~Non-intrusive command-line tool detects the critical PHP2Shell remote-code-execution flaw and the eMudhra/emSign class of recoverable TLS certificates – safely, across an entire estate~
MUMBAI, October 27, 2026 — eScan, the cybersecurity brand of MicroWorld, today released a free command-line scanner that lets organisations quickly identify which of their systems are exposed to two of October’s most serious security events: the PHP2Shell remote-code-execution vulnerability in PHP, and the recoverable private keys discovered in certificates issued by the certificate authority eMudhra.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical flaws in PHP core – the interpreter that runs a large share of the world’s websites – rated 9.8 out of 10 on the CVSS v3.1 scale. The vulnerability allows an attacker to execute code on a server with no credentials and no user interaction. Because the flaw lives in the runtime itself rather than in any single application, every site a vulnerable server hosts is at risk. The bugs were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while older branches receive limited or no official fixes. According to security firm Mallory, roughly 2.6 million internet-facing services were advertising a PHP version on the day the patch shipped, and close to three-quarters of them were running branches that will never receive an official release – and attackers were already probing for the flaw before the fix was public.
Days later, a second incident compounded the urgency. Researchers found that eight intermediate certificate authority keys operated by eMudhra under its emSign brand had been generated so poorly that the private keys were tiny whole numbers – one was simply the number 4 – and could be recovered by anyone in under a second (CVE-2026-111943).
Major browsers moved to withdraw trust from the affected roots, and eMudhra announced it would exit the global TLS certificate business. Because Indian government services and several banks have long relied on emSign certificates, many organisations now need a fast, reliable way to answer a question they never had to ask before: what certificate authority (CA) is my website’s trust actually anchored to, and is any certificate in that chain cryptographically weak?
eScan’s new tool answers both questions in a single sweep. Pointed at an IP address, a network range, a domain, or a file of targets, it determines each host’s exposure to PHP2Shell and inspects the full TLS certificate chain the host presents, flagging any certificate with a recoverable key and naming the issuing organisation, so that an “emSign” certificate is clearly identified as eMudhra’s. Given a domain and the relevant option, the tool also discovers its subdomains (through Certificate Transparency records) and scans each one it finds. It then prints a plain verdict, the evidence behind it, and the specific remediation for each finding.
“When a vulnerability like PHP2Shell is being exploited before the patch is even out, defenders need to find their exposed systems in hours, not weeks, and they shouldn’t have to pay for the privilege or risk knocking over the very servers they’re trying to protect,” said Govind Rammurthy, CEO and Managing Director of eScan. “We built this to be safe to run against a live estate and honest about what it can and cannot confirm. A tool that falsely reassures you is worse than no tool at all.”
What distinguishes the tool is its method. It establishes exposure by reading what a host already reveals, and never by sending the attack traffic that triggers the vulnerability. It cannot crash or destabilise a live server, which makes it safe to run across production, customer, and government infrastructure. It is also deliberately honest about the limits of remote detection: it confirms a vulnerable version with high confidence, but it will never declare a host “safe” on remote evidence alone – because distributions patch without changing version numbers – instead grading every finding and stating the reason behind it.
“The eMudhra episode showed that you cannot simply trust a certificate authority’s word about its own keys — you have to verify what is actually deployed,” he added. “This scanner lets any organisation check for itself, free of charge.”
The scanner is available now at no cost for Windows, with no registration required, from our homepage at https://www.escanav.com.
