Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Briefing for Riley, communications team · Plain English · from the same 70 claims, selected and ordered for one reader
What can we say that is true, what should we not say, and what will we be asked?
This briefing v12 written in site v0.19.2 on 25 October 2026 · history and changes, 11 earlier
The answer in thirty seconds
Safe to say: two critical flaws in PHP were fixed on 21 October; we updated or isolated our systems; we have no evidence of compromise and review continues. Do not say '70% of the Internet', 'the most severe ever' or 'exploited everywhere'. Point people to php.net and your national agency.
What is true, what is not, and what you will be asked. The story most readers saw on the morning of 22 October carried three things this site could not confirm, and the questions will come from that story.
What to decide or do
- True and safe to say: two critical flaws in PHP itself, patched on 21 October; the organisation patched or isolated its systems; no evidence of compromise as of today, review continuing.
- Not safe to say: "70% of the Internet" (a headline restating a share of websites), "the most severe ever" (a vendor's phrase), "exploited everywhere" (attempts against honeypots and CDNs, no named victim), "found by AI" without "by researchers using".
- The questions: Were you hit? (answer with the evidence window: logs reviewed from 17 October.) Did you take sites down? (precaution, not incident, as Oxford City Council put it.) Why did it take so long? (the fix was authored on 18 October and released under a coordinated plan that leaked.)
- Attribution: three research teams and the PHP Foundation each tell the discovery story differently; do not pick one. The flaw was seen in 2024 and not fixed because exploitation could not be shown.
- Point at primary sources: php.net's advisory and your national agency. Do not link a vendor blog as the authority.
Your reading path
- Your briefing 4 min
- Explained from the start 6 min
- The numbers 2 min
- Impact: offline vs compromised 2 min
- The agencies 3 min
About 17 minutes in all. Choose read as Riley and the bar under the menu keeps your place on every page.
What this briefing covers
- the safe statement
- the phrases to avoid
- the questions coming
- where to point people
What you can skip
- the code
- the settings
Words you will meet
PHPExploit, exploitationPatchCDNHoneypotPrimary sourceWeb serverphp2shellRemote code execution (RCE)Evidence vaultNCSCGitHub advisory (GHSA)Out of memory (OOM)Vulnerability
Each is underlined where it first appears; hover or tap for a one-line definition, or open the glossary.
The facts this rests on
Show the 32 claims behind this briefing, each with its status and sources
- confirmed two or more primary sources agree, or the fact was counted from a captured file
- reported one party says so, and it has not been contradicted
- disputed the sources disagree, and both readings are shown
- contradicted a primary source says otherwise
- unverified even the reporting outlet could not check it
- p/n primary sources among the n cited; a blocked capture is counted and marked
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable Counted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. fact timeline → | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | A1 Weak signal●○○○○○ contradicted status overstated | 1/1 | NCSC-NL |
| PHP is used by almost 70% of websites whose server-side language is known None of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems. fact timeline → | Cloudflare; OpenAI ('an estimated 70%'); Wiz body text | reported | A2 Reported●●○○○○ measures differently | 3/3 | Cloudflare OpenAI on X Wiz |
| Something like 30 million websites could be affected No basis given. fact timeline → | Alan Woodward, via the BBC | reported | A2 Reported●●○○○○ | 0/1 | BBC News |
| VulnCheck counts about 2.6 million internet-facing hosts exposing PHP; Censys, of the 2.58 million hosts it saw, could read a version on 1.58 million, and 1.57 million of those were unpatched on 21 October Censys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found. fact timeline → | VulnCheck and Censys, via The Hacker News and SecurityWeek | reported | A2 Reported●●○○○○ | 0/2 | THN SecurityWeek |
| About 6,000 potentially affected resources in Latvia, a few hundred in the public sector Primary source, one country, says 'potentially'. fact timeline → | CERT.LV | reported | A2 Reported●●○○○○ | 1/1 | CERT.LV |
