---
title: "Tenable gave PHP's 9.2 flaws its highest rating, then patched PHP out of its own scanners"
description: "The Nessus maker gave the PHP2Shell flaws its highest concern rating, then spent October 22 patching PHP out of its own appliances. Its next bet is selling exposure data to AI agents; one launch partner already runs an autonomous security center on top of it."
publisher: "The Inference"
section: "Security"
published: 2026-10-23T18:07:29.468Z
modified: 2026-10-23T18:07:29.468Z
canonical: https://theinference.org/article/tenable-gave-php-s-9-2-flaws-its-highest-rating-then-patched-php-out-of-its-own-scanners
language: en
keywords: "Tenable, PHP, Vulnerabilities, AI Security, Exposure Management, Nessus"
---

# Tenable gave PHP's 9.2 flaws its highest rating, then patched PHP out of its own scanners

> The Nessus maker gave the PHP2Shell flaws its highest concern rating, then spent October 22 patching PHP out of its own appliances. Its next bet is selling exposure data to AI agents; one launch partner already runs an autonomous security center on top of it.

Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an unauthenticated attacker run code on any installation serving web requests; the PHP security team rates both 9.2 out of 10, and researchers [call the chain php2shell](https://theinference.org/article/ai-found-the-flaw-under-most-of-the-web-fastly-is-selling-a-wall-it-has-not-finished) [1]. [Tenable](https://theinference.org/markets/companies/tenable), the company behind the Nessus vulnerability scanner, [graded the pair Vulnerability of Concern](https://itwire.com/business-it-news/security/tenable-websites-being-taken-down-worldwide-for-critical-security-upgrade), its highest tier under Vulnerability Watch [1][2].

![Tenable Research Special Operations blog header for the php2shell FAQ covering CVE-2026-109618 and CVE-2026-109619](https://storage.googleapis.com/theinference-public/img/407df1018be02df1.jpg)

*Tenable's php2shell FAQ, the advisory that graded the PHP flaws Vulnerability of Concern. (Courtesy of Tenable)*

Tenable graded its own products too: Tenable Security Center and Enclave Security both ship PHP, and on October 22 the company shipped [precautionary patch SC-202610.1](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote), moving them to the fixed PHP 8.2.35 [1]. Exploitation had begun on October 17, four days before disclosure, on [Amazon](https://theinference.org/markets/companies/amazon)'s MadPot honeypots [1].

## One prompt found what a decade missed

The affected code path dates to PHP 5.4.0, released in 2012 [1]. The PHP Foundation credited Calif, Wiz and [OpenAI](https://theinference.org/markets/companies/openai); both research teams say AI models did part of the finding [1]. Chainguard chief executive Dan Lorenc says the night his team was briefed it [rediscovered the same flaw with a frontier model given one prompt](https://hackernoon.com/nsa-says-patch-or-go-offline-as-ai-found-php2shell-flaws-reach-70percent-of-the-web): "find bad vulnerabilities in PHP" [3].

Tenable research engineer Satnam Nerang wrote on October 23 that "AI-assisted vulnerability discovery is creating larger haystacks, but it isn't finding more needles [2]. These flaws are the needles" [2]. Unit 42 counts over 22.6 million internet-exposed instances as potentially vulnerable; the NSA, FBI and CISA urged patching, with CISA telling those who cannot update to take systems offline [3][1].

## Tenable sells the haystack to the agents

Tenable's commercial answer [landed on October 20, the day the CVE identifiers leaked](https://markets.businessinsider.com/news/stocks/tenable-expands-open-security-ecosystem-to-extend-exposure-intelligence-and-accelerate-ai-security-outcomes-1036643621): OPEN for AI, twelve launch partners including [SentinelOne](https://theinference.org/markets/companies/sentinelone), Splunk and Snyk, feeding exposure data to agents through the Hexa AI MCP server (the agent-tool protocol) and the CyberAgents Exchange marketplace [4]. Product chief Eric Doerr's claim of "the only exposure management provider offering a truly unrestricted, vendor-agnostic ecosystem of validated AI use cases" arrived with no independent benchmark [4][5].

A day later, partner SentinelOne [unveiled Singularity ASOC](https://www.tmcnet.com/usubmit/2026/10/21/10467389.htm), an autonomous security operations center whose Purple models have completed more than 400,000 investigations and saved an estimated 332,000 analyst hours, with Tenable among its 50-plus ingested data sources [6]. SentinelOne, fresh from a $1.44 billion zero-coupon raise, is partner and possible substitute at once: the agent sits above every scanner, Tenable's included [6].

