Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Wikipedia, as a graph / PHP2Shell / Evolution

The evolution of Wikipedia's PHP2Shell article

200 statements have been written into the article since 2026-10-21 07:50:01 UTC; 40 are in it now and 160 were removed or reworded on the way. Every edit is a point in time, every statement a bar from the edit that added it to the edit that took it out, so the picture shows what the article was at any moment, what has survived, and what the editors did not keep. The data is every revision, read by the same parser as the rest of this section.

22 Oct23 Oct24 Oct25 Octrecord, removed 2026-10-21 08:43:17 UTC, added 2026-10-21 07:50:01 UTC: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in common web scripting language PHP.record, removed 2026-10-21 10:03:31 UTC, added 2026-10-21 07:50:01 UTC: The vulnerability was rated 9.2 out of 10 under CVSS v4.0.record, removed 2026-10-21 11:20:44 UTC, added 2026-10-21 08:33:38 UTC: Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for relestated, removed 2026-10-21 14:52:47 UTC, added 2026-10-21 08:33:38 UTC: It is notable for the fact that the PHP maintainers announced the update early and before release, encouraging users to prepare and update aquote, still in the article, added 2026-10-21 08:33:38 UTC: One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".stated, removed 2026-10-21 11:01:34 UTC, added 2026-10-21 08:43:17 UTC: It allows arbitrary code execution on any website that runs PHP versions 5 through 8.record, removed 2026-10-21 08:58:43 UTC, added 2026-10-21 08:43:17 UTC: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in thecommon web scripting language PHP.record, removed 2026-10-21 13:46:43 UTC, added 2026-10-21 08:58:43 UTC: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common web scripting language PHP.stated, removed 2026-10-21 10:11:35 UTC, added 2026-10-21 09:35:37 UTC: PHP2Shell (' and ') is a vulnerability reported in October 2026 in the common web scripting language PHP.record, removed 2026-10-21 10:55:11 UTC, added 2026-10-21 10:03:31 UTC: The vulnerability was rated 9.2 out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.record, still in the article, added 2026-10-21 10:55:11 UTC: The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0.attributed, removed 2026-10-21 11:20:44 UTC, added 2026-10-21 11:01:34 UTC: Unconfirmed reports claim that it allows arbitrary code execution on any website that runs PHP versions 5 through 8.stated, removed 2026-10-21 13:46:43 UTC, added 2026-10-21 11:20:28 UTC: PoCs, write-ups, and partial mitigations started circulating on the Internet.hedged, removed 2026-10-21 11:21:23 UTC, added 2026-10-21 11:20:44 UTC: While information about the vulnerability has been embargoed until 22nd November at 15:00 UTC, unconfirmed leaks claim that it allows arbitrrecord, removed 2026-10-21 12:24:19 UTC, added 2026-10-21 11:20:44 UTC: Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for relehedged, removed 2026-10-21 11:22:32 UTC, added 2026-10-21 11:21:23 UTC: While information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbitrahedged, removed 2026-10-21 12:24:19 UTC, added 2026-10-21 11:22:32 UTC: While the information about the vulnerability has been embargoed until 22nd October at 15:00 UTC, unconfirmed leaks claim that it allows arbattributed, removed 2026-10-21 13:00:41 UTC, added 2026-10-21 11:24:41 UTC: Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary WAF rules as an attempted stopgap hedged, removed 2026-10-21 12:28:54 UTC, added 2026-10-21 12:24:19 UTC: While the information about the vulnerability has been embargoed until 21nd October at 14:00 UTC, unconfirmed leaks claim that it allows arbrecord, removed 2026-10-21 12:28:54 UTC, added 2026-10-21 12:24:19 UTC: Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for relehedged, removed 2026-10-21 13:46:43 UTC, added 2026-10-21 12:28:54 UTC: While the information about the vulnerability has been embargoed until 21 October at 14:00 UTC, unconfirmed leaks claim that it allows arbitrecord, removed 2026-10-21 13:46:43 UTC, added 2026-10-21 12:28:54 UTC: Early reporting suggested versions as early as PHP 5, all the way through to PHP 8, are affected, with an emergency patch scheduled for relerecord, removed 2026-10-21 13:45:10 UTC, added 2026-10-21 12:58:16 UTC: The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers.attributed, removed 2026-10-21 16:09:35 UTC, added 2026-10-21 13:00:41 UTC: Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rulrecord, removed 2026-10-21 13:26:17 UTC, added 2026-10-21 13:25:57 UTC: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability reported in October 2026 in the common webh 8.attributed, removed 2026-10-21 13:26:40 UTC, added 2026-10-21 13:26:24 UTC: Cloudflare has reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rulrecord, removed 2026-10-21 13:46:43 UTC, added 2026-10-21 13:45:10 UTC: The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, but Wiz Research who discovered it said the severitystated, removed 2026-10-21 13:53:57 UTC, added 2026-10-21 13:46:43 UTC: Early reporting suggest versions as early as PHP 5, all the way through to PHP 8, are affected.record, removed 2026-10-21 13:59:18 UTC, added 2026-10-21 13:46:43 UTC: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a arbitrary code execution vulnerability reported in October 2026 in the common web scriprecord, removed 2026-10-21 13:53:57 UTC, added 2026-10-21 13:46:43 UTC: The existence of the vulnerability was announced on 20 October and an emergency patch was released on 21 October at 14:00 UTC together with stated, removed 2026-10-21 17:22:37 UTC, added 2026-10-21 13:46:43 UTC: PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo.stated, removed 2026-10-21 13:56:51 UTC, added 2026-10-21 13:48:24 UTC: Wiz Research who discovered it said the severity reached 10.record, removed 2026-10-21 13:53:29 UTC, added 2026-10-21 13:53:02 UTC: Both vulnerabilities were published through GitHub security advisories on 21 October at 15:34, 26 minutes before the announced release time,record, removed 2026-10-22 09:19:12 UTC, added 2026-10-21 13:53:29 UTC: Both vulnerabilities were published through GitHub security advisories on 21 October at 13:34 UTC, 26 minutes before the announced release tstated, removed 2026-10-21 14:52:22 UTC, added 2026-10-21 13:53:57 UTC: The existence of the vulnerability was publicly announced on 20 October.stated, removed 2026-10-21 14:51:19 UTC, added 2026-10-21 13:53:57 UTC: An emergency patch and details about the vulnerability was released on the following day.record, removed 2026-10-21 14:42:05 UTC, added 2026-10-21 13:53:57 UTC: According to discoverer Wiz, Inc, versions as early as PHP 5.4, all the way through to PHP 8, are affected.record, removed 2026-10-21 14:15:09 UTC, added 2026-10-21 13:59:18 UTC: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a remote code execution vulnerability reported in October 2026 in the common web scriptinrecord, removed 2026-10-21 15:54:26 UTC, added 2026-10-21 14:15:09 UTC: CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP that allow remote code execution and are together known as PHP2Shell.stated, removed 2026-10-21 14:26:23 UTC, added 2026-10-21 14:24:53 UTC: Many websites using PHP have shut down already, and future shutdowns are expected until a fix is released.quote, removed 2026-10-21 16:02:45 UTC, added 2026-10-21 14:42:05 UTC: The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" projerecord, removed 2026-10-21 15:21:49 UTC, added 2026-10-21 14:42:05 UTC: The maintainers of PHP worked with companies including Wiz, Cloudflare, and OpenAI to develop and release patched version of PHP 8.2, 8.3, 8record, still in the article, added 2026-10-21 14:42:05 UTC: Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they astated, removed 2026-10-21 15:25:57 UTC, added 2026-10-21 14:51:19 UTC: An emergency patch and details about the vulnerability were released on the following day.record, removed 2026-10-21 15:25:32 UTC, added 2026-10-21 14:52:22 UTC: The existence of the vulnerability was publicly announced on 20 October 2026.stated, removed 2026-10-21 14:54:46 UTC, added 2026-10-21 14:52:47 UTC: It is notable for the fact that the PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked stated, still in the article, added 2026-10-21 14:52:47 UTC: The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released.stated, removed 2026-10-21 15:30:38 UTC, added 2026-10-21 14:54:46 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and westated, removed 2026-10-21 15:28:07 UTC, added 2026-10-21 15:19:41 UTC: Following an advice from CERT-EU, many organizations across Europe took their websites offline as a precaution while the