非 php.net · 非 NVD · 非 CISA

PHP 漏洞追踪

关于 PHP 安全漏洞的非官方简报

English简体中文日本語DeutschFrançaisNederlandsEspañol

安全警报

PHP2Shell：请升级 PHP。这是唯一完整的修复。

CVE-2026-109618 与 CVE-2026-109619 是 PHP 本体中的严重漏洞，未经身份验证即可远程执行代码。PHP 项目已于 2026 年 10 月 21 日为仍受支持的 8.2 至 8.5 分支发布修复。升级后必须重启 PHP。防火墙不能替代升级。

修复步骤

宕机追踪

PHP2Shell 宕机追踪：下线的网站及恢复时间

2026 年 10 月 21–22 日，据报道与 PHP2Shell 有关而下线的政府门户、大学、平台和热门网站。出现在列表中不代表网站被入侵：多数是出于预防或维护而主动下线。

最近更新

53追踪网站
9仍未恢复
44已恢复
4h 47m宕机时长中位数

按国家

  • 荷兰24
  • 全球10
  • 日本5
  • 芬兰3
  • 英国3
  • 德国2
  • 法国2
  • 比利时2
  • 奥地利1
  • 克罗地亚1

按类型

  • 网站24
  • 政府17
  • 平台9
  • 大学3

🕒 所有时间均为 UTC（24 小时制）。宕机时长为首次报告下线到首次报告恢复之间的时间。

我们的备注
LIFULL HOME'S日本平台——下线X 帖子 Real-estate portal reported offline on X in connection with PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a CDN error, which may reflect regional blocking. [来源]2026-10-22 08:35 · 403
at home日本平台——下线X 帖子 Real-estate portal reported in maintenance/offline on X, with posts linking it to PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a bot-check page, so it could not confirm the site's state. [来源]2026-10-22 08:41 · 405
SUUMO日本平台——下线X 帖子 Real-estate portal reported offline on X in connection with PHP2Shell. The site shows its own system-maintenance page; the operator has not stated a cause. [来源]2026-10-22 08:35 · 503
D66 (Dutch political party)荷兰网站2h 47m已恢复PHPocalypse Tracker Political party site showed a temporary unavailability page for under three hours. [来源]2026-10-22 08:12 · 200
Nespresso Croatia online store克罗地亚网站15m已恢复PHPocalypse Tracker Online store offline briefly for stated security maintenance. [来源]2026-10-22 08:12 · 200
Overheid.nl (Dutch government portal)荷兰政府12h 20m已恢复PHPocalypse Tracker Government portal offline for maintenance overnight; back the next morning (UTC). [来源]2026-10-22 08:12 · 200
French prefecture websites法国政府——下线PHPocalypse Tracker Several prefecture sites show a shared maintenance page; others not checked. [来源]2026-10-22 08:12 · 200
Belgian Foreign Affairs比利时政府7h 06m已恢复PHPocalypse Tracker Ministry site returned HTTP 503 in four languages; back after midnight (UTC). [来源]2026-10-22 08:12 · 302
City of Edinburgh Council英国政府5h 06m已恢复PHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about five hours. [来源]2026-10-22 08:12 · 200
Oxford City Council英国政府4h 06m已恢复PHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about four hours. [来源]2026-10-22 08:12 · 200
Bristol City Council英国政府1h 21m已恢复PHPocalypse Tracker Council site showed an unavailability notice for under two hours. [来源]2026-10-22 08:12 · 200
Port of Rotterdam荷兰网站2h 36m已恢复PHPocalypse Tracker Port authority site temporarily unreachable for under three hours. [来源]2026-10-22 08:12 · 301
KNVB (Dutch football association)荷兰网站1h 41m已恢复PHPocalypse Tracker Football association sites temporarily unreachable for under two hours. [来源]2026-10-22 08:12 · 200
PVV (Dutch political party)荷兰网站8h 36m已恢复PHPocalypse Tracker Political party site offline as a stated precaution until the next morning (UTC). [来源]2026-10-22 08:12 · 200
GroenLinks-PvdA (Dutch political party)荷兰网站1h 36m已恢复PHPocalypse Tracker Political party site offline for under two hours. [来源]2026-10-22 08:12 · 403
