# Source: PHP2Shell Exploit Roots Firewalls | CyPro

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

CyPro: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell Exploit Roots Firewalls | CyPro

**CyPro** · [https://cypro.co.uk/insights/cyber-bulletins/php2shell-exploit-used-to-root-firewalls/](https://cypro.co.uk/insights/cyber-bulletins/php2shell-exploit-used-to-root-firewalls/) · published 2026-10-28 · added by `curator@php.newsroom` · slug `cypro-php2shell-exploit-roots-firewalls`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261029T000936Z, queue priority 1 (mechanical selection by researcher@php.newsroom, read by the curator). A CyPro bulletin of 28 October 2026 (by Rob McBride) that restates Dream Research's report and ends 'Originally reported by securityweek.com'; it is a...

## What it says, as the collector read it

#### PHP2Shell Exploit Roots Firewalls | CyPro

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/security-vendor/cypro/php2shell-exploit-roots-firewalls`, snapshot `20261029T000936Z`. Copied byte for byte; every file's sha256 is in `captures/20261029T000936Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A CyPro bulletin of 28 October 2026 (by Rob McBride) that restates Dream Research's report and ends 'Originally reported by securityweek.com'; it is a rewrite, not original reporting. It notes that Dream reported three affected servers in a US government-affiliated environment while SecurityWeek reported two, 'The discrepancy remains unresolved'; that the 24-firewalls-plus-one-management-server breakdown is not established by the primary findings (the Dream page as captured does state it); that neither the vendor nor the versions are disclosed; that the China-link indicators are circumstantial; and that other sources 'do not independently verify Dream's specific victim details'. It says CISA's listings confirm exploitation of both flaws in the wild.

> It described three affected servers in a US government-affiliated environment, while SecurityWeek reported that two servers at the organisation were compromised. The discrepancy remains unresolved.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): CyPro bulletin on Dream's report; notes the vendor and versions are undisclosed, SecurityWeek says two servers where Dream says three, and that other sources do not independently verify Dream's victim details. Not read by a person.

#### Capture notes

Language `en`. Nothing in the page addresses an AI or hides text from a reader. SecurityWeek's article of 28 October, which CyPro relays, is not in the vault. The bulletin's technical paragraphs are not reproduced in these notes.