## The price already assumes the boom

*Chart: **Revenue has climbed for twelve quarters while annual growth halved** Line chart of Tenable's quarterly revenue rising from about $202 million in Q3 2023 to $269 million in Q2 2026, with the slope flattening*

*Quarterly revenue in US$ millions, as reported in Tenable's SEC filings, Q3 2023 through Q2 2026. [8]*

TENB [rose 4.3% on October 21](https://www.gurufocus.com/news/9135447/tenable-holdings-inc-tenb-shares-surge-43-what-gf-score-of-75-tells-investors) to $40.67, near the 52-week high of $43.67 [7]. That is 18.6 times forward earnings against 701.2 times trailing; GuruFocus ranks profitability 3 of 10, and insiders were net sellers of $2.4 million over a year [7]. The demand case is real: patch cycles are flooding with AI-assisted flaws [2], and [Evercore](https://theinference.org/markets/companies/evercore) ISI says the flaw may spur security remediation work [4]. Net income has swung between -$22.9 million and +$3.8 million a quarter since the start of 2025 [8].

*Chart: **Tenable's annual revenue growth has halved in three years** Line chart of Tenable's year-over-year revenue growth slowing from about 15.5 percent in late 2023 to 8.6 percent in Q2 2026*

*Year-over-year revenue growth by calendar quarter, as reported in Tenable's SEC filings, Q3 2023 through Q2 2026. [9]*

## Watch the catalog, then the earnings call

The CISA Known Exploited Vulnerabilities catalog still lacked both CVEs on October 22 [1]. The fiscal third-quarter report, due within weeks [4], will show whether October became renewals rather than one quarter of scanning, and whether the $400 million revolver Tenable closed this month buys the agent layer instead of another scanner. Finding the needle now costs one sentence of prompt; owning the map of what is exposed is what still gets paid.

## Takeaway

AI-assisted discovery turned a 2012 PHP code path into the web's biggest patch event; Tenable's answer, OPEN for AI, sells exposure data to agents, but 8.6% growth and a 701x trailing multiple already price in the boom.

## Sources

1. [Tenable Research Special Operations, php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ, Tenable blog, 21 October 2026, updated 23 October 2026](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)
2. [Satnam Nerang, Tenable, Websites being taken down worldwide for critical security upgrade, iTWire, 23 October 2026](https://itwire.com/business-it-news/security/tenable-websites-being-taken-down-worldwide-for-critical-security-upgrade)
3. [HackerNoon, NSA Says Patch PHP or Go Offline as AI-Found PHP2Shell Flaws Reach ~70% of the Web, 23 October 2026](https://hackernoon.com/nsa-says-patch-or-go-offline-as-ai-found-php2shell-flaws-reach-70percent-of-the-web)
4. [Tenable press release, Tenable Expands Open Security Ecosystem to Extend Exposure Intelligence and Accelerate AI Security Outcomes, GlobeNewswire via Markets Insider, 20 October 2026 (page also carries live TENB quote and TipRanks analyst headlines)](https://markets.businessinsider.com/news/stocks/tenable-expands-open-security-ecosystem-to-extend-exposure-intelligence-and-accelerate-ai-security-outcomes-1036643621)
5. [The Datatech Times, Tenable opens AI workflow ecosystem with twelve security partners, October 2026](https://thedatatechtimes.com/cybersecurity/tenable-opens-ai-workflow-ecosystem-twelve-security-partners)
6. [SentinelOne press release, SentinelOne Brings Security Superintelligence to the SOC With Singularity ASOC, via TMCnet, 21 October 2026](https://www.tmcnet.com/usubmit/2026/10/21/10467389.htm)
7. [GuruFocus, Tenable Holdings Inc (TENB) Shares Surge 4.3%: What GF Score of 75 Tells Investors, 21 October 2026](https://www.gurufocus.com/news/9135447/tenable-holdings-inc-tenb-shares-surge-43-what-gf-score-of-75-tells-investors)
8. [Tenable Holdings, quarterly figures from its SEC filings, retrieved 23 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001660280)
9. [Tenable, quarterly figures from its SEC filings, retrieved 23 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001660280)


---

Tenable gave PHP's 9.2 flaws its highest rating, then patched PHP out of its own scanners — The Inference. Canonical: https://theinference.org/article/tenable-gave-php-s-9-2-flaws-its-highest-rating-then-patched-php-out-of-its-own-scanners