# The state of affairs: what changed between v3 and v4

> Story: written here by this site, signed and dated. By the journalist.

The measures and the text of the state of affairs, v3 against v4.

View · the state of affairs · what changed

# What changed between v3 and v4

From 24 October 2026, 12:30 UTC to 27 October 2026, 03:45 UTC: 2 of 16 measures changed, and the text gained 13 lines and lost 15.

**v3** site v0.14.25 · evidence vault `1f38e70921b2` · source watch `20afaa62129d` · NCSC-NL inventory `2fdc314ded28` · data as of 24 October 2026, 08:37 UTC **v4** site v0.22.43 · evidence vault `24f0b0e22666` · source watch `20afaa62129d` · NCSC-NL inventory `2fdc314ded28` · data as of 27 October 2026, 00:45 UTC

[← v3 in full](../v3/index.html) · [v4 in full →](../v4/index.html) · [every version](../history/index.html)

## The measures, side by side

| Measure | v3 | v4 |  |
|---|---|---|---|
| **Organisations confirming a compromise through php2shell** | 0 | 0 | unchanged |
| **Named incidents whose link to php2shell is still open** | 3 open, 1 ruled out | 3 open, 1 ruled out | unchanged |
| **Security vendors' claims of a successful compromise, and what became of them** | 1 made and withdrawn (Sophos); Patchstack's reports not reconciled | 1 made and withdrawn (Sophos); Patchstack's reports not reconciled | unchanged |
| **Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog** | 0 | 2 | **changed** |
| **NIST's own score in the National Vulnerability Database** | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | unchanged |
| **EPSS: chance of exploitation activity in the next 30 days** | 0.058 and 0.053, about the 93rd percentile for both | 0.058 and 0.053, about the 93rd percentile for both | unchanged |
| **Public GitHub repositories matching 'php2shell'** | 735 (586 at 17:51 UTC on 22 October) | 735 (586 at 17:51 UTC on 22 October) | unchanged |
| **Merged Metasploit modules naming php2shell** | 0 | 0 | unchanged |
| **NCSC-NL inventory: products fixed, of all listed** | 109 of 751 | 109 of 751 | unchanged |
| **NCSC-NL inventory: products still under investigation** | 389 | 389 | unchanged |
| **Security and network vendors' products confirmed vulnerable** | 10 vulnerable, 26 not, 16 under investigation | 10 vulnerable, 26 not, 16 under investigation | unchanged |
| **PHP servers that disclose their version running an end-of-life branch** | about 758,000 of 1.1 million | about 758,000 of 1.1 million | unchanged |
| **A national count of servers still affected after the fix** | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | unchanged |
| **Sites that went dark over php2shell, and how many are still dark** | 51 listed, 50 back, 1 still dark (French prefecture websites) | 51 listed, 50 back, 1 still dark (French prefecture websites) | unchanged |
| **National authorities saying they know of no successful exploitation in their country** | 6 (adding the Netherlands) | 5 (the US leaves: CISA lists both CVEs as exploited) | **changed** |
| **Sources in the evidence vault, and the latest capture** | 328, latest capture 24 Oct 08:37 UTC | 328, latest capture 24 Oct 08:37 UTC | unchanged |

