CISA confirms attackers are exploiting both PHP2Shell flaws
Comments on “CISA confirms attackers are exploiting both PHP2Shell flaws”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
CISA has added both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalogue, requiring federal civilian agencies to patch by 29 October, though it has not named victims or detailed its evidence.
Why it ranked
No. 85 of 110 with a score of 0.63. The panel rated it highest on reader interest (0.87) and practical relevance (0.86), lowest on technical depth (0.65). Overclaim counted against it (0.54). The judges disagreed most on new information (spread 0.43), so the story is marked contested. The claim check took 0.100 off. Placed No. 85, No. 29 by score alone: the 24th Security story of the day (−0.080), and close to “php2shell: Successful attacks confirmed, many instances still unpatched”, No. 10 on Wednesday 28 October 2026 (−0.050). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Major active exploitation of a widely used web flaw with CISA KEV listing and practical patch urgency; evidence partly from honeypots, with corrections and unverified claims noted.
- AI judgeJudge 3gpt-5.6-luna
- Important security news with concrete honeypot and scanning data, remediation deadlines, and campaign context. However, the headline overstates evidence: public technical confirmation covers one flaw, while CISA’s inclusion of both lacks disclosed supporting detail.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.63total under rubric v2.3Contestedjudges differ by 0.43 on new information, 0.42 on overclaim
- Significance0.76
- Reader interest0.87
- Audience breadth0.75
- Practical relevance0.86
- Substantiated0.72
- Technical depth0.65
- New information0.70
- Counts against: Promotional0.03
- Counts against: Overclaim0.54
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.74 | 0.72 | 0.82 | 0.76 | 0.10 | +0.24 | +0.182 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.82 | 0.85 | 0.94 | 0.87 | 0.12 | +0.26 | +0.226 |
| Audience breadthHow many people who build technology does it concern? | 0.66 | 0.80 | 0.78 | 0.75 | 0.14 | +0.13 | +0.097 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.81 | 0.90 | 0.86 | 0.86 | 0.09 | +0.22 | +0.188 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.70 | 0.68 | 0.78 | 0.72 | 0.10 | +0.05 | +0.036 |
| Technical depthHow technically substantive is it? | 0.68 | 0.60 | 0.68 | 0.65 | 0.08 | +0.05 | +0.033 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.77 | 0.45 | 0.88 | 0.70 | 0.43 , above the contested threshold | +0.05 | +0.035 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.03 | 0.01 | 0.03 | 0.05 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.59 | 0.30 | 0.72 | 0.54 | 0.42 , above the contested threshold | −0.11 | −0.059 |
| Sum of contributions | +0.733 | ||||||
| Claim-check penalty | −0.100 | ||||||
| Total, as published | 0.633 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-29/85/"><img src="https://rubric.hrih.si/badge/2026-10-29/85.svg" alt="Ranked #85 on Rubric, 29 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 3 matches source · 1 differs from source · 1 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
CISA added both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalogue on Monday, with federal civilian agencies required to fix them by Thursday, 29 October.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Federal civilian agencies have until Thursday, 29 October, to fix CVE-2026-109618 and CVE-2026-109619”
The source says No passage could be compared.
Source cited by the article: cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
Couldn’t checkNumber
Adel Karimi's honeypots recorded 35 shell commands started by the Apache web server on Saturday, 24 October.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On Saturday, 24 October, they recorded 35 shell commands started by the Apache web server”
The source says No passage could be compared.
Source cited by the article: github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md
Couldn’t checkGeneralization
The honeypot evidence matches CVE-2026-109618 and does not show the second flaw being used.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The evidence matches CVE-2026-109618 and does not show the second flaw in use”
The source says No passage could be compared.
Source cited by the article: github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md
Matches sourceNumber
Dream said it found traces of a campaign that rooted 25 servers, including systems in a US government-affiliated environment, consisting of 24 firewalls and one internal management server.
The cited source says the same thing.
The article says “it said it found traces of a campaign that rooted 25 servers”
The source says “Among the 24 rooted firewalls, two belonged to a US government-affiliated organization”
Source cited by the article: dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
Matches sourceCausal conclusion
Dream said the attackers paired PHP2Shell with Fragnesia (CVE-2026-46300), a Linux kernel flaw that can give an attacker root access.
The cited source says the same thing.
The article says “the attackers paired PHP2Shell with Fragnesia (CVE-2026-46300”
The source says “The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems”
Source cited by the article: dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
Differs from sourceNumber
Delft University of Technology's Threat Intelligence Lab logged 68,499 exploitation requests from 652 IP addresses in 73 countries since 21 October, of which 174 addresses sent code or a dropper.
The cited source says something else; both quotes are shown.
The article says “it had logged 68,499 exploitation requests from 652 IP addresses in 73 countries since 21 October”
The source says “72,669 exploitation requests from 664 source IPs in 309 autonomous systems and 73 countries, 2026-10-21 08:37:17 to 2026-10-29 00:18:50 UTC”
Source cited by the article: php2shell.delftintellab.com
Matches sourceNumber
Sophos corrected an earlier report of successful attacks on its customers; its telemetry showed only scanning and a few failed attempts.
The cited source says the same thing.
The article says “Its telemetry showed only scanning and a few failed attempts”
The source says “we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts”
Source cited by the article: sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
No source givenVersion
PHP fixed both flaws on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The article gives no link or citation for it.
The article says “PHP fixed both flaws on 21 October, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35”
The source says No source to compare with.
Also covered by
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 29 Oct 2026, 05:47 UTC. It played no part in the ranking.