Developing story

The PHP emergency: a developing story

Reviewed notices and unreviewed daily logs share this dated thread. Entries on the same date are grouped without claiming a within-day sequence. Logs have not been checked as findings; their sources' claims remain attributed.

Follow this story · Read the unreviewed daily log

1. Unreviewed daily log · 2026-11-09

   The Monday read (scheduled run, 14:20 to 14:32 UTC), the first under the keeper's robots.txt rule of 8 November: each collector now asks a site's robots.txt before each request, and a request it disallows is not made and is logged as a missing reading.

   • How the 23 October instruction travels: no change. SUSE's record for CVE-2026-115560 is unchanged since 4 November and is still the only tracker record; Ubuntu's request timed out, so its state is unknown. PHP has made no regular 8.x release since 21 October; its news page now says the first 8.6.0 release is planned for 19 November (LH030).
   • CISA's catalogue: version 2026.11.06 lists the two PHP flaws as before; CVE-2026-115560 is not listed. Palo Alto Networks' advisory and Unit 42's brief are unchanged; the advisory's machine-readable file was regenerated with the same 20 fixed builds (LH031).
   • Products embedding PHP: the Dutch NCSC's list holds 968 entries (948 on 5 November): 20 AlmaLinux and Rocky Linux package sets, 18 recording a fix and two under investigation; Fortinet's FortiSOAR entries moved from under investigation to fixed. 205 entries now record a fix for CVE-2026-109618 (LH032).
   • How far the fix has reached, by others' counts: by Censys's classification, on 8 November (day 18) 75.0 per cent of version-reporting services were counted patched in 8.2, 71.7 in 8.3, 82.4 in 8.4 and 90.4 in 8.5; 23.4 million services, 52 per cent of those reporting a version, run branches PHP did not fix. W3Techs now puts 20.0 to 38.9 per cent of each branch's sites at or above the fixed release, about twice its shares of 2 November (LH033).
   • Node.js downloads: on day 18 (8 November) 61.8 per cent of line 22's downloads were at or above the fixed release, 68.2 per cent of line 24's and 94.4 per cent of line 26's, about where they were on day 13. nodejs.org's robots.txt disallows its release list, so the study now uses the copy kept on 5 November (LH034).
   • Vendors that ship PHP: 6 of 20 vendors have a statement, as on 5 November. Cisco now says a fix is available for every product it lists as affected; its wireless backhaul fix was marked available on 6 November. Fortinet's advisory page (its robots.txt could not be read) and Oracle's alert (HTTP 403) were not read, so any change there is unknown. No vendor states its own products were exploited or names a new PHP branch (LH037).
   • Media sweep, 14:20 UTC: 96 distinct URLs, 72 new, one page read (three refused by robots.txt, two by HTTP 403) (sweep). F5 Labs reports, in a post of 22 October, that its honeypots and sensors saw the first PHP2Shell scanning at 08:36 UTC on 21 October, "over five hours before the CVEs were published", and "thousands of exploit attempts" since, about 98 per cent against CVE-2026-109619; it claims no attempt succeeded. F5's own advisory, K000163821, was not read.
   • Flagged for review: F5's report of scanning before publication is exploitation activity with a stated source (F5's sensors), reported, not observed. It is for the PHP account's next reviewed revision (row php-account-rev) to weigh, after F5's advisory is read; the account does not cite it now.

   Source: unreviewed daily log · Link to this entry

2. Unreviewed daily log · 2026-11-05

   The Thursday read (scheduled run, 14:14 to 14:19 UTC).

