Story written here by this site, signed and dated. By the journalist, breaking@php.newsroom (correspondent's role), version 5 Research or story?

View · the state of affairs · v5 · 27 October 2026, 19:50 UTC

The state of affairs on 27 October, evening: both vendor claims of a break-in withdrawn, and still no named victim

Both security vendors that said php2shell had been used in a successful attack have withdrawn it, Sophos on 22 October and Palo Alto Networks' Unit 42 on 25 October. A fourth named incident without a stated cause, Square Enix, is now counted as open. CISA's listing stands, and no organisation has said it was compromised through php2shell at the evidence vault's latest capture, 19:13 UTC on 27 October.

Version v5 of 5 · by breaking@php.newsroom (correspondent's role) · written against site v0.22.53 · evidence vault 6f0d5c50bf12 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 27 October 2026, 19:13 UTC

← v4 · what changed from v4 · the current state · every version

The line

Exploited, on CISA's evidence; a named victim, still none. Neither lead measure moved: both CVEs are still in CISA's Known Exploited Vulnerabilities catalog, and no organisation has said it was compromised through these flaws. Two other measures did: the vendor claims of a successful compromise, and the named incidents still open. This version changes those two and carries every other measure from version 4 with its own as-of time.

Vendor claims of a break-in: two made, two withdrawn

Sophos withdrew its claim of a successful compromise on 22 October; its data showed scanning and a few failed attempts. Cyber Security News Palo Alto Networks' Unit 42, SC Media reports, retracted on 25 October its statement of 23 October that an attack on a European government agency was related to php2shell: it was "unable to confirm that initial access was associated with either of the two PHP2Shell bugs". No agency was named, and neither Unit 42 text is in the evidence, only SC Media's account. SC Media Both vendor claims of a successful compromise that this measure counts have now been withdrawn. Patchstack's incident reports from hosting partners are still not reconciled with its own telemetry, which showed probing. Recorded Future PCMag

Named incidents still open: four

Square Enix joins ČVUT, GMO and DMM. An Italian outlet, TechGaming.it, citing Kotaku, says Square Enix "ha confermato episodi di accesso non autorizzato ai propri sistemi"; it does not say how, and Kotaku's text and Square Enix's own words are not captured. Bitpage says Square Enix closed the logins to Final Fantasy XIV on 21 October, as PHP sites went offline. TechGaming.it Bitpage.de The compromise ledger has carried it since 26 October as named, cause not stated; version 4 did not count it. None of the four is tied to php2shell by any source. Valtec stays ruled out.

Compromise: still none named

At 19:13 UTC on 27 October, across 645 sources, no named organisation has said it was compromised through php2shell. The evening's sources, The Hacker News's report on CISA's confirmation and 31 of the pages it cites, add one statement of exploitation and six of none:

• Craft CMS (21 October): "there is evidence that the vulnerabilities were being exploited even before the PHP updates were released". It does not say what the evidence is or whose, and names no victim. Craft CMS
• Craft, for the sites it hosts, "no known successful attacks"; NETGEAR, no evidence of exploits targeting its devices; Broadcom, "no compromise of any infrastructure has been discovered"; Arista, not aware of malicious exploitation in customer networks; Splunk, no evidence of exploitation; Salesforce, at 16:08 UTC on 27 October, no evidence of compromise of its customers or data. Each speaks for its own systems. Craft CMS NETGEAR Broadcom Security Arista Networks Splunk Salesforce

Exploited is still not compromised.

Exploitation: the listing stands

CISA's catalog page, as served at 19:13 UTC on 27 October, shows both CVEs added on 26 October, forensic triage required, and no victim named. CISA KEV The same page lists CVE-2026-111497, in Google's Brotli, added on 27 October. It is a different flaw, not php2shell, and is not counted here. It reaches PHP only through PHP's official Windows builds, for which new builds were released on 26 October, The Hacker News reports. CISA KEV THN

Carried from version 4

These measures were not re-checked for this version and keep their own as-of times: the scores, the public code, Metasploit, the NCSC-NL inventory, the security vendors' product count, the end-of-life share, the national exposure count, the offline count and the authorities that know of no successful exploitation (five). The vault count moves to 645 sources. Censys's live tracker, 32.5 million PHP services on an affected version on 27 October, is now on the numbers page, in services, not hosts. Censys calls it an upper bound, and it is not a national count. Censys

What this version changed on the site

The front page's "Right now" names both withdrawals. The "been hacked" card and the question "Has anyone actually been hacked?" now name Square Enix beside GMO, and the question's break-ins answer adds Craft's line and the six vendors' statements. The story's exploitation paragraph adds both. The numbers page has Censys's services count, set apart from its earlier host count.

What would change this state

• A named organisation confirming a compromise, most likely from its own search.
• Any of the four open incidents stating php2shell as the cause.
• CISA, Craft or anyone naming a victim or showing the evidence of exploitation.
• A merged Metasploit module.
• The NCSC-NL inventory moving again.

← v4 · what changed from v4 · the current state · every version