[{"data":1,"prerenderedAt":1104},["ShallowReactive",2],{"post-en-rea-reverse-engineer-anything-ki-agenten":3,"related-en-rea-reverse-engineer-anything-ki-agenten":229},{"id":4,"title":5,"author":6,"body":7,"category":199,"date":200,"description":201,"draft":202,"extension":203,"faq":204,"image":214,"imageAlt":215,"lang":216,"legacyUrl":217,"meta":218,"navigation":219,"path":220,"readingTime":221,"seo":222,"sitemap":223,"stem":224,"tags":225,"translation":227,"updated":217,"__hash__":228},"insightsEn\u002Fen\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten.md","REA: What AI reverse engineering finds in your applications","blacklens.io Team",{"type":8,"value":9,"toc":190},"minimark",[10,14,19,30,44,48,51,66,69,103,107,121,124,127,131,134,166,169,187],[11,12,13],"p",{},"Reverse engineering used to be specialist work: driving a disassembler, reading pseudocode, testing hypotheses, often for days. The open-source project REA (Reverse Engineer Anything) hands that work to AI agents, and in October 2026 it became one of the fastest-growing repositories on GitHub. Whatever ships inside an app, a desktop client or a firmware image was never secret, only expensive to read. That barrier is now falling.",[15,16,18],"h2",{"id":17},"what-is-rea","What is REA?",[11,20,21,22,29],{},"REA (Reverse Engineer Anything) is an open-source MCP server that lets AI coding agents such as Claude Code, Codex, Cursor or Gemini CLI analyse software without access to its source code. The Model Context Protocol (MCP) is the interface an agent uses to call external tools. Through it, REA drives established tools such as Ghidra or IDA as well as its own parsers. According to the ",[23,24,28],"a",{"href":25,"rel":26},"https:\u002F\u002Fgithub.com\u002Fmorluto\u002Frea",[27],"nofollow","project documentation",", it covers native binaries, JavaScript and Electron apps, .NET assemblies, Android apps, firmware images, websites and network captures. The agent decides what to examine; REA runs the tools and returns the evidence.",[11,31,32,33,37,38,43],{},"The project is MIT-licensed and distributed as the npm package ",[34,35,36],"code",{},"rea-agents",". According to the tracking service OSSInsight, as cited by Startup Fortune, its GitHub stars rose from under 10,000 to around 234,000 between 6 and 14 October 2026. The ",[23,39,42],{"href":40,"rel":41},"https:\u002F\u002Fgithub.com\u002Fmorluto\u002Frea\u002Fblob\u002Fmain\u002FDISCLAIMER.md",[27],"usage policy"," names security research, malware analysis and interoperability as its purpose and explicitly rules out unauthorised access. The tool itself is freely available, to defenders and attackers alike.",[15,45,47],{"id":46},"what-attackers-can-read-from-your-applications","What attackers can read from your applications",[11,49,50],{},"Reverse engineering exposes what a vendor considers hidden in shipped code. For Electron and JavaScript apps REA lists modules, routes and source maps; for Android apps, the manifest and decompiled methods; for websites and network captures, the data in transit.",[11,52,53,54,59,60,65],{},"Embedded secrets have the most serious consequences. In 2022 ",[23,55,58],{"href":56,"rel":57},"https:\u002F\u002Fwww.security.com\u002Fthreat-intelligence\u002Fmobile-supply-chain-aws",[27],"Symantec"," found hard-coded AWS credentials in 1,859 Android and iOS apps. More than three-quarters of those apps contained valid tokens for private cloud services. Often the tokens came from shared libraries and SDKs rather than the vendors' own code. A ",[23,61,64],{"href":62,"rel":63},"https:\u002F\u002Farxiv.org\u002Fabs\u002F2606.12212",[27],"study from June 2026"," found exploitable credentials for AI services in the network traffic of 282 of 444 iOS apps examined. Three months after disclosure, 72% of them were still exploitable.",[11,67,68],{},"Four more findings come within reach of people without specialist skills once AI does the analysis:",[70,71,72,85,91,97],"ul",{},[73,74,75,79,80,84],"li",{},[76,77,78],"strong",{},"Hidden interfaces and hosts:"," every API endpoint an app calls is public, documented or not. Code often also points to test, staging or admin systems, extending the ",[23,81,83],{"href":82},"\u002Fen\u002Fwissen\u002Fexternal-attack-surface-management","external attack surface"," with systems never meant for the public.",[73,86,87,90],{},[76,88,89],{},"Security logic in the client:"," role checks, feature flags and input validation that only run in the app can be read and bypassed. The attacker talks to the back end directly.",[73,92,93,96],{},[76,94,95],{},"Outdated components:"," binaries reveal embedded libraries and their versions; REA, for example, reads module versions from Go programs. Matching them against known CVEs is then routine.",[73,98,99,102],{},[76,100,101],{},"Intellectual property:"," REA itself advertises that you can have a feature from someone else's app investigated and rebuilt for your own project. Whatever edge sits in your code can now be copied faster.",[15,104,106],{"id":105},"software-you-only-operate-becomes-readable-too","Software you only operate becomes readable too",[11,108,109,110,115,116,120],{},"The same analysis applies to products you buy and run at the perimeter. Anyone who wants to exploit a fixed vulnerability has to understand what the update changed, and that analysis is reverse engineering. ",[23,111,114],{"href":112,"rel":113},"https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Ftime-to-exploit-trends-2023",[27],"Mandiant"," measured an average of just five days between disclosure and first observed exploitation for 2023 (excluding outliers; 2018–19: 63 days). Every tool that makes the analysis cheaper squeezes that window further, much as ",[23,117,119],{"href":118},"\u002Fen\u002Finsights\u002Fclaude-mythos-wenn-schwachstellen-schneller-kommen-als-patches","AI-driven vulnerability discovery"," does on the zero-day side.",[11,122,123],{},"VPN gateways, firewalls and IoT devices are particularly exposed. They run closed firmware, and REA takes apart firmware images and native binaries. A hard-coded password or an outdated component in the firmware affects every device in that series that is reachable from the internet.",[11,125,126],{},"The project documentation itself states that decompilation and AI-assisted analysis may be incomplete or incorrect. For attackers that is a small price: one hit is enough.",[15,128,130],{"id":129},"what-helps-and-where-blacklensio-comes-in","What helps – and where blacklens.io comes in",[11,132,133],{},"Five measures work regardless of any product:",[70,135,136,142,148,154,160],{},[73,137,138,141],{},[76,139,140],{},"No secrets in the client:"," keys belong on the server. Where the app needs access, use short-lived tokens with minimal rights, and rotate any key that has ever shipped.",[73,143,144,147],{},[76,145,146],{},"Trust nothing from the client:"," authorisation and validation always run on the server.",[73,149,150,153],{},[76,151,152],{},"Inventory your interfaces:"," treat every endpoint an app calls as public. Debug and staging systems are not reachable from the internet.",[73,155,156,159],{},[76,157,158],{},"Know your dependencies:"," keep a bill of materials (SBOM) for every library you ship, including third-party SDKs, and update promptly.",[73,161,162,165],{},[76,163,164],{},"Patch exposed systems faster:"," the window between update and exploit keeps shrinking.",[11,167,168],{},"Obfuscating the code raises the effort but replaces none of these measures.",[11,170,171,172,176,177,181,182,186],{},"blacklens.io shows which findings of such an analysis can actually be attacked from outside. ",[23,173,175],{"href":174},"\u002Fen\u002Fplatform\u002Fattack-surface-management","Attack Surface Management"," continuously discovers domains, subdomains, IP addresses, services and web applications reachable from the internet. A staging host referenced in your app's code appears there as an asset as soon as it is reachable under your domains, not only once an attacker finds it. The ",[23,178,180],{"href":179},"\u002Fen\u002Fplatform\u002Femerging-threats","early warning system"," in the Threat Center matches new CVEs in real time against the technologies and versions detected by fingerprinting, and checks matches with a verification scan where a verification template exists. With ",[23,183,185],{"href":184},"\u002Fen\u002Fplatform\u002Fpenetration-testing","Penetration Testing as a Service",", OSCP-certified pentesters test your web applications, APIs and infrastructure; findings appear as verified in the same platform, and retests are included in the pentest licence price.",[11,188,189],{},"Reverse engineering is becoming a standard capability. Plan as if your software were readable, because for far more people it now is.",{"title":191,"searchDepth":192,"depth":192,"links":193},"",3,[194,196,197,198],{"id":17,"depth":195,"text":18},2,{"id":46,"depth":195,"text":47},{"id":105,"depth":195,"text":106},{"id":129,"depth":195,"text":130},"analysis","2026-10-20","With REA, AI agents take apart apps, binaries and firmware without source code. Which keys, interfaces and flaws that exposes, and what helps.",false,"md",[205,208,211],{"q":206,"a":207},"What is REA (Reverse Engineer Anything)?","REA (Reverse Engineer Anything) is an open-source MCP server under the MIT licence that lets AI coding agents such as Claude Code, Codex or Cursor analyse software without access to its source code. REA drives tools such as Ghidra or IDA alongside its own parsers and covers native binaries, Electron and JavaScript apps, .NET assemblies, Android apps, firmware and websites. It is distributed as the npm package rea-agents and was one of the fastest-growing repositories on GitHub in October 2026.",{"q":209,"a":210},"What are the risks of reverse engineering applications?","Reverse engineering makes whatever ships inside software readable. Attackers find embedded API keys and access tokens, undocumented interfaces and test or staging hosts, bypass checks that only run in the client, and spot outdated libraries with known vulnerabilities. For software that organisations only operate, such as VPN gateway firmware, analysing an update reveals which flaw the vendor has fixed. Tools such as REA make all of these analyses considerably cheaper.",{"q":212,"a":213},"How does blacklens.io help against the risks of reverse engineering?","blacklens.io shows which findings of such an analysis can actually be attacked from outside. Attack Surface Management continuously discovers domains, subdomains, services and web applications reachable from the internet, including forgotten staging systems. The Threat Center matches new CVEs in real time against the detected technologies and versions and checks matches with a verification scan where a verification template exists. With Penetration Testing as a Service, OSCP-certified pentesters test web applications, APIs and infrastructure, retests included.","\u002Fimages\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten.webp","Schematic lens over a grid of binary data, which appears behind it as ordered, indented lines of code","en",null,{},true,"\u002Fen\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten",4,{"title":5,"description":201},{"loc":220},"en\u002Finsights\u002Frea-reverse-engineer-anything-ki-agenten",[226],"Analysis","rea-reverse-engineer-anything-ki-agenten","X-Ksp6_la8KzUewhxrB1gCOIFDu4kuuo0Y_wDOpS8uQ",[230,640,908],{"id":231,"title":232,"author":6,"body":233,"category":613,"date":614,"description":615,"draft":202,"extension":203,"faq":616,"image":628,"imageAlt":629,"lang":216,"legacyUrl":217,"meta":630,"navigation":219,"path":631,"readingTime":632,"seo":633,"sitemap":634,"stem":635,"tags":636,"translation":638,"updated":614,"__hash__":639},"insightsEn\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php.md","PHP2Shell: two critical PHP flaws, no patch for older versions",{"type":8,"value":234,"toc":606},[235,238,242,258,270,274,277,308,321,325,342,349,364,367,419,422,426,429,505,508,511,515,530,587,602],[11,236,237],{},"PHP will publish an out-of-band security release at 14:00 UTC (16:00 CEST) on 21 October 2026 for two critical flaws known as PHP2Shell, which according to the security firm watchTowr allow remote code execution. The fix covers only the four supported branches, 8.2 to 8.5. According to a count by the security firm Mallory, more than half of the PHP servers that show their version on the internet run an older one.",[15,239,241],{"id":240},"what-is-php2shell","What is PHP2Shell?",[11,243,244,245,248,249,252,253,257],{},"PHP2Shell is the unofficial name for two critical vulnerabilities in the PHP scripting language, tracked as ",[34,246,247],{},"CVE-2026-109618"," and ",[34,250,251],{},"CVE-2026-109619",". According to watchTowr, both allow remote code execution: running an attacker's own commands on the server over the network. The PHP security team rates both ",[23,254,256],{"href":255},"\u002Fen\u002Fwissen\u002Fcvss","CVSS"," 9.2 under version 4.0. According to W3Techs, PHP runs 69 per cent of websites whose server-side language is known, from WordPress to Shopware.",[11,259,260,261,263,264,269],{},"The flaws leaked first. On 20 October, a post on the Hacker News forum announced two PHP flaws rated CVSS 10.0, affecting every version from PHP 5 onwards; the poster admitted having no evidence beyond trust in the source. watchTowr confirmed the flaws were real and under embargo until Thursday, 22 October, and said it believed it had reproduced ",[34,262,247],{},". At 19:33 UTC PHP followed with an ",[23,265,268],{"href":266,"rel":267},"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php#2026-10-20-1",[27],"advance notice"," and moved the release forward by a day. The identifiers and the version range come from the leak; PHP's notice names neither.",[15,271,273],{"id":272},"what-is-known-about-php2shell-and-what-is-not","What is known about PHP2Shell, and what is not",[11,275,276],{},"Only what PHP itself announced is confirmed. As of 21 October 2026, before the release:",[70,278,279,285,291,302],{},[73,280,281,284],{},[76,282,283],{},"Confirmed by PHP:"," two critical flaws rated CVSS 9.2 (v4.0), release on 21 October at 14:00 UTC, or earlier if details become public or attacks appear.",[73,286,287,290],{},[76,288,289],{},"Unconfirmed:"," affected versions and whether an attack needs a particular setup such as PHP-FPM or CGI or a login. Analysis by several security researchers points to the session upload progress feature; PHP itself does not name the component.",[73,292,293,296,297,301],{},[76,294,295],{},"Exploitation:"," none known. Huntress had seen no attacks as of 20 October and knows of no public exploit code; the flaws are not in the ",[23,298,300],{"href":299},"\u002Fen\u002Fwissen\u002Fcisa-kev","CISA KEV catalogue",".",[73,303,304,307],{},[76,305,306],{},"Mitigation before the patch:"," PHP names none officially. As a stopgap, security researchers recommend disabling session upload progress (see the next section); the measure follows from analysis of the leaked flaw and may close only one of the two flaws.",[11,309,310,311,314,315,320],{},"After the release, things will move fast: the corrected source code becomes public, and comparing it with the previous version shows where the flaw was. When ",[34,312,313],{},"CVE-2024-4577",", a PHP flaw in CGI mode on Windows, became public in June 2024, ",[23,316,319],{"href":317,"rel":318},"https:\u002F\u002Fwww.akamai.com\u002Fblog\u002Fsecurity-research\u002F2024-php-exploit-cve-one-day-after-disclosure",[27],"Akamai"," saw exploit attempts against its honeypots within 24 hours.",[15,322,324],{"id":323},"immediate-mitigation-before-the-patch-turn-off-session-upload-progress","Immediate mitigation before the patch: turn off session upload progress",[11,326,327,328,333,334,337,338,341],{},"If you cannot patch at once or are stuck on an end-of-life version, you can disable the feature that is reportedly affected. Several security researchers, among them ",[23,329,332],{"href":330,"rel":331},"https:\u002F\u002Fblog.flatt.tech\u002Fentry\u002Fphp2shell",[27],"Flatt Security"," and J4ck3LSyN, trace the flaws to PHP's session upload progress. The feature parses a field named ",[34,335,336],{},"PHP_SESSION_UPLOAD_PROGRESS"," in ",[34,339,340],{},"multipart\u002Fform-data"," uploads and is enabled by default. The sender of the request sets this field, not the application, so the code runs even if a site never built a progress bar. CERT-EU classes the flaws as possible unauthenticated remote code execution.",[11,343,344,345,348],{},"Turn it off in ",[34,346,347],{},"php.ini"," or the pool configuration, then restart PHP-FPM or Apache:",[350,351,355],"pre",{"className":352,"code":353,"language":354,"meta":191,"style":191},"language-ini shiki shiki-themes material-theme-lighter github-light github-dark","session.upload_progress.enabled = 0\n","ini",[34,356,357],{"__ignoreMap":191},[358,359,362],"span",{"class":360,"line":361},"line",1,[358,363,353],{},[11,365,366],{},"Where you set it matters:",[70,368,369,397,400,407],{},[73,370,371,372,375,376,379,380,382,383,386,387,390,391,337,394,301],{},"You ",[76,373,374],{},"cannot"," change it with ",[34,377,378],{},"ini_set()"," in PHP code. It belongs in ",[34,381,347],{},", for