Where the dependency reaches
NCSC SNAPSHOTComponent records by category. Select a bar to investigate.
Research snapshot · 23 Oct 2026
PHP2Shell Impact Observatory
Affected software, service disruption and estate triage for two PHP runtime CVEs.
Patch PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12
CVSS 9.2 RCE, no login needed. Attempts since 17 Oct.
Sourced events and the affected stack
VulnerableFixInvestigationNot vulnService case
Top: events by date in lanes (11 Aug, then 17 to 22 Oct; dashed lines mark skipped days). Squares are service case groupings, hollow when only secondary reporting exists. Bottom: NCSC-NL component records per category, bar length is the count, color is the assessment for the chosen CVE. Click a mark to open its row; click empty space to reset.
Background readingThe CVE systemVulnerability managementIncident response
Loading source snapshots…
What the evidence says
Chart data
One record per component. Select the CVE to inspect its assessment.
“Fix” means a fix exists for the stated scope. It does not establish that your deployed instance is patched.
Patch-adoption estimate · 99.3% reported unpatched
A patch-adoption signal, with limits
99.3%
Reported unpatched among measurable instances, 24 hours after disclosure.
OX Security, 22 Oct ↗ · Shodan-visible sample exceeding 2.2M PHP instances. Banner visibility, backports and scan lag limit interpretation. This is a vendor estimate, not a global census or breach count.
Trace the potential impact
Potential impact
ANALYST MODELArrows show possible consequences, not observed victim paths.
Unpatched web-serving PHPFPM · mod_php · CGI · FrankenPHP · LiteSpeed
Response priorities
What needs attention first
01
Public web runtimes
Find the actual serving runtime, including containers and alternate PHP pools. A CLI version may describe a different installation.
02
Hidden PHP dependencies
Inspect panels, appliances and embedded packages. Assign a patch owner and demand vendor-specific build evidence.
03
Look back, then verify
Review activity from at least 17 October, preserve evidence and verify running workers after remediation.
Which software needs investigation?
Search the pinned NCSC inventory. Status belongs to a component and version scope; installations and affected organizations were not measured.
Compare categories by assessment
Counts for the selected CVE.
| Component / supplier | Category | Assessment | Version scope |
|---|
Investigation includes PHP dependencies without a confirmed CVE match. An inventory relationship alone does not prove exploitability. Read the full scoped assessment before acting.
How the response reached everyday services
Explore 14 curated case groupings across nine sectors. Each entry distinguishes primary statements from secondary reporting and preserves the limits of the source.
Coverage by sector
Counts describe this research collection, not incident frequency.
Chart data
Government disruption, explicitly scoped
32services unavailable
4partly unavailable
UK ministerial statement, 22 October. Largely precautionary action during remediation; no global denominator or duration.
An unavailable website does not establish disruption of clinical care, banking systems, rail operations or physical port activity. No such downstream outcome is inferred here.
| Service / group | Sector / region | Status / date | Evidence / source | Impact and limits |
|---|---|---|---|---|
| UK government services | GovernmentUnited Kingdom | Precautionary disruption2026-10-22 | Primary statementUK Parliament / Hansard | The minister reported 32 services unavailable and four partly unavailable, largely because of protective measures during remediation. Scope and limitsCross-government point-in-time reporting; no complete service list or outage duration. Do not interpret 36 services as 36 breaches. |
| Dutch public digital services | GovernmentNetherlands | Precautionary disruption2026-10-21 | Primary statementGovernment of the Netherlands | The Dutch government described preventive shutdowns affecting public websites, naming Overheid.nl, MijnOverheid.nl and DigiD. Scope and limitsThe notice also says many government sites do not use PHP. This does not establish that every service of each named platform was affected. |
| St. Antonius hospital website | HealthcareNetherlands | Reported restoration2026-10-21 | Primary statementSt. Antonius Ziekenhuis | The hospital announced that its website was reachable again after disruption connected to the PHP vulnerability. Scope and limitsPublic website scope. No inference about clinical systems, patient safety incidents or data compromise. |
| Wikimedia supporting services | Knowledge & communityGlobal | Precautionary disruption2026-10-21 | Primary statementWikimedia Foundation | Wikimedia deliberately took supporting services offline pending safe patching; volunteer-run Toolforge and Cloud VPS workloads added owner dependencies. Scope and limitsSupporting services are not equivalent to all Wikipedia pages being unavailable. No breach total is reported. |
| Weird Gloop hosted wikis | Knowledge & communityGlobal | Precautionary disruption2026-10-21 | Primary statementWeird Gloop | The operator reports 13 hours with webservers shut down and roughly 94% of pageviews still served from cache. Scope and limitsA backend outage and served pageviews have different denominators; neither gives a global website outage estimate. |
| Science Tokyo hosted web service | EducationJapan | Partial restoration2026-10-22 | Primary statementScience Tokyo NOC | The university applied mitigations, restarted servers and then performed emergency maintenance. Most service returned; the notice kept one older PHP 7 environment offline. Scope and limitsThe operator documented a PHP 8.0 vendor backport whose base version did not change, illustrating why banner-only triage needs review. |
| CoDMON childcare and parent services | EducationJapan | Precautionary disruption2026-10-21 | Primary statementCoDMON | CoDMON announced stopping all its services, including parent-facing access, in response to the PHP issue. Scope and limitsAnnouncement describes preventive action. No count of affected facilities, children, exposed records or successful attacks is inferred. |
| Sakura Internet service functions | Hosting & infrastructureJapan | Partial restoration2026-10-22 | Primary statementSakura Internet | Sakura reported preventive emergency maintenance from 21 October 22:30 JST, followed by phased restoration and fixes across managed PHP environments. Scope and limitsThe provider distinguished its VPS platform from customer-managed PHP workloads and reported no identified unauthorized access or data leakage at 22 October 14:00 JST. |
| Lolipop hosting control and APIs | Hosting & infrastructureJapan | Reported restoration2026-10-22 | Primary statementGMO Pepabo / Lolipop | Lolipop recorded preventive maintenance affecting management functions, APIs, FTP and webmail; its notice was marked complete on 22 October. Scope and limitsProvider-applied fixes and feature restrictions do not establish the patch state of unrelated hosts. Users were asked to verify their site behavior. |
| Cisco appliance product line | Networking & appliancesGlobal | Vendor assessment2026-10-22 | Primary statementCisco PSIRT | Cisco listed Expressway variants and Ultra-Reliable Wireless Backhaul as affected, while other products remained under investigation or were confirmed unaffected. Scope and limitsURWB required administrator authentication in the cited scope. Product-specific prerequisites differ from generic PHP severity; planned fixes are not deployed fixes. |
| BASE merchant services | Commerce & financeJapan | Reported maintenance2026-10-21 | Secondary reportingITmedia NEWS | ITmedia reported BASE among Japanese services entering emergency maintenance during the PHP response. Scope and limitsOriginal operator notice was not retrievable during review. Exact duration, merchant count and recovery state remain unverified here. |
| Cygames / Shadowverse services | Games & mediaJapan | Reported maintenance2026-10-21 | Secondary reportingITmedia NEWS | ITmedia reported emergency maintenance affecting Shadowverse: Worlds Beyond alongside the wider Japanese service response. Scope and limitsThis case is retained as reporting, not a verified operator recovery record. It does not establish compromise. |
| Shizuoka Bank and Hankyu public sites | Commerce & financeJapan | Reported maintenance2026-10-22 | Secondary reportingITmedia NEWS | ITmedia listed Shizuoka Bank and Hankyu Railway among organizations temporarily stopping websites or web services during the PHP response. Scope and limitsPublic web access scope only; no evidence here that banking transactions, rail operations or internal systems were compromised. One report entry covers two named organizations. |
| BambooHR and Port of Rotterdam web services | Business & logisticsInternational | Reported maintenance2026-10-21 | Secondary reportingThe Indian Express | The Indian Express identified BambooHR and the Port of Rotterdam among services taken offline during precautionary responses. Scope and limitsOperator-level notices were not independently retrieved. Web service downtime does not demonstrate payroll data loss or disruption of physical port operations. One report entry covers two organizations. |
These cases are not exhaustive and do not share a common denominator. Some cover multiple services or organizations. Do not add them to government totals or treat them as confirmed breaches.
Attack activity and the disruption it triggered
A curated chronology of source claims. Dates describe events; the Source column gives publication dates. Date-only events have no inferred time.
How to read the attack evidence
Attempts in sensors
AWS dates attempts to 17 October and reports wider activity after disclosure. Sensor observations do not establish a named production victim.
AWS report ↗Malware infrastructure
Arctic Wolf linked payload-hosting infrastructure to Potassium samples, but did not establish that its observed requests downloaded or ran those samples.
Arctic Wolf analysis ↗Reproduced exploitability
Research demonstrations establish exploitability within tested conditions. Public PoC reliability and a particular deployment’s vulnerability require separate evidence.
