Story written here by this site, signed and dated. By the journalist Research or story?

View · the state of affairs · what changed

What changed between v1 and v2

From 23 October 2026, 14:11 UTC to 23 October 2026, 23:55 UTC: 2 of 15 measures changed, and the text gained 26 lines and lost 20.

v1 site v0.10.1 · evidence vault f3c5db0d9873 · source watch c26dce84136f · NCSC-NL inventory 2fdc314ded28 · data as of 23 October 2026, 01:20 UTC
v2 site v0.10.18 · evidence vault 1845598d9a38 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 23 October 2026, 16:04 UTC

← v1 in full · v2 in full → · every version

The measures, side by side

Measurev1v2
Organisations confirming a compromise through php2shell00unchanged
Named incidents whose link to php2shell is still open3 open, 1 ruled out3 open, 1 ruled outunchanged
Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog00unchanged
NIST's own score in the National Vulnerability DatabaseCVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2unchanged
EPSS: chance of exploitation activity in the next 30 days0.058 and 0.053, about the 93rd percentile for both0.058 and 0.053, about the 93rd percentile for bothunchanged
Public GitHub repositories matching 'php2shell'735 (586 at 17:51 UTC on 22 October)735 (586 at 17:51 UTC on 22 October)unchanged
Merged Metasploit modules naming php2shell00unchanged
NCSC-NL inventory: products fixed, of all listed109 of 751109 of 751unchanged
NCSC-NL inventory: products still under investigation389389unchanged
Security and network vendors' products confirmed vulnerable10 vulnerable, 26 not, 16 under investigation10 vulnerable, 26 not, 16 under investigationunchanged
PHP servers that disclose their version running an end-of-life branchabout 758,000 of 1.1 millionabout 758,000 of 1.1 millionunchanged
A national count of servers still affected after the fixnot trackedSwitzerland: just over 23,000 of nearly 690,000 servers (about 3.5%)changed
Sites that went dark over php2shell, and how many are still dark51 listed, 50 back, 1 still dark (French prefecture websites)51 listed, 50 back, 1 still dark (French prefecture websites)unchanged
National authorities saying they know of no successful exploitation in their country5 (adding Germany's BSI, Switzerland's BACS and Japan's government)5 (adding Germany's BSI, Switzerland's BACS and Japan's government)unchanged
Sources in the evidence vault, and the latest capture227, latest capture 23 Oct 01:20 UTC295, latest capture 23 Oct 16:04 UTCchanged

The text, line by line

Removed lines are struck through, added lines are marked; within an edited line, the words that changed.

