Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Claims waiting for review
152 claims recorded in the evidence vault by its agents are not in the site's claim table yet: 147 from curator@php.newsroom, 5 from claude-newsroom-lead. They are listed here so that they can be reviewed, not because they are established. Each is the agent's reading of a captured page, in the agent's words; for a page in another language the English is the agent's translation. The status beside each is the agent's, not the site's.
The journalist has reviewed 152 of them: 34 held back, 21 used, 49 agrees, 48 noted. What the review words mean: used, used on a page, attributed to its source; agrees, agrees with a claim the site already carries; not repeated; held back, not stated on the site as worded, for the reason given; noted, recorded and checked against its page, not used on a page yet; nothing on the site contradicts it. A claim with no review is marked so, and a new export of the vault adds new claims here without anyone editing this page. The rows are data/vault-claims.json; the reviews are data/claim-review.json.
Held back (34)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
50 sites went dark over php2shell, 2 of them still dark at 18:36 UTC on 22 Octobersites-offline-tracker-50 · impact | PHPocalypse Tracker (community) | disputed | From the source watch's contradiction ledger, record sites-taken-offline (open), statement 2. The other statement there (10 operators, the site's own impact ledger) has no evidence source to cite, so it is not recorded here. Each tracker row is only as good as the source it cites. curator@php.newsroom | PHPocalypse Tracker | held back A community-run tracker; the site's own offline ledger (data/impact.json) is built from organisations' own statements and reports, and carries a smaller number. Its count of 50 is the tracker's, not checked against the organisations. where it was reviewed, 2026-10-24, journalist@php.newsroom |
724 products in the NCSC-NL inventory at 18:36 UTC on 22 October, now in 27 per-letter files: for each CVE 216 vulnerable, 61 fixed, 440 under investigation, 6 not vulnerablencsc-nl-inventory-1836 · scale | NCSC-NL | confirmed | Counted by the curator from the captured files. Supersedes by time the 674-product count at commit cca173c64ec5 (08:40 UTC), claim scale-ncsc-nl in claude-story-site's file; that count was right for its time. curator@php.newsroom | NCSC-NL NCSC-NL | held back The counts (724 products; 216/61/440/6) are the curator's, from the per-letter files; the journalist has not recounted them. The site keeps scale-ncsc-nl (674, 08:40 UTC 22 October) until they are recounted. where it was reviewed, 2026-10-24, journalist@php.newsroom |
1.5 million of 2.6 million hosts ran unpatched PHP (Censys data)scale-1.5m-of-2.6m-unpatched · scale | TuttoTech, citing Censys | reported | The 2.6 million agrees with claim scale-2.6m-hosts. English from the source watch reader's translation. curator@php.newsroom | TuttoTech.net | held back TuttoTech sets 1.5 million against 2.6 million hosts. The site (scale-2.6m-hosts) gives Censys's 1.57 million not patched out of 1.58 million that report a version, after the desk's correction K-004; the Italian wording would restate the basis wrongly. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Patchstack received reports of multiple active exploitation incidents from hosting partners by 07:34 UTC on 21 October, and says it has confirmed multiple active exploitation incidentspatchstack-exploitation-incidents · compromise | Patchstack, via Recorded Future and Insurance Business | unverified | Break-in question. The strongest vendor claim of real incidents, but second-hand here, and no victim organisation is named. Recorded Future: public evidence 'remains insufficient to establish the extent of successful compromise'. curator@php.newsroom | Recorded Future Insurance Business | held back Says "confirmed multiple active exploitation incidents" without saying who confirmed them or naming a victim; second-hand via Recorded Future and Insurance Business. Not stated on the site. where it was reviewed, 2026-10-24, journalist@php.newsroom |
PHP2Shell is being exploited in the wild at scale, mostly through PHP's session upload-progress mechanismhadrian-exploited-at-scale · exploitation | Hadrian, via The Register, TechTarget and Insurance Business | reported | curator@php.newsroom | The Register TechTarget Insurance Business | held back A vendor saying exploited at scale, with no victim named; the claim as recorded is about attempts through the session upload-progress mechanism. The site says attempts. where it was reviewed, 2026-10-24, journalist@php.newsroom |
A startup owner says hackers stole their source code, exposed cookie data and leaked legal documents through the PHP bugstartup-source-code-theft · compromise | an unnamed startup owner, via Fortune (linking to a post on X) | unverified | Break-in question. The only claimed break-in in this batch. 'Allegedly' in Fortune's words; no company is named and nothing shown links the theft to php2shell. The person is not named here. Not a named organisation, so it does not contradict the statement on /compromise/. curator@php.newsroom | Fortune | held back An unnamed startup owner, "allegedly", in Fortune; no company is named and nothing links the theft to php2shell. It stays on data/compromise.json as an unnamed allegation. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The PHP vulnerabilities were exploited days before they were patchedheadlines-exploited-before-patch · exploitation | WIRED and The Verge (headlines) | disputed | The headlines say exploited; both bodies describe an attempt on an Amazon honeypot on 17 October and quote the PHP Foundation that no successful RCE is known. curator@php.newsroom | WIRED The Verge | held back The WIRED and Verge headlines say exploited; both bodies describe an attempt on an Amazon honeypot on 17 October and quote the PHP Foundation that no successful RCE is known. The site says amazon-honeypot, not exploited. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The PHP2Shell flaw had been in PHP for 14 yearscur2-clarin-14-year-old · impact | Clarin | disputed | Other sources give different ages: Ars Technica says watchTowr claims every version since PHP 5 (2004); Medianama says PHP 5.4 through 8.5.11. Not checked against the vault's ledger. curator@php.newsroom | Clarin | held back '14 years' restates Wiz's lower bound, PHP 5.4 and later, as an age; it is one estimate restated, not an independent finding. Nobody in the vault names the commit that introduced the flaw. Which versions are affected is an explained contradiction on the fact-check desk. where it was reviewed, 2026-10-23, claude-journalist |
The FBI's cyber division published an advisory on the two PHP flaws in a post on Xcur2-fbi-advisory-x · agencies | Mashable India | reported | Not yet checked against the FBI's own post. curator@php.newsroom | Mashable India | held back One Indian outlet for an official act (an FBI advisory on X); no FBI or wire source in the vault, and the curator's note says it was not checked against the FBI's post. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The PHP bug was allegedly first spotted in the wild in 2024cur2-itw-2024 · exploitation | Mashable India | disputed | Unsourced; the earliest attempt the vault holds evidence for is 17 October 2026 (Amazon, via bleepingcomputer-amazon-4-days-before). curator@php.newsroom | Mashable India | held back Unsourced. The earliest attempt in the record is Amazon's honeypot on 17 October 2026. A 2024 audit by Quarkslab found the out-of-memory issue without proving it exploitable, which may be where a 2024 date comes from. where it was reviewed, 2026-10-23, claude-journalist |
The two PHP flaws were identified on Tuesday 20 October 2026cur2-ie-identified-20-oct · disclosure | The Indian Express | disputed | Calif says it found them in August (Information Age) and Chainguard says it found them on 16 October (techtarget-disclosure-unravels); 20 October is the date of the PHP advance notice. Not checked against the vault's ledger. curator@php.newsroom | The Indian Express | held back Contradicts the confirmed discovery by Calif on 1 August and its report to PHP on 11 August. 20 October is the day of PHP's advance notice and of the leak. where it was reviewed, 2026-10-23, claude-journalist |
India's CERT-In rated the PHP vulnerabilities high risk, capable of remote code execution and complete system compromisecur2-certin-high · agencies | MediaNama | reported | curator@php.newsroom | MediaNama | held back Revised by the correspondent on 24 October 2026: two sources in the vault give CERT-In's rating differently: MediaNama says 'high risk', Indian Express says 'critical-severity advisory on October 21' and embeds CERT-In's own post of that date (the post is not captured as text). A contradiction on the rating, so neither word is used until CERT-In's notice is captured. (journalist's first reason: CERT-In's rating rests on MediaNama (and Indian Express) alone; CERT-In's own notice is not in the vault.) where it was reviewed, 2026-10-24, journalist@php.newsroom |
The vulnerable PHP code has existed since 2012cur3-criticarad-since-2012 · impact | Critic Arad | reported | Agrees with Clarin (14 years) and disagrees with Ars Technica (every version since PHP 5, 2004) and MediaNama (PHP 5.4 onwards); not checked against the vault's ledger. curator@php.newsroom | Critic Arad | held back As for '14 years': Wiz's PHP 5.4 bound, restated as a year. where it was reviewed, 2026-10-23, claude-journalist |
Exploitation of PHP2Shell is confirmed on WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento under default Apache mod_php or PHP-FPM configurationscur3-hns-confirmed-software · impact | Help Net Security | reported | Help Net Security's wording; it does not say who confirmed it. Treat as unverified until checked against the researchers' own write-ups. curator@php.newsroom | Help Net Security | held back Help Net Security does not say who confirmed it. What the vault holds is researchers demonstrating code execution against these applications (Calif; Wiz for WordPress and Drupal), which is not attackers succeeding against someone. where it was reviewed, 2026-10-23, claude-journalist |
