PHP Vulnerability Responses by Company

Defense.com US Inc.

Global cloud / infrastructure
Aliases / services
Defense.com / Defense.com US Inc. / Defense App Scanning / defense.com
Official website
https://www.defense.com/
Sources identifying the operating company

Operator named in the website terms; service contracting entities may differ by region.

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Defense.com Application Scanning

Response status
Version-based scanning and free assessment
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Application scanning, vulnerability management and SOC services.

The guide describes Application Scanning's version-based PHP2Shell checks. A dedicated page offers free access, but hidden versions and backports can produce incomplete findings or false positives.

Scope: Application Scanning scope; Vulnerability Scanning, Orbital Agent and MDR/SIEM have distinct roles.

What users should do

Assess under the service terms, verify both CVE fixes on each server, patch and restart; do not rely on scan results alone.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://help.defense.com/en/articles/17703746-how-to-check-if-you-re-affected-by-php2shell-cve-2026-109618-and-cve-2026-109619Response evidence
  2. https://www.defense.com/php2shellhttps://www.defense.com/php2shellResponse evidence
  3. https://www.defense.com/blog/php2shell-vulnerability-2026https://www.defense.com/blog/php2shell-vulnerability-2026Service and operation documentation
  4. Terms and operating entityhttps://www.defense.com/terms-of-useService and operation documentation
  5. https://www.defense.com/bloghttps://www.defense.com/blogService and operation documentation

Defense.com Vulnerability Scanning

Response status
Version-based external-infrastructure scanning
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The guide describes PHP-version checks across domains and IP ranges. Backports and hidden versions require independent verification.

Scope: Vulnerability Scanning scope. The free initiative names Application Scanning and Orbital Agent; it does not establish free access to all Vulnerability Scanning features.

What users should do

Compare findings with installed package fixes, then update and restart as necessary.

Source URLs

  1. PHP2Shell response and scopehttps://help.defense.com/en/articles/17703746-how-to-check-if-you-re-affected-by-php2shell-cve-2026-109618-and-cve-2026-109619Response evidence
  2. https://www.defense.com/bloghttps://www.defense.com/blogService and operation documentation

Defense.com Orbital Agent

Response status
Free exposure-assessment assistance
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The PHP2Shell page offers Orbital Agent free alongside Application Scanning for additional environment visibility, with manual checks and remediation still required.

Scope: Environment-visibility assistance, not a guarantee of automatic remediation or detection of every compromise.

What users should do

Check the program terms and independently verify PHP versions and fixes in your environment.

Source URLs

  1. https://www.defense.com/php2shellhttps://www.defense.com/php2shellResponse evidence
  2. https://www.defense.com/bloghttps://www.defense.com/blogService and operation documentation

Defense.com MDR/SIEM SOC support

Response status
Monitoring and incident escalation
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The guide and CEO article describe 24/7 SOC monitoring of supplied telemetry and escalation through Incident Response for suspected compromise.

Scope: Covers contracted monitoring and response assistance, not confirmation every PHP server is patched.

What users should do

Verify web/PHP log collection and report suspicious activity to the SOC; patch and restart PHP separately.

Source URLs

  1. PHP2Shell response and scopehttps://help.defense.com/en/articles/17703746-how-to-check-if-you-re-affected-by-php2shell-cve-2026-109618-and-cve-2026-109619Response evidence
  2. https://www.defense.com/blog/php2shell-vulnerability-2026https://www.defense.com/blog/php2shell-vulnerability-2026Response evidence
  3. https://www.defense.com/bloghttps://www.defense.com/blogService and operation documentation

Defense.com platform

Response status
No PHP applications found
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The CEO's article reports that no PHP applications were found on other systems, including the Defense.com platform. A separate internal system was patched.

Scope: Distinguishes the customer platform from internal systems, which are not counted as new services.

What users should do

No platform update action is required from users; customers must patch their own PHP servers separately.

Source URLs

  1. https://www.defense.com/blog/php2shell-vulnerability-2026https://www.defense.com/blog/php2shell-vulnerability-2026Response evidence
  2. https://www.defense.com/bloghttps://www.defense.com/blogService and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Terms and operating entityOfficial information directory

Comments