[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-php2shell-draws-millions-of-attacks-but-no-confirmed-breaches":10,"sections":56},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":42,"persona_id":42,"persona_name":42,"section":43,"tags":44,"sources":49,"feedback":55,"feedback_at":42,"cost_usd":55,"total_tokens":55},12142,"php2shell-draws-millions-of-attacks-but-no-confirmed-breaches","PHP2Shell Draws Millions of Attacks, but No Confirmed Breaches","Cloudflare's CEO says exploit attempts against PHP2Shell number in the millions, while officials in three countries report no successful intrusion.","Attackers have made millions of attempts to exploit PHP2Shell since it was disclosed, but officials in Germany, the Netherlands and Japan say they have not seen a single one succeed.\n\nPHP2Shell is a newly disclosed security flaw that attackers are trying to exploit. The name hints at PHP, the scripting language behind a large share of the web, and at a \"shell\", which is the command access an attacker gets when they can run instructions on someone else's server. Cloudflare chief executive Matthew Prince gave the attempt count in a post on X, drawn from traffic crossing Cloudflare's network. The three national governments are the ones reporting no confirmed break-ins so far.\n\nThose two facts measure different things. An exploit attempt is cheap: automated scanners can fire off millions of requests at little cost, whether or not any target is vulnerable. A confirmed breach requires a working attack against a system that was exposed, plus someone noticing. The first number shows how fast attackers moved. The second shows only what defenders have found so far.\n\nThe pattern is familiar. When Log4Shell, a flaw in a widely used Java logging library, was disclosed in December 2021, mass scanning started within hours, and real compromises followed in the days after. Heavy early scanning has tended to signal that attackers see a flaw as worth the effort, not that they have succeeded.\n\nThe government statements come from three countries, which is a useful spread but a small sample of the world's servers. Whether the count of confirmed intrusions stays at zero depends on how many systems are exposed and how quickly their operators patch, and neither figure has been published.","[\"php2shell\",\"vulnerability\",\"cloudflare\",\"exploit\"]","2026-10-22T13:03:23.000Z","2026-10-22T13:40:50.301Z","2026-11-08T00:19:19.364Z","published","The draft still asserts what PHP2Shell is (a 'flaw', with a PHP and shell meaning inferred from the name) when the source never says, and it still claims Prince's attempt count is 'drawn from traffic crossing Cloudflare's network' when the source gives that provenance only for a truncated 'thousands of…' stat; remove both unsupported claims, describe PHP2Shell only as 'PHP2Shell' with confirmed facts (Wednesday's disclosure, Prince's post on X, Germany\u002FNetherlands\u002FJapan reporting no successful i",[24,30,35,39],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the narration of source gaps ('The excerpt we have cuts off…', 'The source does not describe the flaw'), and drop the 'October 21' date, since the source only says 'Wednesday'. Also cut the inference that the flaw was already known before disclosure, because the 'thousands of…' stat is truncated and never says they were exploit attempts. Remove the unexplained reference to 'the vendor's advisory', and either build the piece only on what is confirmed or hold it until fuller source material","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":34},"editor-r2",2,"The draft never says what PHP2Shell is (a flaw, malware or a tool), so the headline subject is an unidentified entity, and it states as fact that the millions figure comes from Cloudflare's own network traffic when the source only gives that provenance for a truncated 'thousands of…' stat; explain PHP2Shell using confirmed information and drop or soften the unsupported attribution, or hold the piece until fuller source material is available.","open",{"id":36,"reviewer":26,"round":37,"reason":38,"status":34},"editor-r3",3,"The draft still never establishes what PHP2Shell is, and it narrates the source's gaps to the reader ('The source does not say…', 'The excerpt cuts off there'), which reads like editing-note text; it also invents an 'October 21' date when the source says only 'Wednesday's disclosure', so remove the unsupported date and the meta-commentary, and either explain PHP2Shell from confirmed information or hold the piece until fuller source material is available.",{"id":40,"reviewer":26,"round":41,"reason":22,"status":34},"editor-r4",4,null,"security",[45,46,47,48],"php2shell","vulnerability","cloudflare","exploit",[50,53],{"name":51,"url":52},"The Next Web","https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fphp2shell-millions-exploit-attempts-no-confirmed-breaches",{"name":51,"url":54},"https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fcloudflare-php2shell-millions-exploit-attempts",0,{"sections":57},[58,63,67,72,77,82,87,92,97,102,107,112,117,122],{"name":59,"slug":60,"count":61,"latest_published_at":62},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":64,"slug":43,"count":65,"latest_published_at":66},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":113,"slug":114,"count":115,"latest_published_at":116},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":118,"slug":119,"count":120,"latest_published_at":121},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":123,"slug":124,"count":125,"latest_published_at":126},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]