For about a week in October, PHP2Shell looked like the end of the web. Two unauthenticated remote code execution flaws in the engine behind roughly 70 percent of websites, a leaked score, a botched disclosure, and governments across Europe and Japan pulling services offline. Then the week ended and nobody had a body. As of October 23, not one source has named a victim with post-exploitation evidence.
The easy conclusion is overreaction, and that conclusion is wrong. This report walks through why. The reason millions of daily attempts are not landing has a name, and it is not luck. Turning memory corruption into a shell on a modern randomized x86-64 host is genuinely hard, and every public exploit tested against a real target has failed without a second weakness. That is the hinge the whole story turns on, and it is also the thing most likely to break.
What you get here is the separation nobody else is making cleanly. Attempt is not success. Scanning traffic is not a compromise. I re-opened every load-bearing source instead of trusting the headlines, and I flag the two numbers I could not confirm against their primary source. The real risk is not the disclosure-week spike. It sits in the long tail, in end-of-life and embedded PHP that patches slowly or never, where financially motivated tooling is already calibrated to old builds.
If you run internet-facing PHP, defend a shared-hosting platform, or own the patch decision for a sector that went dark last week, the actions are specific and sector by sector. The report also keeps one uncomfortable signal in view. The Dutch NCSC says it is investigating initial signs of successful exploitation, with no detail released. That is the single line that could move the whole assessment, and it is the one to watch.
About the Author