Acuity Scheduling全球平台3h 02m已恢复PHPocalypse Tracker Booking platform and login returned HTTP 503 for about three hours, then returned. [来源]2026-10-22 08:12 · 200
DriveThruRPG全球网站7h 11m已恢复PHPocalypse Tracker Digital game store offline for maintenance for about seven hours. [来源]2026-10-22 08:12 · 403
Sakura Internet (domains and SSL)日本平台5h 46m已恢复PHPocalypse Tracker Domain and SSL control panel under emergency maintenance; notices do not name PHP; hosting and email unaffected. [来源]2026-10-22 08:12 · 200
EFRAG (European Financial Reporting Advisory Group)比利时政府3h 08m已恢复PHPocalypse Tracker Site stopped connecting for about three hours, then returned. [来源]2026-10-22 08:12 · 301
DeviantArt全球网站4h 32m已恢复PHPocalypse Tracker Art community suspended while applying a software update, then returned. [来源]2026-10-22 08:12 · 200
DigiD荷兰政府5h 35m已恢复PHPocalypse Tracker Government login service offline for about six hours, then returned. [来源]2026-10-22 08:12 · 200
MijnOverheid荷兰政府3h 35m已恢复PHPocalypse Tracker Government citizen portal offline for under four hours, then returned. [来源]2026-10-22 08:12 · 200
RTL Nieuws荷兰网站3h 32m已恢复PHPocalypse Tracker News site offline for under four hours, then returned. [来源]2026-10-22 08:12 · 302
Follow the Money荷兰网站2h 50m已恢复PHPocalypse Tracker Investigative news site offline for about three hours, then returned. [来源]2026-10-22 08:12 · 200
Platform Investico荷兰网站1h 44m已恢复PHPocalypse Tracker Journalism platform offline for under two hours, then returned. [来源]2026-10-22 08:12 · 200
Nederlandse Orde van Advocaten (Dutch bar association)荷兰政府1h 44m已恢复PHPocalypse Tracker Bar association site offline for under two hours, then returned. [来源]2026-10-22 08:12 · 200
FC Twente荷兰网站5h 50m已恢复PHPocalypse Tracker Football club site offline for about six hours, then returned. [来源]2026-10-22 08:12 · 301
Fortuna Sittard荷兰网站4h 05m已恢复PHPocalypse Tracker Football club site offline for about four hours, then returned. [来源]2026-10-22 08:12 · 301
Politievakbond ACP (police union)荷兰网站16h 34m已恢复PHPocalypse Tracker Police union site offline until the next morning (UTC). [来源]2026-10-22 08:12 · 301
KNMP (Dutch pharmacists' association)荷兰网站2h 20m已恢复PHPocalypse Tracker Pharmacists' association site offline for about two hours, then returned. [来源]2026-10-22 08:12 · 200
Scouting Nederland荷兰网站1h 44m已恢复PHPocalypse Tracker Scouting association site offline for under two hours, then returned. [来源]2026-10-22 08:12 · 200
Kustwacht (Netherlands Coastguard)荷兰政府4h 35m已恢复PHPocalypse Tracker Coastguard site showed an unavailability page with emergency numbers; back later that day. [来源]2026-10-22 08:12 · 301
Security.NL荷兰网站6h 05m已恢复PHPocalypse Tracker Security news site switched to maintenance mode, citing PHP2Shell as the reason. [来源]2026-10-22 08:12 · 200
easybill德国平台2h 20m已恢复PHPocalypse Tracker Invoicing web app offline (HTTP 503) as a stated precaution; vendor said data was safe. [来源]2026-10-22 08:12 · 302
Choice of Games全球网站2h 20m已恢复PHPocalypse Tracker Game publisher site showed a temporary 503 page, then returned. [来源]2026-10-22 08:12 · 200
CNIL (French data protection authority)法国政府——下线PHPocalypse Tracker Data protection authority site returns a maintenance page (HTTP 503) with no stated reason. [来源]2026-10-22 08:12 · 503
