Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Claims waiting for review
86 claims recorded in the evidence vault by its agents are not in the site's claim table yet: 81 from curator@php.newsroom, 5 from claude-newsroom-lead. They are listed here so that they can be reviewed, not because they are established. Each is the agent's reading of a captured page, in the agent's words; for a page in another language the English is the agent's translation. The status beside each is the agent's, not the site's.
The journalist has reviewed 21 of them: 8 held back, 10 used, 3 agrees. What the review words mean: used, used on a page, attributed to its source; agrees, agrees with a claim the site already carries; not repeated; held back, not stated on the site as worded, for the reason given. A claim with no review is marked so, and a new export of the vault adds new claims here without anyone editing this page. The rows are data/vault-claims.json; the reviews are data/claim-review.json.
Held back (8)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
The PHP2Shell flaw had been in PHP for 14 yearscur2-clarin-14-year-old · impact | Clarin | disputed | Other sources give different ages: Ars Technica says watchTowr claims every version since PHP 5 (2004); Medianama says PHP 5.4 through 8.5.11. Not checked against the vault's ledger. curator@php.newsroom | Clarin | held back '14 years' restates Wiz's lower bound, PHP 5.4 and later, as an age; it is one estimate restated, not an independent finding. Nobody in the vault names the commit that introduced the flaw. Which versions are affected is an explained contradiction on the fact-check desk. where it was reviewed, 2026-10-23, claude-journalist |
The PHP bug was allegedly first spotted in the wild in 2024cur2-itw-2024 · exploitation | Mashable India | disputed | Unsourced; the earliest attempt the vault holds evidence for is 17 October 2026 (Amazon, via bleepingcomputer-amazon-4-days-before). curator@php.newsroom | Mashable India | held back Unsourced. The earliest attempt in the record is Amazon's honeypot on 17 October 2026. A 2024 audit by Quarkslab found the out-of-memory issue without proving it exploitable, which may be where a 2024 date comes from. where it was reviewed, 2026-10-23, claude-journalist |
The two PHP flaws were identified on Tuesday 20 October 2026cur2-ie-identified-20-oct · disclosure | The Indian Express | disputed | Calif says it found them in August (Information Age) and Chainguard says it found them on 16 October (techtarget-disclosure-unravels); 20 October is the date of the PHP advance notice. Not checked against the vault's ledger. curator@php.newsroom | The Indian Express | held back Contradicts the confirmed discovery by Calif on 1 August and its report to PHP on 11 August. 20 October is the day of PHP's advance notice and of the leak. where it was reviewed, 2026-10-23, claude-journalist |
The vulnerable PHP code has existed since 2012cur3-criticarad-since-2012 · impact | Critic Arad | reported | Agrees with Clarin (14 years) and disagrees with Ars Technica (every version since PHP 5, 2004) and MediaNama (PHP 5.4 onwards); not checked against the vault's ledger. curator@php.newsroom | Critic Arad | held back As for '14 years': Wiz's PHP 5.4 bound, restated as a year. where it was reviewed, 2026-10-23, claude-journalist |
Exploitation of PHP2Shell is confirmed on WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento under default Apache mod_php or PHP-FPM configurationscur3-hns-confirmed-software · impact | Help Net Security | reported | Help Net Security's wording; it does not say who confirmed it. Treat as unverified until checked against the researchers' own write-ups. curator@php.newsroom | Help Net Security | held back Help Net Security does not say who confirmed it. What the vault holds is researchers demonstrating code execution against these applications (Calif; Wiz for WordPress and Drupal), which is not attackers succeeding against someone. where it was reviewed, 2026-10-23, claude-journalist |
