{"name":"PHP2Shell (CVE-2026-109618 / CVE-2026-109619): reference and patch-availability census 2026","url":"https://www.servnetuk.com/research/php2shell-2026","licence":"Servnet’s derived dataset and compilation: CC BY 4.0 (attribute \"Servnet Research — PHP2Shell patch-availability census 2026\", with a link to the study page). Vendor advisories and third-party statistics remain their publishers’ own and are cited, not relicensed.","note":"A snapshot dated 27 October 2026. Working exploits exist and the flaw is on CISA’s KEV list, but no widespread real-world compromise had been publicly evidenced at the time of writing.","study":"PHP2Shell (CVE-2026-109618 / CVE-2026-109619): what the flaws are, how the world responded, and who had shipped a fix","snapshot_as_at":"2026-10-27T17:00:00Z","as_at_line":"Everything on this page is dated to 27 October 2026. It is a fast-moving incident; figures and fix states are a snapshot, not a live feed.","dataset":{"csv":"/research/php2shell-patch-availability-2026.csv","readme":"/research/php2shell-patch-availability-2026-README.txt","rows":92,"channel_families":35,"licence":"CC BY 4.0","derived_licence":"Creative Commons Attribution 4.0 (CC BY 4.0)","derived_licence_url":"https://creativecommons.org/licenses/by/4.0/"},"patch":{"rows_total":92,"channel_families":35,"fixed_rows":75,"release_day_fixed":50,"within_48h_fixed":72,"unfixed_or_wontfix":13,"pending_rows":4,"wontfix_rows":7,"na_rows":2,"before_release_rows":11,"fastest":"The earliest fix appeared on the Wolfi/Chainguard channel: the Wolfi commit carrying it was merged at 03:36 UTC on 21 October, more than ten hours before the coordinated 14:00 UTC release, and Chainguard published patched container images at 07:41 UTC — the publication the PHP Foundation records as an embargo break.","slowest":"The slowest genuine PHP2Shell fix we traced is Red Hat Enterprise Linux 9.6 EUS php:8.3 (RHSA-2026:89111), on 26 October at 20:43 UTC — five days after release.","by_day":[{"day":"Release day (21 Oct)","fixed":50},{"day":"+1 day (22 Oct)","fixed":16},{"day":"+2 days (23 Oct)","fixed":6},{"day":"+3 days (24 Oct)","fixed":1},{"day":"+5 days (26 Oct)","fixed":1}],"status_split":[{"label":"Fix shipped","n":75,"tone":"good"},{"label":"Still pending","n":4,"tone":"warn"},{"label":"Will not fix / EOL","n":7,"tone":"bad"},{"label":"Not applicable","n":2,"tone":"muted"},{"label":"Vendor statement or note, no fix verdict","n":4,"tone":"info"}],"table":[{"platform":"PHP upstream (php.net)","stream":"8.2 / 8.3 / 8.4 / 8.5","fixed_version":"8.2.35, 8.3.36, 8.4.27, 8.5.12","when":"21 Oct, 14:00 UTC","days":"0","cls":"fixed","note":"the reference point; EOL 7.4/8.0/8.1 get source-only backports"},{"platform":"Chainguard / Wolfi","stream":"php-8.2 … php-8.5","fixed_version":"patched rebuilds of the prior versions","when":"21 Oct, 03:36 UTC","days":"0","cls":"fixed","note":"the Wolfi commit carrying the private patch was merged ~10 h early; the patched images followed at 07:41 UTC (the embargo break)"},{"platform":"windows.php.net","stream":"8.2 / 8.3 / 8.4 / 8.5 zips","fixed_version":"8.2.35 … 8.5.12","when":"21 Oct, ~13:47 UTC","days":"0","cls":"fixed","note":"directory timestamp; the 26 Oct '-1' rebuilds are a separate Brotli fix, not PHP2Shell"},{"platform":"Debian","stream":"13 trixie — php8.4","fixed_version":"8.4.27-1~deb13u1","when":"21 Oct, 13:45 UTC","days":"0","cls":"fixed","note":"DSA-6574-1; LTS/ELTS branches followed via Freexian"},{"platform":"Ubuntu","stream":"24.04 / 26.04 LTS","fixed_version":"8.3.6-…, 8.5.4-…","when":"21 Oct, 13:56 UTC","days":"0","cls":"fixed","note":"USN-8948-1; 7.x on older LTS via Ubuntu Pro/ESM"},{"platform":"Ondřej Surý (ppa:ondrej/php, deb.sury.org)","stream":"7.4 … 8.5","fixed_version":"8.5.12-1 … plus 7.4/8.0/8.1 backports","when":"21 Oct, 14:45 UTC","days":"0","cls":"fixed","note":"shipped fixes for EOL branches