Tweede Kamer (Dutch parliament)荷兰政府8h 02m已恢复PHPocalypse Tracker Parliament website showed a maintenance notice; back the same evening. [来源]2026-10-22 08:12 · 200
NCSC (Dutch national cyber security centre)荷兰政府7h 02m已恢复PHPocalypse Tracker National cyber security centre site taken offline; back the same evening. [来源]2026-10-22 08:12 · 200
Autoriteit Persoonsgegevens (Dutch data protection authority)荷兰政府——下线PHPocalypse Tracker Data protection authority site offline; no recovery recorded by the source. [来源]2026-10-22 08:12 · timeout
Valtori (Finnish central government web services)芬兰政府18h 07m已恢复PHPocalypse Tracker Shared government web services offline; recovery recorded the next morning (UTC). [来源]2026-10-22 08:12 · timeout
National Land Survey of Finland芬兰政府——下线PHPocalypse Tracker Land survey agency site shown as down; no recovery recorded by the source. [来源]2026-10-22 08:12 · 503
University of Vienna奥地利大学4h 17m已恢复PHPocalypse Tracker University website offline for a few hours, then returned. [来源]2026-10-22 08:12 · 200
University of Freiburg德国大学21h 01m已恢复PHPocalypse Tracker Home page carried a computing-centre notice about the PHP flaws; the tracker saw the regular home page again on 22 Oct at 08:10 UTC. [来源]2026-10-22 08:24 · 301
Haaga-Helia University of Applied Sciences芬兰大学——下线PHPocalypse Tracker University website offline; no recovery recorded by the source. [来源]2026-10-22 08:12 · 301
Tweakers荷兰网站4h 59m已恢复PHPocalypse Tracker Tech news site offline for about five hours, then returned. [来源]2026-10-22 08:12 · 403
Fur Affinity全球网站11h 47m已恢复PHPocalypse Tracker Art community offline until late evening (UTC). [来源]2026-10-22 08:12 · 403
Pinboard全球网站12h 02m已恢复PHPocalypse Tracker Bookmarking service offline until late evening (UTC). [来源]2026-10-22 08:12 · 200
Miraheze (all wikis)全球平台10h 02m已恢复PHPocalypse Tracker Wiki farm offline across all hosted wikis, then returned. [来源]2026-10-22 08:12 · 301
4chan全球网站11h 47m已恢复PHPocalypse Tracker Imageboard offline until late evening (UTC). [来源]2026-10-22 08:12 · 302
NotuBiz council portals荷兰平台——下线PHPocalypse Tracker Council meeting portals run by NotuBiz went offline; reported in connection with PHP2Shell. [来源]2026-10-22 08:12 · 301
explain xkcd全球网站9h 59m已恢复PHPocalypse Tracker Community wiki went offline for several hours, then returned. [来源]2026-10-22 08:12 · 301
Star Citizen Wiki全球网站4h 59m已恢复PHPocalypse Tracker Fan wiki taken offline for about five hours, then returned. [来源]2026-10-22 08:12 · 200
Codmon日本平台9h 41m已恢复PHPocalypse Tracker Childcare communication service stopped under emergency maintenance; restored by the evening (UTC). [来源]2026-10-22 08:12 · 200

「我们的检查」是我们在所示时间对每个网站发出的一次 HTTP 状态请求，不是扫描，也不检测漏洞；403 或超时可能只是网站屏蔽了自动请求。

上报已下线的网站

知道有网站因 PHP2Shell 而下线，或者已经恢复？请告诉我们。每条提交都会经人工审核后才出现在表格中，并标注为「用户报告（已审核）」。

常见问题

这些网站是被 PHP2Shell 攻破的吗？

就来源而言并非如此。多数网站在升级 PHP 期间挂出维护或预防性通知。我们只记录它们与 PHP2Shell 有关而下线，不认定为被入侵。

数据从哪里来？

初始数据来自公有领域的 PHPocalypse Tracker，每行都链接原始来源（新闻、帖子或网站自身公告），并附上我们自己的 HTTP 状态检查时间。

时间是哪个时区？

全部为 UTC。例如 17:05 UTC 相当于吉隆坡时间次日 01:05。

多久更新一次？

我们的情报更新白天约每 10 分钟检查一次新报告，核实后更新表格。