Picus Security: PHP2Shell highlights limitations of automated penetration testing
The disclosure of critical PHP vulnerabilities revealed that automated penetration testing often struggles to assess defensive posture before reliable exploit code is available.
The October 2026 disclosure of critical PHP vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), has highlighted distinct limitations in automated security validation. Because these memory-safety bugs exist within the PHP interpreter, they impact a wide range of platforms, from custom applications to vendor appliances.
According to Picus Security, automated penetration testing tools faced structural barriers during the initial response phase. These tools typically validate security by executing actual exploits, which were not available on day one. Furthermore, launching unverified exploits in live production environments poses a high risk of service disruption. As a result, many vendors defaulted to fingerprinting software versions—a task that, while useful, fails to answer the critical question of whether existing security controls would successfully stop an incoming attack.
In contrast, Breach and Attack Simulation (BAS) approaches allow organizations to test their security posture without needing to detonate potentially unstable exploit code. By simulating the malicious traffic patterns associated with the vulnerability, security teams were able to verify which controls were effectively blocking threats within hours of the advisory.
This gap between vulnerability identification and active defense validation underscores the evolving requirements for cybersecurity teams. While version scanning provides basic visibility, simulation tools provide the actionable evidence needed to understand how a network reacts to specific threat vectors.