too"},{"platform":"Remi RPM repository","stream":"EL 8/9/10 + Fedora","fixed_version":"8.2.35 … 8.5.12 (+ 7.4/8.0/8.1)","when":"21 Oct (file 13:49 UTC)","days":"0","cls":"fixed","note":"file time; EOL branches labelled a 'mitigation fix'"},{"platform":"Docker Hub official 'php' image","stream":"8.2 … 8.5 (all variants)","fixed_version":"php:8.5.12 … 8.2.35","when":"21 Oct, ~16:52 UTC","days":"0","cls":"fixed","note":"the 8.1 / 8.0 / 7.4 tags are EOL and were not rebuilt"},{"platform":"Alpine","stream":"v3.24 — php83/84/85","fixed_version":"8.3.36-r0 … 8.5.12-r0","when":"21 Oct, 16:29 UTC","days":"0","cls":"fixed","note":"older Alpine branches landed on 22 Oct"},{"platform":"Homebrew (homebrew-core)","stream":"php, php@8.2 … @8.4","fixed_version":"8.5.12, 8.4.27, 8.3.36, 8.2.35","when":"21 Oct, by 17:28 UTC","days":"0","cls":"fixed","note":"php@8.1 is deprecated and was not updated"},{"platform":"Red Hat Enterprise Linux","stream":"RHEL 9 — php default (8.0)","fixed_version":"php-8.0.30-8.el9_8.1","when":"21 Oct, 20:06 UTC","days":"0","cls":"fixed","note":"RHEL 8/10 main streams same day"},{"platform":"cPanel EasyApache 4","stream":"ea-php82 … ea-php85","fixed_version":"8.2.35 … 8.5.12","when":"21 Oct","days":"0","cls":"fixed","note":"ea-php74/80/81 got backported fixes"},{"platform":"Plesk","stream":"PHP handlers 8.2 … 8.5","fixed_version":"8.2.35 … 8.5.12","when":"21 Oct","days":"0","cls":"fixed","note":"7.4/8.0/8.1 backported on Linux"},{"platform":"CloudLinux","stream":"ea-php for cPanel","fixed_version":"ea-php52 … ea-php85","when":"21 Oct, 21:45 UTC","days":"0","cls":"fixed","note":"alt-php and native PHP followed on 22 Oct; CloudLinux 6 still unconfirmed"},{"platform":"Rocky Linux","stream":"9 — php / 8.2 / 8.3","fixed_version":"rebuilds of the RHSAs","when":"22 Oct, 00:04 UTC","days":"1","cls":"fixed","note":""},{"platform":"AlmaLinux","stream":"8 / 9 / 10","fixed_version":"rebuilds + own 7.2/7.3/8.0/8.1 fixes","when":"22 Oct, 13:25 UTC","days":"1","cls":"fixed","note":"shipped EOL-stream fixes beyond RHEL on 23 Oct"},{"platform":"Amazon Linux 2023","stream":"php8.2 … php8.5","fixed_version":"8.2.35 … 8.5.12","when":"22 Oct","days":"1","cls":"fixed","note":"AL2023 php8.1 is marked 'No Fix Planned'"},{"platform":"Red Hat Enterprise Linux","stream":"EUS / AUS / TUS / E4S","fixed_version":"module rebuilds","when":"23 Oct","days":"2","cls":"fixed","note":"extended-support releases"},{"platform":"Red Hat Enterprise Linux","stream":"RHEL 7 ELS — php 5.4","fixed_version":"php-5.4.16-48.el7_9.1","when":"23 Oct, 13:54 UTC","days":"2","cls":"fixed","note":"fixes CVE-2026-109619 only; RHEL 7 is not affected by 109618"},{"platform":"Red Hat Enterprise Linux","stream":"RHEL 9.6 EUS — php:8.3","fixed_version":"php-8.3.19-…","when":"26 Oct, 20:43 UTC","days":"5","cls":"fixed","note":"the slowest genuine fix we traced"},{"platform":"Red Hat Enterprise Linux","stream":"RHEL 9 — php:8.4 module","fixed_version":"none — Red Hat marks it 'Affected'","when":"—","days":"pending","cls":"pending","note":"no erratum as of 27 Oct"},{"platform":"Alpine","stream":"edge/testing — php82, php81","fixed_version":"not rebuilt (8.2.34-r0 / 8.1.34-r6)","when":"—","days":"pending","cls":"wont-fix","note":"stable Alpine branches did ship php82 8.2.35"},{"platform":"Amazon Linux","stream":"AL2 core php; AL2023 php8.1","fixed_version":"none — 'No Fix Planned'","when":"—","days":"pending","cls":"wont-fix","note":""},{"platform":"Azure App Service","stream":"built-in PHP on Windows; Azure Stack Hub","fixed_version":"none — built-in runtimes are EOL","when":"—","days":"pending","cls":"wont-fix","note":"Linux Latest/Standard channels were fixed on 21 Oct"},{"platform":"AWS Lambda","stream":"PHP","fixed_version":"no managed PHP runtime","when":"—","days":"na","cls":"not-applicable","note":"PHP on Lambda is customer-managed (custom runtime / container)"}]},"cves":[{"id":"CVE-2026-109618","name":"RCE