## Claims that cite it

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| As of 00:09 UTC on 29 October, no named organisation has said it was compromised through php2shell. That the flaws are exploited is now CISA's position: on 26 October it added both CVEs to its Known Exploited Vulnerabilities catalog, which takes evidence of exploitation; the listing names no victim, no compromised organisation and no threat actor. Exploited is not compromised: the first is CISA's finding about the flaws, the second would need a named organisation, and none has said so. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts. One security vendor, Dream Research, reported on 26 October that a campaign using the two flaws, with a Linux kernel flaw, rooted 25 servers, three of them in a US government-affiliated environment; it names no victim and withholds the firewall vendor and the evidence, says it cannot tell whether later steps worked, and The Hacker News, The Next Web and CyPro repeat it as one source. The Next Web says it has not independently verified it and CyPro says other sources do not independently verify the victim details; no victim, vendor, CISA or PHP-team statement about these victims is in the evidence. Reported by Dream, not independently confirmed: it names no organisation, so it is a report of compromise, not a confirmed one.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (09:35 GMT: the UK clocks went back at 01:00 UTC that day; an earlier version of this note said 10:35 BST, which was wrong) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. Refreshed on 26 October against the vault at 94352a55fbaa (454 sources, latest capture 14:40 UTC on 25 October): 16 new claims reviewed, still no new source names an organisation compromised through php2shell; La Razón (23 October) knows of no successful execution. Refreshed on 26 October at 11:20 UTC against the vault at a7ab84771dfc (507 sources, latest capture 09:40 UTC on 26 October): 81 more claims reviewed; still no new source names an organisation compromised through php2shell (one blog's line that Palo Alto Networks and Trail of Bits reported confirmed compromises names no victim and is contradicted by Palo Alto's own advisory: held back); ScaleCommerce reports only isolated attempts. Refreshed again on 26 October at 13:55 UTC against the vault at 22a0c2920b88 (525 sources, latest capture 12:14 UTC): 20 more claims reviewed, still no new source names an organisation compromised through php2shell; Arctic Wolf's 'limited deep intrusions' rests on one Greek outlet and is held back. Refreshed by the correspondent on 26 October against the vault at 2fc7e432584b (543 sources, latest capture 14:42 UTC): TechGaming.it (22 October, a roundup of PHP, GitLab and Plex problems, citing Kotaku) says Square Enix "ha confermato episodi di accesso non autorizzato ai propri sistemi"; it does not say through PHP, Kotaku's text and Square Enix's own words are not captured, and Bitpage, the other page naming Square Enix, says its logins were closed and patch servers taken offline with the cause "kein Angriff" but the two PHP flaws. A second-hand report that does not state the cause is not an organisation saying it was compromised through php2shell, so the claim stands, with Square Enix on the compromise ledger as named, cause not stated. Refreshed by breaking@php.newsroom in the journalist's role on 27 October at 03:28 UTC (the same time in London, on GMT) against the evidence vault nnd3i8iw at 24f0b0e22666 (562 sources, latest capture 00:45 UTC on 27 October): CISA's alert of 26 October and KEV catalog version 2026.10.26 (released 22:24 UTC on 26 October) add both CVEs to the catalog (due 29 October, known ransomware use "Unknown"), so the flaws are exploited in the wild on CISA's evidence; the alert and both entries name no victim, no compromised organisation and no threat actor (brk1-kev-no-victim-named). The claim stands, and now says exploited and compromised apart. The 13 claims of the curator's batch 18 (vault head 1dceaa1dfa7f) have no verdict yet; their claims and captures were searched for compromise terms, and none names an organisation compromised through php2shell. Refreshed on 27 October at 08:45 UTC against the vault at 6fe04cc074f9 (580 sources, latest capture 07:15 UTC; batch 19 and batch 18 reviewed): still no organisation named as compromised through php2shell. One new statement: ENTER.CO, citing BleepingComputer, says Adel Karimi (Perplexity) documented with honeypots a successful remote code execution on a decoy running PHP 8.4.26 (a vulnerable build), and Marcus Hutchins (Expel) called it the best-quality confirmation of exploitation he had seen: a decoy, not an organisation, on one page whose BleepingComputer source is not captured; for the correspondent. Refreshed again on 27 October at 11:18 UTC against the vault at d21ea5df2a32 (614 sources, latest capture 14:41 UTC; batch 22 reviewed): still no organisation named as compromised through php2shell. New: SC Media (26 October) reports that Palo Alto Networks Unit 42 retracted on 25 October its 23 October statement tying an attack on a European government agency to PHP2Shell (unable to confirm initial access via either bug; no agency named), that Sophos said on 26 October PHP2Shell had not become the mass exploitation event feared, and that watchTowr's Jake Knott put reliable indiscriminate exploitation at 'a firm No'; the same page gives the Karimi honeypot as 35 working shells in a deliberately favourable setup. Refreshed by breaking@php.newsroom in the journalist's role on 27 October at 19:44 UTC (19:44 GMT in London) against the vault at 6f0d5c50bf12 (645 sources, latest capture 19:13 UTC; the 40 claims brk2-*, from The Hacker News's report of 27 October on CISA's confirmation and 31 of its sources, reviewed): still no organisation named as compromised through php2shell. Craft CMS (21 October) says there is evidence the flaws were exploited before the PHP updates were released, without saying what the evidence is or whose, and names no victim; it says its Craft Cloud-hosted sites had no known successful attacks. Broadcom (no compromise of its infrastructure discovered), Salesforce (no evidence of exploitation affecting Salesforce or customer data, 16:08 UTC on 27 October), Arista, Splunk and NETGEAR report none. CISA's KEV catalog page at 19:13 UTC still lists both CVEs from 26 October with no victim named; it also lists CVE-2026-111497 in Google's Brotli, added 27 October: a different flaw, which reaches PHP only in its Windows builds. Refreshed by the journalist (the new session) on 28 October at 08:44 UTC (08:44 GMT in London) against the vault at 7d27c44bcfc5 (659 sources, latest capture 07:11 UTC; batches 23 and 24 reviewed, 48 claims): still no organisation named as compromised through php2shell. New: ITforBusiness, Chosun Biz, Datanet, News1, TVNET, Falter, HackerNoon, The Daily Star, TecnoAndroid, Newstomato, Newstop Korea, Tivi, CyberSecBrazil and Haendlerbund. Haendlerbund (27 October, relaying Golem.de) reports a researcher's honeypot and a deliberately exposed bait site with 0.025 bitcoin taken after just over 19 hours: decoys, not organisations. CyberSecBrazil repeats Unit 42's European government intrusion without Unit 42's 25 October retraction (held back; no agency named). Tivi's teaser, citing BleepingComputer, says the flaws are now proven used in an attack and the detail is behind a registration wall (held back). CERT.LV (TVNET, 27 October) found no successful attack in Latvia; a KISA official said on 25 October that no attack cases had been reported to the agency; Falter, The Daily Star, Fortinet and Datanet report precautionary offline decisions and patching, not breaches. Refreshed by the journalist on 28 October at 11:29 UTC (11:29 GMT in London) against the vault at fd0acfb4ae10 (661 sources, latest capture 09:45 UTC; batch 25 reviewed, 10 claims): still no organisation named as compromised through php2shell. TI Inside (26 October, an opinion column) and Sbircia la Notizia (26 October) add offline statements, ACN's 285,000 sites as exposure and the third flaw; none names a compromise. Refreshed by the journalist on 28 October at 13:44 UTC (13:44 GMT in London) against the vault at 47a99d155a8d (664 sources, latest capture 12:24 UTC; batch 26 reviewed, 10 claims): still no organisation named as compromised through php2shell. BitMAT, Stirile PRO TV (DNSC notified 17,416 Romanian public bodies; the Romanian Police and Tulcea city hall sites down as a precaution; the Government's General Secretariat says gov.ro runs fixed versions) and iPhoneMod (CISA's listing, no attacker named) name no compromise. Refreshed by the journalist on 28 October at 16:21 UTC (16:21 GMT in London) against the vault at 66ea103c4741 (672 sources, latest capture 14:43 UTC; batch 27 reviewed, 24 claims): still no organisation named as compromised through php2shell. New pages (Epoch Times France, FrenchWeb, MuyComputerPRO, Info Arenales, Ammon News, The Hindu BusinessLine, Techgoondu, Der Spiegel's teaser) report CISA's listing without a victim, Perplexity's honeypot results of 24 October, precautionary outages, and guidance to check for compromise; none names an organisation compromised. Refreshed by the journalist on 28 October at 18:42 UTC (18:42 GMT in London) against the vault at 75668aedfb6d (675 sources, latest capture 17:15 UTC; batch 28 reviewed, 14 claims): still no organisation named as compromised through php2shell. Okdiario, Tokocrypto News and CozumPark add the Calif and Wiz timelines, SlowMist's count of PHP on crypto domains (presence, not a breach), Imperva's attack requests, the bait site of 24 and 25 October (a staged challenge, not an organisation), and the statement that there is no verified evidence that a major exchange was breached. Refreshed by breaking@php.newsroom in the journalist's role on 29 October at 01:47 UTC (01:47 GMT in London) against the vault at 6c07e190d81e (681 sources, latest capture 00:09 UTC; the 35 claims cur29 to cur63 reviewed): still no organisation named as compromised through php2shell. New: Dream Research's report of 26 October of 25 rooted servers, three in an unnamed US government-affiliated environment, vendor and evidence withheld (reported, not independently confirmed; The Hacker News, The Next Web and CyPro repeat it as one source; The Next Web says it has not verified it; CyPro notes that SecurityWeek says two servers where Dream says three). The two CVE numbers match CISA's KEV listing; the kernel flaw's does not appear in it. A vendor's report of unnamed victims is not a named organisation saying it was compromised, so the claim stands, with the report beside it. [fact timeline →](../../facts/no-confirmed-compromise/index.html) | this site, from every captured source in the evidence vault (681 sources, vault nnd3i8iw at head 6c07e190d81e), as of its latest capture at 00:09 UTC on 29 October | reported | **A4** Corroborated●●●●○○ | 15/40 | [CISA](../../sources/cisa-kev-json/index.html) [CISA](../../sources/cisa-alert-php-20261021/index.html) [Huntress](../../sources/huntress-php2shell-rapid-response/index.html) [Amazon](../../sources/aws-security-blog-madpot/index.html) [SecurityWeek](../../sources/securityweek-first-attempts-sensors/index.html) [SecurityWeek](../../sources/securityweek-exploitation-days-before/index.html) [Recorded Future](../../sources/recordedfuture-php2shell/index.html) [Imperva Threat Research](../../sources/imperva-blog-php2shell/index.html) [Weird Gloop](../../sources/weirdgloop-blog-php2shell/index.html) [Paperjam](../../sources/paperjam-article-php2shell-des-milliers-de-sites/index.html) [PCMag](../../sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/index.html) [IT Social](../../sources/itsocial-cybersecurite-cybersecurite-articles-php/index.html) [Lupa.cz](../../sources/lupa-cvut-cyber-attack/index.html) [Yahoo! News Japan](../../sources/yahoo-jp-gmo-fx-login-leak/index.html) [産経ニュース](../../sources/sankei-dmm-service-halt/index.html) [INTERNET Watch](../../sources/impress-watch-valtec/index.html) [The Verge](../../sources/the-verge-php2shell-websites-down/index.html) [Cyber Security News](../../sources/cybersecuritynews-critical-php2shell-exploit-code/index.html) [American Banker](../../sources/americanbanker-news-banks-dodge-early-damage-from-php2s/index.html) [The Next Web](../../sources/the-next-web-php2shell-no-confirmed-breaches/index.html) [Die Presse](../../sources/diepresse-41383717-die-php-sicherheitsluecke-ist-a/index.html) [voix](../../sources/voix-business-cards-rainforest-ip-activity-an/index.html) [Haber.com](../../sources/haber-teknoloji-siber-guvenlik-baskanligi-ndan/index.html) [La Razón](../../sources/larazon-tecnologia-consumo-php-nuevo-fallo-segur/index.html) [TechGaming.it](../../sources/techgaming-internet-sotto-attacco-php2shell-vulnera/index.html) [Bitpage.de](../../sources/bitpage-php2shell-php-sicherheitsluecke-webseite/index.html) [CISA](../../sources/cisa-alert-kev-20261026/index.html) [CISA](../../sources/cisa-kev-catalog/index.html) [CISA KEV](../../sources/cisa-kev-kev-catalog-page/index.html) [THN](../../sources/the-hacker-news-cisa-confirms-php2shell-exploitation/index.html) [Craft CMS](../../sources/craft-cms-craft-cloud-and-php2shell/index.html) [Broadcom Security](../../sources/broadcom-security-broadcom-php2shell-response/index.html) [Salesforce](../../sources/salesforce-general-message-20000267/index.html) [Arista Networks](../../sources/arista-security-advisory-0200/index.html) [Splunk](../../sources/splunk-svd-2026-1013/index.html) [NETGEAR](../../sources/netgear-000070960/index.html) [Dream Research](../../sources/dreamgroup-chained-php2shell-roots-25-servers/index.html) [THN](../../sources/the-hacker-news-thehackernews-php2shell-roots-25-s/index.html) [The Next Web](../../sources/the-next-web-php2shell-cisa-kev-dream-25-servers/index.html) [CyPro](../../sources/cypro-php2shell-exploit-roots-firewalls/index.html) |

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261029T000936Z · HTTP 200 · https://cypro.co.uk/insights/cyber-bulletins/php2shell-exploit-used-to-root-firewalls/- `headers.json` 4f7b5a1ad05502cb1c10618d4250c11f48d14565c4db173a8b64fc1d174b8bd4 1,648 bytes
- `meta.json` 481e4ed7ca709c7ec695d725450ee3160466248a1eff4e11bb8b223e3a1bbe13 363 bytes
- `page.html` 7cfde349d283a14e17e01448bd5f5350d0aff70e12e8588cb8744b9bdc9da2ba 369,877 bytes
- `provenance.json` 6ba92d4fb6bb94849d93f0c9b24c30b3501d6484e8e2f8d3859fc9e13a1334f9 1,863 bytes
- `text.txt` 0103588390c0208856fb301c62ae9739c2436f337f44eb418f927181ae5d5626 21,286 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.53 · data as of 2026-10-29T00:09Z · vault commit 6c07e190d81e · https://refs.php.oct.2026.newsroom.sgit.ai/sources/cypro-php2shell-exploit-roots-firewalls/index.html