[
 {
  "id": "n-70-internet",
  "value": "70%",
  "of": "the Internet",
  "who": "Wiz (headline and X post)",
  "sources": [
   "wiz-blog-php2shell",
   "x-wiz-io-php2shell"
  ],
  "status": "unverified",
  "measures": "Not stated. The headline is a restatement of the body's figure for websites.",
  "note": "The BBC says it could not independently verify this figure. The body of the same Wiz post says PHP 'powers 70% of all websites in the world' and cites no measurement."
 },
 {
  "id": "n-70-websites",
  "value": "almost 70%",
  "of": "websites",
  "who": "Cloudflare; OpenAI ('an estimated 70% of websites')",
  "sources": [
   "cloudflare-blog-php2shell-waf",
   "x-openai-php2shell"
  ],
  "status": "reported",
  "measures": "The share of websites whose server-side language is PHP, as commonly published by web-technology surveys. Neither page names the survey.",
  "note": "A share of websites is not a share of the Internet, and a site that uses PHP is not a site that is reachable, unpatched and exploitable."
 },
 {
  "id": "n-30m",
  "value": "about 30 million",
  "of": "websites",
  "who": "Alan Woodward, Surrey Centre for Cyber Security, on the BBC",
  "sources": [
   "bbc-live-ckgel5xp2xv9t"
  ],
  "status": "reported",
  "measures": "Not stated.",
  "note": "Second-hand through the BBC. No basis given."
 },
 {
  "id": "n-2.6m-hosts",
  "value": "2,608,039",
  "of": "internet-facing hosts running PHP",
  "who": "VulnCheck, via The Hacker News",
  "sources": [
   "thehackernews-php2shell-4days"
  ],
  "status": "reported",
  "measures": "Hosts observed on the internet that expose PHP, as counted by one scanning vendor.",
  "note": "A host count, far smaller than any websites figure, because one host serves many sites and most sites are behind hosts that do not expose PHP directly."
 },
 {
  "id": "n-6000-lv",
  "value": "about 6,000",
  "of": "potentially affected resources in Latvia, a few hundred in the public sector",
  "who": "CERT.LV",
  "sources": [
   "certlv-php-preventive"
  ],
  "status": "reported",
  "measures": "Resources identified by the national CERT as potentially affected, in one country.",
  "note": "The one national-scale count from a primary source, and the only one that says 'potentially'."
 },
 {
  "id": "n-674",
  "value": "674",
  "of": "software entries in the NCSC-NL php2shell inventory",
  "who": "NCSC-NL, counted from the file at commit cca173c64ec5",
  "sources": [
   "ncsc-nl-php2shell-software-list",
   "ncsc-nl-php2shell"
  ],
  "status": "confirmed",
  "measures": "Rows in the inventory: 206 marked Vulnerable, 46 Fix, 418 Investigation, 3 Not vulnerable, 1 without a status.",
  "note": "NCSC-NL calls the entries investigation leads until a vendor backs them. Counted by this site's export script, not copied from a page."
 },
 {
  "id": "n-cvss",
  "value": "9.2",
  "of": "CVSS v4.0, each CVE",
  "who": "PHP Group as CNA; GitHub advisories; CERT-EU; ACN",
  "sources": [
   "cve-cve-2026-109618",
   "cve-cve-2026-109619",
   "github-ghsa-w8hw-w9fx-j79w",
   "certeu-sa-2026-018",
   "acn-it-php2shell"
  ],
  "status": "confirmed",
  "measures": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "note": "The 10.0 that circulated on 20 October is wrong, per the PHP Foundation; a PHP security team member traces it to a social post relayed by a vendor and a news site."
 },
 {
  "id": "n-views-nsa",
  "value": "10.1 million",
  "of": "views of the NSA Cyber post, at capture",
  "who": "X, as displayed at 2026-10-22T08:09Z",
  "sources": [
   "nsa-x-2112903220209098897"
  ],
  "status": "confirmed",
  "measures": "The view counter X displayed when the post was captured.",
  "note": "A capture-time number; it will be higher now."