via OOM corruption","advisory":"GHSA-w8hw-w9fx-j79w","cvss_php_v4":"9.2","cvss_nvd_v31":"9.8","cwe":"CWE-416 (use after free), with CWE-755/824/1325/1419","affected_from":"PHP 7.3.0 (this bug's corruption path)","one_line":"A failed memory allocation during request start-up leaves half-built internal data that PHP's clean-up code then trusts.","mechanism":"PHP gives every request a memory budget (memory_limit), and historically used a C longjmp() to bail out when an allocation would exceed it. During request start-up, some internal structures are briefly reachable before they are fully built; if an allocation fails at that exact moment, PHP leaves that memory in an invalid state, and the request-cleanup code runs anyway and acts on it. An attacker reaches the out-of-memory moment through multipart form parsing — a request with no usable declared length slips past the initial size check, and empty file fields and deeply nested field names build large internal arrays while the upload on the wire stays small.","worst_on":"Apache mod_php, which always runs request cleanup even when start-up failed and before any of the site's own code executes — so even a one-line 'Hello World' page is exposed.","confirmed_impact":"PHP confirmed full unauthenticated remote code execution against mod_php with default settings. PHP-FPM is rated susceptible by code analysis, but no complete FPM exploit was demonstrated for this bug."},{"id":"CVE-2026-109619","name":"RCE via stale global state","advisory":"GHSA-6wmf-4rv5-p3rp","cvss_php_v4":"9.2","cvss_nvd_v31":"8.1","cwe":"CWE-416 (use after free), with CWE-755/824/1325/1419","affected_from":"PHP 5.4.0","one_line":"A worker keeps global state that points into one request's memory; a later request on the same worker reads it after it has been freed.","mechanism":"A PHP worker process serves many requests in turn and holds global state — error, session and extension data — that temporarily points into the current request's memory. That state must be wiped before the request's memory is freed, but a fatal error (including one caused by running out of memory) can abandon the matching reset, or a late diagnostic can refill the state after it was cleared. A later request on the same worker then reads or acts on freed memory. Exploitation needs a 'producer' request that leaves the dangling pointer and a 'consumer' operation in a later request that touches it before normal initialisation resets it.","worst_on":"On PHP 8.5 the strongest demonstrated case is the fatal_error_backtraces global, whose reset is always missed on shutdown; this is the basis of the confirmed mod_php RCE. Session upload progress — enabled by default, needing no session_start() call — is the other confirmed path.","confirmed_impact":"PHP confirmed unauthenticated heap use-after-free, memory disclosure and remote code execution. Unlike the OOM bug, this one was also demonstrated on PHP-FPM, through application fatal-error paths."}],"cvss_note":"Both flaws carry PHP's own authoritative CVSS v4.0 base score of 9.2. Three other numbers are in circulation: the US National Vulnerability Database scores them 9.8 and 8.1 under the older CVSS v3.1 (it rates the second lower because it judges the attack more complex); and a figure of 10.0 circulated before release, which the PHP Foundation explicitly disowned — \"the actual score is 9.2\".","discovery":{"summary":"The flaws were found by two security firms using AI assistance, and the deeper root cause had been seen — and left unfixed — two years earlier.","points":["The security firm Calif (researcher Ryan Austin) reported the first bug to the PHP project on 11 August 2026, having found it in early August during OpenAI's 'Patch the Planet' programme, using GPT-5.6 Sol; Wiz Research independently found and reported both flaws, crediting Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.","The