CGI\u002FFastCGI in ",[34,384,385],{},".user.ini"," (cached for up to five minutes, ",[34,388,389],{},"user_ini.cache_ttl","), or under the Apache module via ",[34,392,393],{},"php_flag session.upload_progress.enabled off",[34,395,396],{},".htaccess",[73,398,399],{},"Only progress tracking stops; uploads themselves keep working. The change has no effect in most applications.",[73,401,402,403,406],{},"Confirm the active setting through a ",[34,404,405],{},"phpinfo()"," page, then delete that page again.",[73,408,409,410,412,413,415,416,418],{},"Where ",[34,411,347],{}," is out of reach, a web application firewall can serve as a second layer and alert on or block ",[34,414,340],{}," requests carrying the ",[34,417,336],{}," field. Test in detection mode first: applications with a genuine progress bar send this field legitimately.",[11,420,421],{},"The stopgap does not replace the patch. Flatt Security calls it probably but not certainly effective; J4ck3LSyN suspects it closes only one of the two flaws and that the second sits in the multipart parser. CERT-EU does not mention the setting and advises isolating internet-facing applications that cannot be patched at once until the fix lands.",[15,423,425],{"id":424},"why-older-php-versions-get-no-patch","Why older PHP versions get no patch",[11,427,428],{},"PHP fixes only its supported branches, currently 8.2 to 8.5. PHP 8.1 and older are end of life; if the flaws reach back that far, there is no vendor fix.",[430,431,432,448],"table",{},[433,434,435],"thead",{},[436,437,438,442,445],"tr",{},[439,440,441],"th",{},"Branch",[439,443,444],{},"PHP status",[439,446,447],{},"Fixes until",[449,450,451,463,473,484,494],"tbody",{},[436,452,453,457,460],{},[454,455,456],"td",{},"8.5",[454,458,459],{},"active support",[454,461,462],{},"end of 2029",[436,464,465,468,470],{},[454,466,467],{},"8.4",[454,469,459],{},[454,471,472],{},"end of 2028",[436,474,475,478,481],{},[454,476,477],{},"8.3",[454,479,480],{},"security fixes only",[454,482,483],{},"end of 2027",[436,485,486,489,491],{},[454,487,488],{},"8.2",[454,490,480],{},[454,492,493],{},"end of 2026",[436,495,496,499,502],{},[454,497,498],{},"8.1 and older",[454,500,501],{},"end of life",[454,503,504],{},"no fix",[11,506,507],{},"On 20 October, Mallory counted publicly visible HTTP banners: more than 880,000 internet-facing hosts reported PHP 8.1 or older, 59 per cent of the roughly 1.5 million hosts that showed a version. A further 740,000 or so showed PHP without a version. In Germany, Austria and Switzerland, Mallory puts the share without a fix at 41, 53 and 64 per cent respectively.",[11,509,510],{},"The figures describe banners, not confirmed vulnerable systems. Distributions such as Debian, Ubuntu and Red Hat sometimes backport fixes to older packages. Branch 8.2 is on borrowed time too: its security fixes end with 2026, so anyone patching an 8.2 server today should plan the upgrade now.",[15,512,514],{"id":513},"what-helps-and-why-visibility-is-decisive","What helps – and why visibility is decisive",[11,516,517,518,523,524,529],{},"Preparation largely follows the ",[23,519,522],{"href":520,"rel":521},"https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fphp2shell-leaked-critical-php-vulnerabilities",[27],"rapid-response post by Huntress"," and the ",[23,525,528],{"href":526,"rel":527},"https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-018\u002F",[27],"CERT-EU advisory",":",[531,532,533,539,545,551,581],"ol",{},[73,534,535,538],{},[76,536,537],{},"Build an inventory:"," record every PHP installation, including inside appliances, Windows software and control panels such as cPanel or Plesk. If someone else runs your web server, ask the hosting provider when it will update.",[73,540,541,544],{},[76,542,543],{},"Update from 14:00 UTC:"," internet-facing systems first; check distribution and hosting provider for backported packages.",[73,546,547,550],{},[76,548,549],{},"Protect end-of-life systems:"," move to a supported branch, take the system offline, or put it behind a VPN or web application firewall. CERT-EU advises isolating applications that cannot be patched at once from public networks.",[73,552,553,556,557,560,561,560,564,567,568,571,572,560,575,567,578,301],{},[76,554,555],{},"Watch processes:"," alert when ",[34,558,559],{},"php-fpm",", ",[34,562,563],{},"php-cgi",[34,565,566],{},"httpd"," or ",[34,569,570],{},"apache2"," starts a shell, an interpreter or tools such as ",[34,573,574],{},"curl",[34,576,577],{},"wget",[34,579,580],{},"certutil.exe",[73,582,583,586],{},[76,584,585],{},"Isolate on suspicion:"," disconnect the server, preserve web server and PHP logs, and look for web shells, new files in the web root, cron jobs, scheduled tasks and accounts.",[11,588,589,590,592,593,597,598,601],{},"On patch day, the hard question is rarely how to update but where PHP runs at all. blacklens.io uses ",[23,591,175],{"href":174}," to track continuously which domains, services and web applications are reachable from outside and which technologies run on them; the ",[23,594,596],{"href":595},"\u002Fen\u002Fplatform\u002Fsentry","Sentry Agent"," covers internal systems. Once the CVE records carry product data, the ",[23,599,600],{"href":179},"Threat Center"," matches them against this inventory in real time and shows whether a match rests on the exact version or only on the product, as when a server hides its version. Where no verification template exists yet, it flags the match for manual review. blacklens.io does not see what a PHP process starts on the server; that is a job for monitoring on the host.",[603,604,605],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":191,"searchDepth":192,"depth":192,"links":607},[608,609,610,611,612],{"id":240,"depth":195,"text":241},{"id":272,"depth":195,"text":273},{"id":323,"depth":195,"text":324},{"id":424,"depth":195,"text":425},{"id":513,"depth":195,"text":514},"threat","2026-10-21","PHP2Shell: on 21 October 2026 PHP fixes two critical RCE flaws rated CVSS 9.2, but only for branches 8.2 to 8.5. What admins should do now.",[617,619,622,625],{"q":241,"a":618},"PHP2Shell is the unofficial name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, which according to the security firm watchTowr allow remote code execution. The PHP security team rates both CVSS 9.2 under version 4.0 and announced an out-of-band security release for 21 October 2026 at 14:00 UTC. The flaws became public through a leak on 20 October; PHP will name affected versions and technical details only with the release.",{"q":620,"a":621},"Which PHP versions get a patch for PHP2Shell?","PHP ships a PHP2Shell patch only for its four supported branches: 8.2, 8.3, 8.4 and 8.5. PHP 8.1, 8.0, 7.x and 5.x are end of life and receive no official fix if they turn out to be affected. According to a count by Mallory, more than 880,000 internet-facing hosts reported one of these versions on 20 October 2026. Their options are an upgrade, backported packages from the Linux distribution, or isolation from public networks.",{"q":623,"a":624},"How can I protect myself from PHP2Shell until I can patch?","As a stopgap, security researchers recommend disabling PHP's session upload progress: session.upload_progress.enabled = 0 in php.ini or the pool configuration, then restart PHP-FPM or Apache. Uploads keep working; only progress tracking stops. The measure follows from analysis of the leaked flaw, not from an official PHP instruction, and may close only one of the two flaws. It does not replace the patch, but it helps most on end-of-life systems that get no fix.",{"q":626,"a":627},"How does blacklens.io help find PHP systems at risk from PHP2Shell?","blacklens.io uses Attack Surface Management to track continuously which of an organisation's domains, services and web applications are reachable from the internet and which technologies run on them; the Sentry Agent covers internal systems. The Threat Center matches new CVEs such as CVE-2026-109618 and CVE-2026-109619 against this inventory in real time and shows whether a match rests on the exact version or only on the product. Whether a server has already been attacked must be checked on the host itself.","\u002Fimages\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php.webp","Abstract illustration of overlapping lines of source code in blue and red on a dark background",{},"\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php",5,{"title":232,"description":615},{"loc":631},"en\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php",[637],"Threat landscape","php2shell-kritische-rce-lucken-in-php","rkKZ7MQyjYglblzZW1jwgOr4Y6-NMR2NbM-lwpZgueI",{"id":641,"title":642,"author":6,"body":643,"category":613,"date":886,"description":887,"draft":202,"extension":203,"faq":888,"image":898,"imageAlt":899,"lang":216,"legacyUrl":217,"meta":900,"navigation":219,"path":901,"readingTime":221,"seo":902,"sitemap":903,"stem":904,"tags":905,"translation":906,"updated":217,"__hash__":907},"insightsEn\u002Fen\u002Finsights\u002Fcitrix-netscaler-zero-days-update-allein-reicht-nicht.md","Citrix NetScaler: two zero-days, and patching alone is not enough",{"type":8,"value":644,"toc":880},[645,648,652,674,677,703,706,710,713,743,761,765,768,782,790,792,795,862,871],[11,646,647],{},"For many organisations, Citrix NetScaler Gateway is the door through which staff reach the corporate network from outside. Since at least early September, attackers have been opening that door through previously unknown flaws, without logging in and ending up with root. Citrix released updates on 27 September. They close the flaws, but not a backdoor that is already on the device.",[15,649,651],{"id":650},"what-is-known-about-the-netscaler-zero-days","What is known about the NetScaler zero-days?",[11,653,654,248,657,660,661,666,667,669,670,673],{},[34,655,656],{},"CVE-2026-88771",[34,658,659],{},"CVE-2026-88772"," are two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that let attackers run their own code on the device without authenticating. Citrix published them on 27 September 2026 in ",[23,662,665],{"href":663,"rel":664},"https:\u002F\u002Fsupport.citrix.com\u002Fexternal\u002Farticle\u002FCTX697096\u002Fcitrix-netscaler-adc-and-citrix-netscale.html",[27],"security bulletin CTX697096",", together with six further flaws, and rated both ",[23,668,256],{"href":255}," 9.5 (v4). Citrix has observed both being exploited on unmitigated deployments. The US agency CISA added them to its ",[23,671,672],{"href":299},"KEV catalogue"," the same day, and Germany's BSI and Austria's CERT.at issued warnings.",[11,675,676],{},"The flaws affect customer-managed deployments of these versions; Citrix updates the cloud services it runs itself:",[70,678,679,685,691,697],{},[73,680,681,682],{},"NetScaler ADC and Gateway 14.1 before ",[34,683,684],{},"14.1-73.37",[73,686,687,688],{},"NetScaler ADC and Gateway 13.1 before ",[34,689,690],{},"13.1-64.23",[73,692,693,694],{},"NetScaler ADC FIPS 14.1 before ",[34,695,696],{},"14.1-73.37 FIPS",[73,698,699,700],{},"NetScaler ADC FIPS and NDcPP 13.1 before ",[34,701,702],{},"13.1-37.279",[11,704,705],{},"The Shadowserver Foundation counts more than 20,000 NetScaler instances reachable from the internet and potentially at risk. How many were compromised is unknown. Citrix has disclosed neither the scope nor the timing of the attacks, and as of 30 September no threat actor had been named.",[15,707,709],{"id":708},"how-the-attacks-on-netscaler-work","How the attacks on NetScaler work",[11,711,712],{},"Both flaws end in command execution on the