OrganisationSE

Detectify

Swedish external attack-surface security company.

Detectify researcher Joviane Jardim estimated in October 2026 that roughly half of PHP websites used unsupported versions that would receive no PHP2Shell fix.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Was Detectify's unsupported-PHP estimate borne out as exploitation spread?

Timeline for Detectify

#15 21 Oct

Estimated half of PHP sites run unfixable versions

Cybersecurity: Threats and Defences: PHP2Shell: no fix for PHP 8.1 and older

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

Detectify is a Stockholm-based application-security company founded in 2013. Its platform discovers internet-facing assets and tests websites and application programming interfaces for exploitable flaws. Its work focuses on the external attack surface that an unauthorised user can reach.

The company combines research from its own staff with findings from more than 400 vetted ethical hackers. That network broadens the range of techniques represented in its security tests. The model helps Detectify turn newly reported techniques into checks that customers can run against public systems. The company also comments publicly on widespread software exposure, but estimates from its researchers remain expert judgements rather than measured censuses.

Common Questions

What does Detectify do?

Detectify maps external attack surfaces and tests websites and APIs for exploitable security flaws.Source: Detectify

Where is Detectify based?

Detectify was founded in 2013 and is based in Stockholm, Sweden.Source: Detectify

What did Detectify say about PHP2Shell exposure?

Detectify's Joviane Jardim estimated that roughly half of PHP websites ran version 8.1 or older, which lacked regular upstream fixes.Source: The Record

How does Detectify find web vulnerabilities?

It combines continuous asset discovery and payload-based testing with research from staff and a vetted ethical-hacker community.Source: Detectify

Source Material

Hundreds of websites taken offline as concern grows over two PHP vulnerabilities Detectify Newsroom Application security built and trusted by hackers

How the World Sees Them

FirstVDS

There are no traces of the attack on the affected virtual servers

ESET

first documented case of Yggdrasil being abused in this way by a state-aligned threat actor

Cyber Security Agency of Singapore

Attackers are exploiting

Canadian Centre for Cyber Security

open-source reporting indicating that the vulnerability is being exploited in the wild

Ahold Delhaize (Frans Muller)

was caused by the malicious actions of others

ENISA

the manufacturer is not required to comply with the vulnerability handling obligations

CERT-FR (ANSSI)

probablement toujours en cours

ASOS

impersonating a trusted contact

Check Point

actively exploited on Spark Firewalls as of September 12, 2026

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.