Story written here by this site, signed and dated. By the journalist Research or story?
View · the state of affairs · what changed
What changed between v5 and v6
From 27 October 2026, 19:50 UTC to 29 October 2026, 01:53 UTC: 2 of 16 measures changed, and the text gained 26 lines and lost 16.
v5 site v0.22.53 · evidence vault 6f0d5c50bf12 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 27 October 2026, 19:13 UTC
v6 site v0.22.63 · evidence vault 6c07e190d81e · source watch f203ac4e2bb8 · NCSC-NL inventory 2fdc314ded28 · data as of 29 October 2026, 00:09 UTC
← v5 in full · v6 in full → · every version
The measures, side by side
| Measure | v5 | v6 | |
|---|---|---|---|
| Organisations confirming a compromise through php2shell | 0 | 0 | unchanged |
| Named incidents whose link to php2shell is still open | 4 open, 1 ruled out | 4 open, 1 ruled out | unchanged |
| Security vendors' claims of a successful compromise, and what became of them | 2 made and withdrawn (Sophos; Palo Alto Networks Unit 42); Patchstack's reports not reconciled | 3 made: 2 withdrawn (Sophos; Palo Alto Networks Unit 42), 1 reported and not confirmed (Dream Research, unnamed victims); Patchstack's reports not reconciled | changed |
| Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog | 2 | 2 | unchanged |
| NIST's own score in the National Vulnerability Database | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 | unchanged |
| EPSS: chance of exploitation activity in the next 30 days | 0.058 and 0.053, about the 93rd percentile for both | 0.058 and 0.053, about the 93rd percentile for both | unchanged |
| Public GitHub repositories matching 'php2shell' | 735 (586 at 17:51 UTC on 22 October) | 735 (586 at 17:51 UTC on 22 October) | unchanged |
| Merged Metasploit modules naming php2shell | 0 | 0 | unchanged |
| NCSC-NL inventory: products fixed, of all listed | 109 of 751 | 109 of 751 | unchanged |
| NCSC-NL inventory: products still under investigation | 389 | 389 | unchanged |
| Security and network vendors' products confirmed vulnerable | 10 vulnerable, 26 not, 16 under investigation | 10 vulnerable, 26 not, 16 under investigation | unchanged |
| PHP servers that disclose their version running an end-of-life branch | about 758,000 of 1.1 million | about 758,000 of 1.1 million | unchanged |
| A national count of servers still affected after the fix | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) | unchanged |
| Sites that went dark over php2shell, and how many are still dark | 51 listed, 50 back, 1 still dark (French prefecture websites) | 51 listed, 50 back, 1 still dark (French prefecture websites) | unchanged |
| National authorities saying they know of no successful exploitation in their country | 5 (the US leaves: CISA lists both CVEs as exploited) | 5 (the US leaves: CISA lists both CVEs as exploited) | unchanged |
| Sources in the evidence vault, and the latest capture | 645, latest capture 27 Oct 19:13 UTC | 681, latest capture 29 Oct 00:09 UTC | changed |
The text, line by line
Removed lines are struck through, added lines are marked; within an edited line, the words that changed.
## The line
Exploited, on CISA's evidence; compromised, reported by one vendor and not confirmed; a named victim, still none. NeitherThe lead measure moved:for botha CVEsnamed arevictim stilldid innot CISA's Known Exploited Vulnerabilities catalog, andmove: no organisation has said it was compromised through these flaws. TwoWhat othermoved measuresis did:what stands beside it: for the vendorfirst claims oftime a successfulvendor compromise,reports andvictims, the named incidents still open.unnamed. This version changes thosethat, twoand the vendor-claims measure it belongs to, and carries every other measure from version 45 with its own as-of time.
## VendorSince claimsversion of a break-in: two made, two withdrawn5
Sophos withdrew its claim of a successful compromise on 22 October; its data showed scanning and a few failed attempts. [[cybersecuritynews-critical-php2shell-exploit-code]] Palo Alto Networks' Unit 42, SC Media reports, retracted on 25 October its statement of 23 October that an attack on a European government agency was related to php2shell: it was "unable to confirm that initial access was associated with either of the two PHP2Shell bugs". No agency was named, and neither Unit 42 text is in the evidence, only SC Media's account. [[scworld-news-php2shell-exploitation-confirmed-bu]] Both vendor claims of a successful compromise that this measure counts have now been withdrawn. Patchstack's incident reports from hosting partners are still not reconciled with its own telemetry, which showed probing. [[recordedfuture-php2shell, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw]]
- The vault holds 681 sources at 00:09 UTC on 29 October (645 at version 5). The journalist's refreshes of 28 October, batches 25 to 28, found no new source naming an organisation compromised.
- Four sources are new for this version: Dream Research's post of 26 October, and The Hacker News, The Next Web and CyPro, all of 28 October, repeating it. They were captured at 00:07 to 00:09 UTC on 29 October. [[dreamgroup-chained-php2shell-roots-25-servers, the-hacker-news-thehackernews-php2shell-roots-25-s, the-next-web-php2shell-cisa-kev-dream-25-servers, cypro-php2shell-exploit-roots-firewalls]]
## NamedA incidentsvendor stillreports open:victims: fourreported, not confirmed
Square Enix joins ČVUT, GMO and DMM. An Italian outlet, TechGaming.it, citing Kotaku, says Square Enix "ha confermato episodi di accesso non autorizzato ai propri sistemi"; it does not say how, and Kotaku's text and Square Enix's own words are not captured. Bitpage says Square Enix closed the logins to Final Fantasy XIV on 21 October, as PHP sites went offline. [[techgaming-internet-sotto-attacco-php2shell-vulnera, bitpage-php2shell-php-sicherheitsluecke-webseite]] The compromise ledger has carried it since 26 October as named, cause not stated; version 4 did not count it. None of the four is tied to php2shell by any source. Valtec stays ruled out.
Dream Research, which sells the tooling it says it used, says a campaign chaining CVE-2026-109618 and CVE-2026-109619 with a Linux kernel flaw, CVE-2026-46300, rooted 25 servers in the United States, Japan, Taiwan and South Korea: 24 firewalls of a large vendor it does not name and one internal firewall-management server, three of them in one US government-affiliated environment. It dates its find to 25 October and its post to 26 October, says the vendor was notified, names no actor, and says it cannot tell whether its later steps against the organisation's directory worked. [[dreamgroup-chained-php2shell-roots-25-servers]]
What makes it a report and not a confirmation:
- One source. The Hacker News, The Next Web and CyPro repeat Dream; CyPro's bulletin ends "Originally reported by securityweek.com". Three outlets, one origin. [[the-hacker-news-thehackernews-php2shell-roots-25-s, cypro-php2shell-exploit-roots-firewalls]]
- No victim, no vendor, no evidence published. Dream's artifacts are not public, and no statement from the firewall vendor, CISA, the US organisation or the PHP team about these victims is in the evidence.
- The press's own caveats. The Next Web: "TNW has not independently verified Dream's findings." CyPro: other sources do not independently verify Dream's victim details, and SecurityWeek reported two servers at the organisation where Dream says three, a difference it calls unresolved. [[the-next-web-php2shell-cisa-kev-dream-25-servers, cypro-php2shell-exploit-roots-firewalls]]
- Dream's own text is loose on its count: whether the second government firewall is one of the 24 or the 25th is not clear from the page.
What it does match: the two php2shell CVE numbers are the ones in CISA's listing. The kernel flaw's number is in no CISA material in the evidence. [[cisa-kev-json]]
## Vendor claims of a break-in: three made, two withdrawn
Version 5 said both vendor claims of a successful compromise had been withdrawn: Sophos on 22 October and Palo Alto Networks' Unit 42 on 25 October. That stays true of those two. Dream's report of 26 October is a third claim of successful compromise by a vendor, not withdrawn and not confirmed. Patchstack's incident reports from hosting partners are still not reconciled with its own telemetry. [[cybersecuritynews-critical-php2shell-exploit-code, scworld-news-php2shell-exploitation-confirmed-bu, recordedfuture-php2shell]]
## Compromise: still none named
At 19:13 UTC on 27 October, across 645 sources, no named organisation has said it was compromised through php2shell. The evening's sources, The Hacker News's report on CISA's confirmation and 31 of the pages it cites, add one statement of exploitation and six of none:
- Craft CMS (21 October): "there is evidence that the vulnerabilities were being exploited even before the PHP updates were released". It does not say what the evidence is or whose, and names no victim. [[craft-cms-craft-cloud-and-php2shell]]
- Craft, for the sites it hosts, "no known successful attacks"; NETGEAR, no evidence of exploits targeting its devices; Broadcom, "no compromise of any infrastructure has been discovered"; Arista, not aware of malicious exploitation in customer networks; Splunk, no evidence of exploitation; Salesforce, at 16:08 UTC on 27 October, no evidence of compromise of its customers or data. Each speaks for its own systems. [[craft-cms-craft-cloud-and-php2shell, netgear-000070960, broadcom-security-broadcom-php2shell-response, arista-security-advisory-0200, splunk-svd-2026-1013, salesforce-general-message-20000267]]
Exploited is still not compromised.
At 00:09 UTC on 29 October, across 681 sources, no named organisation has said it was compromised through php2shell. A vendor's report of unnamed victims is not an organisation saying so, and it does not end that statement; the compromise page now carries it as a dated row beside the statement. Exploited is CISA's finding about the flaws; compromised needs a victim, or the vendor, or CISA, to say so.
## Exploitation: the listing stands
CISA's cataloglisting page,of both CVEs on 26 October stands as servedlast atcaptured 19:13(19:13 UTC on 27 October,October); showsThe bothNext CVEsWeb addedand CyPro describe it as in place on 2628 October,October. forensicIt triage required, andnames no victim named.and [[cisa-kev-kev-catalog-page]] The same page lists CVE-2026-111497, in Google's Brotli, added on 27 October. It is a different flaw,does not php2shell,confirm andDream's is not counted here. It reaches PHP only through PHP's official Windows builds, for which new builds were released on 26 October, The Hacker News reports.account. [[cisa-kev-kev-catalog-page, the-hacker-news-cisa-confirms-php2shell-exploitation]]the-next-web-php2shell-cisa-kev-dream-25-servers]]
## Carried from version 45
These measures were not re-checked for this version and keep their own as-of times: the named incidents still open (four, as of 19:13 UTC on 27 October), the scores, the public code, Metasploit, the NCSC-NL inventory, the security vendors' product count, the end-of-life share, the national exposure count, the offline count and the authorities that know of no successful exploitation (five). The vault count moves to 645 sources. Censys's live tracker, 32.5 million PHP services on an affected version on 27 October, is now on the numbers page, in services, not hosts. Censys calls it an upper bound, and it is not a national count. [[censys-php2shell-exposure]]
## What this version changed on the site
The front page's "Right now" names both withdrawals. The "been hacked" card and thereader question "Has anyone actually been hacked?"hacked nowthrough namephp2shell?" Squarehas Enixa besidedated GMO,update. The compromise page and the question'sstory break-inscarry answerDream's addsreport Craft'sas linereported, not confirmed. The "been hacked" answers on the front page and the six vendors' statements. The story's exploitation paragraph adds both. The numbersquestions page hasname Censys'sit servicesand count,move settheir apartas-of fromto its00:09 earlierUTC hoston count.29 October.
## What would change this state
- A named organisation, the firewall vendor, CISA or the US government-affiliated organisation confirming Dream's account.
- Dream publishing evidence others can check, or a second source that did not start from its post.
- A named organisation confirming a compromise, most likely from its own search.
- Any of the four open incidents stating php2shell as the cause.
- CISA, Craft or anyone naming a victim or showing the evidence of exploitation.
- A merged Metasploit module.
- The NCSC-NL inventory moving again.