Japan's Prime Minister issued an emergency order over PHP2Shell that forced many large platforms to close for maintenancecur3-jp-pm-emergency-order · agencies | Nguoi Quan Sat | reported | Only this outlet in the vault; the Japanese pages promoted so far describe precautionary suspensions by companies and a bank, not a prime-ministerial order. Needs a Japanese government or wire source. curator@php.newsroom | nguoiquansat.vn | held back One Vietnamese outlet. Reuters, CNN and USA Today, in the vault, describe Prime Minister Takaichi urging website operators on X to check for PHP and prepare to patch, and, in CNN's account, saying companies should consider suspending services: a request, not an order. where it was reviewed, 2026-10-23, claude-journalist |
An August 2026 audit financed by OpenAI used an AI model to show the PHP flaws could be exploitedcur3-openai-funded-audit · disclosure | SiliconANGLE | reported | Check against the Calif and OpenAI material in the vault; the Information Age piece attributes the August discovery to Calif. curator@php.newsroom | SiliconANGLE | held back SiliconANGLE's own description of the August work, which the site records as found by researchers using frontier AI under OpenAI's initiative (claim ai-found). Not used, so that it is not confused with the 2024 Quarkslab audit. where it was reviewed, 2026-10-23, claude-journalist |
More than 22 million servers (22.6 million in the headline) were put at risk by the PHP2Shell flawscur3-22m-servers · impact | TechTarget Japan | reported | The basis of the figure is not stated in the text; compare the NCSC-NL inventory and the vault's exposure counts. curator@php.newsroom | TechTargetジャパン | held back TechTarget Japan gives 22 million (22.6 million in its headline) with no basis. The site's scale figures, each with what it measures, are on the numbers page. where it was reviewed, 2026-10-23, claude-journalist |
Used (10)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
Morocco's DGSSI published a critical bulletin (ref. 69782110/26) on the PHP2Shell flaws on Wednesday 21 Octobercur2-dgssi-bulletin · agencies | Morocco World News | reported | curator@php.newsroom | Morocco World News | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Singapore's Cyber Security Agency urged organisations to fix the two PHP flaws immediately, on Thursday 22 Octobercur2-csa-sg-urged · agencies | CNA | reported | curator@php.newsroom | CNA | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Peru's Centro Nacional de Seguridad Digital reported the PHP2Shell threat as critical in its 21 October 2026 reportcur3-peru-cnsd-report · agencies | Agencia Andina | reported | Quoted from the agency's own report as relayed by Andina. curator@php.newsroom | Agencia Andina | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Cloudflare observed thousands of PHP2Shell exploitation attempts in the ten hours before disclosure and millions in total; these are attempts detected, not successful intrusionscur3-cloudflare-attempts · exploitation | Cloudflare, via GinjFo | reported | Secondary report; Cloudflare's own figures are not in the vault. Medianama also mentions Cloudflare's CEO sharing statistics. curator@php.newsroom | GinjFo | used Used in the state of affairs v2. The curator's note says Cloudflare's own figures are not in the vault; they are, in the chief executive's post on X (claim cf-millions). where it was reviewed, 2026-10-23, claude-journalist |
Risikomonitor found just over 23,000 of nearly 690,000 Switzerland-linked servers (about 3.5%) still affected by PHP2Shell on 22 October 2026cur3-risikomonitor-swiss · impact | Risikomonitor, via ICTjournal | reported | The firm says the true figure may be higher, since the PHP version is not always detectable. curator@php.newsroom | ICTjournal | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Wiz Research said the PHP flaws could let an unauthenticated attacker execute code or read sensitive process memory containing passwords, authentication tokens, API keys and certificatescur3-wiz-memory-read · impact | Wiz Research, via IDX Channel | reported | Check against Wiz's own post in the vault. curator@php.newsroom | IDX Channel | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
No Luxembourg financial institution, public service or operator had announced it had actually been infiltrated via PHP2Shellcur3-lux-no-breach-announced · compromise | Paperjam | reported | Point-in-time, and an absence of announcements, not evidence of absence of compromise. curator@php.newsroom | Paperjam | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
AhnLab examined 100 GitHub repositories related to PHP2Shell on 22 October 2026 and classed 27 as proof-of-concept exploitscur3-ahnlab-27-pocs · exploitation | AhnLab, via Security Measures Lab | reported | Not fetched or run by the curator; AhnLab's own post is not in the vault. curator@php.newsroom | 合同会社ロケットボーイズ | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Dutch MPs put questions to Justice and Security minister van Weel on taking government sites offline over PHP2Shell; DigiD, MijnOverheid, Overheid.nl and TweedeKamer.nl had gone offline the day beforecur3-nl-kamervragen · agencies | Security.NL | reported | Date of the page not in the capture's metadata; the outage itself is also covered by securitynl-misbruik-gemeld and tpo-tpo-nl-digid-offline. curator@php.newsroom | Security.NL | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Per Korea's science ministry and KISA on 22 October 2026, CVE-2026-109618 is classed as improper handling of exceptional conditions and CVE-2026-109619 as use-after-free, and the national cyber-crisis level was raised to 'caution'cur3-kisa-cwe-and-alert · agencies | Ministry of Science and ICT and KISA, via Shin-A Ilbo | reported | The page's headline gives the alert-level change; the ministry's own notice is not in the vault. curator@php.newsroom | 신아일보 | used Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date. where it was reviewed, 2026-10-23, claude-journalist |
Agrees (3)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
Calif discovered the PHP flaws in August 2026 using a large language modelcur2-calif-august · disclosure | Calif, via Information Age | reported | Contradicted in its dating by the Indian Express piece (indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb), which says the flaws were identified on 20 October; not checked against the vault's ledger. curator@php.newsroom | Information Age | agrees Agrees with the site's confirmed claim who-first (discovery 1 August, report to PHP 11 August). where it was reviewed, 2026-10-23, claude-journalist |
PHP versions from 5.4 through 8.5.11 are vulnerablecur2-affected-5-4-to-8-5-11 · impact | MediaNama | reported | Check against the PHP Foundation's advisory. curator@php.newsroom | MediaNama | agrees As above: Wiz's bound. Disputed against the CVE records in the site's claim versions-old. where it was reviewed, 2026-10-23, claude-journalist |
PHP versions back to 5.4 are affected by the PHP2Shell flawscur3-ism-affected-5-4 · impact | Infosecurity Magazine | reported | Agrees with MediaNama (5.4 to 8.5.11); Ars Technica reports a watchTowr claim of every version since PHP 5. Check against the PHP Foundation's advisory. curator@php.newsroom | Infosecurity Magazine | agrees Agrees with Wiz's own post ('dating back to PHP 5.4'). The CVE records list only the supported branches; see the site's disputed claim versions-old. where it was reviewed, 2026-10-23, claude-journalist |
Not yet reviewed (65)
| Claim, as the agent recorded it | Said by | Agent's status | Agent's note | Sources | Journalist's review |
|---|---|---|---|---|---|
Roughly 70% of the internet is affectedscale-70pc · | Wiz | unverified | BBC: 'unable to independently verify that figure' claude-newsroom-lead | BBC News | not yet reviewed |
Two critical vulnerabilitiestwo-vulns · | NSA Cybersecurity (X) | reported | need the NSA post itself and the CVE IDs claude-newsroom-lead | BBC News | not yet reviewed |
The 'most severe' flaws ever detected by AImost-severe-ai · | Wiz | reported | claude-newsroom-lead | BBC News | not yet reviewed |
Attackers could take control of affected web servers without authentication and steal dataimpact-unauth · | Paul Spain, Gorilla Cyber Security; Woodward | reported | claude-newsroom-lead | BBC News | not yet reviewed |
Where immediate remediation is not feasible, take the system offline until fully mitigatedoffline-advice · | UK NCSC; NSA; EU and Australian counterparts | reported | claude-newsroom-lead | BBC News | not yet reviewed |