patches were pendinrecord, removed 2026-10-21 16:42:07 UTC, added 2026-10-21 15:21:49 UTC: The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5.record, still in the article, added 2026-10-21 15:25:32 UTC: Their existence was publicly announced on 20 October 2026.stated, removed 2026-10-21 15:27:48 UTC, added 2026-10-21 15:25:57 UTC: An emergency patch and details about the vulnerabilites was released on the following day.stated, removed 2026-10-21 15:28:59 UTC, added 2026-10-21 15:27:48 UTC: An emergency patch and details about the vulnerabilites were released on the following day.stated, removed 2026-10-21 15:39:47 UTC, added 2026-10-21 15:28:07 UTC: Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline astated, removed 2026-10-22 07:00:59 UTC, added 2026-10-21 15:28:59 UTC: An emergency patch and details about the vulnerabilities were released on the following day.stated, removed 2026-10-21 17:22:37 UTC, added 2026-10-21 15:30:38 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on the Hacker News forums and wastated, removed 2026-10-21 15:45:20 UTC, added 2026-10-21 15:39:47 UTC: Approximately 69% of websites use PHP, so the potential impacts were widespread.stated, removed 2026-10-23 14:04:19 UTC, added 2026-10-21 15:39:47 UTC: The Wikimedia Foundation shut down many of their supporting services, and forum sites 4Chan and Something Awful went offline.stated, removed 2026-10-21 15:49:55 UTC, added 2026-10-21 15:39:47 UTC: Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offlinstated, removed 2026-10-23 10:10:06 UTC, added 2026-10-21 15:45:20 UTC: Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potstated, removed 2026-10-21 16:16:42 UTC, added 2026-10-21 15:46:39 UTC: Parts of the Japanese internet also went offline, including the online card game Shadowverse: Worlds Beyond and many online commerce sites.attributed, removed 2026-10-21 15:56:16 UTC, added 2026-10-21 15:49:09 UTC: The US National Security Agency recommended that websites go offline if they're not able to immediately update.stated, removed 2026-10-21 15:51:44 UTC, added 2026-10-21 15:49:55 UTC: Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offlinstated, removed 2026-10-21 16:26:05 UTC, added 2026-10-21 15:51:44 UTC: Following an advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offlinrecord, removed 2026-10-21 16:15:49 UTC, added 2026-10-21 15:54:26 UTC: CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5-8 that allow remote coattributed, still in the article, added 2026-10-21 15:56:16 UTC: The US National Security Agency recommended that websites go offline if unable to update immediately.quote, removed 2026-10-21 16:03:12 UTC, added 2026-10-21 16:02:45 UTC: The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" projequote, removed 2026-10-21 16:03:52 UTC, added 2026-10-21 16:03:12 UTC: The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" projequote, removed 2026-10-21 16:05:41 UTC, added 2026-10-21 16:03:52 UTC: The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" projequote, removed 2026-10-21 16:40:09 UTC, added 2026-10-21 16:05:41 UTC: The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" projestated, removed 2026-10-21 16:52:00 UTC, added 2026-10-21 16:06:23 UTC: Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline aattributed, removed 2026-10-23 13:11:57 UTC, added 2026-10-21 16:09:35 UTC: Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules arecord, removed 2026-10-21 16:16:42 UTC, added 2026-10-21 16:15:49 UTC: CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5–8 that allow remote corecord, removed 2026-10-21 16:34:53 UTC, added 2026-10-21 16:16:42 UTC: CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 –8.5 that allow remostated, removed 2026-10-21 16:35:21 UTC, added 2026-10-21 16:16:42 UTC: Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby and Shadowverse: Worlds Beyond, and many ostated, removed 2026-10-21 23:05:29 UTC, added 2026-10-21 16:28:37 UTC: Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potrecord, removed 2026-10-21 18:37:06 UTC, added 2026-10-21 16:34:53 UTC: CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4 – 8.5 that allow remstated, removed 2026-10-21 17:26:29 UTC, added 2026-10-21 16:35:21 UTC: Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, and many onliquote, removed 2026-10-21 16:40:57 UTC, added 2026-10-21 16:40:09 UTC: The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" projerecord, removed 2026-10-21 16:46:06 UTC, added 2026-10-21 16:40:57 UTC: PHP versions as early as 5.4 are affected, and the underlying flaws had gone undetected in PHP's code for more than a decade.quote, removed 2026-10-21 17:15:04 UTC, added 2026-10-21 16:40:57 UTC: The vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" projestated, still in the article, added 2026-10-21 16:42:07 UTC: Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe crecord, still in the article, added 2026-10-21 16:42:07 UTC: The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12).record, removed 2026-10-21 17:06:08 UTC, added 2026-10-21 16:46:06 UTC: PHP versions as early as 5.4 are affected, and while the security flaw had been identified decades before, it was not fixed at the time as istated, removed 2026-10-23 13:11:57 UTC, added 2026-10-21 16:49:17 UTC: Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecuritystated, removed 2026-10-23 06:17:08 UTC, added 2026-10-21 16:52:00 UTC: Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline arecord, removed 2026-10-21 17:15:04 UTC, added 2026-10-21 17:06:08 UTC: PHP versions as early as 5.4 are affected, and while this type of bug had been identified as an area of concern decades before, no action wahedged, removed 2026-10-21 17:18:08 UTC, added 2026-10-21 17:15:04 UTC: A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team quote, removed 2026-10-21 22:13:34 UTC, added 2026-10-21 17:15:04 UTC: The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" precord, removed 2026-10-21 19:28:14 UTC, added 2026-10-21 17:15:04 UTC: PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern dechedged, removed 2026-10-22 02:57:15 UTC, added 2026-10-21 17:18:08 UTC: A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team stated, removed 2026-10-21 19:28:14 UTC, added 2026-10-21 17:22:37 UTC: PoCs, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo after development platform Chaingstated, removed 2026-10-21 17:31:32 UTC, added 2026-10-21 17:22:37 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker Nestated, removed 2026-10-21 18:29:00 UTC, added 2026-10-21 17:26:29 UTC: Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasystated, removed 2026-10-21 17:37:47 UTC, added 2026-10-21 17:31:32 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker Nestated, removed 2026-10-21 19:28:14 UTC, added 2026-10-21 17:37:47 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker Neattributed, still in the article, added 2026-10-21 17:59:42 UTC: The Japanese National Cybersecurity Office advised PHP users to immediately update their systems.stated, removed 2026-10-21 20:44:14 UTC, added 2026-10-21 18:29:00 UTC: Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Shadowverse: Worlds Beyond, Final Fantasyrecord, removed 2026-10-21 19:25:39 UTC, added 2026-10-21 18:37:06 UTC: CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two vulnerabilities in PHP versions 5.4–8.5 that allow remotrecord, removed 2026-10-21 22:50:16 UTC, added 2026-10-21 19:25:39 UTC: CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, are two high-impact vulnerabilities in PHP versions 5.4–8.5 thatrecord, removed 2026-10-22 02:55:57 UTC, added 2026-10-21 19:28:14 UTC: PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern decstated, removed 2026-10-21 20:31:27 UTC, added 2026-10-21 19:28:14 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on October 20th on the Hacker Nestated, still in the article, added 2026-10-21 19:28:14 UTC: Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after develstated, removed 2026-10-21 21:30:42 UTC, added 2026-10-21 19:56:46 UTC: PHP is also bundled with vendor appliances, hosting control panels such as cPanel and Plesk, and some Windows applications.stated, removed 2026-10-24 01:37:29 UTC, added 2026-10-21 20:31:27 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker Newsstated, removed 2026-10-21 20:59:41 UTC, added 2026-10-21 20:31:39 UTC: At this point in time Amazon (AWS) have not released a patch for AL2023.stated, removed 2026-10-23 06:17:08 UTC, added 2026-10-21 20:40:13 UTC: The UK National Cyber Security Centre released a similar warning, urging organizations to be wary of backdoors.stated, removed 2026-10-21 21:02:39 UTC, added 2026-10-21 20:44:14 UTC: Re:Dive, and many online commerce sites.stated, removed 2026-10-21 21:02:39 UTC, added 2026-10-21 20:44:14 UTC: The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline. Parts of the stated, removed 2026-10-22 15:14:00 UTC, added 2026-10-21 21:02:39 UTC: Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Distated, removed 2026-10-23 19:13:49 UTC, added 2026-10-21 21:30:42 UTC: PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.stated, removed 2026-10-21 21:50:16 UTC, added 2026-10-21 21:44:35 UTC: Parts of the Japanese internet also went offline, including videogames and many online commerce sites.quote, removed 2026-10-22 04:35:53 UTC, added 2026-10-21 22:13:34 UTC: The two vulnerabilities were independently discovered by the California-based security firm Calif as part of the OpenAI "Patch the Planet" precord, removed 2026-10-22 06:57:01 UTC, added 2026-10-21 22:50:16 UTC: PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, known under Common Vulnerabilities and Exposures IDs CVE-2026stated, still in the article, added 2026-10-22 00:21:42 UTC: The Internet Archive briefly shut down to fix the issue.record, removed 2026-10-22 04:19:58 UTC, added 2026-10-22 00:34:24 UTC: To help discover the bug, Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas were used.stated, removed 2026-10-22 02:18:10 UTC, added 2026-10-22 02:13:57 UTC: Parts of the Japanese internet also went offline, including Cygames franchises such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Cstated, removed 2026-10-22 09:19:12 UTC, added 2026-10-22 02:21:51 UTC: Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct.stated, removed 2026-10-22 09:19:12 UTC, added 2026-10-22 02:21:51 UTC: 17, 2026, in MadPot telemetry, four days before public disclosure.record, removed 2026-10-22 05:07:02 UTC, added 2026-10-22 02:55:57 UTC: PHP versions as early as 5.4 are affected by these vulnerabilities, and while this type of bug had been identified as an area of concern dechedged, removed 2026-10-22 04:09:07 UTC, added 2026-10-22 02:57:15 UTC: A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the development team hedged, still in the article, added 2026-10-22 04:09:07 UTC: A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixrecord, still in the article, added 2026-10-22 04:19:58 UTC: Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their reserecord, still in the article, added 2026-10-22 04:35:53 UTC: Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability.quote, removed 2026-10-22 04:39:16 UTC, added 2026-10-22 04:35:53 UTC: The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as quote, removed 2026-10-22 16:58:39 UTC, added 2026-10-22 04:39:16 UTC: The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as hedged, removed 2026-10-22 08:29:17 UTC, added 2026-10-22 05:07:02 UTC: PHP versions as early as 5.4 are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades befrecord, removed 2026-10-22 07:00:40 UTC, added 2026-10-22 06:57:01 UTC: PHP2Shell is a set of two high-impact vulnerabilities in PHP versions 5.4–8.5, know under Common Vulnerabilities and Exposures IDs CVE-2026-record, removed 2026-10-22 11:31:43 UTC, added 2026-10-22 07:00:40 UTC: PHP2Shell is a set of two high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code estated, removed 2026-10-22 07:27:44 UTC, added 2026-10-22 07:00:59 UTC: An emergency patch and details about the vulnerabilities were released the following day.attributed, removed 2026-10-22 12:18:25 UTC, added 2026-10-22 07:07:45 UTC: Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about attributed, removed 2026-10-22 07:09:18 UTC, added 2026-10-22 07:07:45 UTC: Commentary in the Guardian also noted that the PHP Foundation only had 13 full- and part-time employees, and relied on financial contributioattributed, removed 2026-10-22 07:34:30 UTC, added 2026-10-22 07:09:18 UTC: Commentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and rrecord, removed 2026-10-22 08:03:55 UTC, added 2026-10-22 07:27:44 UTC: An emergency patch for versions 8.2, 8.3, 8.8 and 8.5 and details about the vulnerabilities were released the following day.attributed, still in the article, added 2026-10-22 07:34:30 UTC: Commentary in the Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and rrecord, removed 2026-10-23 13:41:34 UTC, added 2026-10-22 08:03:55 UTC: An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day.hedged, removed 2026-10-23 13:44:29 UTC, added 2026-10-22 08:29:17 UTC: PHP versions as early as 5.4 (released in 2012) are affected by these vulnerabilities, and while concerns around memory safety bugs had beenrecord, removed 2026-10-23 22:59:01 UTC, added 2026-10-22 09:19:12 UTC: Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced relerecord, still in the article, added 2026-10-22 09:19:12 UTC: Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days beforerecord, removed 2026-10-22 20:27:24 UTC, added 2026-10-22 10:56:44 UTC: An analysis by company-data firm Veridion of web technology detections mapped affected PHP version strings to the companies operating the weattributed, removed 2026-10-22 11:29:49 UTC, added 2026-10-22 11:23:53 UTC: Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about record, removed 2026-10-23 10:10:06 UTC, added 2026-10-22 11:31:43 UTC: PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execrecord, removed 2026-10-22 11:35:46 UTC, added 2026-10-22 11:33:21 UTC: An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day. hi thomasattributed, removed 2026-10-22 13:30:28 UTC, added 2026-10-22 12:18:25 UTC: Researchers at Wiz stated that the issue was on par with Heartbleed; a 2014 vulnerability that affected an encryption library used by about attributed, removed 2026-10-23 03:47:03 UTC, added 2026-10-22 13:30:28 UTC: Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected an encryption library used by about stated, removed 2026-10-23 06:17:08 UTC, added 2026-10-22 15:14:00 UTC: Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Diquote, still in the article, added 2026-10-22 16:58:39 UTC: The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as stated, removed 2026-10-22 20:24:44 UTC, added 2026-10-22 18:42:03 UTC: The New York Times covered the event on 22 October.quote, removed 2026-10-22 20:24:44 UTC, added 2026-10-22 18:42:03 UTC: They said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk.quote, still in the article, added 2026-10-22 20:24:44 UTC: Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at riskstated, removed 2026-10-23 01:23:08 UTC, added 2026-10-22 21:49:43 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker Newsstated, removed 2026-10-23 03:43:38 UTC, added 2026-10-23 03:04:00 UTC: Volunteer Ondřej Surý of Czechia was credited with playing a crucial role automating the necessary patches.stated, removed 2026-10-23 06:17:08 UTC, added 2026-10-23 03:40:40 UTC: The Cyber Security Agency of Singapore has also urged organisations in Singapore to fix the security flaws.stated, removed 2026-10-23 06:17:08 UTC, added 2026-10-23 03:43:38 UTC: Volunteer Ondřej Surý of the Czech Republic was credited with playing a crucial role automating the necessary patches.attributed, still in the article, added 2026-10-23 03:47:03 UTC: Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected OpenSSL, an encryption library used stated, still in the article, added 2026-10-23 05:11:50 UTC: Some Canadian government websites were temporarily taken down as a precaution as taken following guidance from the Canadian Centre for Cyberstated, still in the article, added 2026-10-23 06:17:08 UTC: Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites ofstated, still in the article, added 2026-10-23 06:17:08 UTC: The NCSC released a similar warning, urging organizations to be wary of backdoors.stated, removed 2026-10-23 06:18:48 UTC, added 2026-10-23 06:17:08 UTC: The Cyber Security Agency of Singapore has also urged organizations in Singapore to fix the security flaws.stated, removed 2026-10-23 09:21:48 UTC, added 2026-10-23 06:17:08 UTC: Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Distated, removed 2026-10-23 14:22:43 UTC, added 2026-10-23 06:17:08 UTC: Czech volunteer Ondřej Surý was credited with playing a crucial role automating the necessary patches.stated, still in the article, added 2026-10-23 06:18:48 UTC: The Singaporean Cyber Security Agency has also urged organizations in Singapore to fix the security flaws.stated, removed 2026-10-23 08:26:46 UTC, added 2026-10-23 07:06:46 UTC: To help administrators verify the impact, several vendors and devs released free tools during the embargo and after the embargo.stated, removed 2026-10-23 07:19:28 UTC, added 2026-10-23 07:06:46 UTC: These included Aikido, Trend Micro, Astra Security and many others.stated, removed 2026-10-23 08:26:46 UTC, added 2026-10-23 07:19:28 UTC: These