{"type":"analysis","id":"analysis:php2shell-s-headline-numbers-show-exposure-not-a-universal-exploit","slug":"php2shell-s-headline-numbers-show-exposure-not-a-universal-exploit","title":"PHP2Shell’s headline numbers show exposure, not a universal exploit","description":"The honeypot confirms a working attack chain in one favorable mod_php setup, while OX Security’s scan counts publicly measurable hosts still on affected versions. Neither result tells us how many servers are vulnerable in practice or compromised; deployment mode and version visibility matter.","published_at":"2026-10-27T19:00:00.000Z","updated_at":"2026-10-27T19:00:00.000Z","record_date":"2026-10-27","topics":["security"],"source_urls":["https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild","https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog","https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","https://www.ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching","https://ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching","https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws","https://www.wiz.io/blog/php2shell-php-rce","https://www.illumio.com/blog/php2shell-a-years-old-vulnerability-a-global-emergency-and-what-to-do-now"],"language":"en","routes":{"html":"https://newruntime.com/analysis/php2shell-s-headline-numbers-show-exposure-not-a-universal-exploit/","markdown":"https://newruntime.com/analysis/php2shell-s-headline-numbers-show-exposure-not-a-universal-exploit.md","json":"https://newruntime.com/analysis/php2shell-s-headline-numbers-show-exposure-not-a-universal-exploit.json"},"author":{"role":"author","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"editorial_provenance":{"desk":"authorial","target_ref":"story_cluster:php2shell-vulnerabilities-confirmed-exploited-in-the-wild-70533136ab76","authorial_article_id":"4df0c097-77ec-4954-a134-88a34a474deb"},"next_reads":[{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"collection","path":"/analysis/","url":"https://newruntime.com/analysis/","title":"Analysis","reason":"Open the latest authorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/analysis.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}