{
 "schema": "sgit.newsroom.story-status/1",
 "site": "php.oct.2026.newsroom.sgit.ai",
 "name": "PHP October 2026",
 "url": "https://php.oct.2026.newsroom.sgit.ai/index.html",
 "story": "php2shell",
 "cves": [
  "CVE-2026-109618",
  "CVE-2026-109619"
 ],
 "status": "developing",
 "version": "0.7.0",
 "data_as_of": "2026-10-22T11:34Z",
 "vault_commit": "200d08971937",
 "counts": {
  "sources": 144,
  "captures": 137,
  "claims": 70,
  "claims_by_status": {
   "confirmed": 21,
   "reported": 34,
   "disputed": 8,
   "contradicted": 3,
   "unverified": 4
  },
  "events": 68,
  "agencies": 16,
  "offline_reported": 10,
  "compromises_confirmed": 0
 },
 "headline_facts": [
  {
   "id": "two-cves-9.2",
   "text": "Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35",
   "status": "confirmed",
   "url": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html#two-cves-9.2",
   "sources": [
    "cve-cve-2026-109618",
    "cve-cve-2026-109619",
    "github-ghsa-w8hw-w9fx-j79w",
    "github-ghsa-6wmf-4rv5-p3rp",
    "php-net-advisory"
   ]
  },
  {
   "id": "no-confirmed-compromise",
   "text": "As of 20:50 UTC on 22 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.",
   "status": "reported",
   "url": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html#no-confirmed-compromise",
   "sources": [
    "cisa-kev-json",
    "cisa-alert-php-20261021",
    "huntress-php2shell-rapid-response",
    "aws-security-blog-madpot",
    "securityweek-first-attempts-sensors",
    "securityweek-exploitation-days-before",
    "recordedfuture-php2shell",
    "imperva-blog-php2shell",
    "weirdgloop-blog-php2shell"
   ]
  },
  {
   "id": "cisa-none",
   "text": "CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog",
   "status": "confirmed",
   "url": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html#cisa-none",
   "sources": [
    "cisa-alert-php-20261021",
    "cisa-kev-json",
    "cve-cve-2026-109618"
   ]
  }
 ],
 "latest_story": {
  "title": "Why can't every version of PHP just be patched?",
  "url": "https://php.oct.2026.newsroom.sgit.ai/articles/why-not-patch-every-version/index.html",
  "written": "2026-10-22",
  "origin": "house"
 },
 "links": {
  "front": "https://php.oct.2026.newsroom.sgit.ai/index.html",
  "sources": "https://php.oct.2026.newsroom.sgit.ai/sources/index.html",
  "claims": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html",
  "stories": "https://php.oct.2026.newsroom.sgit.ai/articles/index.html",
  "releases": "https://php.oct.2026.newsroom.sgit.ai/admin/versions.html",
  "llms": "https://php.oct.2026.newsroom.sgit.ai/llms.txt"
 }
}