{"id":56653,"date":"2026-11-09T12:12:02","date_gmt":"2026-11-09T11:12:02","guid":{"rendered":"https:\/\/www.accompio.com\/?post_type=blog&p=56653"},"modified":"2026-11-09T12:12:03","modified_gmt":"2026-11-09T11:12:03","slug":"php-security-flaw","status":"publish","type":"blog","link":"https:\/\/www.accompio.com\/en\/blog\/php-sicherheitsluecke\/","title":{"rendered":"The PHP security flaw: What you can do better in the future to no longer offer an attack surface"},"content":{"rendered":"

In this article<\/h2>\n\n\n\n
    \n
  1. \u201ephp2shell\u201c \u2013 This is what happened\u00a0<\/a><\/li>\n\n\n\n
  2. Asked by the expert \u2013 Michael Andresh in an interview\u00a0\u00a0\u00a0<\/a><\/li>\n\n\n\n
  3. VRM at a glance \u2013 Our solution\u00a0<\/a><\/li>\n<\/ol>\n\n\n\n

    \u201ephp2shell\u201c \u2013 This is what happened<\/h2>\n\n\n\n

    On October 21, 2026, two critical security vulnerabilities were disclosed in PHP with the names \u201ephp2shell\u201c (CVE-2026-109618 and CVE-2026-109619). PHP is a technology that is embedded in countless websites, customer portals, and web applications. Once such a vulnerability becomes public, attackers automatically search the internet for vulnerable systems, often within a few hours. Therefore, what is crucial is not only whether a gap exists, but also whether one even knows which proprietary systems could be affected.<\/strong> <\/p>\n\n\n\n

    Most companies have a good overview of their central IT infrastructure, including servers, workstations, and firewalls. However, the attack surface often extends far beyond that: the agency\u2019s website, the external service provider\u2019s customer portal, the NAS that was previously enabled for remote access, and test systems and old subdomains that no one remembers anymore. All of these systems are visible to attackers, but not always to their own IT department. And anyone who doesn\u2019t know what is accessible from the outside cannot secure it or react in time.<\/strong> <\/p>\n\n\n\n

    Asked by the expert \u2013 Michael Andresh in an interview<\/h2>\n\n\n\n

    We asked Michael Andresh about how such a scan works in practice and what companies can learn from it. He is Senior Sales Manager BSC Cyber Security at Netz16 and has been helping companies for years to make their attack surface visible and reduce it.<\/p>\n\n\n\n

    \u201eThe PHP vulnerabilities in October caught many companies off guard. Why are systems that are accessible from the internet in particular such a risk, and why do many companies have no idea about it at all?\u201c<\/em><\/strong>\u00a0<\/p>\n\n\n\n

    Michael Andresh:<\/strong> The PHP vulnerability \u201ephp2shell\u201c (CVE-2026-109618 and CVE-2026-109619) has rightly received a lot of attention. However, it is only one of up to 100 new vulnerabilities that are published daily. <\/p>\n\n\n\n

    Systems that are directly accessible on the Internet are particularly critical. Because what is accessible from the Internet is also accessible to attackers. We are talking here about the \u201eHacker View,\u201c the perspective of an attacker from the outside looking at a company. Furthermore, the attack surface is constantly changing as new systems and cloud services are added and configurations change. <\/p>\n\n\n\n

    Many companies do not have a service that continuously checks for this attack surface. Therefore, with a critical vulnerability like \u201ephp2shell\u201c, they can hardly quickly assess whether they are affected. Anyone who does not know their external attack surface has little time to quickly assess whether and where their own company is affected in the event of a new critical vulnerability like the one currently affecting PHP. <\/p>\n\n\n\n

    \u201eWhat can Netz16 and accompio do here?\u201c<\/em><\/strong>\u00a0<\/p>\n\n\n\n

    Michael Andresh:<\/strong> Together with accompio, we offer an automated and non-invasive analysis of the IT attack surface. We deliberately take the perspective of an attacker and analyze what is visible from the outside and where there are concrete risks. Our Vulnerability & Risk Management identifies and assesses this attack surface automatically and non-invasively. The customer thus receives not just a list of vulnerabilities, but a clear prioritization: What is critical and where should action be taken first? <\/p>\n\n\n\n

    For entry-level use, a one-time scan at fixed prices is suitable. For companies with up to 100 employees, it costs 2,350 euros net, up to 500 employees 2,950 euros net and up to 1,500 employees 4,650 euros net. This gives companies a clear overview of their attack surface and enables them to know where they stand. <\/p>\n\n\n\n

    What is important to me in this context is transparency: The package includes the analysis, not the fixing of the found vulnerabilities.<\/strong> However, this can be taken on as a follow-up order if needed, so that companies are not left alone with the results. <\/p>\n\n\n\n

    \u201eWhat does a CEO ultimately have in their hands, and what does the IT department have?\u201c<\/em><\/strong><\/p>\n\n\n\n

    Michael Andresh:<\/strong> A CEO doesn\u2019t need a long list of technical vulnerabilities. He needs to know how big the risk is, what is particularly exposed, and where action is needed. That\u2019s one side; the other side, IT, receives approaches and tools through vulnerability scans. Management and IT therefore see the same risk \u2013 at different levels.<\/p>\n\n\n\n

    \u201eIs a one-time check sufficient, or do companies need ongoing monitoring? For whom do you recommend which level?\u201c<\/em><\/strong><\/p>\n\n\n\n

    Michael Andresh:<\/strong> A one-time check is certainly a good location assessment, but ultimately only a snapshot. A system that is inconspicuous today can become a risk through a newly discovered vulnerability tomorrow. Therefore, a one-time scan is sufficient for a first overview. Those who make commercially critical systems accessible from the Internet should, in contrast, continuously monitor their attack surface. This is where the added value of our gold model lies: continuous scanning that is compared with the known attack surfaces.<\/strong> <\/p>\n\n\n\n

    Just to make it clear again: A system that seems secure today can become a risk tomorrow due to a new vulnerability. Therefore, what is crucial is a continuous<\/strong> Examination of one's own attack area <\/p>\n\n\n\n

    VRM at a glance<\/h2>\n\n\n\n

    With Vulnerability & Risk Management<\/a> Companies see their IT the way an attacker sees it, and can close vulnerabilities before they are exploited.\u00a0<\/p>\n\n\n\n