php2shell: Successful attacks confirmed, many instances still unpatched
Comments on “php2shell: Successful attacks confirmed, many instances still unpatched”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Attackers are now exploiting the "php2shell" PHP flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2). Perplexity researcher Adel Karimi documented 35 shell executions on three honeypots running PHP 8.4.26 from two IP addresses, consistent with the first CVE. CISA added both bugs to its KEV catalog, with a federal deadline of October 29. Censys still lists over 4 million services reporting vulnerable version numbers, though backported distribution patches mean this overstates exposure. Wiz reports a 67% drop in exposed machines. Several of these figures could not be independently checked.
Why it ranked
No. 10 of 155 with a score of 0.70. The panel rated it highest on reader interest (0.82) and practical relevance (0.80), lowest on new information (0.41). The judges disagreed most on new information (spread 0.52), so the story is marked contested.
- AI judgeJudge 2claude-haiku-5-5
- Widely relevant security news on actively exploited PHP flaws with confirmed honeypot exploitation and millions still exposed; largely overlaps with prior php2shell coverage, lowering novelty and depth.
- AI judgeJudge 3gpt-5.6-luna
- Timely security reporting confirms real exploitation, gives honeypot evidence and prevalence data, and is highly actionable for PHP operators. However, the topic substantially overlaps multiple PHP2Shell stories already covered.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.70total under rubric v2.2Contestedjudges differ by 0.52 on new information
- Significance0.71
- Reader interest0.82
- Audience breadth0.70
- Practical relevance0.80
- Substantiated0.69
- Technical depth0.46
- New information0.41
- Counts against: Promotional0.04
- Counts against: Overclaim0.16
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.72 | 0.62 | 0.78 | 0.71 | 0.16 | +0.24 | +0.170 |
| Reader interest | 0.73 | 0.82 | 0.91 | 0.82 | 0.18 | +0.26 | +0.213 |
| Audience breadth | 0.65 | 0.67 | 0.78 | 0.70 | 0.13 | +0.13 | +0.091 |
| Practical relevance | 0.71 | 0.85 | 0.82 | 0.80 | 0.14 | +0.22 | +0.175 |
| Substantiated | 0.62 | 0.70 | 0.75 | 0.69 | 0.13 | +0.05 | +0.034 |
| Technical depth | 0.56 | 0.40 | 0.42 | 0.46 | 0.16 | +0.05 | +0.023 |
| New information | 0.70 | 0.35 | 0.18 | 0.41 | 0.52 , above the contested threshold | +0.05 | +0.021 |
| Promotional | 0.06 | 0.03 | 0.02 | 0.04 | 0.04 | −0.19 | −0.007 |
| Overclaim | 0.25 | 0.15 | 0.08 | 0.16 | 0.17 | −0.11 | −0.018 |
| Sum of contributions | +0.702 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.702 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/10/"><img src="https://rubric.hrih.si/badge/2026-10-28/10.svg" alt="Ranked #10 on Rubric, 28 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 2 no source given · 6 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
CISA added the php2shell vulnerabilities to its Known-Exploited-Vulnerabilities catalog on Monday, confirming successful attacks.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “CISA added the php2shell vulnerabilities to its “Known-Exploited-Vulnerabilities” catalog sometime Monday this week, confirming the successful attacks”
The source says No passage could be compared.
Source cited by the article: cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
Couldn’t checkNumber
In the first 26 hours after disclosure, Karimishiraz's honeypots saw 30 out-of-memory errors and 11 worker process crashes, with no evidence at that point that injected code had executed.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “There were 30 out-of-memory errors, and worker processes crashed 11 times, but there was no evidence that injected malicious code had been executed”
The source says No passage could be compared.
Source cited by the article: x.com/0x4D31/status/2113832919114658076
Couldn’t checkNumber
Karimishiraz documented 35 shells launched on three honeypots running PHP 8.4.26, with attacks coming from two IP addresses.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “he documented 35 shells launched on three honeypots running PHP 8.4.26; the attacks came from two IP addresses”
The source says No passage could be compared.
Source cited by the article: github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md
Couldn’t checkCausal conclusion
Karimishiraz's analysis confirmed the php2shell vulnerabilities allowed malicious code to reach and run on his honeypots.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “confirming that the php2shell vulnerabilities had allowed malicious code to reach and run on his honeypots”
The source says No passage could be compared.
Source cited by the article: github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md
No source givenNumber
Amazon and Cloudflare observed millions of attack attempts, which had not succeeded until recently.
The article gives no link or citation for it.
The article says “Network infrastructure companies such as Amazon and Cloudflare observed millions of attack attempts”
The source says No source to compare with.
No source givenNumber
On Friday, a Censys scanner reportedly found around 4.2 million vulnerable PHP instances in Germany alone.
The article gives no link or citation for it.
The article says “On Friday, a vulnerability scanner from IT security firm Censys had reportedly found around 4.2 million vulnerable PHP instances in Germany alone”
The source says No source to compare with.
Couldn’t checkNumber
On Tuesday morning the Censys scanner still listed more than 4 million services reporting version numbers of vulnerable PHP releases.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On Tuesday morning, the scanner still listed more than 4 million services reporting version numbers for vulnerable PHP releases”
The source says No passage could be compared.
Source cited by the article: php2shell.censys.com
Couldn’t checkGeneralization
Numerous organizations took their websites offline preemptively last week to apply security patches.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “numerous organizations took their websites offline preemptively last week to apply security patches”
The source says No passage could be compared.
Source cited by the article: heise.de/news/php2shell-Updates-trudeln-ein-viele-Webseiten-offline-Angriffe-laufen-11496366.html
Also covered by
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.