products do not use PHP and are unaffected by PHP2Shell.

Scope: Corelight's stated product scope; does not extend to monitored third-party PHP environments.

What users should do

Review your own PHP applications separately.

Source URLs

  1. https://corelight.com/blog/bulletinshttps://corelight.com/blog/bulletinsResponse evidence
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Zeek detection packageOfficial information directory

Comments