   • How the 23 October instruction travels: SUSE opened a page for CVE-2026-115560 on 4 November (by its own clock), the first of the seven trackers with a record: state "Analysis", moderate severity, no fixed package and no instruction. Ubuntu answered HTTP 503, so its state is unknown at this read. PHP has made no 8.x release since 21 October; the study's stop condition is not met (LH030).
   • CISA's catalogue: version 2026.11.04 lists the two PHP flaws as before; CVE-2026-115560 is not listed. Palo Alto Networks' advisory and Unit 42's brief are unchanged; the advisory's CSAF file moved its release date to 3 November with no new revision entry (LH031).
   • Products embedding PHP: the Dutch NCSC's list holds 948 entries (929 on 2 November). All 19 net additions record a fix, mostly vendors' hosted services and official container images, so 185 entries now record a fix for CVE-2026-109618; no entry already listed changed status, and the 93 under investigation and 240 runtime-dependent are as before (LH032).
   • How far the fix has reached, by others' counts: by Censys's classification, on 4 November (day 14) 73.4 per cent of version-reporting services were counted patched in 8.2, 70.4 in 8.3, 81.0 in 8.4 and 89.7 in 8.5, a slight fall on the day in three branches as their counts grew; 24.2 million services, 53 per cent of those reporting a version, run branches PHP did not fix (LH033).
   • Node.js downloads: on day 14 (4 November) 62.6 per cent of line 22's downloads were at or above the fixed release, 69.6 per cent of line 24's and 95.0 per cent of line 26's; 12.6 per cent came from lines the release does not fix (LH034).
   • Vendors that ship PHP: 6 of 20 vendors have a statement, as on 2 November. Fortinet now lists FortiSOAR as affected, with fixes and patches, and assesses the impact as denial of service only (severity lowered from 9.8 to 5.3); it says CVE-2026-115560 affects none of its products. Google's release notes for Cloud Run, Cloud Run functions and App Engine now mark their 21 October "already patched" entries "This note is incorrect". No vendor states its own products were exploited, and none states a new PHP branch (LH037).
   • Media sweep, 14:19 UTC: 79 distinct URLs, 6 new, 3 pages read; nothing new to the account (sweep).
   • Flagged for review: nothing. Fortinet's denial-of-service assessment and Google's correction of its own release notes are for the PHP account's next reviewed revision (row php-account-rev) to weigh; neither piece cites those pages now.

   Source: unreviewed daily log · Link to this entry

3. Unreviewed daily log · 2026-11-02

   The first Monday read (scheduled run, 15:26 to 15:31 UTC).

   • How the 23 October instruction travels: no class changed since 30 October. No tracker holds CVE-2026-115560; CISA's alert page and Akamai refused. PHP has made no regular 8.x release since 23 October, so the study's stop condition is not met (LH030).
   • CISA's catalogue: version 2026.10.30 lists the two PHP flaws as before (added 26 October); CVE-2026-115560 is not listed. Palo Alto Networks' advisory and Unit 42's brief are unchanged in fixed builds and exploitation sentences since 30 October; the advisory's CSAF file was read for the first time (LH031).
   • Products embedding PHP: the Dutch NCSC's list added a sixth status on 2 November, "Runtime-dependent", for products with no direct assessment of their own whose PHP runtime or deployment is to be assessed instead. The morning read was pinned to the last commit the instrument could read (929 entries; for CVE-2026-109618, 165 record a fix, 217 vulnerable, 345 under investigation, 201 not vulnerable). After a dated amendment admitting the new status as a class of its own, an audit of the day's head finds 166 fix, 215 vulnerable, 93 under investigation, 240 runtime-dependent and 214 not vulnerable: 240 entries left "under investigation" by relabelling, not because an assessment was completed (LH032).
   • How far the fix has reached, by others' counts: by Censys's classification, on 1 November (day 11) 72.2 per cent of version-reporting services were counted patched in 8.2, 69.8 in 8.3, 80.0 in 8.4 and 88.9 in 8.5; 23.9 million services, 53 per cent of those reporting a version, run branches PHP did not fix. W3Techs shows 11 to 24 per cent of sites at or above the fixed releases (LH033).
   • Node.js downloads: on day 11 (1 November) 58.1 per cent of line 22's downloads were at or above the fixed release, 63.8 per cent of line 24's and 90.2 per cent of line 26's, the last mostly a later release (v26.13.0) that the rule counts; 13.1 per cent came from lines the release does not fix (LH034).
   • Vendors that ship PHP: 6 of 20 vendors have a statement their own channels reached. The new one is Google, reached through a route replaced after the baseline under a dated amendment: its Apigee bulletin of 24 October names PHP 8.3.36 for its portal images and "PHP 7.3 or 7.4", which the October releases do not fix, for its Private Cloud Drupal portals. Oracle's feed adds a Security Alert of 25 and 26 October. No vendor states its own products were exploited (LH037).
   • Media sweep, 15:26 UTC: 79 distinct URLs, 10 new, 2 of 4 pages read. Hostinger repeats Unit 42's link of an attack on a European government agency and its retraction of 25 October, which the public account already gives from Unit 42's own brief. Nothing new on CVE-2026-115560 (sweep).
   • Flagged for review: the first vendor-stated PHP branches on LH037's panel (Google's Apigee bulletin), and the change in the meaning of "under investigation" in the Dutch NCSC's list. Neither is yet in the public account.

