Story written here by this site, signed and dated. By the journalist, breaking@php.newsroom (correspondent's role), version 6 Research or story?
View · the state of affairs · v6 · 29 October 2026, 01:53 UTC
The state of affairs on 29 October: one vendor reports 25 servers rooted, unconfirmed, and still no named victim
Dream Research, a security vendor, reported on 26 October that a chain of the two php2shell flaws and a Linux kernel flaw rooted 25 servers, three in a US government-affiliated environment. It names no victim and no firewall vendor, publishes no evidence, and the three outlets that repeat it trace to its post; The Next Web says it has not verified it. It is carried as reported, not confirmed. No organisation has said it was compromised through php2shell at the evidence vault's latest capture, 00:09 UTC on 29 October.
Version v6 of 6 · by breaking@php.newsroom (correspondent's role) · written against site v0.22.63 · evidence vault 6c07e190d81e · source watch f203ac4e2bb8 · NCSC-NL inventory 2fdc314ded28 · data as of 29 October 2026, 00:09 UTC
← v5 · what changed from v5 · the current state · every version
The measures
| Measure | v6 | Since v5 |
|---|---|---|
| Organisations confirming a compromise through php2shell | 0 as of 29 October 2026, 00:09 UTC Still none at the vault's latest capture (681 sources, vault nnd3i8iw at 6c07e190d81e, 00:09 UTC on 29 October; claim no-confirmed-compromise). New beside it, and not counted here: Dream Research (26 October) reports 25 servers rooted, three in an unnamed US government-affiliated environment; it names no victim and no vendor and publishes no evidence, The Hacker News, The Next Web and CyPro repeat it as one source, and The Next Web says it has not independently verified it. A vendor's report of unnamed victims is not a named organisation saying it was compromised. CISA's KEV listing (26 October) names no victim: exploited is not compromised. Carried from version 5: Craft CMS (21 October) says there is evidence of exploitation before the fixes, naming no victim; Craft Cloud, NETGEAR, Broadcom, Arista, Splunk and Salesforce say they know of none in their own systems or customers; American Banker: no US bank or credit union has reported one; BTC-ECHO: no evidence for large crypto exchanges or payment providers. | unchanged |
| Named incidents whose link to php2shell is still open | 4 open, 1 ruled out as of 27 October 2026, 19:13 UTC Open: ČVUT (an attack it calls part of worldwide PHP attempts, stopped, success not shown), GMO's FX VPS (unauthorised programs found on 20 October, cause not stated), DMM (a vulnerability in external software, PHP not confirmed), and Square Enix, on the compromise ledger since 26 October and first counted here: TechGaming.it (citing Kotaku) reports it confirmed unauthorised access to its systems, without saying how; Bitpage says it closed Final Fantasy XIV logins over the PHP flaws, 'kein Angriff'. Ruled out: Valtec, which corrected itself: the flaw was in its own service. No source at 19:13 UTC on 27 October ties any of the four to php2shell. | unchanged |
| Security vendors' claims of a successful compromise, and what became of them | 3 made: 2 withdrawn (Sophos; Palo Alto Networks Unit 42), 1 reported and not confirmed (Dream Research, unnamed victims); Patchstack's reports not reconciled as of 29 October 2026, 00:09 UTC Sophos, in a correction at 21:21 UTC on 22 October: scanning and a small number of failed attempts, no evidence of a successful compromise; a Mirai-derived payload was blocked. Palo Alto Networks Unit 42, as SC Media reports (26 October): in a blog of 25 October it retracted its statement of 23 October tying an attack on a European government agency to php2shell, unable to confirm initial access through either bug; no agency named, and neither Unit 42 text is captured. Patchstack: incidents reported to it by hosting partners (Recorded Future) against 'only probing attacks' in its own telemetry (PCMag). Dream Research, in a post of 26 October (captured 00:07 UTC on 29 October): a chain of the two php2shell flaws and a Linux kernel flaw rooted 25 servers, three in a US government-affiliated environment; no victim or firewall vendor named, no evidence published, outcome of its later steps unknown to it. The Hacker News, The Next Web and CyPro (a relay of SecurityWeek, which says two servers where Dream says three) repeat it; The Next Web: 'TNW has not independently verified Dream's findings.' | was 2 made and withdrawn (Sophos; Palo Alto Networks Unit 42); Patchstack's reports not reconciled |
| Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog | 2 as of 26 October 2026, 22:24 UTC Catalog version 2026.10.26, released at 22:24:24 UTC on 26 October (1,758 entries), captured at 00:45 UTC on 27 October: both CVEs added on 26 October, due date 29 October for US federal civilian agencies (BOD 26-04), known ransomware use "Unknown". CISA's alert of 26 October: an addition must have "evidence of exploitation". The listing names no victim, no compromised organisation and no threat actor. The catalog page as served at 19:13 UTC on 27 October shows the same two entries (forensic triage required 'Yes'; 1,760 entries), still naming no victim. It also lists CVE-2026-111497 in Google's Brotli, added 27 October: a different flaw, reaching PHP only through its Windows builds, not counted here. Not re-captured for version 6: The Next Web and CyPro (28 October) describe the listing as in place; neither it nor they name a victim, and it does not confirm Dream Research's report. | unchanged |
| NIST's own score in the National Vulnerability Database | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 as of 23 October 2026, 08:03 UTC source watch: series nvd-record, capture 20261023T080331Z | unchanged |
| EPSS: chance of exploitation activity in the next 30 days | 0.058 and 0.053, about the 93rd percentile for both as of 22 October 2026, 17:51 UTC source watch: series epss, capture 20261022T175100Z | unchanged |
| Public GitHub repositories matching 'php2shell' | 735 (586 at 17:51 UTC on 22 October) as of 23 October 2026, 08:03 UTC A count of search results, not of working exploits. AhnLab, as reported, examined 100 related GitHub repositories on 22 October and classed 27 as proof-of-concept exploits. Sophos, as reported, found working exploitation difficult even with AI support. source watch: series public-repositories, capture 20261023T080331Z | unchanged |
| Merged Metasploit modules naming php2shell | 0 as of 24 October 2026, 05:53 UTC source watch: the Pulse vault, pass 20261024T055307Z: rung 3, a merged Metasploit module, not reached | unchanged |
| NCSC-NL inventory: products fixed, of all listed | 109 of 751 as of 23 October 2026, 12:50 UTC The NCSC-NL repository has not changed since 12:50 UTC on 23 October (checked at 11:50 UTC on 24 October). data/inventory-history.json, read from the public repository at 2fdc314ded28; the vault's capture is 18:36 UTC on 22 October | unchanged |
| NCSC-NL inventory: products still under investigation | 389 as of 23 October 2026, 12:50 UTC data/inventory-history.json | unchanged |
| Security and network vendors' products confirmed vulnerable | 10 vulnerable, 26 not, 16 under investigation as of 23 October 2026, 12:50 UTC data/inventory-history.json, rows from Palo Alto, Check Point, Cisco, Citrix, F5, Fortinet, Juniper and Sophos | unchanged |
| PHP servers that disclose their version running an end-of-life branch | about 758,000 of 1.1 million as of 2026-10-22 VirusTotal, as reported: of about 5.1 million IPs running PHP, 1.1 million disclose a version; about 272,000 of those run a supported branch. | unchanged |
| A national count of servers still affected after the fix | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) as of 2026-10-22 Risikomonitor, via ICTjournal; the firm says the real number may be higher because the PHP version cannot always be read. For scale: Palo Alto Networks counted more than 22.6 million exposed instances potentially vulnerable, worldwide, on 21 October (via TechTarget); exposure, not compromise. | unchanged |
| Sites that went dark over php2shell, and how many are still dark | 51 listed, 50 back, 1 still dark (French prefecture websites) as of 23 October 2026, 01:20 UTC A community tracker, kept by hand; the site's own ledger still records 10 operators from their own or the press's words. New reports in the vault since: Switzerland (the EPFL, Basel-Stadt, the University of Geneva, La Mobilière), Germany's hospitals and hosts, Morocco, Romania, Japan. source watch: series sites-dark, capture 20261023T012042Z | unchanged |
| National authorities saying they know of no successful exploitation in their country | 5 (the US leaves: CISA lists both CVEs as exploited) as of 26 October 2026, 22:24 UTC Australia, Germany, Switzerland, Japan and the Netherlands, the last four as reported by the press, each as of its own statement (22 October). The US is no longer counted: CISA's alert of 21 October ('has not observed exploitation ... as of the time of publication') is superseded by its KEV listing of 26 October. The Next Web: officials in Germany, the Netherlands and Japan have not seen an attempt succeed. | unchanged |
| Sources in the evidence vault, and the latest capture | 681, latest capture 29 Oct 00:09 UTC as of 29 October 2026, 00:09 UTC data/vault.json, exported from the evidence vault nnd3i8iw at 6c07e190d81e | was 645, latest capture 27 Oct 19:13 UTC |
The data is data/state.json: one row per version, each value with its as-of time and its basis.
