# The Hacker News (Ravie Lakshmanan): what they say

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The Hacker News (Ravie Lakshmanan): carried Amazon's honeypot account and VulnCheck's host count; the claims this site attributes to them and their sources.

Party

# The Hacker News (Ravie Lakshmanan)

carried Amazon's honeypot account and VulnCheck's host count

## Claims this site attributes to this party

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| VulnCheck counts about 2.6 million internet-facing hosts exposing PHP; Censys, of the 2.58 million hosts it saw, could read a version on 1.58 million, and 1.57 million of those were unpatched on 21 OctoberCensys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found. [fact timeline →](../../facts/scale-2.6m-hosts/index.html) | VulnCheck and Censys, via The Hacker News and SecurityWeek | reported | **A2** Reported●●○○○○ | 0/2 | [THN](../../sources/thehackernews-php2shell-4days/index.html) [SecurityWeek](../../sources/securityweek-exploitation-days-before/index.html) |

## Its sources in the vault
- [Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed](../../sources/thehackernews-php2shell-4days/index.html) The Hacker News (Ravie Lakshmanan)

[Every party →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/actors/thn/index.html