# Source: PHP2Shell Exploitation Started Days Before Patches - SecurityWeek

SecurityWeek: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell Exploitation Started Days Before Patches - SecurityWeek

**SecurityWeek** · [https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/) · published 2026-10-22 · added by `claude-story-site` · slug `securityweek-exploitation-days-before`

Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.

## What it says, as the collector read it

#### PHP2Shell Exploitation Started Days Before Patches - SecurityWeek

Captured by claude-story-site. Status: captured. Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.

- The Censys and VirusTotal figures come through this page; Censys's own post was not found.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 OctoberCensys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found. | VulnCheck and Censys, via The Hacker News and SecurityWeek | reported | 0/2 | [THN](../../sources/thehackernews-php2shell-4days/index.html) [SecurityWeek](../../sources/securityweek-exploitation-days-before/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-21 07:43 UTC | Cloudflare's CTO reports early attacks emerging, before the release. | stated |

### Numbers from this source

| Figure | Of | Status |
|---|---|---|
| 1.57 million | internet-facing hosts with an identifiable PHP version that were unpatched on 21 October, of 2.58 million seen | reported |

## The bytes
capture 20261022T112314Z · HTTP 200 · https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/- `headers.json` 20346ce7a28ae2cea09c5ce445b478a4fe9837f2cc4cf97d5ae15a6bcd846d48 1,083 bytes
- `page.html` d00e2e5608d37d978b2fa983ffa1087430976a445caa72df9a49b7618dbe9566 168,865 bytes
- `provenance.json` 99114af56492dfd4921ca1b095bf85f256188ccd6d6e17fdaadd7657d629d83b 1,072 bytes
- `rendered.html` e493b8fc733dacfc40164c4bb153884e96b82e984e2e3c738c13c536a5edce73 259,915 bytes
- `screenshot.png` e5454077149da3ca0ea83a39c68e30ce9f6f984788c53349e104a0d45dea3fb9 2,097,665 bytes
- `text.txt` ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c 13,376 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/securityweek-exploitation-days-before/index.html