ČVUT (Czech Technical University in Prague) is dealing with a cyber attack on its IT infrastructure that it calls part of worldwide attempts to hit PHP websites; the active attack was stopped and some systems were taken offline as a precautioncvut-attack-part-of-php-attempts · compromise | ČVUT, quoted by Lupa.cz | disputed | From the source watch's contradiction ledger, record compromise-cvut (open), statement 1. The organisation's own words describe attempts and a stopped attack, not a successful compromise. The queue's Facebook capture of ČVUT's post was not promoted: it holds no statement text (login wall). curator@php.newsroom | Lupa.cz | not yet reviewed |
It is not yet clear whether the unavailability of ČVUT's sites really relates to PHP2Shell; the community has found no evidence of real exploitationcvut-link-unclear · compromise | Lupa.cz | disputed | From the source watch's contradiction ledger, record compromise-cvut (open), statement 2. curator@php.newsroom | Lupa.cz | not yet reviewed |
Unauthorised programs were found on 20 October on some servers of GMO's FX automated-trading VPS (お名前.com デスクトップクラウド); 26,739 servers may be affected, trading-account logins may have been taken, and fraudulent operations on trading accounts have been reportedgmo-fx-vps-compromise · compromise | GMO Internet Group, via J-CAST / Yahoo! News Japan | disputed | From the source watch's contradiction ledger, record compromise-gmo-fx-vps (open), statement 1. The compromise is stated by GMO; what is disputed is any link to php2shell. curator@php.newsroom | Yahoo! News Japan | not yet reviewed |
The GMO article does not name PHP or php2shell as the cause; the link exists only in other outlets' juxtapositiongmo-fx-vps-cause-unstated · compromise | the source watch (reading of the same capture) | disputed | From the source watch's contradiction ledger, record compromise-gmo-fx-vps (open), statement 2. The curator's reading of the capture agrees: PHP appears only in related-article links. curator@php.newsroom | Yahoo! News Japan | not yet reviewed |
DMM halted services from 22:00 on 21 October for emergency maintenance to respond to a vulnerability found in external software it uses; no personal data leakeddmm-external-software-vulnerability · compromise | DMM, via Sankei | disputed | From the source watch's contradiction ledger, record compromise-dmm (open), statement 1. curator@php.newsroom | 産経ニュース | not yet reviewed |
DMM told Sankei it cannot say more than its announcement and would not confirm a link to PHPdmm-no-php-confirmation · compromise | Sankei | disputed | From the source watch's contradiction ledger, record compromise-dmm (open), statement 2. curator@php.newsroom | 産経ニュース | not yet reviewed |
Valtec halted services and may have leaked personal data after a cyberattack targeting the PHP vulnerabilityvaltec-php-attack · compromise | Valtec (first statement, 22 October), via INTERNET Watch | contradicted | From the source watch's contradiction ledger, record compromise-valtec (resolved). The company retracted its PHP attribution the same day: the cause was a vulnerability in its own service. curator@php.newsroom | INTERNET Watch | not yet reviewed |
Valtec's correction: the attack exploited a vulnerability in its own service, not PHP; it confused the two because it was handling the PHP vulnerability at the timevaltec-own-service-flaw · compromise | Valtec (correction), via INTERNET Watch (same article, updated) | reported | From the source watch's contradiction ledger, record compromise-valtec (resolved), statement 2: the resolution. curator@php.newsroom | INTERNET Watch | not yet reviewed |
The BSI has found no cases of exploitation so far, and the absence of reports suggests many operators have patchedbsi-no-exploitation · exploitation | BSI, via RTL Deutschland (dpa) | disputed | From the source watch's contradiction ledger, record exploitation-germany-netherlands (open), statement 1. curator@php.newsroom | RTL.de | not yet reviewed |
Abuse of the PHP2Shell flaw has been reported: several security firms report attack attempts; whether any succeeded is unclear, and Previdian says attackers did not manage to execute PHP or upload filessecuritynl-abuse-reported · exploitation | Security.NL | disputed | From the source watch's contradiction ledger, record exploitation-germany-netherlands (open), statement 2. The headline says abuse; the body says attempts. curator@php.newsroom | Security.NL | not yet reviewed |
