October 26, 2026

Summary

Numerous updates related to PHP2Shell.
- The PHP fingerprint in the Platform and ASM has been updated to include inferred presence from numerous other software fingerprints.
- Use the Censys ARC PHP2Shell dashboard to track worldwide PHP exposure over time.
- Reference the Censys ARC Rapid Response advisory for PHP2Shell for additional details.
Use the new fingerprint observation API endpoint in the Adversary Investigation module to retrieve fingerprint observations for a host.
Updates for the Censys Platform Palo Alto Cortex XSOAR/XSIAM, ServiceNow TISC, SentinelOne Singularity Operations Center, and Microsoft Sentinel integrations.
Added four new fingerprints to the Platform and one new ASM risk fingerprint for PHP2Shell.
Two additional Censys ARD Rapid Response advisories for GitLab Unauthenticated Remote Code Execution [CVE-2026-110264] and Plex Media Server Remote Code Execution Chain [CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656].

Use the Censys ARC PHP2Shell dashboard to track worldwide PHP exposure over time.
Reference the Censys ARC Rapid Response advisory for PHP2Shell for additional details.
Updated the php fingerprint to include inferred presence from over 30 other software fingerprints.

Version 3.2.3 of the Censys Platform integration with Palo Alto XSOAR was released.
- Updated the human-readable output of the ip and cen-rescan commands to include the reputation details returned by Censys and to display the network and privacy details from the IPinfo source only.
- Added support for additional context outputs in the ip and cen-rescan commands.
The enrichment workflows available in the Censys Platform integration with SentinelOne Singularity Operations Center have been updated to show host reputation labels and scores at the top of the note added to alerts.
Version 1.1.0 of the Censys Platform ServiceNow TISC integration was released.
- Added the option to use the host enrichment API when enriching host assets in ServiceNow TISC.
Version 3.0.1 of the Censys Platform Microsoft Sentinel integration was released.
- Host reputation labels and scores are now shown in the comments added to incidents.

Use the new fingerprint observation API endpoint to retrieve fingerprint observations for a host.
- Use this endpoint to see which TLS certificate chains an IP has presented, on which ports, and when, so you can spot infrastructure changes or pivot to related hosts.

Added four new fingerprints to the Platform and one new risk fingerprint to ASM.

Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.

Type	Name	Description	Query
software	changedetection.io	An open-source web page monitoring and change-detection tool that automatically tracks websites for text, price, or structural updates and sends instant alerts.	Platform query
software	CLIProxyAPI	An open-source local proxy server written in Go that turns web-based AI subscriptions (like ChatGPT Plus, Claude Pro, and Gemini Advanced) into standard, OpenAI-compatible API endpoints.	Platform query
software	MarkLogic Server	A NoSQL multi-model database platform designed to ingest, manage, search, and analyze large volumes of disparate data.	Platform query
software	ManageEngine OpManager	A network and IT infrastructure monitoring solution designed to help IT teams track the health, performance, and availability of physical and virtual devices	Platform query

Name	Description	Query
Vulnerable PHP (php2shell) [CVE-2026-109618 / CVE-2026-109619]	This is a service running a version of PHP that is affected by CVE-2026-109618 (an out-of-memory handling flaw) and/or CVE-2026-109619 (a use-after-free flaw affecting global request state), together nicknamed "php2shell". Both are rated CVSS 9.2 by the PHP project and allow an unauthenticated remote attacker to execute code on any PHP installation serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.	`risks.name: "Vulnerable PHP (php2shell) [CVE-2026-109618 / CVE-2026-109619]"`

The Censys ARC team published information about the following issues in addition to PHP2Shell.