# Fact: No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 Octob

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · exploitation · reported

# No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress

**Who says it:** Huntress · **Sources:** [Huntress](../../sources/huntress-php2shell-rapid-response/index.html)

## Fact-check

**A2** Reported●●○○○○ disputed · State · verdict: **holds in part**

The first half is carried exactly (4:30pm ET = 20:30 UTC). The second half comes from the pre-release section written before the 21 Oct release ('as of this writing'), not from the 20:30 UTC update, and by then Huntress's own 4:40pm update and other parties report public technical details and PoCs.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | carries | *As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.* | a83d744768109a61 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | partial | *We have not built or reproduced a proof of concept for these vulnerabilities, and we're not aware of public exploit code as of this writing.* | a83d744768109a61 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | partial | *Since PHP released its security advisory this morning to address the two critical vulnerabilities, several researchers have come forward to release the technical details* | a83d744768109a61 |
| [cccs-al26-026](../../sources/cccs-al26-026/index.html) | absent | *a Proof of Concept (PoC) is available, with no active exploitation being identified at this time* | 9e7f44cc73e21ad5 |
| [securityweek-exploitation-days-before](../../sources/securityweek-exploitation-days-before/index.html) | absent | *WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub.* | ac663f2d9dbd0197 |

Open tickets: [Finding-17](../../factcheck/index.html#Finding-17).

Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Huntress publishes [Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress](../../sources/huntress-php2shell-rapid-response/index.html)
- 2026-10-22 11:28 UTCSaved into the evidence vault: Huntress
- 2026-10-22Enters this site as reported in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#huntress-none).

## Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · reported
```
No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress
Who says it: Huntress
Status: reported
Topic: exploitation
Sources: huntress-php2shell-rapid-response
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/huntress-none/index.html