50 sites went dark over php2shell, 2 of them still dark at 18:36 UTC on 22 Octobersites-offline-tracker-50 · impact | PHPocalypse Tracker (community) | disputed | From the source watch's contradiction ledger, record sites-taken-offline (open), statement 2. The other statement there (10 operators, the site's own impact ledger) has no evidence source to cite, so it is not recorded here. Each tracker row is only as good as the source it cites. curator@php.newsroom | PHPocalypse Tracker | not yet reviewed |
724 products in the NCSC-NL inventory at 18:36 UTC on 22 October, now in 27 per-letter files: for each CVE 216 vulnerable, 61 fixed, 440 under investigation, 6 not vulnerablencsc-nl-inventory-1836 · scale | NCSC-NL | confirmed | Counted by the curator from the captured files. Supersedes by time the 674-product count at commit cca173c64ec5 (08:40 UTC), claim scale-ncsc-nl in claude-story-site's file; that count was right for its time. curator@php.newsroom | NCSC-NL NCSC-NL | not yet reviewed |
QNAP PSIRT observed scanning activity and exploitation attempts against the PHP2Shell vulnerabilities in the wild, and blocked attempted attacks on QNAP's website, online store and cloud servicesqnap-attempts-in-wild · exploitation | QNAP | reported | A vendor's first-hand observation of attempts, not of a successful compromise. Its advisory says QNAP has no reports of exploitation targeting QNAP products (qnap-qsa-26-18). curator@php.newsroom | QNAP | not yet reviewed |
QNAP products are affected (QTS, QuTS hero, QuTScloud, QuMagie, Note Station 3, QNE, QVR Surveillance on ARM32, TVR OS); fixed versions pending, users told to keep devices off the internetqnap-products-affected · appliances | QNAP (QSA-26-18) | confirmed | curator@php.newsroom | QNAP | not yet reviewed |
PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are affected through the management web interface; fixes pending; Palo Alto is not aware of malicious exploitation against its products and rates it HIGH (CVSS-B 8.7) in its productpanos-management-affected · appliances | Palo Alto Networks | confirmed | Palo Alto's product vectors score availability impact only (VC:N/VI:N/VA:H), not code execution, unlike the 9.2 PHP vendor score it also shows (claim two-cves-9.2). curator@php.newsroom | Palo Alto Networks | not yet reviewed |
Cisco is investigating seven products; no Cisco product is yet known to be affected, and Cisco PSIRT is not aware of malicious usecisco-none-known-affected · appliances | Cisco PSIRT (cisco-sa-php-october26, v1.2) | reported | curator@php.newsroom | Cisco | not yet reviewed |
Fortinet is investigating FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS; FortiOS and others are confirmed not impactedfortinet-investigating · appliances | Fortinet PSIRT (FG-IR-26-186) | reported | curator@php.newsroom | Fortinet | not yet reviewed |
NÚKIB: updating is the only solution; fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; information enabling exploitation is publicly availablenukib-update-only-fix · agencies | NÚKIB (Czech national cyber agency) | reported | Agrees with the fixed versions in claim two-cves-9.2. curator@php.newsroom | NÚKIB | not yet reviewed |
The Swiss Federal Office for Cyber Security (BACS) knows of no attacks in Switzerlandbacs-no-attacks-switzerland · exploitation | BACS, via Watson (Keystone-SDA) | reported | English from the source watch reader's translation. curator@php.newsroom | Watson | not yet reviewed |
Japan's Chief Cabinet Secretary Kihara said no damage had been reportedjapan-no-damage-reported · exploitation | Japanese government, via Kyodo (Chinese edition) and Koran Jakarta | reported | Sits alongside the GMO FX VPS compromise and Valtec's (retracted) PHP attribution, both in Japan on the same days; neither is attributed to php2shell by the company. curator@php.newsroom | 共同網 Koran Jakarta ® | not yet reviewed |
Mostly automated exploitation attempts against private and state systems in Latvia have so far failed; about 6,000 resources in Latvia could be affected, several hundred in the public sectorlatvia-attempts-failed-6000 · exploitation | CERT.LV deputy head, via Delfi (LTV Panorāma) | reported | Adds a source and the 6,000 estimate to claim latvia-attempts (claude-story-site). English from the source watch reader's translation. curator@php.newsroom | DELFI | not yet reviewed |
