Story written here by this site, signed and dated. By the journalist Research or story?

View · the state of affairs · what changed

What changed between v4 and v5

From 27 October 2026, 03:45 UTC to 27 October 2026, 19:50 UTC: 3 of 16 measures changed, and the text gained 19 lines and lost 11.

v4 site v0.22.43 · evidence vault 24f0b0e22666 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 27 October 2026, 00:45 UTC
v5 site v0.22.53 · evidence vault 6f0d5c50bf12 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 27 October 2026, 19:13 UTC

← v4 in full · v5 in full → · every version

The measures, side by side

Measurev4v5
Organisations confirming a compromise through php2shell00unchanged
Named incidents whose link to php2shell is still open3 open, 1 ruled out4 open, 1 ruled outchanged
Security vendors' claims of a successful compromise, and what became of them1 made and withdrawn (Sophos); Patchstack's reports not reconciled2 made and withdrawn (Sophos; Palo Alto Networks Unit 42); Patchstack's reports not reconciledchanged
Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog22unchanged
NIST's own score in the National Vulnerability DatabaseCVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2unchanged
EPSS: chance of exploitation activity in the next 30 days0.058 and 0.053, about the 93rd percentile for both0.058 and 0.053, about the 93rd percentile for bothunchanged
Public GitHub repositories matching 'php2shell'735 (586 at 17:51 UTC on 22 October)735 (586 at 17:51 UTC on 22 October)unchanged
Merged Metasploit modules naming php2shell00unchanged
NCSC-NL inventory: products fixed, of all listed109 of 751109 of 751unchanged
NCSC-NL inventory: products still under investigation389389unchanged
Security and network vendors' products confirmed vulnerable10 vulnerable, 26 not, 16 under investigation10 vulnerable, 26 not, 16 under investigationunchanged
PHP servers that disclose their version running an end-of-life branchabout 758,000 of 1.1 millionabout 758,000 of 1.1 millionunchanged
A national count of servers still affected after the fixSwitzerland: just over 23,000 of nearly 690,000 servers (about 3.5%)Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%)unchanged
Sites that went dark over php2shell, and how many are still dark51 listed, 50 back, 1 still dark (French prefecture websites)51 listed, 50 back, 1 still dark (French prefecture websites)unchanged
National authorities saying they know of no successful exploitation in their country5 (the US leaves: CISA lists both CVEs as exploited)5 (the US leaves: CISA lists both CVEs as exploited)unchanged
Sources in the evidence vault, and the latest capture328, latest capture 24 Oct 08:37 UTC645, latest capture 27 Oct 19:13 UTCchanged

The text, line by line

Removed lines are struck through, added lines are marked; within an edited line, the words that changed.

## The line
php2shellExploited, ison nowCISA's officiallyevidence; exploited,a andnamed victim, still hasnone. no named victim. One of the twoNeither lead measuresmeasure moved: both CVEs are still in CISA's Known Exploited Vulnerabilities catalogcatalog, went from neither CVE to both. The other did not:and no organisation has said it was compromised through these flaws. Two other measures did: the vendor claims of a successful compromise, and the named incidents still open. This version changes onlythose whattwo followsand from the listing;carries every other measure is carried from version 34 with its own as-of time.
## Exploitation:Vendor onclaims CISA'sof lista break-in: two made, two withdrawn
CISA'sSophos alertwithdrew its claim of 26a successful compromise on 22 October; its data showed scanning and a few failed attempts. [[cybersecuritynews-critical-php2shell-exploit-code]] Palo Alto Networks' Unit 42, SC Media reports, retracted on 25 October saysits statement of 23 October that an attack on a European government agency was related to php2shell: it "haswas added"unable to confirm that initial access was associated with either of the two newPHP2Shell vulnerabilitiesbugs". toNo agency was named, and neither Unit 42 text is in the evidence, only SC Media's account. [[scworld-news-php2shell-exploitation-confirmed-bu]] Both vendor claims of a successful compromise that this measure counts have now been withdrawn. Patchstack's incident reports from hosting partners are still not reconciled with its Knownown Exploitedtelemetry, Vulnerabilitieswhich (KEV)showed Catalog":probing. CVE-2026-109618[[recordedfuture-php2shell, and CVE-2026-109619. The catalog's version 2026.10.26, released at 22:24 UTC on 26 October and captured by the newsroom at 00:45 UTC on 27 October, lists both with the date added 26 October, a due date of 29 October and known ransomware use "Unknown". [[cisa-alert-kev-20261026, cisa-kev-json, cisa-kev-catalog]]pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]]
What## itNamed establishes:incidents CISAstill holdsopen: evidence that the flaws are exploited. The alert says an addition "must have a CVE ID, evidence of exploitation, and clear mitigation guidance". [[cisa-alert-kev-20261026]] It supersedes CISA's alert of 21 October, which said it "has not observed exploitation of these vulnerabilities as of the time of publication", so the US leaves the count of authorities that know of no successful exploitation, which falls from six to five. [[cisa-alert-php-20261021]] The due date binds only US federal civilian agencies under BOD 26-04; the alert encourages every organisation to prioritise the catalog. "Unknown" in the ransomware field is the catalog's value, neither a finding of ransomware use nor a finding that there is none. [[cisa-alert-kev-20261026, cisa-kev-json]]four
TheSquare lastEnix joins ČVUT, GMO and DMM. An Italian outlet, TechGaming.it, citing Kotaku, says Square Enix "ha confermato episodi di accesso non autorizzato ai propri sistemi"; it does not say how, and Kotaku's text and Square Enix's own words are not captured. Bitpage says Square Enix closed the logins to Final Fantasy XIV on 21 October, as PHP coresites flaw,went CVE-2024-4577,offline. was[[techgaming-internet-sotto-attacco-php2shell-vulnera, listedbitpage-php2shell-php-sicherheitsluecke-webseite]] threeThe dayscompromise afterledger disclosure;has thiscarried oneit wassince listed26 fiveOctober daysas afternamed, cause not stated; version 4 did not count it. None of the fixesfour ofis 21tied October.to [[akamai-blog-cve-2024-4577-one-day,php2shell cisa-kev-json]]by any source. Valtec stays ruled out.
## Compromise: still none named
WhatAt the19:13 listingUTC doeson not27 establish:October, aacross victim.645 The alert and the two catalog entries namesources, no compromised organisation, no threat actor and no ransomware campaign. [[cisa-alert-kev-20261026, cisa-kev-catalog]] No named organisation has said it was compromised through php2shellphp2shell. atThe evening's sources, The Hacker News's report on CISA's confirmation and 31 of the vault'spages latestit capture,cites, 00:45add UTCone onstatement 27of October, across 562 sources. Exploited is CISA's finding about the flaws; compromised would need an organisation saying so,exploitation and nonesix has.of Sophos's withdrawn claim and the sectors that report nothing, in version 3, stand. [[cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s]]none:
CISA says it also updated its PHP alert of 21 October. The newsroom's capture of that alert predates the update, so what the new text says is not yet in the evidence.
- Craft CMS (21 October): "there is evidence that the vulnerabilities were being exploited even before the PHP updates were released". It does not say what the evidence is or whose, and names no victim. [[craft-cms-craft-cloud-and-php2shell]]
- Craft, for the sites it hosts, "no known successful attacks"; NETGEAR, no evidence of exploits targeting its devices; Broadcom, "no compromise of any infrastructure has been discovered"; Arista, not aware of malicious exploitation in customer networks; Splunk, no evidence of exploitation; Salesforce, at 16:08 UTC on 27 October, no evidence of compromise of its customers or data. Each speaks for its own systems. [[craft-cms-craft-cloud-and-php2shell, netgear-000070960, broadcom-security-broadcom-php2shell-response, arista-security-advisory-0200, splunk-svd-2026-1013, salesforce-general-message-20000267]]
##Exploited Carriedis fromstill versionnot 3compromised.
The other measures were not re-checked for this version and keep their own as-of times: the named incidents still open (ČVUT, GMO, DMM), the scores, the public code, the NCSC-NL inventory, the offline count and the vault count of version 3.
## Exploitation: the listing stands
CISA's catalog page, as served at 19:13 UTC on 27 October, shows both CVEs added on 26 October, forensic triage required, and no victim named. [[cisa-kev-kev-catalog-page]] The same page lists CVE-2026-111497, in Google's Brotli, added on 27 October. It is a different flaw, not php2shell, and is not counted here. It reaches PHP only through PHP's official Windows builds, for which new builds were released on 26 October, The Hacker News reports. [[cisa-kev-kev-catalog-page, the-hacker-news-cisa-confirms-php2shell-exploitation]]
## Carried from version 4
These measures were not re-checked for this version and keep their own as-of times: the scores, the public code, Metasploit, the NCSC-NL inventory, the security vendors' product count, the end-of-life share, the national exposure count, the offline count and the authorities that know of no successful exploitation (five). The vault count moves to 645 sources. Censys's live tracker, 32.5 million PHP services on an affected version on 27 October, is now on the numbers page, in services, not hosts. Censys calls it an upper bound, and it is not a national count. [[censys-php2shell-exposure]]
## What this version changed on the site
The claimsfront thatpage's said"Right neithernow" CVEnames isboth inwithdrawals. KEVThe (cisa-none,"been kev-precedent)hacked" are kept as dated and marked superseded; the story's exploitation paragraph, the journalist's briefing, the exploitation row of 21 October, CISA's row on the agencies page, the 2026 KEV count (now 274, 2 of them php2shell)card and the timeline carry the listing; the compromise page's list of what would change its statement no longer waits for a KEV listing; and the reader-question articlequestion "Has anyone actually been hackedhacked?" throughnow php2shell?"name Square Enix beside GMO, and the question's break-ins answer adds Craft's line and the six vendors' statements. The story's exploitation paragraph adds both. The numbers page has aCensys's datedservices update.count, set apart from its earlier host count.
2 unchanged lines
- A named organisation confirming a compromise, most likely from its own search.
- CISA, or anyone, naming a victim, or the updated PHP alert saying what evidence CISA holds.
- Any of the four open incidents stating php2shell as the cause.
- CISA, Craft or anyone naming a victim or showing the evidence of exploitation.
- A merged Metasploit module.
- The NCSC-NL inventory moving again.