included Pentest-Tools.com, Aikido, Trend Micro, Astra Security and many others.stated, removed 2026-10-23 09:22:19 UTC, added 2026-10-23 09:21:48 UTC: Several Japanese websites also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, astated, still in the article, added 2026-10-23 09:22:19 UTC: Several Japanese websites and applications also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Corecord, removed 2026-10-23 13:41:34 UTC, added 2026-10-23 10:10:06 UTC: PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote stated, removed 2026-10-23 19:13:49 UTC, added 2026-10-23 10:10:06 UTC: Approximately 69% of websites worldwide use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, attributed, still in the article, added 2026-10-23 13:11:57 UTC: Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall rules as an aattributed, still in the article, added 2026-10-23 13:11:57 UTC: Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurityhedged, removed 2026-10-24 14:37:36 UTC, added 2026-10-23 13:41:34 UTC: PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearlhedged, removed 2026-10-24 09:04:05 UTC, added 2026-10-23 13:41:34 UTC: PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote hedged, still in the article, added 2026-10-23 13:41:34 UTC: An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day, with numerous whedged, still in the article, added 2026-10-23 13:44:29 UTC: PHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs had beestated, still in the article, added 2026-10-23 14:04:19 UTC: The Wikimedia Foundation shut down many of their supporting services, and forum sites such as 4chan and Something Awful went offline.stated, still in the article, added 2026-10-23 14:22:43 UTC: Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches.stated, removed 2026-10-23 14:41:47 UTC, added 2026-10-23 14:41:23 UTC: PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-stated, removed 2026-10-23 14:41:47 UTC, added 2026-10-23 14:41:23 UTC: i was there when it happenhedged, removed 2026-10-23 14:41:47 UTC, added 2026-10-23 14:41:23 UTC: 2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE), potentially allowing a malicious user to gastated, removed 2026-10-23 14:43:46 UTC, added 2026-10-23 14:43:41 UTC: DONT USE THIS WESTITE PEOPLE EDIT THESE ARTICALS UNRELIEABLE thank you from a six graderstated, still in the article, added 2026-10-23 19:13:49 UTC: The potential impacts of the vulnerability were widespread.stated, still in the article, added 2026-10-23 19:13:49 UTC: Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content managemenstated, removed 2026-10-23 22:43:04 UTC, added 2026-10-23 22:41:48 UTC: Some japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game.stated, removed 2026-10-23 22:52:25 UTC, added 2026-10-23 22:43:04 UTC: Some japanese users conpared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!.stated, removed 2026-10-24 01:44:04 UTC, added 2026-10-23 22:52:25 UTC: Some Japanese users compared the incident to the plot of the 2000 animated short film Digimon Adventure: Our War Game!.record, still in the article, added 2026-10-23 22:59:01 UTC: Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced relestated, still in the article, added 2026-10-24 01:37:29 UTC: The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker Newsrecord, removed 2026-10-24 20:22:42 UTC, added 2026-10-24 09:04:05 UTC: PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote hedged, removed 2026-10-24 20:25:05 UTC, added 2026-10-24 14:37:36 UTC: PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearlhedged, still in the article, added 2026-10-24 19:52:09 UTC: Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versioattributed, still in the article, added 2026-10-24 19:52:09 UTC: In response to claims on X that unpatched older PHP releases left one-third of the internet permanently vulnerable, Surý stated that there wrecord, still in the article, added 2026-10-24 20:22:42 UTC: PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP vershedged, still in the article, added 2026-10-24 20:25:05 UTC: The vulnerabilities are estimated to affect nearly 70% of websites.stated, still in the article, added 2026-10-24 20:25:05 UTC: PHP is a popular programming language that many website and web application codebases are built upon.stated, removed 2026-10-24 21:32:14 UTC, added 2026-10-24 21:31:13 UTC: REDIRECT Trump govermentrecord, removed 2026-10-24 21:41:44 UTC, added 2026-10-24 21:40:44 UTC: PeeonHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP stated, removed 2026-10-24 21:41:44 UTC, added 2026-10-24 21:40:44 UTC: PeeonHP is a popular programming language that many website and web application codebases are built upon.hedged, removed 2026-10-24 21:41:44 UTC, added 2026-10-24 21:40:44 UTC: PeeonHP versions as early as 5.4 (released in 2012) were affected by these vulnerabilities, and while concerns around memory safety bugs hadstated, still in the article, added 2026-10-25 11:39:32 UTC: Wiz coined the name "PHP2Shell" indicating that PHP exploits would enable execution of shell commands on affected servers.2026-10-21 07:50:01 UTC: [[WP:AES|←]]Created page with ''''PHP2Shell''' ('''CVE-2026-109618 and CVE-2026-2026-10-21 07:50:23 UTC: Adding [[Wikipedia:Short description|short description]]: "2026 software securit2026-10-21 08:14:01 UTC: /* */ unbold "and" between CVE IDs2026-10-21 08:27:06 UTC: 2026-10-21 08:27:42 UTC: 2026-10-21 08:33:38 UTC: 2026-10-21 08:43:17 UTC: adding the most important part2026-10-21 08:58:43 UTC: fix typo2026-10-21 09:21:43 UTC: ce2026-10-21 09:24:13 UTC: Added {{[[Template:Current|Current]]}} tag2026-10-21 09:29:06 UTC: update language used in current template2026-10-21 09:35:37 UTC: Add CVE link2026-10-21 09:39:59 UTC: 2026-10-21 10:03:31 UTC: clarify2026-10-21 10:05:36 UTC: 2026-10-21 10:11:35 UTC: [[WP:NOELBODY]]2026-10-21 10:48:42 UTC: moved citation outside punctuation2026-10-21 10:55:11 UTC: /* */ Added clarification that 9.2 is a Critical vulnerability2026-10-21 11:01:34 UTC: Changed statement about remote code execution to include 'unconfirmed reports cl2026-10-21 11:10:15 UTC: add eMudhra see also link2026-10-21 11:20:28 UTC: Known state of public PoCs, mitigations and write-ups2026-10-21 11:20:44 UTC: 2026-10-21 11:21:23 UTC: wrong date2026-10-21 11:22:32 UTC: 2026-10-21 11:22:52 UTC: +{{Software-eng-stub}} using [[User:SD0001/StubSorter|StubSorter]]2026-10-21 11:23:09 UTC: see also2026-10-21 11:24:38 UTC: eMudhra isn't really related to this incident without clarification2026-10-21 11:24:41 UTC: 2026-10-21 11:37:23 UTC: wl2026-10-21 11:37:37 UTC: ce2026-10-21 11:38:35 UTC: {{better source needed}}2026-10-21 11:43:33 UTC: eMudhra incident is unrelated, except by date2026-10-21 12:19:29 UTC: better source found (PC Gamer)2026-10-21 12:24:19 UTC: 2026-10-21 12:28:54 UTC: /* */ some MOS changes ([[MOS:BADDATE]], [[MOS:RANGE]])2026-10-21 12:34:50 UTC: Adding screenshot of the Phabricator as a visual aid for sites being disabled du2026-10-21 12:55:59 UTC: /* */ [[WP:BOLD]]-ly revise Phabricator-image caption2026-10-21 12:58:16 UTC: Undo https://en.wikipedia.org/w/index.php?title=PHP2Shell&diff=prev&oldid=1381282026-10-21 13:00:41 UTC: expand abbreviation2026-10-21 13:02:03 UTC: add external link of the announcement2026-10-21 13:04:29 UTC: link2026-10-21 13:05:23 UTC: Fix forward cite2026-10-21 13:25:57 UTC: 2026-10-21 13:26:17 UTC: [[WP:CVPI|Interceptor]]: Reverting unexplained deletion by [[Special:Contributio2026-10-21 13:26:24 UTC: 2026-10-21 13:26:40 UTC: [[WP:CVPI|Interceptor]]: Reverting unexplained deletion by [[Special:Contributio2026-10-21 13:42:33 UTC: 2026-10-21 13:42:45 UTC: 2026-10-21 13:45:10 UTC: Add Wiz cite2026-10-21 13:46:43 UTC: fix has been released2026-10-21 13:48:24 UTC: restore accidentally deletion2026-10-21 13:53:02 UTC: 2026-10-21 13:53:29 UTC: 2026-10-21 13:53:57 UTC: 2026-10-21 13:56:51 UTC: Wiz seems to repeat the 9.2 figure2026-10-21 13:58:43 UTC: Ars Tech down... so sad2026-10-21 13:59:18 UTC: more precise term2026-10-21 14:02:05 UTC: update link2026-10-21 14:08:53 UTC: addressed + no more need2026-10-21 14:15:09 UTC: improve first sentence2026-10-21 14:22:22 UTC: discoverer2026-10-21 14:24:53 UTC: added a short line mentioning website shutdowns2026-10-21 14:25:28 UTC: should be 'Phabricator instance'2026-10-21 14:25:59 UTC: add website2026-10-21 14:26:23 UTC: Undid revision [[Special:Diff/1381309714|1381309714]] by [[Special:Contributions2026-10-21 14:27:24 UTC: Undid revision [[Special:Diff/1381309826|1381309826]] by [[Special:Contributions2026-10-21 14:29:08 UTC: add wiktionary link2026-10-21 14:32:50 UTC: add links2026-10-21 14:41:01 UTC: Undid revision [[Special:Diff/1381309962|1381309962]] by [[Special:Contributions2026-10-21 14:42:05 UTC: update2026-10-21 14:51:19 UTC: Grammar fix ("was" -> "were" in lead)2026-10-21 14:52:22 UTC: 2026-10-21 14:52:47 UTC: Add2026-10-21 14:54:46 UTC: source doesn't indicate this is notable. reinclude with exactly why it is notabl2026-10-21 15:05:10 UTC: /* */ mark Wiz/Cloudflare/OpenAI-collaboration statement with tags2026-10-21 15:09:37 UTC: 2026-10-21 15:11:00 UTC: /* Patches */2026-10-21 15:13:01 UTC: /* Patches */ remove citation tagged as failed verification [tagged by me in a p2026-10-21 15:19:41 UTC: Impact2026-10-21 15:21:49 UTC: /* Patches */ Rm claim, not clear how much those companies had contributed to th2026-10-21 15:22:59 UTC: /* Patches */ re-add source2026-10-21 15:23:51 UTC: /* Discovery */ remove "The Hacker News" source [very-rough consensus of unrelia2026-10-21 15:25:32 UTC: 2026-10-21 15:25:57 UTC: 2026-10-21 15:27:48 UTC: /* */ fixed grammar2026-10-21 15:28:07 UTC: /* Impact */ UK advice too2026-10-21 15:28:59 UTC: typo2026-10-21 15:30:38 UTC: /* Patches */ grammar2026-10-21 15:33:33 UTC: 2026-10-21 15:34:08 UTC: 2026-10-21 15:34:25 UTC: Undid revision [[Special:Diff/1381316773|1381316773]] by [[Special:Contributions2026-10-21 15:39:47 UTC: /* Impact */ update2026-10-21 15:45:20 UTC: /* Impact */ add2026-10-21 15:45:43 UTC: /* Discovery */ mark OpenAI and Wiz's citations as possibly [[WP:SPS|self-publis2026-10-21 15:46:39 UTC: /* Impact */ Japan2026-10-21 15:49:09 UTC: /* Impact */ add2026-10-21 15:49:55 UTC: /* Impact */2026-10-21 15:50:42 UTC: /* Impact */ add cite2026-10-21 15:51:44 UTC: /* Impact */ Correct a typo2026-10-21 15:52:15 UTC: update anchor to php advisory2026-10-21 15:54:26 UTC: adjust lede2026-10-21 15:55:11 UTC: /* See also */ add [[Heartbleed]], given as a similar level of vulnerability by 2026-10-21 15:56:16 UTC: /* Impact */ rephrase2026-10-21 15:58:06 UTC: Removed unnecessary softlink.2026-10-21 16:02:45 UTC: /* Discovery */ add2026-10-21 16:03:12 UTC: /* Discovery */ not need to credit that to Wiz2026-10-21 16:03:52 UTC: /* Discovery */ c/e2026-10-21 16:04:42 UTC: Added links to other articles where useful.2026-10-21 16:05:41 UTC: typo fix2026-10-21 16:06:23 UTC: /* Impact */ Fixed grammar2026-10-21 16:08:16 UTC: add cite2026-10-21 16:09:35 UTC: /* Patches */ grammar2026-10-21 16:13:00 UTC: More links added.2026-10-21 16:14:13 UTC: One link added2026-10-21 16:15:49 UTC: [[MOS:DASHVAR]]2026-10-21 16:16:42 UTC: Citing versions, Wiz states that 5.4 was the first version affected, NIST and PH2026-10-21 16:20:00 UTC: /* External links */ not a stub2026-10-21 16:23:42 UTC: /* Impact */ Proper spelling2026-10-21 16:26:05 UTC: Remove [[WP:OVERLINK]] and inline external links, c/e2026-10-21 16:28:17 UTC: adding website for exploit2026-10-21 16:28:37 UTC: /* Impact */ updated to present tense2026-10-21 16:28:58 UTC: restore link to [[GitHub]]2026-10-21 16:30:00 UTC: use {{url}}2026-10-21 16:34:03 UTC: /* Impact */2026-10-21 16:34:53 UTC: 2026-10-21 16:35:21 UTC: Grammar changes.2026-10-21 16:36:36 UTC: Link added2026-10-21 16:39:05 UTC: /* Impact */ Not sure we need the 4chan screenshot here, the Phab screenshot alr2026-10-21 16:40:09 UTC: add quotes2026-10-21 16:40:57 UTC: Discovery: cite August 2026 date to Sansec; correct flaw age per BBC and Reuters2026-10-21 16:42:07 UTC: Add patched version numbers and PHP's mitigation advice; tag uncited timestamp2026-10-21 16:42:52 UTC: Added a link2026-10-21 16:46:06 UTC: Restore Ahecht's WSJ quotes and wording, lost in my earlier edit2026-10-21 16:46:30 UTC: Links2026-10-21 16:47:59 UTC: add cite2026-10-21 16:48:27 UTC: fix {{subref}}2026-10-21 16:49:17 UTC: Add exploitation status per watchTowr and NBC; add BleepingComputer cite for Clo2026-10-21 16:50:02 UTC: /* Discovery */ unnecessary pipe2026-10-21 16:50:27 UTC: /* Discovery */ fix2026-10-21 16:51:12 UTC: /* Impact */ rm unnecessary pipe2026-10-21 16:52:00 UTC: French outage was Interior Ministry sites per Reuters; fix Reuters and NCSC cite2026-10-21 16:53:17 UTC: /* Patches */ move ref2026-10-21 16:54:23 UTC: Edited external link to be date-specific.2026-10-21 17:01:45 UTC: /* Discovery */ replace self-published source2026-10-21 17:02:57 UTC: removed inline link: citation already has this url2026-10-21 17:06:08 UTC: /* Discovery */ Clarify on the timeline here. The official PHP post doesn't agre2026-10-21 17:11:21 UTC: tag citations to "The Hacker News" (not the forum named "Hacker News") as possib2026-10-21 17:14:14 UTC: /* */ use {{[[Template:Flatlist|Flatlist]]}} instead of {{[[Template:Plain list|2026-10-21 17:15:04 UTC: /* Discovery */ add information on 2024 discovery, re-order2026-10-21 17:16:31 UTC: /* Impact */ Added citations confirming Umamusume: Pretty Derby went offline for2026-10-21 17:18:08 UTC: fix typo2026-10-21 17:22:37 UTC: /* Patches */ add2026-10-21 17:26:29 UTC: /* Impact */2026-10-21 17:27:24 UTC: ref author2026-10-21 17:28:40 UTC: /* Patches */ move ref to the correct place2026-10-21 17:30:42 UTC: Remove commercial source2026-10-21 17:31:32 UTC: Fixed a small typo2026-10-21 17:37:47 UTC: /* Patches */ removed the extraneous "by" and adjusted the flow2026-10-21 17:38:20 UTC: /* Impact */ added NSA citation and partial quote2026-10-21 17:48:55 UTC: /* Impact */ fixed citation error2026-10-21 17:59:42 UTC: /* Impact */ added japanese govt. advisory + fixed citation2026-10-21 18:08:23 UTC: added [[Category:Wikipedia controversies]] using [[WP:HC|HotCat]]2026-10-21 18:10:41 UTC: re-add {{[[Template:add Unreliable source|add Unreliable source]]}} templates fo2026-10-21 18:20:26 UTC: Undid revision [[Special:Diff/1381333092|1381333092]] by [[Special:Contributions2026-10-21 18:29:00 UTC: added oxford comma2026-10-21 18:31:56 UTC: no current event anymore: patches released, websites back online2026-10-21 18:37:06 UTC: /* */ some changes to an occurence of an en-dash2026-10-21 18:40:47 UTC: /* Discovery */ added reference to official php foundation blog about the histor2026-10-21 19:05:16 UTC: Add current event2026-10-21 19:25:39 UTC: 2026-10-21 19:28:14 UTC: linking and grammar and de-jargon a bit2026-10-21 19:56:46 UTC: Added a key additional set of vulnerabilities for the impact2026-10-21 19:57:51 UTC: 2026-10-21 19:59:30 UTC: 2026-10-21 20:31:27 UTC: /* Patches */ Consistently use DMY formats2026-10-21 20:31:39 UTC: /* Patches */2026-10-21 20:40:13 UTC: /* Impact */ Expanding article2026-10-21 20:41:56 UTC: /* Impact */ overlinked2026-10-21 20:44:14 UTC: /* Impact */ non-primary sourcing2026-10-21 20:59:41 UTC: /* Patches */ Removed "at this point in time" sentence that 1. was referenced to2026-10-21 21:02:39 UTC: /* Impact */ fix space2026-10-21 21:26:23 UTC: /* Discovery */ This source doesn't support the "decades" claim, just the 2024 o2026-10-21 21:26:57 UTC: /* Discovery */ not needed since a secondary source is also supplied here2026-10-21 21:30:42 UTC: clarify that PHP doesn't "host" cPanel, it's just bundled with it2026-10-21 21:44:35 UTC: /* Impact */ more concise: not necessary to give examples of Japanese videogames2026-10-21 21:50:16 UTC: Undid revision [[Special:Diff/1381357570|1381357570]] by [[Special:Contributions2026-10-21 22:13:34 UTC: /* Discovery */2026-10-21 22:35:27 UTC: 2026-10-21 22:50:16 UTC: 2026-10-21 23:04:36 UTC: combine duplicate references2026-10-21 23:05:29 UTC: /* Impact */ past tense2026-10-21 23:06:21 UTC: /* See also */ no rogue agents were involved in discovering this2026-10-21 23:08:54 UTC: 2026-10-21 23:12:10 UTC: Fixed link2026-10-21 23:13:10 UTC: Fixed link2026-10-21 23:13:40 UTC: 2026-10-21 23:50:59 UTC: use non-primary source2026-10-22 00:08:56 UTC: /* Patches */ Add citation2026-10-22 00:09:39 UTC: Undid revision [[Special:Diff/1381372239|1381372239]] by [[Special:Contributions2026-10-22 00:12:34 UTC: /* Patches */ Prioritize secondary citations2026-10-22 00:17:24 UTC: /* top */[[MOS:CURLY]]2026-10-22 00:21:42 UTC: /* Impact */ Add Internet Archive2026-10-22 00:23:11 UTC: [[MOS:OVERLINK]]2026-10-22 00:23:50 UTC: [[MOS:OVERLINK]]2026-10-22 00:30:16 UTC: the sources don't mention Wiz at all (unless I missed it somehow), and I can't s2026-10-22 00:33:02 UTC: /* Patches */2026-10-22 00:34:24 UTC: /* Discovery */ Add method of discovery2026-10-22 00:35:22 UTC: /* Discovery */ Remove non-confirming citation2026-10-22 00:36:14 UTC: /* Impact */ Fix author name2026-10-22 01:07:30 UTC: Attribute to Calif who was the first team that found php2shell, and link to thei2026-10-22 01:10:12 UTC: reformat the website lists2026-10-22 01:39:54 UTC: Tagged [[WP:DUPREF|duplicate citations]] using [[User:Polygnotus/DuplicateRefere2026-10-22 01:48:39 UTC: remove duplicated citation2026-10-22 02:07:52 UTC: Calif is involved in php2shell.com as well, no need to list them separately in t2026-10-22 02:13:57 UTC: 2026-10-22 02:17:51 UTC: 2026-10-22 02:18:10 UTC: Undid