Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Fact · impact · reported

As of 14:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.

Who says it: this site, from every captured source in the evidence vault (454 sources, head 94352a55fbaa), as of its latest capture at 14:40 UTC on 25 October · Sources: CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge Cyber Security News American Banker The Next Web Die Presse voix Haber.com La Razón

A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (09:35 GMT: the UK clocks went back at 01:00 UTC that day; an earlier version of this note said 10:35 BST, which was wrong) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. Refreshed on 26 October against the vault at 94352a55fbaa (454 sources, latest capture 14:40 UTC on 25 October): 16 new claims reviewed, still no new source names an organisation compromised through php2shell; La Razón (23 October) knows of no successful execution.

Fact-check

A4 Corroborated · State · verdict: holds

Refreshed to 16:05 UTC on 24 October, still time-bounded and 'reported', which fits. More independent negatives now carry it: Sophos withdrew its success claim (scanning and a few failed attempts, via Cyber Security News), American Banker finds no US bank or credit union reporting a compromise, The Next Web's officials in three countries have 'not seen one succeed'. The vendor half (Hadrian, Patchstack) is still through the press, A3. Every new quote checked verbatim. Run 6 adds Die Presse ('In Österreich sind bisher keine erfolgreichen Angriffe bekannt') and RainForest's honeypot (21 PHP2Shell POST requests, attempts), both checked in their captures. Run 7 (as of 09:35 UTC on 25 October): the Turkish Presidency's Cyber Security Directorate, via Haber, says e-Devlet is safe and its services continue, naming no compromise; teleSUR, captured at 09:35 UTC on 25 October, says no massive successful intrusion had been publicly confirmed and that most activity was scanning and failed attempts. Of the 20 captures made since 16:05 UTC on 24 October, none names a compromised organisation.

Capture checkedResultWhat it sayssha256 of the text read
cisa-kev-jsonpartialnothing that carries itef8fffede5c47200
huntress-php2shell-rapid-responsecarriesAs of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.a83d744768109a61
huntress-php2shell-rapid-responsecarriesNo indicators of compromise have been confirmed yet.a83d744768109a61
imperva-blog-php2shellpartialDuring this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.3da873bdb21219a6
aws-security-blog-madpotpartialTechnical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.94315ded6e1175f2
aws-security-blog-madpotpartialPHP2Shell is now being broadly exploited in the wild.94315ded6e1175f2
weirdgloop-blog-php2shellpartialit’s extremely likely that a bunch of old PHP fansites and forums have had their databases compromised6bd492a6220e8eea
certlv-php-preventivecarriestaču līdz šim nav ziņu par sekmīgiem uzbrukumiem.e37a6582c4e6c685
insurancebusiness-uk-councils-metcarriesNo successful break-ins had been confirmed as of Wednesday afternoon.89357150e0bc8363
reuters-factbox-websites-offlinecarriesThe temporary deactivation was purely preventive and no security incidents were known to have occurred, the spokesperson said.d562e28995b00a19
abc-au-politics-livecarriesIndustry and Innovation Minister Tim Ayres says there has been no breach of Australian government websitesa86331d9b7a21f78
the-verge-php2shell-websites-downcarriesto our knowledge, there has been no successful attempt at remote code execution1a9a20537e477cc8
pcmag-news-hackers-already-trying-to-exploit-serious-php-flawcarriesour telemetry shows only probing attacks, with no hard evidence of breaches yet82ef905cd2201bd4
recordedfuture-php2shellpartialPatchstack received reports of multiple active exploitation incidents from hosting partners by 07:34 UTC on October 2139efeb7b8ae8152f
insurance-business-au-asiapac-attacks-beginpartialHadrian says it is seeing PHP2Shell exploited at scale, mostly through PHP’s session upload progress path.8d88bddde485e36f
cybersecuritynews-critical-php2shell-exploit-codecarriesSophos said its customer data showed scanning and a small number of failed exploit attempts.bdf6e94a1a8a118b
americanbanker-news-banks-dodge-early-damage-from-php2scarriesno U.S. bank or credit union has publicly reported a compromise2b6aa63f39e73b0e
the-next-web-php2shell-no-confirmed-breachescarriesOfficials in Germany, the Netherlands and Japan say they have not seen one succeed.75d67773b979aa86
diepresse-41383717-die-php-sicherheitsluecke-ist-acarriesIn Österreich sind bisher keine erfolgreichen Angriffe bekannt.f6998ff009f030cc
voix-business-cards-rainforest-ip-activity-anpartialPHP2Shell関連のHTTP POST通信が21件観測され3e5e879383dd76ce
haber-teknoloji-siber-guvenlik-baskanligi-ndancarriese-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor2825ea23dc0ee99d
telesurenglish-php2shell-vulnerabilitiescarriesno massive successful intrusion had been publicly confirmed as of Thursday6efd752b24f54073

Open tickets: Contradiction-2, Evidence-1, Evidence-10, Evidence-12, Evidence-18, Evidence-3, Finding-26, Finding-85.

