{ "note": "The journalist's review of the claims in the evidence vault that are not in the site's claim table (data/claims.json). One row per reviewed claim: the verdict (used, agrees, held back), the reason, and the page it was reviewed for. A vault claim with no row here is shown on /claims/review/ as not yet reviewed, so a new export lists new claims without anyone editing a page.", "verdicts": { "used": "used on a page, attributed to its source", "agrees": "agrees with a claim the site already carries; not repeated", "held back": "not stated on the site as worded, for the reason given", "noted": "recorded and checked against its page, not used on a page yet; nothing on the site contradicts it" }, "author": "claude-journalist", "reviews": [ { "id": "cur3-jp-pm-emergency-order", "verdict": "held back", "reason": "One Vietnamese outlet. Reuters, CNN and USA Today, in the vault, describe Prime Minister Takaichi urging website operators on X to check for PHP and prepare to patch, and, in CNN's account, saying companies should consider suspending services: a request, not an order.", "sources": [ "rte-reuters-websites-go-dark", "cnn-php2shell-websites-shut", "usa-today-php2shell-live" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-22m-servers", "verdict": "agrees", "reason": "Revised on 24 October: held back on 23 October because TechTarget Japan gives no basis. TechTarget's English report (cur5-pan-22-6m-exposed) attributes the figure to Palo Alto Networks: \"more than 22.6 million exposed instances potentially vulnerable\". The site already carried it, from Palo Alto via Insurance Business (numbers page, n-22.6m). It counts exposed instances from scanning, not compromised servers.", "sources": [ "techtarget-cybersecurity-news-366652444-php2shell-2", "insurancebusiness-uk-councils-met" ], "where": "numbers/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur3-hns-confirmed-software", "verdict": "held back", "reason": "Help Net Security does not say who confirmed it. What the vault holds is researchers demonstrating code execution against these applications (Calif; Wiz for WordPress and Drupal), which is not attackers succeeding against someone.", "sources": [ "calif-php2shell" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur2-itw-2024", "verdict": "held back", "reason": "Unsourced. The earliest attempt in the record is Amazon's honeypot on 17 October 2026. A 2024 audit by Quarkslab found the out-of-memory issue without proving it exploitable, which may be where a 2024 date comes from.", "sources": [ "cyberpress-php2shell-exploits-predate-patches", "php-foundation-blog-security-release" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur2-ie-identified-20-oct", "verdict": "held back", "reason": "Contradicts the confirmed discovery by Calif on 1 August and its report to PHP on 11 August. 20 October is the day of PHP's advance notice and of the leak.", "sources": [ "calif-php2shell", "php-foundation-blog-security-release" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-openai-funded-audit", "verdict": "held back", "reason": "SiliconANGLE's own description of the August work, which the site records as found by researchers using frontier AI under OpenAI's initiative (claim ai-found). Not used, so that it is not confused with the 2024 Quarkslab audit.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur2-calif-august", "verdict": "agrees", "reason": "Agrees with the site's confirmed claim who-first (discovery 1 August, report to PHP 11 August).", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur2-clarin-14-year-old", "verdict": "held back", "reason": "'14 years' restates Wiz's lower bound, PHP 5.4 and later, as an age; it is one estimate restated, not an independent finding. Nobody in the vault names the commit that introduced the flaw. Which versions are affected is an explained contradiction on the fact-check desk.", "sources": [ "wiz-blog-php2shell" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-criticarad-since-2012", "verdict": "held back", "reason": "As for '14 years': Wiz's PHP 5.4 bound, restated as a year.", "sources": [ "wiz-blog-php2shell" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-ism-affected-5-4", "verdict": "agrees", "reason": "Agrees with Wiz's own post ('dating back to PHP 5.4'). The CVE records list only the supported branches; see the site's disputed claim versions-old.", "sources": [ "wiz-blog-php2shell" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur2-affected-5-4-to-8-5-11", "verdict": "agrees", "reason": "As above: Wiz's bound. Disputed against the CVE records in the site's claim versions-old.", "sources": [ "wiz-blog-php2shell" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-cloudflare-attempts", "verdict": "used", "reason": "Used in the state of affairs v2. The curator's note says Cloudflare's own figures are not in the vault; they are, in the chief executive's post on X (claim cf-millions).", "sources": [ "x-eastdakota-php2shell-stats" ], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-risikomonitor-swiss", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-ahnlab-27-pocs", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-lux-no-breach-announced", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-nl-kamervragen", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-wiz-memory-read", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-peru-cnsd-report", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur2-dgssi-bulletin", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur2-csa-sg-urged", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur3-kisa-cwe-and-alert", "verdict": "used", "reason": "Used in the state of affairs v2, attributed to the outlet that reports it, with its as-of date.", "sources": [], "where": "views/state/v2/index.html", "reviewed": "2026-10-23", "by": "claude-journalist" }, { "id": "cur5-pan-22-6m-exposed", "verdict": "used", "reason": "Checked against TechTarget's page. Added as a second source for the site's figure n-22.6m on the numbers page: exposed instances from Palo Alto's scanning.", "sources": [ "techtarget-cybersecurity-news-366652444-php2shell-2" ], "where": "numbers/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-mirai-variant-attempt", "verdict": "used", "reason": "Checked against the page: the observer is Sophos, which also withdrew an earlier success claim in a correction at 21:21 UTC on 22 October; its customer data showed scanning and a small number of failed attempts, the Mirai-derived payload (Potassium) blocked. Added to the compromise evidence as an attempt and as a party seeing no success.", "sources": [ "cybersecuritynews-critical-php2shell-exploit-code" ], "where": "compromise/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-us-banks-no-compromise", "verdict": "used", "reason": "Checked: \"no U.S. bank or credit union has publicly reported a compromise\". Added to the compromise evidence as an absence of reports at one time.", "sources": [ "americanbanker-news-banks-dodge-early-damage-from-php2s" ], "where": "compromise/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-crypto-no-evidence", "verdict": "used", "reason": "Checked: no evidence that large exchanges or payment providers were compromised, as of 22 October. Added to the compromise evidence as an absence of reports.", "sources": [ "btc-echo-news-krypto-boersen-akut-bedroht-kritisc" ], "where": "compromise/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-de-nl-jp-no-success", "verdict": "used", "reason": "Checked: the compromise evidence already carried this row from the source watch; it now cites the promoted copy.", "sources": [ "the-next-web-php2shell-no-confirmed-breaches" ], "where": "compromise/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-swiss-institutions", "verdict": "used", "reason": "Checked: 24 Heures names the EPFL among Swiss institutions affected. Added to the offline list as reported; the institutions' own statements are not in the vault.", "sources": [ "24heures-php2shell-qui-est-affecte-par-la-faille" ], "where": "impact/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-cloudflare-prince-ladder", "verdict": "agrees", "reason": "Agrees with the site's claim cf-millions, from the chief executive's own post.", "sources": [ "x-eastdakota-php2shell-stats" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-ncsc-nl-mod-php-risk", "verdict": "agrees", "reason": "Agrees with the site's confirmed claim rce-modphp.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-first-signs-2024", "verdict": "agrees", "reason": "Agrees with the site's confirmed claim quarkslab-2024 (a 2024 audit found the issue, no exploitation path, not fixed). The added detail that a 2020 bug report flagged the behaviour is Zitec's account of Calif and is not checked against Calif's own post.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-bbc-2024-potential-flaw", "verdict": "agrees", "reason": "Agrees with quarkslab-2024.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-checkpoint-10pct", "verdict": "held back", "reason": "A vendor statistic relayed by a commentary site: 'impacted' is not defined and Check Point's own report is not in the vault. Not stated until its basis is.", "sources": [ "areacucuta-php2shell-log4shell-a-la-velocidad-de-la" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-calif-gpt56-wiz-independent", "verdict": "held back", "reason": "Chinaz says Calif used GPT-5.6 Sol. On the site, Calif names no model and it is Wiz that names GPT-5.6 Sol among others (story, open questions). One Chinese summary is not enough to settle which model Calif used.", "sources": [ "chinaz-ainews-31789-shtml" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-jp-company-patch-0239", "verdict": "noted", "reason": "One company's press release: an example of operator response, not a measurement.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-synology-psirt", "verdict": "noted", "reason": "Agrees in substance with the NCSC-NL inventory, where Synology's packages are marked fixed; relayed by a distributor.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-openai-checker", "verdict": "noted", "reason": "A tool: the site does not link or run tools from captured pages.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-kr-pipc-guidance", "verdict": "noted", "reason": "Korea's data protection guidance, as reported; for the agencies refresh (pass step 2).", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-tr-cyber-directorate", "verdict": "noted", "reason": "Turkey's notice and national scans, as reported; for the agencies refresh (pass step 2).", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-kisa-advisory-21-oct", "verdict": "noted", "reason": "KISA's advisory of 21 October, as reported; the alert-level rise is already in the state of affairs v2.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur4-bsi-alarm", "verdict": "noted", "reason": "The BSI's warning, as reported; the BSI is already among the agencies.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-astra-free-tools", "verdict": "noted", "reason": "Vendor marketing for tools; not linked or run.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-nsa-advisory-21-oct", "verdict": "noted", "reason": "Agrees with the NSA's advice already on the site (offline-nsa).", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "cur5-qnap-opnsense-status", "verdict": "noted", "reason": "Point-in-time vendor status; the inventory carries the current state.", "sources": [], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "claude-journalist" }, { "id": "scale-70pc", "verdict": "agrees", "reason": "Wiz's figure as the BBC reports it, with the BBC saying it could not verify it; the site carries it as scale-70pc-internet in Wiz's own words.", "sources": [ "bbc-live-ckgel5xp2xv9t" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "two-vulns", "verdict": "noted", "reason": "The BBC page says two critical vulnerabilities; the CVE IDs are on the site from the PHP advisory (two-cves-9.2). The agent's note about needing the NSA post is met by nsa-press-php-4630238 in the vault.", "sources": [ "bbc-live-ckgel5xp2xv9t" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "most-severe-ai", "verdict": "agrees", "reason": "Same as claim most-severe on the site (Wiz's characterisation, attributed to Wiz).", "sources": [ "bbc-live-ckgel5xp2xv9t" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "impact-unauth", "verdict": "agrees", "reason": "Repeats rce-modphp; the NSA page in the vault says PHP2Shell \"could allow attackers to take control of affected web servers\".", "sources": [ "bbc-live-ckgel5xp2xv9t" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "offline-advice", "verdict": "agrees", "reason": "Same as offline-allies; the NSA (nsa-press-php-4630238) and NCSC (ncsc-news-php) pages in the vault carry the advice in their own words.", "sources": [ "bbc-live-ckgel5xp2xv9t" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cvut-attack-part-of-php-attempts", "verdict": "agrees", "reason": "Carried on data/compromise.json (named organisations) and counted in no-confirmed-compromise: ČVUT describes attempts and a stopped