Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · exploitation · unverified
watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild
watchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries.
Fact-check
A6 Established●●●●●● · Attribution · verdict: holds · the status word understates the evidence
watchTowr's own pages are now captured (23 October): its intel page lists both CVEs as 'EXPLOITED IN THE WILD: Yes', and its FAQ says it 'has observed exploitation in the wild through its Attacker Eye honeypot network'. The claim is an attribution, and watchTowr's own page is the primary record of what watchTowr says: A6, and the site's 'unverified' understates it. What watchTowr measures is honeypot traffic, the same kind of evidence as Amazon's (K-002); its own words elsewhere say none of the sprayed exploits succeeded (Finding on the missing qualifier stays open).
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| watchtowr-php2shell | blocked | Access to watchtowr.com was denied | 1837b6e2c766cabd |
| watchtowr-php2shell-faq | blocked | Access to watchtowr.com was denied | 1837b6e2c766cabd |
| securityweek-first-attempts-sensors | carries | it has seen the first in-the-wild exploitation attempts hitting its sensors around the same time the patches landed, but has not observed successful attempts. | b63772dddccf9cee |
| securityweek-exploitation-days-before | carries | WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub. | ac663f2d9dbd0197 |
| darkreading-php2shell-red-alert | carries | WatchTowr reported it has observed exploitation attempts of both flaws in the wild. | 6db30e279f5f3877 |
| therecord-php-warnings | carries | the cybersecurity company is also observing in-the-wild exploitation of the vulnerabilities | 39efe473da414c01 |
| tenable-php2shell-faq | carries | watchTowr says it has reproduced both vulnerabilities and is observing exploitation attempts against both. | 10d98694b9c0243e |
| equixly-php2shell-what-we-know | absent | watchTowr lists no reported exploitation, and neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog. | 34bf72d02f14deb9 |
| securityweek-mass-exploitation-looms | absent | WatchTowr and Huntress say they have not seen either of the vulnerabilities being exploited in the wild. | 693aa4300139d2af |
| watchtowr-php2shell | carries | EXPLOITED IN THE WILD: Yes , reported by watchTowr | e09524178ed5f328 |
| watchtowr-php2shell-faq | carries | watchTowr has observed exploitation in the wild through its Attacker Eye honeypot network. | 3c561d0c08e9343f |
Open tickets: Contradiction-2, Finding-111, Finding-127, Finding-18, Finding-19.
Graded in Run-6, resting on captures up to 2026-10-23 23:25 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-22 11:18 UTCSaved into the evidence vault: watchTowr, then 1 more capture
- 2026-10-22 11:18 UTCSaved into the evidence vault: watchTowr, then 1 more capture
- 2026-10-22Enters this site as unverified in v0.2.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · unverified
watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild Who says it: watchTowr Status: unverified Topic: exploitation Sources: watchtowr-php2shell, watchtowr-php2shell-faq