About 22 million servers are exposed (an estimate attributed to Palo Alto Networks)scale-22m-paloalto · scale | Salzburg24 (APA) | unverified | Second-hand; Palo Alto's own advisory (paloalto-psirt-cve-2026-109618) gives no such figure. Not comparable with claim scale-2.6m-hosts (Censys hosts) or scale-30m (websites). curator@php.newsroom | salzburg24 | not yet reviewed |
1.5 million of 2.6 million hosts ran unpatched PHP (Censys data)scale-1.5m-of-2.6m-unpatched · scale | TuttoTech, citing Censys | reported | The 2.6 million agrees with claim scale-2.6m-hosts. English from the source watch reader's translation. curator@php.newsroom | TuttoTech.net | not yet reviewed |
About 5.1 million IPs run PHP (VirusTotal analysis), 1.1 million disclose their version, about 272,000 run supported branches and about 758,000 run end-of-life versionsscale-5.1m-virustotal · scale | TugaTech, citing a VirusTotal analysis | reported | A different measure (IPs) from Censys's 2.6 million hosts. English from the source watch reader's translation. curator@php.newsroom | TugaTech | not yet reviewed |
To the PHP Foundation's knowledge there has been no successful attempt at remote code executionphp-foundation-no-successful-rce · compromise | Elizabeth Barron, PHP Foundation executive director, to WIRED and The Verge | reported | Break-in question. Stated on 21-22 October; 'to our knowledge'. curator@php.newsroom | WIRED The Verge | not yet reviewed |
Observed activity since disclosure remains limited to scanning, fingerprinting and non-working exploits, with no known compromisesdataminr-no-known-compromises · compromise | Dataminr TRACE, via BleepingComputer | reported | Break-in question. curator@php.newsroom | BleepingComputer | not yet reviewed |
No breach at a real organisation had been confirmed by the time the fixes were released; watchTowr's decoy servers recorded attemptsno-confirmed-breach-at-release · compromise | Insurance Business (Australia) | reported | Break-in question. The same page's 22 October update says vendors now report exploitation beyond honeypots, not yet confirmed by agencies. curator@php.newsroom | Insurance Business | not yet reviewed |
Patchstack received reports of multiple active exploitation incidents from hosting partners by 07:34 UTC on 21 October, and says it has confirmed multiple active exploitation incidentspatchstack-exploitation-incidents · compromise | Patchstack, via Recorded Future and Insurance Business | unverified | Break-in question. The strongest vendor claim of real incidents, but second-hand here, and no victim organisation is named. Recorded Future: public evidence 'remains insufficient to establish the extent of successful compromise'. curator@php.newsroom | Recorded Future Insurance Business | not yet reviewed |
PHP2Shell is now being broadly exploited in the wild; it is unclear whether any of the observed attempts would have succeeded on real-world systemsaws-broadly-exploited · exploitation | Amazon (CJ Moses, AWS CISO), via WIRED, BleepingComputer, The Register and SecurityWeek | reported | Both halves are Amazon's own words: 'exploited' here means attempts seen on honeypots and sensors, not confirmed break-ins. curator@php.newsroom | WIRED BleepingComputer The Register SecurityWeek | not yet reviewed |
PHP2Shell is being exploited in the wild at scale, mostly through PHP's session upload-progress mechanismhadrian-exploited-at-scale · exploitation | Hadrian, via The Register, TechTarget and Insurance Business | reported | curator@php.newsroom | The Register TechTarget Insurance Business | not yet reviewed |
Huntress had not observed exploitation across its partner systemshuntress-none-observed · exploitation | Huntress, via Insurance Business | reported | curator@php.newsroom | Insurance Business | not yet reviewed |
Cloudflare observed exploit attempts in spikes of thousands, rising to millions by the evening of 21 October; these describe attack attempts and do not by themselves establish successful compromisescloudflare-attempts-not-compromises · exploitation | Cloudflare (Daniele Molteni to USA Today; Matthew Prince via The Verge; counts via Fortune) | reported | curator@php.newsroom | USA Today The Verge Fortune | not yet reviewed |
At least one Chinese IP address unsuccessfully attempted to exploit PHP2Shell to deploy a webshellvulncheck-webshell-attempt · exploitation | VulnCheck, via SecurityWeek | reported | curator@php.newsroom | SecurityWeek | not yet reviewed |
