When two of the most serious security events of October hit—a critical remote-code-execution flaw in PHP and the discovery of shockingly weak certificate authority keys—organizations suddenly needed answers fast. eScan has now released a free tool designed to help defenders find both exposures in a single sweep, without risking their production systems.
MI, UNITED STATES, October 29, 2026 /EINPresswire.com/ — eScan (MicroWorld Technologies Inc.) today announced the availability of a free command-line scanner that enables organizations to rapidly determine which of their systems are vulnerable to two of the month’s most critical security incidents: the PHP2Shell remote-code-execution vulnerability in PHP, and the recoverable private keys found in certificates issued by the certificate authority eMudhra.
Govind Rammurthy, CEO and Managing Director, eScan
Also worth a look: Bigly Sales gives websites a voice with Talk Kit, an AI agent that talks back and Synergy Logistics rebrands after 50 years, unveils hybrid WMS for offline resilience.
Non-intrusive command-line tool detects the critical PHP2Shell flaw and recoverable eMudhra/emSign TLS certificates – safely, across an entire estate
The PHP2Shell vulnerability, tracked as CVE-2026-109618 and CVE-2026-109619, is actually a pair of critical flaws in PHP core—the interpreter that powers a vast portion of the world’s websites—and carries a severity rating of 9.8 out of 10 on the CVSS v3.1 scale. This means an attacker can execute code on a server with no credentials and no user interaction required. Because the flaw resides in the runtime itself rather than in any specific application, every website hosted on a vulnerable server is at risk. The bugs were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while older branches receive limited or no official patches. According to published internet-scan data, roughly 2.6 million internet-facing services were advertising a PHP version on the day the patch shipped, and close to three-quarters of them were running branches that will never receive an official release—and attackers were already probing for the flaw before the fix was even public.
Days later, a second incident compounded the urgency. Researchers discovered that eight intermediate certificate authority keys operated by eMudhra under its emSign brand had been generated so poorly that the private keys were tiny whole numbers—one was simply the number 4—and could be recovered by anyone in under a second (CVE-2026-111943).
Major browsers moved to withdraw trust from the affected roots, and eMudhra announced it would exit the global TLS certificate business. Since government services, banks, and businesses have long relied on emSign certificates, many organizations now need a fast, reliable way to answer a question they never had to ask before: what certificate authority (CA) is my website’s trust actually anchored to, and is any certificate in that chain cryptographically weak?
eScan’s new tool answers both questions in a single pass. Pointed at an IP address, a network range, a domain, or a file of targets, it determines each host’s exposure to PHP2Shell and inspects the full TLS certificate chain the host presents, flagging any certificate with a recoverable key and naming the issuing organization, so that an “emSign” certificate is clearly identified as eMudhra’s. Given a domain and the relevant option, the tool also discovers its subdomains through Certificate Transparency records and scans each one it finds. It then prints a plain verdict, the evidence behind it, and the specific remediation for each finding.
What distinguishes the tool is its method. It establishes exposure by reading what a host already reveals, and never by sending the attack traffic that triggers the vulnerability. It cannot crash or destabilize a live server, making it safe to run across production, customer, and government infrastructure. It is also deliberately honest about the limits of remote detection: it confirms a vulnerable version with high confidence, but it will never declare a host “safe” on remote evidence alone—because distributions patch without changing version numbers—instead grading every finding and stating the reason behind it.
“When a vulnerability like PHP2Shell is being exploited before the patch is even out, defenders need to find their exposed systems in hours, not weeks, and they shouldn’t have to pay for the privilege or risk knocking over the very servers they’re trying to protect,” said Govind Rammurthy, CEO and Managing Director of eScan. “We built this to be safe to run against a live estate and honest about what it can and cannot confirm. A tool that falsely reassures you is worse than no tool at all.”
“The eMudhra episode showed that you cannot simply trust a certificate authority’s word about its own keys—you have to verify what is actually deployed,” he added. “This scanner lets any organization check for itself, free of charge.”
The scanner is available now at no cost for Windows, with no registration required, at https://www.escanav.com/en/support/php2shell-scanner.asp.
About eScan
eScan (MicroWorld Technologies Inc.) is a globally established cybersecurity company providing comprehensive security solutions including Enterprise EDR, Vision Core XDR, Enterprise DLP, and Business DLP. With over 300 R&D professionals, eScan serves enterprises, government agencies, and small to medium businesses across 90+ countries, delivering protection against evolving cyber threats.
eScan Communications
MicroWorld Technologies Inc.
+1 248-470-1119
Why it matters: With attackers already probing PHP2Shell before patches were public and the eMudhra incident proving that certificate authorities cannot be blindly trusted, organizations need tools that help them verify their own exposure without risking production systems. This free scanner gives defenders a safe, honest way to answer two urgent security questions at once—before attackers do it for them.