attack, not a confirmed compromise, and gives no cause.", "sources": [ "lupa-cvut-cyber-attack" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cvut-link-unclear", "verdict": "agrees", "reason": "Carried with the ČVUT row on data/compromise.json: Lupa.cz says a link to PHP2Shell is not clear.", "sources": [ "lupa-cvut-cyber-attack" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "gmo-fx-vps-compromise", "verdict": "agrees", "reason": "Checked against the J-CAST/Yahoo page: GMO says 26,739 server accounts may be affected (全角 digits in the text). Carried on data/compromise.json as a break-in with no stated cause; no-confirmed-compromise stands.", "sources": [ "yahoo-jp-gmo-fx-login-leak" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "gmo-fx-vps-cause-unstated", "verdict": "agrees", "reason": "Agrees with the GMO row on data/compromise.json: the article does not name PHP as the cause.", "sources": [ "yahoo-jp-gmo-fx-login-leak" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "dmm-external-software-vulnerability", "verdict": "agrees", "reason": "Carried on data/compromise.json: DMM names \"external software\", not PHP.", "sources": [ "sankei-dmm-service-halt" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "dmm-no-php-confirmation", "verdict": "agrees", "reason": "Carried with the DMM row on data/compromise.json.", "sources": [ "sankei-dmm-service-halt" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "valtec-php-attack", "verdict": "agrees", "reason": "Carried on data/compromise.json as retracted: Valtec withdrew its PHP attribution the same day. Not stated on the site as a PHP compromise.", "sources": [ "impress-watch-valtec" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "valtec-own-service-flaw", "verdict": "agrees", "reason": "Carried on data/compromise.json: Valtec's correction, a flaw in its own service.", "sources": [ "impress-watch-valtec" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "bsi-no-exploitation", "verdict": "noted", "reason": "dpa wire via RTL: the BSI had found no exploitation so far, a point-in-time statement. The headline-versus-body difference is the curator's ledger note; nothing on the site contradicts it.", "sources": [ "rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "securitynl-abuse-reported", "verdict": "noted", "reason": "Checked: Security.NL's headline says abuse, the body says attempts and that Previdian saw attackers fail to run PHP or upload files. The site says attempts, not compromise; nothing contradicts it.", "sources": [ "securitynl-misbruik-gemeld" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "sites-offline-tracker-50", "verdict": "held back", "reason": "A community-run tracker; the site's own offline ledger (data/impact.json) is built from organisations' own statements and reports, and carries a smaller number. Its count of 50 is the tracker's, not checked against the organisations.", "sources": [ "phpocalypse-tracker-sites-csv" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "ncsc-nl-inventory-1836", "verdict": "held back", "reason": "The counts (724 products; 216/61/440/6) are the curator's, from the per-letter files; the journalist has not recounted them. The site keeps scale-ncsc-nl (674, 08:40 UTC 22 October) until they are recounted.", "sources": [ "ncsc-nl-php2shell-software-list-letters", "ncsc-nl-php2shell-software-list" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "qnap-attempts-in-wild", "verdict": "noted", "reason": "Checked on QNAP's statement: scanning and exploitation attempts, attacks blocked on QNAP's own sites. Attempts, not a compromise; nothing on the site contradicts it.", "sources": [ "qnap-statement-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "qnap-products-affected", "verdict": "noted", "reason": "Vendor advisory QSA-26-18, checked: a product list with fixes pending. Not repeated on a page.", "sources": [ "qnap-qsa-26-18" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "panos-management-affected", "verdict": "noted", "reason": "Palo Alto's own advisory, checked: affected PAN-OS versions through the management interface; \"not aware of malicious exploitation\". Not repeated on a page.", "sources": [ "paloalto-psirt-cve-2026-109618" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cisco-none-known-affected", "verdict": "noted", "reason": "Cisco's own advisory (cisco-sa-php-october26), checked. Not repeated on a page.", "sources": [ "cisco-sa-php-october26" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "fortinet-investigating", "verdict": "noted", "reason": "Fortinet's own advisory FG-IR-26-186, checked. Not repeated on a page.", "sources": [ "fortinet-fg-ir-26-186" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "nukib-update-only-fix", "verdict": "agrees", "reason": "Agrees with only-update and the fixed versions in two-cves-9.2; the NÚKIB page gives the same four versions.", "sources": [ "nukib-aktuality-2470" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "bacs-no-attacks-switzerland", "verdict": "noted", "reason": "Keystone-SDA wire via Watson: BACS knows of no attacks in Switzerland, a point-in-time statement. BACS's own page (ch-bacs-warnung-php) was searched for it and does not say it.", "sources": [ "watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "japan-no-damage-reported", "verdict": "noted", "reason": "Kyodo wire via Chinese and Indonesian outlets: the Chief Cabinet Secretary said no damage had been reported. Point in time.", "sources": [ "tchina-kyodonews-articles-15266", "koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "latvia-attempts-failed-6000", "verdict": "agrees", "reason": "Agrees with scale-latvia and latvia-attempts; Delfi's page says about 6000 digital resources.", "sources": [ "delfi-bizness-44467736-tehnologijas-120139480-certlv-novero" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "scale-22m-paloalto", "verdict": "agrees", "reason": "The figure is on the numbers page as n-22.6m, attributed to Palo Alto Networks via Insurance Business; Salzburg24 says \"more than 22 million\" second-hand. An exposure estimate, not compromised servers.", "sources": [ "salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "scale-1.5m-of-2.6m-unpatched", "verdict": "held back", "reason": "TuttoTech sets 1.5 million against 2.6 million hosts. The site (scale-2.6m-hosts) gives Censys's 1.57 million not patched out of 1.58 million that report a version, after the desk's correction K-004; the Italian wording would restate the basis wrongly.", "sources": [ "tuttotech-news-2026-10-22-vulnerabilita-php-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "scale-5.1m-virustotal", "verdict": "agrees", "reason": "Agrees with scale-2.6m-hosts, which already carries VirusTotal's 5.1 million IPs and 1.1 million announcing a version. TugaTech's page also gives 272 thousand supported and 758 thousand end-of-life (checked).", "sources": [ "tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "php-foundation-no-successful-rce", "verdict": "noted", "reason": "Elizabeth Barron, PHP Foundation, 'to our knowledge', as WIRED and The Verge quote it. Point in time; consistent with no-confirmed-compromise.", "sources": [ "wired-exploited-days-before-patched", "the-verge-php2shell-websites-down" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "dataminr-no-known-compromises", "verdict": "noted", "reason": "Dataminr via BleepingComputer: limited to scanning, fingerprinting and non-working exploits. Point in time.", "sources": [ "bleepingcomputer-amazon-4-days-before" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "no-confirmed-breach-at-release", "verdict": "noted", "reason": "Insurance Business: no confirmed breach at release time; the same page notes later vendor reports. Point in time.", "sources": [ "insurance-business-au-asiapac-attacks-begin" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "patchstack-exploitation-incidents", "verdict": "held back", "reason": "Says \"confirmed multiple active exploitation incidents\" without saying who confirmed them or naming a victim; second-hand via Recorded Future and Insurance Business. Not stated on the site.", "sources": [ "recordedfuture-php2shell", "insurance-business-au-asiapac-attacks-begin" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "aws-broadly-exploited", "verdict": "noted", "reason": "Amazon's own words, checked: broadly exploited, and unclear whether any attempt would have worked. The site says attempts (probing); \"exploited\" is not used on its own.", "sources": [ "wired-exploited-days-before-patched", "bleepingcomputer-amazon-4-days-before", "the-register-hackers-pile-on-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "hadrian-exploited-at-scale", "verdict": "held back", "reason": "A vendor saying exploited at scale, with no victim named; the claim as recorded is about attempts through the session upload-progress mechanism. The site says attempts.", "sources": [ "the-register-hackers-pile-on-php2shell", "techtarget-disclosure-unravels", "insurance-business-au-asiapac-attacks-begin" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "huntress-none-observed", "verdict": "agrees", "reason": "Agrees with huntress-none (Huntress, none observed).", "sources": [ "insurance-business-au-asiapac-attacks-begin" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cloudflare-attempts-not-compromises", "verdict": "agrees", "reason": "Agrees with cf-millions and cloudflare-traffic; the caveat that attempts do not establish compromise is the site's own.", "sources": [ "usa-today-php2shell-live", "the-verge-php2shell-websites-down", "fortune-ai-tools-php-vulnerability" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "vulncheck-webshell-attempt", "verdict": "noted", "reason": "VulnCheck via SecurityWeek: one Chinese IP unsuccessfully tried a webshell. An attempt that failed.", "sources": [ "securityweek-exploitation-days-before" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "startup-source-code-theft", "verdict": "held back", "reason": "An unnamed startup owner, \"allegedly\", in Fortune; no company is named and nothing links the theft to php2shell. It stays on data/compromise.json as an unnamed allegation.", "sources": [ "fortune-ai-tools-php-vulnerability" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "headlines-exploited-before-patch", "verdict": "held back", "reason": "The WIRED and Verge headlines say exploited; both bodies describe an attempt on an Amazon honeypot on 17 October and quote the PHP Foundation that no successful RCE is known. The site says amazon-honeypot, not exploited.", "sources": [ "wired-exploited-days-before-patched", "the-verge-php2shell-websites-down" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "chainguard-lorenc-account", "verdict": "agrees", "reason": "Agrees with lorenc-ai-found and chainguard (the disputed disclosure account); Lorenc's side as TechTarget quotes it.", "sources": [ "techtarget-disclosure-unravels" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-ars-sansec-15min", "verdict": "noted", "reason": "A forecast Sansec made before release, per Ars Technica; not an observation.", "sources": [ "arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-crn-huntress-no-itw", "verdict": "agrees", "reason": "Agrees with huntress-none at an earlier time (10 a.m. Eastern, 21 October).", "sources": [ "crn-news-security-2026-5-things-to-know-about-critical-php-vulne" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-madpot-17-oct", "verdict": "agrees", "reason": "Agrees with amazon-honeypot (17 October, Amazon's MadPot), reported by Cyber Press.", "sources": [ "cyberpress-php2shell-exploits-predate-patches" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-acsc-no-exploitation", "verdict": "noted", "reason": "The ACSC alert is in the vault (acsc-alert-php, published 21 October 2026); Information Age reports that it was not aware of active exploitation at issue time. Point in time.", "sources": [ "ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-fixed-versions", "verdict": "agrees", "reason": "Agrees with two-cves-9.2; the PHP advisory in the vault gives 8.5.12, 8.4.27, 8.3.36 and 8.2.35.", "sources": [ "seroundtable-google-php2shell-42353-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-asd-alert-21-oct", "verdict": "noted", "reason": "The ACSC alert (acsc-alert-php) is published 21 October 2026, Status Critical, in the vault; The Mandarin's date matches.", "sources": [ "themandarin-322640-asd-rushes-out-critical-alert-on-unpatched-php-vulner" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-vulncheck-china-ip", "verdict": "noted", "reason": "VulnCheck via PCMag: one attempt traced to a China-based IP. A location does not identify the actor.", "sources": [ "pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-ncsc-uk-update-or-offline", "verdict": "agrees", "reason": "Agrees with offline-ncsc; the NCSC page (ncsc-news-php) is in the vault and carries the advice.", "sources": [ "bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-fbi-advisory-x", "verdict": "held back", "reason": "One Indian outlet for an official act (an FBI advisory on X); no FBI or wire source in the vault, and the curator's note says it was not checked