Story written here by this site, signed and dated. By the journalist Research or story?

View · the state of affairs · what changed

What changed between v2 and v3

From 23 October 2026, 23:55 UTC to 24 October 2026, 12:30 UTC: 3 of 16 measures changed, and the text gained 16 lines and lost 29.

v2 site v0.10.18 · evidence vault 1845598d9a38 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 23 October 2026, 16:04 UTC
v3 site v0.14.25 · evidence vault 1f38e70921b2 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 24 October 2026, 08:37 UTC

← v2 in full · v3 in full → · every version

The measures, side by side

Measurev2v3
Organisations confirming a compromise through php2shell00unchanged
Named incidents whose link to php2shell is still open3 open, 1 ruled out3 open, 1 ruled outunchanged
Security vendors' claims of a successful compromise, and what became of themnot tracked1 made and withdrawn (Sophos); Patchstack's reports not reconciledchanged
Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog00unchanged
NIST's own score in the National Vulnerability DatabaseCVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2unchanged
EPSS: chance of exploitation activity in the next 30 days0.058 and 0.053, about the 93rd percentile for both0.058 and 0.053, about the 93rd percentile for bothunchanged
Public GitHub repositories matching 'php2shell'735 (586 at 17:51 UTC on 22 October)735 (586 at 17:51 UTC on 22 October)unchanged
Merged Metasploit modules naming php2shell00unchanged
NCSC-NL inventory: products fixed, of all listed109 of 751109 of 751unchanged
NCSC-NL inventory: products still under investigation389389unchanged
Security and network vendors' products confirmed vulnerable10 vulnerable, 26 not, 16 under investigation10 vulnerable, 26 not, 16 under investigationunchanged
PHP servers that disclose their version running an end-of-life branchabout 758,000 of 1.1 millionabout 758,000 of 1.1 millionunchanged
A national count of servers still affected after the fixSwitzerland: just over 23,000 of nearly 690,000 servers (about 3.5%)Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%)unchanged
Sites that went dark over php2shell, and how many are still dark51 listed, 50 back, 1 still dark (French prefecture websites)51 listed, 50 back, 1 still dark (French prefecture websites)unchanged
National authorities saying they know of no successful exploitation in their country5 (adding Germany's BSI, Switzerland's BACS and Japan's government)6 (adding the Netherlands)changed
Sources in the evidence vault, and the latest capture295, latest capture 23 Oct 16:04 UTC328, latest capture 24 Oct 08:37 UTCchanged

The text, line by line

Removed lines are struck through, added lines are marked; within an edited line, the words that changed.