revision [[Special:Diff/1381382832|1381382832]] by [[Special:Contributions2026-10-22 02:21:51 UTC: /* Patches */ Important earlier wild date reported by AWS2026-10-22 02:55:57 UTC: /* Discovery */ Prosody and nuance; WP:MDASH works better than parentheses here2026-10-22 02:57:15 UTC: /* Discovery */ Prosody and nuance2026-10-22 04:09:07 UTC: /* Discovery */ ce2026-10-22 04:19:58 UTC: /* Discovery */ Clarify Wiz AI use2026-10-22 04:32:53 UTC: /* External links */ update php announcement link to latest one. add wiz announc2026-10-22 04:35:53 UTC: /* Discovery */ ce, clarify Calif researcher LLM use2026-10-22 04:39:16 UTC: /* Discovery */ Add Wiz corporate structure information2026-10-22 04:42:41 UTC: remove an extra space. remove a duplicated wikilink2026-10-22 04:46:48 UTC: /* Impact */ for better readability, split single large paragraph into three par2026-10-22 05:07:02 UTC: /* Discovery */ clean up language, clarify finer points from the listed sources2026-10-22 05:22:09 UTC: 2026-10-22 06:38:01 UTC: sweet32 too2026-10-22 06:39:26 UTC: 2026-10-22 06:57:01 UTC: grammafr fix2026-10-22 07:00:40 UTC: ce2026-10-22 07:00:59 UTC: ce2026-10-22 07:03:10 UTC: test2026-10-22 07:05:02 UTC: test2026-10-22 07:07:45 UTC: add analysis section2026-10-22 07:09:18 UTC: /* Analysis */ cleanup2026-10-22 07:18:45 UTC: /* Analysis */ wl2026-10-22 07:27:44 UTC: Important to note that versions prior to 8 are not patched.2026-10-22 07:34:30 UTC: 2026-10-22 08:03:55 UTC: PHP 8.4 instead of PHP 8.82026-10-22 08:11:28 UTC: sd2026-10-22 08:12:06 UTC: done2026-10-22 08:13:42 UTC: 2026-10-22 08:17:16 UTC: 2026-10-22 08:29:17 UTC: added release date to 5.42026-10-22 09:15:04 UTC: clean up2026-10-22 09:19:12 UTC: Add links, format days DMY as per the note2026-10-22 09:49:33 UTC: /* Patches */ Add HN post via Wayback Machine link2026-10-22 10:06:34 UTC: Improve formatting2026-10-22 10:56:44 UTC: Added company-level exposure figures; I work at Veridion (COI).2026-10-22 11:10:08 UTC: /* Discovery */ Fix ref, maybe2026-10-22 11:11:34 UTC: /* Discovery */2026-10-22 11:12:29 UTC: 2026-10-22 11:23:53 UTC: /* Analysis */ spelling2026-10-22 11:29:49 UTC: Undid revision [[Special:Diff/1381424661|1381424661]] by [[Special:Contributions2026-10-22 11:31:43 UTC: /* */ ce2026-10-22 11:33:21 UTC: 2026-10-22 11:35:46 UTC: [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contribut2026-10-22 12:18:25 UTC: Wording2026-10-22 13:30:28 UTC: Fixed grammar, italic2026-10-22 13:49:29 UTC: /* */2026-10-22 14:53:23 UTC: Links added2026-10-22 14:56:24 UTC: /* top */link CVEs2026-10-22 15:14:00 UTC: /* Impact */ Prosody & encyclopedic tone2026-10-22 15:42:37 UTC: citation needed2026-10-22 16:13:20 UTC: /* */ no sentence2026-10-22 16:13:35 UTC: /* */ unnecessary in infobox2026-10-22 16:28:54 UTC: Image added.2026-10-22 16:58:39 UTC: /* Discovery */2026-10-22 16:59:55 UTC: /* Analysis */ sourced to same Veridion citation2026-10-22 17:41:03 UTC: Removing commercial spam trying to sell security services related to PHP2Shell2026-10-22 18:15:11 UTC: /* Impact */ Let's not take up 80% of the width of the article2026-10-22 18:16:57 UTC: fix reference name2026-10-22 18:25:11 UTC: The references were broken because a closing quote mark was removed, not because2026-10-22 18:42:03 UTC: /* Analysis */ NY Times coverage2026-10-22 20:24:44 UTC: I don't think this needs to be it's own section at this point2026-10-22 20:26:06 UTC: Replaced [[Wikipedia:VisualEditor/Named references|VE ref names]] using [[User:N2026-10-22 20:27:24 UTC: Remove paragraph sourced to social media2026-10-22 21:49:43 UTC: /* Patches */ Fixed lint error2026-10-22 22:11:29 UTC: /* Impact */2026-10-22 22:26:46 UTC: /* See also */ don't assume they are related2026-10-22 23:43:29 UTC: /* Patches */ address a missing citation for the timeline2026-10-23 00:04:07 UTC: Calif discovered the vulnerability on August 1st 2026 (https://calif.io/php2shel2026-10-23 00:54:27 UTC: rm extra space2026-10-23 00:54:42 UTC: [[Wikipedia:MOSNUMscript|script]]-assisted date audit and style fixes per [[MOS:2026-10-23 01:23:08 UTC: /* Patches */ ce2026-10-23 01:31:35 UTC: {{start date and age}}2026-10-23 02:41:24 UTC: /* Patches */ rm unreliable source2026-10-23 02:57:35 UTC: Added Commons Category2026-10-23 03:04:00 UTC: /* Analysis */ Vital role of Ondřej Surý2026-10-23 03:40:40 UTC: /* Impact */ Added Singapore2026-10-23 03:41:20 UTC: /* Impact */2026-10-23 03:43:38 UTC: /* Analysis */ [[MOS:GEO]], ref format2026-10-23 03:44:56 UTC: /* Analysis */2026-10-23 03:47:03 UTC: /* Analysis */ felt that it should be clarified what library was affected2026-10-23 04:26:09 UTC: Resolved CS1 error2026-10-23 05:11:50 UTC: /* Impact */ Add Canadian gov't2026-10-23 05:26:57 UTC: 2026-10-23 06:17:08 UTC: Link edits2026-10-23 06:18:48 UTC: /* Discovery */2026-10-23 06:27:18 UTC: 2026-10-23 06:59:02 UTC: Added link to a testing tool2026-10-23 07:06:46 UTC: Just added about the free tools made by some vendors to help people detect their2026-10-23 07:19:28 UTC: Updated the list of testing tools2026-10-23 08:26:46 UTC: WP:ELNO2026-10-23 08:34:25 UTC: Undid revision [[Special:Diff/1381548266|1381548266]] by [[Special:Contributions2026-10-23 09:21:48 UTC: More correct language2026-10-23 09:22:19 UTC: 2026-10-23 09:23:44 UTC: see also - heartbleed2026-10-23 09:49:31 UTC: /* See also */2026-10-23 09:54:36 UTC: /* See also */ just use the anl template instead2026-10-23 10:10:06 UTC: brief clarity2026-10-23 10:31:46 UTC: 2026-10-23 10:42:43 UTC: /* Patches */ wlinks2026-10-23 13:11:57 UTC: 2026-10-23 13:41:34 UTC: /* */2026-10-23 13:44:29 UTC: /* Discovery */ flip para2026-10-23 14:04:19 UTC: /* Impact */ grammar2026-10-23 14:22:43 UTC: ce2026-10-23 14:41:23 UTC: 2026-10-23 14:41:47 UTC: [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contribut2026-10-23 14:43:41 UTC: 2026-10-23 14:43:46 UTC: Reverting possible vandalism by [[Special:Contribs/~2026-56713-33|~2026-56713-332026-10-23 16:01:22 UTC: /* */ Alter: title, website.2026-10-23 17:22:04 UTC: 2026-10-23 19:13:49 UTC: /* Impact */ precision and re-organization of first sentence2026-10-23 19:49:34 UTC: wlnk2026-10-23 19:57:02 UTC: excess blank space2026-10-23 22:11:35 UTC: /* See also */ [[MOS:NOTSEEAGAIN]]2026-10-23 22:41:48 UTC: /* Impact */2026-10-23 22:42:22 UTC: /* Impact */2026-10-23 22:43:04 UTC: /* Impact */2026-10-23 22:52:25 UTC: /* Impact */ fix typos2026-10-23 22:59:01 UTC: /* Patches */ backport information2026-10-23 23:07:26 UTC: Cleaning up syntax using [[:en:User:Zackmann08/scripts/indent|indent.js]]2026-10-23 23:35:56 UTC: improve refs2026-10-24 01:17:46 UTC: 2026-10-24 01:23:58 UTC: Altered title. Add: authors 1-1. Removed parameters. Some additions/deletions we2026-10-24 01:36:55 UTC: dmy date2026-10-24 01:37:29 UTC: /* Patches */2026-10-24 01:44:04 UTC: Undid revision 1381654262; claim not substantiated by citations given.2026-10-24 02:38:48 UTC: Rescuing 28 sources and tagging 0 as dead. #IABot (v2.0.9.6)2026-10-24 03:13:41 UTC: /* Impact */ nice to be able to read it2026-10-24 03:58:42 UTC: 2026-10-24 04:16:10 UTC: 2026-10-24 09:04:05 UTC: /* */ smoother flow2026-10-24 12:44:18 UTC: simplifying links per [[WP:NOPIPE]]2026-10-24 13:02:31 UTC: 2026-10-24 13:52:37 UTC: add link2026-10-24 13:52:49 UTC: /* See also */ remove newline2026-10-24 14:37:36 UTC: /* */ not just commerce2026-10-24 19:52:09 UTC: 2026-10-24 20:22:42 UTC: memory safety2026-10-24 20:25:05 UTC: 2026-10-24 21:06:04 UTC: /* See also */ adjusted link text2026-10-24 21:16:52 UTC: 2026-10-24 21:19:40 UTC: Undid revision [[Special:Diff/1381795121|1381795121]] by [[Special:Contributions2026-10-24 21:31:13 UTC: [[WP:AES|←]]Redirected page to [[Trump goverment]]2026-10-24 21:32:14 UTC: Reverted edit by [[Special:Contribs/~2026-56891-34|~2026-56891-34]] ([[User talk2026-10-24 21:40:44 UTC: 2026-10-24 21:41:36 UTC: 2026-10-24 21:41:44 UTC: [[WP:CVPI|Interceptor]]: Reverting non-constructive edits by [[Special:Contribut2026-10-25 03:00:52 UTC: Auto-removing {{current}} - no edits in 5hrs+. The event may still be current, b2026-10-25 04:00:16 UTC: /* Impact */ wl2026-10-25 10:09:43 UTC: /* See also */2026-10-25 11:22:47 UTC: /* Patches */ second ref2026-10-25 11:24:10 UTC: /* Patches */ hmmm... move BBC ref2026-10-25 11:39:32 UTC: /* Discovery */ naming
200 statements ever written, one row each in the order they first appeared, from 2026-10-21 07:50:01 UTC to 2026-10-25 11:39:32 UTC: a bar runs from the edit that added a statement to the edit that removed it; 40 are still in the article. Colour is the class (record, stated, attributed, quote, hedged), named in each bar's title. The ticks along the foot are the 370 revisions; a red tick was reverted. Hover or focus a bar to read it; click it to open the statement, or the edit that removed it.