against the FBI's post.", "sources": [ "in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-nsa-offline", "verdict": "agrees", "reason": "Agrees with offline-nsa; the NSA page (nsa-press-php-4630238) is in the vault and says to take the system offline if an immediate update is not feasible.", "sources": [ "indiatvnews-technology-news-us-nsa-issues-urgent-php2shell-warning-advis" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur2-certin-high", "verdict": "held back", "reason": "Revised by the correspondent on 24 October 2026: two sources in the vault give CERT-In's rating differently: MediaNama says 'high risk', Indian Express says 'critical-severity advisory on October 21' and embeds CERT-In's own post of that date (the post is not captured as text). A contradiction on the rating, so neither word is used until CERT-In's notice is captured. (journalist's first reason: CERT-In's rating rests on MediaNama (and Indian Express) alone; CERT-In's own notice is not in the vault.)", "sources": [ "medianama-2026-10-223-php-vulnerabilities-global-rush-update", "indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-filigran-log4shell", "verdict": "noted", "reason": "An expert comparison (Filigran, via 01net), not a measurement; not used.", "sources": [ "01net-actualites-failles-php-pourquoi-cest-vra" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-cz-warning", "verdict": "noted", "reason": "A public warning by a non-security figure, reported by a crypto outlet; checked, not used.", "sources": [ "analyticsinsight-news-changpeng-zhao-warns-crypto-users-a" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-mittwald-all-offline", "verdict": "agrees", "reason": "Agrees with the Germany row on data/impact.json, which already names Mittwald; Bitpage relays it, Mittwald's own statement is not in the vault.", "sources": [ "bitpage-php2shell-php-sicherheitsluecke-webseite" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-watchtowr-confirmed", "verdict": "agrees", "reason": "Agrees with leak-watchtowr.", "sources": [ "computable-2026-10-21-kritiek-php-lek-zet-miljoenen-20261023" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-ncsc-nl-beyond-websites", "verdict": "noted", "reason": "NCSC-NL via Computerworld España: impact not limited to websites. Not checked against the NCSC-NL repository's own wording; nothing on the site contradicts it.", "sources": [ "computerworld-article-4238887-dos-fallos-criticos-de-p" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-ro-police-site", "verdict": "agrees", "reason": "Agrees with the Romania row on data/impact.json (the Romanian Police website, reported).", "sources": [ "criticarad-php2shell-cve-2026-109618-ghid-patch" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-cyberscoop-little-exploitation", "verdict": "noted", "reason": "CyberScoop, the afternoon of 21 October: very little reported exploitation. Point in time, later overtaken by attempts reports.", "sources": [ "cyberscoop-php-emergency-patches-php2shell-vulnerab" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-ghsa-ids", "verdict": "agrees", "reason": "Agrees with four-reporters; the PHP advisory in the vault names GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619).", "sources": [ "forest-watch-impress-docs-news-2150167-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-searchlight-scanner", "verdict": "noted", "reason": "Help Net Security reports a vendor scanner. Not fetched or run; not linked from the site.", "sources": [ "helpnetsecurity-2026-10-22-php2shell-scanner-tool" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-morocco-map-bam", "verdict": "agrees", "reason": "Agrees with the Morocco row on data/impact.json (MAP in maintenance, Bank Al-Maghrib unavailable); no Moroccan source in the vault.", "sources": [ "journalducanada-php2shell-des-serveurs-exposes-a-une-cyb" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-jp-precautions", "verdict": "held back", "reason": "Taken from headlines named on a Yahoo! News Japan page; the Jiji Press articles themselves are not in the vault.", "sources": [ "news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-hn-leak", "verdict": "agrees", "reason": "Agrees with leak-hn and release-moved.", "sources": [ "notebookcheck-php2shell-le-falle-critiche-di-php-colpi" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur3-release-1400utc", "verdict": "agrees", "reason": "Agrees with release-time; the PHP advisory in the vault is dated 21 Oct 2026.", "sources": [ "techaeris-2026-10-21-php2shell-the-emergency-php-p" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-checkpoint-country-rates", "verdict": "held back", "reason": "A vendor statistic: 'affected' is not defined in the text and Check Point's report is not in the vault. The curator's note also records that 14% is India's rate, not the global one.", "sources": [ "cnbctv18-technology-india-ranks-11th-among-18-cou" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-third-flaw-115560", "verdict": "used", "reason": "Revised by the correspondent on 24 October 2026: the CVE is in the vault from three more pages than Coinpedia: Cloudflare's post (update of 23 October: the PHP project published an informational advisory for CVE-2026-115560, in the session upload progress feature, affecting fully patched releases including 8.5.12, fixed in the next regular release), SOCRadar (a separate session-handling flaw, needing a rare session.serialize_handler switch; no exploitation reported; mitigation session.upload_progress.enabled=0) and The Hacker News. PHP's own advisory is not in the vault. Used on /summary/ as an attributed open question; no severity score was published when SOCRadar wrote. (journalist's first reason: One crypto outlet; CVE-2026-115560 is not in the PHP advisory in the vault (searched), so the CVE is not stated on the site.)", "sources": [ "coinpedia-crypto-live-news-php-flags-third-unpatch", "cloudflare-blog-php2shell-waf", "socradar-blog-php2shell", "thehackernews-php2shell-4days" ], "where": "summary/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-france-60pct-freebox", "verdict": "noted", "reason": "Cryptoast correcting an early exposure figure for France (Freebox devices). Not repeated; the original figure is not on the site.", "sources": [ "cryptoast-failles-critiques-php-php2shell-france-f" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-watchtowr-itw-vibecoded", "verdict": "agrees", "reason": "Agrees with watchtowr-itw; \"in the wild\" here is attempts on watchTowr's sensors.", "sources": [ "cyberdaily-security-14335-php2shell-do-you-know-whe" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-cisa-urges-patch", "verdict": "agrees", "reason": "Agrees with gov-patch-required and offline-cisa; the CISA alert (cisa-alert-php-20261021) is in the vault and uses these words: \"strongly urges\", \"unauthenticated remote code execution\".", "sources": [ "cyberdaily-security-14335-php2shell-do-you-know-whe" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-vn-nca-patches", "verdict": "held back", "reason": "One Vietnamese outlet for an agency notice; the notice is not in the vault.", "sources": [ "dantri-cong-nghe-doanh-nghiep-can-lam-gi-de-bao" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-detik-20-years", "verdict": "held back", "reason": "A headline age (20 years) that conflicts with the other age figures; not stated on the site (versions-old: all PHP versions from 5 onwards).", "sources": [ "detik-tag-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur6-at-no-successful-attacks", "verdict": "used", "reason": "Revised by the correspondent on 24 October 2026: it is on the site: data/compromise.json (Austria, as of 12:03 Vienna time) and the front page's latest events, so the verdict is 'used', not 'noted' (journalist's first reason: Die Presse, 12:03 on 23 October: no successful attacks known in Austria. Point in time.)", "sources": [ "diepresse-41383717-die-php-sicherheitsluecke-ist-a" ], "where": "compromise/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-in-mp-nic-advisory", "verdict": "held back", "reason": "One Indian outlet for a state advisory and a CERT statement; neither is in the vault.", "sources": [ "freepressjournal-bhopal-mp-government-websites-vulnerable" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-jp-pm-x-post", "verdict": "noted", "reason": "Masaland: the Prime Minister urged on X preparing to patch; consistent with Reuters, CNN and USA Today in the vault (see cur3-jp-pm-emergency-order). Not used as the blog's word.", "sources": [ "note-masaland-n-n1bda3e5bc53f" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-no-intrusion-23-oct", "verdict": "noted", "reason": "A blog's summary at 23 October; consistent with no-confirmed-compromise. Not used.", "sources": [ "note-masaland-n-n1bda3e5bc53f" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-uk-ncsc-advisory", "verdict": "agrees", "reason": "Agrees with offline-ncsc; the NCSC page (ncsc-news-php) is in the vault.", "sources": [ "openaccessgovernment-ncsc-issues-warning-over-critical-php-re" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-deepseek-remote-patch", "verdict": "held back", "reason": "A rumour on X reported by AI Matters, with no confirmation by a security firm or DeepSeek.", "sources": [ "aimatters-news-report-56697" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-precursors-2004", "verdict": "noted", "reason": "blue News: precursors since 2004. Fits versions-old; not the 14-year or 20-year figures.", "sources": [ "bluewin-de-digital-php-sicherheitsluecke-ondrej" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-cyfirma-lazarus", "verdict": "held back", "reason": "An attribution at moderate confidence by one vendor, via EBN; Cyfirma's own report is not in the vault and EBN says direct evidence is not confirmed.", "sources": [ "ebn-news-articleview-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-unrelated-outages", "verdict": "noted", "reason": "El Debate: outages at Node.js, GitLab and Railway not linked by those companies to PHP2Shell. A caution; not used.", "sources": [ "eldebate-tecnologia-20261022-php2shell-vulnerabil" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur7-uy-state-sites-down", "verdict": "held back", "reason": "A headline-level claim from one Uruguayan outlet; no agency statement in the vault.", "sources": [ "elobservador-ciencia-y-tecnologia-sitios-del-estado-c" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-lcfr-first-discovery", "verdict": "agrees", "reason": "Agrees with who-first and four-reporters (lcfr-hax is Calif's reporter); Inc42 adds the pseudonym.", "sources": [ "inc42-features-php2shell-who-is-at-risk-and-ho" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-offline-list-itwire", "verdict": "held back", "reason": "One outlet's list of names; the curator's own note says several of them are not in the vault from a primary source. The site lists only what organisations or named reports say (data/impact.json).", "sources": [ "itwire-business-it-news-security-php2shell-the" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-chainguard-early-images", "verdict": "agrees", "reason": "Agrees with chainguard (07:41 UTC, 21 October), both sides quoted by iTWire.", "sources": [ "itwire-business-it-news-security-php2shell-the" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-calif-video-leak", "verdict": "agrees", "reason": "Agrees with leak-video.", "sources": [ "itwire-business-it-news-security-php2shell-the" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-rainforest-honeypot", "verdict": "used", "reason": "Revised by the correspondent on 24 October 2026: it is on the site: data/compromise.json and the front page's latest events, so the verdict is 'used', not 'noted' (journalist's first reason: RainForest via VOIX: a small honeypot sample, 21 POST requests. Attempts, not intrusions.)", "sources": [ "voix-business-cards-rainforest-ip-activity-an" ], "where": "compromise/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-dfv-warning", "verdict": "noted", "reason": "A sector body's warning (German fire brigades), as an example of how far the alerts spread; not used.", "sources": [ "feuerwehrmagazin-nachrichten-dfv-warnt-vor-kritischen-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-sansec-memory-leak", "verdict": "held back", "reason": "Revised by the correspondent on 24 October 2026: Sansec's own post IS in the vault (sansec-research-php2shell) and its two captures differ: on 22 October (11:31 UTC) it says CVE-2026-109618 'also leaks memory on its own, similar to Heartbleed' and 'default configurations are vulnerable'; on 23 October (16:04 UTC) the Heartbleed comparison is gone ('also discloses server memory on its own') and it adds 'an attack also needs specific conditions on the target server'. A vendor claim that its author has since reworded, and no other source in the vault measures; not stated on the site. (journalist's first reason: Sansec's own post is not in the vault; the Heartbleed-style memory leak is stated by Yahoo Finance second-hand. The site does not state it.)", "sources": [ "sansec-research-php2shell", "finance-yahoo-technology-articles-php-patches-critical" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-wiz-most-serious", "verdict": "noted", "reason": "Wiz via Forbes Türkiye: its characterisation; the site carries Wiz's similar words as most-severe.", "sources": [ "forbes-teknoloji-yapay-zekayla-kesfedildi-php-g" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-august-working-group", "verdict": "held back", "reason": "The WSJ is relayed by Fortune Italia; the WSJ piece is not in the vault.", "sources": [ "fortuneita-2026-10-22-php2shell-il-bug-che-poteva-m" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-world-quest-shutdown", "verdict": "held back", "reason": "Rests on one photo caption in a trade article; the operator's notice is not in the vault.", "sources": [ "gamemeca-view-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-eu-joint-advisory", "verdict": "noted", "reason": "Revised by the correspondent on 24 October 2026: the joint statement is reported by five outlets in the vault, not one: Gazzetta del Sud, 20minutos, Le Big Data, LeMondeInformatique and Criticarad, all naming the Commission, ENISA, CERT-EU and Europol (Criticarad: dated 21 October, 'does not claim active exploitation'; 20minutos: advises considering disconnecting exposed applications). None quotes it and the statement itself is not in the vault, so it is not stated on a page as a quoted official act; it belongs on the agencies page when the full pass reaches it. (journalist's first reason: One Italian outlet for an official act; searched CERT-EU (certeu-sa-2026-018) and ENISA pages in the vault for the joint advisory and did not find it.)", "sources": [ "gazzettadelsud-articoli-cronaca-2026-10-22-allarme-php2", "20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit", "lebigdata-php2shell-des-millions-dattaques-frappen", "lemondeinformatique-actualites-lire-deux-failles-critiques-d", "criticarad-php2shell-cve-2026-109618-ghid-patch" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur8-cloudflare-waf-rule", "verdict": "agrees", "reason": "Revised by the correspondent on 24 October 2026: Cloudflare's own post IS in the vault (cloudflare-blog-php2shell-waf, captured 22 and 23 October): it agrees with waf-nine-hours. (journalist's first reason said it was not in the vault.)", "sources": [ "gigazine-news-20261023-cloudflare-stats-php2shell", "cloudflare-blog-php2shell-waf" ], "where": "claims/review/index.html", "reviewed": "2026-10-24", "by": "journalist@php.newsroom" }, { "id": "cur9-tr-edevlet-no-problem", "verdict": "used", "reason": "On data/compromise.json (no-success-known, 22 October). Searched the text of every capture for 'Siber Güvenlik Başkanlığı' and 'e-Devlet': four Turkish news pages carry the statement (Haber, Haber7, DonanımHaber, İndigo Dergisi); the Directorate's own post is not among the captures. An organisation's statement about its own portal, as relayed.", "sources": [ "haber-teknoloji-siber-guvenlik-baskanligi-ndan" ], "where": "compromise/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur9-cyfirma-i2p-channel", "verdict": "held back", "reason": "One vendor report, relayed by two outlets (Korea Economic Daily, and EBN in cur7-cyfirma-lazarus). Searched the text of every capture for 'Cyfirma' and the Korean spelling 사이퍼마, and data/sources.json for the publisher: only those two news pages; Cyfirma's own report is not captured. The page itself says no direct proof of a North Korea link.", "sources": [ "hankyung-article-2026102423207" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur9-report-dates-aug", "verdict": "agrees", "reason": "The site carries both dates: Calif's report on 11 August (who-first), OpenAI's the same day (openai-same-day) and Wiz's on 24 August (wiz-independent). Hurriyet gives the same dates.", "sources": [ "hurriyet-dunya-dunya-genelinde-siber-guvenlik-aci" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur9-wiz-llm-adapts-exploits", "verdict": "noted", "reason": "Wiz's own post is in the vault (wiz-blog-php2shell) and says it: 'LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.' Checked against it; not used on a page.", "sources": [ "hwupgrade-news-sicurezza-software-falle-php-gia-so" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur9-jp-pm-warning-detik", "verdict": "noted", "reason": "A second outlet for cur7-jp-pm-x-post. CNN (cnn-php2shell-websites-shut) is in the vault and quotes Prime Minister Takaichi's request to check for PHP and prepare to apply the patch, and that companies should consider suspending services: a request on social media, not an order.", "sources": [ "inet-detik-security-d-8718436-saking-bahayanya-php2" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur9-fbi-nsa-cisa-disconnect", "verdict": "noted", "reason": "NSA (nsa-press-php-4630238) and CISA (cisa-alert-php-20261021) pages are in the vault and carry the offline advice in their own words (offline-nsa, offline-cisa on the site). Searched data/sources.json for an FBI page: none; the FBI's alert is known only from press (Mashable, CBS via Infobae), so the FBI part is not stated. Infobae's summary says 'ordered' where its body says 'asked'.", "sources": [ "infobae-estados-unidos-2026-10-23-php2shell-como" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur9-shizuoka-bank", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 22 October). Two pages in the vault name it: IT Finanzmagazin and The Next Web citing Bloomberg ('Shizuoka Bank suspended its website and app'). A precaution; neither says it was compromised. The bank's own notice is not among the captures (searched the text of every capture for 'Shizuoka').", "sources": [ "it-finanzmagazin-php2shell-sicherheitsluecken-bedrohen-we" ], "where": "impact/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-amazon-attempts-after-fix", "verdict": "agrees", "reason": "Agrees with the Amazon rows on data/compromise.json. Amazon's own post (aws-security-blog-madpot, both captures) says: after the embargo lifted at 14:00 UTC on 21 October and the patch was released, further proofs of concept 'appeared within hours' and were used against its sensors; Actainfo repeats it. Attempts against sensors, not confirmed compromises.", "sources": [ "actainfo-news-php2shell-vulnerabilita-php-allerta" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-eight-tls-certs", "verdict": "noted", "reason": "A separate incident, not PHP2Shell. Economedia (economedia-zitec-vulnerabilitatile-in-php-sunt-ampl) says the private keys of eight certificates were compromised between 17 and 20 October; Malwarebytes NL is the other page. Kept so nothing conflates the two; not used.", "sources": [ "malwarebytes-nl-blog-bugs-2026-10-php2shell-why-websi" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-openai-blog-coalition", "verdict": "noted", "reason": "OpenAI's Patch the Planet launch page and patchtheplanet.org are in the vault (openai-patch-the-planet-launch, patchtheplanet-org) and list the php2shell disclosure with Trail of Bits, Calif and HackerOne. They do not carry the two-month coalition wording, the GPT-5.6 audit or Wiz's verification; those rest on Ijiwei's summary. Consistent with ai-found and who-first; not used.", "sources": [ "ijiwei-n-1122779" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-openai-daybreak", "verdict": "held back", "reason": "The $1 billion subsidy rests on Ijiwei's summary alone. Searched OpenAI's launch page (openai-patch-the-planet-launch, 22 June) and patchtheplanet.org for 'billion', 'subsid', '$' and 'Daybreak': Daybreak is named as OpenAI's initiative, but the subscription programme, the figure and the PHP detection tool are not there.", "sources": [ "ijiwei-n-1122779" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-planned-22-oct-leak-20-oct", "verdict": "agrees", "reason": "Agrees with release-moved, leak-cve-ids and leak-watchtowr on the site (disclosure planned for 22 October, details leaked on 20 October, watchTowr confirmed).", "sources": [ "ijiwei-n-1122779" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-kaltim-tightens", "verdict": "noted", "reason": "A regional government's response (East Kalimantan, Indonesia), one local outlet; an example of how far the response spread, not a measurement. Not used.", "sources": [ "inibalikpapan-pemprov-kaltim-waspadai-php2shell-celah" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-active-exploitation-before-patch", "verdict": "held back", "reason": "ITdaily's headline says 'activement exploitée' before the fix. Searched its text for 'tentative', 'Amazon', 'honeypot' and 'succès': none; no victim and no source is named. The primary, Amazon's post, says an attempt on 17 October and 'unclear if any of these attempts would have succeeded'. The site says attempts (amazon-honeypot), not exploited.", "sources": [ "itdaily-blogs-logiciel-php2shell-bug-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur10-nepal-sites-offline", "verdict": "held back", "reason": "The 'thousands' figure is the Kathmandu Post's headline and lead and gives no count; searched the text of every capture for 'Nepal': this page alone (ACSC pages only list it). The named organisations are on data/impact.json (reported, 25 October) without the number; the 'hours to a week' wording is not on the page.", "sources": [ "kathmandupost-science-technology-2026-10-25-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-25", "by": "journalist@php.newsroom" }, { "id": "cur11-watchtower-embargo-thursday", "verdict": "noted", "reason": "BleepingComputer quotes watchTowr's CEO Benjamin Harris: 'scheduled under embargo and due for release on Thursday at 11 am ET', 'CVSS10' and 'PHP versions 5, 6, 7, and 8'. Checked. A pre-patch statement: the same page gives the final release as Wednesday 21 October at 14:00 UTC (10:00 AM Eastern) and the scores as 9.2 under CVSS v4.0 (the PHP advisory agrees), so the site keeps 9.2 and release-moved. Not used.", "sources": [ "bleepingcomputer-wikipedia-ref-12--flaws-emergency-patche" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur11-embargo-broken-by-several", "verdict": "noted", "reason": "The Guardian does say it: 'A number of security companies did break the embargo after the leak, according to the PHP Foundation'. The PHP Foundation's own post (php-foundation-blog-security-release) names one distributor, Chainguard (07:41 UTC on 21 October), and a reporting firm's mistakenly published video; I searched it for 'other companies', 'several' and 'a number of' and did not find the plural there. The site carries the Chainguard dispute (chainguard) and the video (leak-video).", "sources": [ "guardian-wikipedia-ref-40-ge-flaw-causing-global" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur11-php-foundation-anthropic-scan", "verdict": "noted", "reason": "Checked in two places in the vault. The PHP Foundation's own post: 'we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos', and later added OpenAI's Daybreak Red for validating reports. The Guardian: 'worked with Anthropic's frontier model to scan its code, and had PHP put into OpenAI's Patch the Planet program'. Not used on a page.", "sources": [ "guardian-wikipedia-ref-40-ge-flaw-causing-global" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur11-patches-8-2-and-up-only", "verdict": "held back", "reason": "The fixed versions agree with the PHP advisory (8.5.12, 8.4.27, 8.3.36, 8.2.35; two-cves-9.2). The attribution to the UK NCSC of a range 'back to PHP 5.4' is not on the NCSC page in the vault (ncsc-news-php, searched for '5.4', '8.2', 'end of life', 'unsupported'): it says 'any version of PHP' and that older versions should move to a supported one. The site's range is versions-old (PHP 5 onwards, Ars Technica).", "sources": [ "pcmag-wikipedia-ref-31-s-should-consider-going" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur11-third-flaw-not-urgent", "verdict": "agrees", "reason": "Agrees with cur6-third-flaw-115560, which the correspondent reviewed 'used' (story and front page). CVE-2026-115560 is now carried by eight captures: Cloudflare's blog, The Hacker News (three pages), SOCRadar, Coinpedia, Knews and La Razón. Searched all captures for the CVE id.", "sources": [ "knews-news-7898c3112ba7f79b25f7a44622d2e7d4" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur11-no-successful-execution-demonstrated", "verdict": "used", "reason": "On data/compromise.json (no-success-known, 23 October, La Razón). A point-in-time statement; consistent with no-confirmed-compromise.", "sources": [ "larazon-tecnologia-consumo-php-nuevo-fallo-segur" ], "where": "compromise/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur11-qianxin-million-assets", "verdict": "held back", "reason": "A vendor's exposure estimate with no basis given, carried by Leiphone and Ijiwei (searched all captures for 'Qi An Xin' and 奇安信); searched data/numbers.json, claims.json and impact.json: not on the site. Not comparable with the figures the site carries.", "sources": [ "leiphone-category-industrynews-9dejmhebinubut49-h" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-libertatea-18-oct", "verdict": "held back", "reason": "Contradicts Amazon's own date: Amazon's post (aws-security-blog-madpot) and the site (amazon-honeypot) say 17 October. Libertatea's page says '18 octombrie' with 'four days before the announcement', which fits 17 October; a one-day slip by one outlet.", "sources": [ "libertatea-stiri-ce-este-vulnerabilitatea-php-care" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-austin-gpt56-audit", "verdict": "noted", "reason": "Calif's own write-up (calif-php2shell) names Ryan Austin (@lcfr_hax) of Calif as researcher, dates the hash tweet to 5 August and the report to PHP to 11 August, and says OpenAI invited Calif to its Patch the Planet initiative. The model name 'GPT-5.6 Sol' is not on that page (searched for 'GPT', 'OpenAI', 'Sol'), so it stays out. Consistent with who-first and four-reporters.", "sources": [ "lisanews-internacional-un-fallo-en-php-detectado" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-garr-isolated", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 21 October). One outlet, Macitynet, which says GARR announced on 21 October that it had isolated some platforms as a precaution; searched all captures for 'GARR': no other page carries it (the other hits are the name Garrity and a menu), and GARR's own notice is not captured. A precaution, not a compromise.", "sources": [ "macitynet-php2shell-vulnerabilita-php-siti-offline" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-bssn-versions", "verdict": "held back", "reason": "An agency's warning relayed by one outlet: Medcom says BSSN listed PHP 8.2 to 8.5 as potentially affected (checked on the page), but BSSN's notice is not in the vault (searched all captures for 'BSSN'), and the list is narrower than the site's range (PHP 5 onwards).", "sources": [ "medcom-teknologi-news-teknologi-en442w3n-bssn-p" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-moncloa-patch-date", "verdict": "held back", "reason": "Wrong date: the PHP advisory and The Register's quotation of the PHP Foundation say the fixes were released on 21 October at 14:00 UTC (release-time on the site). 