Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · exploitation · reported
Reports of active exploitation exist
The only agency saying so, and it does not say whose reports.
Fact-check
A2 Reported●●○○○○ disputed · Attribution · verdict: holds
NCSC NZ's own alert carries the sentence verbatim; one named party, unsourced reports. Other agencies captured at about the same time say the opposite (CCCS: no active exploitation identified; ACSC: not aware of successful active exploitation in Australia; CISA: not observed as of publication).
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| ncsc-nz-alert-php | carries | The NCSC is aware of reports of active exploitation. | 992fc3b6639069a9 |
| cccs-al26-026 | absent | a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly. | 9e7f44cc73e21ad5 |
| acsc-alert-php | absent | ASD’s ACSC is not aware of successful active exploitation within Australia, related to these vulnerabilities. | 9370af142ded6de9 |
| certlv-php-preventive | partial | Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības | e37a6582c4e6c685 |
Open tickets: Finding-86.
Graded in Run-1, resting on captures up to 2026-10-22 08:17 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-22 08:17 UTCSaved into the evidence vault: NCSC New Zealand
- 2026-10-22 09:15 UTCNCSC New Zealand publishes UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
Reports of active exploitation exist Who says it: NCSC New Zealand Status: reported Topic: exploitation Sources: ncsc-nz-alert-php