# The evidence behind four days: what changed in v1.1.0, sgit.ai > The changes to the article "The evidence behind four days" in v1.1.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [The evidence behind four days](../../the-evidence-behind-four-days.md) / [Versions](../the-evidence-behind-four-days.md) / v1.1.0 # The evidence behind four days: what changed in v1.1.0 From v1.0.0 (2026-10-27, `15683c53c`) to v1.1.0 (2026-10-27, `019ddf902`), paragraph by paragraph. **Prompted by review.** This version answers ChatGPT (OpenAI)’s review of the text published in newsroom v0.13.101 (9 findings fixed). 14 paragraphs added, 5 removed, 15 changed in place, 37 unchanged. About 1,399 words added and 486 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [all versions](../the-evidence-behind-four-days.md) · [v1.2.0 →](v1.2.0.md) 1 unchanged paragraph Summary: Four days after php2shell went public, Jeremiah Grossman, CEO of Root Evidence, posted on LinkedIn that the evidence does not support the wave of AI-enabled breaches many were bracing for, that the exploits are environment-specific, that in the same four days over a thousand CVEs were published and almost none were exploited, and that the rule is the old one: patch what adversaries exploit. This is the data behind each claim, re-counted from public sources and from the PHP story site's evidence, with every number traceable to a query or a captured source. Most of it holds. The post's timestamp is the CVE record's to the second; NVD counts 1,394 CVEs in the same window, not 1,448; none references Exploit-DB or Metasploit; VulnCheck published 25 old bugs with 2017 to 2025 IDs on 22 October; CISA had listed one, the Arista flaw. Two things changed after the post: CISA added both php2shell CVEs to its catalogue on 26 October, and their EPSS scores jumpedwent from about 0.1 to 0.9998above 0.999 the day before. StillAs of 09:43 UTC on 27 October, no named organisation hashad said it was compromised through php2shell. And theThe yearly numbers backare consistent with the post's wider point:point, but cannot test it: CVE publications more than doubled this year, while additions to CISA's catalogue rose by 30%. Corrected on 27 October after a review by ChatGPT, which the editor asked for; the changes are listed at the end. !shot jg-window.webpjg-post.webp | images/ | FourJeremiah Grossman's post on LinkedIn, four days ofafterCVEs,php2shellfromwent public, as shared with me on 27 October 2026: "php2shell went public four days ago, at 13:48:34 UTC on 21 October to21, 2026", the claims in the same timefourondays,25 October 2026, re-counted on 27 October: 1,394 published according to NVD (the post says 1,448), 1,383 scored by EPSS, 22 with an EPSS of 0.01 or more, 25 old bugs given IDs by VulnCheck on 22 October, none with an Exploit-DB or Metasploit reference, one on CISA's KEV catalogue atand the timeconclusion,of"patchthewhatpost,adversariesand three now, the Arista flaw and both php2shell CVEs. Log scale.exploit". | chartmedium | aside 3 unchanged paragraphs, under In short {#in-short} • **1,394, not 1,448,** by NVD's count for the same window. Close;Close, but not reconciled: we have possible causes, not the differencetwoislistsexplained below.compared. • **Almost none showaresignsexpectedoftoexploitation.**be exploited.** 1,361 of 1,383 have an EPSS below 0.01;0.01, a 30-day forecast, not a count; none cites Exploit-DB or Metasploit.Metasploit in NVD. • **Still no**No confirmed victim.**victim,53 rowsas of evidence,09:43 UTC on 27 October.** Attempts, honeypot shells and a CISA listing, yes; of eight named organisations, none confirmed as php2shell. 1 unchanged paragraph • **Two things changed since.** CISA listed php2shell on 26 October; EPSS jumped to 0.9998 the day before. • **The yearly data backs the wider point.** CVEs more than doubled; the exploited catalogue grew by 30%. • **Two things changed since.** CISA listed php2shell on 26 October; EPSS went above 0.999 the day before. • **The yearly data is consistent with the wider point, but cannot test it.** CVEs more than doubled; CISA's catalogue grew by 30%. • **AI does cut the effort of building exploits,** in Wiz's own account. That is a research capability, not evidence of adversaries' use or of victims. 3 unchanged paragraphs, under The post {#post} The [PHP story site](https://php.oct.2026.newsroom.sgit.ai/) keeps exactly the record needed to check this, and the rest is public: NVD's API, CISA's catalogue, FIRST's EPSS scores and the CVE records. Every number below comes from one of them;them, except where marked; the queries and the derived data are in [this article's dataset](https://newsroom.sgit.ai/articles/data/the-evidence-behind-four-days__dataset.json). 1 unchanged paragraph, under Claim by claim {#claims} | Claim in the post | What the data says | Verdict | | --- | --- | --- | | Public at 13:48:34 UTC on 21 October | The CVE record for CVE-2026-109618: published 2026-10-21T13:48:34.845Z | Exact | | 1,448 CVEs in four days | NVD: 1,394 in the same window, 12 of them rejected | Close | | No exploit code in Metasploit or Exploit-DB | None of the 1,394 NVD records references either | Holds, as far as NVD shows | | VulnCheck: 25 on its KEV, 24 old bugs given IDs on 22 October, years 2017 to 2025 | NVD: VulnCheck, as a CNA, published 25 CVEs with 2017 to 2025 IDs, all on 22 October | Consistent; KEV membership not checked | | CISA added one: Arista VeloCloud Orchestrator | CVE-2026-114625, published 22 October, listed 23 October; the other listing that day, a Collabora flaw, was published on 14 October | Exact at the time; three now | | Censys: 32 million PHP services on an affected version | Censys's dashboard is quoted at 36.7 million services on 22 October, by Fortinet | Not reproduced | | Honeypots caught plenty of attempts | Amazon's MadPot, ELLIO's sensors, Chainguard's honeypots, Cloudflare's "millions" | Holds | | No mass compromise; nothing confirmed | No named organisation has said it was compromised through php2shell, at 09:43 UTC on 27 October | Holds | | Exploits built for specific environments | The public chains are tuned to one build, raced, or have the wrong mechanism | Holds | [figure jg-window.webp] Four days of CVEs, from 13:48:34 UTC on 21 October to the same time on 25 October 2026, re-counted on 27 October: 1,394 published according to NVD (the post says 1,448), 1,383 scored by EPSS, 22 with an EPSS of 0.01 or more, 25 old bugs given IDs by VulnCheck on 22 October, none with an Exploit-DB or Metasploit reference, one on CISA's KEV catalogue at the time of the post, and three now, the Arista flaw and both php2shell CVEs. Log scale. | chart | Claim in the post | What the data says | Verdict | | --- | --- | --- | | Public at 13:48:34 UTC on 21 October | The CVE record for CVE-2026-109618: published 2026-10-21T13:48:34.845Z | Exact | | 1,448 CVEs in four days | NVD: 1,394 in the same window, 12 of them rejected | Close; not reconciled | | No exploit code in Metasploit or Exploit-DB | None of the 1,394 NVD records references either | Holds, as far as NVD shows | | VulnCheck: 25 on its KEV, 24 old bugs given IDs on 22 October, years 2017 to 2025 | NVD: VulnCheck, as a CNA, published 25 CVEs with 2017 to 2025 IDs, all on 22 October | The count matches; KEV membership and when the IDs were assigned not checked | | CISA added one: Arista VeloCloud Orchestrator | CVE-2026-114625, published 22 October, listed 23 October; the other listing that day, a Collabora flaw, was published on 14 October | Exact at the time; three now | | Censys: 32 million PHP services on an affected version | Censys's dashboard is quoted at 36.7 million services on 22 October, by Fortinet | Not reproduced | | Honeypots caught plenty of attempts | Amazon's MadPot, ELLIO's sensors, Chainguard's honeypots, Cloudflare's "millions" | Holds | | No mass compromise; nothing confirmed | No named organisation has said it was compromised through php2shell, at 09:43 UTC on 27 October | Holds, as a time-bounded absence | | Exploits built for specific environments | The public chains are tuned to one build, raced, or have the wrong mechanism | Holds | 2 unchanged paragraphs, under No wave, and nothing confirmed {#record} The PHP story site's [evidence on compromise](https://php.oct.2026.newsroom.sgit.ai/compromise/index.html) is a list of every statement, each with its captured source. Its line, at 09:43 UTC on 27 October, six days in: "No named organisation has said it was compromised through php2shell." Its 53 rows divide as the figure shows. Three kinds of