PHP Vulnerability Responses by Company

Zscaler

Global cloud / infrastructure
Aliases / services
Zscaler / Zscaler Inc. / ZIA / ZPA / Zscaler Deception / Zscaler MDR / zscaler.com
Official website
https://www.zscaler.com

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Zscaler Internet Access (ZIA)

Response status
Platform unaffected; detection deployed
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Cloud network security services.

The official article updated 26 October rules out impact to Zscaler platforms. Advanced Threat Protection signatures detect PHP2Shell attempts in ZIA traffic.

Scope: ZIA protection does not install PHP patches on customer servers. ZPA and Deception are separate entries.

What users should do

Verify detection under your subscription and policies; separately patch your own PHP servers.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rceResponse evidence

Zscaler Private Access: App Protection / Autonomous App Shield

Response status
Virtual patching and detection provided
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The 27 October follow-up describes production mitigation controls. App Protection lists signatures 6000568/6000569; Autonomous App Shield provides application-specific inline protection.

Scope: Defense availability does not mean customer PHP was patched. App Shield is grouped as a ZPA feature.

What users should do

Verify subscription, configuration and covered applications, and still patch PHP itself.

Source URLs

  1. PHP2Shell response and scopehttps://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rceResponse evidence
  2. https://www.zscaler.com/blogs/product-insights/what-php2shell-teaches-us-about-defending-private-apps-age-frontier-aihttps://www.zscaler.com/blogs/product-insights/what-php2shell-teaches-us-about-defending-private-apps-age-frontier-aiResponse evidence

Zscaler Deception

Response status
PHP2Shell decoys and detection guidance
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Customers can deploy WordPress, Drupal, Joomla, phpMyAdmin and Nextcloud decoys and orchestrate blocking of interacting IP addresses.

Scope: The named applications are decoy types, not products patched by Zscaler.

What users should do

Check licensed capabilities, decoy placement and orchestration; patch real PHP systems.

Source URLs

  1. PHP2Shell response and scopehttps://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rceResponse evidence
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Operating entityOfficial information directory

Comments