Tracker · php2shell day by day · Is my site cooked?

Tracker · php2shell · live

days since disclosure, 20 Oct 2026

3 of 4 milestones

The x2shell wave, day by day.

Public milestones as they land, with the aggregate. No domain is ever listed.

Alerts in Telegram

18checks run

20%cooked

0%shielded

20%unknown

60%not PHP

0fixed since first check

Shares are of the 10 sites checked, latest verdict per site, errors excluded. Fixed counts sites that went from COOKED to SHIELDED on a re-check. Aggregates only. No domain is ever listed.

Kill-feed · php2shell

Public milestones, each with its source.

20 OctLeakedDetails of the pair leak online before coordinated disclosure. php.net posts advance notice of a critical release. source

21 OctPatched upstreamphp.net ships 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with source backports for 7.4, 8.0 and 8.1. source

21 OctExploitation reportedwatchTowr reports attempts in its honeypots. Other vendors are still confirming. source

nextKEV listingListed in the CISA known exploited catalogue. source

the bot on X· daily post · soon

Day 02 of php2shell. 18 checks: 20% cooked, 0% shielded, 20% unknown, 60% not PHP. Aggregates only. Check yours in about five seconds.

Your watch list

soon

/watch opens with the Telegram bot: a daily re-check and an alert when the verdict changes.

Hall of Cooked.

Each mass RCE wave found by AI gets its own module. The scanner grows with the Hall.

WaveWhereWhenCVEsScanner

php2shellPHP coreOct 2026CVE-2026-109618 + CVE-2026-109619module live

next waveto be namedwhen it landsa new scanner modulein the plan