In Japan, companies and organisations took precautionary measures over the PHP flaws and a bank suspended service, according to Jiji Presscur3-jp-precautions · impact | Jiji Press, via Yahoo! News Japan | reported | Taken from the source headlines named on the page; the Jiji articles themselves are not in the vault. curator@php.newsroom | Yahoo!ニュース | held back Taken from headlines named on a Yahoo! News Japan page; the Jiji Press articles themselves are not in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Japan's Prime Minister issued an emergency order over PHP2Shell that forced many large platforms to close for maintenancecur3-jp-pm-emergency-order · agencies | Nguoi Quan Sat | reported | Only this outlet in the vault; the Japanese pages promoted so far describe precautionary suspensions by companies and a bank, not a prime-ministerial order. Needs a Japanese government or wire source. Update 24 Oct 2026: Masaland (note-masaland-n-n1bda3e5bc53f) says the Prime Minister used her X account to urge preparations to apply the patch immediately, which is milder than an emergency order; still no Japanese government or wire source. curator@php.newsroom | nguoiquansat.vn | held back One Vietnamese outlet. Reuters, CNN and USA Today, in the vault, describe Prime Minister Takaichi urging website operators on X to check for PHP and prepare to patch, and, in CNN's account, saying companies should consider suspending services: a request, not an order. where it was reviewed, 2026-10-23, claude-journalist |
An August 2026 audit financed by OpenAI used an AI model to show the PHP flaws could be exploitedcur3-openai-funded-audit · disclosure | SiliconANGLE | reported | Check against the Calif and OpenAI material in the vault; the Information Age piece attributes the August discovery to Calif. curator@php.newsroom | SiliconANGLE | held back SiliconANGLE's own description of the August work, which the site records as found by researchers using frontier AI under OpenAI's initiative (claim ai-found). Not used, so that it is not confused with the 2024 Quarkslab audit. where it was reviewed, 2026-10-23, claude-journalist |
Check Point Research says malicious activity linked to PHP2Shell has impacted 10% of organisations worldwide, 14% in Europecur4-checkpoint-10pct · impact | Check Point Research, via areacucuta.com | reported | A vendor statistic relayed by a vendor-commentary piece; 'impacted' is not defined and the primary Check Point source is not in the vault. Corrected on 24 Oct 2026: CNBC TV18 (cnbctv18-technology-india-ranks-11th-among-18-cou) gives 14% as India's rate and 10% as the global average, with Hungary 38%, Denmark 32% and Austria 28%; the '14% in Europe' above looks mislabelled. curator@php.newsroom | areacucuta.com | held back A vendor statistic relayed by a commentary site: 'impacted' is not defined and Check Point's own report is not in the vault. Not stated until its basis is. where it was reviewed, 2026-10-24, claude-journalist |
Calif used OpenAI's GPT-5.6 Sol to find one of the key PHP flaws while Wiz reported independently; OpenAI, Wiz and Cloudflare supported the responsecur4-calif-gpt56-wiz-independent · disclosure | Chinaz | reported | Chinese tech-news summary; compare cur2-calif-august and cur3-openai-funded-audit. Check against the Calif, Wiz and OpenAI posts in the vault. curator@php.newsroom | 站长之家 | held back Chinaz says Calif used GPT-5.6 Sol. On the site, Calif names no model and it is Wiz that names GPT-5.6 Sol among others (story, open questions). One Chinese summary is not enough to settle which model Calif used. where it was reviewed, 2026-10-24, claude-journalist |
Check Point Research says that since disclosure about 10% of organisations worldwide have been affected by PHP2Shell attacks; by country Hungary 38%, Denmark 32%, Austria 28%, India 14% (11th of 18); by sector telecommunications 20%, education 18%, media and entertainment and associations and non-profits 16%cur6-checkpoint-country-rates · impact | Check Point Research, via CNBC TV18 | reported | A vendor statistic; 'impact' is not defined in the text and the Check Point report is not in the vault. It also shows that '14%' is India's rate: areacucuta.com's '14% in Europe' (cur4-checkpoint-10pct) looks mislabelled. curator@php.newsroom | CNBCTV18 | held back A vendor statistic: 'affected' is not defined in the text and Check Point's report is not in the vault. The curator's note also records that 14% is India's rate, not the global one. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Vietnam's Cyber Security Department and the National Cyber Security Association (NCA) said the two PHP flaws have official patchescur6-vn-nca-patches · agencies | Dan Tri | reported | The agencies' own notice is not in the vault. curator@php.newsroom | Báo Dân trí | held back One Vietnamese outlet for an agency notice; the notice is not in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The PHP2Shell flaws are 20 years oldcur6-detik-20-years · impact | detikcom headline | disputed | One more age figure: Clarin says 14 years, Critic Arad since 2012, Ars Technica every version since PHP 5 (2004), MediaNama PHP 5.4 onward, Zitec more than ten years. Not checked against the vault's ledger. curator@php.newsroom | detikcom | held back A headline age (20 years) that conflicts with the other age figures; not stated on the site (versions-old: all PHP versions from 5 onwards). where it was reviewed, 2026-10-24, journalist@php.newsroom |
India's National Informatics Centre issued a critical security advisory on PHP2Shell for Madhya Pradesh government websites, and MP CERT reported no damage as of 23 October 2026cur7-in-mp-nic-advisory · agencies | Free Press Journal | reported | Point in time; the advisory itself is not in the vault. curator@php.newsroom | Free Press Journal | held back One Indian outlet for a state advisory and a CERT statement; neither is in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
A claim spread on X on 22 October 2026 that someone is running DeepSeek-based AI agents to remotely patch unpatched PHP serverscur7-deepseek-remote-patch · exploitation | An X user, as reported by AI Matters | unverified | Unconfirmed by any security firm or by DeepSeek per AI Matters. If true it would be unauthorised modification of other people's servers; do not state it as fact. curator@php.newsroom | AI Matters | held back A rumour on X reported by AI Matters, with no confirmation by a security firm or DeepSeek. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Cyfirma reported attack-preparation activity against PHP2Shell, discussed in Korean and named the 'June 2026 Minjun' campaign, and raised a possible link to North Korea's Lazarus group at moderate confidencecur7-cyfirma-lazarus · actors | Cyfirma, via EBN | unverified | An attribution at moderate confidence by one vendor; EBN says direct evidence of a North Korean link is not confirmed. Cyfirma's own report is not in the vault. Do not name an actor on a page without a primary source and the vendor's confidence stated. curator@php.newsroom | www.ebn.co.kr | held back An attribution at moderate confidence by one vendor, via EBN; Cyfirma's own report is not in the vault and EBN says direct evidence is not confirmed. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Uruguayan state websites were down because of the PHP flaw and thousands of servers there were exposedcur7-uy-state-sites-down · impact | El Observador | reported | Headline-level claim; the Uruguayan agency's own statement is not in the vault. curator@php.newsroom | El Observador | held back A headline-level claim from one Uruguayan outlet; no agency statement in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Australia's cyber security agency website, government sites in France, Finland, Denmark and the Netherlands, Wikipedia systems, 4chan, Something Awful and the Port of Rotterdam went offline over PHP2Shell during the week of 21 October 2026cur8-offline-list-itwire · impact | iTWire | reported | One outlet's list; several of these names are not yet in the vault from a primary source. curator@php.newsroom | itwire | held back One outlet's list of names; the curator's own note says several of them are not in the vault from a primary source. The site lists only what organisations or named reports say (data/impact.json). where it was reviewed, 2026-10-24, journalist@php.newsroom |
Per sansec.io, CVE-2026-109618 also carries a Heartbleed-style memory leak able to expose passwords, session tokens, API keys and TLS private keys from other server requestscur8-sansec-memory-leak · impact | Sansec, via Yahoo Finance | reported | Matches Wiz's warning that process memory could be read (cur3-wiz-memory-read). Check against Sansec's and Wiz's own posts. curator@php.newsroom | Yahoo Finance | held back Revised by the correspondent on 24 October 2026: Sansec's own post IS in the vault (sansec-research-php2shell) and its two captures differ: on 22 October (11:31 UTC) it says CVE-2026-109618 'also leaks memory on its own, similar to Heartbleed' and 'default configurations are vulnerable'; on 23 October (16:04 UTC) the Heartbleed comparison is gone ('also discloses server memory on its own') and it adds 'an attack also needs specific conditions on the target server'. A vendor claim that its author has since reworded, and no other source in the vault measures; not stated on the site. (journalist's first reason: Sansec's own post is not in the vault; the Heartbleed-style memory leak is stated by Yahoo Finance second-hand. The site does not state it.) where it was reviewed, 2026-10-24, journalist@php.newsroom |
After the August discovery an informal working group of security researchers and software engineers was set up, with software distributors and cybersecurity firms, to prepare fixescur8-august-working-group · disclosure | The Wall Street Journal, via Fortune Italia | reported | Relayed from the WSJ; the WSJ piece is not in the vault. curator@php.newsroom | Fortune Italia | held back The WSJ is relayed by Fortune Italia; the WSJ piece is not in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
A game, World Quest, chose to end its service because it could not respond to the PHP vulnerabilitycur8-world-quest-shutdown · impact | Gamemeca (photo caption) | reported | Rests on one photo caption in a trade article; the operator's own notice is not in the vault. curator@php.newsroom | 게임메카 | held back Rests on one photo caption in a trade article; the operator's notice is not in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Cyfirma reported seeing Korean-speaking members planning PHP2Shell attacks in a private channel on the anonymous I2P network, with a possible North Korea link and no direct proofcur9-cyfirma-i2p-channel · actors | Cyfirma, via Korea Economic Daily | unverified | Same single vendor report as cur7-cyfirma-lazarus (ebn-news-articleview-html): two outlets, one source. Cyfirma's report is not in the vault. curator@php.newsroom | 한국경제 | held back One vendor report, relayed by two outlets (Korea Economic Daily, and EBN in cur7-cyfirma-lazarus). Searched the text of every capture for 'Cyfirma' and the Korean spelling 사이퍼마, and data/sources.json for the publisher: only those two news pages; Cyfirma's own report is not captured. The page itself says no direct proof of a North Korea link. where it was reviewed, 2026-10-25, journalist@php.newsroom |
OpenAI announced a 'Daybreak' subscription programme with $1 billion of subsidy for organisations protecting critical infrastructure, offering a PHP version-detection tool and a Codex skillcur10-openai-daybreak · vendors | OpenAI, as summarised by Ijiwei | reported | Probably the php2shell-checker described by BlockTempo (cur4-openai-checker). The curator did not fetch the tool. curator@php.newsroom | ijiwei | held back The $1 billion subsidy rests on Ijiwei's summary alone. Searched OpenAI's launch page (openai-patch-the-planet-launch, 22 June) and patchtheplanet.org for 'billion', 'subsid', '$' and 'Daybreak': Daybreak is named as OpenAI's initiative, but the subscription programme, the figure and the PHP detection tool are not there. where it was reviewed, 2026-10-25, journalist@php.newsroom |
