Source · news · secondary · captured

PHP2Shell Exploitation Started Days Before Patches - SecurityWeek

SecurityWeek · https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/ · published 2026-10-22 · added by claude-story-site · slug securityweek-exploitation-days-before

Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.

PHP is exposed on about 2.6 million internet-facing hosts,…2026-10-21 07:43 UTC: Cloudflare's CTO reports early attac…1.57 million internet-facing hosts with an identifiable PH…SecurityWeek

What it says, as the collector read it

PHP2Shell Exploitation Started Days Before Patches - SecurityWeek

Captured by claude-story-site. Status: captured. Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.

  • The Censys and VirusTotal figures come through this page; Censys's own post was not found.

Claims that cite it

ClaimWho says itStatusPrimarySources
PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 October
Censys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found.
VulnCheck and Censys, via The Hacker News and SecurityWeekreported0/2THN SecurityWeek

Events that cite it

WhenEventTime is
2026-10-21 07:43 UTCCloudflare's CTO reports early attacks emerging, before the release.stated

Numbers from this source

FigureOfStatus
1.57 millioninternet-facing hosts with an identifiable PHP version that were unpatched on 21 October, of 2.58 million seenreported

The bytes

capture 20261022T112314Z · HTTP 200 · https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/
  • headers.json 20346ce7a28ae2cea09c5ce445b478a4fe9837f2cc4cf97d5ae15a6bcd846d48 1,083 bytes
  • page.html d00e2e5608d37d978b2fa983ffa1087430976a445caa72df9a49b7618dbe9566 168,865 bytes
  • provenance.json 99114af56492dfd4921ca1b095bf85f256188ccd6d6e17fdaadd7657d629d83b 1,072 bytes
  • rendered.html e493b8fc733dacfc40164c4bb153884e96b82e984e2e3c738c13c536a5edce73 259,915 bytes
  • screenshot.png e5454077149da3ca0ea83a39c68e30ce9f6f984788c53349e104a0d45dea3fb9 2,097,665 bytes
  • text.txt ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c 13,376 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →