PHP2SHELL.LIVE Verified incident record
Search /

Sources and method

Reference documents, automated feeds, read scope and last successful checks. Failed checks and official alternatives are shown explicitly.

01 Collection status

Machine-checked sources

These endpoints are checked by the content refresh command. A failed check does not delete previously published content; it is shown here with the last successful time.

Source Last success Last attempt Status Candidates
PHP.net news archive 23 October 2026, 13:52 UTC 23 October 2026, 13:52 UTC not-modified 22
GitHub php-src advisories 23 October 2026, 13:52 UTC 23 October 2026, 13:52 UTC not-modified 30
Node.js vulnerability index 23 October 2026, 13:52 UTC 23 October 2026, 13:52 UTC ok 1
SecurityWeek RSS 23 October 2026, 13:52 UTC 23 October 2026, 13:52 UTC ok 1
CISA KEV JSON 23 October 2026, 13:52 UTC 23 October 2026, 13:52 UTC not-modified 0

Status generated 23 October 2026, 13:52 UTC. A green check means the source was fetched and parsed; it does not mean every claim on the site was re-verified at that moment. Source checks can be newer than the editorial research cut-off; a newer check does not mean a candidate has been reviewed or published.

02 Exploitation catalog

CISA KEV check

KEV is a catalog of known exploitation, not a complete map of all exploitation. Absence is recorded as absence, not as evidence of safety.

Catalog version
2026.10.21
Feed released
21 October 2026, 14:04 UTC
Checked
23 October 2026, 13:52 UTC
Entries
1,754
PHP2Shell listed
Neither CVE
Fetch status
ok
Editorial review
Not listed

Neither PHP2Shell CVE appears in CISA KEV catalog version 2026.10.21, checked 23 October 2026, 13:52 UTC. This is a catalog observation, not proof that exploitation never occurred.

The KEV HTML page returned HTTP 403 to this project’s automated request. The official JSON feed was used instead; no access control was bypassed. Some secondary reports claimed a KEV listing that this check did not find in the official feed.

03 Source directory

Everything consulted

Read scope is explicit. “Full text read” means the source document was opened and used; “metadata only” means only its title, date and link were used.

Official project and vendor notices 18

Government and CERT advisories 15

  • CVE-2026-109618
    NIST NVD · Full text read
    Checked successfully
    Published 21 October 2026, 14:17 UTC
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2026-109619
    NIST NVD · Full text read
    Checked successfully
    Published 21 October 2026, 14:17 UTC
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2026-111497
    NIST NVD · Full text read
    Checked successfully
    Published 22 October 2026, 14:17 UTC
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2024-27980
    NIST NVD · Full text read
    Checked successfully
    Published 9 January 2025
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2024-4577
    NIST NVD · Full text read
    Checked successfully
    Published 9 June 2024
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2019-11043
    NIST NVD · Full text read
    Checked successfully
    Published 28 October 2019
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2021-44228
    NIST NVD · Full text read
    Checked successfully
    Published 10 December 2021
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2014-0160
    NIST NVD · Full text read
    Checked successfully
    Published 7 April 2014
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • CVE-2014-6271
    NIST NVD · Full text read
    Checked successfully
    Published 24 September 2014
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • Security Advisory 2026-018: Critical vulnerabilities in PHP
    CERT-EU · Full text read
    Checked successfully
    Published 21 October 2026
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • Critical security issue affecting PHP
    UK National Cyber Security Centre · Full text read
    Checked successfully
    Published 21 October 2026
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • PHPの脆弱性対策について (CVE-2026-109618, CVE-2026-109619: PHP2shell)
    IPA (Japan) · Full text read
    Checked successfully
    Published 22 October 2026
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • Operational information regarding the 2026 php2shell vulnerabilities
    NCSC-NL · Full text read
    Checked successfully
    Published 22 October 2026
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC
  • Known Exploited Vulnerabilities catalog (HTML)
    CISA · Not read
    Check failed — no successful read
    Published 21 October 2026
    Last success Never
    Last attempt 22 October 2026, 16:45 UTC
  • Critical Vulnerabilities in PHP Require Immediate Patching
    CISA · Full text read
    Checked successfully
    Published 21 October 2026
    Last success 23 October 2026, 15:18 UTC
    Last attempt 23 October 2026, 15:18 UTC

Original security research 1

  • PHP2Shell: critical RCE in PHP
    Wiz Research · Full text read
    Checked successfully
    Published 21 October 2026
    Last success 22 October 2026, 16:45 UTC
    Last attempt 22 October 2026, 16:45 UTC

Vendor analysis and structured records 6

Media reporting 7

Structured data feeds 1

04 Method

How the record is built

Source priority

Version numbers, fixed releases, affected conditions and interim controls come from the project or vendor that owns the software. Government and CERT advisories are used for action guidance and exploitation context. Original research explains mechanism and laboratory reproduction. Media reporting supplies timeline and context and is followed back to its primary source. Social posts are discovery leads, not a basis for a key conclusion.

What “read” means

  • Full text read: the document was opened and the cited fact was checked in the text.
  • Excerpt read: a specific section was read, not the whole document.
  • Metadata only: title, publisher, date and link were used; the body was not treated as evidence.
  • Not read: the source could not be accessed. It is retained with the failure note.

Time boundaries

Article publication time and event time are separate. A media report published on 22 October about a patch released on 21 October produces an event dated 21 October and a source dated 22 October. When a source gives only a date, the site displays only a date. When official pages disagree about a time, the site records the date and states the conflict rather than choosing a number.

Static-site boundary

This is a static publication. It does not update itself. New content requires a source refresh, a validation pass and a new build. A build does not change the content update time, and a failed refresh does not remove the last successful snapshot.

Known access limits

  • The CISA KEV HTML catalog returned 403 to automated requests; the official JSON feed was used.
  • The media feed is used for candidate discovery only. Article bodies are not stored or republished.
  • Some official pages do not publish a modification time; the source record says so.
  • Research cut-off is 23 October 2026, 15:45 UTC. Events after that time are not covered until the next refresh and review.
Type to search the local index Results stay in your browser
↑ ↓ move Enter open Esc close