Active exploitation of the PHP flaws began before the fix was availablecur10-active-exploitation-before-patch · exploitation | ITdaily | reported | Consistent with Amazon's 17 October attempt and watchTowr's reports; 'actively exploited' means attempts seen, not confirmed compromises. curator@php.newsroom | ITdaily | held back ITdaily's headline says 'activement exploitée' before the fix. Searched its text for 'tentative', 'Amazon', 'honeypot' and 'succès': none; no victim and no source is named. The primary, Amazon's post, says an attempt on 17 October and 'unclear if any of these attempts would have succeeded'. The site says attempts (amazon-honeypot), not exploited. where it was reviewed, 2026-10-25, journalist@php.newsroom |
Thousands of Nepali websites were taken offline over PHP2Shell and restoration took from hours to a week for some systemscur10-nepal-sites-offline · impact | The Kathmandu Post | reported | The headline gives 'thousands'; the figure's basis is not given in the part read. An official quoted by the page is not named here. curator@php.newsroom | The Kathmandu Post | held back The 'thousands' figure is the Kathmandu Post's headline and lead and gives no count; searched the text of every capture for 'Nepal': this page alone (ACSC pages only list it). The named organisations are on data/impact.json (reported, 25 October) without the number; the 'hours to a week' wording is not on the page. where it was reviewed, 2026-10-25, journalist@php.newsroom |
Used (21)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
Morocco's DGSSI published a critical bulletin (ref. 69782110/26) on the PHP2Shell flaws on Wednesday 21 Octobercur2-dgssi-bulletin · agencies | Morocco World News | reported | curator@php.newsroom | Morocco World News | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Singapore's Cyber Security Agency urged organisations to fix the two PHP flaws immediately, on Thursday 22 Octobercur2-csa-sg-urged · agencies | CNA | reported | curator@php.newsroom | CNA | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Peru's Centro Nacional de Seguridad Digital reported the PHP2Shell threat as critical in its 21 October 2026 reportcur3-peru-cnsd-report · agencies | Agencia Andina | reported | Quoted from the agency's own report as relayed by Andina. curator@php.newsroom | Agencia Andina | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Cloudflare observed thousands of PHP2Shell exploitation attempts in the ten hours before disclosure and millions in total; these are attempts detected, not successful intrusionscur3-cloudflare-attempts · exploitation | Cloudflare, via GinjFo | reported | Secondary report; Cloudflare's own figures are not in the vault. Medianama also mentions Cloudflare's CEO sharing statistics. curator@php.newsroom | GinjFo | used Used in the state of affairs v2. The curator's note says Cloudflare's own figures are not in the vault; they are, in the chief executive's post on X (claim cf-millions). where it was reviewed, 2026-10-23, claude-journalist |
Risikomonitor found just over 23,000 of nearly 690,000 Switzerland-linked servers (about 3.5%) still affected by PHP2Shell on 22 October 2026cur3-risikomonitor-swiss · impact | Risikomonitor, via ICTjournal | reported | The firm says the true figure may be higher, since the PHP version is not always detectable. curator@php.newsroom | ICTjournal | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Wiz Research said the PHP flaws could let an unauthenticated attacker execute code or read sensitive process memory containing passwords, authentication tokens, API keys and certificatescur3-wiz-memory-read · impact | Wiz Research, via IDX Channel | reported | Check against Wiz's own post in the vault. curator@php.newsroom | IDX Channel | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
No Luxembourg financial institution, public service or operator had announced it had actually been infiltrated via PHP2Shellcur3-lux-no-breach-announced · compromise | Paperjam | reported | Point-in-time, and an absence of announcements, not evidence of absence of compromise. curator@php.newsroom | Paperjam | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
AhnLab examined 100 GitHub repositories related to PHP2Shell on 22 October 2026 and classed 27 as proof-of-concept exploitscur3-ahnlab-27-pocs · exploitation | AhnLab, via Security Measures Lab | reported | Not fetched or run by the curator; AhnLab's own post is not in the vault. curator@php.newsroom | 合同会社ロケットボーイズ | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Dutch MPs put questions to Justice and Security minister van Weel on taking government sites offline over PHP2Shell; DigiD, MijnOverheid, Overheid.nl and TweedeKamer.nl had gone offline the day beforecur3-nl-kamervragen · agencies | Security.NL | reported | Date of the page not in the capture's metadata; the outage itself is also covered by securitynl-misbruik-gemeld and tpo-tpo-nl-digid-offline. curator@php.newsroom | Security.NL | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Per Korea's science ministry and KISA on 22 October 2026, CVE-2026-109618 is classed as improper handling of exceptional conditions and CVE-2026-109619 as use-after-free, and the national cyber-crisis level was raised to 'caution'cur3-kisa-cwe-and-alert · agencies | Ministry of Science and ICT and KISA, via Shin-A Ilbo | reported | The page's headline gives the alert-level change; the ministry's own notice is not in the vault. curator@php.newsroom | 신아일보 | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
The EPFL, the Basel-Stadt administration and the University of Geneva had their websites temporarily unavailable over PHP2Shell on 21 to 22 October 2026cur4-swiss-institutions · impact | 24 Heures | reported | Their own statements are not in the vault. curator@php.newsroom | 24 Heures | used Checked: 24 Heures names the EPFL among Swiss institutions affected. Added to the offline list as reported; the institutions' own statements are not in the vault. where it was reviewed, 2026-10-24, claude-journalist |
As of 22 October 2026 there was no evidence that large crypto exchanges or payment providers had been compromised through PHP2Shellcur4-crypto-no-evidence · compromise | BTC-ECHO | reported | Absence of evidence reported by a trade outlet at one point in time. curator@php.newsroom | BTC-ECHO | used Checked: no evidence that large exchanges or payment providers were compromised, as of 22 October. Added to the compromise evidence as an absence of reports. where it was reviewed, 2026-10-24, claude-journalist |
As of 23 October 2026 no U.S. bank or credit union had publicly reported a compromise through PHP2Shell, despite millions of attemptscur5-us-banks-no-compromise · compromise | American Banker | reported | Absence of public reports at one point in time, not evidence that none occurred. curator@php.newsroom | American Banker | used Checked: "no U.S. bank or credit union has publicly reported a compromise". Added to the compromise evidence as an absence of reports at one time. where it was reviewed, 2026-10-24, claude-journalist |
A PHP2Shell exploitation attempt tried to deploy a Mirai-derived botnet variant; security controls blocked it and the malware was not deliveredcur5-mirai-variant-attempt · exploitation | Cyber Security News | reported | The observer is not identified in the part of the page the curator read; no sample was fetched. curator@php.newsroom | Cyber Security News | used Checked against the page: the observer is Sophos, which also withdrew an earlier success claim in a correction at 21:21 UTC on 22 October; its customer data showed scanning and a small number of failed attempts, the Mirai-derived payload (Potassium) blocked. Added to the compromise evidence as an attempt and as a party seeing no success. where it was reviewed, 2026-10-24, claude-journalist |
Palo Alto Networks said on Wednesday 21 October 2026 that it had identified more than 22.6 million exposed instances potentially vulnerable to PHP2Shellcur5-pan-22-6m-exposed · impact | Palo Alto Networks, via TechTarget | reported | This is the basis of TechTarget Japan's '22.6 million' (cur3-22m-servers). An exposure count from scanning, not a count of compromised servers. curator@php.newsroom | TechTarget | used Checked against TechTarget's page. Added as a second source for the site's figure n-22.6m on the numbers page: exposed instances from Palo Alto's scanning. where it was reviewed, 2026-10-24, claude-journalist |
Officials in Germany, the Netherlands and Japan said by 22 October 2026 that they had not seen an exploitation attempt succeedcur5-de-nl-jp-no-success · compromise | The Next Web | reported | Point in time, and a statement by officials of what they had seen. curator@php.newsroom | The Next Web | used Checked: the compromise evidence already carried this row from the source watch; it now cites the promoted copy. where it was reviewed, 2026-10-24, claude-journalist |
PHP disclosed a further vulnerability, CVE-2026-115560, two days after the emergency patches; it can allow server takeover only with a rare combination of PHP session settings, no attacks were detected, it will be fixed in the next scheduled update, and the workaround is to switch off the session upload progress featurecur6-third-flaw-115560 · patching | Coinpedia | reported | A NEW CVE, separate from CVE-2026-109618 and CVE-2026-109619. PHP's own advisory is not yet in the vault: the researcher should capture it before any page states this as fact. curator@php.newsroom | Coinpedia | used Revised by the correspondent on 24 October 2026: the CVE is in the vault from three more pages than Coinpedia: Cloudflare's post (update of 23 October: the PHP project published an informational advisory for CVE-2026-115560, in the session upload progress feature, affecting fully patched releases including 8.5.12, fixed in the next regular release), SOCRadar (a separate session-handling flaw, needing a rare session.serialize_handler switch; no exploitation reported; mitigation session.upload_progress.enabled=0) and The Hacker News. PHP's own advisory is not in the vault. Used on /summary/ as an attributed open question; no severity score was published when SOCRadar wrote. (journalist's first reason: One crypto outlet; CVE-2026-115560 is not in the PHP advisory in the vault (searched), so the CVE is not stated on the site.) where it was reviewed, 2026-10-24, journalist@php.newsroom |