device before anyone has logged in, by different routes.",[70,714,715,729],{},[73,716,717,722,723,728],{},[76,718,719,721],{},[34,720,656],{},", commands via the device's own log:"," It affects every deployment in its default configuration. ",[23,724,727],{"href":725,"rel":726},"https:\u002F\u002Fcert.europa.eu\u002Fblog\u002Ftaking-execute-logging-a-bit-too-literally-cve-2026-88771",[27],"CERT-EU's analysis"," describes a script that, after a Packet Engine failure, searches the log files for the name of the crash dump and inserts the match unquoted into a shell command. Attackers write crafted lines into the log without authenticating, and the script executes them.",[73,730,731,736,737,742],{},[76,732,733,735],{},[34,734,659],{},", memory overflow via DTLS:"," It requires DTLS, which is enabled by default on VPN virtual servers and therefore on most gateways. According to ",[23,738,741],{"href":739,"rel":740},"https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fdefending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",[27],"Mandiant and Google Threat Intelligence",", attackers send fragmented, malformed DTLS packets to UDP port 443. These corrupt the Packet Engine's heap memory and yield root privileges on the underlying FreeBSD system.",[11,744,745,746,749,750,248,753,756,757,760],{},"Mandiant has documented what happens next at government bodies, financial services firms, education institutions and legal and professional services firms in North America and Europe. The attackers modify the web server configuration ",[34,747,748],{},"\u002Fetc\u002Fhttpd.conf"," so that files ending in ",[34,751,752],{},".sig",[34,754,755],{},".deb"," run as PHP. The WHIPSHOT web shell then receives Base64-encoded commands in HTTP headers such as ",[34,758,759],{},"NSC_LDAP",". The Python tool SLAPSHOT serves as a tunnel into the internal network: for reconnaissance, credential theft and moving on to other systems.",[15,762,764],{"id":763},"why-the-update-alone-is-not-enough","Why the update alone is not enough",[11,766,767],{},"The update closes the flaws but removes neither a web shell nor stolen credentials. Mandiant states explicitly that patching does not remove an existing compromise. By Mandiant's account, the attacks have been running since at least early September, and security researcher Kevin Beaumont describes attacks unfolding throughout the month. CERT-EU therefore recommends a compromise assessment for every internet-facing appliance running an affected build.",[11,769,770,771,774,775,248,778,781],{},"The August update is a second trap. On 19 August, Citrix fixed ",[34,772,773],{},"CVE-2026-19490",", an authentication bypass (CVSS 9.3), in builds ",[34,776,777],{},"14.1-73.32",[34,779,780],{},"13.1-63.21",". Those builds are below the new minimum versions and remain vulnerable. Patching quickly in August is not enough now.",[11,783,784,785,789],{},"A NetScaler Gateway also accepts VPN logins and queries LDAP or RADIUS servers behind it. Anyone with root on it sees the credentials and sessions passing through. The pattern is familiar from ",[23,786,788],{"href":787},"\u002Fen\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden","FortiBleed",": the compromised perimeter device becomes a collection point for credentials.",[15,791,514],{"id":513},[11,793,794],{},"Order matters, because the reboot after the update wipes evidence held in memory:",[531,796,797,803,809,833,856],{},[73,798,799,802],{},[76,800,801],{},"Check the inventory:"," record every NetScaler instance, including test, disaster-recovery and HA partner devices, and compare the build number against the minimum versions above.",[73,804,805,808],{},[76,806,807],{},"Preserve evidence:"," before updating, the Dutch NCSC advises backing up memory and at least one month of log files. For virtual appliances, Mandiant recommends a snapshot that includes memory.",[73,810,811,814,815,567,818,821,822,824,825,828,829,832],{},[76,812,813],{},"Check for compromise:"," unfamiliar ",[34,816,817],{},"AddHandler",[34,819,820],{},"AliasMatch"," entries in ",[34,823,748],{},", PHP files under ",[34,826,827],{},"\u002Fvar\u002Fnetscaler\u002Fgui\u002F",", a SUID bit on ",[34,830,831],{},"\u002Fbin\u002Fsh",", and log entries reading \"PPE missed too many heartbeats\" alongside Base64 text in the User-Agent. Mandiant provides hunting commands and YARA rules.",[73,834,835,838,839,567,841,843,844,560,847,852,853,301],{},[76,836,837],{},"Update:"," to ",[34,840,684],{},[34,842,690],{},", or the corresponding FIPS and NDcPP builds. For ",[34,845,846],{},"CVE-2026-88778",[23,848,851],{"href":849,"rel":850},"https:\u002F\u002Fwww.cert.at\u002Fde\u002Fwarnungen\u002F2026\u002F9\u002Fkritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar",[27],"CERT.at"," (in German) also recommends ",[34,854,855],{},"set ns tcpparam -enhancedISNgeneration ENABLED",[73,857,858,861],{},[76,859,860],{},"Renew credentials:"," rotate admin passwords, SSH keys, TLS certificates and LDAP, RADIUS and API credentials, and terminate active admin, VPN and ICA sessions.",[11,863,864,865,867,868,870],{},"If you cannot update immediately, disabling DTLS or blocking UDP port 443 upstream reduces the risk from ",[34,866,659],{},". It does nothing against ",[34,869,656],{},": that flaw has no precondition, and Citrix lists no workaround.",[11,872,873,874,876,877,879],{},"In weeks like this, the inventory takes the longest: which NetScaler instances exist and which are reachable from the internet. blacklens.io builds that inventory continuously from the outside through ",[23,875,175],{"href":174},", including devices nobody internally remembers. The ",[23,878,600],{"href":179}," matches new CVEs like these against the detected technologies, flags KEV entries with the