PHP exploitation moves at slower-than-expected pace, but millions remain at risk
Comments on “PHP exploitation moves at slower-than-expected pace, but millions remain at risk”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (reported severity 9.2 each, enabling remote code execution), are drawing exploitation attempts, including from an expanded Potassium botnet variant that Sophos blocked. Wiz compared the potential impact to Heartbleed, but VulnCheck and Mandiant say most public exploits fail, partly because they rely on the rarely used display_errors setting. Mandiant validated some that work against default mod_php, not PHP-FPM. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart services, and rotate exposed credentials.
Why it ranked
No. 10 of 124 with a score of 0.72. The panel rated it highest on practical relevance (0.85) and reader interest (0.82), lowest on new information (0.41). The judges disagreed most on new information (spread 0.56), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.72total under rubric v2.2Contestedjudges differ by 0.56 on new information
- Significance0.72
- Reader interest0.82
- Audience breadth0.76
- Practical relevance0.85
- Substantiated0.63
- Technical depth0.55
- New information0.41
- Counts against: Promotional0.04
- Counts against: Overclaim0.23
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.74 | 0.70 | 0.72 | 0.72 | 0.04 | +0.24 | +0.173 |
| Reader interest | 0.74 | 0.82 | 0.90 | 0.82 | 0.16 | +0.26 | +0.213 |
| Audience breadth | 0.71 | 0.80 | 0.78 | 0.76 | 0.09 | +0.13 | +0.099 |
| Practical relevance | 0.82 | 0.85 | 0.88 | 0.85 | 0.06 | +0.22 | +0.187 |
| Substantiated | 0.49 | 0.60 | 0.80 | 0.63 | 0.31 | +0.05 | +0.032 |
| Technical depth | 0.65 | 0.45 | 0.55 | 0.55 | 0.20 | +0.05 | +0.028 |
| New information | 0.74 | 0.30 | 0.18 | 0.41 | 0.56 , above the contested threshold | +0.05 | +0.020 |
| Promotional | 0.08 | 0.03 | 0.01 | 0.04 | 0.07 | −0.19 | −0.008 |
| Overclaim | 0.32 | 0.25 | 0.12 | 0.23 | 0.20 | −0.11 | −0.025 |
| Sum of contributions | +0.719 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.719 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/10/"><img src="https://rubric.hrih.si/badge/2026-10-27/10.svg" alt="Ranked #10 on Rubric, 27 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 4 matches source · 2 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
CVE-2026-109618 and CVE-2026-109619 in PHP can enable remote-code execution and each has a severity score of 9.2 out of 10.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “can enable an attacker to achieve remote-code execution. Each has a severity score of 9.2 out of 10”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/cve-2026-109618
Matches sourceQuote
Arctic Wolf observed an exploitation attempt that combined command-execution validation with a second-stage payload delivery.
The cited source says the same thing.
The article says “command-execution validation with a second-stage payload delivery”
The source says “Arctic Wolf Labs observed a likely weaponized PHP2Shell exploitation attempt that combined command-execution validation with second-stage payload delivery”
Source cited by the article: arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution
Matches sourceNumber
Arctic Wolf did not find enough evidence to show that the two malicious binaries found in the payload hosting infrastructure were successfully downloaded or executed.
The cited source says the same thing.
The article says “Arctic Wolf said it did not find enough evidence to show successful downloading or execution”
The source says “Available telemetry did not establish that the observed PHP2Shell requests downloaded or executed either sample”
Source cited by the article: arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution
Matches sourceNumber
Sophos blocked an attack linked to Potassium and found its sample to be an updated, significantly expanded version of the botnet variant.
The cited source says the same thing.
The article says “An examination of the sample showed an updated and ‘significantly expanded’ version of the botnet variant, Sophos said”
The source says “analysis of the sample revealed that is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026”
Source cited by the article: sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
No source givenDate
Potassium is a Mirai-derived botnet originally discovered in March.
The article gives no link or citation for it.
The article says “Potassium, a Mirai-derived botnet originally discovered in March”
The source says No source to compare with.
No source givenNumber
PHP powers roughly 70% of websites across the globe.
The article gives no link or citation for it.
The article says “The scripting language powers roughly 70% of the websites across the globe”
The source says No source to compare with.
Matches sourceFirst, only or fastest
Wiz said the PHP vulnerabilities are among the most severe ever discovered in PHP and compared their impact to Heartbleed.
The cited source says the same thing.
The article says “Researchers at Wiz said the vulnerabilities are among the most severeever discovered in PHP”
The source says “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”
Source cited by the article: wiz.io/blog/php2shell-php-rce
Couldn’t checkQuote
Mandiant's Charles Carmakal said there is no current evidence of successful widescale exploitation and that many circulating PoCs appear vibe coded and cannot achieve RCE.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “there is no current evidence of successful widescale exploitation”
The source says No passage could be compared.
Source cited by the article: lnkd.in/p/eaRdBjVF
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.