Graded in Run-7, resting on captures up to 2026-10-25 09:35 UTC. The scale is on the fact-check page.

This fact over time

  1. 2026-10-21CISA publishes Critical Vulnerabilities in PHP Require Immediate Patching
  2. 2026-10-21Huntress publishes Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress
  3. 2026-10-21Amazon publishes Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Securi
  4. 2026-10-21SecurityWeek publishes PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek
  5. 2026-10-21Recorded Future publishes PHP2Shell Exploitation: Two Critical PHP Flaws Explained
  6. 2026-10-21Imperva Threat Research publishes PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva
  7. 2026-10-21Weird Gloop publishes Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop
  8. 2026-10-21PCMag publishes Hackers Already Trying to Exploit Serious PHP Flaw | PCMag
  9. 2026-10-21 14:04 UTCCISA publishes CISA Known Exploited Vulnerabilities catalog (JSON feed)
  10. 2026-10-22SecurityWeek publishes PHP2Shell Exploitation Started Days Before Patches - SecurityWeek
  11. 2026-10-22Lupa.cz publishes ČVUT čelí kybernetickému útoku, údajně doplatilo na kritickou chybu v PHP - Lupa.cz
  12. 2026-10-22INTERNET Watch publishes バルテック、サイバー攻撃によりサービス停止、情報流出の可能性（記事訂正） - INTERNET Watch
  13. 2026-10-22 08:13 UTCSaved into the evidence vault: CISA
  14. 2026-10-22 09:40 UTCHaber.com publishes Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor |
  15. 2026-10-22 11:11 UTC産経ニュース publishes エンタメサイトDMMがサービス停止、外部システムの脆弱性への対応　「情報漏洩は無し」 - 産経ニュース
  16. 2026-10-22 11:17 UTCSaved into the evidence vault: Amazon, then 1 more capture
  17. 2026-10-22 11:18 UTCSaved into the evidence vault: Imperva Threat Research, then 1 more capture
  18. 2026-10-22 11:18 UTCSaved into the evidence vault: Weird Gloop, then 1 more capture
  19. 2026-10-22 11:23 UTCSaved into the evidence vault: SecurityWeek, then 1 more capture
  20. 2026-10-22 11:23 UTCSaved into the evidence vault: SecurityWeek, then 2 more captures
  21. 2026-10-22 11:28 UTCSaved into the evidence vault: Huntress
  22. 2026-10-22 11:30 UTCSaved into the evidence vault: Recorded Future, then 2 more captures
  23. 2026-10-22 13:03 UTCThe Next Web publishes Millions of PHP2Shell attempts so far, but officials see no break-in
  24. 2026-10-22 15:12 UTCThe Verge publishes Everything we know so far about the PHP2Shell vulnerability | The Verge
  25. 2026-10-22 19:14 UTCSaved into the evidence vault: INTERNET Watch
  26. 2026-10-22 19:15 UTCSaved into the evidence vault: Lupa.cz
  27. 2026-10-22 19:15 UTCSaved into the evidence vault: Yahoo! News Japan
  28. 2026-10-22 19:15 UTCSaved into the evidence vault: 産経ニュース
  29. 2026-10-22Enters this site as confirmed in v0.2.0 (reconstructed from git)
  30. 2026-10-22Status changes from confirmed to reported in v0.5.8
  31. 2026-10-23 01:20 UTCSaved into the evidence vault: The Verge
  32. 2026-10-23 07:58 UTCIT Social publishes PHP2Shell, la mise à jour ferme la faille, mais oblige à traquer les compromissions possibles - IT SOCIAL
  33. 2026-10-23 08:03 UTCSaved into the evidence vault: PCMag, then 1 more capture
  34. 2026-10-23 09:16 UTCvoix publishes RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIX
  35. 2026-10-23 13:00 UTCCyber Security News publishes Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware
  36. 2026-10-23 16:04 UTCSaved into the evidence vault: Paperjam
  37. 2026-10-23 16:04 UTCSaved into the evidence vault: IT Social
  38. 2026-10-23 16:04 UTCSaved into the evidence vault: Die Presse
  39. 2026-10-23 16:04 UTCSaved into the evidence vault: Haber.com
  40. 2026-10-23 16:18 UTCAmerican Banker publishes Banks dodge early damage from PHP2Shell flaws | American Banker
  41. 2026-10-23 17:15 UTCLa Razón publishes PHP descubre otro fallo de seguridad sin parche apenas dos días después de una actualización urgente: Cloudfla
  42. 2026-10-23 23:25 UTCSaved into the evidence vault: Cyber Security News
  43. 2026-10-24 08:37 UTCSaved into the evidence vault: American Banker
  44. 2026-10-24 08:37 UTCSaved into the evidence vault: The Next Web
  45. 2026-10-24 08:37 UTCSaved into the evidence vault: La Razón
  46. 2026-10-24 16:05 UTCSaved into the evidence vault: voix
  47. 2026-10-24Reworded or re-sourced in v0.12.1
  48. 2026-10-24Reworded or re-sourced in v0.14.30
  49. 2026-10-24Reworded or re-sourced in v0.15.19
  50. 2026-10-25Reworded or re-sourced in v0.19.2
  51. 2026-10-26Reworded or re-sourced in v0.22.25

