https://php2shell.co.uk/changes/ Dated record of substantive changes to the PHP2Shell Response Kit: what changed, which pages were affected and which sources changed. en-GB Fri, 30 Oct 2026 12:00:00 GMT https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-30-Correct%20the%20KEV%20deadline%20wording%20after%20the%20due%20date%20passed Fri, 30 Oct 2026 12:00:00 GMT The latest check said the 29 October remediation due date for US federal civilian agencies was “today”. The page is dated 30 October, so the sentence now records the date as passed. No other wording, source or guidance changed. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-30-On-page%20navigation%2C%20article%20metadata%20and%20an%20IndexNow%20key Fri, 30 Oct 2026 12:00:00 GMT Added an “On this page” navigation with stable anchors to /understand/, advisory and release dates to /versions/, article published and modified metadata for article pages, and contextual links from the home notice and the sources page to /versions/. The robots meta now allows full snippets. An IndexNow key and the seo:indexnow script submit the sitemap URLs to Bing and other participating engines after a deployment. No fact, fixed version or exploitation claim changed. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-30-Version%20reference%20page%2C%20CVE-aware%20titles%20and%20a%20revisions%20feed Fri, 30 Oct 2026 12:00:00 GMT Added /versions/, a single reference for affected and fixed PHP releases, distribution and runtime packages, and the PAN-OS, NetScaler and QNAP vendor builds. The pages it links from now name CVE-2026-109618 and CVE-2026-109619 in their titles and descriptions within search-result limits. TechArticle dateModified now follows the site revision dates instead of a fixed authored date, and /changes/rss.xml provides a feed for revision updates. No fact, fixed version or exploitation claim changed. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-30-Unit%2042%20verifies%20the%20chained%20PAN-OS%20firewall%20campaign Fri, 30 Oct 2026 12:00:00 GMT Unit 42's 29 October update confirms active exploitation of PAN-OS management interfaces exposed to the internet, reports the Dream Research chain with the Linux kernel flaw, and states that it independently verified the same attacker's tooling and confirmed the reported results. Palo Alto Networks estimates about 0.02% of its global installed base had internet-facing management interfaces and was impacted; affected customers were contacted individually and the interface is not exposed by default. The 25 October retraction of a separate European government attribution still stands. NCSC-NL's inventory now tracks 929 products (217 vulnerable, 165 fixed) and Delft's counters were refreshed to 76,153 requests. Fixed PHP versions and patch/restart/verify steps are unchanged. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-30-UK%20NCSC%20alert%20added%3B%20embedded-PHP%20inventory%20reaches%20925%20products Fri, 30 Oct 2026 12:00:00 GMT The UK NCSC alert advises inventorying every PHP system rather than only outdated ones, patching internet-facing systems first, taking a system offline if it cannot be fully mitigated, and assessing for evidence of compromise and backdoors before upgrading; it reports no specific UK exploitation and predates the KEV listing. NCSC-NL's inventory now tracks 925 products with a PHP dependency, 223 marked vulnerable and 153 fixed, which is the scale behind the appliance guidance. Delft's counters were refreshed to the 30 October 01:22 UTC reading. Fixed PHP versions, patch/restart/verify steps and the KEV status are unchanged. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-29-Pre-disclosure%20exploitation%20dated%20to%2017%20October%3B%20JPCERT%2FCC%20adds%20compromise%20indicators Thu, 29 Oct 2026 12:00:00 GMT Amazon Threat Intelligence reports a PHP2Shell exploitation attempt in MadPot telemetry dated 17 October 2026, four days before disclosure, and advises reviewing logs from at least that date. JPCERT/CC's advisory update of 29 October lists three compromise indicators — unusual PHPSESSID values, suspicious multipart requests with memory-limit errors or HTTP 500s, and PHP workers terminating or restarting unexpectedly — and warns that traces may not be logged, so a clean log is not proof of safety. The same update reports successful exploitation against a specific firewall version chained with the kernel flaw, without naming the product. Delft's live counters were refreshed to the 11:22 UTC reading. Fixed PHP versions and patch/restart guidance are unchanged. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-29-KEV%20covers%20the%20Fragnesia%20chain%3B%20QNAP%20added%3B%20exploitation%20telemetry%20separated%20from%20compromise Thu, 29 Oct 2026 12:00:00 GMT CISA's 29 October deadline for both PHP2Shell CVEs falls today, and on 28 October CISA also listed the Linux kernel flaw CVE-2026-46300 (Fragnesia), stating that it can be chained with the PHP2Shell CVEs to implant webshells and run commands as root. QNAP's QSA-26-18 adds NAS and storage appliances to the firmware-only fix pattern already seen with PAN-OS and NetScaler. Delft University's live honeypot and telescope data (72,679 requests from 664 IPs in 73 countries to 29 October 01:16 UTC) is presented as observed attempts, not compromises. Fixed PHP versions and patch/restart/verify steps are unchanged; Fragnesia and the Brotli CVE stay outside the PHP2Shell counts. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-28-Vendor%20advisories%20put%20appliance%20PHP%20in%20scope%3B%20a%20vendor%20reports%20a%20chained%20intrusion Wed, 28 Oct 2026 12:00:00 GMT Palo Alto Networks states in its CVE-2026-109618 advisory, updated 28 October, that active exploitation has been observed targeting PAN-OS management interfaces exposed to the internet; Citrix lists NetScaler ADC and Gateway as affected with fixed builds. NCSC-NL's software list now records these vendor fixed versions. Dream Research separately reports a 26 October chained PHP2Shell and Fragnesia (CVE-2026-46300) intrusion affecting 25 systems, mostly internet-facing firewalls, including three in a US government-affiliated environment; the vendor and versions are withheld and this site has not independently verified the report. Fixed PHP releases, patch/restart/verify steps and the KEV exploitation status are unchanged. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-27-CISA%20lists%20both%20PHP2Shell%20CVEs%20as%20exploited%20in%20the%20wild Tue, 27 Oct 2026 12:00:00 GMT CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog on 26 October, with a 29 October remediation due date and forensic triage under BOD 26-04. The site now leads with that exploitation status while keeping the limits clear: KEV records exploitation somewhere, not victims, scale or compromise of a particular estate. Patch, restart, verify and intrusion-review advice is unchanged; internet-facing PHP is the priority. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-26-Correction%3A%20Unit%2042%20retracts%20attribution%3B%20official%20exposure%20alert%20added Mon, 26 Oct 2026 12:00:00 GMT Unit 42 retracted its 23 October post-exploitation update on 25 October: it still reports an attack on a European government agency in a vulnerable PHP application, but cannot confirm initial access through the PHP2Shell CVEs. The site removes the retracted password-hash, MFA-secret and Active Directory details as established impact. It also adds the CSIRT-ITA/ACN alert: 285,149 potentially vulnerable of 741,523 detected PHP services in Italy, an exposure estimate that does not confirm exploitation. Patch, restart and verify advice is unchanged. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-25-Correction%3A%20later%20vendor%20brief%20reports%20post-exploitation%20activity Sun, 25 Oct 2026 12:00:00 GMT A 25 October recheck found Unit 42's 23 October threat brief, updated with post-exploitation detail after the earlier media snapshot. The site no longer uses “no confirmed compromise” as a shorthand: it now reports the vendor observation against an unnamed European government entity separately from the NCSC-NL unconfirmed report and from the earlier Security Affairs article. Patch and verification advice is unchanged; an intrusion review remains a separate task for any system that was exposed. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-24-Latest%20source%20check%3A%20no%20new%20fixed%20release%3B%20embedded%20PHP%20inventory Sat, 24 Oct 2026 12:00:00 GMT Rechecked PHP, Cloudflare, NCSC-NL and public reporting on 24 October. No new upstream PHP release or GHSA followed the 23 October session upload progress advisory. Added a latest-status note to the overview, and added appliance/network-device/vendor-managed PHP to the assessment inventory. Public reports of attempted exploitation are labelled as reporting; the site does not claim a confirmed compromise or a clean estate. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-24-Site%20identity%2C%20contact%20address%20and%20container%20evidence%20corrected Sat, 24 Oct 2026 12:00:00 GMT The public site now uses one identity and one contact address: the php2shell.co.uk domain and its public contact address. The footer, About, Contact and Changes pages no longer present another site as part of this publication's identity. The Contact page adds a copy-email control with success and manual-fallback feedback. The workbook now writes each edit synchronously and reports its save state accurately; mobile totals are compact with a table scroll hint. The container playbook now distinguishes base image digest, application image ID, repository digest and platform manifest, and the build checks reject foreign site identities and wrong mailto addresses. https://php2shell.co.uk/changes/ https://php2shell.co.uk/changes/#2026-10-23-Response%20kit%20published Fri, 23 Oct 2026 12:00:00 GMT First release of the independent response kit: four-step response path, three environment playbooks, a local workbook with CSV export, and three collaboration templates. All sources were read in full on the publication date, including PHP's 23 October informational advisory on session upload progress.