Size, references and statements

bytes: 824 to 30364 (most 30364)references: 2 to 45 (most 45)statements: 2 to 40 (most 40)
Each line is scaled to its own peak: the article's bytes, its references and its statements over the 370 revisions. Now: bytes: 30,364 · references: 45 · statements: 40.

What has survived longest

The statements that have been in the article longest, unchanged in wording:

What lasted least

The statements removed soonest after they were written, with the edit that removed them: where the article's editors disagreed with a contributor, or a contributor with themselves.

By class, over the whole history

ClassEver writtenIn the article now
record569
stated9016
attributed197
quote153
hedged205

The Wikidata item, over time

The item has 112 revisions, from 2026-10-21 09:48:21 UTC (created from the Finnish Wikipedia's side, two hours after the English article) to 2026-10-24 18:38:02 UTC, by 49 named editors; by day: 2026-10-21 (56), 2026-10-22 (38), 2026-10-23 (9), 2026-10-24 (9). Kinds of edit: wbsetdescription-add (20), wbsetclaim-create (19), wbsetsitelink-add (19), wbsetclaim-update (16), wbsetlabel-add (13), wblinktitles-connect (7), wbsetreference-add (7), wbsetaliases-add (4), wbsetdescription-set (2), wbeditentity-create (1), wbeditentity-update-languages-short (1), clientsitelink-update (1), wbsetsitelink-add-both (1), wbsetaliases-remove (1).