The line
Exploited, on CISA's evidence; compromised, reported by one vendor and not confirmed; a named victim, still none. The lead measure for a named victim did not move: no organisation has said it was compromised through these flaws. What moved is what stands beside it: for the first time a vendor reports victims, unnamed. This version changes that, and the vendor-claims measure it belongs to, and carries every other measure from version 5 with its own as-of time.
Since version 5
- The vault holds 681 sources at 00:09 UTC on 29 October (645 at version 5). The journalist's refreshes of 28 October, batches 25 to 28, found no new source naming an organisation compromised.
- Four sources are new for this version: Dream Research's post of 26 October, and The Hacker News, The Next Web and CyPro, all of 28 October, repeating it. They were captured at 00:07 to 00:09 UTC on 29 October. Dream Research THN The Next Web CyPro
A vendor reports victims: reported, not confirmed
Dream Research, which sells the tooling it says it used, says a campaign chaining CVE-2026-109618 and CVE-2026-109619 with a Linux kernel flaw, CVE-2026-46300, rooted 25 servers in the United States, Japan, Taiwan and South Korea: 24 firewalls of a large vendor it does not name and one internal firewall-management server, three of them in one US government-affiliated environment. It dates its find to 25 October and its post to 26 October, says the vendor was notified, names no actor, and says it cannot tell whether its later steps against the organisation's directory worked. Dream Research
What makes it a report and not a confirmation:
- One source. The Hacker News, The Next Web and CyPro repeat Dream; CyPro's bulletin ends "Originally reported by securityweek.com". Three outlets, one origin. THN CyPro
- No victim, no vendor, no evidence published. Dream's artifacts are not public, and no statement from the firewall vendor, CISA, the US organisation or the PHP team about these victims is in the evidence.
- The press's own caveats. The Next Web: "TNW has not independently verified Dream's findings." CyPro: other sources do not independently verify Dream's victim details, and SecurityWeek reported two servers at the organisation where Dream says three, a difference it calls unresolved. The Next Web CyPro
- Dream's own text is loose on its count: whether the second government firewall is one of the 24 or the 25th is not clear from the page.
What it does match: the two php2shell CVE numbers are the ones in CISA's listing. The kernel flaw's number is in no CISA material in the evidence. CISA
Vendor claims of a break-in: three made, two withdrawn
Version 5 said both vendor claims of a successful compromise had been withdrawn: Sophos on 22 October and Palo Alto Networks' Unit 42 on 25 October. That stays true of those two. Dream's report of 26 October is a third claim of successful compromise by a vendor, not withdrawn and not confirmed. Patchstack's incident reports from hosting partners are still not reconciled with its own telemetry. Cyber Security News SC Media Recorded Future
Compromise: still none named
At 00:09 UTC on 29 October, across 681 sources, no named organisation has said it was compromised through php2shell. A vendor's report of unnamed victims is not an organisation saying so, and it does not end that statement; the compromise page now carries it as a dated row beside the statement. Exploited is CISA's finding about the flaws; compromised needs a victim, or the vendor, or CISA, to say so.
Exploitation: the listing stands
CISA's listing of both CVEs on 26 October stands as last captured (19:13 UTC on 27 October); The Next Web and CyPro describe it as in place on 28 October. It names no victim and does not confirm Dream's account. CISA KEV The Next Web
Carried from version 5
These measures were not re-checked for this version and keep their own as-of times: the named incidents still open (four, as of 19:13 UTC on 27 October), the scores, the public code, Metasploit, the NCSC-NL inventory, the security vendors' product count, the end-of-life share, the national exposure count, the offline count and the authorities that know of no successful exploitation (five).
What this version changed on the site
The reader question "Has anyone actually been hacked through php2shell?" has a dated update. The compromise page and the story carry Dream's report as reported, not confirmed. The "been hacked" answers on the front page and the questions page name it and move their as-of to 00:09 UTC on 29 October.
What would change this state
- A named organisation, the firewall vendor, CISA or the US government-affiliated organisation confirming Dream's account.
- Dream publishing evidence others can check, or a second source that did not start from its post.
- A named organisation confirming a compromise, most likely from its own search.
- Any of the four open incidents stating php2shell as the cause.
- A merged Metasploit module.
- The NCSC-NL inventory moving again.
← v5 · what changed from v5 · the current state · every version