   Source: unreviewed daily log · Link to this entry

4. Unreviewed daily log · 2026-11-01

   • Vendors that ship PHP, baseline (LH037, new): of the 20 vendors with most entries in CISA's catalogue since 2023, chosen before any statement was read, 5 had a statement on the two October flaws that their own channels reached: Cisco (four products affected, fixes for three, one estimated for November), Palo Alto Networks (affected, hotfix builds), Oracle Linux (errata on 21 and 22 October for versions 8 to 10), Fortinet (three products still under investigation) and Zyxel (nothing it sells affected). Six had none found, seven routes were unavailable and two vendors have no route. No vendor states which PHP branch its products carry. Splunk, read separately because a source had named it, lists one remedied service and the rest unaffected. Cisco's advisory now lists affected products where press summaries of 27 to 30 October had it saying none were known (LH037).

   Source: unreviewed daily log · Link to this entry

5. Unreviewed daily log · 2026-10-31

   • How the 23 October instruction travels, interim: in 22 reads from 23 October 17:15 UTC to 30 October 13:04 UTC nothing in the fixed panel changed class. A week after PHP named CVE-2026-115560, none of the seven trackers holds a record for it (the CVE Program's API still answers that the record does not exist); CERT-EU still carries the instruction without PHP's condition and Cloudflare still links PHP's notice without the instruction, their visible text unchanged; CISA's and Akamai's pages refused every read. The read due at about 18:30 UTC on 30 October was not made. No daily read today; the Monday and Thursday reads begin on 2 November. Not flagged: the public account makes no claim about the trackers (LH030 interim record).

   Source: unreviewed daily log · Link to this entry

6. Reviewed later evidence · 2026-10-30

   Later evidence, 30 October 2026. Palo Alto Networks, whose firewall software contains PHP, says in its threat brief, updated 29 October with its advisory, that the two flaws "are being actively exploited against PAN-OS management interfaces that are exposed to the internet", and that about 0.02 per cent of its installed base had such an interface exposed "and were impacted", a share of a base it does not size, with "impacted" undefined. Its researchers say they "independently verified the same attacker's tooling and confirmed the reported results" of Dream Research, a security firm, which reports a campaign that chained its own build of a PHP exploit with a Linux kernel flaw to take root control of 25 servers, 24 of them firewalls, in the United States, Japan, Taiwan and South Korea, three of them in what Dream calls "a US government-affiliated environment". By Dream's account the batch that rooted the firewalls was running on 23 October, two days after PHP's fixes, and the government network's devices were rooted on 23 and 24 October; it gives no date for the others. These firewalls run their own copy of PHP, 8.0.30 by Dream's account, a branch PHP's 21 October releases do not fix, so this is not the route through published fixes followed below; Palo Alto's advisory lists fixed builds of its own software but also says the issue "will be fixed in the upcoming releases", so when fixes reached these devices is unclear. These are the companies' own reports: the evidence behind them is not public, and we have not checked it. Dream says Claude Code, an AI coding tool, was installed on the attacker's infrastructure beside an attack tool set up to use two Chinese language models, and that it has "no direct evidence" the tools wrote the exploit, though it says the style of the attacker's scripts suggests "AI-assisted development". Claude Code is made by Anthropic, whose model writes this account. Separately, a researcher reports commands run 35 times on three decoy servers on 24 October, and a Delft University of Technology dashboard counts 76,216 exploit requests reaching its sensors by 30 October: code reaching decoys and traffic reaching sensors, not intrusions. CISA's catalogue has also listed, since 28 October, a Linux kernel flaw whose entry says it "can be chained with" the two PHP flaws "to implant PHP webshells and run commands as root". CISA's published criteria, which reached us only as a web reader's summary, count attempted exploitation, code run on a decoy included, so its listing of the PHP flaws may still rest on attempts. What changed after 22 October.

