When a vulnerability like PHP2Shell hits the headlines, the clock starts immediately. Leadership wants to know one thing: are we exposed? The two CVEs driving the conversation are currently listed as CVE-2026-109618 and CVE-2026-109619. With Unified Security Exposure Management (USEM), you can answer that question quickly and turn the answer into action.
The scenario
Your application vulnerability scanner (Veracode, Checkmarx, Fortify, and others) is already feeding findings into USEM, where they become AVIT records with triage rules, risk scoring, and assignment applied automatically. The data you need is already in the platform. The challenge is connecting a headline CVE to the third-party entries your scanner produced, and doing it before attackers move.
Watch Topics: your rapid-response lever
Watch Topics were a go-to capability during the log4j response and for other high-alert vulnerabilities, and they are just as effective for PHP2Shell. A Watch Topic shows exactly which CVEs are tied to which applications in your environment, so you can stop guessing and start prioritizing.
The key: getting from the CVE to the third-party entry
The AVIT record is tied to a application vulnerability entry (TPE) from your scanner, not directly to a CVE. The bridge is a column that is not displayed on the form: CVEs [cves_list]. This glide_list field references the National Vulnerability Database Entry table [sn_vul_nvd_entry]. It is populated when a record is inserted into the m2m table [sn_vul_m2m_entry_cve], which correlates the NVD CVE to the TPE/AVE from your scanner sources.
Build the Watch Topic
- Create a new Watch Topic focused on the CVEs in question.
- Locate the field: Vulnerability > Application Vulnerability Entry entry > CVE (list).
- Populate it with the PHP2Shell CVEs and the appropriate details.
- Activate and submit.
The outcome
Within minutes, you have a live, scoped view of every finding tied to PHP2Shell. As a Vulnerability Analyst, you can:
- See exactly which applications are affected, with no manual spreadsheet correlation.
- Track the backlog of related findings as it shrinks.
- Create remediation efforts and remediation tasks, and route them to the right teams.
- Report on progress to stakeholders with confidence.
The result is a faster path from “are we exposed?” to “we are fixing it,” with clear ownership at every step.
Learn more
