PHP Vulnerability Responses by Company

Semgrep

Global cloud / infrastructure
Aliases / services
Semgrep / Semgrep Inc. / r2c / ReturnToCorp / Semgrep Guardian
Official website
https://semgrep.dev/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Listed services and systems

Response status
Guardian flags vulnerable PHP versions
Response information checked
2026-10-27 Rechecked: 2026-10-27

Code security products from Semgrep Inc., formerly r2c.

Semgrep Guardian flags vulnerable PHP versions when an agent starts working on a project. Expanded coverage of source-code-defined PHP usage is planned. A script is also provided to inventory projects using PHP.

What users should do

Investigate flagged runtimes and images and update the PHP that actually handles web requests. Updating Composer dependencies alone does not patch the PHP runtime.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://semgrep.dev/blog/2026/php2shell-php-runtime-rce/Response evidence
  2. Operating entityhttps://semgrep.dev/legal/termsService and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Operating entityOfficial information directory

Comments