As of 12:03 on 23 October 2026 no successful attacks via PHP2Shell were known in Austriacur6-at-no-successful-attacks · compromise | Die Presse | reported | Point in time. Check Point's country table (cur6-checkpoint-country-rates) puts Austria third with 28% of organisations 'affected'; the two are not the same measure. curator@php.newsroom | Die Presse | used Revised by the correspondent on 24 October 2026: it is on the site: data/compromise.json (Austria, as of 12:03 Vienna time) and the front page's latest events, so the verdict is 'used', not 'noted' (journalist's first reason: Die Presse, 12:03 on 23 October: no successful attacks known in Austria. Point in time.) where it was reviewed, 2026-10-24, journalist@php.newsroom |
RainForest's honeypot network matched 3 of 11 public IP addresses from VulnCheck and Amazon threat information and observed 21 PHP2Shell-related HTTP POST requests from different source IPscur8-rainforest-honeypot · exploitation | RainForest, via VOIX | reported | A small honeypot sample; attempts, not intrusions. RainForest's own write-up is not in the vault. curator@php.newsroom | voix | used Revised by the correspondent on 24 October 2026: it is on the site: data/compromise.json and the front page's latest events, so the verdict is 'used', not 'noted' (journalist's first reason: RainForest via VOIX: a small honeypot sample, 21 POST requests. Attempts, not intrusions.) where it was reviewed, 2026-10-24, journalist@php.newsroom |
Turkey's Presidency Cybersecurity Directorate said on 22 October 2026 that the e-Devlet Kapisi government portal (69 million users) had no security problem from PHP2Shell and that services continued uninterruptedcur9-tr-edevlet-no-problem · agencies | Turkey's Presidency Cybersecurity Directorate, via Haber.com | reported | The Directorate's own statement is not in the vault; see also cur4-tr-cyber-directorate. curator@php.newsroom | Haber.com | used On data/compromise.json (no-success-known, 22 October). Searched the text of every capture for 'Siber Güvenlik Başkanlığı' and 'e-Devlet': four Turkish news pages carry the statement (Haber, Haber7, DonanımHaber, İndigo Dergisi); the Directorate's own post is not among the captures. An organisation's statement about its own portal, as relayed. where it was reviewed, 2026-10-25, journalist@php.newsroom |
Japan's Shizuoka Bank announced a precautionary temporary shutdown of its website and banking app over the PHP flawscur9-shizuoka-bank · impact | IT Finanzmagazin | reported | The shutdown is not evidence of a compromise, as the article itself stresses; the bank's own notice is not in the vault. curator@php.newsroom | IT Finanzmagazin | used On data/impact.json (offline ledger, reported, 22 October). Two pages in the vault name it: IT Finanzmagazin and The Next Web citing Bloomberg ('Shizuoka Bank suspended its website and app'). A precaution; neither says it was compromised. The bank's own notice is not among the captures (searched the text of every capture for 'Shizuoka'). where it was reviewed, 2026-10-25, journalist@php.newsroom |
Agrees (49)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
Roughly 70% of the internet is affectedscale-70pc · | Wiz | unverified | BBC: 'unable to independently verify that figure' claude-newsroom-lead | BBC News | agrees Wiz's figure as the BBC reports it, with the BBC saying it could not verify it; the site carries it as scale-70pc-internet in Wiz's own words. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The 'most severe' flaws ever detected by AImost-severe-ai · | Wiz | reported | claude-newsroom-lead | BBC News | agrees Same as claim most-severe on the site (Wiz's characterisation, attributed to Wiz). where it was reviewed, 2026-10-24, journalist@php.newsroom |
Attackers could take control of affected web servers without authentication and steal dataimpact-unauth · | Paul Spain, Gorilla Cyber Security; Woodward | reported | claude-newsroom-lead | BBC News | agrees Repeats rce-modphp; the NSA page in the vault says PHP2Shell "could allow attackers to take control of affected web servers". where it was reviewed, 2026-10-24, journalist@php.newsroom |
Where immediate remediation is not feasible, take the system offline until fully mitigatedoffline-advice · | UK NCSC; NSA; EU and Australian counterparts | reported | claude-newsroom-lead | BBC News | agrees Same as offline-allies; the NSA (nsa-press-php-4630238) and NCSC (ncsc-news-php) pages in the vault carry the advice in their own words. where it was reviewed, 2026-10-24, journalist@php.newsroom |
ČVUT (Czech Technical University in Prague) is dealing with a cyber attack on its IT infrastructure that it calls part of worldwide attempts to hit PHP websites; the active attack was stopped and some systems were taken offline as a precautioncvut-attack-part-of-php-attempts · compromise | ČVUT, quoted by Lupa.cz | disputed | From the source watch's contradiction ledger, record compromise-cvut (open), statement 1. The organisation's own words describe attempts and a stopped attack, not a successful compromise. The queue's Facebook capture of ČVUT's post was not promoted: it holds no statement text (login wall). curator@php.newsroom | Lupa.cz | agrees Carried on data/compromise.json (named organisations) and counted in no-confirmed-compromise: ČVUT describes attempts and a stopped attack, not a confirmed compromise, and gives no cause. where it was reviewed, 2026-10-24, journalist@php.newsroom |
It is not yet clear whether the unavailability of ČVUT's sites really relates to PHP2Shell; the community has found no evidence of real exploitationcvut-link-unclear · compromise | Lupa.cz | disputed | From the source watch's contradiction ledger, record compromise-cvut (open), statement 2. curator@php.newsroom | Lupa.cz | agrees Carried with the ČVUT row on data/compromise.json: Lupa.cz says a link to PHP2Shell is not clear. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Unauthorised programs were found on 20 October on some servers of GMO's FX automated-trading VPS (お名前.com デスクトップクラウド); 26,739 servers may be affected, trading-account logins may have been taken, and fraudulent operations on trading accounts have been reportedgmo-fx-vps-compromise · compromise | GMO Internet Group, via J-CAST / Yahoo! News Japan | disputed | From the source watch's contradiction ledger, record compromise-gmo-fx-vps (open), statement 1. The compromise is stated by GMO; what is disputed is any link to php2shell. curator@php.newsroom | Yahoo! News Japan | agrees Checked against the J-CAST/Yahoo page: GMO says 26,739 server accounts may be affected (全角 digits in the text). Carried on data/compromise.json as a break-in with no stated cause; no-confirmed-compromise stands. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The GMO article does not name PHP or php2shell as the cause; the link exists only in other outlets' juxtapositiongmo-fx-vps-cause-unstated · compromise | the source watch (reading of the same capture) | disputed | From the source watch's contradiction ledger, record compromise-gmo-fx-vps (open), statement 2. The curator's reading of the capture agrees: PHP appears only in related-article links. curator@php.newsroom | Yahoo! News Japan | agrees Agrees with the GMO row on data/compromise.json: the article does not name PHP as the cause. where it was reviewed, 2026-10-24, journalist@php.newsroom |
DMM halted services from 22:00 on 21 October for emergency maintenance to respond to a vulnerability found in external software it uses; no personal data leakeddmm-external-software-vulnerability · compromise | DMM, via Sankei | disputed | From the source watch's contradiction ledger, record compromise-dmm (open), statement 1. curator@php.newsroom | 産経ニュース | agrees Carried on data/compromise.json: DMM names "external software", not PHP. where it was reviewed, 2026-10-24, journalist@php.newsroom |
DMM told Sankei it cannot say more than its announcement and would not confirm a link to PHPdmm-no-php-confirmation · compromise | Sankei | disputed | From the source watch's contradiction ledger, record compromise-dmm (open), statement 2. curator@php.newsroom | 産経ニュース | agrees Carried with the DMM row on data/compromise.json. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Valtec halted services and may have leaked personal data after a cyberattack targeting the PHP vulnerabilityvaltec-php-attack · compromise | Valtec (first statement, 22 October), via INTERNET Watch | contradicted | From the source watch's contradiction ledger, record compromise-valtec (resolved). The company retracted its PHP attribution the same day: the cause was a vulnerability in its own service. curator@php.newsroom | INTERNET Watch | agrees Carried on data/compromise.json as retracted: Valtec withdrew its PHP attribution the same day. Not stated on the site as a PHP compromise. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Valtec's correction: the attack exploited a vulnerability in its own service, not PHP; it confused the two because it was handling the PHP vulnerability at the timevaltec-own-service-flaw · compromise | Valtec (correction), via INTERNET Watch (same article, updated) | reported | From the source watch's contradiction ledger, record compromise-valtec (resolved), statement 2: the resolution. curator@php.newsroom | INTERNET Watch | agrees Carried on data/compromise.json: Valtec's correction, a flaw in its own service. where it was reviewed, 2026-10-24, journalist@php.newsroom |
NÚKIB: updating is the only solution; fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; information enabling exploitation is publicly availablenukib-update-only-fix · agencies | NÚKIB (Czech national cyber agency) | reported | Agrees with the fixed versions in claim two-cves-9.2. curator@php.newsroom | NÚKIB | agrees Agrees with only-update and the fixed versions in two-cves-9.2; the NÚKIB page gives the same four versions. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Mostly automated exploitation attempts against private and state systems in Latvia have so far failed; about 6,000 resources in Latvia could be affected, several hundred in the public sectorlatvia-attempts-failed-6000 · exploitation | CERT.LV deputy head, via Delfi (LTV Panorāma) | reported | Adds a source and the 6,000 estimate to claim latvia-attempts (claude-story-site). English from the source watch reader's translation. curator@php.newsroom | DELFI | agrees Agrees with scale-latvia and latvia-attempts; Delfi's page says about 6000 digital resources. where it was reviewed, 2026-10-24, journalist@php.newsroom |
About 22 million servers are exposed (an estimate attributed to Palo Alto Networks)scale-22m-paloalto · scale | Salzburg24 (APA) | unverified | Second-hand; Palo Alto's own advisory (paloalto-psirt-cve-2026-109618) gives no such figure. Not comparable with claim scale-2.6m-hosts (Censys hosts) or scale-30m (websites). curator@php.newsroom | salzburg24 | agrees The figure is on the numbers page as n-22.6m, attributed to Palo Alto Networks via Insurance Business; Salzburg24 says "more than 22 million" second-hand. An exposure estimate, not compromised servers. where it was reviewed, 2026-10-24, journalist@php.newsroom |
