# PHP2Shell Impact Observatory Canonical: https://pwnsy.com/tools/php2shell/ Reviewed: 23 October 2026. Dated research snapshot; not live telemetry. ## Scope PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. This workspace contains 725 NCSC component records in 20 dependency categories, 14 operational case groupings across nine sectors, and 40 Pwnsy News discovery links. Component records are not websites or victims. Case groupings vary in size and must not be summed as organization counts. ## What is established - Researchers demonstrated unauthenticated code execution on WordPress, Drupal and Joomla deployments and PHP worker-memory disclosure. Source: https://www.wiz.io/blog/php2shell-php-rce - AWS reports attempts from 17 October, four days before disclosure. Attempt telemetry does not establish named production victims. Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ - The UK minister reported 32 services unavailable and four partly unavailable on 22 October, largely through precautionary measures. Source: https://hansard.parliament.uk/Lords/2026-10-22/debates/14CB4C6D-4E16-4377-8FCF-C2CF77BB5CC0/details - No complete confirmed-victim census is established by this collection. ## Fix thresholds Upstream first fixed releases: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Verify downstream backports and the actual web-serving build. A version comparison alone cannot prove deployment safety. Source: https://www.php.net/archive/2026.php#2026-10-21-5 ## Operational case desk ### UK government services Government | United Kingdom | 2026-10-22 | Primary statement The minister reported 32 services unavailable and four partly unavailable, largely because of protective measures during remediation. Cross-government point-in-time reporting; no complete service list or outage duration. Do not interpret 36 services as 36 breaches. Source: https://hansard.parliament.uk/Lords/2026-10-22/debates/14CB4C6D-4E16-4377-8FCF-C2CF77BB5CC0/details ### Dutch public digital services Government | Netherlands | 2026-10-21 | Primary statement The Dutch government described preventive shutdowns affecting public websites, naming Overheid.nl, MijnOverheid.nl and DigiD. The notice also says many government sites do not use PHP. This does not establish that every service of each named platform was affected. Source: https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/aantal-websites-rijksoverheid-preventief-offline-na-kwetsbaarheden-php ### St. Antonius hospital website Healthcare | Netherlands | 2026-10-21 | Primary statement The hospital announced that its website was reachable again after disruption connected to the PHP vulnerability. Public website scope. No inference about clinical systems, patient safety incidents or data compromise. Source: https://www.antoniusziekenhuis.nl/nieuwsoverzicht/onze-website-weer-bereikbaar ### Wikimedia supporting services Knowledge & community | Global | 2026-10-21 | Primary statement Wikimedia deliberately took supporting services offline pending safe patching; volunteer-run Toolforge and Cloud VPS workloads added owner dependencies. Supporting services are not equivalent to all Wikipedia pages being unavailable. No breach total is reported. Source: https://diff.wikimedia.org/2026/10/21/impact-of-php-vulnerabilities-on-wikimedia-tools-and-services/ ### Weird Gloop hosted wikis Knowledge & community | Global | 2026-10-21 | Primary statement The operator reports 13 hours with webservers shut down and roughly 94% of pageviews still served from cache. A backend outage and served pageviews have different denominators; neither gives a global website outage estimate. Source: https://weirdgloop.org/blog/php2shell ### Science Tokyo hosted web service Education | Japan | 2026-10-22 | Primary statement The university applied mitigations, restarted servers and then performed emergency maintenance. Most service returned; the notice kept one older PHP 7 environment offline. The operator documented a PHP 8.0 vendor backport whose base version did not change, illustrating why banner-only triage needs review. Source: https://www.noc.cii.isct.ac.jp/maintenance/2026/10/4091/ ### CoDMON childcare and parent services Education | Japan | 2026-10-21 | Primary statement CoDMON announced stopping all its services, including parent-facing access, in response to the PHP issue. Announcement describes preventive action. No count of affected