Source · social · primary · captured

Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet

Wiz (@wiz_io) · https://x.com/wiz_io/status/2112899813264277528 · published 2026-10-21T13:32Z · added by collector-researchers · slug x-wiz-io-php2shell

Shown '13:32 · 21 Oct 2026' (UTC in capture browser) — 28 min before the 14:00 UTC release. Thread says 'Apply the Oct 22 security release immediately' — stale date from the original schedule.

All PHP versions from 5 onwards are affected by at least o…Roughly 70% of the Internet is affectedThe release moved forward from 22 October 14:00 UTC to 21 …2026-10-21 13:32 UTC: Wiz posts 'BREAKING ... #PHP2SHELL .…70% the InternetWiz on X

What it says, as the collector read it

Wiz on X: "#PHP2SHELL ... impacting 70% of the Internet"

  • Verbatim: "🚨 BREAKING: @wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet." Shown 13:32 · 21 Oct 2026 (UTC), i.e. before the 14:00 UTC release.
  • "Wiz Research uncovers" framing: no credit to Calif or OpenAI in the lead post (the blog thanks them).
  • Thread: "All php versions >= 5.4 are affected by at least 1 of these vulnerabilities." "Confirmed pre-auth RCE on representative targets: WordPress, Drupal, and Joomla". "Patch: Apply the Oct 22 security release immediately" — wrong date (the release moved to Oct 21), so the thread was probably drafted before the leak moved the date.
  • 70% here is "of the Internet"; Wiz's blog body and Cloudflare/OpenAI say "of websites".

Claims that cite it

ClaimWho says itStatusPrimarySources
All PHP versions from 5 onwards are affected by at least one of the flaws
The CVE records list only 8.2 to 8.5 with defaultStatus 'unaffected'. php.net published source backports for 7.4, 8.0 and 8.1, which implies they are affected. A scanner that trusts the CVE record will miss 7.4 to 8.1.
NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1)disputed3/4NCSC-NL Wiz on X CERT-FR oss-security
Roughly 70% of the Internet is affected
The BBC was 'unable to independently verify that figure'. Wiz's body text says 70% of websites and cites no measurement.
Wiz (headline, X post); BBC attributing Wizunverified2/3Wiz Wiz on X BBC News
The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak
The php.net ChangeLog still dates all four releases 22 October. Wiz's X thread still says 22 October.
PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release')confirmed4/4PHP Foundation oss-security Wiz on X php.net

Events that cite it

WhenEventTime is
2026-10-21 13:32 UTCWiz posts 'BREAKING ... #PHP2SHELL ... impacting 70% of the Internet', 28 minutes before the planned release; the thread still says 'Apply the Oct 22 security release'.stated

Numbers from this source

FigureOfStatus
70%the Internetunverified

The bytes

capture 20261022T081624Z · HTTP 200 · https://x.com/wiz_io/status/2112899813264277528
  • headers.json f9a8ec8c80b7e7b13a6e772a718ece30ec0796dffd3481acc57a310616eca249 9,022 bytes
  • page.html 6adc23abb012a9e89f22453d2d8d4f0eff574edc67373bc94eef59cfc12ebe85 183,867 bytes
  • provenance.json 5df6949985ad1cf4a150d5b9a7e52f1355bac3b127484b31c70c8052986b1556 1,086 bytes
  • rendered.html 9c5f87ac8afbe6aad1205a23ecbe79d83dc801c77f4d0ffb750ffb5b53625888 193,354 bytes
  • screenshot.png d2187dc09d49ec23ea5593aa7ffef5df60cd2385f290922ec6d77b6861fc7abb 578,314 bytes
  • text.txt 6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809 2,222 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →