Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · researcher · primary · captured
Censys PHP2Shell Exposure Tracker
Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 1 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Censys's PHP2Shell exposure tracker (live page; 'Updated 18:15 UTC', no date on the page; captured 19:13 UTC on 27 October 2026, so the figures are as of 18:15 UTC on 27 October). Version-based counts, which Censys calls an upper bound.
What it says, as the collector read it
Censys PHP2Shell Exposure Tracker
Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault 7r83qic5), page us/research/censys/censys-php2shell-exposure, snapshot 20261027T191336Z. Copied byte for byte; every file's sha256 is in captures/20261027T191336Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Read in the curator's role._
Censys's PHP2Shell exposure tracker (live page; 'Updated 18:15 UTC', no date on the page; captured 19:13 UTC on 27 October 2026, so the figures are as of 18:15 UTC on 27 October). Version-based counts, which Censys calls an upper bound.
> 32,545,698
> PHP services still on an affected version at their most recent scan
> 42,790,125
> PHP services seen on an affected version at any point since tracking began (Oct 21)
> 10,270,095
> Another 61,303,506 PHP services (58% of all detected) do not reveal their version and are not shown.
> Version-based counts are an upper bound: Linux distributions often backport fixes without changing the version.
Why it is here
From the promotion queue (index/promote.json, priority 1): Censys PHP2Shell Exposure Tracker (updated 18:15 UTC, 27 Oct): 42,790,125 PHP services seen on an affected version since 21 Oct, 32,545,698 still affected at last scan, 10,270,095 patched since 21 Oct; version counts are an upper bound (distribution backports); 61.3 million services hide their version.
Supports: exposure: how many PHP services remain on an affected version; board breaking-0002.
Capture notes
Language en. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:13:36Z. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
Numbers from this source
| Figure | Of | Status |
|---|---|---|
| 32.5 million | PHP services still reporting an affected version at Censys's most recent scan (32,545,698 at its update of 18:15 UTC on 27 October); 42.8 million seen on an affected version at some point since 21 October, 10.3 million seen to move to a fixed version | reported |
The bytes
capture 20261027T191336Z · HTTP 200 · https://php2shell.censys.com/
headers.json167bb5b87eeb5deacab43aff124611399706e24866ffdbb4d3e811715e57b2a2 962 bytespage.htmlc2acdf1e68be13010cabcca055f612ffabd85cc94a0a17858b00a2553c43ab3f 7,410 bytesprovenance.json1f76ba786fd9c894bf7f1e6af4a486968d4e6ab64c598a86b060964ce86c51c7 1,533 bytesrendered.html3b5efb7a546edf8e6fb59ab841ea9b72e9dd31f8a1e856ab24df1c1cc6030803 157,964 bytesscreenshot.jpg9a42840f123abd50975df9fa4aab7b4fdf2f29c89ecfa1f1608fd1b8bf0ec038 374,547 bytestext.txt534d8ce44d4b9408b46ed3db6be4937b3e9b572d9e48fb06aff01c0e29b5d3a4 9,654 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →