PHP2Shell Live — verified updatesIndependent, source-linked tracking of PHP2Shell: confirmed fixes, exposure, exploitation evidence and open questions.https://php2shell.live/enIndependent publication; source links remain the property of their publishers.23 Oct: attack reports and PHP advisoryhttps://php2shell.live/news/attack-scale-and-session-flaw/https://php2shell.live/news/attack-scale-and-session-flaw/Security Affairs, citing Censys, reported an estimated 34.4M vulnerable PHP services; the reports reviewed do not confirm a real-world RCE.Fri, 23 Oct 2026 15:45:00 GMTPHP2ShellCVE-2026-115560ExploitationExposureEarly assessment: patches and unknownshttps://php2shell.live/news/first-48-hours-assessment/https://php2shell.live/news/first-48-hours-assessment/What the first day established: fixes are confirmed, attempts documented, exposure estimates disagree and no mass compromise is confirmed.Thu, 22 Oct 2026 16:45:00 GMTAssessmentPHP2ShellEvidenceCloudflare: millions of attemptshttps://php2shell.live/news/cloudflare-exploit-attempts/https://php2shell.live/news/cloudflare-exploit-attempts/Cloudflare deployed WAF rules before disclosure and tracked a steep rise in attacks. It still says customers must patch.Thu, 22 Oct 2026 16:45:00 GMTCloudflareWAFExploitationPHP2Shell attempt seen before patcheshttps://php2shell.live/news/exploitation-before-patches/https://php2shell.live/news/exploitation-before-patches/A honeypot attempt on 17 October predates the leak. SecurityWeek reports early PoCs, but attempts are not confirmed compromises.Thu, 22 Oct 2026 16:45:00 GMTExploitationPHP2ShellEvidenceFake PoCs and a failed webshell attempthttps://php2shell.live/news/fake-pocs-and-failed-attempts/https://php2shell.live/news/fake-pocs-and-failed-attempts/Researchers describe unreliable public PoCs, prank repositories and one failed webshell attempt. The underlying flaw remains serious.Thu, 22 Oct 2026 16:45:00 GMTPoCExploitationResearchCERT-EU, NCSC and CISA issue alertshttps://php2shell.live/news/government-alerts-sites-offline/https://php2shell.live/news/government-alerts-sites-offline/Official advice is consistent: patch immediately, restart workers and isolate if needed. Some organisations took services offline.Thu, 22 Oct 2026 16:45:00 GMTCERT-EUNCSCCISAAdvisoryNode.js fixes a Brotli decoder RCEhttps://php2shell.live/news/nodejs-brotli-security-release/https://php2shell.live/news/nodejs-brotli-security-release/CVE-2026-111497 is a Node.js core flaw, not PHP2Shell or an npm package issue. Keep runtime and package inventories separate.Thu, 22 Oct 2026 16:45:00 GMTNode.jsBrotliRCEPatchPHP Foundation: a structural failurehttps://php2shell.live/news/php-foundation-structural-failure/https://php2shell.live/news/php-foundation-structural-failure/The Foundation says a 2024 audit showed signs, competing fixes stalled, and AI-assisted review forced the issue back in August 2026.Thu, 22 Oct 2026 16:45:00 GMTPHP FoundationDisclosureProcessPHP ships fixes for two critical flawshttps://php2shell.live/news/php-releases-php2shell-fixes/https://php2shell.live/news/php-releases-php2shell-fixes/PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix CVE-2026-109618 and CVE-2026-109619. The flaws sit in the runtime, so updating a CMS or plugin is not enough.Thu, 22 Oct 2026 16:45:00 GMTPHP2ShellPHPRCEPatch