In responding to PHP2Shell, the first step is identifying externally exposed services running PHP and their status. OFFen ASM automatically discovers internet-exposed assets and identifies services and tech stacks to continuously manage your attack surface. Based on this, you can uncover unmanaged assets and identify services that need review regarding this vulnerability.

First, identify externally exposed assets.

Enter seed info like a primary domain, and OFFen ASM scans for external assets and services. Through this discovery process, you can detect Shadow IT linked to the domain that was missing from security inventories. Review discovered assets' exposed services and ports, verify ownership and operators, and bring them under management scope.

Identify tech stacks to narrow down PHP inspection targets.

OFFen ASM identifies technologies running on discovered assets. Security teams can locate PHP-based services and, if versions are known, compare them with versions affected by PHP2Shell to prioritize review targets. For services lacking clear tech or version details, verify actual environments via operators and dedicated scanners.

Check information leaks and vulnerability risks with endpoint scans.

OFFen ASM inspects key endpoints using the security auditing and vulnerability research expertise of ENKI Whitehat hackers. This identifies risk factors on exposed assets that could lead to data leaks or exploits, providing a solid foundation for rapid response to emerging security threats.

Prepare scanner checks based on verified service addresses.

Compile a checklist of domains and access URLs for confirmed PHP-based services. Security and operations teams can then run dedicated PHP2Shell scanners against this list to determine actual PHP versions and patch statuses.

Beyond asset identification: OFFen ASM assesses real attack risks

Attackers do not just look at domains, IPs, ports, and services. They seek actionable paths like admin logins, configuration/backup file paths, CMS/device URLs exposing versions, and unauthenticated APIs. OFFen ASM checks such endpoints, enabling you to move beyond asset discovery to pinpoint concrete security risks.

Scanned endpoints build on paths used by ENKI Whitehat hackers during penetration tests along with dedicated research databases, while also automatically analyzing target architectures to discover unlisted routes. This covers major CMSs, commercial solutions, network/security appliances, version leaks, PII/document exposures, config/backup dumps, and known exploit points, updated with new vulnerabilities and field cases.

Going beyond simple exposure monitoring, OFFen ASM leverages cataloged asset and tech data whenever critical vulnerabilities arise to swiftly identify and remediate affected systems. Without installing agents or writing code integrations, you can inspect exposed assets, prioritize discovered risks, and achieve more effective security management.

Upon deployment, scan all externally exposed assets for risky endpoints without extra installs or dev integration, and prioritize remediation immediately using the provided risk severity levels.