# The evidence behind four days: what changed in v1.3.0, sgit.ai > The changes to the article "The evidence behind four days" in v1.3.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [The evidence behind four days](../../the-evidence-behind-four-days.md) / [Versions](../the-evidence-behind-four-days.md) / v1.3.0 # The evidence behind four days: what changed in v1.3.0 From v1.2.0 (2026-10-27, `4cb930e25`) to v1.3.0 (2026-10-27, `db67c5ce1`), paragraph by paragraph. 0 paragraphs added, 0 removed, 7 changed in place, 60 unchanged. About 0 words added and 320 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [← v1.2.0](v1.2.0.md) · [all versions](../the-evidence-behind-four-days.md) 2 unchanged paragraphs !shot jg-post.webp | images/ | Jeremiah Grossman's LinkedIn post on LinkedIn,php2shell, four days after php2shellit went public, as shared with me on 27 October 2026: "php2shell went public four days ago, at 13:48:34 UTC on October 21, 2026", the claims in the same four days, and the conclusion, "patch what adversaries exploit".2026. | medium | aside 15 unchanged paragraphs, under In short {#in-short}, The post {#post}, Claim by claim {#claims} !shot jg-window.webp | images/ | FourThedaysCVEs of CVEs, from 13:48:34 UTC on 21 October to the samefour-daytime on 25 October 2026,window, re-counted on 27 October:October1,3942026,publishedagainstaccordingJeremiahtoGrossman'sNVD (the post says 1,448), 1,383 scored by EPSS, 22 with an EPSS of 0.01 or more, 25 old bugs given IDs by VulnCheck on 22 October, none with an Exploit-DB or Metasploit reference, one on CISA's KEV catalogue at the time of the post, and three now, the Arista flaw and both php2shell CVEs.figures. Log scale. | chart 2 unchanged paragraphs, under No wave, and nothing confirmed {#record} !shot jg-record.webp | images/ | The compromise record on the PHP story site at 09:43 UTC on 27 October, by kind: 22 rows of no success known, 13 of exploitation attempts, 8 named organisations, 5 vendor statements of exploitation with no victim named, 4 official signals and 1 anonymous allegation;kind, and what the eight named organisations said: a break-in with no cause stated, an attack stopped, a retraction, a precaution, "was not hacked", attempts only, a link denied, and an unverified second-hand report.said. | chart 10 unchanged paragraphs, under Exploits built for specific environments {#specific}, The other 1,392 {#window} !shot jg-epss.webp | images/ | EPSS scores for the window: 1,361 of 1,383 scored CVEs below 0.01, 19 between 0.01 and 0.1, one between 0.1 and 0.5, and two above 0.5,in the php2shell pair;window, and the daily EPSSscores of the two php2shell CVEs, about 0.05 to 0.12 from 22 to 24 October, then above 0.999 on 25 and 26 October, against the Arista flaw, listed by CISA on 23 October, at about 0.01.CVEs. | chart 7 unchanged paragraphs, under What changed after the post {#changed}, Attention is not exploitation {#attention} !shot jg-attention.webp | images/ | News items about each flaw, with 53 to 55 feeds checked for each, not necessarily the same ones, from the PHP story site's Pulse agent on 24 October: php2shell 295, against 11 to 48 forand twelve flaws already on CISA's cataloguecatalogue,infrom the samePHPfortnight,site'sfromPulseBeyondTrustagent,and24Ivanti to a 2015 ProFTPD flaw; php2shell had reached evidence levels 1 and 4, the others level 5, a KEV listing.October. | chart 2 unchanged paragraphs, under Is AI driving it? {#ai} !shot jg-ratio.webp | images/ | CVEs published by NVD and entries added to CISA's KEV catalogue, 1 January to 26 October of each year:year,25,3262023andto156 in 2023, 32,569 and 148 in 2024, 40,266 and 210 in 2025, 89,531 and 274 in 2026; the additions as a share of publications, 0.62%, 0.45%, 0.52% and 0.31%.2026. | chart 3 unchanged paragraphs, under The 32 million {#exposure} !shot jg-exposure.webp | images/ | What each published exposure figure counts:for PHP counts, from Censys 1.57 million unpatched hosts on 21 October, VulnCheck about 2.6 million hosts exposing PHP, VirusTotal 5.1 million IPs running PHP,to Unit 42 22.6 million instances potentially vulnerable, Censys's dashboard 32 million services in the post and 36.7 million on 22 October as quoted by Fortinet, and "almost 70% of websites", a share, not a count.websites". Log scale. | chart 19 unchanged paragraphs, under What we asked the PHP team for {#asked}, What this does not claim {#limits}, Reviewed, and corrected {#review}… [← v1.2.0](v1.2.0.md) · [all versions](../the-evidence-behind-four-days.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/the-evidence-behind-four-days/v1.3.0.html)*