A startup owner says hackers stole their source code, exposed cookie data and leaked legal documents through the PHP bugstartup-source-code-theft · compromise | an unnamed startup owner, via Fortune (linking to a post on X) | unverified | Break-in question. The only claimed break-in in this batch. 'Allegedly' in Fortune's words; no company is named and nothing shown links the theft to php2shell. The person is not named here. Not a named organisation, so it does not contradict the statement on /compromise/. curator@php.newsroom | Fortune | not yet reviewed |
The PHP vulnerabilities were exploited days before they were patchedheadlines-exploited-before-patch · exploitation | WIRED and The Verge (headlines) | disputed | The headlines say exploited; both bodies describe an attempt on an Amazon honeypot on 17 October and quote the PHP Foundation that no successful RCE is known. curator@php.newsroom | WIRED The Verge | not yet reviewed |
Chainguard independently found the vulnerability on 16 October with an AI harness, and published fixed builds early because vendors in the disclosure channel reported active exploitation overnight on 20-21 Octoberchainguard-lorenc-account · disclosure | Dan Lorenc, Chainguard CEO, to TechTarget | disputed | Chainguard's side of claim chainguard (claude-story-site, disputed). Lorenc does not dispute publishing early; he disputes the PHP Foundation's account that Chainguard had the patch early for its customers. curator@php.newsroom | TechTarget | not yet reviewed |
Sansec said it expected mass attacks to start within 15 minutes of the patch releasecur2-ars-sansec-15min · exploitation | Sansec, via Ars Technica | reported | Forecast made before release, not an observation. curator@php.newsroom | Ars Technica | not yet reviewed |
Huntress had not observed in-the-wild exploitation across its partner base as of 10 a.m. Eastern on Wednesday 21 Octobercur2-crn-huntress-no-itw · exploitation | Huntress, via CRN | reported | Point-in-time statement; watchTowr reported exploitation attempts the same day. curator@php.newsroom | CRN | not yet reviewed |
Amazon's MadPot honeypot recorded the earliest PHP2Shell exploitation attempt on 17 October 2026, four days before public disclosurecur2-madpot-17-oct · exploitation | Amazon, via Cyber Press | reported | Secondary report of Amazon's own findings; see also bleepingcomputer-amazon-4-days-before. curator@php.newsroom | Cyber Press | not yet reviewed |
ASD's ACSC said it was not aware of active exploitation of the PHP vulnerabilities when it issued its critical alert on the evening of 21 Octobercur2-acsc-no-exploitation · exploitation | ASD ACSC, via Information Age | reported | Point-in-time; Amazon had seen attempts from 17 October. curator@php.newsroom | Information Age | not yet reviewed |
The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35cur2-fixed-versions · patching | Search Engine Roundtable | reported | Check against the PHP Foundation's own advisory in the vault. curator@php.newsroom | Search Engine Roundtable | not yet reviewed |
The Australian Signals Directorate issued a top-level alert on the PHP vulnerabilities on Wednesday 21 October, before the patches were outcur2-asd-alert-21-oct · agencies | The Mandarin | reported | curator@php.newsroom | The Mandarin | not yet reviewed |
VulnCheck traced one PHP2Shell exploitation attempt to an IP address based in Chinacur2-vulncheck-china-ip · exploitation | VulnCheck, via PCMag | reported | An IP's location does not identify the actor. curator@php.newsroom | PCMag | not yet reviewed |
The UK NCSC advised organisations to update internet-facing PHP systems immediately or temporarily take them offlinecur2-ncsc-uk-update-or-offline · agencies | BankInfoSecurity | reported | curator@php.newsroom | BankInfoSecurity | not yet reviewed |
The FBI's cyber division published an advisory on the two PHP flaws in a post on Xcur2-fbi-advisory-x · agencies | Mashable India | reported | Not yet checked against the FBI's own post. curator@php.newsroom | Mashable India | not yet reviewed |
The US NSA advised taking unpatched PHP systems offline if patching cannot be done immediatelycur2-nsa-offline · agencies | India TV News | reported | Check against the NSA's own advisory. curator@php.newsroom | India TV News | not yet reviewed |
