Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure

Insignary has released a free tool called insignary-chk to help organizations detect exposure to PHP2Shell and Node2Shell vulnerabilities in their Linux servers and container images. PHP2Shell is a set of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP runtime that can allow remote code execution by an unauthenticated attacker.

Node2Shell, on the other hand, is a vulnerability in Google's Brotli decompression library bundled with Node.js that can result in memory exposure or remote code execution. Both vulnerabilities are actively exploited and pose a significant risk to organizations.

Insignary's insignary-chk is a read-only scanner that helps identify exposed Linux servers and container images vulnerable to these two vulnerabilities. It does not require any installation or registration and operates on Linux x86_64 architecture. The tool flags end-of-life PHP versions for review against the Linux distribution's security advisory or for upgrade to a supported release.

Results are prioritized, showing "Act now" for issues in use by a running process, "Fix soon" for installed but non-running software, and "Review" for items requiring manual checks.

The tool complements Insignary's Clarity product family, which uses patented binary software composition analysis to identify components and versions inside compiled applications and container images without requiring source code. Users of Insignary Clarity can use insignary-chk's --clarity option to verify its findings with binary analysis on their Clarity server.

Insignary emphasizes that PHP2Shell and Node2Shell vulnerabilities exist in the runtime itself, making source code review insufficient for detection. The company aims to assist organizations in identifying and addressing these runtime-exposed vulnerabilities quickly and efficiently.