22 October was the planned date (release-moved). Moncloa's page says 'este jueves 22 de octubre'.", "sources": [ "moncloa-2026-10-22-vulnerabilidad-php2shell-fall" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-cyfirma-report-23-oct", "verdict": "held back", "reason": "One vendor report, three Korean outlets: Money Today, Korea Economic Daily and EBN. Searched all captures for 'Cyfirma' and 사이퍼마: only those three news pages; Cyfirma's own report is not captured. Same as cur7-cyfirma-lazarus and cur9-cyfirma-i2p-channel.", "sources": [ "mt-tech-2026-10-24-2026102414170377166" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-de-pkgr-turning-point", "verdict": "noted", "reason": "A second page in the vault carries the statement: FAZ quotes Marc Henrichmann, chair of the Parliamentary Control Panel for the intelligence services, 'Wir erleben einen Wendepunkt'. A politician's characterisation, not a measurement; not used.", "sources": [ "netzpolitik-2026-wir-stehen-auf-den-schultern-vieler" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-crypto-firms-not-affected", "verdict": "noted", "reason": "Four pages carry company statements (BTC-ECHO, Cointelegraph, Journal du Coin, Bitcoin News); the companies' own posts are not captured. Consistent with the BTC-ECHO row already on data/compromise.json.", "sources": [ "news-bitcoin-es-security-coinbase-y-bitgo-niegan-impa" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur12-emudhra-separate", "verdict": "noted", "reason": "A separate incident, not PHP2Shell; eMudhra appears in Ars Technica, BleepingComputer, Cloudflare's blog, Cointelegraph and Cybernews (searched all captures). Same as cur10-eight-tls-certs. Kept so pages do not conflate the two; not used.", "sources": [ "news-bitcoin-es-security-coinbase-y-bitgo-niegan-impa" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-wersm-amazon-week-before", "verdict": "held back", "reason": "Contradicts Amazon's own date: its post (aws-security-blog-madpot) and the site (amazon-honeypot) say 17 October, four days before disclosure. WeRSM's 'about a week' is a loose paraphrase of TechCrunch.", "sources": [ "wersm-php2shell-legacy-infrastructure-web-risk" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-wersm-confirmed-compromises", "verdict": "held back", "reason": "The sentence 'Palo Alto Networks and Trail of Bits later reported confirmed compromises and post-exploit activity' is on this page alone (searched every capture for 'Trail of Bits' with 'compromis' or 'exploit', for 'TechCrunch' and for 'post-exploit'), names no victim, and is contradicted by Palo Alto's own advisory in the vault (paloalto-psirt-cve-2026-109618): 'not aware of any malicious exploitation'. No organisation is named as compromised, so no-confirmed-compromise stands.", "sources": [ "wersm-php2shell-legacy-infrastructure-web-risk" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-qq-scan-useragent", "verdict": "noted", "reason": "One analyst's telemetry on a Tencent News creator page: a request with the User-Agent 'php2shell-scan/1.0'. A User-Agent is set freely; an attempt-level observation, not a compromise. Not used.", "sources": [ "news-qq-rain-a-20261021a0eq4p00" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-newscj-217-systems", "verdict": "held back", "reason": "An official statement on one outlet: Cheonji Ilbo quotes the Ministry of the Interior and Safety that none of its 217 information systems was developed with PHP (checked on the page). Searched every capture for '217': this page alone, and the ministry's own notice is not captured.", "sources": [ "newscj-news-articleview-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-newscj-alert-caution", "verdict": "noted", "reason": "Checked: Cheonji Ilbo says the government raised the cyber crisis alert to 'Caution' (주의) and activated its emergency response; Polinews also carries a cyber-alert item. Two Korean outlets, no ministry page captured. A national alert level, not a finding about PHP2Shell; not used.", "sources": [ "newscj-news-articleview-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-newstap-theori-reproduced", "verdict": "noted", "reason": "A vendor's own claim of reproduction, relayed by Newstap; Theori's guide is not in the page. Not used.", "sources": [ "newstap-news-articleview-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-newstap-leaked-binaries", "verdict": "noted", "reason": "Newstap relays Theori: a demonstration video and patched binaries leaked before the advisory. The video matches leak-video on the site; the 'patched binaries' detail has support in the PHP Foundation's account of distributors' images (chainguard). Not used.", "sources": [ "newstap-news-articleview-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-beincrypto-no-exchange-evidence", "verdict": "noted", "reason": "BeInCrypto's own caveat that its exposure list is an estimate of risk, not of compromises. Consistent with the BTC-ECHO row on data/compromise.json.", "sources": [ "nl-beincrypto-crypto-exchange-hack-waarschuwing-php2sh" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-note-yoshi-history", "verdict": "noted", "reason": "A personal blog's history of the 2019 memory bug and the 2024 Quarkslab audit; the bug and CVE numbers were not checked here. The site's quarkslab-2024 and versions-old carry the audit and the age. Not used.", "sources": [ "note-gay-egret4207-n-n2c2499dc2998" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-note-yoshi-wiz-time", "verdict": "noted", "reason": "A blog relaying Wiz: AI cut the effort from months to about one researcher-week. Wiz's own post is in the vault (wiz-blog-php2shell) and says AI is 'no longer a barrier'; the 'one researcher-week' figure was not searched for there. Not used.", "sources": [ "note-gay-egret4207-n-n2c2499dc2998" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-notebookcheck-qnap-eol-apps", "verdict": "noted", "reason": "Notebookcheck relays QNAP's bulletin that Download Station and PHP Extensions get no fix (support ended). QNAP's QSA-26-18 is in the vault (qnap-qsa-26-18) and advises backing up Download Station tasks before uninstalling applications; the 30 September end-of-support date is not on that page. Not used.", "sources": [ "notebookcheck-php2shell-im-homelab-qnap-nextcloud-und" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-notebookcheck-opnsense-pfsense", "verdict": "noted", "reason": "Version numbers for OPNsense and pfSense as the article gives them (all six numbers found on the page), as of 22 October. Vendor release details; not used on a page.", "sources": [ "notebookcheck-php2shell-im-homelab-qnap-nextcloud-und" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-notebookcheck-qnap-no-device-attacks", "verdict": "noted", "reason": "QNAP knows of no attacks on its devices, as of the article. QNAP's own advisory says the same (no reports of exploitation targeting QNAP products), beside its PSIRT report of attempts on its own website (qnap-attempts-in-wild). Not used.", "sources": [ "notebookcheck-php2shell-im-homelab-qnap-nextcloud-und" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-nbc-nl-hn-leak", "verdict": "agrees", "reason": "Agrees with leak-hn and release-moved (details leaked the day before; release brought forward to 21 October, 14:00 UTC).", "sources": [ "notebookcheck-php2shell-kritieke-php-kwetsbaarheden-tr" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-nbc-nl-wiz-24-aug", "verdict": "agrees", "reason": "Agrees with wiz-independent (Wiz reported on 24 August). The note.com blog's 19 August is the find, not the report.", "sources": [ "notebookcheck-php2shell-kritieke-php-kwetsbaarheden-tr" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-nbc-nl-digid-offline", "verdict": "agrees", "reason": "Agrees with the Netherlands row on data/impact.json (DigiD and MijnOverheid, cited to TPO.NL); the page itself says no successful break-in had been confirmed.", "sources": [ "notebookcheck-php2shell-kritieke-php-kwetsbaarheden-tr" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-notimerica-multiple-actors", "verdict": "noted", "reason": "Checked against Amazon's own post, which says 'these were multiple actors' and that analysis was ongoing. The inference is Amazon's, not an attribution. Not used.", "sources": [ "notimerica-ciencia-tecnologia-noticia-portaltic-ama" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-notimerica-voluntary-suspensions", "verdict": "noted", "reason": "Portaltic (Europa Press) relays voluntary suspensions in the Netherlands, Belgium and France and Japan's advice to disable pages in extreme cases. Each government's statement is the primary; the site's offline ledger carries the Netherlands, Belgium and France (Reuters). Not used.", "sources": [ "notimerica-ciencia-tecnologia-noticia-portaltic-ama" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-npr-leak-hackers", "verdict": "noted", "reason": "A blurb: NPR says the vulnerability leaked before the fix and hackers moved in. No transcript in the capture, so nothing is attributed to the guests. Not used.", "sources": [ "npr-2026-10-24-nx-s1-6012327-ai-found-the-fl" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-nw-owl-sites", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 21 to 23 October): East Westphalia-Lippe sites, Neue Westfälische's own survey with a stated cut-off at 18:00 on 23 October; the Kreis Paderborn and the Bielefeld fire brigade still offline then. Reasons are not given beyond the PHP flaw. Revised by the correspondent on 26 October 2026: the row now names every organisation the page lists, the fifteen back online by 23 October as well as the two still offline.", "sources": [ "nw-nachrichten-zwischen-weser-und-rhein-244" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-nw-prince-millions", "verdict": "agrees", "reason": "Agrees with cf-millions (Cloudflare's chief executive, 'millions' of attempts); an attempts count, not successes.", "sources": [ "nw-nachrichten-zwischen-weser-und-rhein-244" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-okaz-ap-disruptions", "verdict": "noted", "reason": "Okaz relays AP: some government sites and services in the UK, Finland and Japan were disrupted. The site's offline ledger carries the UK (Edinburgh, Oxford, Met Police, OBR) and Finland (Valtori) on their own sources. Not used.", "sources": [ "okaz-technology-na-2272170" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-okaz-php-delay-acknowledged", "verdict": "held back", "reason": "No source is named for the PHP project's acknowledgement of a weakness in handling security reports; Bangkok Biz News repeats it without naming the statement (cur14-bangkokbiz-php-foundation-resources). Not stated on the site.", "sources": [ "okaz-technology-na-2272170" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-ot-checkpoint-regions", "verdict": "held back", "reason": "A vendor statistic: ot.gr does not say what 'affected' means or the window and sample, and Check Point's report is not in the vault. Same as cur6-checkpoint-country-rates, held back on 25 October.", "sources": [ "ot-2026-10-23-texnologia-php2shell-enas-sto" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-ot-checkpoint-sectors", "verdict": "held back", "reason": "Same Check Point