TL;DR: where to go in Panorays
1. Confirmed exposure: open Risk Insights, search for CVE-2026-109619 and CVE-2026-109618, and open the Supply Chain Impact tab.
2. Fourth parties: on the same tab, click the open icon next to unique companies auto-discovered.
3. Everyone running PHP: open the Technologies Center, filter Technology to PHP, and export Suppliers and Technologies by Severity.
4. Background: read the PHP2Shell Threat Intel Report.
Step-by-step instructions with screenshots follow below.
PHP2Shell is a critical remote code execution (RCE) vulnerability in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. This article shows you how to build two supplier lists in Panorays, and how to get our full research report. For the timeline, affected and fixed versions, and interim mitigations, read our PHP2Shell Threat Intel Report.
Confirmed exposure (Step 1, Risk Insights): suppliers where Panorays detected a vulnerable PHP version. Act on these first.
Potential exposure (Step 2, Technologies Center): every supplier where Panorays detected PHP, with or without a visible version. Use this as your outreach scope.
Note: Panorays attaches a newly published CVE to a supplier after that supplier's next scan. Both lists will grow over the next few days as rescans finish, so check back for the full picture.
Step 1: Find suppliers with a confirmed finding
1. In the left navigation, click Risk Insights.
2. In the search box (1), enter CVE-2026-109619. You can also click Filters (2) and select the CVE there.
3. Click the insight PHP - CVE-2026-109619 - Critical Vulnerability detected.
4. In the insight panel, click the Supply Chain Impact tab (1). The banner above the tabs tells you whether your own company is impacted.
5. Review the impacted suppliers:
Direct Impact toggle (1): turn it on to show only directly impacted suppliers.
Impact Type (2): Direct means Panorays detected the vulnerable version on the supplier's own assets. Indirect means the supplier is exposed through a company in its own supply chain.
Business Impact (3): the business impact (inherent risk) set for the supplier. Use it to decide who to contact first.
Tip: see the full list of fourth parties. Indirect suppliers are exposed through companies in their own supply chains, which are your fourth parties. On the Supply Chain Impact tab, click the open icon (1) next to unique companies auto-discovered. The Supply Chain Discovery window lists every company found, with its Cyber Posture Rating and Industry. To add one to your inventory, hover over its row and click Add (2).
6. Repeat steps 2 to 5 for CVE-2026-109618.
For more on this view, see How to find the supply chain affected by a specific CVE.
Step 2: Find every supplier running PHP
More than half of PHP installations hide their version number, so the CVE findings in Step 1 are a floor, not the full picture. The Technologies Center lists every supplier where Panorays detected PHP, with or without a visible version. Treat it as your outreach scope: suppliers who may be exposed but can't be verified from the outside.
1. In the left navigation, click Reporting Hub (1), then Live Dashboards (2).
2. Open the Technologies Center dashboard. Check that the portfolio selector (1) shows All Portfolios, so the dashboard covers every supplier you monitor.
3. Click Dashboard Filters (1).
4. Expand Technology, type PHP in the search box (1), select PHP (2), and click Apply (3). Leave the other matches clear. They are separate products whose names contain "PHP".
5. Scroll down to Suppliers and Technologies by Severity and click Export (1).
Working with the export
One row per detection, not per supplier. A supplier running several PHP versions, or detected on several dates, appears on several rows. De-duplicate on Supplier Name before you build your outreach list.
Version (2) is the PHP version Panorays detected. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Earlier versions on those branches are affected, as are the unsupported 7.x and 8.1 branches. Judge exposure against these, not the Latest Version column, which shows the newest release at the time of detection. Where no version is shown, PHP was detected but its version isn't exposed.
Assets links to the supplier assets where PHP was detected. Include them when you contact the supplier.
Time Frame is set in the Dashboard Filters panel. Make sure it covers the period you need.
Step 3: Get the Threat Center report
Our Cyber Research team has published a Panorays Third Party Intelligence – Threat Center report on PHP2Shell. It covers:
What happened
Which PHP versions are fixed, and which are not
What the data shows across the internet
How Panorays detects it
Recommended actions for you and for your vendors
It's written so you can forward it to your CISO or board as-is. To get the PDF, contact your Customer Success Manager, or message us from the chat icon in the bottom-right corner of the app. A public summary is on our blog: PHP2Shell Threat Intel Report.
What to do next
You can act on what you find directly from the insight panel.
Prioritize. Start with directly impacted suppliers that have a high Business Impact, then work through your Step 2 scope list.
Reach out. Click Send Questionnaire (1) to send affected suppliers a short, targeted questionnaire. Useful questions: Do you run PHP on internet-facing systems? Which version? Have you upgraded to a fixed version? Have you seen any signs of compromise?
Track progress. Update the insight status (2), for example from New to In Progress, as you work through it.
Related articles
Need help? Contact your Customer Success Manager. We can help you pull your data and choose the right questionnaire.