 },
 {
  "id": "n-4days",
  "value": "4 days",
  "of": "before disclosure, an exploit attempt hit an Amazon honeypot",
  "who": "CJ Moses, Amazon, via The Hacker News",
  "sources": [
   "thehackernews-php2shell-4days"
  ],
  "status": "reported",
  "measures": "17 October 2026, MadPot honeypot, one attempt from an anonymisation network.",
  "note": "Amazon's own post has not been found; the quote is as The Hacker News printed it."
 },
 {
  "id": "n-9h",
  "value": "about 9 hours",
  "of": "before disclosure, Cloudflare's WAF rules went live for all customers",
  "who": "Cloudflare",
  "sources": [
   "cloudflare-blog-php2shell-waf"
  ],
  "status": "confirmed",
  "measures": "21 October 2026 03:02 UTC against the 14:00 UTC release.",
  "note": "Primary party. No attack volumes are in the post."
 },
 {
  "id": "n-6h",
  "value": "more than 6 hours",
  "of": "before the coordinated release, Chainguard published built images with the fix",
  "who": "The PHP Foundation",
  "sources": [
   "php-foundation-blog-security-release"
  ],
  "status": "reported",
  "measures": "21 October 2026 07:41 UTC.",
  "note": "Chainguard reportedly does not dispute the time but denies leaking; that article is blocked from this environment."
 },
 {
  "id": "n-censys",
  "value": "1.57 million",
  "of": "internet-facing hosts with an identifiable PHP version that were unpatched on 21 October, of 2.58 million seen",
  "who": "Censys, via SecurityWeek",
  "sources": [
   "securityweek-exploitation-days-before"
  ],
  "status": "reported",
  "measures": "Hosts whose HTTP response announces a PHP version below the fixed one. Hosts that hide the version (a million of them) are not counted either way.",
  "note": "Censys's own post was not found; nearly 3 million hosts by 22 October per the same report."
 },
 {
  "id": "n-millions-attempts",
  "value": "millions",
  "of": "exploit attempts seen across Cloudflare's network by 22 October 01:25 UTC",
  "who": "Matthew Prince, Cloudflare",
  "sources": [
   "x-eastdakota-php2shell-stats"
  ],
  "status": "reported",
  "measures": "Requests matching Cloudflare's rules, across all customers. Not compromises, not unique attackers, not unique targets.",
  "note": "Thousands in the ten hours before the announcement."
 },
 {
  "id": "n-22.6m",
  "value": "22.6 million",
  "of": "exposed instances 'potentially vulnerable' to php2shell (TechTarget's wording; Insurance Business: internet-facing systems that 'could be vulnerable')",
  "who": "Palo Alto Networks, via Insurance Business and TechTarget",
  "sources": [
   "insurancebusiness-uk-councils-met",
   "techtarget-cybersecurity-news-366652444-php2shell-2"
  ],
  "status": "reported",
  "measures": "Instances found by Palo Alto's scanning on 21 October; the method is not given.",
  "note": "Nine times Censys's host count. TechTarget Japan's '22.6 million servers put at risk' is the same figure, restated without its source."
 },
 {
  "id": "n-94pc",
  "value": "94%",
  "of": "Weird Gloop's wiki page views still served during its 13-hour shutdown",
  "who": "Weird Gloop",
  "sources": [
   "weirdgloop-blog-php2shell"
  ],
  "status": "confirmed",
  "measures": "Page views served from cache with no PHP or database running, as measured by the operator.",
  "note": "The one number on this page that measures the cost of taking a system offline."
 },
 {
  "id": "n-389",
  "value": "389",
  "of": "files changed by the fix commit, 10,689 lines added",
  "who": "php/php-src, counted by this site from a clone",
  "sources": [
   "github-php-src-fix-commit-3584a98bd"
  ],
  "status": "confirmed",
  "measures": "git show --shortstat on commit 3584a98bd; 113 of the files are not tests.",
  "note": "The 7.4 backport changes 17 files."
 },
 {
  "id": "n-kev-2026",
  "value": "270",
  "of": "CVEs added to CISA's Known Exploited Vulnerabilities catalog in 2026 so far; 0 of them php2shell",
  "who": "CISA KEV, counted by this site",
  "sources": [
   "cisa-kev-json"
  ],
  "status": "confirmed",
  "measures": "Entries with dateAdded in 2026 in catalog version 2026.10.21.",
  "note": "Three PHP core CVEs are in the catalog from earlier years."
 }
]