briefing and the same missing definition of 'affected' (sectors: telecommunications 20%, education 18%); second-hand. Held back with cur13-ot-checkpoint-regions.", "sources": [ "ot-2026-10-23-texnologia-php2shell-enas-sto" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-pcwatch-openai-checker", "verdict": "noted", "reason": "PC Watch (Impress) describes OpenAI's 'PHP Version Checker' (21 October), which reads a version string from headers; MediaNama and SentinelOne also mention it (searched all captures for 'PHP Version Checker'). Version-header checks can mislead after backports. The tool was not fetched or run; not linked from the site.", "sources": [ "pc-watch-impress-docs-news-2150338-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-pcwatch-php54-affected", "verdict": "noted", "reason": "PC Watch says PHP 5.4 up to the fixed releases are affected, matching Sansec's 'PHP 5.4 or later' in cur13-pcgamer-sansec-15-min. The site's range is versions-old (PHP 5 onwards); the project itself gives fixes only for 8.2 to 8.5. Not used.", "sources": [ "pc-watch-impress-docs-news-2150338-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-pcgamer-sansec-15-min", "verdict": "noted", "reason": "Same as cur2-ars-sansec-15min: a forecast before release, not an observation. PC Gamer also carries Sansec's 'PHP 5.4 or later'.", "sources": [ "pcgamer-wikipedia-ref-22-dates-to-plug-leaked-hi" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-pcgamer-watchtowr-cvss10", "verdict": "noted", "reason": "Same statement as cur11-watchtower-embargo-thursday: watchTowr's CEO said 'CVSS10' and 'PHP versions 5, 6, 7, and 8' on the day of the leak. The final scores are 9.2 under CVSS v4.0 (PHP advisory), which the site carries.", "sources": [ "pcgamer-wikipedia-ref-22-dates-to-plug-leaked-hi" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-pcgamer-cloudflare-early", "verdict": "noted", "reason": "PC Gamer relays Cloudflare's CTO (Dane Knecht, on X) that it was already updating firewall rules for early attacks before the 14:00 UTC release. The site carries Cloudflare's edge protections (waf-nine-hours) from its own blog. Not used.", "sources": [ "pcgamer-wikipedia-ref-22-dates-to-plug-leaked-hi" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-martincid-0-08-patched", "verdict": "noted", "reason": "Checked on the page: at 13:52 UTC on 21 October, 0.08% ('0,08%') of monitored sites reported a patched version, per mySites.guru; one monitoring service's sample, at one moment, before the 14:00 UTC release. Not used.", "sources": [ "pl-martincid-technology-pl-php2shell-latka-php-juz-je" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-martincid-version-misleading", "verdict": "noted", "reason": "Practical guidance relayed from The Hacker News and others: a version number can mislead after a distribution backport. Not used.", "sources": [ "pl-martincid-technology-pl-php2shell-latka-php-juz-je" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur13-martincid-package-sources", "verdict": "noted", "reason": "A snapshot of which package sources had fixed builds on 21 October, as the article gives it; not updated. Not used.", "sources": [ "pl-martincid-technology-pl-php2shell-latka-php-juz-je" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-bnt-millions-attempts", "verdict": "agrees", "reason": "Agrees with cf-millions; the page gives no source or counting method of its own. Attempts, not successes.", "sources": [ "blog-nouvelles-technologies-389778-php2shell-faille-critique-php-cor" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-bnt-php-foundation-ai", "verdict": "noted", "reason": "The PHP Foundation's own post is in the vault (php-foundation-blog-security-release) and says it scanned PHP with Anthropic's Claude Mythos and later used OpenAI's Daybreak Red; the same as cur11-php-foundation-anthropic-scan. Not used.", "sources": [ "blog-nouvelles-technologies-389778-php2shell-faille-critique-php-cor" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-computing-cloudflare-10h", "verdict": "agrees", "reason": "Agrees with cf-millions: thousands of attempts in the ten hours before announcement, millions since. Attempts, not successes.", "sources": [ "computing-news-2026-security-php-emergency-patches" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-computing-uk-takedowns", "verdict": "agrees", "reason": "Agrees with the UK rows already on data/impact.json (Oxford City Council, City of Edinburgh Council, Office for Budget Responsibility); precautionary.", "sources": [ "computing-news-2026-security-php-emergency-patches" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-computing-nsa-offline", "verdict": "agrees", "reason": "Agrees with offline-nsa; the NSA page (nsa-press-php-4630238) is in the vault.", "sources": [ "computing-news-2026-security-php-emergency-patches" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-acn-81-9", "verdict": "held back", "reason": "The percentage is right but the parenthetical is not: the pages give 285,149 of 348,130 services whose version could be identified (81.9%; Matrice Digitale), and 285,149 of 741,523 would be 38.5%. CyberSecItalia's wording mixes the two bases. ACN's alert is of potential vulnerability from version strings. Not stated until the base is one.", "sources": [ "cybersecitalia-lalert-dellacn-in-italia-a-rischio-vulne" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-acn-third-cve", "verdict": "agrees", "reason": "Agrees with cur6-third-flaw-115560 (used by the correspondent) and the other captures that carry CVE-2026-115560 (Cloudflare, The Hacker News, SOCRadar, ZDNET Japan); ACN's alert is also a captured source (acn-it-php2shell).", "sources": [ "cybersecitalia-lalert-dellacn-in-italia-a-rischio-vulne" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-albilad-mufg", "verdict": "agrees", "reason": "Agrees with the Japan row on data/impact.json (Mizuho, MUFG group companies, ANA and others, from The Next Web citing Bloomberg, added by the correspondent in v0.1.20). A service suspension, not a breach.", "sources": [ "albiladpress-news-2026-6586-finance-1027748-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-bangkokbiz-cloudflare-rates", "verdict": "noted", "reason": "Relays Cloudflare's rates (tens of thousands of attempts within 45 minutes, hundreds of thousands within two hours). Cloudflare's own blog is in the vault (cloudflare-blog-php2shell-waf); I did not find those exact figures there (searched for '45 minutes', 'two hours' and 'tens of thousands'). Attempts, not successes; not used.", "sources": [ "bangkokbiznews-opinion-1257779" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-bangkokbiz-php-foundation-resources", "verdict": "held back", "reason": "Matches cur13-okaz-php-delay-acknowledged; neither page names the statement. Not stated on the site.", "sources": [ "bangkokbiznews-opinion-1257779" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-denews-logpresso-scanner", "verdict": "noted", "reason": "A vendor's product announcement (Logpresso's scanner, announced on 26 October; the curator corrected the date of release on 26 October). The tool was not fetched or run; not linked from the site.", "sources": [ "denews-news-articleview-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-waca-takaichi-x", "verdict": "noted", "reason": "A press release by an industry association (WACA) relaying the Prime Minister's X post on 21 October. CNN (cnn-php2shell-websites-shut) is in the vault and quotes Takaichi's request; a request on social media. Not used.", "sources": [ "digitalpr-r-146712" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-encause-cisa-no-success", "verdict": "noted", "reason": "En cause, 25 October, citing CISA: no successful exploitation observed at its last update. CISA's own alert (cisa-alert-php-20261021) is in the vault and the KEV catalogue did not list either CVE at the last check (cisa-none on the site). Point in time.", "sources": [ "encause-failles-php-critiques-php2shell-mise-a-j" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-etnews-enki-scanner", "verdict": "noted", "reason": "A vendor's announcement of its own free scanner (Enki WhiteHat, 23 October), as Electronic Times reports. Not tested; not linked from the site.", "sources": [ "etnews-20261023000089" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-nbc-fr-shodan", "verdict": "noted", "reason": "Checked on the page: a Shodan count published by Mallory on 20 October, about 884,000 internet-exposed hosts declaring an unsupported PHP version. Banner-based host counts, not confirmed vulnerable sites; shared hosting puts many sites behind one address. Not comparable with Censys's or VirusTotal's figures on the site (scale-2.6m-hosts); not used.", "sources": [ "notebookcheck-php2shell-laisse-des-millions-de-serveur" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-nbc-fr-backports", "verdict": "noted", "reason": "Checked: Notebookcheck says no numbered releases for end-of-life branches but minimal source backports for 7.4, 8.0 and 8.1 (Scherzer's account in the vault agrees). As of 26 October; vendors may carry their own backports. Not used.", "sources": [ "notebookcheck-php2shell-laisse-des-millions-de-serveur" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-nbc-fr-cisa", "verdict": "agrees", "reason": "Agrees with offline-cisa. The CISA alert itself is in the vault and says: 'Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.' Computing's NSA attribution is a separate item (offline-nsa).", "sources": [ "notebookcheck-php2shell-laisse-des-millions-de-serveur" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-polskieradio-coi-bip", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 22 October): Poland's Central Informatics Centre switched off BIP pages in the national public-information system as a precaution, affecting only some bodies. One outlet (Polskie Radio 24); the centre's own notice is not among the captures.", "sources": [ "polskieradio24-pieniadze-strony-bip-znikaja-z-sieci-luk" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-posttoday-thaicert", "verdict": "noted", "reason": "A ministerial statement relayed by Post Today that ThaiCERT issued a national alert on the morning of 22 October; Daily News also carries ThaiCERT (searched all captures). The alert itself is not captured. Not used.", "sources": [ "posttoday-ai-today-750820" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-posttoday-openai-found", "verdict": "held back", "reason": "A Thai deputy prime minister's attribution, unverified: the vault's primary accounts credit Calif (with OpenAI's Patch the Planet) and Wiz, and Calif's own write-up (calif-php2shell) says OpenAI invited Calif to its initiative. Not stated on the site as worded.", "sources": [ "posttoday-ai-today-750820" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-pplware-wiz-decades", "verdict": "noted", "reason": "Relays Wiz: the flaws existed for decades; AI helped overcome the complexity of demonstrating exploitation. Wiz's own post is in the vault (wiz-blog-php2shell) and says AI 'is no longer a barrier'. Not used.", "sources": [ "pplware-sapo-internet-php2shell-disponibilizadas-atua" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-scalecommerce-patch-speed", "verdict": "noted", "reason": "A company's own account in a promotional press release (ScaleCommerce, PresseBox, 22 October): 18 minutes after the release it had patched most customers (the page says 18 minutes) and all systems by 20:00. Not independently checked; not used.", "sources": [ "pressebox-pressemitteilung-scalecommerce-gmbh-krit" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-scalecommerce-few-attempts", "verdict": "used", "reason": "On data/compromise.json (no-success-known, 22 October, ScaleCommerce): its log review found only isolated attack attempts on customer shops and no indication of a broad compromise. Scope is one provider's customers, and its own account.", "sources": [ "pressebox-pressemitteilung-scalecommerce-gmbh-krit" ], "where": "compromise/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-qdnd-vn-users-no-panic", "verdict": "noted", "reason": "Public guidance for consumers relayed by the People's Army Newspaper: users need not stop using websites. Not used.", "sources": [ "qdnd-phap-luat-tin-tuc-hai-lo-hong-nghiem-tro" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-raij-white-house-16-oct", "verdict": "noted", "reason": "Reuters (rte-reuters-websites-go-dark, in the vault) quotes the White House: it 'was made aware of the flaw on Friday'; Friday is 16 October 2026. Raij relays it. Amazon's earliest honeypot attempt was the next day, 17 October. Not used.", "sources": [ "ra2ej-php2shell-893716-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur14-raij-watchtowr-no-success", "verdict": "noted", "reason": "watchTowr's Jake Knott, early in the exploitation: attempts seen, 'no one has succeeded so far'. Point in time; consistent with no-confirmed-compromise.", "sources": [ "ra2ej-php2shell-893716-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-scherzer-original-schedule", "verdict": "agrees", "reason": "Agrees with release-moved (planned 22 October 14:00 UTC, brought forward to 21 October). Scherzer, PHP 8.5's release manager, is first-hand: tags made on Monday 19 October, kept private.", "sources": [ "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-scherzer-reschedule-20-oct", "verdict": "agrees", "reason": "Agrees with leak-cve-ids and release-moved (CVE IDs discussed about 15:00 UTC on 20 October, release moved a day forward).", "sources": [ "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-scherzer-calif-video", "verdict": "agrees", "reason": "Agrees with leak-video (Calif's proof-of-concept video around 20:00 UTC on 20 October, deleted, copied; a copy online at 20:27 UTC).", "sources": [ "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-scherzer-chainguard", "verdict": "agrees", "reason": "Agrees with chainguard (07:41 UTC, from the PHP Foundation's post). Scherzer notes Hacker News reports of builds from 06:07 UTC and that the exact time is unknown; the site keeps 07:41.", "sources": [ "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-scherzer-public-13-35", "verdict": "used", "reason": "Revised by the correspondent on 26 October 2026: used: the release manager's first-hand timeline matches the GitHub tags and advisories already cited on release-time (13:34 to 13:35 UTC) and CERT-EU's 13:30; 14:00 UTC was the scheduled time. release-time now says scheduled 14:00, published 13:31 to 13:35 UTC, confirmed. (journalist's first reason: Contradicts a time the site carries: release-time is 14:00 UTC on 21 October (the PHP advisory; BleepingComputer: '14:00 UTC (10:00 AM Eastern)'). The release manager's account puts the public release at 13:31 to 13:35 UTC, from GitHub activity. Not stated until the correspondent decides which time the site gives; sent as a note.)", "sources": [ "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell" ], "where": "claims/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-agenda-foundation-chronology", "verdict": "noted", "reason": "Agenda Digitale relays the PHP Foundation's chronology (Calif's audit from 30 July, report on 11 August, OpenAI's analysis the same day). Calif's own write-up gives 30 July and the report to PHP on 11 August (who-first, openai-same-day on the site). Not used.", "sources": [ "agendadigitale-sicurezza-php2shell-lai-accelera-la-scop" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-agenda-leak-moved-release", "verdict": "agrees", "reason": "Agrees with release-moved and leak-video (leak on 20 October, release brought forward from 22 to 21 October, a video published by mistake).", "sources": [ "agendadigitale-sicurezza-php2shell-lai-accelera-la-scop" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-agenda-w3techs-69-3", "verdict": "agrees", "reason": "Agrees with scale-70pc-websites ('almost 70% of websites whose server-side language is known'). Checked on the page: 69,3% of all analysed sites, 64,5% of the first million, 61,0%, 59,7% and 59,3% by band; the share of sites with a known server-side language.", "sources": [ "agendadigitale-sicurezza-php2shell-lai-accelera-la-scop" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-matrice-348130-identified", "verdict": "noted", "reason": "Checked on Matrice Digitale and CyberSecItalia: 285,149 services on potentially vulnerable versions, 81.9% of the 348,130 whose version could be identified; potential vulnerability from version strings. States the base cur14-acn-81-9 gets wrong. Not used on a page.", "sources": [ "matricedigitale-2026-10-25-php2shell-italia-csirt-serviz" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-schieb-bsi-update", "verdict": "held back", "reason": "Gives no date or content of the BSI's 'updated warning' (as of 25 October) and nothing in the captures shows one; an official act on one blog-style page. Not stated.", "sources": [ "schieb-php2shell-sicherheitsluecke-so-schuetzt" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-esi-old-versions-affected", "verdict": "held back", "reason": "A commercial vendor of extended support claiming, in its own press release, that the flaw is in all end-of-life versions 5.3 to 8.1; not independently checked, and the lower bound (5.3) differs from the site's range (versions-old, PHP 5 onwards; PC Watch and Sansec say 5.4).", "sources": [ "atpress-ne-news-644147" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-zdnet-mirai", "verdict": "used", "reason": "On data/compromise.json (attempts, 26 October): ZDNET Japan, translating ZDNET, says Amazon Threat Intelligence reports actors in PHP2Shell attack chains trying to deploy Mirai-family botnets. Amazon's post in the vault (aws-security-blog-madpot, both captures) does not contain the word 'Mirai'; Sophos, via Cyber Security News, also reports a Mirai-derived payload (blocked). Attempts, no named actor.", "sources": [ "japan-zdnet-article-35253966" ], "where": "compromise/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-zdnet-third-cve-unlikely", "verdict": "agrees", "reason": "Agrees with cur6-third-flaw-115560 (used by the correspondent) and cur14-acn-third-cve; ZDNET Japan relays the PHP project's 23 October advisory: unusual configuration needed, mitigation given.", "sources": [ "japan-zdnet-article-35253966" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-lepti-wiz-cms-images", "verdict": "noted", "reason": "Relays Wiz: control of recent WordPress, Drupal and Joomla images and a memory read. Wiz's own post (wiz-blog-php2shell) names WordPress, Joomla, Drupal and memory disclosure as the stakes. In researchers' own tests (wordpress-drupal on the site). Not used.", "sources": [ "leptidigital-securite-informatique-cybersecurite-fail" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-radioworld-telos", "verdict": "noted", "reason": "A vendor's own advisory relayed by Radio World (Telos Alliance: Zephyr Connect SE, Altus SE and Pathfinder Core Pro affected); Telos appears in this page alone (searched all captures). As of 23 October; an affected-products notice, not a compromise.", "sources": [ "radioworld-tech-and-gear-radio-it-management-is-you" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-radioworld-comrex-wheatstone", "verdict": "noted", "reason": "Vendor self-reports to a trade magazine (Comrex: only its Switchboard service, patched within hours; Wheatstone: a Nielsen timestamp interface for a few X5 customers). Not an audit; not used.", "sources": [ "radioworld-tech-and-gear-radio-it-management-is-you" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-raya-ionos", "verdict": "noted", "reason": "A one-line mention that large hosts such as IONOS have already updated PHP, with no date or source; other captures name IONOS (Die Presse, FAZ, BornCity). Not used.", "sources": [ "raya-2026-10-22-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-root-check-from-17-oct", "verdict": "agrees", "reason": "Agrees with amazon-honeypot: Amazon advises administrators to look for signs from 17 October on; the first attempt hit a honeypot.", "sources": [ "root-zpravicky-utok-na-php2shell-zacal-uz-cty" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-root-honeypot-not-production", "verdict": "agrees", "reason": "Agrees with amazon-honeypot: the 17 October attempt hit Amazon's MadPot honeypot, not a production site; Amazon's post says it cannot explain how the attacker knew.", "sources": [ "root-zpravicky-utok-na-php2shell-zacal-uz-cty" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-sbbit-japan-suspensions", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 21 October): BASE, Kodomon, pixiv, Niconico, game companies and Sakura Internet suspended all or part of their services for emergency maintenance (BASE and Kodomon naming the PHP flaw); the Ministry of Finance paused related web content. Business+IT notes the companies' stated reasons differ; none is said to be compromised.", "sources": [ "sbbit-article-cont1-187672" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-sbbit-w3techs-versions", "verdict": "noted", "reason": "Checked: W3Techs (October 2026), PHP on 69.3% of sites with a known server-side language; within them 8.x 65.2%, 7.x 27.0%, 5.x 7.7%; the page notes 8.0 and 8.1 are end of life too, so the end-of-life share is higher. Agrees with cur15-agenda-w3techs-69-3 on the 69.3%. Not used.", "sources": [ "sbbit-article-cont1-187672" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur15-secnl-palo-alto-panos", "verdict": "noted", "reason": "Relays Palo Alto's bulletin (PAN-OS 10.2, 11.1, 11.2, 12.1, 12.2 vulnerable; greatest risk when the management interface is internet-reachable). The same as panos-management-affected, reviewed on 25 October against the vendor's own advisory in the vault (paloalto-psirt-cve-2026-109618: 'not aware of any malicious exploitation'). Not used.", "sources": [ "security-nl-palo-alto-firewalls" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-malaymail-csa-singapore", "verdict": "noted", "reason": "Singapore's Cyber Security Agency warning, relayed by Malay Mail (immediate action to patch) and by Channel NewsAsia (channelnewsasia-singapore-php-vulnerabilities-csa-singapore-firms-cybersecur); the agency's own advisory is not among the captures (searched the source list for CSA and SingCERT pages). 'Working exploits demonstrated' is the agency's wording as relayed. A national warning; not used.", "sources": [ "malaymail-news-singapore-2026-10-23-singapore-warn" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-ciol-india-14", "verdict": "held back", "reason": "Check Point's 'impact rate' is not defined in the article (attempts seen against compromise) and Check Point's report is not in the vault; India's 14% against 10% globally is the same figure held back on 25 October (cur6-checkpoint-country-rates) and in cur13-ot-checkpoint-regions.", "sources": [ "ciol-iot-india-php2shell-attacks-ai-driven-cy" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-selular-kemenperin", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 22 to 25 October): Indonesia's Ministry of Industry (TKDN site, SIINas, all kemenperin.go.id domains) off from 22:00 WIB (15:00 UTC) on 22 October to 25 October as a precaution; Selular.ID (24 October, 14:00 WIB, 07:00 UTC) found the TKDN site still unreachable. Searched all captures for 'kemenperin': this page alone, and the ministry's own notice is not among the captures. A precaution, not a breach.", "sources": [ "selular-2026-10-ancaman-serangan-siber-php2shell" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-sempre-sophos-failed", "verdict": "agrees", "reason": "Agrees with the Sophos rows already on data/compromise.json (Sophos withdrew its success claim: scanning and failed attempts; a Mirai-derived payload blocked). SempreUpdate relays Sophos's Counter Threat Unit; Cyber Security News, Latin Times and Bitpage also carry the Potassium variant (searched all captures); Sophos's own report is not captured.", "sources": [ "sempreupdate-php2shell-a-anatomia-das-vulnerabilidade" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-sempre-third-cve", "verdict": "agrees", "reason": "Agrees with cur6-third-flaw-115560 (used by the correspondent) and cur14-acn-third-cve, cur15-zdnet-third-cve-unlikely: the PHP project's advisory of 23 October, CVE-2026-115560, left to the regular release because it needs a rare configuration.", "sources": [ "sempreupdate-php2shell-a-anatomia-das-vulnerabilidade" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-silicon-unit42-22-6m", "verdict": "agrees", "reason": "Agrees with n-22.6m on the numbers page (22.6 million, Palo Alto Networks' Unit 42, via Insurance Business and TechTarget). A count of instances that could be vulnerable by version, not confirmed vulnerable or compromised sites.", "sources": [ "silicon-cybersecurite-1371-php2shell-vulnerabili" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-silicon-wiz-php2shell-com", "verdict": "held back", "reason": "The pages disagree on who made the site: PCMag (in the vault) says 'The IT industry created a dedicated site, php2shell.com'; Silicon.fr says Wiz did and 'led the public narrative'. Searched all captures for php2shell.com (PCMag, Silicon, Wikipedia, Cyberkendra, JPCERT, Bitpage): none says Wiz made it. An editorial reading; not stated.", "sources": [ "silicon-cybersecurite-1371-php2shell-vulnerabili" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-sn-austria-no-attacks", "verdict": "agrees", "reason": "Agrees with the Austria row on data/compromise.json (the Interior Ministry, no cyber attacks known, via Salzburg24): Salzburger Nachrichten has the same statement for Wednesday evening, 21 October, and that the ministry expected attempts. A point-in-time statement.", "sources": [ "sn-panorama-medien-was-die-php-sicherheitsl" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-sn-austria-advance-notice", "verdict": "noted", "reason": "Checked: Salzburger Nachrichten quotes the Interior Ministry that the new Federal Office for Cybersecurity, with CERT.at, issued a notice on Tuesday that a critical PHP update was coming, and repeated it on Wednesday; ORF and Bitpage also carry CERT.at (searched all captures). Consistent with preannounce-time on the site (19:30 UTC on 20 October). The notice itself is not captured; not used.", "sources": [ "sn-panorama-medien-was-die-php-sicherheitsl" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-it168-virustotal-5-1m", "verdict": "agrees", "reason": "Agrees with scale-2.6m-hosts, which already carries VirusTotal's 5.1 million IPs running PHP. IT168 is a vendor's promotional article with no method or date.", "sources": [ "software-it168-a2026-1022-6954-000006954576-shtml" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-it168-european-shutdowns", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported): the Netherlands row names every organisation the lists give, those back online as well as those still off, as of 20:55 CEST (18:55 UTC) on 21 October (AG Connect) with IT168 (22 October): the Port of Rotterdam, Overheid.nl, the Dutch football association, parties' sites, hospitals, the veiligheidsregio's, Schiphol's app, Odido's BEN and Simpel, the Tweede Kamer, MijnOverheid and AG Connect itself. IT168 also names Valtori in Finland, French local-government administrative sites and some Australian government sites, already on the ledger. Precautionary; most were not hacked.", "sources": [ "software-it168-a2026-1022-6954-000006954576-shtml" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-sohu-china-notices", "verdict": "held back", "reason": "A vendor's marketing post claiming risk notices by MIIT's NVDB and CNVD and bulletins by Tencent Cloud, Alibaba Cloud and QiAnXin CERT. Searched all captures for 'CNVD' and 'NVDB': this post and Ijiwei's summary only, neither a government page; the notices are not captured.", "sources": [ "sohu-a-1091246810-122998307" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-sohu-cvss-9-8", "verdict": "held back", "reason": "Contradicts the score the site carries: both flaws are 9.2 under CVSS v4.0 in the PHP advisory (two-cves-9.2); 9.8 is not on any of those pages and the post does not say which CVSS version it means. Marketing post, one source.", "sources": [ "sohu-a-1091246810-122998307" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-synology-packages", "verdict": "noted", "reason": "Synology's PSIRT finding as its distributor ASK Corp (ask-corp-news-2026-10-synology-php2shell-vulnerab) and Stadt-Bremerhaven (Caschys Blog) relay it: only systems running certain PHP-dependent packages (ASK's list begins Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki), PHP updates for DSM 7.4, 7.3 and 7.2. Synology's own bulletin is not captured. A vendor's affected-products notice; not used.", "sources": [ "stadt-bremerhaven-synology-sicherheitsupdates-fuer-php-geg" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-startupfortune-prince-sky-falling", "verdict": "noted", "reason": "An opinion and prediction by Cloudflare's chief executive, relayed second-hand from Reuters. Not a fact about PHP2Shell; not used.", "sources": [ "startupfortune-cloudflares-ceo-says-worse-bugs-than-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-startupfortune-cybelangel-2-24m", "verdict": "noted", "reason": "CybelAngel's own post is in the vault (cybelangel-php2shell): '2.24M Internet-Facing PHP Hosts, 59% on Versions With No Fix Coming'. A banner-based host count by one vendor; not comparable with the Censys and VirusTotal figures on the site (scale-2.6m-hosts). Not used.", "sources": [ "startupfortune-cloudflares-ceo-says-worse-bugs-than-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-startupper-censys-39-7m", "verdict": "held back", "reason": "Censys's 39.7 million services is on one Greek outlet alone (searched all captures for '39,7' and '39.7'); Censys's own post is not captured. The site carries Censys's host counts (about 2.6 million hosts, 1.57 million not patched; scale-2.6m-hosts), a different measure.", "sources": [ "startupper-ai-282619-antepithesi-220-ekat-liron-apo" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-startupper-arctic-wolf-limited", "verdict": "held back", "reason": "Arctic Wolf's own page is in the vault (arcticwolf-php2shell-exposure) and does not carry it (searched for 'limited', 'intrusion' and 'successful'); the statement rests on one Greek outlet. Point in time. Consistent with no-confirmed-compromise but not stated.", "sources": [ "startupper-ai-282619-antepithesi-220-ekat-liron-apo" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-startupper-uk-220m", "verdict": "held back", "reason": "The £220 million package is on one Greek outlet alone (searched all captures for '£220', '220 million' and 'AI Security Institute'); the link to PHP2Shell is the outlet's framing, and the UK government's announcement is not captured. Unverified.", "sources": [ "startupper-ai-282619-antepithesi-220-ekat-liron-apo" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur16-larue-prefectures", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 21 October): France's Ministry of the Interior took the prefectures' websites offline, the Paris police prefecture's included, awaiting a fix for the framework they run on. Reuters (via Boursorama, in the vault) quotes the ministry's communiqué: 'Par mesure de précaution, les sites web des préfectures ont été temporairement mis hors ligne'; Actu17 adds that it was at the request of ANSSI. The Paris police prefecture portal returned a 503 when Stéphane Larue checked.", "sources": [ "stephanelarue-sites-des-prefectures-inaccessibles-lint" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-cpo-hn-leak-honest-mistake", "verdict": "held back", "reason": "'Is thought to be' an insider's honest mistake, with no source and no name; CPO Magazine hedges it itself. The PHP Foundation's post names Calif's video and Chainguard's early build as the leak routes. Not stated on the site.", "sources": [ "cpomagazine-cyber-security-threat-actor-targeted-php" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-ddaily-cyfirma-i2p", "verdict": "held back", "reason": "The fourth Korean page for one vendor report: Digital Daily, with Money Today, Korea Economic Daily and EBN (searched all captures for 'Cyfirma' and 사이퍼마). Cyfirma's own report is not captured; the attribution to the Lazarus ecosystem is rated 'moderate' by the vendor. Same as cur7-cyfirma-lazarus, cur9-cyfirma-i2p-channel, cur12-cyfirma-report-23-oct.", "sources": [ "m-ddaily-page-view-2026102611404279049" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-ddaily-exploit-tools-in-wild", "verdict": "noted", "reason": "Digital Daily relays watchTowr and SOCRadar. SOCRadar's own post is in the vault (socradar-blog-php2shell): 'Exploitation attempts began on October 17', and it 'found PHP2Shell exploit tooling on an exposed attacker server'; watchTowr's side is watchtowr-itw on the site. Tools in use are attempts, not a compromise. Not used.", "sources": [ "m-ddaily-page-view-2026102611404279049" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-ddaily-node2shell-separate", "verdict": "noted", "reason": "A separate Node.js flaw (Theori's 'Node2Shell', CVE-2026-111497), not PHP2Shell; BornCity, Imperva's blog and patchtheplanet.org also mention it (searched all captures). Kept so pages do not conflate the two; not used.", "sources": [ "m-ddaily-page-view-2026102611404279049" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-qianxin-china-million", "verdict": "held back", "reason": "The same QiAnXin estimate held back on 26 October (cur11-qianxin-million-assets): over a million assets in China, a vendor's exposure count with no method, now on a third page (10jqka, with Leiphone and Ijiwei). Not on the site's numbers.", "sources": [ "stock-10jqka-20261022-c680990008-shtml" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-suara-komdigi", "verdict": "noted", "reason": "Four Indonesian pages carry Komdigi's warning (Suara Nasional, Bisnis, Detik, Kompas; searched all captures for 'Komdigi'); the ministry's own notice is not captured. An emergency warning to administrators; not used.", "sources": [ "suaranasional-2026-10-25-bahaya-celah-keamanan-php2she" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-tagesschau-bsi-orange", "verdict": "noted", "reason": "Checked on tagesschau.de: the BSI warning BITS-H Nr. 2026-297981-1032 rates the risk '3 / Orange', extraordinarily high, countermeasures at once; BornCity and Bitpage also carry the number (searched all captures). The BSI's own warning is not captured. A severity rating, not a finding of exploitation; not used.", "sources": [ "tagesschau-wirtschaft-digitales-php-panne-100-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-tagesschau-wildberger", "verdict": "noted", "reason": "Checked: Digital Minister Karsten Wildberger told Bild that no damage had been done to federal IT systems and no sign that federal websites were affected (tagesschau.de; FAZ, Morgenpost, RTL, Netzpolitik and IT-Daily also name him). Point in time, 21 to 22 October; not used.", "sources": [ "tagesschau-wirtschaft-digitales-php-panne-100-html" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-takvim-turkey-alert", "verdict": "agrees", "reason": "Agrees with the Turkey row on data/compromise.json (the e-Devlet portal, no problem): national alert TR-26-1372 is carried by four Turkish pages (Takvim, Bursada Bugün, İndigo Dergisi, İstanbul Ticaret Gazetesi; searched all captures); the Directorate's own notice is not captured.", "sources": [ "takvim-guncel-2026-10-22-php2shell-guvenlik-aci" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-takvim-belgium-ccb", "verdict": "used", "reason": "On data/impact.json (offline ledger, reported, 22 October): after the CCB's warning the Foreign, Finance and Labour ministries' sites and media and education platforms were disabled (Takvim, 22 October, 16:54 EEST, 13:54 UTC). Takvim's whole list is on the ledger: Belgium's ministries here, the Dutch DigiD, the Rotterdam port portal, Schiphol's app and the House of Representatives in the Netherlands row, prefectures, police units and portals in France, Germany and Finland, and South Korea's 'caution' alert. Precautionary, not a cyber attack.", "sources": [ "takvim-guncel-2026-10-22-php2shell-guvenlik-aci" ], "where": "impact/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-technoisy-huntress-no-exploitation", "verdict": "agrees", "reason": "Agrees with huntress-none and cur2-crn-huntress-no-itw (Huntress had not confirmed exploitation in its monitored environments); the page says as of the evening of 21 October, US Eastern. Point in time.", "sources": [ "tech-noisy-2026-10-22-php2shell-php-rce-cve-2026-10" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-techgaming-pokemon-squareenix", "verdict": "used", "reason": "On data/compromise.json (named-organisation, 22 October) and on the offline ledger. TechGaming.it, citing Kotaku, says Square Enix 'confirmed episodes of unauthorised access to its systems' in the same week as PHP2Shell; it does not say the access came through the PHP flaws, and Kotaku's text and Square Enix's own words are not captured (searched all captures for 'Square Enix': TechGaming and Bitpage only). Bitpage, the other page, says Square Enix closed new logins to Final Fantasy XIV on all worlds and took its patch servers offline, and that the cause 'is no attack, but two flaws in the core of PHP'. Unverified; no-confirmed-compromise is left as it was, for the correspondent.", "sources": [ "techgaming-internet-sotto-attacco-php2shell-vulnera" ], "where": "compromise/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-technotoday-compromised-unknown", "verdict": "noted", "reason": "A dated caveat from Technotoday: the number of systems successfully compromised was not yet known with certainty, as of 22 to 23 October. Consistent with the unsettled picture (cur16-sempre-sophos-failed); not used.", "sources": [ "technotoday-php2shell-saldirilari-iki-kritik-php-aci" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-kompas-70-percent-caveat", "verdict": "agrees", "reason": "Agrees with scale-70pc-websites: the '70%' is W3Techs' share of sites with a known server-side language, not a count of vulnerable or attacked sites; Kompas Tekno says it itself.", "sources": [ "tekno-kompas-read-2026-10-22-14200007-celah-keamanan" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-bisnis-censys-1-5m-unpatched", "verdict": "held back", "reason": "Restates a basis the site corrects: Bisnis has an expert saying about 1.5 million of 2.6 million PHP hosts were unpatched; the site (scale-2.6m-hosts) gives Censys's 1.57 million not patched out of the 1.58 million that report a version (the desk's correction K-004). The same wording as TuttoTech's, held back on 25 October. Not a Censys publication.", "sources": [ "teknologi-bisnis-read-20261023-84-2015221-pengamat-ingatk" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" }, { "id": "cur17-bisnis-komdigi-pdn1", "verdict": "noted", "reason": "Komdigi's letter asking users of National Data Center (PDN) 1 to update PHP is reported by Bisnis, whose page is an expert (CISSReC) saying the response is right but late and should not stay voluntary; the letter itself is not captured. A precaution; not used.", "sources": [ "teknologi-bisnis-read-20261023-84-2015221-pengamat-ingatk" ], "where": "claims/review/index.html", "reviewed": "2026-10-26", "by": "journalist@php.newsroom" } ] }