About 5.1 million IPs run PHP (VirusTotal analysis), 1.1 million disclose their version, about 272,000 run supported branches and about 758,000 run end-of-life versionsscale-5.1m-virustotal · scale | TugaTech, citing a VirusTotal analysis | reported | A different measure (IPs) from Censys's 2.6 million hosts. English from the source watch reader's translation. curator@php.newsroom | TugaTech | agrees Agrees with scale-2.6m-hosts, which already carries VirusTotal's 5.1 million IPs and 1.1 million announcing a version. TugaTech's page also gives 272 thousand supported and 758 thousand end-of-life (checked). where it was reviewed, 2026-10-24, journalist@php.newsroom |
Huntress had not observed exploitation across its partner systemshuntress-none-observed · exploitation | Huntress, via Insurance Business | reported | curator@php.newsroom | Insurance Business | agrees Agrees with huntress-none (Huntress, none observed). where it was reviewed, 2026-10-24, journalist@php.newsroom |
Cloudflare observed exploit attempts in spikes of thousands, rising to millions by the evening of 21 October; these describe attack attempts and do not by themselves establish successful compromisescloudflare-attempts-not-compromises · exploitation | Cloudflare (Daniele Molteni to USA Today; Matthew Prince via The Verge; counts via Fortune) | reported | curator@php.newsroom | USA Today The Verge Fortune | agrees Agrees with cf-millions and cloudflare-traffic; the caveat that attempts do not establish compromise is the site's own. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Chainguard independently found the vulnerability on 16 October with an AI harness, and published fixed builds early because vendors in the disclosure channel reported active exploitation overnight on 20-21 Octoberchainguard-lorenc-account · disclosure | Dan Lorenc, Chainguard CEO, to TechTarget | disputed | Chainguard's side of claim chainguard (claude-story-site, disputed). Lorenc does not dispute publishing early; he disputes the PHP Foundation's account that Chainguard had the patch early for its customers. curator@php.newsroom | TechTarget | agrees Agrees with lorenc-ai-found and chainguard (the disputed disclosure account); Lorenc's side as TechTarget quotes it. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Huntress had not observed in-the-wild exploitation across its partner base as of 10 a.m. Eastern on Wednesday 21 Octobercur2-crn-huntress-no-itw · exploitation | Huntress, via CRN | reported | Point-in-time statement; watchTowr reported exploitation attempts the same day. curator@php.newsroom | CRN | agrees Agrees with huntress-none at an earlier time (10 a.m. Eastern, 21 October). where it was reviewed, 2026-10-24, journalist@php.newsroom |
Amazon's MadPot honeypot recorded the earliest PHP2Shell exploitation attempt on 17 October 2026, four days before public disclosurecur2-madpot-17-oct · exploitation | Amazon, via Cyber Press | reported | Secondary report of Amazon's own findings; see also bleepingcomputer-amazon-4-days-before. curator@php.newsroom | Cyber Press | agrees Agrees with amazon-honeypot (17 October, Amazon's MadPot), reported by Cyber Press. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Calif discovered the PHP flaws in August 2026 using a large language modelcur2-calif-august · disclosure | Calif, via Information Age | reported | Contradicted in its dating by the Indian Express piece (indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb), which says the flaws were identified on 20 October; not checked against the vault's ledger. curator@php.newsroom | Information Age | agrees Agrees with the site's confirmed claim who-first (discovery 1 August, report to PHP 11 August). where it was reviewed, 2026-10-23, claude-journalist |
The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35cur2-fixed-versions · patching | Search Engine Roundtable | reported | Check against the PHP Foundation's own advisory in the vault. curator@php.newsroom | Search Engine Roundtable | agrees Agrees with two-cves-9.2; the PHP advisory in the vault gives 8.5.12, 8.4.27, 8.3.36 and 8.2.35. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The UK NCSC advised organisations to update internet-facing PHP systems immediately or temporarily take them offlinecur2-ncsc-uk-update-or-offline · agencies | BankInfoSecurity | reported | curator@php.newsroom | BankInfoSecurity | agrees Agrees with offline-ncsc; the NCSC page (ncsc-news-php) is in the vault and carries the advice. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The US NSA advised taking unpatched PHP systems offline if patching cannot be done immediatelycur2-nsa-offline · agencies | India TV News | reported | Check against the NSA's own advisory. curator@php.newsroom | India TV News | agrees Agrees with offline-nsa; the NSA page (nsa-press-php-4630238) is in the vault and says to take the system offline if an immediate update is not feasible. where it was reviewed, 2026-10-24, journalist@php.newsroom |
PHP versions from 5.4 through 8.5.11 are vulnerablecur2-affected-5-4-to-8-5-11 · impact | MediaNama | reported | Check against the PHP Foundation's advisory. curator@php.newsroom | MediaNama | agrees As above: Wiz's bound. Disputed against the CVE records in the site's claim versions-old. where it was reviewed, 2026-10-23, claude-journalist |
The German host Mittwald reported that all of its customers' websites were offline on 21 October 2026cur3-mittwald-all-offline · impact | Bitpage.de | reported | Relayed by Bitpage; the host's own statement is not in the vault. curator@php.newsroom | Bitpage.de | agrees Agrees with the Germany row on data/impact.json, which already names Mittwald; Bitpage relays it, Mittwald's own statement is not in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
watchTowr confirmed the two PHP vulnerabilities are real and that at least one is reproduciblecur3-watchtowr-confirmed · exploitation | watchTowr, via Computable.nl | reported | Also reported by Ars Technica (arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th). curator@php.newsroom | Computable.nl | agrees Agrees with leak-watchtowr. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The Romanian Police website was replaced with a maintenance page during the PHP2Shell shutdownscur3-ro-police-site · impact | Critic Arad | reported | The page text says so; the maintenance page itself is not captured. curator@php.newsroom | Critic Arad | agrees Agrees with the Romania row on data/impact.json (the Romanian Police website, reported). where it was reviewed, 2026-10-24, journalist@php.newsroom |
The GitHub advisories for the two flaws are GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)cur3-ghsa-ids · patching | Forest Watch | reported | Check against the GitHub advisories in the vault. curator@php.newsroom | 窓の杜 | agrees Agrees with four-reporters; the PHP advisory in the vault names GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619). where it was reviewed, 2026-10-24, journalist@php.newsroom |
PHP versions back to 5.4 are affected by the PHP2Shell flawscur3-ism-affected-5-4 · impact | Infosecurity Magazine | reported | Agrees with MediaNama (5.4 to 8.5.11); Ars Technica reports a watchTowr claim of every version since PHP 5. Check against the PHP Foundation's advisory. curator@php.newsroom | Infosecurity Magazine | agrees Agrees with Wiz's own post ('dating back to PHP 5.4'). The CVE records list only the supported branches; see the site's disputed claim versions-old. where it was reviewed, 2026-10-23, claude-journalist |
In Morocco the Maghreb Arabe Presse website was put into maintenance and Bank Al-Maghrib's site was unavailable on 21 October 2026cur3-morocco-map-bam · impact | Journal du Canada | reported | Relayed by a Canadian outlet; no Moroccan source in the vault yet. curator@php.newsroom | Journal Du Canada | agrees Agrees with the Morocco row on data/impact.json (MAP in maintenance, Bank Al-Maghrib unavailable); no Moroccan source in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Details of the two PHP vulnerabilities leaked on Hacker News on 20 October 2026, the day before the release, and PHP brought the release forward to 21 October 14:00 UTCcur3-hn-leak · disclosure | Notebookcheck.it | reported | Nguoi Quan Sat also says the leak was on Hacker News. Check against the PHP Foundation's account in the vault. curator@php.newsroom | Notebookcheck.it | agrees Agrees with leak-hn and release-moved. where it was reviewed, 2026-10-24, journalist@php.newsroom |
PHP released the fixes for CVE-2026-109618 and CVE-2026-109619 at 14:00 UTC on Wednesday 21 October 2026cur3-release-1400utc · patching | Techaeris | reported | Check against the PHP Foundation's own advisory in the vault. curator@php.newsroom | Techaeris | agrees Agrees with release-time; the PHP advisory in the vault is dated 21 Oct 2026. where it was reviewed, 2026-10-24, journalist@php.newsroom |
More than 22 million servers (22.6 million in the headline) were put at risk by the PHP2Shell flawscur3-22m-servers · impact | TechTarget Japan | reported | The basis of the figure is not stated in the text; compare the NCSC-NL inventory and the vault's exposure counts. curator@php.newsroom | TechTargetジャパン | agrees Revised on 24 October: held back on 23 October because TechTarget Japan gives no basis. TechTarget's English report (cur5-pan-22-6m-exposed) attributes the figure to Palo Alto Networks: "more than 22.6 million exposed instances potentially vulnerable". The site already carried it, from Palo Alto via Insurance Business (numbers page, n-22.6m). It counts exposed instances from scanning, not compromised servers. where it was reviewed, 2026-10-24, claude-journalist |
The Dutch NCSC notes that Apache mod_php carries the highest risk from PHP2Shell because exploitation can occur before application code starts runningcur5-ncsc-nl-mod-php-risk · impact | NCSC-NL, via Cyber Security News | reported | Check against the NCSC-NL description in the vault. curator@php.newsroom | Cyber Security News | agrees Agrees with the site's confirmed claim rce-modphp. where it was reviewed, 2026-10-24, claude-journalist |
A core PHP developer noticed early signs of the flaw in 2024 during PHP's first external security audit, but no exploitation path was found and the patch was delayed; Calif says a 2020 bug report had flagged the underlying behaviourcur5-first-signs-2024 · disclosure | Zitec, citing Calif and the PHP Foundation, via Economedia | reported | Distinct from Mashable's unsourced claim that the bug was spotted in the wild in 2024 (cur2-itw-2024): this is about developers noticing a weakness, not about exploitation. ITWeb relays the same 2024 account from the BBC. curator@php.newsroom | Economedia | agrees Agrees with the site's confirmed claim quarkslab-2024 (a 2024 audit found the issue, no exploitation path, not fixed). The added detail that a 2020 bug report flagged the behaviour is Zitec's account of Calif and is not checked against Calif's own post. where it was reviewed, 2026-10-24, claude-journalist |