| 70% of the Internet is affected The BBC was 'unable to independently verify that figure'. Wiz's body text says 70% of websites and cites no measurement. fact timeline → | Wiz (headline, X post); the BBC, which reports it as Wiz's 'roughly 70%' | unverified | A1 Weak signal●○○○○○ measures differently | 2/3 | Wiz Wiz on X BBC News |
| Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTC The one documented case of government services being pulled from the public internet, from the agency itself. fact timeline → | CERT.LV | confirmed | A6 Established●●●●●● | 1/1 | CERT.LV |
| Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cache Primary, and the one outage with a measured cost. fact timeline → | Weird Gloop | confirmed | A2 Reported●●○○○○ status overstated | 1/1 | Weird Gloop |
| Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offline Not captured from any of the named organisations. fact timeline → | BBC | reported | A2 Reported●●○○○○ | 0/1 | BBC News |
| As of 09:35 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts. A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (10:35 BST) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. fact timeline → | this site, from every captured source in the evidence vault (418 sources, head 87795d121200), as of its latest capture at 09:35 UTC on 25 October | reported | A4 Corroborated●●●●○○ | 6/23 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge Cyber Security News American Banker The Next Web Die Presse voix Haber.com |
| The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline too The government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). fact timeline → | the Dutch government | reported | A4 Corroborated●●●●○○ | 1/2 | Rijksoverheid / NCSC-NL TPO.nl |
| Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution fact timeline → | Yle; Helsinki Times, quoting Valtori | reported | A2 Reported●●○○○○ | 0/2 | Yle Helsinki Times |
| The Wikimedia Foundation took down a number of systems 'as a precautionary measure until they can be safely patched' No Wikimedia-published statement captured. fact timeline → | the Foundation, as quoted by CNN and The Cyber Express | reported | A4 Corroborated●●●●○○ | 0/2 | CNN The Cyber Express |
| Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a link fact timeline → | The Scotsman quoting the council | reported | A3 Echoed●●●○○○ | 0/1 | The Scotsman |
| Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident' fact timeline → | the council's social post, via Oxford Chronicle | reported | A2 Reported●●○○○○ | 0/1 | Oxford Chronicle |
| Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors fact timeline → | LBC; Insurance Business | reported | A3 Echoed●●●○○○ | 0/2 | LBC Insurance Business |
| Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August The hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked. fact timeline → | Calif; PHP Foundation (report date) | confirmed | A3 Echoed●●●○○○ opinion measures differently status overstated | 3/3 | Calif Ryan Austin, Calif on X PHP Foundation |
| The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion tomash-areion is not named in the PHP Foundation's thanks and appears nowhere else on this beat. fact timeline → | GitHub security advisories | confirmed | A6 Established●●●●●● | 2/3 | PHP PHP Daubois |
| The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixed Two parties agree. The Foundation calls the delay 'a structural failure'. Cloudflare lists Quarkslab among the 2026 disclosers; nobody else does. fact timeline → | PHP Foundation; Calif | confirmed | A2 Reported●●○○○○ disputed status overstated | 2/2 | PHP Foundation Calif |
| The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative All three research parties say AI was used. Calif: 'No special harness, or access to models that weren't generally available to everyone were used'. Calif does not name a model; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas; OpenAI's blog reportedly names GPT-5.6 Sol but is blocked. fact timeline → | BBC; OpenAI; Calif; Wiz | reported | A3 Echoed●●●○○○ opinion measures differently | 3/4 | BBC News OpenAI on X Calif Wiz |
| OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September The GitHub advisories credit amyb-oai among four reporters. OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol' and Wiz; an X Community Note disputes OpenAI's role. fact timeline → | PHP Foundation | reported | A2 Reported●●○○○○ disputed | 2/2 | PHP Foundation PHP |
| Wiz Research independently discovered the first flaw on 19 August and reported on 24 August Wiz's X post says 'Wiz Research uncovers' with no credit to Calif or OpenAI; the blog thanks both. fact timeline → | Wiz; PHP Foundation (24 August) | reported | A2 Reported●●○○○○ | 2/2 | Wiz PHP Foundation |