PHP Foundation says a core developer first saw 'the first signs of the OOM problem' during a 2024 security audit (funded by Germany's Sovereign Tech Agency, run through OSTIF and carried out by Quarkslab), but a fix stalled — the Foundation calls the delay 'a structural failure, caused by both the security team's decision process and its lack of resources'.","The PHP Foundation maintains the language with around 13 full- and part-time engineers and relies on donations — a point several commentators contrasted with the scale of AI-research funding.","The disclosure did not go to plan: the CVE identifiers (and a wrong 10.0 score) leaked on 20 October, so PHP pulled the release forward a day to 21 October; Calif briefly published a proof-of-concept video; and Chainguard shipped patched images before the embargo lifted."]},"timeline":[{"when":"2024","label":"A PHP core developer sees 'the first signs' of the OOM bug during the Quarkslab security audit. A fix is not agreed, and the issue is left open.","kind":"origin"},{"when":"30 Jul – 24 Aug 2026","label":"Calif and, separately, Wiz discover remote-code-execution paths in the PHP engine using AI tooling, and report them to the PHP security team.","kind":"origin"},{"when":"20 Oct, ~15:00 UTC","label":"The two CVE IDs leak on Hacker News and social media, with a wrong release time and a wrong CVSS 10.0. PHP moves the release forward from 22 to 21 October.","kind":"leak"},{"when":"20 Oct, 19:33 UTC","label":"PHP publishes an advance notice: a critical release at 14:00 UTC the next day, both flaws rated CVSS v4.0 9.2.","kind":"vendor"},{"when":"21 Oct, 07:41 UTC","label":"Chainguard publishes patched container images more than six hours early (the underlying Wolfi commit had been merged at 03:36 UTC) — it is this publication the PHP Foundation records as an embargo break.","kind":"patch"},{"when":"21 Oct, 13:34 UTC","label":"The GitHub security advisories go live, about 26 minutes before the planned release time.","kind":"vendor"},{"when":"21 Oct, 14:00 UTC","label":"PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12, plus source-only backports for end-of-life 7.4/8.0/8.1. Distributions and panels begin shipping fixes within minutes.","kind":"patch"},{"when":"21 Oct","label":"Governments start taking services offline as a precaution — the Netherlands (incl. DigiD), Finland, France's Interior Ministry, Czechia, Canada — and UK councils including Edinburgh, Bristol and Oxford. Wikimedia, 4chan and several Japanese services go dark; Reuters also reported the Internet Archive going dark, though whether that was linked to PHP2Shell is disputed. CISA says it has 'not observed exploitation'; the UK NCSC advises considering taking systems offline.","kind":"impact"},{"when":"22 Oct","label":"In the Lords, a UK minister reports 32 government services unavailable and four partly so (largely precautionary), 50,000 NCSC notifications sent, and 'no confirmed compromise' of UK public-sector systems. Sophos claims one successful exploitation, then retracts it the same day.","kind":"impact"},{"when":"23 Oct","label":"PHP discloses a third, lower-risk flaw, CVE-2026-115560 (session upload progress), with no out-of-band fix — only the configuration mitigation. Unit 42 reports an attack on a European government agency.","kind":"vendor"},{"when":"24 Oct","label":"Researcher Adel Karimi publishes honeypot evidence of confirmed remote code execution — on a deliberately favourable single-worker Apache setup running PHP 8.4.26, consistent with CVE-2026-109618 only.","kind":"exploit"},{"when":"25 Oct","label":"Unit 42 retracts its European-agency attribution: it cannot tie the initial access to the PHP2Shell CVEs.","kind":"exploit"},{"when":"26 Oct","label":"Shadowserver reports 'no confirmed exploitation' against its sensors. CISA adds both CVEs to its Known Exploited Vulnerabilities catalogue (federal deadline 29 Oct). Trail of Bits confirms working exploits against pre-patch PHP 8.2–8.5 — in the lab, not in the wild.","kind":"exploit"},{"when":"27 Oct","label":"This snapshot. Working exploits exist and the flaw is actively targeted, but no widespread real-world compromise has been publicly evidenced.","kind":"origin"}],"exploitation":{"headline":"As of 27 October 2026: proven exploitable, actively targeted, but no widely-evidenced mass compromise.","points":["Working exploits demonstrably exist. Calif, Wiz and Trail of Bits have each built them against real applications in the lab; Adel Karimi caught genuine remote code execution on honeypots on 24 October — on a single-worker Apache setup he deliberately made favourable to the flaw, and matching CVE-2026-109618 only.","The flaw is being targeted. Amazon saw a probe four days before disclosure (17 October); Cloudflare reported tens of thousands of attempts within 45 minutes of the announcement. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October, with a 29 October deadline for US federal agencies.","But confirmed real-world compromise has been elusive. Sophos claimed a successful exploitation on 22 October and retracted it the same day; Unit 42 claimed a government-agency case on 23 October and retracted it on 25 October; Shadowserver reported 'no confirmed exploitation' on 26 October; and the UK government reported no confirmed compromise of its systems. Much of the early 'exploitation' traffic was scanning, fingerprinting and non-working — in one researcher's words, 'AI slop'.","The honest reading for a buyer: do not wait for proof of a breach. Attempts began before the patch existed, a reliable public exploit now exists, and the gap between disclosure and weaponisation was measured in hours, not weeks."]},"exposure":{"intro":"How many systems are exposed depends entirely on what you count — instances, IP addresses, hosts, services or websites — so the published figures shown here range from about 1.4 million to 22.6 million. They are not alternative estimates of the same thing; each is shown with what it actually measures.","figures":[{"figure":"22.6 million","what":"exposed instances the vendor judged potentially vulnerable (instances, not IPs; method undisclosed)","by":"Palo Alto Networks (Cortex Xpanse / Unit 42)","date":"22 Oct"},{"figure":"~5.1 million","what":"IP addresses running PHP, ~3.8 million with an open port; ~1.1M expose a version, of which ~758K are on 5.4–8.1","by":"VirusTotal","date":"21 Oct"},{"figure":"1.91 million","what":"Shodan hosts running PHP (no version or vulnerability filter)","by":"Henk Poley","date":"20 Oct"},{"figure":"~1.38 million","what":"hosts running named PHP apps (WordPress, phpBB and the like) — an app census, not a vulnerability check","by":"Silas Cutler","date":"20 Oct"},{"figure":"69.2%","what":"of all websites whose server-side language is known use PHP; by our calculation from the same source's version split, around 48% of PHP sites are on end-of-life branches (8.1 or older)","by":"W3Techs (derivation ours)","date":"27 Oct"}],"uk":{"intro":"Two third-party trackers give a UK picture. We cite their published figures; we did not reproduce their datasets.","points":["Infrawatch counted roughly 153,945 active PHP services in the UK. On 27 October its live tracker put the UK patch rate at about 27% of eligible, version-visible hosts — up from 8.5% on 22 October, and behind the Netherlands (~50%), Germany (~37%) and France (~36%), but ahead of the United States (~20%).","Shadowserver, which added an 'end-of-life PHP' tag rather than a CVE-specific one, counted roughly 21,100 UK IP addresses still running PHP older than 8.2."]