## The line
Twophp2shell andis a halfthree days afterold the release, php2shelland still has no confirmed victim,victim. What moved since version 2 is the other side of the ledger: a claim of success that did not survive, and themore storysectors issaying, nowin aboutpublic, whatthat comesnothing afterhas thehappened patch.to them yet. The evidence vault holds 295328 sources, 6833 more than thisversion desk's last version, most of them coverage2, from 21 and 22 October in a dozen languages, selected mechanically and read by the curator.curator's Theytwo addwakes detailthis and new countries; they do not add a victim.morning.
## Compromise: none confirmed, and theone questionclaim changeswithdrawn
No named organisation has confirmedsaid ait compromisewas compromised through php2shell, at the vault's latest capture, 16:0408:37 UTC on 2324 October. The three named cases that were open in version 1 (ČVUT, GMO and DMM) are still open, andopen; no new source changes any of them. [[lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt]]
InThe Luxembourg,first Paperjamclaim reportsof thata nosuccessful financialcompromise institution,by publica servicesecurity or operatorvendor has announcedbeen anwithdrawn. intrusion,Sophos, in a correction issued at 21:21 UTC on 22 October and thatreported the authorities ask operators to search back for traces of compromise and to keep the evidence. [[paperjam-article-php2shell-des-milliers-de-sites]] Singapore'sby Cyber Security AgencyNews, tellssaid organisationsits customer data showed scanning and a small number of failed exploit attempts and no evidence of a successful compromise. One attempt tried to patchdeliver internet-facingPotassium, systemsa firstlikely Mirai botnet variant; it was blocked. [[cybersecuritynews-critical-php2shell-exploit-code]] Patchstack's two accounts, reports of incidents from hosting partners and totelemetry investigateshowing whetheronly theyprobing, mayare already have been compromised. [[channelnewsasia-singapore-php-vulnerabilities-csa-singapore-firms-cybersecur]] IT Social's headline on 23 October is the turn in one line: the update closes the flaw, but obliges a hunt for possible compromises; its body adds that the published figures measure attempts,still not successfulreconciled. intrusions.[[recordedfuture-php2shell, [[itsocial-cybersecurite-cybersecurite-articles-php]]pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]]
ThatSectors are now saying so in public. American Banker: "no U.S. bank or credit union has publicly reported a compromise". [[americanbanker-news-banks-dodge-early-damage-from-php2s]] BTC-ECHO: no evidence that large crypto exchanges or payment providers were compromised. [[btc-echo-news-krypto-boersen-akut-bedroht-kritisc]] Officials in Germany, the Netherlands and Japan say they have not seen an attempt succeed. [[the-next-web-php2shell-no-confirmed-breaches]] Each is the right next question, and it is a slower one. A patch is visible from outside; a break-in is found only by the operator who looks for it. Thean absence of reports at a namedpoint victimin istime, thereforenot weakera evidence each dayfinding that nothing happened, and the advice of version 2 stands: the answer will come from operators havesearching nottheir yetown looked.systems. [[paperjam-article-php2shell-des-milliers-de-sites]]
## Exploitation: attemptspublic incode, millions,no weaponisation unchangedmarkers
Cloudflare'sPublic count,proof-of-concept ascode is available, and attackers have tried to use it to build botnets; Sophos says its chiefown executiveresearchers putfound it,working wentexploitation fromdifficult, thousandseven ofwith attemptsAI support. [[cybersecuritynews-critical-php2shell-exploit-code]] Neither CVE was in theCISA's tenKnown hoursExploited beforeVulnerabilities catalog, and no Metasploit module had been merged, at the announcementPulse tovault's millionscheck byat early05:53 onUTC 22today, October;the attempts,freshest notcheck intrusions.in [[x-eastdakota-php2shell-stats,any ginjfo-actualites-politique-et-economie-failles]]vault AhnLab, as reported, examined 100 GitHub repositories related to php2shell on 22 October and classed 27 as proof-of-concept exploits. [[rocket-boys-security-measures-lab-php2shell-poc-expl]] Thisthis desk hasreads. not[[cisa-kev-json]] openedThe anylast ofPHP them,core andflaw willwas not.listed within three days; today is the third day after this one. [[akamai-blog-cve-2024-4577-one-day]]
One## source contradicts another about Patchstack. Recorded Future reports that Patchstack received reports of "multiple active exploitation incidents" from hosting partners by 07:34 UTC on 21 October; PCMag quotes Patchstack saying that, shortly after the update, its telemetry showed "only probing attacks, with no hard evidence of breaches yet". [[recordedfuture-php2shell, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]] Both can be true at different timesExposure and of different things, reports received and telemetry seen, but neither names a victim.patching
The markers22.6 million figure that circulated without a basis is Palo Alto Networks' count of weaponisationexposed haveinstances potentially vulnerable, made on 21 October, now attributed in two captured reports; it counts exposure, not moved:compromise. neither[[techtarget-cybersecurity-news-366652444-php2shell-2, CVEinsurancebusiness-uk-councils-met]] wasThe inNCSC-NL theinventory Knownhas Exploitednot Vulnerabilitieschanged catalogsince at the old source watch's last check, 08:0312:50 UTC onyesterday: 23109 October,of and751 noproducts Metasploitfixed, module389 hadunder beeninvestigation. merged. [[cisa-kev-json]] This desk does not yet read the source watch's new vault, so that check is now sixteen hours old; the next version will say what it shows.[[ncsc-nl-php2shell-software-list-letters]]
