Unit 42 has withdrawn the only named PHP2Shell victim, and the week's biggest numbers are not counting the same thing

We have written about PHP2Shell three times this month: when the flaws were disclosed, when the Foundation counted the leaks, and when we asked why the flaws existed at all. This is the fourth and the least dramatic, which is why it is worth writing.

What Unit 42 said, and what it says now

Unit 42's original account was specific: "the attackers targeted a government entity in Europe", and within 2 hours of initial exploitation had reached password hashes and MFA secrets. It was the only named, dated, concrete victim story attached to these CVEs, and it travelled accordingly.

The firm's revised wording describes "an attack against a European government agency executed in the context of a vulnerable PHP application", and adds: "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs."

The intrusion is not retracted. The link between that intrusion and these two vulnerabilities is. Those are different claims and the second one is the one everybody repeated.

The numbers count different things

Three figures have carried the week, and they measure three unrelated quantities.

37 million is Bitsight's count of internet-facing systems running PHP or related software. It is an exposure figure. It says nothing about attacks and would be roughly the same number if nothing had happened.

The request totals — Fastly recorded around 250,000 requests from PHP2Shell-named tooling across about 3,200 addresses by midday on 22 October — count requests, and the counters are explicit that defensive scanners are inside the total. Security teams checking their own estates generate traffic that looks identical to the thing being measured.

Cloudflare's "millions of exploitation attempts" counts attempts. An attempt is not a success, and no count of successes exists.

None of the three is wrong. Stacked in a headline they describe a catastrophe nobody has evidenced.

The North Korea claim is separate

CYFIRMA has reported a suspected North Korea-linked campaign using PHP2Shell to probe PHP infrastructure from 21 compromised nodes against 216 targeted hosts, attributing it "with moderate confidence" to a Korean-speaking operator in the Lazarus ecosystem. Its chief executive describes the scanning as "deliberately low-volume and paced".

That is a different firm, a different dataset and a different claim from the one Unit 42 revised, and the revision does not touch it. Moderate confidence, resting on shared infrastructure and target selection, is also exactly as much as it says.

Why this keeps happening

A critical flaw in something as widely deployed as PHP creates demand for a victim, and the first firm with telemetry supplies one. Unit 42's original note went out within days of the 21 October release, into a vacuum where no confirmed compromise existed and every outlet wanted one. The incentive runs toward publishing early.

What makes this week unusual is not that a firm got ahead of its evidence. It is that the firm said so, in public, in its own words, while the story was still running. That is the behaviour to reward, and it is also why the original claim should not be quoted again without the revision attached to it.

The fix is not scepticism about vendors, who in this case corrected themselves. It is reading the unit on every number before repeating it.

What to do

• Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 if you have not. Nothing here softens that.
• Check logs back to 17 October, which remains the earliest probe anyone has published, rather than to the disclosure date.
• When you brief anyone on this, say which number you are quoting and what it counts. Exposure, requests and attempts are not interchangeable.
• Do not treat the absence of confirmed victims as the absence of risk. It is the absence of evidence, which is a weaker and more honest statement.

What is not established

• Whether anyone has been successfully compromised through either CVE. No confirmed case is public.
• What caused Unit 42 to revise its assessment. The firm has not said beyond being unable to confirm the link.
• How the European intrusion did begin, if not through these flaws.
• What proportion of the recorded requests are defensive.
• Whether CYFIRMA's attribution holds. Moderate confidence is the firm's own framing.
• Whether the exploitation attempts have reached code execution anywhere.

Neither Unit 42's nor CYFIRMA's own publication was retrieved. The quotations above are as the reporting carries them.