SentinelOne, Inc.
- Aliases / services
- SentinelOne / SentinelOne, Inc. / Singularity / Purple AI / SentinelLabs / Attivo / DataSet / Scalyr / Prompt Security / sentinelone.com
- Official website
- https://www.sentinelone.com
Sources identifying the operating company
Official website operator or publisher; check the individual contract for the product and regional contracting entity.
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
Singularity agent
- Response status
- Post-exploitation detection and protection guidance
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Endpoint protection and AI SIEM.
SentinelOne describes detection of suspicious web-worker child processes and files, with termination and quarantine in protect mode.
Scope: Host telemetry cannot cover memory disclosure without OS interactions; protection is not a PHP patch.
What users should do
Check agent health and protect mode on affected servers, and patch PHP separately.
Official service URL
Source URLs
- PHP2Shell response and scopehttps://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/Response evidence
Singularity AI SIEM
- Response status
- Log-correlation detection guidance
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
SentinelOne describes correlating endpoint and forwarded web-server, WAF and CDN logs to investigate request anomalies and suspicious process/file activity.
Scope: Visibility depends on ingested sources; detection availability is not PHP patch completion.
What users should do
Forward relevant logs, tune detections and patch PHP separately.
Source URLs
- PHP2Shell response and scopehttps://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/Response evidence
Purple AI
- Response status
- Threat-hunting examples published
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Guidance provides questions for investigating web-worker child processes, new web-root files and outbound traffic while PHP is being patched.
Scope: This is investigation assistance, not automatic PHP remediation or proof of intrusion.
What users should do
Verify data coverage; HTTP 500 analysis requires ingested web-server logs.
Source URLs
- PHP2Shell response and scopehttps://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/Response evidence
Related official sources
- PHP2Shell response and scopeOfficial notice
- Operating entityOfficial information directory
Comments