Story written here by this site, signed and dated. By the journalist Research or story?
View · the state of affairs · what changed
What changed between v3 and v4
From 24 October 2026, 12:30 UTC to 27 October 2026, 03:45 UTC: 2 of 16 measures changed, and the text gained 13 lines and lost 15.
v3 site v0.14.25 · evidence vault 1f38e70921b2 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 24 October 2026, 08:37 UTC
v4 site v0.22.43 · evidence vault 24f0b0e22666 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 27 October 2026, 00:45 UTC
← v3 in full · v4 in full → · every version
The measures, side by side
| Measure | v3 | v4 | |
|---|---|---|---|
| Organisations confirming a compromise through php2shell | 0 | 0 | unchanged |
| Named incidents whose link to php2shell is still open | 3 open, 1 ruled out | 3 open, 1 ruled out | unchanged |
| Security vendors' claims of a successful compromise, and what became of them | 1 made and withdrawn (Sophos); Patchstack's reports not reconciled | 1 made and withdrawn (Sophos); Patchstack's reports not reconciled | unchanged |
| Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog | 0 | 2 | changed |
| NIST's own score in the National Vulnerability Database | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | unchanged |
| EPSS: chance of exploitation activity in the next 30 days | 0.058 and 0.053, about the 93rd percentile for both | 0.058 and 0.053, about the 93rd percentile for both | unchanged |
| Public GitHub repositories matching 'php2shell' | 735 (586 at 17:51 UTC on 22 October) | 735 (586 at 17:51 UTC on 22 October) | unchanged |
| Merged Metasploit modules naming php2shell | 0 | 0 | unchanged |
| NCSC-NL inventory: products fixed, of all listed | 109 of 751 | 109 of 751 | unchanged |
| NCSC-NL inventory: products still under investigation | 389 | 389 | unchanged |
| Security and network vendors' products confirmed vulnerable | 10 vulnerable, 26 not, 16 under investigation | 10 vulnerable, 26 not, 16 under investigation | unchanged |
| PHP servers that disclose their version running an end-of-life branch | about 758,000 of 1.1 million | about 758,000 of 1.1 million | unchanged |
| A national count of servers still affected after the fix | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | unchanged |
| Sites that went dark over php2shell, and how many are still dark | 51 listed, 50 back, 1 still dark (French prefecture websites) | 51 listed, 50 back, 1 still dark (French prefecture websites) | unchanged |
| National authorities saying they know of no successful exploitation in their country | 6 (adding the Netherlands) | 5 (the US leaves: CISA lists both CVEs as exploited) | changed |
| Sources in the evidence vault, and the latest capture | 328, latest capture 24 Oct 08:37 UTC | 328, latest capture 24 Oct 08:37 UTC | unchanged |
The text, line by line
Removed lines are struck through, added lines are marked; within an edited line, the words that changed.
## The line
php2shell is threenow daysofficially oldexploited, and still has no confirmednamed victim. What moved since version 2 is the other sideOne of the ledger:two alead claimmeasures ofmoved: successCISA's thatKnown Exploited Vulnerabilities catalog went from neither CVE to both. The other did notnot: survive,no and more sectors saying, in public, that nothingorganisation has happenedsaid toit themwas yet.compromised Thethrough evidencethese vaultflaws. holds 328 sources, 33 more thanThis version 2,changes only what follows from the curator'slisting; twoevery wakesother thismeasure morning.is carried from version 3 with its own as-of time.
## Compromise:Exploitation: noneon confirmed,CISA's and one claim withdrawnlist
What it establishes: CISA holds evidence that the flaws are exploited. The firstalert claimsays ofan addition "must have a successfulCVE compromise by a security vendor has been withdrawn. Sophos, in a correction issued at 21:21 UTC on 22 October and reported by Cyber Security News, said its customer data showed scanning and a small number of failed exploit attempts and noID, evidence of aexploitation, and clear mitigation guidance". [[cisa-alert-kev-20261026]] It supersedes CISA's alert of 21 October, which said it "has not observed exploitation of these vulnerabilities as of the time of publication", so the US leaves the count of authorities that know of no successful compromise.exploitation, Onewhich attemptfalls triedfrom six to deliverfive. Potassium,[[cisa-alert-php-20261021]] The due date binds only US federal civilian agencies under BOD 26-04; the alert encourages every organisation to prioritise the catalog. "Unknown" in the ransomware field is the catalog's value, neither a likely Mirai botnet variant; it was blocked. [[cybersecuritynews-critical-php2shell-exploit-code]] Patchstack's two accounts, reportsfinding of incidentsransomware fromuse hostingnor partnersa andfinding telemetrythat showingthere onlyis probing,none. are[[cisa-alert-kev-20261026, still not reconciled. [[recordedfuture-php2shell, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]]cisa-kev-json]]
## Exploitation:Compromise: publicstill code,none no weaponisation markersnamed
## Offline
More organisations that took sites down are in the record: in Switzerland, the EPFL, Basel-Stadt's administration, the University of Geneva and the insurer La Mobilière. [[24heures-php2shell-qui-est-affecte-par-la-faille]] All of them describe precautions.
The other measures were not re-checked for this version and keep their own as-of times: the named incidents still open (ČVUT, GMO, DMM), the scores, the public code, the NCSC-NL inventory, the offline count and the vault count of version 3.
## What this version changed on the site
The no-compromiseclaims claimthat said neither CVE is in KEV (cisa-none, kev-precedent) are kept as dated and itsmarked evidencesuperseded; pagethe arestory's asexploitation paragraph, the journalist's briefing, the exploitation row of 08:3721 UTCOctober, CISA's row on 24the October;agencies page, the 222026 newKEV claimscount from(now the vault are reviewed, 14 noted or agreeing, 6 used and274, 2 held back (a Check Point figure whose "impacted" is undefined, and a Chinese summary's account of whichthem model Calif used);php2shell) and the verdicttimeline oncarry the 22.6 million figure is revised inlisting; the opencompromise onpage's [thelist claimsof waitingwhat would change its statement no longer waits for review](/claims/review/index.html).a KEV listing; and the reader-question article "Has anyone actually been hacked through php2shell?" has a dated update.
2 unchanged lines
- A named organisation confirming a compromise, most likely from its own search.
- A KEV listing,CISA, or anyone, naming a mergedvictim, Metasploitor module.the updated PHP alert saying what evidence CISA holds.
- PatchstackA reconcilingmerged itsMetasploit two accounts.module.
- The NCSC-NL inventory moving again.