}},"bitcoin":{"intro":"Within days of the patch, someone built a public dare around the question everyone was asking: is PHP2Shell really exploitable, or is the alarm overblown? The 'Steal My Bitcoin' challenge is a useful illustration — and a useful caution about reading too much into a stunt.","points":["A site, stealmybitcoin.com, ran an unpatched PHP 8.4.26 server and offered a Bitcoin bounty to anyone who could break in using the PHP2Shell flaws. The prize started at about $500 and grew through donations to roughly $2,021 (0.0251 BTC). The organisers' stated aim was to test whether the flaws — and the claim that AI makes them easy to exploit — were as dangerous as reported.","It survived the first ~17 hours untouched, which some read as evidence the flaw was overblown. Security researchers pushed back hard: the server was serving a static HTML page, so it never exposed a page that actually ran the vulnerable code. One researcher called using a misconfigured challenge as proof of safety 'a very dangerous narrative'.","Once the organisers added a normal PHP-executing page (reported around 25 October), the server fell within hours (accounts put it at under three to under four hours). A researcher using the handle KillaBoi logged the win about 19 hours into the challenge and published a write-up.","Reports differ on the payout — some say the recovered key did not match the advertised prize address, others that the prize wallet was emptied — and the site now shows the challenge as won. Crucially, the exercise does not show that an autonomous AI carried out the attack, and a single anecdote is not a measure of how exploitable the flaw is across real-world configurations. What it does reinforce is the main lesson: once the vulnerable path is reachable, exploitation is fast."],"sources_note":"This account is drawn from reporting by several security and technology outlets (26–27 October 2026); Servnet did not interact with the challenge in any way. Outlets differ on who ran the site and on the payout details, and those points are flagged above."},"mitigations":{"intro":"Updating is the only complete fix. PHP is explicit that the configuration mitigations below reduce exposure to specific paths but do not make an installation safe.","fixed_versions":"PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (released 21 Oct 2026). PHP 8.1 and older are end of life and get no official release — only source-only backport branches for 7.4/8.0/8.1; use a vendor package (your distro, Ondřej Surý, Remi, a control panel) or upgrade.","steps":[{"h":"Update, then restart every worker","p":"Installing the package is not enough: a reload leaves already-running workers holding the vulnerable code in memory. Restart (not reload) PHP-FPM, Apache or your container after updating. Capture forensic evidence first if you suspect compromise — a restart erases it."},{"h":"If you cannot patch immediately","p":"Partial, path-specific mitigations only: for CVE-2026-109618, set and enforce memory_limit=-1 administratively (and never use RLIMIT_AS / RLIMIT_DATA, which make it worse); for CVE-2026-109619, set session.upload_progress.enabled=0, and on PHP 8.5 also fatal_error_backtraces=0. Restart every worker afterwards. A web application firewall can blunt known payloads but is a stopgap, not a fix. Where none of this is feasible in time, several national cyber agencies advised considering taking the system offline until it is patched."},{"h":"Mind the known rough edges","p":"8.4.27 and 8.5.12 shipped with a SimpleXML garbage-collection regression (unrelated to the security fix) that can crash some applications; a source fix exists but, as of 27 October, had not yet shipped in a release. On Windows, the 26 October '-1' rebuilds fix a separate Brotli bug (CVE-2026-111497), not PHP2Shell — the PHP version is unchanged. And a third, lower-risk flaw, CVE-2026-115560 (session upload progress), has no fix yet; php.net advises session.upload_progress.enabled=0 until the next regular release, so every 'patched' build is still subject to it."