India's CERT-In rated the PHP vulnerabilities high risk, capable of remote code execution and complete system compromisecur2-certin-high · agencies | MediaNama | reported | curator@php.newsroom | MediaNama | not yet reviewed |
Filigran experts compare PHP2Shell to Log4Shell: unauthenticated remote code execution in software present almost everywherecur3-filigran-log4shell · impact | Filigran, via 01net | reported | An expert's comparison, not a measurement. curator@php.newsroom | 01net | not yet reviewed |
Changpeng Zhao warned internet users on 22 October 2026 to be cautious when visiting websites after the PHP patchescur3-cz-warning · impact | Analytics Insight | reported | A public warning by a non-security figure, reported by a crypto-news outlet. curator@php.newsroom | Analytics Insight | not yet reviewed |
The German host Mittwald reported that all of its customers' websites were offline on 21 October 2026cur3-mittwald-all-offline · impact | Bitpage.de | reported | Relayed by Bitpage; the host's own statement is not in the vault. curator@php.newsroom | Bitpage.de | not yet reviewed |
watchTowr confirmed the two PHP vulnerabilities are real and that at least one is reproduciblecur3-watchtowr-confirmed · exploitation | watchTowr, via Computable.nl | reported | Also reported by Ars Technica (arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th). curator@php.newsroom | Computable.nl | not yet reviewed |
The NCSC-NL says the PHP2Shell impact is not limited to websites because PHP is embedded in appliances, network devices and vendor productscur3-ncsc-nl-beyond-websites · impact | NCSC-NL, via Computerworld España | reported | Check against the NCSC-NL repository in the vault. curator@php.newsroom | COMPUTERWORLD ESPAÑA | not yet reviewed |
The Romanian Police website was replaced with a maintenance page during the PHP2Shell shutdownscur3-ro-police-site · impact | Critic Arad | reported | The page text says so; the maintenance page itself is not captured. curator@php.newsroom | Critic Arad | not yet reviewed |
There had been very little reported exploitation of the PHP flaws as of the afternoon of Wednesday 21 October 2026cur3-cyberscoop-little-exploitation · exploitation | CyberScoop | reported | Point-in-time; Amazon had recorded attempts from 17 October and watchTowr and VulnCheck reported attempts the same day. curator@php.newsroom | CyberScoop | not yet reviewed |
The GitHub advisories for the two flaws are GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)cur3-ghsa-ids · patching | Forest Watch | reported | Check against the GitHub advisories in the vault. curator@php.newsroom | 窓の杜 | not yet reviewed |
Searchlight Cyber released an open-source scanner, php2shell-scanner, that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619cur3-searchlight-scanner · tooling | Help Net Security | reported | Not fetched or run by the curator. curator@php.newsroom | Help Net Security | not yet reviewed |
In Morocco the Maghreb Arabe Presse website was put into maintenance and Bank Al-Maghrib's site was unavailable on 21 October 2026cur3-morocco-map-bam · impact | Journal du Canada | reported | Relayed by a Canadian outlet; no Moroccan source in the vault yet. curator@php.newsroom | Journal Du Canada | not yet reviewed |
In Japan, companies and organisations took precautionary measures over the PHP flaws and a bank suspended service, according to Jiji Presscur3-jp-precautions · impact | Jiji Press, via Yahoo! News Japan | reported | Taken from the source headlines named on the page; the Jiji articles themselves are not in the vault. curator@php.newsroom | Yahoo!ニュース | not yet reviewed |
Details of the two PHP vulnerabilities leaked on Hacker News on 20 October 2026, the day before the release, and PHP brought the release forward to 21 October 14:00 UTCcur3-hn-leak · disclosure | Notebookcheck.it | reported | Nguoi Quan Sat also says the leak was on Hacker News. Check against the PHP Foundation's account in the vault. curator@php.newsroom | Notebookcheck.it | not yet reviewed |
PHP released the fixes for CVE-2026-109618 and CVE-2026-109619 at 14:00 UTC on Wednesday 21 October 2026cur3-release-1400utc · patching | Techaeris | reported | Check against the PHP Foundation's own advisory in the vault. curator@php.newsroom | Techaeris | not yet reviewed |