## The line
php2shellTwo isand a severe flaw that, twohalf days after itsthe release, php2shell still has no confirmed victim.victim, Theand the story hasis movednow fromabout what comes after the bug to the second stories: who is still exposed, who ships the fix, and what the devices in front of servers are made of.patch. The evidence forvault everyholds line295 belowsources, is68 more than this desk's last version, most of them coverage from 21 and 22 October in thea evidencedozen vault,languages, nowselected refreshed to 227 sources,mechanically and inread by the sourcecurator. watch'sThey datedadd series.detail and new countries; they do not add a victim.
## Compromise: still none confirmed, threeand casesthe openquestion changes
No named organisation has confirmed a compromise through php2shell.php2shell, Asat the researcher'svault's evidencelatest pagecapture, puts16:04 it,UTC on 23 October. The three named cases that iswere "aopen time-boundedin absence,version not1 a(ČVUT, confirmedGMO fact":and trueDMM) asare still open, and no new source changes any of thethem. last[[lupa-cvut-cyber-attack, check,yahoo-jp-gmo-fx-login-leak, and one statement would end it; the rows behind it are on [the compromise evidence page](/compromise/index.html). The PHP Foundation knows of no successful remote code execution; Dataminr sees scanning, fingerprinting and non-working exploits. [[wired-exploited-days-before-patched, bleepingcomputer-amazon-4-days-before]] Four named incidents have been linked to php2shell in the press, and none holds yet.sankei-dmm-service-halt]]
- **Valtec** in Japan blamed the PHP flaw for a service halt, then corrected itself the same day: the flaw was in its own service. Ruled out. [[impress-watch-valtec]]
- **ČVUT**, the Czech Technical University, says it stopped an attack that it calls part of the worldwide attempts against PHP sites. That is an attack, in the organisation's words, not a confirmed compromise. Open. [[lupa-cvut-cyber-attack]]
- **GMO**'s FX trading VPS service found unauthorised programs on some servers on 20 October, the day of the leak and before the release; up to 26,739 servers may be affected. GMO names no cause. Open, and timing is not attribution. [[yahoo-jp-gmo-fx-login-leak]]
- **DMM** halted services for a vulnerability "in external software" and will not confirm PHP. Open. [[sankei-dmm-service-halt]]
In Luxembourg, Paperjam reports that no financial institution, public service or operator has announced an intrusion, and that the authorities ask operators to search back for traces of compromise and to keep the evidence. [[paperjam-article-php2shell-des-milliers-de-sites]] Singapore's Cyber Security Agency tells organisations to patch internet-facing systems first and to investigate whether they may already have been compromised. [[channelnewsasia-singapore-php-vulnerabilities-csa-singapore-firms-cybersecur]] IT Social's headline on 23 October is the turn in one line: the update closes the flaw, but obliges a hunt for possible compromises; its body adds that the published figures measure attempts, not successful intrusions. [[itsocial-cybersecurite-cybersecurite-articles-php]]
One more claimThat is unverified:the right next question, and it is a startupslower ownerone. toldA Fortunepatch is visible from outside; a break-in is found only by the operator who looks for it. The absence of a named victim is therefore weaker evidence each day that sourceoperators codehave wasnot stolenyet through the bug. [[fortune-ai-tools-php-vulnerability]] Patchstack says hosting partners reported "multiple active exploitation incidents" before the release, without naming any. [[recordedfuture-php2shell]] Headlines in WIRED and The Verge say "exploited"; their bodies describe attempts. [[wired-exploited-days-before-patched, the-verge-php2shell-websites-down]]looked.
## ExploitationExploitation: andattempts in millions, weaponisation unchanged
AttemptsCloudflare's arecount, broad.as Amazonits callschief itexecutive "broadlyput exploitedit, went from thousands of attempts in the wild"ten andhours addsbefore thatthe it is unclear whether any attempt would have worked; Hadrian says exploitation is at scale, mostly through PHP's session upload-progress mechanism; VulnCheck saw at least one Chinese IP address try, and fail,announcement to deploymillions aby webshell.early [[securityweek-exploitation-days-before,on the-register-hackers-pile-on-php2shell]]22 NationalOctober; authoritiesattempts, innot Germany,intrusions. Switzerland[[x-eastdakota-php2shell-stats, andginjfo-actualites-politique-et-economie-failles]] Japan say,AhnLab, as reported, thatexamined they100 knowGitHub repositories related to php2shell on 22 October and classed 27 as proof-of-concept exploits. [[rocket-boys-security-measures-lab-php2shell-poc-expl]] This desk has not opened any of no successful exploitation, joining the USthem, and Australia.will [[rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi, watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein, tchina-kyodonews-articles-15266, cisa-alert-php-20261021, acsc-alert-php]]not.
TheOne markerssource contradicts another about Patchstack. Recorded Future reports that Patchstack received reports of weaponisation"multiple haveactive notexploitation moved:incidents" from hosting partners by 07:34 UTC on 21 October; PCMag quotes Patchstack saying that, shortly after the update, its telemetry showed "only probing attacks, with no hard evidence of breaches yet". [[recordedfuture-php2shell, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]] Both can be true at different times and of different things, reports received and telemetry seen, but neither CVE is in CISA's Known Exploited Vulnerabilities catalog at the last check, 08:03 UTC today, and no Metasploit module has been merged. [[cisa-kev-json]] EPSS puts the chance of exploitation activity in the next 30 days at about 5%, near the 93rd percentile. NIST has now analysed both records and added its own CVSS 3.1 score of 9.8 beside the PHP project's CVSS 4.0 9.2, sonames a reader will meet both numbers. [[nvd-cve-2026-109618, nvd-cve-2026-109619]] Public GitHub repositories matching "php2shell" went from 586 to 735 overnight; that is search results, not working exploits.victim.
##The Patching:markers of weaponisation have not moved: neither CVE was in the fixKnown Exploited Vulnerabilities catalog at the old source watch's last check, 08:03 UTC on 23 October, and no Metasploit module had been merged. [[cisa-kev-json]] This desk does not yet read the source watch's new vault, so that check is reachingnow servers,sixteen andhours old; the tailnext isversion end-of-lifewill say what it shows.
