PHP2Shell live tracker

Status: 0 organizations confirmed breached by name. CISA Known Exploited Vulnerabilities: Not listed. Exploit attempts: Millions (exploit attempts seen by Cloudflare). Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12.

Am I affected? What to do

Questions people are asking

Latest, newest first

• Oct 24CISA's catalog, opened directly: version 2026.10.23, no PHP entry, no emergency directive. No PHP release since Oct 21. Korean press relays a CYFIRMA report, at moderate confidence, of Korean-speaking actors preparing attacks on banks and government in four countries. source
• Oct 23The PHP Foundation tells Reuters it has one full-time employee and 14 mostly part-time contractors, and no evidence the flaws were exploited before disclosure or against patched servers. source
• Oct 23Palo Alto Networks' Unit 42 gives the first vendor account of a successful intrusion: at an unnamed European government entity, an attacker it judges to be an AI agent had password hashes and multi-factor secrets within two hours of exploitation and tried for domain admin. The victim, the data source and the outcome are not stated. Retracted by Unit 42 on Oct 25 (2:15 p.m. PT): it could not confirm the initial access involved the PHP2Shell flaws. source
• Oct 23A Michigan credit union, MSUFCU, becomes the first US financial institution to describe its own precautionary outage: digital banking offline about 24 hours to patch in-house PHP systems, no impact to member data. New York's financial regulator tells firms to patch at once and not rely on web firewalls. source
• Oct 23PHP flags a third, narrower code-execution risk (CVE-2026-115560) that needs an unusual session configuration. It recommends disabling session upload progress and will fix it in the next regular release; no exploitation reported. source
• Oct 23VulnCheck says it has an exploit that works against the recommended production configuration on x86-64, kept to its paying customers, and knows of no other public or commercial exploit that does so across PHP versions. Hunt.io, Wordfence and SOCRadar still report no confirmed compromise. source
• Oct 23Qualys, from about 12,000 customers, counts only about 199,000 PHP instances patched within 12 hours of disclosure; about 110 million (71%) run end-of-life versions that will mostly never get a fix. source
• Oct 23Neither flaw is yet on CISA's Known Exploited Vulnerabilities list, and no federal emergency directive has been issued. source
• Oct 23Censys counts 34.4 million PHP services still assessed as vulnerable across about 3.1 million hosts. source
• Oct 23Attackers try to use the flaws to recruit servers into a Mirai botnet variant (Potassium). Previdian, SOCRadar, Wordfence and Hunt.io still report no successful exploitation; VulnCheck shows a working chain against a default production build. source
• Oct 22The UK government confirms 32 digital services unavailable and four partially unavailable, mostly as a precaution; the NCSC has sent about 50,000 warnings. source
• Oct 22VulnCheck confirms a working exploit against default production settings of a widely used PHP 8.4 build. source
• Oct 22Sophos retracts its claim of one successful compromise; officials in Germany, the Netherlands, Japan and Australia report no confirmed breaches. source
• Oct 22Cloudflare's CEO says exploit attempts have reached the millions. source
• Oct 22South Korea raises its private-sector cyber alert to 'caution' and warns about 28,000 organizations. source
• Oct 22Pantheon reports blocking more than 60,000 suspicious requests. source
• Oct 21Major Linux distributions, control panels and Docker images ship fixes. source
• Oct 21UK NCSC urges immediate updates. source
• Oct 21CISA says the flaws require immediate patching; it has not yet seen exploitation. source
• Oct 21Governments and companies in Europe, Canada, Japan, Australia and the UK take sites offline as a precaution. source
• Oct 21Slovenia raises its national cyber threat level to high. source
• Oct 21OpenAI publishes its 'Patch the Planet' post and a free PHP checker. source
• Oct 21Hundreds of proof-of-concept repositories appear on GitHub, most fake — some carrying malware. source
• Oct 21PHP ships fixed releases and the flaws are publicly disclosed. source
• Oct 21Japan's Prime Minister Takaichi posts on X urging site operators to patch. source

Who has been hit, attacked or taken offline (77)

Confirmed compromises first. "Attacked" includes honeypots and blocked attempts; most entries are precautionary shutdowns, not breaches.