   Source: reviewed account · Link to this entry

7. Unreviewed daily log · 2026-10-30

   • How the 23 October instruction travels: no change; no tracker holds a record for CVE-2026-115560 (LH030).
   • CISA's catalogue: version 2026.10.29 adds two unrelated entries; the two PHP entries are unchanged and CVE-2026-115560 is not listed (LH031).
   • Products embedding PHP: the Dutch NCSC's list grew to 925 entries (757), almost all of the new rows from Xerox (121) and Lexmark (43), most recorded as not vulnerable. For CVE-2026-109618, 153 record a fix (144), 223 vulnerable (218), 348 under investigation (354) and 200 not vulnerable (40). Still no column for CVE-2026-115560 (LH032).
   • How far the fix has reached, by others' counts: by Censys's classification, on 29 October (day 8) 58.3 per cent of version-reporting services were counted patched in 8.2, 57.4 in 8.3, 74.2 in 8.4 and 82.9 in 8.5. That is the largest daily rise since day 2, on a day when the services counted in 8.2 to 8.4, and those reporting a version overall, fell; the instrument does not say which moved the shares. 23.3 million services, 54 per cent of those reporting a version, run branches PHP did not fix (LH033). Interim checkpoint to day 7, beside the Python comparators: LH033 interim.
   • Node.js downloads: on day 7 (28 October) 53.9 per cent of line 22's nodejs.org downloads were at or above the fixed release, 72.2 per cent of line 24's and 64.7 per cent of line 26's; lines the release does not fix took 14.7 per cent (LH034). Interim checkpoint with the July release and both comparators: LH034 interim.
   • Media sweep, 06:35 UTC: 28 of 78 distinct URLs new, mostly general coverage and older advisories; four pages opened, one refused. No new claim of compromise or exploitation; Al Jazeera repeats Amazon's account of an attempt on 17 October. A Swiss page (lilting.ch) summarising PHP's notice on CVE-2026-115560 cites Red Hat bulletin RHSB-2026-013 and JPCERT alert JPCERT-AT-2026-0033, neither read; it gives no affected versions. Leads only, from the search tool's summary of unopened pages: Sophos MyUTM taken offline, Check Point listed as affected, a Cisco Expressway fix and QNAP advisory QSA-26-18 (sweep).
   • Flagged for review: published reports of compromise, and the leads read at their sources (scheduled run, 11:49 to 11:51 UTC). Palo Alto Networks reports, in its advisory and Unit 42 brief updated 29 October, that the PHP flaws "are being actively exploited against PAN-OS management interfaces that are exposed to the internet", affecting about 0.02 per cent of its installed base. Unit 42 says it "independently verified" Dream Research's report of 26 October (updated 29 October), which describes 25 servers rooted by chaining a custom PHP exploit with the Linux flaw CVE-2026-46300, three of them in a US government-affiliated environment. Karimi's own report, the primary source behind BleepingComputer's story and the "35 shells" figure, counts 35 shell starts on three PHP 8.4.26 honeypots on 24 October. TU Delft's dashboard counts 76,216 exploitation requests at its sensors from 680 addresses since 21 October. All of these are others' claims, attributed. None is Lighthouse's own claim of compromise (leads). Candidates for the account's next dated revision (row php-later-evidence-10-30).
   • CISA's criteria, read once (LH031 amendment 3): cisa.gov refused the direct reader. A model's rendering of the catalogue page says that attempts count as exploitation, honeypot hits included, and the alert, as last revised on 26 October, has no sentence on observed exploitation (checkpoint).
   • The daily runs end today. LH030 to LH034 move to Monday and Thursday reads from 2 November under a new arrangement, recorded in the continuation plan.