date added and due date, and confirms affected systems with a verification scan where a verification template exists. It does not detect a web shell on the device; that check remains work on the appliance itself.",{"title":191,"searchDepth":192,"depth":192,"links":881},[882,883,884,885],{"id":650,"depth":195,"text":651},{"id":708,"depth":195,"text":709},{"id":763,"depth":195,"text":764},{"id":513,"depth":195,"text":514},"2026-09-30","Two zero-days in Citrix NetScaler ADC and Gateway are under active exploitation: which builds are affected and what to do before and after updating.",[889,892,895],{"q":890,"a":891},"What are CVE-2026-88771 and CVE-2026-88772?","CVE-2026-88771 and CVE-2026-88772 are two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, rated CVSS 9.5, that let attackers run code on the device without authenticating. Citrix released updates on 27 September 2026 and confirms active exploitation. CVE-2026-88771 affects every deployment in its default configuration; CVE-2026-88772 affects devices with DTLS enabled, the default on VPN virtual servers. Both are fixed from builds 14.1-73.37 and 13.1-64.23.",{"q":893,"a":894},"Is updating Citrix NetScaler enough after the zero-days?","Updating Citrix NetScaler to 14.1-73.37 or 13.1-64.23 closes the flaws but does not remove a backdoor that attackers have already installed. According to Mandiant, the attacks had been running since at least early September and left web shells and tunnelling tools behind. Before updating, back up logs and memory and check the device for compromise; afterwards, renew passwords, certificates and service accounts and terminate active sessions. The August update does not protect against these flaws either.",{"q":896,"a":897},"How does blacklens.io help find affected NetScaler systems?","blacklens.io uses Attack Surface Management to continuously identify which of an organisation's systems are reachable from the internet and which technologies run on them, including NetScaler gateways. The Threat Center matches new CVEs against this inventory, flags entries in the CISA KEV catalogue with date added and due date, and confirms affected systems with a verification scan where a verification template exists. A compromise on the device itself, such as a web shell, still has to be investigated on the device.","\u002Fimages\u002Finsights\u002Fcitrix-netscaler-zero-days-update-allein-reicht-nicht.webp","Hooded figure with a hidden face in front of blurred lines of code",{},"\u002Fen\u002Finsights\u002Fcitrix-netscaler-zero-days-update-allein-reicht-nicht",{"title":642,"description":887},{"loc":901},"en\u002Finsights\u002Fcitrix-netscaler-zero-days-update-allein-reicht-nicht",[637],"citrix-netscaler-zero-days-update-allein-reicht-nicht","vuUX3gg10P6lsBk0bqGskTTBtJw5D16CBJVpWmSX9LY",{"id":909,"title":910,"author":6,"body":911,"category":1077,"date":1078,"description":1079,"draft":202,"extension":203,"faq":1080,"image":1090,"imageAlt":1091,"lang":216,"legacyUrl":217,"meta":1092,"navigation":219,"path":1093,"readingTime":192,"seo":1094,"sitemap":1095,"stem":1099,"tags":1100,"translation":1102,"updated":217,"__hash__":1103},"insightsEn\u002Fen\u002Finsights\u002Fthreat-center-neue-cves-automatisch-verifiziert.md","Threat Center: From CVE alarm to confirmed exposure",{"type":8,"value":912,"toc":1070},[913,916,920,923,926,930,933,936,968,972,975,982,990,994,997,1028,1034,1041,1045,1048,1056],[11,914,915],{},"Critical new vulnerabilities in firewalls, VPN gateways and mail servers now arrive week after week. The question that matters is never whether there is a new CVE. It is whether it affects your organisation. The Threat Center in blacklens.io answers exactly that: automatically, for your systems, with evidence.",[15,917,919],{"id":918},"what-is-the-threat-center","What is the Threat Center?",[11,921,922],{},"The Threat Center is the blacklens.io early warning system for new vulnerabilities. It continuously matches newly published CVEs against the technologies your organisation runs and shows only the matches that really affect you. It builds on the inventory blacklens.io already creates from external scans, the Sentry agent and your cloud connectors. There is nothing extra to set up.",[11,924,925],{},"Behind it sits a threat feed of more than 140,000 CVEs, over 26,000 of them with a public exploit. From that volume, your team gets the short list of vulnerabilities that apply to your firewall, your Exchange server or your Citrix gateway.",[15,927,929],{"id":928},"why-a-cve-newsletter-is-no-longer-enough","Why a CVE newsletter is no longer enough",[11,931,932],{},"CVE newsletters and CERT warnings matter, but they are written for everyone. Whether the product runs in your environment, in which version and on which system, your team has to work out afterwards. With several critical notices a week, that search costs hours, and those are the hours in which attackers start scanning.",[11,934,935],{},"The Threat Center reverses the order. Instead of a general warning, you get a list of affected systems, each with the signals that matter for prioritisation:",[70,937,938,947,955,961],{},[73,939,940,946],{},[76,941,942,529],{},[23,943,945],{"href":944},"\u002Fen\u002Fwissen\u002Fepss","EPSS"," how likely is exploitation within the next 30 days?",[73,948,949,954],{},[76,950,951,529],{},[23,952,953],{"href":299},"CISA KEV"," is the vulnerability already under active attack, and by when should it be fixed?",[73,956,957,960],{},[76,958,959],{},"Exploit:"," is attack code publicly available?",[73,962,963,967],{},[76,964,965,529],{},[23,966,256],{"href":255}," how severe is the vulnerability technically?",[15,969,971],{"id":970},"from-warning-to-certainty","From warning to certainty",[11,973,974],{},"A match in the inventory is a