VulnCheck research ↗Operator-reported disruption
PRECAUTIONARYWeird Gloop / hosted wikis
13h
Webservers switched off while waiting for a patch.
About 94% of pageviews continued serving through caching.
Traffic served and backend uptime are different measures. Operator report, 21 Oct ↗
Wikimedia supporting services
Wikimedia described deliberately taking supporting services offline, including Toolforge and Cloud VPS workloads requiring volunteer owners to update their PHP environments.
Distributed ownership adds recovery dependencies even when a runtime patch exists.
A shutdown is not evidence of compromise. Wikimedia statement ↗
Coverage from Pwnsy News
Discovery links captured from Pwnsy News; not independently verified incident records. Article volume is not attack volume.
Turn exposure into a response list
Paste a CSV inventory. Analysis runs in this tab. Your asset data is not uploaded or saved. Runtime thresholds are a first pass; vendor backports need separate evidence.
Published upstream fix thresholds
| PHP branch | First fixed release | Verification |
|---|---|---|
| 8.2 | 8.2.35 | Confirm serving workers use the updated build. |
| 8.3 | 8.3.36 | Confirm serving workers use the updated build. |
| 8.4 | 8.4.27 | Confirm serving workers use the updated build. |
| 8.5 | 8.5.12 | Confirm serving workers use the updated build. |
Older branches and downstream package revisions require vendor-specific evidence. Upstream advisory ↗
Remediation handoff
- Confirm the PHP runtime actually serving web requests, its package revision and patch owner.
- Install a fixed runtime or a vendor-confirmed backport, then restart or redeploy affected workers.
- Verify each serving pool or replica. Check rebuilt images and deployment rollouts.
- Preserve and review web, process, file and authentication evidence. Investigate suspicious activity from at least 17 October.
- If compromise is suspected, isolate the workload, preserve evidence and rotate potentially exposed credentials through your incident process.
WAF rules and configuration changes reduce specific paths; they do not provide a complete fix. AWS mitigation guidance ↗
Sources, scope and reproducibility
This observatory combines a component inventory, primary-source event claims and an analyst impact model. It is a dated research snapshot.
What the numbers mean
- Unit of analysis
- One SPDX package record, identified by its source ID. Runtimes, extensions and applications are separate records. Counts do not represent unique vendors, websites or victims.
- Assessment mapping
- Scoped VEX relationships map to Fix, Vulnerable, Investigation and Not vuln. Missing assessments stay Investigation. CVEs are counted separately; no “either CVE” aggregation hides differences.
- Category charts
- Categories come from NCSC metadata. Bars start at zero and count records. Overview displays the ten largest categories; the inventory contains all categories.
- Selection limits
- The inventory is curated and incomplete. Category mix describes this dataset, not market share. No country heatmap or global breach total is inferred.
- Version triage
- Only exact upstream 8.2 to 8.5 version formats are compared to published thresholds. Package suffixes, prereleases and other branches require manual review. A below-threshold result is a review flag because vendors may backport.
- Event confidence
- Attack attempts, researcher demonstrations and precautionary shutdowns remain distinct. AWS's sensor observations do not identify confirmed victim breaches or quantify successful attacks.
- Freshness
- No background refresh. Re-check vendor advisories before acting. Pwnsy News is a separate discovery snapshot.
Inventory provenance
Inventory data © NCSC-NL/php2shell contributors, distributed under EUPL 1.2. Pwnsy normalized the records and assessment fields on 23 October 2026. The original source and license are included for reproducibility.
Primary reference desk
PHP2Shell questions, answered
What is PHP2Shell?
PHP2Shell names CVE-2026-109618 and CVE-2026-109619, critical PHP runtime memory-safety vulnerabilities that can allow unauthenticated remote code execution.
Which PHP releases contain the upstream fixes?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 contain the upstream fixes. Downstream packages may carry backports; verify vendor build evidence and the running serving pool.
Do the outages prove that these organizations were hacked?
No. The cases distinguish precautionary shutdowns, reported maintenance, vendor assessments and observed attack attempts. These do not establish a confirmed victim total.
Will updating WordPress alone fix PHP2Shell?
WordPress says no WordPress update is required for these issues. Update the underlying PHP runtime through the responsible hosting provider or operator.
Is estate inventory uploaded?
No. Pasted CSV is analyzed in this tab, kept only in memory and exported only when you request a download.
References: PHP advisory · WordPress notice · Machine-readable research brief