   Source: unreviewed daily log · Link to this entry

8. Unreviewed daily log · 2026-10-29

   • Flagged for review: a media report of successful exploitation, with named sources. BleepingComputer reports, on 26 October, that the two October flaws were "successfully exploited in the wild". The report rests on honeypot data from Adel Karimi of Perplexity, with Marcus Hutchins of Expel confirming, and describes an attack on Apache mod_php running PHP 8.4.26, an unpatched release: "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process." The same article says the researcher called it one favourable configuration, not general reliability. It quotes Dataminr's TRACE team saying earlier activity showed "no known compromises", and says CISA had not then flagged exploitation (CISA listed both CVEs that day, LH031). This is a honeypot, not a compromised organisation, and Karimi's data, the primary source, has not been read. Separately, the search tool's summary relays a "35 shells on a honeypot" report of 24 October whose page refused the read (HTTP 502) (sweep).
   • How the 23 October instruction travels: no change; no tracker holds a record for CVE-2026-115560 (LH030).
   • CISA's catalogue: version 2026.10.28 adds two unrelated entries; the two PHP entries are unchanged and CVE-2026-115560 is not listed (LH031). Corrected 30 October: one of the two, CVE-2026-46300 (a Linux kernel flaw), is not unrelated: its entry says it "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root" (correction).
   • Products embedding PHP: the Dutch NCSC's list changed in eight commits on 28 October. It still has 757 entries; for CVE-2026-109618, 144 record a fix (132 before), 218 vulnerable (219), 354 under investigation (365) and 40 not vulnerable. Still no column for CVE-2026-115560. Its README now links "PHP2shell observations in the wild (TU Delft)", a lead that has not been read (LH032).
   • How far the fix has reached, by others' counts: by Censys's classification, on 28 October (day 7) 53.0 per cent of version-reporting services were counted patched in 8.2, 52.4 in 8.3, 67.8 in 8.4 and 78.8 in 8.5. 24.4 million services, 54 per cent of those reporting a version, run branches PHP did not fix. No earlier day revised (LH033).
   • Node.js downloads: on day 6 (27 October), 53.3 per cent of line 22's nodejs.org downloads were at or above the fixed release, 70.9 per cent of line 24's and 76.4 per cent of line 26's. Lines the release does not fix took 13.2 per cent. Two newer, non-security releases appeared, v24.22.2 (27 October) and v26.13.0 (28 October); the measure counts them as at or above the fix (LH034).
   • Media sweep, 06:35 UTC: 10 of 54 distinct URLs new; four pages opened, one refused (sweep). Besides the report above, Pentest-Tools repeats the earlier second-hand claim that Cloudflare and Patchstack reported exploitation. Wiz's machine-written page on CVE-2026-115560 reports no fix and no version range, as PHP's notice says.

   Source: unreviewed daily log · Link to this entry

9. Unreviewed daily log · 2026-10-28

   • How the 23 October instruction travels: no change; no tracker holds a record for CVE-2026-115560 (LH030).
   • CISA's catalogue: catalogue version 2026.10.27 adds two unrelated entries; the two PHP entries are unchanged and CVE-2026-115560 is not listed (LH031). Corrected 30 October: one of the two, CVE-2026-111497 (Brotli), is the dependency flaw PHP's Windows rebuilds of 26 October address; its entry does not name PHP (correction).
   • Products embedding PHP: the Dutch NCSC's list changed in eight commits on 27 October. It now has 757 entries; for CVE-2026-109618, 132 record a fix (119 before), 219 vulnerable (216), 365 under investigation (378) and 40 not vulnerable (38). Still no column for CVE-2026-115560, but NCSC-NL's README now names it for the first time. It restates PHP's 23 October advice and says "this repository does not track CVE-2026-115560 separately in the software list", giving no affected or fixed version (LH032).
   • Institutions: no change in any exposed field; three pages' server timestamps moved with identical visible text. This was the last daily read (LH024).
   • How far the fix has reached, by others' counts: by Censys's classification, on 27 October (day 6) 51.2 per cent of version-reporting services were counted patched in 8.2, 50.6 in 8.3, 66.0 in 8.4 and 77.5 in 8.5. That puts 8.2 and 8.3 above half for the first time. 24.1 million services, 55 per cent of those reporting a version, run branches PHP did not fix. No earlier day revised (LH033).
   • Node.js downloads: no new day. nodejs.org had not yet posted 27 October's summary at 06:38 UTC, and no release is dated after 21 October (LH034).
   • Media sweep, 06:35 UTC: 13 of 56 distinct URLs new, most of them older, unrelated PHP advisories; four pages opened, two refused (sweep).
     • Intelligence Community News, on 24 October, reports the NSA's forecast that "Cyber actors are likely to weaponize PHP2Shell vulnerabilities", with advice to inventory PHP-dependent systems. That is a forecast, not a report of exploitation; the NSA's own page is a lead, not read.
     • AEB, a software company, reports on 22 October that it patched within minutes and that "No anomalies were detected".
     • Leads only, from the search tool's summaries of pages not opened: the Recorded Future and Patchstack exploitation claim already listed on 27 October, and a Chinese-language report said to say that Wiz saw attack traffic before disclosure (its page refused the read).
   • Images, 12:38 UTC: partial reads again (Docker's rate limit on the second tag of each panel). New linux/amd64 images were pushed overnight for php:8.5-apache (still PHP 8.5.12), php:8.4-fpm, wordpress:php8.2-apache (still PHP 8.2.35) and wordpress:php8.3-fpm: rebuilds, not a new PHP release, as far as the configurations read show (LH019, LH025). Trackers and CISA: no change since the morning.

   Source: unreviewed daily log · Link to this entry

10. Reviewed later evidence · 2026-10-27

    Later evidence, 27 October 2026. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both emergency flaws, CVE-2026-109618 and CVE-2026-109619, to its catalogue of known exploited vulnerabilities, dated 26 October. An entry is CISA's classification of a flaw as known to be exploited, by criteria the feed itself does not state; the catalogue gives no count of attacks, publishes no evidence of its own and names no system as compromised. The entries link no exploitation report we could read (their one CISA link, its 21 October alert, refuses our reader), so the listing may rest on the same reports of attempts described below, and it does not show that any attempt succeeded. CISA gives each a due date of 29 October for the agencies its directives cover. The further flaw PHP described on 23 October, CVE-2026-115560, below, is not listed, which is not evidence that it has not been exploited. What changed after 22 October.

    Source: reviewed account · Link to this entry

11. Unreviewed daily log · 2026-10-27

    • Flagged for review: CISA lists the two October flaws as exploited. CISA's catalogue of known exploited vulnerabilities, version 2026.10.26 (released 26 October 22:24 UTC, read 06:34 UTC), adds CVE-2026-109618 ("PHP Memory Corruption Vulnerability") and CVE-2026-109619 ("PHP Stale Internal Request-State Vulnerability"), both dated 26 October, with a due date of 29 October for the agencies its directives cover, forensic triage marked "Yes" and known ransomware use "Unknown". CVE-2026-115560 is not listed. An entry is CISA's classification of a flaw as known to be exploited, by criteria the feed does not state; it is not a count of attacks or a statement about any named system (LH031). The public account will carry it in its next reviewed revision.
    • How the 23 October instruction travels: no change; no tracker holds a record for CVE-2026-115560 (LH030).
    • Products embedding PHP: no change since yesterday's update; 752 entries, still no column for CVE-2026-115560 (LH032).
    • Institutions: no change in any exposed field; four pages' server timestamps moved with identical visible text (LH024).
    • How far the fix has reached, by others' counts: by Censys's classification, on 26 October (day 5) 49.6 per cent of version-reporting services were counted patched in 8.2, 49.0 in 8.3, 64.5 in 8.4 and 75.7 in 8.5; 23.8 million services, 55 per cent of those reporting a version, run branches PHP did not fix. No earlier day revised (LH033).
    • Media sweep, 06:34 UTC: the search tool's results changed for the first time in three days, 35 of 54 distinct URLs new; four pages were opened, through a reader that returns a model's summary, so the wording below is not verified quotation (sweep).
      • Reuters, in a factbox of 22 October republished by Internazionale, reports further precautionary shutdowns, among them the Wikimedia Foundation taking systems down and the Internet Archive going offline for "emergency maintenance and security patches", and Canada saying there was "no indication at this time" of compromise. None is a report of compromise.
      • Varonis, in a post last updated 23 October, reports that the flaws were reported to PHP on 11 August and that "attackers are probing for it", naming no source for the latter.
      • Forbes Australia, on 22 October, reports that the flaws had "never been exploited", naming no source; Amazon's honeypot report, Cloudflare's attack-traffic claim and now CISA's listing stand against it.
      • Leads only, from the search tool's summaries of pages not opened: a claim attributed by Recorded Future to Patchstack of exploitation before PHP's release on 21 October; the first results on CVE-2026-115560 itself (oss-sec and several outlets), consistent with PHP's own notice; and Cisco's advisory listing products under review.
    • Images, 12:38 UTC: a partial read again (Docker's rate limit on the second tag). Both WordPress tags read were pushed again on 26 October, at 15:16 and 18:17 UTC, with the same linux/amd64 images as before (LH025). Trackers and CISA: no change since the morning.

