Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
The story · for specialists
The specialist summary: php2shell, CVE-2026-109618 and CVE-2026-109619
This page v2 written in site v0.5.8 on 22 October 2026 · history and changes, 1 earlier
On 21 October 2026 at 14:00 UTC the PHP project released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell. Either can give an unauthenticated attacker remote code execution on a web server running PHP, the language behind WordPress, Drupal, Wikipedia and a large share of the web. The flaws were found with AI help, the coordinated disclosure broke down two days early, and by the morning of 22 October the NSA, CISA and the UK's NCSC were telling organisations that could not patch to take systems offline. This site follows the story as evidence: every claim points to a captured, dated and hashed source, every number says what it measures, and every contradiction between sources is left visible.
Developing, and agent-produced. Software agents assemble this site from sources captured into a private evidence vault; the editor is Dinis Cruz. Nothing here is advice on what to patch in your environment. For that, read the php.net advisory and your national cyber-security agency. Where this site says a thing is confirmed, it means two or more primary sources agree, or the fact was counted from a captured file; reported means one party says so; disputed means the sources disagree; unverified means even the reporting outlet could not check it.
Six numbers, and what each one measures
The figures in circulation range from 2.6 million hosts to 70% of the Internet. They are not contradictory so much as incommensurable: each measures a different thing. The numbers page says what each one counts, who said it, and whether anyone has checked it.
What is established
- There are two flaws, both in the PHP engine, both rated CVSS v4.0 9.2, both fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The CVE records, the GitHub advisories and the php.net advisory agree on this. CVE record CVE record PHP PHP php.net
- Unauthenticated remote code execution was demonstrated against Apache with mod_php before any application code runs. PHP-FPM is susceptible; the two primary accounts differ on whether a complete FPM exploit exists. PHP oss-security PHP Foundation
- The flaws are old. The out-of-memory problem behind CVE-2026-109618 was first seen during a 2024 audit (Quarkslab, funded through OSTIF) and left unfixed because nobody could prove exploitation. PHP 8.1 and older are out of support; the project published minimal source backports for 7.4, 8.0 and 8.1, but the CVE records list only 8.2 to 8.5. PHP Foundation Calif php-src CVE record
- Discovery was AI-assisted and three parties claim it. Calif reported first (hash on 5 August, report on 11 August); OpenAI reported the same root cause the same day; Wiz found it independently on 19 August and reported on 24 August. The GitHub advisories credit four reporters. Calif Ryan Austin, Calif on X PHP Foundation Wiz PHP
- Disclosure broke down on 20 October around 15:00 UTC, when the CVE IDs circulated with a wrong CVSS of 10.0. The release moved forward a day; Calif published, then deleted, a demonstration video; Chainguard shipped patched images six hours before the embargo lifted. PHP Foundation Daubois PHP Foundation
- The scale figures do not measure the same thing.
70% of the Internet
is a Wiz headline; the body of the same post, Cloudflare and OpenAI say 70% of websites; VulnCheck counts 2.6 million internet-facing hosts; Alan Woodward saidsomething like 30 million websites
; Latvia counted about 6,000 potentially affected resources in one country. Wiz Wiz on X Cloudflare OpenAI on X THN BBC News CERT.LV - Exploitation attempts are reported from several directions, but no agency has confirmed a successful compromise. Amazon says a honeypot was hit on 17 October, four days before disclosure. Cloudflare saw attack traffic after the leak. Latvia saw automated attempts, none successful. CISA has not listed either CVE as known-exploited. New Zealand's NCSC alone says it is
aware of reports of active exploitation
. THN Cloudflare CERT.LV CISA NCSC New Zealand - The agencies do not agree on taking systems offline. The NSA and CISA say take them offline if you cannot patch; the UK NCSC puts that fourth, after patching and temporary mitigations; CERT-EU, Canada and France say isolate; Australia, the Netherlands, Italy, Japan and New Zealand give no offline advice at all. NSA Cyber on X CISA NCSC UK CERT-EU CCCS CERT-FR ACSC NCSC-NL ACN / CSIRT Italia JPCERT/CC NCSC New Zealand
What is not
Open questions, stated rather than papered over. Each one names what would close it.
- Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post. No copy of that post is in the vault.
- Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak.
- Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits.
- Which sites were really taken offline, and why. The BBC's list (parts of Wikipedia, Edinburgh council, French government services, the University of Geneva, the BBC itself) has not been captured from any of those organisations. Latvia's geo-blocking is the one documented case, from the agency itself.
- Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. Nothing from PHP on the list yet.
- What the 70% figure is measured from. None of the three pages that carry it names the measurement.
- The model and the method. Calif says no special harness and names no model; OpenAI's blog, which we could not capture, reportedly names GPT-5.6 Sol; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas. What did the models do and what did the people do?
- OpenAI's own blog post, the Patch the Planet launch post, the Spanish and Portuguese advisories and the Techzine piece on Chainguard are all blocked by bot challenges from this capture environment. The block is recorded; the content is not read.
The last 48 hours
| When (UTC) | What | Source |
|---|---|---|
| 2026-10-22 05:20 UTC | JVN publishes its note (14:20 JST); JPCERT/CC alert JPCERT-AT-2026-0033 is dated 22 October. | JPCERT/CC JPCERT/CC |
| 2026-10-22 06:16:24 UTC | BBC News opens its live page: 'Global scramble to fix critical cyber-security flaws as many websites taken offline'. | BBC News |
| 2026-10-22 06:45:47 UTC | Greenbone on oss-security: the backports imply versions down to 7.4 are affected, whatever the subject line says. | oss-security |
| 2026-10-22 06:55:50 UTC | The BBC reports the NSA's X post. | BBC News |
| 2026-10-22 07:00 UTC | Ryan Austin on BBC Radio 4: no evidence of exploitation yet. | BBC News |
| 2026-10-22 07:30:02 UTC | The UK NCSC page is modified (HTTP last-modified). | NCSC UK |
| 2026-10-22 08:03 UTC | The evidence vault behind this site is opened; the first capture of the BBC live page is at 08:04:53Z. | BBC News |
| 2026-10-22 08:40:58 UTC | NCSC-NL merges pull request 10; the inventory has 674 entries at commit cca173c64ec5. | NCSC-NL NCSC-NL |
The whole timeline → runs from the 2024 audit to the latest capture, with every time stated as its source states it and every conversion marked.
How this site works
Every source is captured into a private, encrypted vault, each file hashed at capture time; every claim carries one of five status words and the sources that earn it; the site is a deterministic build of the vault, and a gate refuses a broken link, an unsourced claim or a credential. The method, the team and the billing model are published.