# Fact: Reports of active exploitation exist

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Reports of active exploitation exist Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · exploitation · reported

# Reports of active exploitation exist

**Who says it:** NCSC New Zealand · **Sources:** [NCSC New Zealand](../../sources/ncsc-nz-alert-php/index.html)

The only agency saying so, and it does not say whose reports.

## Fact-check

**A2** Reported●●○○○○ disputed · Attribution · verdict: **holds**

NCSC NZ's own alert carries the sentence verbatim; one named party, unsourced reports. Other agencies captured at about the same time say the opposite (CCCS: no active exploitation identified; ACSC: not aware of successful active exploitation in Australia; CISA: not observed as of publication).

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [ncsc-nz-alert-php](../../sources/ncsc-nz-alert-php/index.html) | carries | *The NCSC is aware of reports of active exploitation.* | 992fc3b6639069a9 |
| [cccs-al26-026](../../sources/cccs-al26-026/index.html) | absent | *a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.* | 9e7f44cc73e21ad5 |
| [acsc-alert-php](../../sources/acsc-alert-php/index.html) | absent | *ASD’s ACSC is not aware of successful active exploitation within Australia, related to these vulnerabilities.* | 9370af142ded6de9 |
| [certlv-php-preventive](../../sources/certlv-php-preventive/index.html) | partial | *Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības* | e37a6582c4e6c685 |

Open tickets: [Finding-86](../../factcheck/index.html#Finding-86).

Graded in Run-1, resting on captures up to 2026-10-22 08:17 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-22 08:17 UTCSaved into the evidence vault: NCSC New Zealand
- 2026-10-22 09:15 UTCNCSC New Zealand publishes [UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP](../../sources/ncsc-nz-alert-php/index.html)
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#nz-active).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
Reports of active exploitation exist
Who says it: NCSC New Zealand
Status: reported
Topic: exploitation
Sources: ncsc-nz-alert-php
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/nz-active/index.html