facilities, children, exposed records or successful attacks is inferred. Source: https://www.codmon.com/info/maintenance/10243/ ### Sakura Internet service functions Hosting & infrastructure | Japan | 2026-10-22 | Primary statement Sakura reported preventive emergency maintenance from 21 October 22:30 JST, followed by phased restoration and fixes across managed PHP environments. The provider distinguished its VPS platform from customer-managed PHP workloads and reported no identified unauthorized access or data leakage at 22 October 14:00 JST. Source: https://www.sakura.ad.jp/corporate/information/announcements/2026/10/22/1968226117/ ### Lolipop hosting control and APIs Hosting & infrastructure | Japan | 2026-10-22 | Primary statement Lolipop recorded preventive maintenance affecting management functions, APIs, FTP and webmail; its notice was marked complete on 22 October. Provider-applied fixes and feature restrictions do not establish the patch state of unrelated hosts. Users were asked to verify their site behavior. Source: https://lolipop.jp/info/news/8237/ ### Cisco appliance product line Networking & appliances | Global | 2026-10-22 | Primary statement Cisco listed Expressway variants and Ultra-Reliable Wireless Backhaul as affected, while other products remained under investigation or were confirmed unaffected. URWB required administrator authentication in the cited scope. Product-specific prerequisites differ from generic PHP severity; planned fixes are not deployed fixes. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq ### BASE merchant services Commerce & finance | Japan | 2026-10-21 | Secondary reporting ITmedia reported BASE among Japanese services entering emergency maintenance during the PHP response. Original operator notice was not retrievable during review. Exact duration, merchant count and recovery state remain unverified here. Source: https://www.itmedia.co.jp/news/article/2610/21/2000002472/ ### Cygames / Shadowverse services Games & media | Japan | 2026-10-21 | Secondary reporting ITmedia reported emergency maintenance affecting Shadowverse: Worlds Beyond alongside the wider Japanese service response. This case is retained as reporting, not a verified operator recovery record. It does not establish compromise. Source: https://www.itmedia.co.jp/news/article/2610/21/2000002472/ ### Shizuoka Bank and Hankyu public sites Commerce & finance | Japan | 2026-10-22 | Secondary reporting ITmedia listed Shizuoka Bank and Hankyu Railway among organizations temporarily stopping websites or web services during the PHP response. Public web access scope only; no evidence here that banking transactions, rail operations or internal systems were compromised. One report entry covers two named organizations. Source: https://www.itmedia.co.jp/news/article/2610/22/2000002480/ ### BambooHR and Port of Rotterdam web services Business & logistics | International | 2026-10-21 | Secondary reporting The Indian Express identified BambooHR and the Port of Rotterdam among services taken offline during precautionary responses. Operator-level notices were not independently retrieved. Web service downtime does not demonstrate payroll data loss or disruption of physical port operations. One report entry covers two organizations. Source: https://indianexpress.com/article/explained/explained-sci-tech/php2shell-php-security-flaws-websites-offline-explained-10931935/ ## Reproducibility NCSC source revision: ecad8f7dbcc8197b825ae3ca3d790fa4069235d3 Original SPDX SHA-256: c841d7d93548abba9ee4943043666a048a12071291b1b5fbf47c7342a5984bc1 Source inventory: https://github.com/NCSC-NL/php2shell Normalized JSON: https://pwnsy.com/tools/php2shell/data/inventory.json Original SPDX: https://pwnsy.com/tools/php2shell/data/source.spdx.json Inventory data license: EUPL 1.2; included at https://pwnsy.com/tools/php2shell/data/LICENSE.txt The normalized inventory is a modified representation of the original data, created 23 October 2026. Missing VEX assessments remain Investigation. Case data: https://pwnsy.com/tools/php2shell/data/impact-cases.json News discovery snapshot: https://pwnsy.com/tools/php2shell/data/news.json ## Local estate triage CSV asset data stays in the tab, is not uploaded or persisted, and clears on refresh. Package suffixes, unsupported branches and prereleases require manual review. Public unresolved assets sort first. CSV exports neutralize spreadsheet formula prefixes.