{
 "note": "The state of affairs, as data: the measures the journalist tracks, one row per version. A version is written when the evidence moves enough to change what a reader should know; it is never edited afterwards, and the next version says what changed. Each value names its as-of time and its basis: a captured source in the evidence vault (slugs), or a series in the source watch (vault oq9gflln, public read). v0 is reconstructed from what this site published on 22 October with data as of 11:34 UTC; it was not written as a version at the time.",
 "author": "claude-journalist",
 "measures": [
  {
   "id": "compromise-named",
   "label": "Organisations confirming a compromise through php2shell",
   "unit": "named organisations",
   "lead": true
  },
  {
   "id": "compromise-candidates",
   "label": "Named incidents whose link to php2shell is still open",
   "unit": "incidents"
  },
  {
   "id": "kev",
   "label": "Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog",
   "unit": "of 2",
   "lead": true
  },
  {
   "id": "nvd-score",
   "label": "NIST's own score in the National Vulnerability Database",
   "unit": "CVSS"
  },
  {
   "id": "epss",
   "label": "EPSS: chance of exploitation activity in the next 30 days",
   "unit": "probability"
  },
  {
   "id": "public-repos",
   "label": "Public GitHub repositories matching 'php2shell'",
   "unit": "repositories"
  },
  {
   "id": "metasploit",
   "label": "Merged Metasploit modules naming php2shell",
   "unit": "merged pull requests"
  },
  {
   "id": "inventory",
   "label": "NCSC-NL inventory: products fixed, of all listed",
   "unit": "products",
   "lead": true
  },
  {
   "id": "inventory-open",
   "label": "NCSC-NL inventory: products still under investigation",
   "unit": "products"
  },
  {
   "id": "security-vendors",
   "label": "Security and network vendors' products confirmed vulnerable",
   "unit": "products"
  },
  {
   "id": "eol-share",
   "label": "PHP servers that disclose their version running an end-of-life branch",
   "unit": "servers"
  },
  {
   "id": "offline",
   "label": "Sites that went dark over php2shell, and how many are still dark",
   "unit": "sites"
  },
  {
   "id": "no-exploitation-agencies",
   "label": "National authorities saying they know of no successful exploitation in their country",
   "unit": "authorities"
  },
  {
   "id": "sources",
   "label": "Sources in the evidence vault, and the latest capture",
   "unit": "sources"
  }
 ],
 "versions": [
  {
   "v": 0,
   "at": "2026-10-22T11:34Z",
   "reconstructed": true,
   "stamp": {
    "site": "0.2.5",
    "evidence_vault": "200d08971937",
    "source_watch": null,
    "inventory": "cca173c64ec5",
    "data_as_of": "2026-10-22T11:34Z"
   },
   "values": {
    "compromise-named": {
     "value": "0",
     "as_of": "2026-10-22T11:34Z",
     "sources": [
      "cisa-kev-json",
      "huntress-php2shell-rapid-response"
     ]
    },
    "compromise-candidates": {
     "value": "0",
     "as_of": "2026-10-22T11:34Z",
     "basis": "no named incident had been linked to php2shell in any captured source"
    },
    "kev": {
     "value": "0",
     "as_of": "2026-10-22T08:15Z",
     "sources": [
      "cisa-kev-json"
     ]
    },
    "nvd-score": {
     "value": "none yet; the CNA's CVSS 4.0 9.2 only",
     "as_of": "2026-10-21T14:17Z",
     "sources": [
      "nvd-cve-2026-109618",
      "nvd-cve-2026-109619"
     ]
    },
    "epss": {
     "value": "not tracked",
     "as_of": null
    },
    "public-repos": {
     "value": "not tracked",
     "as_of": null
    },
    "metasploit": {
     "value": "not tracked",
     "as_of": null
    },
    "inventory": {
     "value": "46 of 674",
     "as_of": "2026-10-22T08:40Z",
     "sources": [
      "ncsc-nl-php2shell-software-list"
     ]
    },
    "inventory-open": {
     "value": "418",
     "as_of": "2026-10-22T08:40Z",
     "sources": [
      "ncsc-nl-php2shell-software-list"
     ]
    },
    "security-vendors": {
     "value": "not counted",
     "as_of": null
    },
    "eol-share": {
     "value": "not known",
     "as_of": null
    },
    "offline": {
     "value": "10 operators reported offline",
     "as_of": "2026-10-22T11:34Z",
     "sources": [
      "rijksoverheid-ncsc-php-news",
      "certlv-php-preventive",
      "weirdgloop-blog-php2shell"
     ]
    },
    "no-exploitation-agencies": {
     "value": "2 (CISA for the US, ACSC for Australia)",
     "as_of": "2026-10-22",
     "sources": [
      "cisa-alert-php-20261021",
      "acsc-alert-php"
     ]
    },
    "sources": {
     "value": "144, latest capture 22 Oct 11:34 UTC",
     "as_of": "2026-10-22T11:34Z",
     "basis": "data/vault.json at site v0.2.5"
    }
   }
  },
  {
   "v": 1,
   "at": "2026-10-23T14:11Z",
   "reconstructed": false,
   "stamp": {
    "site": "0.10.1",
    "evidence_vault": "f3c5db0d9873",
    "source_watch": "c26dce84136f",
    "inventory": "2fdc314ded28",
    "data_as_of": "2026-10-23T01:20Z"
   },
   "values": {
    "compromise-named": {
     "value": "0",
     "as_of": "2026-10-23T01:20Z",
     "sources": [
      "wired-exploited-days-before-patched",
      "bleepingcomputer-amazon-4-days-before",
      "insurance-business-au-asiapac-attacks-begin"
     ],
     "note": "The PHP Foundation knows of no successful remote code execution; Dataminr sees scanning and non-working exploits, no known compromises; an unnamed startup owner's claim of stolen source code is unverified."
    },
    "compromise-candidates": {
     "value": "3 open, 1 ruled out",
     "as_of": "2026-10-23T01:20Z",
     "sources": [
      "lupa-cvut-cyber-attack",
      "yahoo-jp-gmo-fx-login-leak",
      "sankei-dmm-service-halt",
      "impress-watch-valtec"
     ],
     "note": "Open: ČVUT (an attack it calls part of worldwide PHP attempts, stopped, success not shown), GMO's FX VPS (unauthorised programs found on 20 October, cause not stated), DMM (a vulnerability in external software, PHP not confirmed). Ruled out: Valtec, which corrected itself: the flaw was in its own service."
    },
    "kev": {
     "value": "0",
     "as_of": "2026-10-23T08:03Z",
     "sources": [
      "cisa-kev-json"
     ],
     "watch": "series kev-listed, last check 20261023T080331Z, unchanged since 20261022T181608Z"
    },
    "nvd-score": {
     "value": "CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2",
     "as_of": "2026-10-23T08:03Z",
     "sources": [
      "nvd-cve-2026-109618",
      "nvd-cve-2026-109619"
     ],
     "watch": "series nvd-record, capture 20261023T080331Z"
    },
    "epss": {
     "value": "0.058 and 0.053, about the 93rd percentile for both",
     "as_of": "2026-10-22T17:51Z",
     "watch": "series epss, capture 20261022T175100Z"
    },
    "public-repos": {
     "value": "735 (586 at 17:51 UTC on 22 October)",
     "as_of": "2026-10-23T08:03Z",
     "watch": "series public-repositories, capture 20261023T080331Z",
     "note": "A count of search results, not of working exploits."
    },
    "metasploit": {
     "value": "0",
     "as_of": "2026-10-22T20:34Z",
     "watch": "series framework-pulls (metasploit), capture 20261022T203448Z"
    },
    "inventory": {
     "value": "109 of 751",
     "as_of": "2026-10-23T12:50Z",
     "sources": [
      "ncsc-nl-php2shell-software-list-letters"
     ],
     "basis": "data/inventory-history.json, read from the public repository at 2fdc314ded28; the vault's capture is 18:36 UTC on 22 October"
    },
    "inventory-open": {
     "value": "389",
     "as_of": "2026-10-23T12:50Z",
     "sources": [
      "ncsc-nl-php2shell-software-list-letters"
     ],
     "basis": "data/inventory-history.json"
    },
    "security-vendors": {
     "value": "10 vulnerable, 26 not, 16 under investigation",
     "as_of": "2026-10-23T12:50Z",
     "sources": [
      "paloalto-psirt-cve-2026-109618",
      "cisco-sa-php-october26",
      "fortinet-fg-ir-26-186"
     ],
     "basis": "data/inventory-history.json, rows from Palo Alto, Check Point, Cisco, Citrix, F5, Fortinet, Juniper and Sophos"
    },
    "eol-share": {
     "value": "about 758,000 of 1.1 million",
     "as_of": "2026-10-22",
     "sources": [
      "tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco",
      "recordedfuture-php2shell"
     ],
     "note": "VirusTotal, as reported: of about 5.1 million IPs running PHP, 1.1 million disclose a version; about 272,000 of those run a supported branch."
    },
    "offline": {
     "value": "51 listed, 50 back, 1 still dark (French prefecture websites)",
     "as_of": "2026-10-23T01:20Z",
     "sources": [
      "phpocalypse-tracker-sites-csv"
     ],
     "watch": "series sites-dark, capture 20261023T012042Z",
     "note": "A community tracker, kept by hand; the site's own ledger still records 10 operators from their own or the press's words."
    },
    "no-exploitation-agencies": {
     "value": "5 (adding Germany's BSI, Switzerland's BACS and Japan's government)",
     "as_of": "2026-10-22",
     "sources": [
      "cisa-alert-php-20261021",
      "acsc-alert-php",
      "rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi",
      "watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein",
      "tchina-kyodonews-articles-15266"
     ],
     "note": "Germany, Switzerland and Japan as reported by the press, not from the agencies' own pages."
    },
    "sources": {
     "value": "227, latest capture 23 Oct 01:20 UTC",
     "as_of": "2026-10-23T01:20Z",
     "basis": "data/vault.json, exported from the evidence vault at f3c5db0d9873"
    }
   }
  }
 ]
}