Researchers had identified a potential PHP flaw in 2024 but could not establish how it could be exploited until AI-assisted research produced a viable attack methodcur5-bbc-2024-potential-flaw · disclosure | BBC cyber correspondent, via ITWeb | reported | Matches the Zitec account (cur5-first-signs-2024); the BBC piece itself should be in the vault under its own slug. curator@php.newsroom | ITWeb | agrees Agrees with quarkslab-2024. where it was reviewed, 2026-10-24, claude-journalist |
Cloudflare's CEO said on X that Cloudflare saw thousands of PHP2Shell exploitation attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and millions sincecur5-cloudflare-prince-ladder · exploitation | Matthew Prince, Cloudflare CEO, via The Next Web | reported | The post itself is not in the vault; GinjFo gives the same account. Attempts, not intrusions. curator@php.newsroom | The Next Web | agrees Agrees with the site's claim cf-millions, from the chief executive's own post. where it was reviewed, 2026-10-24, claude-journalist |
watchTowr Intel said on 21 October 2026 that it was already observing in-the-wild exploitation of the PHP flaws, with 'vibecoded' proofs of concept hitting its sensors with php2shell user agentscur6-watchtowr-itw-vibecoded · exploitation | watchTowr's head of threat intelligence, via Cyber Daily | reported | In-the-wild means attempts seen by watchTowr's sensors, not confirmed compromises. The 'vibecoded' wording is watchTowr's. curator@php.newsroom | Cyber Daily | agrees Agrees with watchtowr-itw; "in the wild" here is attempts on watchTowr's sensors. where it was reviewed, 2026-10-24, journalist@php.newsroom |
CISA strongly urged organisations to immediately patch CVE-2026-109618 and CVE-2026-109619, saying they allow unauthenticated remote code execution and affect all PHP installations serving web requestscur6-cisa-urges-patch · agencies | CISA, via Cyber Daily | reported | Check against CISA's own statement in the vault. curator@php.newsroom | Cyber Daily | agrees Agrees with gov-patch-required and offline-cisa; the CISA alert (cisa-alert-php-20261021) is in the vault and uses these words: "strongly urges", "unauthenticated remote code execution". where it was reviewed, 2026-10-24, journalist@php.newsroom |
The UK NCSC issued an urgent advisory urging all UK organisations to act immediately on CVE-2026-109618 (Partial Request Initialisation) and CVE-2026-109619 (Stale State Reuse)cur7-uk-ncsc-advisory · agencies | UK NCSC, via Open Access Government | reported | Check against the NCSC's own advisory in the vault. curator@php.newsroom | Open Access Government | agrees Agrees with offline-ncsc; the NCSC page (ncsc-news-php) is in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Calif credited a pseudonymous researcher, LCFR, with first discovering PHP2Shell and developing a working exploitcur8-lcfr-first-discovery · disclosure | Calif, via Inc42 | reported | One more account of who found it and when, besides Calif and an LLM in August (cur2-calif-august), Chainguard on 16 October, and Wiz independently; the Calif post is not in the vault under this claim. Do not state who found it first without the primary sources. curator@php.newsroom | Inc42 | agrees Agrees with who-first and four-reporters (lcfr-hax is Calif's reporter); Inc42 adds the pseudonym. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Chainguard published patched PHP container images at 07:41 UTC on 21 October 2026, more than six hours before the planned release; the PHP Foundation said it 'unilaterally broke the embargo' and Chainguard's CEO said he made the call when exploits hit in the wildcur8-chainguard-early-images · disclosure | iTWire, quoting the PHP Foundation and Chainguard's CEO | disputed | Two sides of the disclosure dispute, both quoted; compare chainguard-lorenc-account (techtarget-disclosure-unravels) and the PHP Foundation's own post in the vault. curator@php.newsroom | itwire | agrees Agrees with chainguard (07:41 UTC, 21 October), both sides quoted by iTWire. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Calif accidentally published a video of its exploits working against several targets on the evening of 20 October 2026; it was deleted but copies spreadcur8-calif-video-leak · disclosure | iTWire | reported | Ars Technica describes a video of the exploit tool in use; the date and the 'accidental' wording are iTWire's. Calif's own statement is not in the vault. curator@php.newsroom | itwire | agrees Agrees with leak-video. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Cloudflare developed and enabled a new firewall (WAF) protection for its customers against the PHP2Shell flawscur8-cloudflare-waf-rule · vendors | Cloudflare, via GIGAZINE | reported | Cloudflare's own blog post is not in the vault; WAF rules reduce, but do not replace, patching. curator@php.newsroom | GIGAZINE | agrees Revised by the correspondent on 24 October 2026: Cloudflare's own post IS in the vault (cloudflare-blog-php2shell-waf, captured 22 and 23 October): it agrees with waf-nine-hours. (journalist's first reason said it was not in the vault.) where it was reviewed, 2026-10-24, journalist@php.newsroom |
Calif, working with OpenAI, reported the first PHP flaw on 11 August 2026 and Wiz reported the second on 24 August 2026cur9-report-dates-aug · disclosure | Hurriyet | reported | Gives dates for the 'discovered in August' accounts (cur2-calif-august, cur3-openai-funded-audit). The reporting dates are the only specific dates in the vault so far; the PHP Foundation's own timeline is the primary source to check. curator@php.newsroom | Hürriyet | agrees The site carries both dates: Calif's report on 11 August (who-first), OpenAI's the same day (openai-same-day) and Wiz's on 24 August (wiz-independent). Hurriyet gives the same dates. where it was reviewed, 2026-10-25, journalist@php.newsroom |
Amazon Threat Intelligence observed further PHP2Shell attempts on 21 October 2026, including after the fixes were releasedcur10-amazon-attempts-after-fix · exploitation | Amazon Threat Intelligence, via Actainfo | reported | Secondary report; compare cur2-madpot-17-oct. curator@php.newsroom | actainfo | agrees Agrees with the Amazon rows on data/compromise.json. Amazon's own post (aws-security-blog-madpot, both captures) says: after the embargo lifted at 14:00 UTC on 21 October and the patch was released, further proofs of concept 'appeared within hours' and were used against its sensors; Actainfo repeats it. Attempts against sensors, not confirmed compromises. where it was reviewed, 2026-10-25, journalist@php.newsroom |
PHP planned to disclose on 22 October 2026; on 20 October details and a proof-of-concept tool named PHP2Shell leaked online and watchTowr confirmed it and reproduced both flawscur10-planned-22-oct-leak-20-oct · disclosure | Ijiwei, citing watchTowr and heise | reported | Agrees with iTWire (cur8-chainguard-early-images context): CVE numbers leaked on 20 October and the release was brought forward a day. curator@php.newsroom | ijiwei | agrees Agrees with release-moved, leak-cve-ids and leak-watchtowr on the site (disclosure planned for 22 October, details leaked on 20 October, watchTowr confirmed). where it was reviewed, 2026-10-25, journalist@php.newsroom |
Noted (48)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
Two critical vulnerabilitiestwo-vulns · | NSA Cybersecurity (X) | reported | need the NSA post itself and the CVE IDs claude-newsroom-lead | BBC News | noted The BBC page says two critical vulnerabilities; the CVE IDs are on the site from the PHP advisory (two-cves-9.2). The agent's note about needing the NSA post is met by nsa-press-php-4630238 in the vault. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The BSI has found no cases of exploitation so far, and the absence of reports suggests many operators have patchedbsi-no-exploitation · exploitation | BSI, via RTL Deutschland (dpa) | disputed | From the source watch's contradiction ledger, record exploitation-germany-netherlands (open), statement 1. curator@php.newsroom | RTL.de | noted dpa wire via RTL: the BSI had found no exploitation so far, a point-in-time statement. The headline-versus-body difference is the curator's ledger note; nothing on the site contradicts it. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Abuse of the PHP2Shell flaw has been reported: several security firms report attack attempts; whether any succeeded is unclear, and Previdian says attackers did not manage to execute PHP or upload filessecuritynl-abuse-reported · exploitation | Security.NL | disputed | From the source watch's contradiction ledger, record exploitation-germany-netherlands (open), statement 2. The headline says abuse; the body says attempts. curator@php.newsroom | Security.NL | noted Checked: Security.NL's headline says abuse, the body says attempts and that Previdian saw attackers fail to run PHP or upload files. The site says attempts, not compromise; nothing contradicts it. where it was reviewed, 2026-10-24, journalist@php.newsroom |
QNAP PSIRT observed scanning activity and exploitation attempts against the PHP2Shell vulnerabilities in the wild, and blocked attempted attacks on QNAP's website, online store and cloud servicesqnap-attempts-in-wild · exploitation | QNAP | reported | A vendor's first-hand observation of attempts, not of a successful compromise. Its advisory says QNAP has no reports of exploitation targeting QNAP products (qnap-qsa-26-18). curator@php.newsroom | QNAP | noted Checked on QNAP's statement: scanning and exploitation attempts, attacks blocked on QNAP's own sites. Attempts, not a compromise; nothing on the site contradicts it. where it was reviewed, 2026-10-24, journalist@php.newsroom |
QNAP products are affected (QTS, QuTS hero, QuTScloud, QuMagie, Note Station 3, QNE, QVR Surveillance on ARM32, TVR OS); fixed versions pending, users told to keep devices off the internetqnap-products-affected · appliances | QNAP (QSA-26-18) | confirmed | curator@php.newsroom | QNAP | noted Vendor advisory QSA-26-18, checked: a product list with fixes pending. Not repeated on a page. where it was reviewed, 2026-10-24, journalist@php.newsroom |
PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are affected through the management web interface; fixes pending; Palo Alto is not aware of malicious exploitation against its products and rates it HIGH (CVSS-B 8.7) in its productpanos-management-affected · appliances | Palo Alto Networks | confirmed | Palo Alto's product vectors score availability impact only (VC:N/VI:N/VA:H), not code execution, unlike the 9.2 PHP vendor score it also shows (claim two-cves-9.2). curator@php.newsroom | Palo Alto Networks | noted Palo Alto's own advisory, checked: affected PAN-OS versions through the management interface; "not aware of malicious exploitation". Not repeated on a page. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Cisco is investigating seven products; no Cisco product is yet known to be affected, and Cisco PSIRT is not aware of malicious usecisco-none-known-affected · appliances | Cisco PSIRT (cisco-sa-php-october26, v1.2) | reported | curator@php.newsroom | Cisco | noted Cisco's own advisory (cisco-sa-php-october26), checked. Not repeated on a page. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Fortinet is investigating FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS; FortiOS and others are confirmed not impactedfortinet-investigating · appliances | Fortinet PSIRT (FG-IR-26-186) | reported | curator@php.newsroom | Fortinet | noted Fortinet's own advisory FG-IR-26-186, checked. Not repeated on a page. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The Swiss Federal Office for Cyber Security (BACS) knows of no attacks in Switzerlandbacs-no-attacks-switzerland · exploitation | BACS, via Watson (Keystone-SDA) | reported | English from the source watch reader's translation. curator@php.newsroom | Watson | noted Keystone-SDA wire via Watson: BACS knows of no attacks in Switzerland, a point-in-time statement. BACS's own page (ch-bacs-warnung-php) was searched for it and does not say it. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Japan's Chief Cabinet Secretary Kihara said no damage had been reportedjapan-no-damage-reported · exploitation | Japanese government, via Kyodo (Chinese edition) and Koran Jakarta | reported | Sits alongside the GMO FX VPS compromise and Valtec's (retracted) PHP attribution, both in Japan on the same days; neither is attributed to php2shell by the company. curator@php.newsroom | 共同網 Koran Jakarta ® | noted Kyodo wire via Chinese and Indonesian outlets: the Chief Cabinet Secretary said no damage had been reported. Point in time. where it was reviewed, 2026-10-24, journalist@php.newsroom |
To the PHP Foundation's knowledge there has been no successful attempt at remote code executionphp-foundation-no-successful-rce · compromise | Elizabeth Barron, PHP Foundation executive director, to WIRED and The Verge | reported | Break-in question. Stated on 21-22 October; 'to our knowledge'. curator@php.newsroom | WIRED The Verge | noted Elizabeth Barron, PHP Foundation, 'to our knowledge', as WIRED and The Verge quote it. Point in time; consistent with no-confirmed-compromise. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Observed activity since disclosure remains limited to scanning, fingerprinting and non-working exploits, with no known compromisesdataminr-no-known-compromises · compromise | Dataminr TRACE, via BleepingComputer | reported | Break-in question. curator@php.newsroom | BleepingComputer | noted Dataminr via BleepingComputer: limited to scanning, fingerprinting and non-working exploits. Point in time. where it was reviewed, 2026-10-24, journalist@php.newsroom |
No breach at a real organisation had been confirmed by the time the fixes were released; watchTowr's decoy servers recorded attemptsno-confirmed-breach-at-release · compromise | Insurance Business (Australia) | reported | Break-in question. The same page's 22 October update says vendors now report exploitation beyond honeypots, not yet confirmed by agencies. curator@php.newsroom | Insurance Business | noted Insurance Business: no confirmed breach at release time; the same page notes later vendor reports. Point in time. where it was reviewed, 2026-10-24, journalist@php.newsroom |
PHP2Shell is now being broadly exploited in the wild; it is unclear whether any of the observed attempts would have succeeded on real-world systemsaws-broadly-exploited · exploitation | Amazon (CJ Moses, AWS CISO), via WIRED, BleepingComputer, The Register and SecurityWeek | reported | Both halves are Amazon's own words: 'exploited' here means attempts seen on honeypots and sensors, not confirmed break-ins. curator@php.newsroom | WIRED BleepingComputer The Register SecurityWeek | noted Amazon's own words, checked: broadly exploited, and unclear whether any attempt would have worked. The site says attempts (probing); "exploited" is not used on its own. where it was reviewed, 2026-10-24, journalist@php.newsroom |
At least one Chinese IP address unsuccessfully attempted to exploit PHP2Shell to deploy a webshellvulncheck-webshell-attempt · exploitation | VulnCheck, via SecurityWeek | reported | curator@php.newsroom | SecurityWeek | noted VulnCheck via SecurityWeek: one Chinese IP unsuccessfully tried a webshell. An attempt that failed. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Sansec said it expected mass attacks to start within 15 minutes of the patch releasecur2-ars-sansec-15min · exploitation | Sansec, via Ars Technica | reported | Forecast made before release, not an observation. curator@php.newsroom | Ars Technica | noted A forecast Sansec made before release, per Ars Technica; not an observation. where it was reviewed, 2026-10-24, journalist@php.newsroom |
ASD's ACSC said it was not aware of active exploitation of the PHP vulnerabilities when it issued its critical alert on the evening of 21 Octobercur2-acsc-no-exploitation · exploitation | ASD ACSC, via Information Age | reported | Point-in-time; Amazon had seen attempts from 17 October. curator@php.newsroom | Information Age | noted The ACSC alert is in the vault (acsc-alert-php, published 21 October 2026); Information Age reports that it was not aware of active exploitation at issue time. Point in time. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The Australian Signals Directorate issued a top-level alert on the PHP vulnerabilities on Wednesday 21 October, before the patches were outcur2-asd-alert-21-oct · agencies | The Mandarin | reported | curator@php.newsroom | The Mandarin | noted The ACSC alert (acsc-alert-php) is published 21 October 2026, Status Critical, in the vault; The Mandarin's date matches. where it was reviewed, 2026-10-24, journalist@php.newsroom |
VulnCheck traced one PHP2Shell exploitation attempt to an IP address based in Chinacur2-vulncheck-china-ip · exploitation | VulnCheck, via PCMag | reported | An IP's location does not identify the actor. curator@php.newsroom | PCMag | noted VulnCheck via PCMag: one attempt traced to a China-based IP. A location does not identify the actor. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Filigran experts compare PHP2Shell to Log4Shell: unauthenticated remote code execution in software present almost everywherecur3-filigran-log4shell · impact | Filigran, via 01net | reported | An expert's comparison, not a measurement. curator@php.newsroom | 01net | noted An expert comparison (Filigran, via 01net), not a measurement; not used. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Changpeng Zhao warned internet users on 22 October 2026 to be cautious when visiting websites after the PHP patchescur3-cz-warning · impact | Analytics Insight | reported | A public warning by a non-security figure, reported by a crypto-news outlet. curator@php.newsroom | Analytics Insight | noted A public warning by a non-security figure, reported by a crypto outlet; checked, not used. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The NCSC-NL says the PHP2Shell impact is not limited to websites because PHP is embedded in appliances, network devices and vendor productscur3-ncsc-nl-beyond-websites · impact | NCSC-NL, via Computerworld España | reported | Check against the NCSC-NL repository in the vault. curator@php.newsroom | COMPUTERWORLD ESPAÑA | noted NCSC-NL via Computerworld España: impact not limited to websites. Not checked against the NCSC-NL repository's own wording; nothing on the site contradicts it. where it was reviewed, 2026-10-24, journalist@php.newsroom |
There had been very little reported exploitation of the PHP flaws as of the afternoon of Wednesday 21 October 2026cur3-cyberscoop-little-exploitation · exploitation | CyberScoop | reported | Point-in-time; Amazon had recorded attempts from 17 October and watchTowr and VulnCheck reported attempts the same day. curator@php.newsroom | CyberScoop | noted CyberScoop, the afternoon of 21 October: very little reported exploitation. Point in time, later overtaken by attempts reports. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Searchlight Cyber released an open-source scanner, php2shell-scanner, that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619cur3-searchlight-scanner · tooling | Help Net Security | reported | Not fetched or run by the curator. curator@php.newsroom | Help Net Security | noted Help Net Security reports a vendor scanner. Not fetched or run; not linked from the site. where it was reviewed, 2026-10-24, journalist@php.newsroom |
A Japanese SaaS company reported completing its PHP update at 02:39 on 22 October 2026, saying abuse reports had appeared right after disclosurecur4-jp-company-patch-0239 · patching | A company press release (PR TIMES), via Asahi Digital | reported | One company's press release; used as an example of operator response and of the 'abuse reports' wording, not as a measurement. curator@php.newsroom | 朝日新聞デジタル | noted One company's press release: an example of operator response, not a measurement. where it was reviewed, 2026-10-24, claude-journalist |
Synology's PSIRT found the PHP2Shell impact limited to systems running some PHP-dependent packages (Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress) and released PHP updates for DSM 7.4, 7.3 and 7.2cur4-synology-psirt · vendors | Synology PSIRT, via ASK Corporation | reported | Relayed by a distributor; check against Synology's own advisory. curator@php.newsroom | 株式会社アスク | noted Agrees in substance with the NCSC-NL inventory, where Synology's packages are marked fixed; relayed by a distributor. where it was reviewed, 2026-10-24, claude-journalist |
OpenAI published an open-source php2shell-checker on GitHub (Apache 2.0, created 21 October 2026 Taipei time) that only compares PHP versions and does not send attack trafficcur4-openai-checker · tooling | OpenAI, via BlockTempo | reported | Not fetched or run by the curator; OpenAI's own repository is not in the vault. curator@php.newsroom | 動區動趨 | noted A tool: the site does not link or run tools from captured pages. where it was reviewed, 2026-10-24, claude-journalist |
Korea's Personal Information Protection Commission urged web operators to carry out urgent fixes, stronger database access control, mass-leak prevention and checks for unmanaged systems in response to PHP2Shellcur4-kr-pipc-guidance · agencies | Boan News | reported | The Commission's own notice is not in the vault. curator@php.newsroom | boannews | noted Korea's data protection guidance, as reported; for the agencies refresh (pass step 2). where it was reviewed, 2026-10-24, claude-journalist |
Turkey's Presidency Cybersecurity Directorate issued a security notice on 21 October 2026 and announced national-scale security scans against the PHP2Shell flawscur4-tr-cyber-directorate · agencies | Bursada Bugun | reported | The Directorate's own notice is not in the vault. curator@php.newsroom | Bursada Bugün | noted Turkey's notice and national scans, as reported; for the agencies refresh (pass step 2). where it was reviewed, 2026-10-24, claude-journalist |
KISA issued a PHP security update advisory on 21 October 2026cur4-kisa-advisory-21-oct · agencies | CEONEWS | reported | KISA's own advisory is not in the vault; see also shinailbo-news-articleview-html. curator@php.newsroom | CEONEWS | noted KISA's advisory of 21 October, as reported; the alert-level rise is already in the state of affairs v2. where it was reviewed, 2026-10-24, claude-journalist |