}]},"page":{"title":"PHP2Shell: the critical PHP vulnerabilities, and who had shipped a fix","standfirst":"In October 2026 two flaws in the PHP engine — nicknamed PHP2Shell — could let an unauthenticated attacker run code on a vulnerable web server, and led governments around the world to take services offline as a precaution. This is a plain-English reference to what the flaws are and how the incident unfolded, built around an original census of when a fix reached each way you actually install PHP.","caveats":["This is a count and a chronology, dated 27 October 2026. It is not a live exploitation feed, and it is not security advice for your specific estate — if you run PHP, patch and restart now, then check for compromise.","On exploitation we follow the evidence carefully: working exploits exist and the flaw is on CISA's exploited-vulnerabilities list, but several 'successful compromise' claims were retracted and no widespread real-world compromise had been publicly evidenced by 27 October. We do not overstate it in either direction."],"sections":[{"id":"what","heading":"What PHP2Shell is"},{"id":"how","heading":"How the two flaws work"},{"id":"patch-tracker","heading":"Who had shipped a fix, and when"},{"id":"world","heading":"How the incident unfolded"},{"id":"exploitation","heading":"Is it actually being exploited?"},{"id":"exposure","heading":"How exposed is the web?"},{"id":"bitcoin","heading":"The 'Steal My Bitcoin' challenge"},{"id":"fix","heading":"How to fix it"}],"method":{"points":["The patch-availability census is our own measurement. We traced each PHP install channel — Linux distributions and their extended-support tiers, container images, third-party repositories, control panels and cloud platforms — to a primary source (a vendor security tracker, advisory, package index or git commit), and recorded the fixed version, the date the source shows and an exact quote. Each row is classified fixed / pending / won't-fix / not-applicable, or statement-only where the source gives no fix verdict of its own.","The reference point is the upstream PHP release on 21 October 2026, 14:00 UTC. 'Days after' is measured from that date; where a source gives a time we note hours relative to 14:00 UTC.","Several timestamps are file or build times, not publication times, and some sources give no timezone; both are noted per row in the dataset, and a file existing is not the same as users being able to install it.","The technical description is taken from the two GitHub security advisories, php.net and the PHP Foundation; the chronology, exploitation evidence, government response and exposure figures from primary sources (CISA KEV, national cyber agencies, Hansard, vendor telemetry posts) wherever possible, with each claim attributed.","Third-party figures we could not independently reproduce — the Infrawatch and Shadowserver UK numbers, the exposure counts — are presented as attributed statistics, not as our data. The exposure figures are deliberately not merged, because they measure different things."],"sources":[{"name":"PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","what":"the flaws, CVSS, affected and fixed versions, mitigations"},{"name":"php.net news archive and the PHP Foundation blog","url":"https://www.php.net/archive/2026.php","what":"release, source backports, the disclosure story, the third flaw"},{"name":"CISA Known Exploited Vulnerabilities catalogue","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","what":"KEV addition dates and the federal deadline (public domain, CC0)"},{"name":"Vendor security trackers, advisories and package indexes","url":"https://www.servnetuk.com/research/php2shell-patch-availability-2026.csv","what":"the 92-row patch-availability dataset, each row sourced"},{"name":"UK Parliament (Hansard)","url":"https://hansard.parliament.uk/","what":"the UK government's own statement of services affected and notifications sent"}]}}}