| The most severe flaws ever detected by AI Wiz's own wording is 'among the most severe vulnerabilities discovered in PHP, and arguably in software history'. OpenAI: 'one of the most impactful vulnerabilities in recent memory'. fact timeline → | BBC attributing Wiz | reported | A2 Reported●●○○○○ opinion measures differently | 1/2 | BBC News Wiz |
| Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding The Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself. fact timeline → | Quarkslab's blog; a Substack analysis | reported | A6 Established●●●●●● | 1/2 | Quarkslab David Lopez-Kurtz |
| Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before Unverified by anyone else. fact timeline → | Dan Lorenc, via The Register | reported | A2 Reported●●○○○○ | 0/1 | The Register |
| Frontier AI found the flaw ahead of attackers, giving defenders time to prepare Amazon reports an exploit attempt against a honeypot on 17 October, four days before disclosure, from an actor whose source of exploit information is unknown. fact timeline → | OpenAI | disputed | A2 Reported●●○○○○ opinion disputed | 1/2 | OpenAI on X THN |
| If an immediate update is not feasible, take the system offline until it can be fully mitigated X post 13:45:58Z 21 October (10.1 million views at capture) and the press release. fact timeline → | NSA Cybersecurity | confirmed | A6 Established●●●●●● | 2/2 | NSA Cyber on X NSA |
| Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offline fact timeline → | CISA | confirmed | A6 Established●●●●●● | 1/1 | CISA |
| Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 October Every vendor says the same two things: it is a stopgap, and patch anyway. fact timeline → | the vendors | confirmed | A2 Reported●●○○○○ status overstated | 5/5 | Cloudflare Imperva Threat Research Akamai Security Research Fastly Fortinet Community |
| The risks require immediate patching across United States Government departments and agencies No CISA emergency directive was visible on the CISA home page at capture. fact timeline → | NSA | reported | A6 Established●●●●●● | 1/2 | NSA CISA |
| 'Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated' That sentence is not on the NCSC page as captured at 08:09Z on 22 October. The page's offline advice is step 4 of 6 and is worded differently. The page was modified at 07:30Z that morning. The sentence's opening matches the Canadian CCCS text. fact timeline → | UK NCSC, as quoted by the BBC | disputed | A2 Reported●●○○○○ disputed | 2/3 | BBC News NCSC UK CCCS |
| The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking systems offline where patching is not feasible Australia's ACSC gives no offline advice. CERT-EU says isolate. The Netherlands, Italy, Japan and New Zealand give no offline advice. fact timeline → | BBC | contradicted | A1 Weak signal●○○○○○ | 4/6 | BBC News ACSC CERT-EU NCSC-NL ACN / CSIRT Italia JPCERT/CC |
Every sentence above rests on these rows. They are folded away because they are written in the sources' own vocabulary; the glossary explains each term.
What is still open
- Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post, and Notebookcheck and Nguoi Quan Sat repeat that account. No copy of the post is in the vault.
- Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak.
- Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits, and the named cases do not state php2shell as the cause. Authorities in Singapore and Luxembourg now ask operators to look for traces; the answer will come from those searches, if it comes.
- Which sites were really taken offline, and why. The list now draws on more captured reports (Germany's hospitals and hosts, Morocco, Romania, Japan), but most are press accounts; few come from the organisations themselves (the Dutch government, Latvia's agency, Weird Gloop, the Charité's spokesman as quoted). A community tracker counts 51 listed and 50 back.
- Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. On 23 October PHP published an informational advisory for a separate flaw, CVE-2026-115560, in the session upload progress feature, reported by Cloudflare, SOCRadar and The Hacker News: it affects fully patched releases including 8.5.12, needs a rare session setting, will be fixed in the next regular release, and has session.upload_progress.enabled=0 as the mitigation; SOCRadar reports no exploitation and no severity score. PHP's advisory is not in the evidence vault, and whether this is the bug the Fediverse report described is not stated.
The full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer.