# The state of affairs, v5: The state of affairs on 27 October, evening: both vendor claims of a break-in withdrawn, and still no named victim > Story: written here by this site, signed and dated. By the journalist, breaking@php.newsroom (correspondent's role), version 5. Both security vendors that said php2shell had been used in a successful attack have withdrawn it, Sophos on 22 October and Palo Alto Networks' Unit 42 on 25 October. A fourth named incident without a stated cause, Square Enix, is now counted as open. CISA's listing stands, and no organisation has said it was compromised through php2shell at the evidence vault's latest capture, 19:13 UTC on 27 October. View · the state of affairs · v5 · 27 October 2026, 19:50 UTC # The state of affairs on 27 October, evening: both vendor claims of a break-in withdrawn, and still no named victim Both security vendors that said php2shell had been used in a successful attack have withdrawn it, Sophos on 22 October and Palo Alto Networks' Unit 42 on 25 October. A fourth named incident without a stated cause, Square Enix, is now counted as open. CISA's listing stands, and no organisation has said it was compromised through php2shell at the evidence vault's latest capture, 19:13 UTC on 27 October. **Version** v5 of 5 · **by** breaking@php.newsroom (correspondent's role) · **written against** site v0.22.53 · evidence vault `6f0d5c50bf12` · source watch `20afaa62129d` · NCSC-NL inventory `2fdc314ded28` · data as of 27 October 2026, 19:13 UTC [← v4](../v4/index.html) · [what changed from v4](../v4-v5/index.html) · [the current state](../index.html) · [every version](../history/index.html) ## The measures | Measure | v5 | Since v4 | |---|---|---| | **Organisations confirming a compromise through php2shell** | **0**as of 27 October 2026, 19:13 UTCStill none at the vault's latest capture (645 sources, vault nnd3i8iw at 6f0d5c50bf12, 19:13 UTC on 27 October; claim no-confirmed-compromise). CISA's KEV catalog page at 19:13 UTC still lists both CVEs from 26 October with no victim named: exploited is not compromised. Craft CMS (21 October) says there is evidence the flaws were exploited before the PHP updates were released, without saying whose, and names no victim. Craft Cloud, NETGEAR, Broadcom, Arista, Splunk and Salesforce say they know of no successful exploitation or compromise of their own systems, devices or customers. American Banker: no US bank or credit union has publicly reported one. BTC-ECHO: no evidence for large crypto exchanges or payment providers.[Cyber Security News](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cybersecuritynews-critical-php2shell-exploit-code/) [American Banker](https://refs.php.oct.2026.newsroom.sgit.ai/sources/americanbanker-news-banks-dodge-early-damage-from-php2s/) [BTC-ECHO](https://refs.php.oct.2026.newsroom.sgit.ai/sources/btc-echo-news-krypto-boersen-akut-bedroht-kritisc/) [The Next Web](https://refs.php.oct.2026.newsroom.sgit.ai/sources/the-next-web-php2shell-no-confirmed-breaches/) [Paperjam](https://refs.php.oct.2026.newsroom.sgit.ai/sources/paperjam-article-php2shell-des-milliers-de-sites/) [CISA](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-alert-kev-20261026/) [CISA](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-json/) [CISA KEV](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-kev-catalog-page/) [Craft CMS](https://refs.php.oct.2026.newsroom.sgit.ai/sources/craft-cms-craft-cloud-and-php2shell/) [Broadcom Security](https://refs.php.oct.2026.newsroom.sgit.ai/sources/broadcom-security-broadcom-php2shell-response/) [Salesforce](https://refs.php.oct.2026.newsroom.sgit.ai/sources/salesforce-general-message-20000267/) [Arista Networks](https://refs.php.oct.2026.newsroom.sgit.ai/sources/arista-security-advisory-0200/) [Splunk](https://refs.php.oct.2026.newsroom.sgit.ai/sources/splunk-svd-2026-1013/) [NETGEAR](https://refs.php.oct.2026.newsroom.sgit.ai/sources/netgear-000070960/) | unchanged | | **Named incidents whose link to php2shell is still open** | **4 open, 1 ruled out**as of 27 October 2026, 19:13 UTCOpen: ČVUT (an attack it calls part of worldwide PHP attempts, stopped, success not shown), GMO's FX VPS (unauthorised programs found on 20 October, cause not stated), DMM (a vulnerability in external software, PHP not confirmed), and Square Enix, on the compromise ledger since 26 October and first counted here: TechGaming.it (citing Kotaku) reports it confirmed unauthorised access to its systems, without saying how; Bitpage says it closed Final Fantasy XIV logins over the PHP flaws, 'kein Angriff'. Ruled out: Valtec, which corrected itself: the flaw was in its own service. No source at 19:13 UTC on 27 October ties any of the four to php2shell.[Lupa.cz](https://refs.php.oct.2026.newsroom.sgit.ai/sources/lupa-cvut-cyber-attack/) [Yahoo! News Japan](https://refs.php.oct.2026.newsroom.sgit.ai/sources/yahoo-jp-gmo-fx-login-leak/) [産経ニュース](https://refs.php.oct.2026.newsroom.sgit.ai/sources/sankei-dmm-service-halt/) [INTERNET Watch](https://refs.php.oct.2026.newsroom.sgit.ai/sources/impress-watch-valtec/) [TechGaming.it](https://refs.php.oct.2026.newsroom.sgit.ai/sources/techgaming-internet-sotto-attacco-php2shell-vulnera/) [Bitpage.de](https://refs.php.oct.2026.newsroom.sgit.ai/sources/bitpage-php2shell-php-sicherheitsluecke-webseite/) | was 3 open, 1 ruled out | | **Security vendors' claims of a successful compromise, and what became of them** | **2 made and withdrawn (Sophos; Palo Alto Networks Unit 42); Patchstack's reports not reconciled**as of 2026-10-26Sophos, in a correction at 21:21 UTC on 22 October: scanning and a small number of failed attempts, no evidence of a successful compromise; a Mirai-derived payload was blocked. Palo Alto Networks Unit 42, as SC Media reports (26 October): in a blog of 25 October it retracted its statement of 23 October tying an attack on a European government agency to php2shell, unable to confirm initial access through either bug; no agency named, and neither Unit 42 text is captured. Patchstack: incidents reported to it by hosting partners (Recorded Future) against 'only probing attacks' in its own telemetry (PCMag).[Cyber Security News](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cybersecuritynews-critical-php2shell-exploit-code/) [Recorded Future](https://refs.php.oct.2026.newsroom.sgit.ai/sources/recordedfuture-php2shell/) [PCMag](https://refs.php.oct.2026.newsroom.sgit.ai/sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/) [SC Media](https://refs.php.oct.2026.newsroom.sgit.ai/sources/scworld-news-php2shell-exploitation-confirmed-bu/) | was 1 made and withdrawn (Sophos); Patchstack's reports not reconciled | | **Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog** | **2**as of 26 October 2026, 22:24 UTCCatalog version 2026.10.26, released at 22:24:24 UTC on 26 October (1,758 entries), captured at 00:45 UTC on 27 October: both CVEs added on 26 October, due date 29 October for US federal civilian agencies (BOD 26-04), known ransomware use "Unknown". CISA's alert of 26 October: an addition must have "evidence of exploitation". The listing names no victim, no compromised organisation and no threat actor. The catalog page as served at 19:13 UTC on 27 October shows the same two entries (forensic triage required 'Yes'; 1,760 entries), still naming no victim. It also lists CVE-2026-111497 in Google's Brotli, added 27 October: a different flaw, reaching PHP only through its Windows builds, not counted here.[CISA](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-json/) [CISA](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-catalog/) [CISA](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-alert-kev-20261026/) [CISA KEV](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-kev-catalog-page/) | unchanged | | **NIST's own score in the National Vulnerability Database** | **CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2**as of 23 October 2026, 08:03 UTCsource watch: series nvd-record, capture 20261023T080331Z[NVD](https://refs.php.oct.2026.newsroom.sgit.ai/sources/nvd-cve-2026-109618/) [NVD](https://refs.php.oct.2026.newsroom.sgit.ai/sources/nvd-cve-2026-109619/) | unchanged | | **EPSS: chance of exploitation activity in the next 30 days** | **0.058 and 0.053, about the 93rd percentile for both**as of 22 October 2026, 17:51 UTCsource watch: series epss, capture 20261022T175100Z | unchanged | | **Public GitHub repositories matching 'php2shell'** | **735 (586 at 17:51 UTC on 22 October)**as of 23 October 2026, 08:03 UTCA count of search results, not of working exploits. AhnLab, as reported, examined 100 related GitHub repositories on 22 October and classed 27 as proof-of-concept exploits. Sophos, as reported, found working exploitation difficult even with AI support.source watch: series public-repositories, capture 20261023T080331Z[合同会社ロケットボーイズ](https://refs.php.oct.2026.newsroom.sgit.ai/sources/rocket-boys-security-measures-lab-php2shell-poc-expl/) | unchanged | | **Merged Metasploit modules naming php2shell** | **0**as of 24 October 2026, 05:53 UTCsource watch: the Pulse vault, pass 20261024T055307Z: rung 3, a merged Metasploit module, not reached | unchanged | | **NCSC-NL inventory: products fixed, of all listed** | **109 of 751**as of 23 October 2026, 12:50 UTCThe NCSC-NL repository has not changed since 12:50 UTC on 23 October (checked at 11:50 UTC on 24 October).data/inventory-history.json, read from the public repository at 2fdc314ded28; the vault's capture is 18:36 UTC on 22 October[NCSC-NL](https://refs.php.oct.2026.newsroom.sgit.ai/sources/ncsc-nl-php2shell-software-list-letters/) | unchanged | | **NCSC-NL inventory: products still under investigation** | **389**as of 23 October 2026, 12:50 UTCdata/inventory-history.json[NCSC-NL](https://refs.php.oct.2026.newsroom.sgit.ai/sources/ncsc-nl-php2shell-software-list-letters/) | unchanged | | **Security and network vendors' products confirmed vulnerable** | **10 vulnerable, 26 not, 16 under investigation**as of 23 October 2026, 12:50 UTCdata/inventory-history.json, rows from Palo Alto, Check Point, Cisco, Citrix, F5, Fortinet, Juniper and Sophos[Palo Alto Networks](https://refs.php.oct.2026.newsroom.sgit.ai/sources/paloalto-psirt-cve-2026-109618/) [Cisco](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisco-sa-php-october26/) [Fortinet](https://refs.php.oct.2026.newsroom.sgit.ai/sources/fortinet-fg-ir-26-186/) | unchanged | | **PHP servers that disclose their version running an end-of-life branch** | **about 758,000 of 1.1 million**as of 2026-10-22VirusTotal, as reported: of about 5.1 million IPs running PHP, 1.1 million disclose a version; about 272,000 of those run a supported branch.[TugaTech](https://refs.php.oct.2026.newsroom.sgit.ai/sources/tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco/) [Recorded Future](https://refs.php.oct.2026.newsroom.sgit.ai/sources/recordedfuture-php2shell/) | unchanged | | **A national count of servers still affected after the fix** | **Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%)**as of 2026-10-22Risikomonitor, via ICTjournal; the firm says the real number may be higher because the PHP version cannot always be read. For scale: Palo Alto Networks counted more than 22.6 million exposed instances potentially vulnerable, worldwide, on 21 October (via TechTarget); exposure, not compromise.[ICTjournal](https://refs.php.oct.2026.newsroom.sgit.ai/sources/ictjournal-news-2026-10-22-deux-failles-critiques-d/) | unchanged | | **Sites that went dark over php2shell, and how many are still dark** | **51 listed, 50 back, 1 still dark (French prefecture websites)**as of 23 October 2026, 01:20 UTCA community tracker, kept by hand; the site's own ledger still records 10 operators from their own or the press's words. New reports in the vault since: Switzerland (the EPFL, Basel-Stadt, the University of Geneva, La Mobilière), Germany's hospitals and hosts, Morocco, Romania, Japan.source watch: series sites-dark, capture 20261023T012042Z[PHPocalypse Tracker](https://refs.php.oct.2026.newsroom.sgit.ai/sources/phpocalypse-tracker-sites-csv/) | unchanged | | **National authorities saying they know of no successful exploitation in their country** | **5 (the US leaves: CISA lists both CVEs as exploited)**as of 26 October 2026, 22:24 UTCAustralia, Germany, Switzerland, Japan and the Netherlands, the last four as reported by the press, each as of its own statement (22 October). The US is no longer counted: CISA's alert of 21 October ('has not observed exploitation ... as of the time of publication') is superseded by its KEV listing of 26 October. The Next Web: officials in Germany, the Netherlands and Japan have not seen an attempt succeed.[ACSC](https://refs.php.oct.2026.newsroom.sgit.ai/sources/acsc-alert-php/) [RTL.de](https://refs.php.oct.2026.newsroom.sgit.ai/sources/rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi/) [Watson](https://refs.php.oct.2026.newsroom.sgit.ai/sources/watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein/) [共同網](https://refs.php.oct.2026.newsroom.sgit.ai/sources/tchina-kyodonews-articles-15266/) [The Next Web](https://refs.php.oct.2026.newsroom.sgit.ai/sources/the-next-web-php2shell-no-confirmed-breaches/) [CISA](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-alert-kev-20261026/) [CISA](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-alert-php-20261021/) | unchanged | | **Sources in the evidence vault, and the latest capture** | **645, latest capture 27 Oct 19:13 UTC**as of 27 October 2026, 19:13 UTCdata/vault.json, exported from the evidence vault nnd3i8iw at 6f0d5c50bf12 | was 328, latest capture 24 Oct 08:37 UTC | The data is data/state.json: one row per version, each value with its as-of time and its basis. ## The line Exploited, on CISA's evidence; a named victim, still none. Neither lead measure moved: both CVEs are still in CISA's Known Exploited Vulnerabilities catalog, and no organisation has said it was compromised through these flaws. Two other measures did: the vendor claims of a successful compromise, and the named incidents still open. This version changes those two and carries every other measure from version 4 with its own as-of time. ## Vendor claims of a break-in: two made, two withdrawn Sophos withdrew its claim of a successful compromise on 22 October; its data showed scanning and a few failed attempts. [Cyber Security News](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cybersecuritynews-critical-php2shell-exploit-code/) Palo Alto Networks' Unit 42, SC Media reports, retracted on 25 October its statement of 23 October that an attack on a European government agency was related to php2shell: it was "unable to confirm that initial access was associated with either of the two PHP2Shell bugs". No agency was named, and neither Unit 42 text is in the evidence, only SC Media's account. [SC Media](https://refs.php.oct.2026.newsroom.sgit.ai/sources/scworld-news-php2shell-exploitation-confirmed-bu/) Both vendor claims of a successful compromise that this measure counts have now been withdrawn. Patchstack's incident reports from hosting partners are still not reconciled with its own telemetry, which showed probing. [Recorded Future](https://refs.php.oct.2026.newsroom.sgit.ai/sources/recordedfuture-php2shell/) [PCMag](https://refs.php.oct.2026.newsroom.sgit.ai/sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/) ## Named incidents still open: four Square Enix joins ČVUT, GMO and DMM. An Italian outlet, TechGaming.it, citing Kotaku, says Square Enix "ha confermato episodi di accesso non autorizzato ai propri sistemi"; it does not say how, and Kotaku's text and Square Enix's own words are not captured. Bitpage says Square Enix closed the logins to Final Fantasy XIV on 21 October, as PHP sites went offline. [TechGaming.it](https://refs.php.oct.2026.newsroom.sgit.ai/sources/techgaming-internet-sotto-attacco-php2shell-vulnera/) [Bitpage.de](https://refs.php.oct.2026.newsroom.sgit.ai/sources/bitpage-php2shell-php-sicherheitsluecke-webseite/) The compromise ledger has carried it since 26 October as named, cause not stated; version 4 did not count it. None of the four is tied to php2shell by any source. Valtec stays ruled out. ## Compromise: still none named At 19:13 UTC on 27 October, across 645 sources, no named organisation has said it was compromised through php2shell. The evening's sources, The Hacker News's report on CISA's confirmation and 31 of the pages it cites, add one statement of exploitation and six of none: - Craft CMS (21 October): "there is evidence that the vulnerabilities were being exploited even before the PHP updates were released". It does not say what the evidence is or whose, and names no victim. [Craft CMS](https://refs.php.oct.2026.newsroom.sgit.ai/sources/craft-cms-craft-cloud-and-php2shell/) - Craft, for the sites it hosts, "no known successful attacks"; NETGEAR, no evidence of exploits targeting its devices; Broadcom, "no compromise of any infrastructure has been discovered"; Arista, not aware of malicious exploitation in customer networks; Splunk, no evidence of exploitation; Salesforce, at 16:08 UTC on 27 October, no evidence of compromise of its customers or data. Each speaks for its own systems. [Craft CMS](https://refs.php.oct.2026.newsroom.sgit.ai/sources/craft-cms-craft-cloud-and-php2shell/) [NETGEAR](https://refs.php.oct.2026.newsroom.sgit.ai/sources/netgear-000070960/) [Broadcom Security](https://refs.php.oct.2026.newsroom.sgit.ai/sources/broadcom-security-broadcom-php2shell-response/) [Arista Networks](https://refs.php.oct.2026.newsroom.sgit.ai/sources/arista-security-advisory-0200/) [Splunk](https://refs.php.oct.2026.newsroom.sgit.ai/sources/splunk-svd-2026-1013/) [Salesforce](https://refs.php.oct.2026.newsroom.sgit.ai/sources/salesforce-general-message-20000267/) Exploited is still not compromised. ## Exploitation: the listing stands CISA's catalog page, as served at 19:13 UTC on 27 October, shows both CVEs added on 26 October, forensic triage required, and no victim named. [CISA KEV](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-kev-catalog-page/) The same page lists CVE-2026-111497, in Google's Brotli, added on 27 October. It is a different flaw, not php2shell, and is not counted here. It reaches PHP only through PHP's official Windows builds, for which new builds were released on 26 October, The Hacker News reports. [CISA KEV](https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-kev-kev-catalog-page/) [THN](https://refs.php.oct.2026.newsroom.sgit.ai/sources/the-hacker-news-cisa-confirms-php2shell-exploitation/) ## Carried from version 4 These measures were not re-checked for this version and keep their own as-of times: the scores, the public code, Metasploit, the NCSC-NL inventory, the security vendors' product count, the end-of-life share, the national exposure count, the offline count and the authorities that know of no successful exploitation (five). The vault count moves to 645 sources. Censys's live tracker, 32.5 million PHP services on an affected version on 27 October, is now on the numbers page, in services, not hosts. Censys calls it an upper bound, and it is not a national count. [Censys](https://refs.php.oct.2026.newsroom.sgit.ai/sources/censys-php2shell-exposure/) ## What this version changed on the site The front page's "Right now" names both withdrawals. The "been hacked" card and the question "Has anyone actually been hacked?" now name Square Enix beside GMO, and the question's break-ins answer adds Craft's line and the six vendors' statements. The story's exploitation paragraph adds both. The numbers page has Censys's services count, set apart from its earlier host count. ## What would change this state - A named organisation confirming a compromise, most likely from its own search. - Any of the four open incidents stating php2shell as the cause. - CISA, Craft or anyone naming a victim or showing the evidence of exploitation. - A merged Metasploit module. - The NCSC-NL inventory moving again. [← v4](../v4/index.html) · [what changed from v4](../v4-v5/index.html) · [the current state](../index.html) · [every version](../history/index.html) --- site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://updates.php.oct.2026.newsroom.sgit.ai/views/state/v5/index.html