Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · technical · disputed
All PHP versions from 5 onwards are affected by at least one of the flaws
The CVE records list only 8.2 to 8.5 with defaultStatus 'unaffected'. php.net published source backports for 7.4, 8.0 and 8.1, which implies they are affected. A scanner that trusts the CVE record will miss 7.4 to 8.1.
Fact-check
A3 Echoed●●●○○○ disputed · State · verdict: holds in part
Wiz (a finder) says '>= 5.4'; PHP's own source backports for 7.4, 8.0 and 8.1 imply those are affected; only NCSC-NL and CERT-FR say all of 5.x, and both pre-release texts look like echoes of the leak (CERT-FR lists a 6.x that never shipped). The CVE records list only 8.2 to 8.5 with default unaffected. So 7.4+ is well supported, 5.4+ rests on Wiz, and 5.0 to 5.3 is not shown; disputed caps display at A2.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| ncsc-nl-advisories | carries | Alle versies vanaf versie 5 zijn in ieder geval kwetsbaar. | b7e4ac6caf7d177d |
| x-wiz-io-php2shell | partial | All php versions >= 5.4 are affected by at least 1 of these vulnerabilities. | 6c17977662815b0c |
| certfr-2026-ale-014 | carries | PHP toutes versions 5.x PHP toutes versions 6.x PHP toutes versions 7.x | f9e9557ab49ddb95 |
| openwall-oss-security-109619-thread | partial | which implies that at least versions down to 7.4 are affected as well | bbc0f0fc06953b13 |
| cve-cve-2026-109618 | absent | Default Status: unaffected | f8705d8e0aa2a248 |
| php-net-advisory | partial | the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 | df0b1bba3deae282 |
| daubois-blog-php2shell-rumors | partial | the same jump sits in the PHP-5.3 allocator. I have not seen an exploit shown on those old versions either. | 5ef17f9886aa93f7 |
| thehackernews-php2shell-unpatched-alert | partial | a post on HN said two PHP remote code execution flaws, rated CVSS 10.0 and affecting versions from PHP 5 onward | 33ba8292e26406d7 |
Open tickets: Contradiction-3, Evidence-9, Finding-107, Finding-50.
Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21CERT-FR publishes [Màj] Multiples vulnérabilités dans PHP (CERTFR-2026-ALE-014)
- 2026-10-21 13:32 UTCWiz on X publishes Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet
- 2026-10-21 15:24 UTCoss-security publishes Re: CVE-2026-109619 thread (21/16, 21/17, 21/23, 22/2)
- 2026-10-22 08:13 UTCSaved into the evidence vault: CERT-FR
- 2026-10-22 08:16 UTCSaved into the evidence vault: NCSC-NL
- 2026-10-22 08:16 UTCSaved into the evidence vault: Wiz on X
- 2026-10-22Enters this site as disputed in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · disputed
All PHP versions from 5 onwards are affected by at least one of the flaws
Who says it: NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1)
Status: disputed
Topic: technical
Sources: ncsc-nl-advisories, x-wiz-io-php2shell, certfr-2026-ale-014, openwall-oss-security-109619-thread