suspicion. So blacklens.io checks it: where a verification template exists for the CVE, a targeted scan against the affected system starts automatically. The result is clear, either confirmed or not confirmed. Your team spends its time on real findings, not guesswork.",[11,976,977],{},[978,979],"img",{"alt":980,"src":981},"Threat detail view in the Threat Center with CVSS 10, EPSS score, CISA KEV due date and a running verification scan","\u002Fimages\u002Finsights\u002Fthreat-center-neue-cves-automatisch-verifiziert-2.webp",[11,983,984,985,989],{},"The detail view shows at a glance how critical a vulnerability is, whether it is already being exploited and which systems are affected. Confirmed matches become regular findings in the same ",[23,986,988],{"href":987},"\u002Fen\u002Fwissen\u002Fvulnerability-management","vulnerability management"," workflow as everything else, with assignment, ticket and retest.",[15,991,993],{"id":992},"fewer-alarms-more-impact","Fewer alarms, more impact",[11,995,996],{},"An early warning system that rings all the time gets ignored. The Threat Center is built to stay quiet:",[70,998,999,1005,1011,1022],{},[73,1000,1001,1004],{},[76,1002,1003],{},"Threshold per workspace:"," alerts start at a CVSS score of your choice, 7 by default.",[73,1006,1007,1010],{},[76,1008,1009],{},"Grouped, not one by one:"," new CVEs for the same product produce one alert, not dozens.",[73,1012,1013,1016,1017,1021],{},[76,1014,1015],{},"To the right team:"," notification policies route alerts by e-mail, push or through ",[23,1018,1020],{"href":1019},"\u002Fen\u002Fplatform\u002Fintegrations","integrations"," such as Jira, Microsoft Teams and Microsoft Sentinel.",[73,1023,1024,1027],{},[76,1025,1026],{},"Escalated automatically:"," when exploitation is likely and an exploit is available, urgency rises on its own.",[11,1029,1030],{},[978,1031],{"alt":1032,"src":1033},"Alert list with grouped threat intel alerts, such as \"35 Emerging CVEs may affect Microsoft Sql Server\"","\u002Fimages\u002Finsights\u002Fthreat-center-neue-cves-automatisch-verifiziert-4.webp",[11,1035,1036,1037,1040],{},"The ",[76,1038,1039],{},"Advisories"," view adds vendor security notices, so broader warnings sit in the same tool.",[15,1042,1044],{"id":1043},"what-this-means-for-your-organisation","What this means for your organisation",[11,1046,1047],{},"The time between a vulnerability's disclosure and the first attack is the window in which you can act. The Threat Center shortens the path from \"a new CVE is out\" to \"these systems are affected, it is confirmed, and the responsible team has the ticket\".",[11,1049,1050,1051,1055],{},"At the same time, it builds a traceable record of which vulnerabilities were detected, checked and handled. That helps in audits and with requirements such as ",[23,1052,1054],{"href":1053},"\u002Fen\u002Fwissen\u002Fnis2","NIS2",", which call for structured vulnerability handling.",[11,1057,1058,1061,1062,1065,1066,1069],{},[76,1059,1060],{},"Get started:"," the Threat Center is active in blacklens.io under ",[76,1063,1064],{},"Threat Center → Emerging Threats"," as soon as your technology inventory is in place. Read more about the ",[23,1067,1068],{"href":179},"early warning system for zero-days and new CVEs"," on the platform page.",{"title":191,"searchDepth":192,"depth":192,"links":1071},[1072,1073,1074,1075,1076],{"id":918,"depth":195,"text":919},{"id":928,"depth":195,"text":929},{"id":970,"depth":195,"text":971},{"id":992,"depth":195,"text":993},{"id":1043,"depth":195,"text":1044},"release","2026-09-24","The blacklens.io Threat Center is your early warning system for new vulnerabilities: it shows which CVEs affect your systems and confirms it by scan.",[1081,1084,1087],{"q":1082,"a":1083},"What does the blacklens.io Threat Center do?","The Threat Center is the blacklens.io early warning system for new vulnerabilities. It continuously matches newly published CVEs against the technologies your organisation actually runs and shows only the matches that affect you. Where a verification template exists, a targeted scan automatically confirms whether your system is vulnerable. Signals such as EPSS and CISA KEV show what needs fixing first.",{"q":1085,"a":1086},"How do I know whether a new vulnerability affects my organisation?","Whether a new vulnerability affects your organisation depends on whether the named product runs in an affected version in your environment and whether it can be reached. That requires an up-to-date inventory of your technologies. An early warning system such as the Threat Center matches new CVEs against this inventory automatically and checks the affected systems by scan, instead of your team chasing every warning by hand.",{"q":1088,"a":1089},"How does the Threat Center prevent alert fatigue?","The Threat Center only raises alerts above a CVSS threshold you set per workspace, 7 by default. blacklens.io groups new CVEs for the same product into a single alert instead of reporting each one. Notification policies route alerts by severity to the right team, by e-mail, push or through integrations such as Jira, Microsoft Teams and Microsoft Sentinel. Every match stays visible in the list.","\u002Fimages\u002Finsights\u002Fthreat-center-neue-cves-automatisch-verifiziert.webp","Emerging Threats list in the blacklens.io Threat Center with new CVEs, state and risk signals per technology",{},"\u002Fen\u002Finsights\u002Fthreat-center-neue-cves-automatisch-verifiziert",{"title":910,"description":1079},{"loc":1093,"images":1096},[1097,1098],{"loc":981},{"loc":1033},"en\u002Finsights\u002Fthreat-center-neue-cves-automatisch-verifiziert",[1101],"Release notes","threat-center-neue-cves-automatisch-verifiziert","wEIzwGFMdqPmNnfyQFG5AXJO_wvJ_zy5tF6u2YMMIHE",1792565714976]