Every edit of the item
WhenEditorEditProperty or summary
2026-10-24 18:38:02 UTCPminh141wbsetdescription-sethai lỗ hổng bảo mật PHP được công bố vào năm 2026
2026-10-24 18:37:32 UTCPminh141wbsetdescription-addlỗ hổng bảo mật PHP năm 2026
2026-10-24 18:37:09 UTCPminh141wbsetlabel-addPHP2Shell
2026-10-24 18:36:58 UTCPminh141wbsetsitelink-addPHP2Shell
2026-10-24 18:00:14 UTCTadejMwbsetdescription-addvarnostna ranljivost v PHP iz leta 2026
2026-10-24 12:14:43 UTCAlessotwblinktitles-connectenwiki:PHP2Shell, ukwiki:PHP2Shell
2026-10-24 11:58:10 UTCRVA2869wbsetaliases-removePHP2Shell, Cleanup: remove alias=label/mul ([[User:Difool/WikidataCleanup]])
2026-10-24 08:47:12 UTCDavidparwbsetlabel-addPHP2Shell
2026-10-24 04:30:23 UTCTitouan-Josephwbsetdescription-addPHP security vulnerability
2026-10-23 19:52:36 UTCProfesorul Blazatwbsetdescription-addvulnerabilitate de securitate PHP din 2026
2026-10-23 19:52:36 UTCProfesorul Blazatwbsetlabel-addPHP2Shell
2026-10-23 11:49:25 UTC~2026-56598-76wbsetsitelink-addPHP2Shell
2026-10-23 08:53:05 UTCJklamowbsetsitelink-add-bothPHP2Shell, [[Q70894304]]
2026-10-23 06:13:32 UTCİmmortalancewbsetsitelink-addPHP2Shell
2026-10-23 03:55:19 UTCस्वर्णwbsetaliases-addसीवीई-२०२६-१०९६१८, सीवीई-२०२६-१०९६१९, जीएचएसए-डब्ल्यू८एचडब्ल्यू-डब्ल्यू९एफ़एक्स-जे७९डब्ल्यू, जीएचएसए
2026-10-23 03:55:18 UTCस्वर्णwbsetdescription-addपीएचपी में २०२६ सुरक्षा भेद्यता
2026-10-23 03:55:17 UTCस्वर्णwbsetlabel-addपीएचपी२शेल
2026-10-23 03:49:31 UTCस्वर्णwblinktitles-connectenwiki:PHP2Shell, hiwiki:पीएचपी२शेल
2026-10-22 22:45:14 UTCHujiclientsitelink-update
2026-10-22 22:23:02 UTCKor109wblinktitles-connectenwiki:PHP2Shell, hewiki:PHP2Shell
2026-10-22 20:25:13 UTCRikiwblinktitles-connectenwiki:PHP2Shell, nlwiki:PHP2Shell
2026-10-22 19:25:14 UTCFnielsenwbsetsitelink-addPHP2Shell
2026-10-22 18:23:54 UTCWoordenbrij2wbsetdescription-addveiligheidskwetsbaarheid in programmeertaal PHP in 2026
2026-10-22 18:00:11 UTCKylespaskiwbsetdescription-addvulnerabilidade de segurança de 2026 no PHP
2026-10-22 18:00:11 UTCKylespaskiwbsetdescription-addvulnerabilidad de seguridad en PHP de 2026
2026-10-22 16:53:50 UTCRVA2869wbsetclaim-updatesignificant event (P793)
2026-10-22 16:51:23 UTCRVA2869wbsetclaim-updatesignificant event (P793)
2026-10-22 16:14:34 UTCSunfyrewbsetsitelink-addPHP2Shell
2026-10-22 15:19:15 UTCPsychpsyowbsetclaim-updatehas use (P366)
2026-10-22 15:18:12 UTCPsychpsyowbsetclaim-updateimage (P18)
2026-10-22 14:59:34 UTCTheklanwbsetsitelink-addPHP2Shell
2026-10-22 12:36:19 UTCTofeikuwbsetsitelink-addPHP2Shell
2026-10-22 11:57:54 UTC四特朗普通话wbsetclaim-updatesignificant event (P793)
2026-10-22 11:56:54 UTC四特朗普通话wbsetclaim-updatesignificant event (P793)
2026-10-22 11:47:58 UTCKugelschreiberswbsetdescription-add2026年に公表されたPHPの2件の脆弱性
2026-10-22 11:24:53 UTCHolekwbsetdescription-addluka bezpieczeństwa w języku PHP upubliczniona w październiku 2026
2026-10-22 11:24:15 UTCHolekwbsetsitelink-addPHP2Shell
2026-10-22 10:51:54 UTCToadetteEditwbsetdescription-addتغره امنيه فى PHP سنة 2026
2026-10-22 10:51:54 UTCToadetteEditwbsetdescription-addثغرة أمنية في PHP عام 2026
2026-10-22 10:50:53 UTCToadetteEditwbsetlabel-addPHP2Shell
2026-10-22 10:50:53 UTCToadetteEditwbsetlabel-addPHP2Shell
2026-10-22 10:48:44 UTCToadetteEditwblinktitles-connectenwiki:PHP2Shell, arwiki:PHP2Shell
2026-10-22 09:25:10 UTCOwlyKnightwblinktitles-connectenwiki:PHP2Shell, idwiki:PHP2Shell
2026-10-22 08:56:53 UTCAssangeswbsetclaim-createfacet of (P1269)
2026-10-22 08:50:18 UTCScikingwbsetdescription-addvulnerabilità del PHP
2026-10-22 07:48:44 UTC~2026-55772-71wbsetaliases-add2026 PHP krizi, 2026 PHP açığı, Ekim 2026 PHP krizi
2026-10-22 04:36:39 UTCYkhwongwbsetdescription-addPHP 버전 5.4~8.5에 존재하는 두 가지 고위험 취약점, ([[w:en:Wikipedia:Shortdesc helper|짧은 설명 도우미]])
2026-10-22 04:33:54 UTC四特朗普通话wbsetdescription-add2026年PHP安全漏洞
2026-10-22 03:18:12 UTC四特朗普通话wbsetlabel-addPHP2Shell
2026-10-22 03:17:56 UTC四特朗普通话wbsetlabel-addPHP2Shell
2026-10-22 02:51:20 UTCYkhwongwbsetsitelink-addPHP2Shell
2026-10-22 01:35:18 UTC~2026-56438-66wbsetsitelink-addPHP2Shell
2026-10-22 01:22:40 UTCKugelschreiberswbsetlabel-addPHP2Shell
2026-10-22 01:22:29 UTCKugelschreiberswbeditentity-update-languages-short[[MediaWiki:Gadget-dataDrainer.js|dataDrainer]] Delete all labels
2026-10-22 01:20:38 UTCNnhwbsetlabel-addPHP2Shell
2026-10-22 00:17:40 UTCNnhwbsetsitelink-addPHP2Shell
2026-10-21 21:10:03 UTCKurmanbekwbsetdescription-add2026'da PHP'de meydana gelen güvenlik açığı
2026-10-21 20:43:49 UTCKittyTeggiewbsetclaim-updateimage (P18)
2026-10-21 20:43:13 UTCKittyTeggiewbsetclaim-updateimage (P18)
2026-10-21 20:42:43 UTCKittyTeggiewbsetclaim-updateimage (P18)
2026-10-21 20:36:59 UTCKittyTeggiewbsetclaim-updateimage (P18)
2026-10-21 20:35:25 UTCKittyTeggiewbsetclaim-createlogo image (P154)
2026-10-21 18:23:03 UTCAschmidtwbsetclaim-createCommons category (P373)
2026-10-21 18:22:48 UTCAschmidtwbsetsitelink-addCategory:PHP2Shell
2026-10-21 17:10:06 UTCPantheraLeo1359531wbsetclaim-updateinstance of (P31)
2026-10-21 16:59:50 UTCQuillQuasarwbsetreference-addhas effect (P1542)
2026-10-21 16:59:20 UTCQuillQuasarwbsetreference-addsignificant event (P793)
2026-10-21 16:58:55 UTCQuillQuasarwbsetreference-adddiscoverer or inventor (P61)
2026-10-21 16:58:30 UTCQuillQuasarwbsetreference-adddiscoverer or inventor (P61)
2026-10-21 16:58:10 UTCQuillQuasarwbsetreference-adddiscoverer or inventor (P61)
2026-10-21 16:57:42 UTCQuillQuasarwbsetreference-addCommon Vulnerabilities and Exposures ID (P3587)
2026-10-21 16:57:20 UTCQuillQuasarwbsetreference-addCommon Vulnerabilities and Exposures ID (P3587)
2026-10-21 16:56:58 UTCQuillQuasarwbsetclaim-createtime of discovery or invention (P575)
2026-10-21 16:22:00 UTC~2026-56623-42wbsetsitelink-addPHP2Shell
2026-10-21 16:16:34 UTCMitte27wbsetsitelink-addPHP2Shell
2026-10-21 15:59:25 UTCJake Parkwbsetsitelink-addPHP2Shell
2026-10-21 15:55:27 UTCElLutzowbsetdescription-setSicherheitslücke in PHP aus dem Jahr 2026
2026-10-21 15:35:23 UTCJoalpewbsetsitelink-addPHP2Shell
2026-10-21 14:44:46 UTCAniolwbsetdescription-addVulnerabilitat de seguretat del 2026 a PHP
2026-10-21 14:44:46 UTCAniolwbsetlabel-addPHP2Shell
2026-10-21 14:43:46 UTCAniolwblinktitles-connectenwiki:PHP2Shell, cawiki:PHP2Shell
2026-10-21 14:32:43 UTCWd-Ryanwbsetclaim-createhas use (P366)
2026-10-21 14:31:00 UTCWd-Ryanwbsetclaim-creatediscoverer or inventor (P61)
2026-10-21 14:28:12 UTCWd-Ryanwbsetclaim-creatediscoverer or inventor (P61)
2026-10-21 14:28:07 UTCWd-Ryanwbsetclaim-creatediscoverer or inventor (P61)
2026-10-21 14:24:37 UTCWd-Ryanwbsetclaim-updatesignificant event (P793)
2026-10-21 14:24:20 UTCWd-Ryanwbsetclaim-updatesignificant event (P793)
2026-10-21 14:24:03 UTCWd-Ryanwbsetclaim-createsignificant event (P793)
2026-10-21 14:23:34 UTCWd-Ryanwbsetclaim-updateinstance of (P31)
2026-10-21 14:21:06 UTCSamoasambiawbsetclaim-createofficial website (P856)
2026-10-21 13:57:59 UTCUndefinedRachelwbsetclaim-createdescribed at URL (P973)
2026-10-21 13:57:28 UTCUndefinedRachelwbsetclaim-createdescribed at URL (P973)
2026-10-21 13:56:59 UTCUndefinedRachelwbsetaliases-addGHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp
2026-10-21 13:56:29 UTCUndefinedRachelwbsetaliases-addCVE-2026-109618, CVE-2026-109619
2026-10-21 13:21:38 UTCPsychpsyowbsetdescription-add2026 Sicherheitslücke in PHP
2026-10-21 13:21:38 UTCPsychpsyowbsetdescription-add2026 security vulnerability in PHP
2026-10-21 13:02:45 UTCPsychpsyowbsetclaim-updateuses (P2283)
2026-10-21 13:02:24 UTCPsychpsyowbsetclaim-updateannouncement date (P6949)
2026-10-21 12:39:28 UTCNMaiawbsetclaim-createimage (P18)
2026-10-21 12:38:43 UTCNMaiawbsetlabel-addPHP2Shell
2026-10-21 12:32:48 UTCLofhiwbsetdescription-addfailles de sécurité dans PHP
2026-10-21 12:32:48 UTCLofhiwbsetlabel-addPHP2Shell
2026-10-21 12:05:27 UTCLofhiwbsetsitelink-addPHP2Shell
2026-10-21 11:18:00 UTCM2k~dewikiwbsetsitelink-addPHP2Shell
2026-10-21 10:39:49 UTCScikingwbsetsitelink-addPHP2Shell
2026-10-21 09:51:11 UTCSamoasambiawbsetclaim-createuses (P2283)
2026-10-21 09:50:35 UTCSamoasambiawbsetclaim-createannouncement date (P6949)
2026-10-21 09:49:21 UTCSamoasambiawbsetclaim-createhas effect (P1542)
2026-10-21 09:48:51 UTCSamoasambiawbsetclaim-createCommon Vulnerabilities and Exposures ID (P3587)
2026-10-21 09:48:43 UTCSamoasambiawbsetclaim-createCommon Vulnerabilities and Exposures ID (P3587)
2026-10-21 09:48:29 UTCSamoasambiawbsetclaim-createinstance of (P31)
2026-10-21 09:48:21 UTCSamoasambiawbeditentity-createPHP2Shell

The text is Wikipedia's, CC BY-SA 4.0, by its contributors.