Is PHP2Shell Actually Unusual?

CVSS v3.1 builds a score from a fixed vector. A vulnerability reachable over the network, needing no privileges and no user interaction, with full impact on confidentiality, integrity and availability, arrives at 9.8 by arithmetic. There is no room in the formula for how hard the exploit actually is to build.

That is why the chart looks the way it does. Of the 112 PHP core CVEs scoring 9.0 or higher, 98 land on exactly 9.8 and twelve on 9.1, leaving two records alone at 9.6 and 9.4. The distribution has almost no shape, because the scale has almost no resolution at the top.

Put the other way round: 87.5 per cent of every PHP flaw the scale calls critical sits on one value, and the whole rest of the band from 9.0 to 9.7 holds fourteen records between them. A distribution that concentrated is not measuring variation in the flaws. It is measuring the ceiling of the instrument.

So when coverage says PHP2Shell scored 9.8 and calls that remarkable, the statement is accurate and carries no information. Ninety-six other PHP records earned the same number, including several nobody remembers.

PHP, acting as its own CVE numbering authority, scored these flaws on CVSS v4.0 and got 9.2. The vector is the interesting part: it rates attack complexity as high and marks attack requirements as present. In plain terms, the scale is saying this is not a point-and-click exploit.

That matters because it is the only severity judgement here that comes from the people who maintain the code, and because it cuts against the week’s loudest claim. Several vendors said frontier AI models collapsed the difficulty of exploiting this flaw. PHP’s own scoring, published the same day, says the attack remains complex. Sansec added on 22 October that public proof-of-concept code does not work against a default PHP installation.

Among the fifteen PHP CVEs scored on v4.0 so far, 9.2 ranks second, behind CVE-2026-6722 at 9.5. On that scale PHP2Shell genuinely stands out. On the scale everyone quoted, it does not.

Severity scores describe what a flaw could do. CISA’s Known Exploited Vulnerabilities catalogue describes what attackers are actually doing, which is a different and more useful question.

Three PHP core CVEs appear on it: CVE-2012-1823, CVE-2019-11043 and CVE-2024-4577. PHP2Shell was absent as of catalogue version 2026.10.21, rechecked later the same week. That may change, and the catalogue is updated continuously, but it is the position at the time of writing.

Taken together the three measures disagree in a useful way. The old scale says PHP2Shell is indistinguishable from 96 other records. The new scale says it is near the top but hard to exploit. The exploitation list says it has not yet joined the three PHP flaws attackers reliably use. All three are true at once, and a headline that quotes only the first is quoting the least informative one.

The chart carries every PHP core CVE that ever reached 9.0, and in addition every 2026 record whatever it scored. That second group is the grey scatter on the left, and it is there so one year can be seen whole rather than only through its worst entries.

2026 has fifteen PHP core records so far. Eight score 9.0 or above and seven do not, which puts more than half of a single year inside the band the scale cannot separate. Seven of those eight carry 9.8, the eighth 9.1. Below the line the piling up continues on a smaller scale: four of the seven share an identical 7.5, and the rest run 5.3, 5.5 and 6.1.

PHP2Shell is two of the eight. Set against the other six, nothing in the v3.1 number marks it out at all, because five of those six also carry 9.8. What actually separates it from the rest of the year is not its severity score. It is how much of the installed base runs a branch that never received a patched release.