# Briefing: CFO: version history

> About this site: how the site works, kept by the agents that run it.

Every version of the section "Briefing: CFO" on PHP October 2026, with the site release that created it and the changes between versions.

Version history · briefing

# Briefing: CFO: every version

This section is a projection of the site's data, rebuilt on every release. It is written for Quinn, cfo. A new version is recorded only when the text a reader sees changes, so a release that changed something elsewhere leaves this section's version alone. It has 7 versions; the newest is first, and each is shown as the changes from the one before. [Read the current version →](../../briefings/cfo/index.html)

v7 · site v0.5.9 · 22 October 2026 · 1 lines added or changed, 1 removed or changed, against v6 · ef8574bfc27b# Briefing for a CFO: What is the financial exposure, what does downtime cost against breach cost, and will insurance respond?90 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · Data protection officer · Head of AppSec · Developer · Communications team.v6 · site v0.5.8 · 22 October 2026 · 2 lines added or changed, 2 removed or changed, against v5 · 2dd1d01a9763# Briefing for a CFO: What is the financial exposure, what does downtime cost against breach cost, and will insurance respond?9 unchanged linesThe documented cost so far is precaution, not breach: hours to a day of downtime for organisations that pulled sites, and engineering time to update. NoAs of the evening of 22 October, no named organisation has confirmedsaid ait compromise.was compromised through this flaw. Ask your broker now, in writing, whether a precautionary shutdown with no breach is covered. Do not use 70% of the Internet in any forecast.40 unchanged lines| Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | **A6** Established●●●●●● | 1/1 | CERT.LV || No named organisation has confirmed a compromise through php2shellA negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE. | this site, from every captured source | confirmed | **A4** Corroborated●●●●○○ status overstated | 5/5 | CISA Huntress Imperva Threat Research Amazon Weird Gloop || The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | **A3** Echoed●●●○○○ status overstated | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders || Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | **A2** Reported●●○○○○ status overstated | 1/1 | Weird Gloop || Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 20:50 UTC on 22 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request (fact-check run 1 had marked it overstated; Perplexity and ChatGPT, asked by the editor, said the same). Attempts are not compromises: watchTowr says "nobody has been successful to date"; Amazon says it is unclear whether any attempt would have succeeded on real systems; Patchstack's incidents are reports from hosting partners with no victim named. Source watch (vault oq9gflln), pending promotion into the evidence vault: the PHP Foundation's executive director told The Verge and WIRED "to our knowledge, there has been no successful attempt at remote code execution" (raw/us/tech-press/the-verge/php2shell-websites-down/); officials in Germany, the Netherlands and Japan say they have not seen an attack succeed (The Next Web, raw/nl/tech-press/the-next-web/php2shell-no-confirmed-breaches/); GMO confirmed a break-in on 20 October on its FX trading VPS service (26,739 servers, logins possibly taken) without stating the cause (raw/jp/news/yahoo-news-jp/gmo-fx-login-leak/20261022T191523Z/); Czech Technical University says it stopped an active attack that was part of worldwide attempts against PHP sites, success not established (raw/cz/tech-press/lupa/cvut-cyber-attack/20261022T191510Z/); Valtec in Japan blamed php2shell for a break-in, then retracted: its own service's flaw (raw/jp/tech-press/impress-watch/valtec-php-attack/20261022T191433Z/); Fortune reports an anonymous startup owner alleging stolen source code, unnamed and not attributed to the flaw. Edited by researcher@php.newsroom. | this site, from every captured source in the evidence vault and the source watch, as of 20:50 UTC on 22 October | reported | **A4** Corroborated●●●●○○ status overstated | 6/9 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop || Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | **A2** Reported●●○○○○ | 0/2 | Yle Helsinki Times |33 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · Head of AppSec · Developer · Communications team.v5 · site v0.4.7 · 22 October 2026 · 31 lines added or changed, 31 removed or changed, against v4 · 4f8909fe4b4e# Briefing for a CFO: What is the financial exposure, what does downtime cost against breach cost, and will insurance respond?49 unchanged lines| Claim | Who says it | Status | Primary | Sources ||---|---|---|---|---|| Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | 1/1 | CERT.LV || No named organisation has confirmed a compromise through php2shellA negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE. | this site, from every captured source | confirmed | 5/5 | CISA Huntress Imperva Threat Research Amazon Weird Gloop || The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders || Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | 1/1 | Weird Gloop || Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | 0/1 | BBC News || Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | 0/2 | Yle Helsinki Times || The Wikimedia Foundation took down a number of systems 'as a precautionary measure until they can be