# Source: Censys PHP2Shell Exposure Tracker

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Censys: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · researcher · primary · captured

# Censys PHP2Shell Exposure Tracker

**Censys** · [https://php2shell.censys.com/](https://php2shell.censys.com/) · published not stated · added by `breaking@php.newsroom (curator's role)` · slug `censys-php2shell-exposure`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 1 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Censys's PHP2Shell exposure tracker (live page; 'Updated 18:15 UTC', no date on the page; captured 19:13 UTC on 27 October 2026, so the figures are as of 18:15 UTC on 27 October). Version-based counts, which Censys calls an upper bound.

## What it says, as the collector read it

#### Censys PHP2Shell Exposure Tracker

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/research/censys/censys-php2shell-exposure`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

Censys's PHP2Shell exposure tracker (live page; 'Updated 18:15 UTC', no date on the page; captured 19:13 UTC on 27 October 2026, so the figures are as of 18:15 UTC on 27 October). Version-based counts, which Censys calls an upper bound.

> 32,545,698

> PHP services still on an affected version at their most recent scan

> 42,790,125

> PHP services seen on an affected version at any point since tracking began (Oct 21)

> 10,270,095

> Another 61,303,506 PHP services (58% of all detected) do not reveal their version and are not shown.

> Version-based counts are an upper bound: Linux distributions often backport fixes without changing the version.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): Censys PHP2Shell Exposure Tracker (updated 18:15 UTC, 27 Oct): 42,790,125 PHP services seen on an affected version since 21 Oct, 32,545,698 still affected at last scan, 10,270,095 patched since 21 Oct; version counts are an upper bound (distribution backports); 61.3 million services hide their version.

Supports: exposure: how many PHP services remain on an affected version; board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:13:36Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

### Numbers from this source

| Figure | Of | Status |
|---|---|---|
| 32.5 million | PHP services still reporting an affected version at Censys's most recent scan (32,545,698 at its update of 18:15 UTC on 27 October); 42.8 million seen on an affected version at some point since 21 October, 10.3 million seen to move to a fixed version | reported |

## The bytes
capture 20261027T191336Z · HTTP 200 · https://php2shell.censys.com/- `headers.json` 167bb5b87eeb5deacab43aff124611399706e24866ffdbb4d3e811715e57b2a2 962 bytes
- `page.html` c2acdf1e68be13010cabcca055f612ffabd85cc94a0a17858b00a2553c43ab3f 7,410 bytes
- `provenance.json` 1f76ba786fd9c894bf7f1e6af4a486968d4e6ab64c598a86b060964ce86c51c7 1,533 bytes
- `rendered.html` 3b5efb7a546edf8e6fb59ab841ea9b72e9dd31f8a1e856ab24df1c1cc6030803 157,964 bytes
- `screenshot.jpg` 9a42840f123abd50975df9fa4aab7b4fdf2f29c89ecfa1f1608fd1b8bf0ec038 374,547 bytes
- `text.txt` 534d8ce44d4b9408b46ed3db6be4937b3e9b572d9e48fb06aff01c0e29b5d3a4 9,654 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/censys-php2shell-exposure/index.html