evidence need keeping apart here: attempts, seen by honeypots and sensors; successful exploitation in a lab or honeypot set up for it, such as the 35 shells below; and a confirmed compromise of a production system, of which there is none so far. CISA's listing sits between them: CISA's own assessment, added to both CVE records, marks exploitation as "active", and names no victim. The eight named organisations are the "reports of individual breaches": GMO Internet Group found malicious programs on servers of its trading service and has not stated the cause; Czech Technical University stopped an attack; Valtec first blamed the PHP flaw, then said the attackers used a flaw in its own service; DMM halted services and would not say whether it was PHP; Germany's Interior Ministry said its site "was not hacked"; Anexia confirmed attempts; Ahold Delhaize denied any link; and the Square Enix report is second-hand and does not say how the access happened. 3 unchanged paragraphs, under Exploits built for specific environments {#specific} • **The CVSS vector itself** says attack complexity is high (AC:H) for both CVEs.CVEs, and CISA's assessment on the CVE record marks it "Automatable: no". 5 unchanged paragraphs, under The other 1,393 {#window} !shot jg-epss.webp | images/ | EPSS for the window: 1,361 of 1,383 scored CVEs below 0.01, 19 between 0.01 and 0.1, one between 0.1 and 0.5, and two above 0.5, the php2shell pair; and the daily EPSS of the two php2shell CVEs, about 0.05 to 0.12 from 22 to 24 October, then 0.9998above 0.999 on 25 and 26 October, against the Arista flaw, listed by CISA on 23 October, at about 0.01. | chart NVD counts 1,394 CVEs published between 13:48:34 UTC on 21 October and the same time on 25 October. The difference from the post's 1,448 is small, and hasnottworeconciled.likelyTwo possible causes: NVD's publication time is not always the CVE record's, and counts move as records are added, rejected or re-dated. Only comparing the two lists of IDs would settle it, and we do not have the post's list. Of the 1,394, NVD had fully analysed 3; 12 were rejected; most were waiting. They came mostly on weekdays: 494 and 497 on 22 and 23 October, 39 on the Sunday. None references Exploit-DB or Metasploit.Metasploit, which says what NVD's references hold, not what exists elsewhere. FIRST's EPSS, which models the probability of exploitation activity in the next 30 days, scored 1,383 of them on 26 October: 1,361 below 0.01, 19 between 0.01 and 0.1, one Brotli decoder flaw at 0.36, and the two php2shell CVEs at 0.9998.0.99997 and 0.99981. That is a forecast: a low score means the model does not expect exploitation, not that none was seen. VulnCheck, acting as a CVE authority, published 25 CVEs with ID years from 2017 to 2025, all on 22 October, which ismatches the count and the pattern Jeremiah describes:describes.old bugs, known to be exploited, givenBut an IDID'sonlyyearnow.does not show when it was assigned, and we have not read VulnCheck's KEV, so whether these are the 25 on it is not checked. 5 unchanged paragraphs, under What changed after the post {#changed}, Attention is not exploitation {#attention} !shot jg-attention.webp | images/ | News items about each flawflaw,in the samewith 53 to 55 feeds,feeds checked for each, not necessarily the same ones, from the PHP story site's Pulse agent on 24 October: php2shell 295, against 11 to 48 for twelve flaws already on CISA's catalogue in the same fortnight, from BeyondTrust and Ivanti to a 2015 ProFTPD flaw; php2shell had reached evidence levels 1 and 4, the others level 5, a KEV listing. | chart The PHP story site has an agent, Pulse, that tracks other vulnerabilities in the news beside php2shell, with two things kept apart: the evidence of exploitation, as eight levels from a public proof of concept to a named victim, and the attention, as counts of news items. On 24 October, inwithcomparable53feeds,to 55 feeds checked for each row, php2shell had 295 news items and had reached levels 1 and 4: a public proof of concept and attempts reported by a named party. Twelve flaws that CISA had listed as exploited in the same fortnight, or that were old flaws newly listed, had 11 to 48 news items each. Three of them were from 2015 and 2016. ThatRead it as a description of coverage in this collection, not a controlled measure: similar numbers of feeds are not the same feeds, and a named pair of flaws is counted against single CVEs. Even so, it is consistent with the post's closing argument in one chart:argument: what is exploited and what is talked about are different lists, and patching should follow the first. A run with the same feeds for every row is in our brief. 