What officials have said

• Oct 25Palo Alto Networks Unit 42: Retracts its Oct 23 update, which had reported attackers using agentic AI attack platforms for post-exploitation at a government entity in Europe (password hashes and multi-factor secrets within two hours, an attempted Domain Admin escalation). The Oct 25 update: 'What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application. This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.' Cortex Xpanse's count of over 22.6 million exposed instances stays. source
• Oct 22Chainguard: Denied breaking the embargo, saying Chainguard shipped fixes because attacks were already under way. source
• Oct 22Germany BSI: Said attacks were seen but none had succeeded, and that exploitation looks harder than attackers' pace suggests. source
• Oct 22Government of Japan: Said no damage reports or confirmed exploiting attacks had been received. source
• Oct 22South Korea Science Ministry: Raised the private-sector cyber crisis alert from 'interest' to 'caution' (level 2 of 4) at noon KST, warned ~28,000 entities, and said multi-day manual patching cannot stop these attacks, so automated response is essential. (Post confirmed by press reports; direct link not located.) source
• Oct 22Australian Government: Said the outages were not a breach and described ASD-led work with international agencies and OpenAI. source
• Oct 22Trail of Bits: Said his team built a working exploit in one day with Codex, but turning a bug into a shell still takes expertise. source
• Oct 22NCC Group: Warned that patching does not prove systems are clean and urged reviewing the exposure window for compromise. source
• Oct 22ThaiCERT (Thailand NCSA): Warned that a PoC is public; no confirmed compromise. source
• Oct 22New York Department of Financial Services: Told regulated firms to patch immediately and take unpatchable systems offline; web application firewalls 'may provide limited protection' but 'should not be used as a substitute for patching or isolation'. source
• Oct 21NSA: NSA says the flaws sit in PHP itself, so any server on an affected version is exposed to unauthenticated takeover. It urges patching, replacing end-of-life PHP, and taking systems offline if they cannot be updated immediately. source
• Oct 21NSA Cybersecurity: Posted on X urging organizations to prepare for the PHP update and take systems offline if they cannot update immediately (per Newsweek and The National). (Post confirmed by press reports; direct link not located.) source

The latest reporting

• PHP2Shell: honeypot shells confirmed, still no named victim and no CISA listing as of Monday morning SecurityWeek, Oct 26
• TU Delft's live PHP2Shell dashboard: 41,900 exploitation requests from 586 IPs in 68 countries since Oct 21 Delft Threat Intelligence Lab, Oct 26
• PHP2Shell confirmed working in the wild: a Perplexity researcher's honeypot logs full code execution BleepingComputer, Oct 26
• KB Kookmin Bank resumes its tablet-branch service after a five-day PHP shutdown on the regulator's advice SBS Biz, Oct 26
• PHP2Shell reaches IBM i shops: Zend backports fixes to end-of-life PHP as 'Black October' patching drags on IT Jungle, Oct 26
• 'Killa' wins the $2,000 StealMyBitcoin challenge with PHP2Shell after 19 hours, publishes a proof of concept Cyber Security News, Oct 26
• Most Nepal government websites are back online after the PHP2Shell shutdown; Nagarik app still down Kathmandu Post, Oct 26
• Korean security press: Unit 42 withdraws its PHP2Shell intrusion analysis, cannot confirm the entry route Dailysecu, Oct 26
• Unit 42 retracts its report of an AI-run PHP2Shell intrusion at a European government body Palo Alto Networks Unit 42, Oct 25
• Docomo restores J-Alert and evacuation alerts at 20:01 JST, earlier than planned, after PHP maintenance Keitai Watch, Oct 25
• KISA recommends a temporary fix for the third PHP bug, CVE-2026-115560, which the Oct 21 patches do not cover Topstar News, Oct 25
• Nepal's government sites enter a fourth day offline; licences and the central bank still down, passports back Ratopati, Oct 25
• Korean banks widen PHP2Shell checks; regulators found security gaps at 130 of 555 financial firms inspected eToday (Korea), Oct 25
• Japan's PHP2Shell service suspensions pass 500, Assured counts; SoftBank's alert emails off until Oct 26 FNN (Seoul), Tokyo correspondent, Oct 25
• SoftBank gets quake and tsunami alerts back at 09:25 JST; evacuation alerts stay off until Oct 26 Keitai Watch, Oct 25