Markmonitor x Red Sift: Closing the gap between your domain portfolio and your attack surface

In October 2026, two critical PHP flaws put a large share of the web at risk of unauthenticated remote code execution. In this session, Markmonitor CISO Michael Rogers and Red Sift’s Billy McDiarmid break down what happened, why the patch was the easy part, and what it takes to find every exposed host.

Patching takes minutes. Finding every host can take weeks, because exposed systems sat on acquired domains, old campaign sites, and vendor products no one was tracking. Michael shares the operator’s view of running the response and Billy shares what Red Sift’s scan data showed in the days after the fix. Together they cover how a well-managed domain portfolio plus external discovery gets you to a complete list of hosts with owners.

Here’s what's covered

• What PHP2Shell is and why a flaw in the runtime reaches further than an application bug
• Three assumptions that left exposure behind
• Where PHP hides, and how to map your domain portfolio to the hosts, software and owners behind it
• What the patch data shows, and why the long tail is an upgrade problem
• A six-step response playbook, including when to go offline

Watch on demand.