## Patching: the first national count of what is leftOffline
RisikomonitorMore examinedorganisations nearlythat 690,000took serverssites linkeddown to Switzerland on 22 October and found just over 23,000, about 3.5%, still affected; it says the real number may be higher because the PHP version cannot always be read. [[ictjournal-news-2026-10-22-deux-failles-critiques-d]] It is the first countare in the vaultrecord: in Switzerland, the EPFL, Basel-Stadt's administration, the University of whatGeneva remains afterand the fixinsurer inLa oneMobilière. country,[[24heures-php2shell-qui-est-affecte-par-la-faille]] and it sits beside VirusTotal's global picture, as reported,All of aboutthem 758,000describe end-of-life servers among the 1.1 million that disclose a version. [[tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco]] The two do not measure the same thing: one counts servers still affected in one country, the other counts versions anywhere.precautions.
The## NCSC-NLWhat inventorythis has notversion changed since 12:50 UTC on 23the October: 109 of 751 products fixed, 389 under investigation. [[ncsc-nl-php2shell-software-list-letters]]site
## The response spreads
More national authorities are in the record. Peru's Centro Nacional de Seguridad Digital called php2shell a critical threat in its report of 21 October. [[andina-agencia-noticia-peru-y-otros-paises-advi]] Morocco's DGSSI issued a critical bulletin the same day. [[moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu]] Korea's science ministry raised the private-sector cyber crisis alert from "interest" to "caution", as reported by Shin-A Ilbo. [[shinailbo-news-articleview-html]] In the Netherlands, MPs have put questions to the justice and security minister about taking government sites offline. [[security-nl-kamervragen]] Wiz warns that the flaws can also let an attacker read process memory holding passwords, tokens, API keys and certificates: a patched server that was reachable before may still have leaked secrets that need changing. [[wiz-blog-php2shell]]
## What this version does not say, and why
The curator flagged six claims for checking against the ledger. This desk checked each against the saved page and the site's claims and contradiction records, and holds them back as worded:
- **That Japan's Prime Minister issued an emergency order.** One Vietnamese outlet says so. [[nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan]] Reuters, CNN and USA Today, in the vault, describe Sanae Takaichi urging website operators, on X, to check whether their sites use PHP and to prepare to patch, and, in CNN's account, saying companies should consider suspending services if necessary: a request, not an order. [[rte-reuters-websites-go-dark, cnn-php2shell-websites-shut, usa-today-php2shell-live]]
- **That 22.6 million servers were put at risk.** TechTarget Japan gives the figure without its basis. [[techtarget-itmedia-tt-article-2610-23-2000002526]]
- **That exploitation is "confirmed" on WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento.** Help Net Security does not say who confirmed it. [[helpnetsecurity-2026-10-22-php2shell-scanner-tool]] What the vault holds is researchers demonstrating code execution against these applications, which is not attackers succeeding against someone. [[calif-php2shell]]
- **That the bug was first spotted in the wild in 2024.** Mashable India gives no source. [[in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet]] The earliest attempt in the record is Amazon's, on 17 October 2026. [[cyberpress-php2shell-exploits-predate-patches]] A 2024 audit by Quarkslab did find the out-of-memory issue without proving it exploitable, which may be where a 2024 date comes from. [[php-foundation-blog-security-release]]
- **That the flaws were identified on 20 October.** The Indian Express says so. [[indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb]] Calif's discovery on 1 August and its report to PHP on 11 August are confirmed; 20 October is the day of the advance notice and the leak. [[calif-php2shell, php-foundation-blog-security-release]] SiliconANGLE's "August audit financed by OpenAI" is its own description of that August work, which the site records as found under OpenAI's initiative. [[siliconangle-2026-10-22-php2shell-attacks-began-four]]
- **How old the flaw is.** "14 years" (Clarin) and "since 2012" (Critic Arad) match Wiz's lower bound, PHP 5.4 and later, and are one estimate restated, not independent findings. [[clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv, criticarad-php2shell-cve-2026-109618-ghid-patch, wiz-blog-php2shell]] "Every version since PHP 5, from 2004" is watchTowr's account of the leaked report, as Ars Technica gives it. [[arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th]] The CVE records list only the supported branches. Which versions are affected is already an explained contradiction on [the fact-check desk](/factcheck/index.html); nobody in the vault names the commit that introduced the flaw.
The no-compromise claim and its evidence page are as of 08:37 UTC on 24 October; the 22 new claims from the vault are reviewed, 14 noted or agreeing, 6 used and 2 held back (a Check Point figure whose "impacted" is undefined, and a Chinese summary's account of which model Calif used); and the verdict on the 22.6 million figure is revised in the open on [the claims waiting for review](/claims/review/index.html).
## What would change this state
- A named organisation confirming a compromise, whichmost is now likelier to comelikely from an operator'sits own search than from a headline.search.
- A KEV listing, or a merged Metasploit module.
- MorePatchstack nationalreconciling countsits liketwo Switzerland's, so the size of what is left can be compared country by country.accounts.
- The 389NCSC-NL inventory rowsmoving under investigation resolving, and fixes for the security appliances.again.