Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · exploitation · reported
No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress
Fact-check
A2 Reported●●○○○○ disputed · State · verdict: holds in part
The first half is carried exactly (4:30pm ET = 20:30 UTC). The second half comes from the pre-release section written before the 21 Oct release ('as of this writing'), not from the 20:30 UTC update, and by then Huntress's own 4:40pm update and other parties report public technical details and PoCs.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| huntress-php2shell-rapid-response | carries | As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems. | a83d744768109a61 |
| huntress-php2shell-rapid-response | partial | We have not built or reproduced a proof of concept for these vulnerabilities, and we're not aware of public exploit code as of this writing. | a83d744768109a61 |
| huntress-php2shell-rapid-response | partial | Since PHP released its security advisory this morning to address the two critical vulnerabilities, several researchers have come forward to release the technical details | a83d744768109a61 |
| cccs-al26-026 | absent | a Proof of Concept (PoC) is available, with no active exploitation being identified at this time | 9e7f44cc73e21ad5 |
| securityweek-exploitation-days-before | absent | WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub. | ac663f2d9dbd0197 |
Open tickets: Finding-17.
Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Huntress publishes Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress
- 2026-10-22 11:28 UTCSaved into the evidence vault: Huntress
- 2026-10-22Enters this site as reported in v0.2.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · reported
No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress Who says it: Huntress Status: reported Topic: exploitation Sources: huntress-php2shell-rapid-response