Handling PHP2Shell with Tanium Atlas: Tanium Tech Talks #175

PHP2Shell is here. See how Tanium finds PHP across your environment, scopes your exposure, and maps attack paths so you know what to patch first.

In this special edition, we walk through how Tanium gives you visibility into the new PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and the resources available to help you respond.

You'll learn:
🔍 How to find PHP across Windows, Mac, and Linux endpoints, including PHP bundled inside other software
📋 Where to see impacted endpoints in Tanium Atlas and in Tanium Classic
🧾 How Comply findings and SBOM data fill in coverage that sensors alone can miss
🛰️ How External Attack Surface Management and Attack Path Mapping show whether PHP is exposed to the internet
🎯 How to prioritize patching and compensating controls based on real exposure
🕵️ Where to find hunting questions and indicators of compromise for potential exploit attempts

Dive Deeper with our Tanium Block & Knowledge Articles:
https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619
https://help.tanium.com/bundle/WhyPHP2ShellIsReal/page/KA/WhyPHP2ShellIsReal/WhyPHP2ShellIsReal.htm

#TaniumTechTalks #Tanium #PHP2Shell #cybersecurity

CHAPTERS:

0:00 Intros

0:57 What is PHP2Shell?

2:17 The CVEs and exploitation status

3:33 Why PHP hides in your environment

5:19 DEMO: PHP2Shell page template in Atlas

6:10 What Tanium finds out of the box

7:17 Deeper coverage with Index and SBOM

7:55 DEMO: Guardian dashboard in Tanium Classic

8:46 Hunting questions and IOCs

9:24 DEMO: Attack paths with External Attack Surface Management/Attack Path Mapping

11:01 Wrap-up