# The state of affairs: what changed between v4 and v5

> Story: written here by this site, signed and dated. By the journalist.

The measures and the text of the state of affairs, v4 against v5.

View · the state of affairs · what changed

# What changed between v4 and v5

From 27 October 2026, 03:45 UTC to 27 October 2026, 19:50 UTC: 3 of 16 measures changed, and the text gained 19 lines and lost 11.

**v4** site v0.22.43 · evidence vault `24f0b0e22666` · source watch `20afaa62129d` · NCSC-NL inventory `2fdc314ded28` · data as of 27 October 2026, 00:45 UTC **v5** site v0.22.53 · evidence vault `6f0d5c50bf12` · source watch `20afaa62129d` · NCSC-NL inventory `2fdc314ded28` · data as of 27 October 2026, 19:13 UTC

[← v4 in full](../v4/index.html) · [v5 in full →](../v5/index.html) · [every version](../history/index.html)

## The measures, side by side

| Measure | v4 | v5 |  |
|---|---|---|---|
| **Organisations confirming a compromise through php2shell** | 0 | 0 | unchanged |
| **Named incidents whose link to php2shell is still open** | 3 open, 1 ruled out | 4 open, 1 ruled out | **changed** |
| **Security vendors' claims of a successful compromise, and what became of them** | 1 made and withdrawn (Sophos); Patchstack's reports not reconciled | 2 made and withdrawn (Sophos; Palo Alto Networks Unit 42); Patchstack's reports not reconciled | **changed** |
| **Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog** | 2 | 2 | unchanged |
| **NIST's own score in the National Vulnerability Database** | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | unchanged |
| **EPSS: chance of exploitation activity in the next 30 days** | 0.058 and 0.053, about the 93rd percentile for both | 0.058 and 0.053, about the 93rd percentile for both | unchanged |
| **Public GitHub repositories matching 'php2shell'** | 735 (586 at 17:51 UTC on 22 October) | 735 (586 at 17:51 UTC on 22 October) | unchanged |
| **Merged Metasploit modules naming php2shell** | 0 | 0 | unchanged |
| **NCSC-NL inventory: products fixed, of all listed** | 109 of 751 | 109 of 751 | unchanged |
| **NCSC-NL inventory: products still under investigation** | 389 | 389 | unchanged |
| **Security and network vendors' products confirmed vulnerable** | 10 vulnerable, 26 not, 16 under investigation | 10 vulnerable, 26 not, 16 under investigation | unchanged |
| **PHP servers that disclose their version running an end-of-life branch** | about 758,000 of 1.1 million | about 758,000 of 1.1 million | unchanged |
| **A national count of servers still affected after the fix** | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | unchanged |
| **Sites that went dark over php2shell, and how many are still dark** | 51 listed, 50 back, 1 still dark (French prefecture websites) | 51 listed, 50 back, 1 still dark (French prefecture websites) | unchanged |
| **National authorities saying they know of no successful exploitation in their country** | 5 (the US leaves: CISA lists both CVEs as exploited) | 5 (the US leaves: CISA lists both CVEs as exploited) | unchanged |
| **Sources in the evidence vault, and the latest capture** | 328, latest capture 24 Oct 08:37 UTC | 645, latest capture 27 Oct 19:13 UTC | **changed** |

## The text, line by line

Removed lines are struck through, added lines are marked; within an edited line, the words that changed.
## The linephp2shellExploited, ison nowCISA's officiallyevidence; exploited,a andnamed victim, still hasnone. no named victim. One of the twoNeither lead measuresmeasure moved: both CVEs are still in CISA's Known Exploited Vulnerabilities catalogcatalog, went from neither CVE to both. The other did not:and no organisation has said it was compromised through these flaws. Two other measures did: the vendor claims of a successful compromise, and the named incidents still open. This version changes onlythose whattwo followsand from the listing;carries every other measure is carried from version 34 with its own as-of time.## Exploitation:Vendor onclaims CISA'sof lista break-in: two made, two withdrawnCISA'sSophos alertwithdrew its claim of 26a successful compromise on 22 October; its data showed scanning and a few failed attempts. [[cybersecuritynews-critical-php2shell-exploit-code]] Palo Alto Networks' Unit 42, SC Media reports, retracted on 25 October saysits statement of 23 October that an attack on a European government agency was related to php2shell: it "haswas added"unable to confirm that initial access was associated with either of the two newPHP2Shell vulnerabilitiesbugs". toNo agency was named, and neither Unit 42 text is in the evidence, only SC Media's account. [[scworld-news-php2shell-exploitation-confirmed-bu]] Both vendor claims of a successful compromise that this measure counts have now been withdrawn. Patchstack's incident reports from hosting partners are still not reconciled with its Knownown Exploitedtelemetry, Vulnerabilitieswhich (KEV)showed Catalog":probing. CVE-2026-109618[[recordedfuture-php2shell, and CVE-2026-109619. The catalog's version 2026.10.26, released at 22:24 UTC on 26 October and captured by the newsroom at 00:45 UTC on 27 October, lists both with the date added 26 October, a due date of 29 October and known ransomware use "Unknown". [[cisa-alert-kev-20261026, cisa-kev-json, cisa-kev-catalog]]pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]]What## itNamed establishes:incidents CISAstill holdsopen: evidence that the flaws are exploited. The alert says an addition "must have a CVE ID, evidence of exploitation, and clear mitigation guidance". [[cisa-alert-kev-20261026]] It supersedes CISA's alert of 21 October, which said it "has not observed exploitation of these vulnerabilities as of the time of publication", so the US leaves the count of authorities that know of no successful exploitation, which falls from six to five. [[cisa-alert-php-20261021]] The due date binds only US federal civilian agencies under BOD 26-04; the alert encourages every organisation to prioritise the catalog. "Unknown" in the ransomware field is the catalog's value, neither a finding of ransomware use nor a finding that there is none. [[cisa-alert-kev-20261026, cisa-kev-json]]fourTheSquare lastEnix joins ČVUT, GMO and DMM. An Italian outlet, TechGaming.it, citing Kotaku, says Square Enix "ha confermato episodi di accesso non autorizzato ai propri sistemi"; it does not say how, and Kotaku's text and Square Enix's own words are not captured. Bitpage says Square Enix closed the logins to Final Fantasy XIV on 21 October, as PHP coresites flaw,went CVE-2024-4577,offline. was[[techgaming-internet-sotto-attacco-php2shell-vulnera, listedbitpage-php2shell-php-sicherheitsluecke-webseite]] threeThe dayscompromise afterledger disclosure;has thiscarried oneit wassince listed26 fiveOctober daysas afternamed, cause not stated; version 4 did not count it. None of the fixesfour ofis 21tied October.to [[akamai-blog-cve-2024-4577-one-day,php2shell cisa-kev-json]]by any source. Valtec stays ruled out.## Compromise: still none namedWhatAt the19:13 listingUTC doeson not27 establish:October, aacross victim.645 The alert and the two catalog entries namesources, no compromised organisation, no threat actor and no ransomware campaign. [[cisa-alert-kev-20261026, cisa-kev-catalog]] No named organisation has said it was compromised through php2shellphp2shell. atThe evening's sources, The Hacker News's report on CISA's confirmation and 31 of the vault'spages latestit capture,cites, 00:45add UTCone onstatement 27of October, across 562 sources. Exploited is CISA's finding about the flaws; compromised would need an organisation saying so,exploitation and nonesix has.of Sophos's withdrawn claim and the sectors that report nothing, in version 3, stand. [[cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s]]none:CISA says it also updated its PHP alert of 21 October. The newsroom's capture of that alert predates the update, so what the new text says is not yet in the evidence.- Craft CMS (21 October): "there is evidence that the vulnerabilities were being exploited even before the PHP updates were released". It does not say what the evidence is or whose, and names no victim. [[craft-cms-craft-cloud-and-php2shell]]- Craft, for the sites it hosts, "no known successful attacks"; NETGEAR, no evidence of exploits targeting its devices; Broadcom, "no compromise of any infrastructure has been discovered"; Arista, not aware of malicious exploitation in customer networks; Splunk, no evidence of exploitation; Salesforce, at 16:08 UTC on 27 October, no evidence of compromise of its customers or data. Each speaks for its own systems. [[craft-cms-craft-cloud-and-php2shell, netgear-000070960, broadcom-security-broadcom-php2shell-response, arista-security-advisory-0200, splunk-svd-2026-1013, salesforce-general-message-20000267]]##Exploited Carriedis fromstill versionnot 3compromised.The other measures were not re-checked for this version and keep their own as-of times: the named incidents still open (ČVUT, GMO, DMM), the scores, the public code, the NCSC-NL inventory, the offline count and the vault count of version 3.## Exploitation: the listing standsCISA's catalog page, as served at 19:13 UTC on 27 October, shows both CVEs added on 26 October, forensic triage required, and no victim named. [[cisa-kev-kev-catalog-page]] The same page lists CVE-2026-111497, in Google's Brotli, added on 27 October. It is a different flaw, not php2shell, and is not counted here. It reaches PHP only through PHP's official Windows builds, for which new builds were released on 26 October, The Hacker News reports. [[cisa-kev-kev-catalog-page, the-hacker-news-cisa-confirms-php2shell-exploitation]]## Carried from version 4These measures were not re-checked for this version and keep their own as-of times: the scores, the public code, Metasploit, the NCSC-NL inventory, the security vendors' product count, the end-of-life share, the national exposure count, the offline count and the authorities that know of no successful exploitation (five). The vault count moves to 645 sources. Censys's live tracker, 32.5 million PHP services on an affected version on 27 October, is now on the numbers page, in services, not hosts. Censys calls it an upper bound, and it is not a national count. [[censys-php2shell-exposure]]## What this version changed on the siteThe claimsfront thatpage's said"Right neithernow" CVEnames isboth inwithdrawals. KEVThe (cisa-none,"been kev-precedent)hacked" are kept as dated and marked superseded; the story's exploitation paragraph, the journalist's briefing, the exploitation row of 21 October, CISA's row on the agencies page, the 2026 KEV count (now 274, 2 of them php2shell)card and the timeline carry the listing; the compromise page's list of what would change its statement no longer waits for a KEV listing; and the reader-question articlequestion "Has anyone actually been hackedhacked?" throughnow php2shell?"name Square Enix beside GMO, and the question's break-ins answer adds Craft's line and the six vendors' statements. The story's exploitation paragraph adds both. The numbers page has aCensys's datedservices update.count, set apart from its earlier host count.2 unchanged lines- A named organisation confirming a compromise, most likely from its own search.- CISA, or anyone, naming a victim, or the updated PHP alert saying what evidence CISA holds.- Any of the four open incidents stating php2shell as the cause.- CISA, Craft or anyone naming a victim or showing the evidence of exploitation.- A merged Metasploit module.- The NCSC-NL inventory moving again.


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://updates.php.oct.2026.newsroom.sgit.ai/views/state/v4-v5/index.html