safely patched'No Wikimedia-published statement captured. | the Foundation, as quoted by CNN and The Cyber Express | reported | 0/2 | CNN The Cyber Express || Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a link | The Scotsman quoting the council | reported | 0/1 | The Scotsman || Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident' | the council's social post, via Oxford Chronicle | reported | 0/1 | Oxford Chronicle || Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors | LBC; Insurance Business | reported | 0/2 | LBC Insurance Business || 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerableCounted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | 1/1 | NCSC-NL || PHP is used by almost 70% of websitesNone of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems. | Cloudflare; OpenAI ('an estimated 70%'); Wiz body text | reported | 3/3 | Cloudflare OpenAI on X Wiz || Something like 30 million websites could be affectedNo basis given. | Alan Woodward, via the BBC | reported | 0/1 | BBC News || PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 OctoberCensys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found. | VulnCheck and Censys, via The Hacker News and SecurityWeek | reported | 0/2 | THN SecurityWeek || About 6,000 potentially affected resources in Latvia, a few hundred in the public sectorPrimary source, one country, says 'potentially'. | CERT.LV | reported | 1/1 | CERT.LV || Roughly 70% of the Internet is affectedThe BBC was 'unable to independently verify that figure'. Wiz's body text says 70% of websites and cites no measurement. | Wiz (headline, X post); BBC attributing Wiz | unverified | 2/3 | Wiz Wiz on X BBC News || CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalogCatalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding. | CISA | confirmed | 3/3 | CISA CISA CVE record || Amazon and Cloudflare saw sites being probed for the flawBoth companies have since said so themselves. | Alan Woodward, via the BBC; confirmed by both companies' own posts | confirmed | 2/3 | BBC News Cloudflare Amazon || The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one dayCounted from the captured catalog. | CISA KEV catalog; Akamai (2024) | confirmed | 3/3 | CISA CVE record Akamai Security Research || There is no evidence yet that hackers have exploited the flaw | Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October | reported | 0/1 | BBC News || Reports of active exploitation existThe only agency saying so, and it does not say whose reports. | NCSC New Zealand | reported | 1/1 | NCSC New Zealand || An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; proof-of-concept attempts began about 02:00 UTC on 21 October from multiple actors; after release 'PHP2Shell is now being broadly exploited in the wild'Primary party. Amazon adds: 'it's unclear if any of these attempts would have succeeded in real-world systems'. Attempts against honeypots, not compromises of victims. | Amazon (CJ Moses, AWS Security Blog) | reported | 1/2 | Amazon THN || Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloadsPrimary party, no volumes. | Cloudflare | reported | 1/1 | Cloudflare || Automated exploitation attempts were seen in Latvia; none succeededPrimary source. | CERT.LV | reported | 1/1 | CERT.LV || Exploit attempts across Cloudflare's network: thousands in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, millions by 22 October 01:25 UTCPrimary party. Attempts, not compromises; no blocked count; 1.4 million views at capture. | Matthew Prince, Cloudflare CEO, on X | reported | 1/1 | Matthew Prince, Cloudflare CEO on… || No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoringA negative finding from a party that had the details under embargo. | Imperva Threat Research | reported | 1/1 | Imperva Threat Research || No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress | Huntress | reported | 1/1 | Huntress || Criminals are using AI to 'vibe code' an attack method | unnamed researchers, via the BBC | unverified | 0/1 | BBC News || watchTowr sees active exploitation attempts and lists the flaws as exploited in the wildwatchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. | watchTowr | unverified | 2/2 | watchTowr watchTowr || Claim | Who says it | Status | Fact-check | Primary | Sources ||---|---|---|---|---|---|| Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | **A6** Established●●●●●● | 1/1 | CERT.LV || No named organisation has confirmed a compromise through php2shellA negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE. | this site, from every captured source | confirmed | **A4** Corroborated●●●●○○ status overstated | 5/5 | CISA Huntress Imperva Threat Research Amazon Weird Gloop || The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | **A3** Echoed●●●○○○ status overstated | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders || Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | **A2** Reported●●○○○○ status overstated | 1/1 | Weird Gloop || Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | **A2** Reported●●○○○○ | 0/2 | Yle Helsinki Times || The Wikimedia Foundation took down a number of systems 'as a precautionary measure until they can be safely patched'No Wikimedia-published statement captured. | the Foundation, as quoted by CNN and The Cyber Express | reported | **A4** Corroborated●●●●○○ | 0/2 | CNN The Cyber Express || Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a link | The Scotsman quoting the council | reported | **A3** Echoed●●●○○○ | 0/1 | The Scotsman || Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident' | the council's social post, via Oxford Chronicle | reported | **A2** Reported●●○○○○ | 0/1 | Oxford Chronicle || Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors | LBC; Insurance Business | reported | **A3** Echoed●●●○○○ | 0/2 | LBC Insurance Business || 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerableCounted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | **A1** Weak signal●○○○○○ contradicted status overstated | 1/1 | NCSC-NL || PHP is used by almost 70% of websitesNone of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems. | Cloudflare; OpenAI ('an estimated 70%'); Wiz body text | reported | **A2** Reported●●○○○○ measures differently | 3/3 | Cloudflare OpenAI on X Wiz || Something like 30 million websites could be affectedNo basis given. | Alan Woodward, via the BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 OctoberCensys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found. | VulnCheck and Censys, via The Hacker News and SecurityWeek | reported | **A2** Reported●●○○○○ measures differently | 0/2 | THN SecurityWeek || About 6,000 potentially affected resources in Latvia, a few hundred in the public sectorPrimary source, one country, says 'potentially'. | CERT.LV | reported | **A2** Reported●●○○○○ | 1/1 | CERT.LV || Roughly 70% of the Internet is affectedThe BBC was 'unable to independently verify that figure'. Wiz's body text says 70% of websites and cites no measurement. | Wiz (headline, X post); BBC attributing Wiz | unverified | **A1** Weak signal●○○○○○ measures differently | 2/3 | Wiz Wiz on X BBC News || CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalogCatalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding. | CISA | confirmed | **A6** Established●●●●●● | 3/3 | CISA CISA CVE record || Amazon and Cloudflare saw sites being probed for the flawBoth companies have since said so themselves. | Alan Woodward, via the BBC; confirmed by both companies' own posts | confirmed | **A5** Confirmed●●●●●○ | 2/3 | BBC News Cloudflare Amazon || The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one dayCounted from the captured catalog. | CISA KEV catalog; Akamai (2024) | confirmed | **A2** Reported●●○○○○ status overstated | 3/3 | CISA CVE record Akamai Security Research || There is no evidence yet that hackers have exploited the flaw | Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October | reported | **A2** Reported●●○○○○ disputed | 0/1 | BBC News || Reports of active exploitation existThe only agency saying so, and it does not say whose reports. | NCSC New Zealand | reported | **A2** Reported●●○○○○ disputed | 1/1 | NCSC New Zealand || An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; proof-of-concept attempts began about 02:00 UTC on 21 October from multiple actors; after release 'PHP2Shell is now being broadly exploited in the wild'Primary party. Amazon adds: 'it's unclear if any of these attempts would have succeeded in real-world systems'. Attempts against honeypots, not compromises of victims. | Amazon (CJ Moses, AWS Security Blog) | reported | **A2** Reported●●○○○○ disputed | 1/2 | Amazon THN || Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloadsPrimary party, no volumes. | Cloudflare | reported | **A2** Reported●●○○○○ | 1/1 | Cloudflare || Automated exploitation attempts were seen in Latvia; none succeededPrimary source. | CERT.LV | reported | **A2** Reported●●○○○○ | 1/1 | CERT.LV || Exploit attempts across Cloudflare's network: thousands in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, millions by 22 October 01:25 UTCPrimary party. Attempts, not compromises; no blocked count; 1.4 million views at capture. | Matthew Prince, Cloudflare CEO, on X | reported | **A2** Reported●●○○○○ measures differently | 1/1 | Matthew Prince, Cloudflare CEO on… || No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoringA negative finding from a party that had the details under embargo. | Imperva Threat Research | reported | **A2** Reported●●○○○○ measures differently | 1/1 | Imperva Threat Research || No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress | Huntress | reported | **A2** Reported●●○○○○ disputed | 1/1 | Huntress || Criminals are using AI to 'vibe code' an attack method | unnamed researchers, via the BBC | unverified | **A1** Weak signal●○○○○○ opinion | 0/1 | BBC News || watchTowr sees active exploitation attempts and lists the flaws as exploited in the wildwatchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. | watchTowr | unverified | **A4** Corroborated●●●●○○ superseded | 2/2 | watchTowr watchTowr |9 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · Head of AppSec · Developer · Communications team.v4 · site v0.3.2 · 22 October 2026 · 2 lines added or changed, 2 removed or changed, against v3 · 7914b3ed6d53# Briefing for a cfo:CFO: What is the financial exposure, what does downtime cost against breach cost, and will insurance respond?The php2shell story for a cfo:CFO: a thirty-second answer, what to decide, a reading path, the claims it rests on with their status and sources, and what is still open.88 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · Head of AppSec · Developer · Communications team.v3 · site v0.3.1 · 22 October 2026 · reconstructed from git · 2 lines added or changed, 2 removed or changed, against v2 · 5842cb10300b# Briefing for a cfo: What is the financial exposure, what does downtime cost against breach cost, and will insurance respond?24 unchanged lines- Your briefing- Explained from scratchthe start- Impact: offline vs compromised48 unchanged lines| Automated exploitation attempts were seen in Latvia; none succeededPrimary source. | CERT.LV | reported | 1/1 | CERT.LV || Exploit attempts across Cloudflare's network: thousands in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, millions by 22 October 01:25 UTCPrimary party. Attempts, not compromises; no blocked count; 1.4 million views at capture. | Matthew Prince, Cloudflare CEO, on X | reported | 1/1 | Matthew Prince ,Prince, Cloudflare CEO onon… || No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoringA negative finding from a party that had the details under embargo. | Imperva Threat Research | reported | 1/1 | Imperva Threat Research |13 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · Head of AppSec · Developer · Communications team.v2 · site v0.3.0 · 22 October 2026 · reconstructed from git · 32 lines added or changed, 4 removed or changed, against v1 · 28d6f3cc7f23# Briefing for a cfo: What is the financial exposure, what does downtime cost against breach cost, and will insurance respond?The php2shell story for a cfo: a thirty-second answer, what to decide, a reading path, the claims it rests on with their status and sources, and what is still open.Briefing for Quinn, cfo · CFO******Plain English# What is the financial exposure, what does downtime cost against breach cost, and will insurance respond?QThe answer in thirty secondsThe documented cost so far is precaution, not breach: hours to a day of downtime for organisations that pulled sites, and engineering time to update. No named organisation has confirmed a compromise. Ask your broker now, in writing, whether a precautionary shutdown with no breach is covered. Do not use 70% of the Internet in any forecast.Read the site as Quinn →8 unchanged lines## Your reading path- Your briefing- Explained from scratch- Impact: offline vs compromised- The numbers- In context: 2008 to 2026Choose *read as Quinn* and the bar under the menu keeps your place on every page.### What this briefing covers- cost of acting against cost of not acting- whether a precautionary shutdown is covered- which figures are safe in a forecast### What you can skip- versions and settings- the code## The facts this rests on-Show the 29 claims behind this briefing, each with its status and sources- confirmed two or more primary sources agree, or the fact was counted from a captured file- reported one party says so, and it has not been contradicted36 unchanged linesEvery sentence above rests on these rows. They are folded away because they are written in the sources' own vocabulary; the glossary explains each term.## What is still open5 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other briefings:readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · Head of AppSec · Developer · Media and communicationsCommunications team.v1 · site v0.2.0 · 22 October 2026 · reconstructed from git · the first version · bc7a7ea29a26
# Briefing for a cfo: What is the financial exposure, what does downtime cost against breach cost, and will insurance respond? The php2shell story for a cfo: what to decide, the claims it rests on with their status and sources, and what is still open. Briefing · CFO # What is the financial exposure, what does downtime cost against breach cost, and will insurance respond? The financial question has two sides and the evidence is lopsided: downtime is documented and measurable; breach is claimed and unconfirmed. Insurers are already treating this as an aggregation event. ## What to decide or do - Cost of acting: operators that pulled sites report hours to a day offline; one operator served 94% of its page views from cache through a 13-hour shutdown. Engineering time to patch, restart and verify is the main cost for most. - Cost of not acting: an unauthenticated code-execution flaw in the web tier; what it reaches is whatever that tier can reach, which is a question for the CISO's inventory, not for a percentage. - Insurance: Insurance Business reports underwriters watching for an aggregation event and asks whether business-interruption cover responds to a precautionary shutdown with no breach; that depends on wording and waiting periods. Ask the broker now, in writing. - Figures you will hear and should not use in a forecast: 70% of the Internet (a share of websites restated), 30 million websites (no basis), 22.6 million systems (method not given). Use your own inventory count. - No named organisation has confirmed a compromise as of the latest capture. That is a statement about evidence, not about safety. ## The facts this rests on - confirmed two or more primary sources agree, or the fact was counted from a captured file - reported one party says so, and it has not been contradicted - disputed the sources disagree, and both readings are shown - contradicted a primary source says otherwise - unverified even the reporting outlet could not check it - p/n primary sources among the n cited; a blocked capture is counted and marked | Claim | Who says it | Status | Primary | Sources | |---|---|---|---|---| | Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | 1/1 | CERT.LV | | No named organisation has confirmed a compromise through php2shellA negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE. | this site, from every captured source | confirmed | 5/5 | CISA Huntress Imperva Threat Research Amazon Weird Gloop | | The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders | | Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | 1/1 | Weird Gloop | | Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | 0/1 | BBC News | | Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | 0/2 | Yle Helsinki Times | | The Wikimedia Foundation took down a number of systems 'as a precautionary measure until they can be safely patched'No Wikimedia-published statement captured. | the Foundation, as quoted by CNN and The Cyber Express | reported | 0/2 | CNN The Cyber Express | | Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a link | The Scotsman quoting the council | reported | 0/1 | The Scotsman | | Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident' | the council's social post, via Oxford Chronicle | reported | 0/1 | Oxford Chronicle | | Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors | LBC; Insurance Business | reported | 0/2 | LBC Insurance Business | | 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerableCounted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | 1/1 | NCSC-NL | | PHP is used by almost 70% of websitesNone of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems. | Cloudflare; OpenAI ('an estimated 70%'); Wiz body text | reported | 3/3 | Cloudflare OpenAI on X Wiz | | Something like 30 million websites could be affectedNo basis given. | Alan Woodward, via the BBC | reported | 0/1 | BBC News | | PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 OctoberCensys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found. | VulnCheck and Censys, via The Hacker News and SecurityWeek | reported | 0/2 | THN SecurityWeek | | About 6,000 potentially affected resources in Latvia, a few hundred in the public sectorPrimary source, one country, says 'potentially'. | CERT.LV | reported | 1/1 | CERT.LV | | Roughly 70% of the Internet is affectedThe BBC was 'unable to independently verify that figure'. Wiz's body text says 70% of websites and cites no measurement. | Wiz (headline, X post); BBC attributing Wiz | unverified | 2/3 | Wiz Wiz on X BBC News | | CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalogCatalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding. | CISA | confirmed | 3/3 | CISA CISA CVE record | | Amazon and Cloudflare saw sites being probed for the flawBoth companies have since said so themselves. | Alan Woodward, via the BBC; confirmed by both companies' own posts | confirmed | 2/3 | BBC News Cloudflare Amazon | | The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one dayCounted from the captured catalog. | CISA KEV catalog; Akamai (2024) | confirmed | 3/3 | CISA CVE record Akamai Security Research | | There is no evidence yet that hackers have exploited the flaw | Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October | reported | 0/1 | BBC News | | Reports of active exploitation existThe only agency saying so, and it does not say whose reports. | NCSC New Zealand | reported | 1/1 | NCSC New Zealand | | An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; proof-of-concept attempts began about 02:00 UTC on 21 October from multiple actors; after release 'PHP2Shell is now being broadly exploited in the wild'Primary party. Amazon adds: 'it's unclear if any of these attempts would have succeeded in real-world systems'. Attempts against honeypots, not compromises of victims. | Amazon (CJ Moses, AWS Security Blog) | reported | 1/2 | Amazon THN | | Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloadsPrimary party, no volumes. | Cloudflare | reported | 1/1 | Cloudflare | | Automated exploitation attempts were seen in Latvia; none succeededPrimary source. | CERT.LV | reported | 1/1 | CERT.LV | | Exploit attempts across Cloudflare's network: thousands in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, millions by 22 October 01:25 UTCPrimary party. Attempts, not compromises; no blocked count; 1.4 million views at capture. | Matthew Prince, Cloudflare CEO, on X | reported | 1/1 | Matthew Prince , Cloudflare CEO on | | No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoringA negative finding from a party that had the details under embargo. | Imperva Threat Research | reported | 1/1 | Imperva Threat Research | | No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no public exploit code known to Huntress | Huntress | reported | 1/1 | Huntress | | Criminals are using AI to 'vibe code' an attack method | unnamed researchers, via the BBC | unverified | 0/1 | BBC News | | watchTowr sees active exploitation attempts and lists the flaws as exploited in the wildwatchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. | watchTowr | unverified | 2/2 | watchTowr watchTowr | ## What is still open - Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post. No copy of that post is in the vault. - Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak. - Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits. - Which sites were really taken offline, and why. The BBC's list (parts of Wikipedia, Edinburgh council, French government services, the University of Geneva, the BBC itself) has not been captured from any of those organisations. Latvia's geo-blocking is the one documented case, from the agency itself. - Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. Nothing from PHP on the list yet. The full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other briefings: Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or advisor · CISO · CTO · Head of AppSec · Developer · Media and communications team. [Every section, across every release →](../index.html)


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/versions/briefing-cfo/index.html