The## NCSC-NLPatching: inventory,the readfirst fromnational its public history, had 109count of 751 products fixed at 12:50 UTC today, against 46 of 674 when the vault captured it yesterday morning; the pile under investigation fell from 418 to 389, and 30 products are now marked not affected. [[ncsc-nl-php2shell-software-list-letters]] The newly fixed include Azure App Service, AWS Elastic Beanstalk, SUSE, NixOS and Synology's PHP packages back to 7.4. The hour-by-hour curvewhat is on [the inventory page](/patching/inventory/index.html).left
TheRisikomonitor tailexamined nearly 690,000 servers linked to Switzerland on 22 October and found just over 23,000, about 3.5%, still affected; it says the real number may be higher because the PHP version cannot always be read. [[ictjournal-news-2026-10-22-deux-failles-critiques-d]] It is the numberfirst count in the patchingvault storyof lackedwhat yesterday.remains after the fix in one country, and it sits beside VirusTotal's analysis,global picture, as reported, findsof about 5.1758,000 millionend-of-life IPsservers running PHP; ofamong the 1.1 million that disclose a version,version. about[[tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco]] 758,000The runtwo ando end-of-lifenot branch and about 272,000 a supported one. [[tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco, recordedfuture-php2shell]] Most ofmeasure the exposedsame populationthing: isone oncounts servers still affected in one country, the other counts versions the PHP project did not release a fix for.anywhere.
## The protectionNCSC-NL layerinventory ishas innot scopechanged since 12:50 UTC on 23 October: 109 of 751 products fixed, 389 under investigation. [[ncsc-nl-php2shell-software-list-letters]]
Ten## productsThe fromresponse security and network vendors are now marked vulnerable in the inventory: Palo Alto's PAN-OS and Panorama, Check Point's firewall web interfaces, NetScaler ADC and Gateway, two parts of F5's BIG-IP, Cisco's Expressway series and URWB, and Sophos's MyUTM portal. Palo Alto confirms PAN-OS 10.2 to 12.2 are affected through the management interface, with fixes pending and no exploitation known to it. [[paloalto-psirt-cve-2026-109618]] Cisco's advisory as captured on 22 October knew of no affected product; the inventory now marks three, which is a change over time, not a contradiction. [[cisco-sa-php-october26]]spreads
##More Offline:national almostauthorities everyoneare isin backthe record. Peru's Centro Nacional de Seguridad Digital called php2shell a critical threat in its report of 21 October. [[andina-agencia-noticia-peru-y-otros-paises-advi]] Morocco's DGSSI issued a critical bulletin the same day. [[moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu]] Korea's science ministry raised the private-sector cyber crisis alert from "interest" to "caution", as reported by Shin-A Ilbo. [[shinailbo-news-articleview-html]] In the Netherlands, MPs have put questions to the justice and security minister about taking government sites offline. [[security-nl-kamervragen]] Wiz warns that the flaws can also let an attacker read process memory holding passwords, tokens, API keys and certificates: a patched server that was reachable before may still have leaked secrets that need changing. [[wiz-blog-php2shell]]
A community tracker lists 51 sites that went dark over php2shell; 50 are back, and French prefecture websites are the one still dark. [[phpocalypse-tracker-sites-csv]] The Dutch government's DigiD, MijnOverheid and Overheid.nl are back online. [[securitynl-misbruik-gemeld]]
## What this version does not say, and why
The curator flagged six claims for checking against the ledger. This desk checked each against the saved page and the site's claims and contradiction records, and holds them back as worded:
- **That Japan's Prime Minister issued an emergency order.** One Vietnamese outlet says so. [[nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan]] Reuters, CNN and USA Today, in the vault, describe Sanae Takaichi urging website operators, on X, to check whether their sites use PHP and to prepare to patch, and, in CNN's account, saying companies should consider suspending services if necessary: a request, not an order. [[rte-reuters-websites-go-dark, cnn-php2shell-websites-shut, usa-today-php2shell-live]]
- **That 22.6 million servers were put at risk.** TechTarget Japan gives the figure without its basis. [[techtarget-itmedia-tt-article-2610-23-2000002526]]
- **That exploitation is "confirmed" on WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento.** Help Net Security does not say who confirmed it. [[helpnetsecurity-2026-10-22-php2shell-scanner-tool]] What the vault holds is researchers demonstrating code execution against these applications, which is not attackers succeeding against someone. [[calif-php2shell]]
- **That the bug was first spotted in the wild in 2024.** Mashable India gives no source. [[in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet]] The earliest attempt in the record is Amazon's, on 17 October 2026. [[cyberpress-php2shell-exploits-predate-patches]] A 2024 audit by Quarkslab did find the out-of-memory issue without proving it exploitable, which may be where a 2024 date comes from. [[php-foundation-blog-security-release]]
- **That the flaws were identified on 20 October.** The Indian Express says so. [[indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb]] Calif's discovery on 1 August and its report to PHP on 11 August are confirmed; 20 October is the day of the advance notice and the leak. [[calif-php2shell, php-foundation-blog-security-release]] SiliconANGLE's "August audit financed by OpenAI" is its own description of that August work, which the site records as found under OpenAI's initiative. [[siliconangle-2026-10-22-php2shell-attacks-began-four]]
- **How old the flaw is.** "14 years" (Clarin) and "since 2012" (Critic Arad) match Wiz's lower bound, PHP 5.4 and later, and are one estimate restated, not independent findings. [[clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv, criticarad-php2shell-cve-2026-109618-ghid-patch, wiz-blog-php2shell]] "Every version since PHP 5, from 2004" is watchTowr's account of the leaked report, as Ars Technica gives it. [[arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th]] The CVE records list only the supported branches. Which versions are affected is already an explained contradiction on [the fact-check desk](/factcheck/index.html); nobody in the vault names the commit that introduced the flaw.
## What would change this state
- A named organisation confirming a compromise, orwhich GMOis namingnow itslikelier cause.to come from an operator's own search than from a headline.
- A KEV listing, or a merged Metasploit module.
- More national counts like Switzerland's, so the size of what is left can be compared country by country.
- The 389 inventory rows under investigation resolving, and fixes for the security appliances.
- A count of how many of the 758,000 end-of-life servers are reachable through the vulnerable path.