2 unchanged paragraphs, under Is AI driving it? {#ai} Jeremiah's opinion is that nothing in the record shows AI driving up how many vulnerabilities adversaries exploit, or how fast. The yearly numbers are consistent with it, with one caveat. From 1 January to 26 October, NVD published 89,531 CVEs this year, more than twice the 40,266 of the same period in 2025. CISA's catalogue added 274 entries, 30% more than the 210 of 2025. Whatever is driving the flood of disclosures, much of it plausibly AI-assisted discovery, the evidenced exploitation is growing much more slowly: the rate fell from 0.62% of publications in 2023 to 0.31% this year. The caveat is that 30% is still growth, that CISA's additions include older CVEs, and that neither number says what caused it. "How fast" needs a different measure, the time from publication to first exploitation, which we have asked for below. Jeremiah's opinion is that nothing in the record shows AI driving up how many vulnerabilities adversaries exploit, or how fast. The yearly numbers describe the background, but they cannot test that. From 1 January to 26 October, NVD published 89,531 CVEs this year, more than twice the 40,266 of the same period in 2025; CISA's catalogue added 274 entries, 30% more than the 210 of 2025, so additions as a share of publications fell from 0.62% in 2023 to 0.31%. The two numbers count different populations, since CISA's additions include CVEs published in earlier years; the catalogue records what CISA has evidence for, not attack volume or speed; and neither says anything about AI. Testing the claim needs matched cohorts: the CVEs published in a period, each followed for the same time, with the time to the first evidence of exploitation. We have asked for that below. Three questions need keeping apart. Can AI help build exploits? Yes, by the account of a team that found php2shell: Wiz's researchers wrote that frontier models enabled them "to develop and adapt working exploits across multiple applications in hours", and that "a single researcher completed in a week what previously would have taken a world-class team months of work". Are adversaries using it at scale? Jeremiah expects so: "I can't imagine any exploit writer or cyber adversary not using heavy AI tooling at this point". Has it produced more exploited flaws, faster, or more victims? That is the post's claim, and on this record the answer is not yet, with the caveat that four days and a catalogue are a small window on it. The first is a demonstrated research capability; the post is about the second and third. 2 unchanged paragraphs, under The 32 million {#exposure} The post's 32 million is Censys's count of services, not servers or organisations. Censys's dashboard was quoted at 36.7 million services on 22 October, which, ifIf both figures are the same measure, would mean the count iswentfallingdown. That could be patching, but also scan coverage, services going offline, fingerprints or the method changing; and, as sitesFortinetpatch.notes, "version-based estimates may include installations already patched through vendor backports". We could not read the dashboard ourselves, so thatthe trend is a question, not a finding. What the record does show is how far apart the published figures are: from 1.57 million unpatched hosts to "almost 70% of websites", because each counts a different thing, and a version string is not the same as an exploitable server. 7 unchanged paragraphs, under What we asked the PHP team for {#asked}, What this does not claim {#limits} • **The yearly ratio is a rate,** not the share of the same set of CVEs. • **The yearly ratio is a rate,** not the share of the same set of CVEs. It describes; it does not test AI's effect. • **EPSS is a forecast.** It is used here for what the model expects, not for what was observed. • **The attention chart is descriptive.** The rows do not share the same feeds. 1 unchanged paragraph ## Reviewed, and corrected {#review} The editor asked ChatGPT to review this article on 27 October, and pasted its review to me. Its verdict was "changes needed", with nine findings, and I agree with all nine. The record is on [the reviews page](https://newsroom.sgit.ai/reviews/index.html), with what was done about each. In short: 1. **EPSS was used as if it were an observation.** It is a 30-day forecast; the summary now says "expected", and the window section says what a low score does and does not mean. 2. **The yearly comparison was used about AI.** It now describes the background and says what a test would need. 3. **Wiz's account was missing.** It is now quoted, with three questions kept apart: research capability, adversaries' use, and victims. 4. **"0.9998" did not reproduce both scores.** Now 0.99997 and 0.99981, or "above 0.999". 5. **The absence of a confirmed victim had lost its bound** in the summaries. It now carries its date, and attempts, lab or honeypot success and production compromise are kept apart, with CISA's "Exploitation: active" on the CVE records. 6. **1,448 against 1,394 was "explained" when it was not.** Now "not reconciled". 7. **VulnCheck's 25 matched in count only.** Assignment dates and KEV membership are now marked as not checked. 8. **The attention chart was presented as controlled.** It is now labelled as descriptive. 9. **The fall from 36.7 to 32 million was read as patching.** Now with the other possible causes, and Fortinet's note on backports. One point in the review I could not confirm: that watchTowr reports exploitation through its honeypot network. The PHP story site's capture tool got a 403 from watchTowr's pages, and its fact-check desk marked that claim as resting on search summaries only. The core of Jeremiah's post is unchanged by any of this: no wave of confirmed breaches in four days, and patch what adversaries exploit. 1 unchanged paragraph, under Where this comes from {#sources} Jeremiah Grossman's LinkedIn post on php2shell, written four days after the disclosure, as shared with me on 27 October 2026. Public data read on 27 October 2026: [NVD's CVE API 2.0](https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-21T13:48:34.000&pubEndDate=2026-10-25T13:48:34.000&resultsPerPage=1) for the window and for yearly totals; [CISA's KEV catalogue](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), version 2026.10.26; [FIRST's EPSS API](https://api.first.org/data/v1/epss?cve=CVE-2026-109618,CVE-2026-109619,CVE-2026-114625&scope=time-series); [the CVE record for CVE-2026-109618](https://cveawg.mitre.org/api/cve/CVE-2026-109618); [Fortinet's post](https://www.fortinet.com/blog/industry-trends/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch) for Censys's 22 October figure.figure; [Wiz Research's post on PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce) of 21 October for its account of AI-assisted exploit development. The PHP story site's data at version 0.1.77: [compromise.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/compromise.json), [exploitation.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/exploitation.json), [claims.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/claims.json), [numbers.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/numbers.json) and [pulse.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/pulse.json), each pointing to its captured sources on [the references site](https://refs.php.oct.2026.newsroom.sgit.ai/sources/index.html). This article's own data: [the dataset](https://newsroom.sgit.ai/articles/data/the-evidence-behind-four-days__dataset.json). Related: [what the bitcoin bounty actually proves](https://newsroom.sgit.ai/articles/what-the-bitcoin-bounty-actually-proves.html), [PHP October 2026, update 4](https://newsroom.sgit.ai/articles/php-daily-2026-10-26.html), [the side stories of php2shell](https://newsroom.sgit.ai/articles/the-side-stories-of-php2shell.html), [patch for breakfast](https://newsroom.sgit.ai/articles/patch-for-breakfast.html). Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine. [all versions](../the-evidence-behind-four-days.md) · [v1.2.0 →](v1.2.0.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/the-evidence-behind-four-days/v1.1.0.html)*