cyber.hendryadrian.com
Security Insights · censys.com

Censys Explains Why PHP2Shell Exposure Counts Differ

· Original article ↗

Summary

Censys explains why public PHP2Shell exposure counts vary, citing different scan sources, counting units, version banners, query methods and refresh rates, and describes its own scanning and historical tracking.

Key points

  • PHP announced an emergency release on October 20 for two pre-authentication RCE flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and collectively called PHP2Shell.
  • Exposure counts can differ because scanners use different indexes, count different units, handle hidden version banners differently, and may overcount similar version strings or duplicate hosts.
  • Banner-based counts can include systems whose Linux distributions backported fixes without changing the reported version; the article says these counts are upper bounds.
  • Censys says its scanners cover all 65,535 ports daily and revisit services about every 8 to 14 hours; its measurements found newly exposed hosts within 2 to 11 hours.
  • Censys says it treats websites as separate properties and retains four years of history to track service changes and patch adoption.
  • Reports of in-the-wild exploitation were changing at publication; at least two security vendors had retracted claims linking incidents to these CVEs, while the flaws were listed in CISA’s Known Exploited Vulnerabilities catalog.

Article Details

Topic
Censys’ Internet Map methodology for measuring PHP2Shell exposure and explaining differences in public PHP vulnerability counts.

CVE

CVE-2026-109618On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2.CVE-2026-109619On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2.

Vendors

CensysCensys’ PHP exposure reporting derives exclusively from its Internet Map, the most accurate, comprehensive, and real-time Internet data in the world.

Products

Censys InvestigatorTake the source IP of a suspicious multipart POST from your logs, enrich it, and pivot to the rest of its infrastructure by hand or with Censys Investigator.Internet MapCensys’ PHP exposure reporting derives exclusively from its Internet Map, the most accurate, comprehensive, and real-time Internet data in the world.PHPCensys’ PHP exposure reporting derives exclusively from its Internet Map, the most accurate, comprehensive, and real-time Internet data in the world.

Related Articles