Insignary has launched insignary-chk, a free, read-only tool designed to identify vulnerabilities known as PHP2Shell and Node2Shell. These security flaws affect the PHP and Node.js runtimes and have been added to the CISA Known Exploited Vulnerabilities catalog.
The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2. They impact various PHP deployments, including Apache mod_php and PHP-FPM. Patches were released on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Node2Shell, identified as CVE-2026-111497, is an out-of-bounds write flaw in the Brotli decompression library used by Node.js. It is addressed in Node.js versions 22.23.4, 24.22.1, and 26.12.1. The tool also scans for Brotli copies in Python packages and system libraries.
The utility operates on Linux x86_64 systems without requiring installation or registration. It categorizes findings by urgency, labeling them as Act now, Fix soon, or Review. The tool does not transmit data over the network and performs no changes unless the user selects the fix option.
Insignary, based in Toronto, specializes in binary software composition analysis. The new tool complements the company's existing Clarity product line, which identifies components in compiled applications and firmware without needing source code access.