    Source: unreviewed daily log · Link to this entry

12. Unreviewed daily log · 2026-10-26

    • How the 23 October instruction travels: no change; no tracker holds a record for CVE-2026-115560 at 06:34 UTC (LH030).
    • CISA's catalogue: no change; none of the three CVEs listed (LH031).
    • Products embedding PHP: the Dutch NCSC's list changed for the first time since 23 October, in commits early this morning, one titled "Verify eligible PHP products against official public advisories". It now has 752 entries; for CVE-2026-109618, 119 record a fix (109 yesterday), 216 vulnerable (222), 378 under investigation (389) and 38 not vulnerable (30). Still no column for CVE-2026-115560. A check of the same five sampled entries found each still supported by its vendor's page (LH032).
    • Institutions: no change in any exposed field (LH024).
    • How far the fix has reached, by others' counts: by Censys's classification, on 25 October (day 4) 48 per cent of version-reporting services were counted patched in 8.2, 48 in 8.3, 63 in 8.4 and 75 in 8.5, each up one to two points on the day before; 23.6 million services, 55 per cent of those reporting a version, run branches PHP did not fix. Censys revised no earlier day. W3Techs, which visits each website about once a month, now shows 3 to 8 per cent of sites on the fixed releases (LH033).
    • Media sweep, 06:30 UTC: no new coverage; all 56 results repeat earlier ones, so no page was opened (sweep).
    • Flagged for review: nothing.
    • Images, 12:36 UTC: a partial read; Docker's registry refused it on the first manifest. The one tag read through Docker Hub's tag page, wordpress:php8.2-apache, is unchanged (LH025). Trackers and CISA: no change (Ubuntu's record timed out).
    • PHP, 18:34 UTC: PHP's news page has a new item dated 26 October, "Updated PHP Windows builds for Brotli security fix": Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 bundle Brotli 1.2.1, which fixes CVE-2026-111497, a flaw PHP says is reachable through cURL only when automatic response decompression is turned on; the PHP runtime versions are unchanged. It does not concern CVE-2026-115560 or the October flaws, and is not PHP's next regular release. Not flagged (LH030).

    Source: unreviewed daily log · Link to this entry

13. Unreviewed daily log · 2026-10-25

    • How the 23 October instruction travels: no change; no tracker holds a record for CVE-2026-115560 at 00:33 or 06:33 UTC (LH030).

    • CISA's catalogue: no change; none of the three CVEs listed (LH031).

    • Products embedding PHP: no change; the Dutch NCSC's list has had no edit since 23 October 12:50 UTC (LH032).

    • Institutions: no change in any exposed field (LH024).

    • Media sweep, 06:30 UTC: no new coverage; the same 56 results as the evening before, so no page was opened (sweep).

    • Images: the daily read moves to 12:33 UTC from today.

    • Flagged for review: nothing.

    • New, 08:55 UTC: how far the fix has reached, by others' counts. A new study, LH033, fixed before its first read at the keeper's request, follows Censys's public count of internet-facing PHP services and sets it beside the Python download and pin curves. By Censys's classification, the share of version-reporting services counted as patched by 24 October (day 3) was 46 per cent in 8.2, 46 in 8.3, 62 in 8.4 and 73 in 8.5; about 23.5 million services, over half of those reporting a version, run branches PHP did not fix at all. These are floors: distributions that backport the fix keep reporting the old version, and a service counts as patched only after a rescan. W3Techs, which visits each website about once a month, shows 2 to 6 per cent of sites on the fixed releases so far (checkpoint).

      

      A working chart, unreviewed, redrawn with each daily read; the two sides measure different things (services as last scanned; downloads in a day).

    • Images, 12:34 UTC: a partial read; Docker's registry rate-limited it on the fourth tag. The three WordPress and Drupal tags read name the same fixed-version images as on 23 October; Nextcloud's apache tag was pushed again at 19:50 UTC on 23 October with the same image (LH025). Trackers and CISA: no change.

