Php2shell: what zero-day response looks like for IONIX customers 

On October 21, 2026, two critical PHP vulnerabilities became public: php2shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Together they could let an attacker run code on a PHP server without logging in. PHP runs a large share of the web, and mass exploitation was expected. 

Every security team faced the same urgent question: where do we run PHP, and which of those systems are at risk?  

Here’s how IONIX customers answered it, and what that says about responding to the next zero-day. 

Within hours, customers knew where to look 

A few hours after the news broke, IONIX customers could see their potentially affected internet-facing assets in Live Exposure Defense, with guidance on what to do first. As the event developed, our researchers kept narrowing that list with safe checks for the affected PHP versions and for whether the vulnerable PHP feature was reachable. Customers could focus on the assets that mattered most. 

They didn’t have to go looking for answers 

• The answers came to them. Not every team opens the portal right away. So we proactively scanned our customers, emailed each one a report on where they stood, and kept talking with them directly as the list narrowed. 

• Protection before patching. For servers that couldn’t be patched right away, customers had interim PHP configuration changes and WAF guidance. 

• One clear picture. Updates reached customers by email, through a rolling post on our website, in the portal and one-to-one from their customer success manager. 

• A team behind them. Research, engineering, customer success, support and solutions engineering worked as one team, around the clock. 

What customers said 

Customers told us IONIX helped them scope their PHP exposure quickly and at scale, and that the remediation guidance was clear. Some found internet-facing sites they hadn’t known about, and fixed them. Several thanked us for being the first to alert them. 

What the next zero-day response will look like 

Our customers and our team went through php2shell together, and handled it well. It also taught us two lessons: 

• The first response is only the beginning. In an event like this, teams want to follow the situation as it develops and know that their fixes truly reduced their exposure. On php2shell, we helped customers do that in real time. Next, we’re making it more seamless, with more capabilities in Live Exposure Defense to run the whole response, from the first alert to a confirmed fix. 

• A high-profile zero-day deserves its own playbook. New CVEs are published faster than ever, and a few zero-days matter far more than the rest. For those, we’re adding dedicated elements to the product so every customer can respond fast. 

The next one is coming. Let’s make it easier.  

php2shell won’t be the last critical vulnerability to hit the internet at scale. The organizations that respond best already know their attack surface, and they have a partner ready when the news breaks.

See how IONIX maps your exposure to the next critical CVE