Rapid7

Exposure Command / Vulnerability Management / Nexpose

Response status

Detection available; listed components unaffected

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides vulnerability management and detection and response services.

Remote checks were released October 21 and authenticated checks October 22, including Linux backports. The official table marks VM Console, engines, Scan Assistant and Agent unaffected.

Scope: Unaffected product components do not make customer PHP safe. CVE-2026-115560 checks concern a separate issue.

What users should do

Update scan content, run authenticated scans, patch PHP and rescan.

Official service URL

• https://www.rapid7.com/

Source URLs

1. Rapid7: PHP vulnerabilities and detection updateshttps://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/Response evidence
2. https://www.rapid7.com/trust/advisories/php-cve-2026-109618-cve-2026-109619/https://www.rapid7.com/trust/advisories/php-cve-2026-109618-cve-2026-109619/Service and operation documentation

Velociraptor (PHPInventory)

Response status

PHP inventory available

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Generic.Applications.PHPInventory inventories PHP packages and processes on Windows, Linux and macOS.

Scope: Inventory does not mean automatic patching or completed vulnerability testing.

What users should do

Use the inventory to scope PHP remediation.

Source URLs

1. Rapid7: PHP vulnerabilities and detection updateshttps://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/Response evidence