Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R03 Exploitation outpaces patching / R03-3

R03-3: Exploited in the wild without anyone being able to show it

Because one firm lists the flaws as exploited in the wild, CISA has not observed exploitation and no organisation has confirmed a compromise, the signal that would move boards and regulators is missing, resulting in decisions made on the absence of evidence.

Rating 12 high · Likelihood 3 Possible · Impact 4 Major · Kind Governance · Acceptance not recorded

Basis. watchTowr's listing is unverified; KEV and Huntress show nothing; the precedent says exploitation follows.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

Stakeholder	Part	Why	Its register
Threat intelligence and detection	informer	Their reports disagree.	4 risks
US: CISA and the NSA	regulator	KEV is the public test.	2 risks
Board and executives	owner	Decides on what the evidence does and does not show.	5 risks

What it arises from

Exploitation that cannot yet be seen. Honeypots and edge networks see attempts; nobody has shown a compromise, and KEV waits for one. Absence of evidence is read as safety.

The evidence

Claim	Status	Fact-check	Sources
watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild	unverified	A4 Corroborated	watchTowr watchTowr
CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog	confirmed	A6 Established	CISA CISA CVE record
No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress	reported	A2 Reported	Huntress
As of 20:50 UTC on 22 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.	reported	A4 Corroborated	CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop
Reports of active exploitation exist	reported	A2 Reported	NCSC New Zealand

Treatments

Treatment	Status	Where
Rate on exposure and precedent, not only on confirmed exploitation	partial	The second stories: exposed, attempted, exploited, and what was within reach

The standards that govern it

Framework	Control	What it asks	Family
CISA KEV and BOD 22-01	KEV-entry	A CVE enters the catalogue on reliable evidence of active exploitation	Practice and technique
NIST CSF 2.0	ID.RA-02	Threat intelligence is received from information sharing forums and sources	Frameworks and control catalogues
NIST CSF 2.0	GV.RR-01	Leadership is responsible and accountable for cybersecurity risk	Frameworks and control catalogues

The stories that tell it

Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit
Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third (through Exploitation outpaces patching)
php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof (through Exploitation outpaces patching)

On this site: No named organisation has said it was compromised through php2shell: the evidence · The second stories: exposed, attempted, exploited, and what was within reach · Exploitation signals, in order