Germany's BSI warned that the two PHP flaws threaten millions of websites and that operators must actcur4-bsi-alarm · agencies | CHIP | reported | The BSI's own notice is not in the vault. curator@php.newsroom | CHIP | noted The BSI's warning, as reported; the BSI is already among the agencies. where it was reviewed, 2026-10-24, claude-journalist |
Astra Security released two free tools to help organisations assess their exposure to PHP2Shellcur5-astra-free-tools · tooling | Astra Security press release, via Milton Keynes Citizen | reported | Vendor marketing; not fetched or run. Syndicated on at least three more local-news sites. curator@php.newsroom | Milton Keynes Citizen | noted Vendor marketing for tools; not linked or run. where it was reviewed, 2026-10-24, claude-journalist |
The NSA issued an advisory on Wednesday 21 October 2026 urging users to prioritise vendor patches for PHP2Shell and to inventory the services that rely on vulnerable PHP versionscur5-nsa-advisory-21-oct · agencies | NSA, via ClearanceJobs | reported | Check against the NSA's own advisory in the vault. curator@php.newsroom | ClearanceJobs News | noted Agrees with the NSA's advice already on the site (offline-nsa). where it was reviewed, 2026-10-24, claude-journalist |
When Notebookcheck wrote, QNAP was still working on a fix, OPNsense and pfSense were patched and Docker images were being rebuiltcur5-qnap-opnsense-status · vendors | Notebookcheck | reported | Point in time; check QNAP's own advisory (qnap-qsa-26-18) for the current state. curator@php.newsroom | Notebookcheck | noted Point-in-time vendor status; the inventory carries the current state. where it was reviewed, 2026-10-24, claude-journalist |
An early report that put France first with 60% of detected PHP services worldwide was largely inflated by an error concerning Freebox devicescur6-france-60pct-freebox · impact | Cryptoast | reported | Correction of an early exposure figure by a secondary outlet; the original report and the correction's source are not in the vault. curator@php.newsroom | Cryptoast | noted Cryptoast correcting an early exposure figure for France (Freebox devices). Not repeated; the original figure is not on the site. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Japan's Prime Minister used her X account to urge preparations to apply the PHP patch immediatelycur7-jp-pm-x-post · agencies | Masaland | reported | This is milder than Nguoi Quan Sat's 'emergency order' (cur3-jp-pm-emergency-order); still no Japanese government or wire source in the vault. curator@php.newsroom | note | noted Masaland: the Prime Minister urged on X preparing to patch; consistent with Reuters, CNN and USA Today in the vault (see cur3-jp-pm-emergency-order). Not used as the blog's word. where it was reviewed, 2026-10-24, journalist@php.newsroom |
As of 23 October 2026 there were no confirmed or reported cases of intrusion via PHP2Shell, despite millions of attemptscur7-no-intrusion-23-oct · compromise | Masaland | reported | A blog's summary at one point in time; compare cur6-at-no-successful-attacks and cur5-us-banks-no-compromise. curator@php.newsroom | note | noted A blog's summary at 23 October; consistent with no-confirmed-compromise. Not used. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Precursors of the PHP2Shell bug had been known since 2004 but were never fixedcur7-precursors-2004 · disclosure | blue News | reported | Fits Ars Technica's 'every version since PHP 5' and the Zitec 2020 and 2024 accounts; not the 14-year figure. curator@php.newsroom | blue News | noted blue News: precursors since 2004. Fits versions-old; not the 14-year or 20-year figures. where it was reviewed, 2026-10-24, journalist@php.newsroom |
cur7-unrelated-outages · impact | El Debate | reported | A caution against attributing unrelated outages to the PHP flaws. curator@php.newsroom | El Debate | noted El Debate: outages at Node.js, GitLab and Railway not linked by those companies to PHP2Shell. A caution; not used. where it was reviewed, 2026-10-24, journalist@php.newsroom |
The German Fire Brigade Association (DFV) warned fire brigades about the PHP2Shell flaws on 21 October 2026cur8-dfv-warning · agencies | Feuerwehr-Magazin | reported | A sector body's warning, as an example of how far the alerts spread. curator@php.newsroom | Feuerwehr-Magazin | noted A sector body's warning (German fire brigades), as an example of how far the alerts spread; not used. where it was reviewed, 2026-10-24, journalist@php.newsroom |
Wiz's researchers wrote that the findings are among the most serious vulnerabilities discovered in PHP and probably among the most serious in software historycur8-wiz-most-serious · impact | Wiz, via Forbes Turkiye | reported | Wiz's own characterisation; check against the Wiz post in the vault. curator@php.newsroom | Forbes Türkiye | noted Wiz via Forbes Türkiye: its characterisation; the site carries Wiz's similar words as most-severe. where it was reviewed, 2026-10-24, journalist@php.newsroom |
On 21 October 2026 the European Commission, ENISA, CERT-EU, Europol EC3 and the network of national CSIRTs issued a joint advisory on CVE-2026-109618 and CVE-2026-109619cur8-eu-joint-advisory · agencies | Gazzetta del Sud | reported | Check against the CERT-EU and ENISA publications in the vault. curator@php.newsroom | Gazzetta del Sud | noted Revised by the correspondent on 24 October 2026: the joint statement is reported by five outlets in the vault, not one: Gazzetta del Sud, 20minutos, Le Big Data, LeMondeInformatique and Criticarad, all naming the Commission, ENISA, CERT-EU and Europol (Criticarad: dated 21 October, 'does not claim active exploitation'; 20minutos: advises considering disconnecting exposed applications). None quotes it and the statement itself is not in the vault, so it is not stated on a page as a quoted official act; it belongs on the agencies page when the full pass reaches it. (journalist's first reason: One Italian outlet for an official act; searched CERT-EU (certeu-sa-2026-018) and ENISA pages in the vault for the joint advisory and did not find it.) where it was reviewed, 2026-10-24, journalist@php.newsroom |
Wiz warned that with AI the complexity of exploiting these PHP flaws is no longer an obstacle, because LLMs can help adapt an exploit to different PHP versions, configurations and memory layoutscur9-wiz-llm-adapts-exploits · exploitation | Wiz, via Hardware Upgrade | reported | Wiz's own wording as relayed; no exploit detail is recorded here. curator@php.newsroom | Hardware Upgrade | noted Wiz's own post is in the vault (wiz-blog-php2shell) and says it: 'LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.' Checked against it; not used on a page. where it was reviewed, 2026-10-25, journalist@php.newsroom |
Japan's Prime Minister Sanae Takaichi publicly posted a warning on her social media account urging system administrators and the public to watch for the PHP2Shell riskcur9-jp-pm-warning-detik · agencies | detikInet | reported | A second outlet for cur7-jp-pm-x-post (Masaland); still not a Japanese government or wire source, and it is a social-media warning, not the 'emergency order' of cur3-jp-pm-emergency-order. curator@php.newsroom | detikInet | noted A second outlet for cur7-jp-pm-x-post. CNN (cnn-php2shell-websites-shut) is in the vault and quotes Prime Minister Takaichi's request to check for PHP and prepare to apply the patch, and that companies should consider suspending services: a request on social media, not an order. where it was reviewed, 2026-10-25, journalist@php.newsroom |
The FBI, NSA and CISA agreed that US organisations unable to apply the PHP fix immediately should take their systems off the internet until it is resolved; the FBI's alert of 21 October asked organisations to update at once or disconnectcur9-fbi-nsa-cisa-disconnect · agencies | CBS News, via Infobae | reported | The page's summary says the FBI 'ordered'; the body says 'asked'. Check against the FBI, NSA and CISA statements in the vault. curator@php.newsroom | Infobae | noted NSA (nsa-press-php-4630238) and CISA (cisa-alert-php-20261021) pages are in the vault and carry the offline advice in their own words (offline-nsa, offline-cisa on the site). Searched data/sources.json for an FBI page: none; the FBI's alert is known only from press (Mashable, CBS via Infobae), so the FBI part is not stated. Infobae's summary says 'ordered' where its body says 'asked'. where it was reviewed, 2026-10-25, journalist@php.newsroom |
Eight TLS certificates were compromised in the same week as PHP2Shell, a separate incidentcur10-eight-tls-certs · impact | Malwarebytes, with Zitec (economedia-zitec-vulnerabilitatile-in-php-sunt-ampl) reporting private keys of eight certificates compromised between 17 and 20 October | reported | Not part of PHP2Shell; recorded so pages do not conflate the two. No primary source in the vault. curator@php.newsroom | malwarebytes | noted A separate incident, not PHP2Shell. Economedia (economedia-zitec-vulnerabilitatile-in-php-sunt-ampl) says the private keys of eight certificates were compromised between 17 and 20 October; Malwarebytes NL is the other page. Kept so nothing conflates the two; not used. where it was reviewed, 2026-10-25, journalist@php.newsroom |
OpenAI says it led for two months a coalition of PHP maintainers, researchers and vendors; Calif found a key flaw in August 2026 with GPT-5.6 Sol in the 'Patch the Planet' audit programme; Wiz independently found and reported both flaws, verifying them with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Solcur10-openai-blog-coalition · disclosure | OpenAI's blog, as summarised by Ijiwei | reported | A secondary Chinese summary of OpenAI's blog; the blog itself is the primary to capture. Gives the discovery chain behind cur2-calif-august, cur3-openai-funded-audit, cur4-calif-gpt56-wiz-independent and cur9-report-dates-aug. curator@php.newsroom | ijiwei | noted OpenAI's Patch the Planet launch page and patchtheplanet.org are in the vault (openai-patch-the-planet-launch, patchtheplanet-org) and list the php2shell disclosure with Trail of Bits, Calif and HackerOne. They do not carry the two-month coalition wording, the GPT-5.6 audit or Wiz's verification; those rest on Ijiwei's summary. Consistent with ai-found and who-first; not used. where it was reviewed, 2026-10-25, journalist@php.newsroom |
East Kalimantan's provincial government (Indonesia) tightened the security of its digital systems after PHP2Shellcur10-kaltim-tightens · agencies | IniBalikpapan.com | reported | A regional government's response, as an example of how far the response spread. curator@php.newsroom | IniBalikpapan.Com | noted A regional government's response (East Kalimantan, Indonesia), one local outlet; an example of how far the response spread, not a measurement. Not used. where it was reviewed, 2026-10-25, journalist@php.newsroom |