Toronto, Canada, November 6th, 2026, CyberNewswire
A new tool designed to enhance cybersecurity for organizations has recently been unveiled by Insignary, a prominent global open-source security company. The tool, known as insignary-chk, is a free, read-only scanner that aims to help organizations identify Linux servers and container images that are vulnerable to two significant and actively exploited weaknesses in widely used programming environments, namely PHP and Node.js.
Insignary-chk specifically targets vulnerabilities referred to as PHP2Shell and Node2Shell. These vulnerabilities have been disclosed recently and present substantial risks, allowing unauthorized attackers to execute code remotely on affected systems. The vulnerabilities in PHP—designated as CVE-2026-109618 and CVE-2026-109619—have been rated a critical 9.2 on the Common Vulnerability Scoring System (CVSS v4.0). Organizations that utilize PHP to manage web requests, especially through systems such as Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, need to be particularly vigilant as they are at heightened risk.
To address these concerns, the PHP Project has issued patches for these vulnerabilities in its latest software updates released on October 21, 2026, across various versions of PHP, including 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Notably, PHP 8.1 and earlier versions have reached their end of life, meaning they no longer receive any official security updates.
Given that the vulnerabilities exist within the runtime itself and not within the application code, traditional code reviews are insufficient to uncover these risks. Organizations are encouraged to conduct active searches for PHP instances embedded within vendor software and container images, underscoring the necessity for tools like insignary-chk.
In addition to targeting PHP vulnerabilities, insignary-chk also addresses an important flaw linked to Node2Shell, identified under CVE-2026-111497. This vulnerability stems from an out-of-bounds write issue within Google’s Brotli decompression library, which is bundled with Node.js. If exploited, it can lead to application crashes, memory exposure, or even remote code execution. The flaw has been rectified in the most recent versions of Node.js, specifically 22.23.4, 24.22.1, and 26.12.1. Node.js maintains a strict end-of-life policy, thus unsupported branches, such as version 20.x and earlier, are considered to carry inherent risks, as they will not receive further security fixes.
Reflecting its commitment to providing accurate assessments, insignary-chk does not classify end-of-life branches like Node.js 20.x as "likely vulnerable." Instead, it categorizes them as "check with OS vendor" where applicable or "unable to determine" when installed from nodejs.org or compiled from source code. This feature allows administrators to verify the patch status with their respective vendors or to upgrade to supported releases.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recognized the severity of PHP2Shell and Node2Shell, cataloging both vulnerabilities within its Known Exploited Vulnerabilities database.
insignary-chk is designed for user convenience: it is a single-file tool that necessitates no installation or registration. It operates primarily in a read-only mode, conducting file reads without running any of the findings or altering any systems unless explicitly commanded to do so via the “–fix” option. Furthermore, the tool does not transmit any data over the network unless the user opts to connect it to a specific address.
Given that Node2Shell originates from the Brotli library, insignary-chk extends its scanning capabilities to check for Brotli installations outside of the Node.js environment, encompassing the system Brotli library as well as Python’s brotli package.
In addition to addressing the PHP and Node.js vulnerabilities, insignary-chk identifies end-of-life PHP versions that need review against their respective Linux security advisories or may require an upgrade to a version that continues to receive support. The results produced by insignary-chk are prioritized based on urgency, enabling teams to swiftly identify and address the most critical issues.
The tool’s report categorizes findings into actionable items; files identified as vulnerable and actively running are flagged for immediate action, whereas those installed but not currently in use are marked for prompt fixing. Items that necessitate further manual checks are labeled for review, ensuring that teams can easily navigate through the detailed findings specific to each server or container image.
insignary-chk adds substantial functionality to Insignary’s existing product lineup. The Insignary Clarity product suite employs patented binary software composition analysis (SCA) technology to identify software components and versions contained within compiled applications, firmware, IT infrastructure, and container images, all without requiring source code access. As a further enhancement, users who already utilize Clarity can employ insignary-chk’s “–clarity” option to cross-verify findings through binary analysis on their personal Clarity server.
Expressing the importance of this development, Taek Wan Kim, President and CEO of Insignary, noted, “PHP2Shell and Node2Shell are vulnerabilities that reside in the runtime, not in application code, so relying solely on source code review won’t expose potential risks. We developed insignary-chk to empower organizations to swiftly check their Linux servers and containers for vulnerabilities, facilitating a focus on the most pressing issues while making no alterations to their systems."
For interested users, insignary-chk is available as a free download, with no registration prerequisites, at www.insignary.com/free-tools/php2shell-node2shell-checker. The tool operates on Linux x86_64 systems and currently supports checks for the three listed CVEs, with plans for broader compatibility in future iterations.
In summary, Insignary, headquartered in Toronto, continues to innovate within the realm of cybersecurity, enabling organizations to navigate the complex landscape of software vulnerabilities effectively. With its cutting-edge solutions, Insignary aids businesses, governmental entities, and software developers worldwide in securing their software supply chains, bolstered by strategic partnerships across continents. For more information, potential users or partners are directed to visit www.insignary.com.