## The text, line by line

Removed lines are struck through, added lines are marked; within an edited line, the words that changed.
## The linephp2shell is threenow daysofficially oldexploited, and still has no confirmednamed victim. What moved since version 2 is the other sideOne of the ledger:two alead claimmeasures ofmoved: successCISA's thatKnown Exploited Vulnerabilities catalog went from neither CVE to both. The other did notnot: survive,no and more sectors saying, in public, that nothingorganisation has happenedsaid toit themwas yet.compromised Thethrough evidencethese vaultflaws. holds 328 sources, 33 more thanThis version 2,changes only what follows from the curator'slisting; twoevery wakesother thismeasure morning.is carried from version 3 with its own as-of time.## Compromise:Exploitation: noneon confirmed,CISA's and one claim withdrawnlistNoCISA's namedalert organisationof has26 saidOctober says it was"has compromisedadded throughtwo php2shell,new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog": CVE-2026-109618 and CVE-2026-109619. The catalog's version 2026.10.26, released at the vault's latest capture, 08:3722:24 UTC on 2426 October. The three named cases that were open (ČVUT, GMOOctober and DMM)captured areby stillthe open;newsroom noat new00:45 sourceUTC changeson them.27 [[lupa-cvut-cyber-attack,October, yahoo-jp-gmo-fx-login-leak,lists sankei-dmm-service-halt]]both with the date added 26 October, a due date of 29 October and known ransomware use "Unknown". [[cisa-alert-kev-20261026, cisa-kev-json, cisa-kev-catalog]]What it establishes: CISA holds evidence that the flaws are exploited. The firstalert claimsays ofan addition "must have a successfulCVE compromise by a security vendor has been withdrawn. Sophos, in a correction issued at 21:21 UTC on 22 October and reported by Cyber Security News, said its customer data showed scanning and a small number of failed exploit attempts and noID, evidence of aexploitation, and clear mitigation guidance". [[cisa-alert-kev-20261026]] It supersedes CISA's alert of 21 October, which said it "has not observed exploitation of these vulnerabilities as of the time of publication", so the US leaves the count of authorities that know of no successful compromise.exploitation, Onewhich attemptfalls triedfrom six to deliverfive. Potassium,[[cisa-alert-php-20261021]] The due date binds only US federal civilian agencies under BOD 26-04; the alert encourages every organisation to prioritise the catalog. "Unknown" in the ransomware field is the catalog's value, neither a likely Mirai botnet variant; it was blocked. [[cybersecuritynews-critical-php2shell-exploit-code]] Patchstack's two accounts, reportsfinding of incidentsransomware fromuse hostingnor partnersa andfinding telemetrythat showingthere onlyis probing,none. are[[cisa-alert-kev-20261026, still not reconciled. [[recordedfuture-php2shell, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]]cisa-kev-json]]SectorsThe arelast nowPHP sayingcore soflaw, inCVE-2024-4577, public.was Americanlisted Banker:three "nodays U.S.after bankdisclosure; orthis creditone unionwas haslisted publiclyfive reporteddays a compromise". [[americanbanker-news-banks-dodge-early-damage-from-php2s]] BTC-ECHO: no evidence that large crypto exchanges or payment providers were compromised. [[btc-echo-news-krypto-boersen-akut-bedroht-kritisc]] Officials in Germany,after the Netherlands and Japan say they have not seen an attempt succeed. [[the-next-web-php2shell-no-confirmed-breaches]] Each is an absencefixes of reports21 atOctober. a[[akamai-blog-cve-2024-4577-one-day, point in time, not a finding that nothing happened, and the advice of version 2 stands: the answer will come from operators searching their own systems. [[paperjam-article-php2shell-des-milliers-de-sites]]cisa-kev-json]]## Exploitation:Compromise: publicstill code,none no weaponisation markersnamedPublicWhat proof-of-conceptthe codelisting isdoes available,not establish: a victim. The alert and attackersthe havetwo triedcatalog toentries usename itno tocompromised buildorganisation, botnets;no Sophosthreat says its own researchers found working exploitation difficult, even with AI support. [[cybersecuritynews-critical-php2shell-exploit-code]] Neither CVE was in CISA's Known Exploited Vulnerabilities catalog,actor and no Metasploitransomware modulecampaign. had[[cisa-alert-kev-20261026, beencisa-kev-catalog]] merged,No named organisation has said it was compromised through php2shell at the Pulse vault's checklatest atcapture, 05:5300:45 UTC today,on 27 October, across 562 sources. Exploited is CISA's finding about the freshestflaws; checkcompromised would need an organisation saying so, and none has. Sophos's withdrawn claim and the sectors that report nothing, in anyversion vault3, thisstand. desk[[cybersecuritynews-critical-php2shell-exploit-code, reads. [[cisa-kev-json]] The last PHP core flaw was listed within three days; today is the third day after this one. [[akamai-blog-cve-2024-4577-one-day]]americanbanker-news-banks-dodge-early-damage-from-php2s]]##CISA Exposuresays andit patchingalso updated its PHP alert of 21 October. The newsroom's capture of that alert predates the update, so what the new text says is not yet in the evidence.The## 22.6Carried millionfrom figureversion that circulated without a basis is Palo Alto Networks' count of exposed instances potentially vulnerable, made on 21 October, now attributed in two captured reports; it counts exposure, not compromise. [[techtarget-cybersecurity-news-366652444-php2shell-2, insurancebusiness-uk-councils-met]] The NCSC-NL inventory has not changed since 12:50 UTC yesterday: 109 of 751 products fixed, 389 under investigation. [[ncsc-nl-php2shell-software-list-letters]]3## OfflineMore organisations that took sites down are in the record: in Switzerland, the EPFL, Basel-Stadt's administration, the University of Geneva and the insurer La Mobilière. [[24heures-php2shell-qui-est-affecte-par-la-faille]] All of them describe precautions.The other measures were not re-checked for this version and keep their own as-of times: the named incidents still open (ČVUT, GMO, DMM), the scores, the public code, the NCSC-NL inventory, the offline count and the vault count of version 3.## What this version changed on the siteThe no-compromiseclaims claimthat said neither CVE is in KEV (cisa-none, kev-precedent) are kept as dated and itsmarked evidencesuperseded; pagethe arestory's asexploitation paragraph, the journalist's briefing, the exploitation row of 08:3721 UTCOctober, CISA's row on 24the October;agencies page, the 222026 newKEV claimscount from(now the vault are reviewed, 14 noted or agreeing, 6 used and274, 2 held back (a Check Point figure whose "impacted" is undefined, and a Chinese summary's account of whichthem model Calif used);php2shell) and the verdicttimeline oncarry the 22.6 million figure is revised inlisting; the opencompromise onpage's [thelist claimsof waitingwhat would change its statement no longer waits for review](https://php.oct.2026.newsroom.sgit.ai/claims/review/).a KEV listing; and the reader-question article "Has anyone actually been hacked through php2shell?" has a dated update.2 unchanged lines- A named organisation confirming a compromise, most likely from its own search.- A KEV listing,CISA, or anyone, naming a mergedvictim, Metasploitor module.the updated PHP alert saying what evidence CISA holds.- PatchstackA reconcilingmerged itsMetasploit two accounts.module.- The NCSC-NL inventory moving again.


---
site v0.22.44 · data as of 2026-10-27T00:45Z · vault commit 24f0b0e22666 · https://updates.php.oct.2026.newsroom.sgit.ai/views/state/v3-v4/index.html