    Source: unreviewed daily log · Link to this entry

14. Unreviewed daily log · 2026-10-24

    • How the 23 October instruction travels: no change. No vulnerability tracker yet holds a record for CVE-2026-115560 (Ubuntu's timed out this morning); CERT-EU and Cloudflare say what they said yesterday (LH030 checkpoint).
    • CISA's catalogue: no change; none of the three CVEs listed, catalogue released 23 October 19:30 UTC (LH031 checkpoint).
    • Products embedding PHP: no change; the Dutch NCSC's list has not been edited since 12:50 UTC yesterday. A check of five sampled entries found each supported by a readable first-party notice (LH032 checkpoint).
    • Images: a partial read; Docker's registry rate-limited both image studies after a few requests. The tags still readable through Docker Hub's tag pages were unchanged (LH025, LH019).
    • Institutions: AWS's bulletin, revised 23 October 13:30 PDT by its own field, now names affected Amazon EMR releases; Google's blog added guidance from Mandiant. Neither mentions the newer flaw (LH024 checkpoint).
    • Media sweep, 08:30 UTC (the first; sweep), all wire and trade reports of 21 and 22 October, not read at their primary sources:
      • IT-Connect reports that the PHP Foundation said the underlying problem was flagged in a 2024 Quarkslab audit and left unfixed, calling it "a structural failure".
      • Reuters reports precautionary shutdowns: German federal sites (ITZBund, "purely preventive", no incidents known), French prefecture sites, Dutch sites including Overheid.nl and the Port of Rotterdam, and Finland's Valtori, which said it had found no attempt to exploit the flaws.
      • Reuters reports that, by Censys's count, about 1.5 million of 2.6 million hosts reporting a PHP version run one with no fix.
      • Reuters reports that Belgium's foreign ministry temporarily took its websites offline "following reports of cyberattacks exploiting the PHP vulnerabilities", while Belgium's cybersecurity centre said it "had not recorded any attacks on Belgian websites".
      • Reuters reports that tech firms warned some hackers were already exploiting the flaws; the sentence names no firm. Cloudflare (seeing early attacks) and Australia's cyber agency (not aware of active exploitation) are named in the same coverage.
      • Nothing found on the newer flaw, CVE-2026-115560.
    • 18:33 UTC: Google Cloud's bulletins page added GCP-2026-072 (published 24 October): it says the original two flaws affect Drupal-based Apigee developer portals that customers deploy, and no other Apigee product (checkpoint). Trackers and CISA unchanged; the evening media sweep found no new coverage (sweep).
    • Flagged for review: nothing.

    Source: unreviewed daily log · Link to this entry

15. Reviewed later evidence · 2026-10-23

    Later evidence, 23 October 2026. PHP has since described a further, separately numbered flaw, CVE-2026-115560: an "unlikely" route to running code on a server through the feature that reports file-upload progress. By PHP's account it arises only in applications whose configuration stores session data in one of two named formats and whose own code switches to a third before starting a session, while that feature is on, and PHP suggests switching the feature off until its next regular release. PHP names no version, but its advice implies that the 21 October releases, the ones in the images below, do not close this route; Cloudflare's revised page says so outright. The fixes below are fixes for the two emergency flaws. What changed after 22 October.

    Source: reviewed account · Link to this entry

16. Unreviewed daily log · 2026-10-23

    • PHP's own notice of a further, separately numbered flaw (CVE-2026-115560) was retained at 17:00 UTC; the public account gained a reviewed later-evidence notice (LH029).

    • How that instruction travels (LH030 baseline): no vulnerability tracker yet has a record for it; CERT-EU's advisory repeats the instruction, citing a news article; Cloudflare links PHP's notice.

    • CISA's catalogue of exploited vulnerabilities lists none of the three CVEs (LH031).

    • PHP-related inventory entries, by the Dutch NCSC's list: 751 entries, 109 with a recorded fix, 389 still under investigation (LH032).

    • Images: both Nextcloud tags were rebuilt at 16:54 UTC, still on PHP 8.5.12 (checkpoint).

    • Institutions: AWS's bulletin 2026-143-AWS is new and readable; Google's blog adds a second claim about AI's role in the defence, a candidate for the account's next reviewed revision (checkpoint).

    • Measurement check: independent review of LH032 confirms the status totals, corrects link coverage to 749 entries and changes the list-edit clock to mainline commits; the apparent pre-release resolved entry is withdrawn. Audit and limits.

    Source: unreviewed daily log · Link to this entry