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

CISA Known Exploited Vulnerabilities catalog (JSON feed)Critical Vulnerabilities in PHP Require Immediate PatchingRapid Response: php2shell, Leaked Critical PHP Vulnerabili…Amazon Threat Intelligence identifies PHP2Shell exploitati…PHP2Shell Patches Land as First Exploitation Attempts Hit …PHP2Shell Exploitation Started Days Before Patches - Secur…PHP2Shell Exploitation: Two Critical PHP Flaws ExplainedPHP2Shell: When PHP Runs Out of Memory at the Wrong Moment…Recent wiki downtime (PHP2Shell mitigation) | Weird GloopPHP2Shell: des milliers de sites exposés au Luxembourg | P…Hackers Already Trying to Exploit Serious PHP Flaw | PCMagPHP2Shell, la mise à jour ferme la faille, mais oblige à t…ČVUT čelí kybernetickému útoku, údajně doplatilo na kritic…GMO「悪用確認されず」から一転　FX口座ログイン情報、流出の可能性　不正操作報告も（J-CASTニュース） - Y…エンタメサイトDMMがサービス停止、外部システムの脆弱性への対応　「情報漏洩は無し」 - 産経ニュースバルテック、サイバー攻撃によりサービス停止、情報流出の可能性（記事訂正） - INTERNET WatchEverything we know so far about the PHP2Shell vulnerabilit…Critical PHP2Shell Exploit Code Goes Public as Hackers Att…Banks dodge early damage from PHP2Shell flaws | American B…Millions of PHP2Shell attempts so far, but officials see n…Die PHP-Sicherheitslücke ist alt, die KI hat sie wieder au…RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIXSiber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-D…PHP descubre otro fallo de seguridad sin parche apenas dos…fact no-confirmed-compromise

Where this fact appears

In the briefings for:

AlexCurious readerTaylorProject or programme managerJordanBoard member or executiveRobinCISOQuinnCFOMorganData protection officerRileyCommunications team

And on every claim.

Every version of this fact

v1 · site v0.2.0 · 22 October 2026 · confirmed
No named organisation has confirmed a compromise through php2shell
Who says it: this site, from every captured source
Status: confirmed
Topic: impact
Sources: cisa-kev-json, huntress-php2shell-rapid-response, imperva-blog-php2shell, aws-security-blog-madpot, weirdgloop-blog-php2shell
v2 · site v0.5.8 · 22 October 2026 · reported
NoAs of 20:50 UTC on 22 October, no named organisation has confirmedsaid ait compromisewas compromised through php2shellphp2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.
Who says it: this site, from every captured source in the evidence vault and the source watch, as of 20:50 UTC on 22 October
Status: confirmedreported
Topic: impact
Sources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, aws-security-blog-madpot, weirdgloop-blog-php2shell
v3 · site v0.12.1 · 24 October 2026 · reported
As of 20:5016:04 UTC on 2223 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, andin two security vendors,millions; Hadrian and Patchstack, report successfulreports exploitation withoutat scale and Patchstack received reports of incidents from hosting partners, neither naming anya victim.victim, and Patchstack's own telemetry showed only probing.
Who says it: this site, from every captured source in the evidence vault and(295 thesources, sourcehead watch,1845598d9a38), as of 20:50its latest capture at 16:04 UTC on 2223 October
Status: reported
Topic: impact
Sources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shellweirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-down
v4 · site v0.14.30 · 24 October 2026 · reported
As of 16:0408:37 UTC on 2324 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.
Who says it: this site, from every captured source in the evidence vault (295(328 sources, head 1845598d9a38),1f38e70921b2), as of its latest capture at 16:0408:37 UTC on 2324 October
Status: reported
Topic: impact
Sources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-downthe-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breaches
v5 · site v0.15.19 · 24 October 2026 · reported
As of 08:3716:05 UTC on 24 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.
Who says it: this site, from every captured source in the evidence vault (328(382 sources, head 1f38e70921b2),8c16a64a7cf6), as of its latest capture at 08:3716:05 UTC on 24 October
Status: reported
Topic: impact
Sources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breachesthe-next-web-php2shell-no-confirmed-breaches, diepresse-41383717-die-php-sicherheitsluecke-ist-a, voix-business-cards-rainforest-ip-activity-an
v6 · site v0.19.2 · 25 October 2026 · reported
As of 16:0509:35 UTC on 2425 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.
Who says it: this site, from every captured source in the evidence vault (382(418 sources, head 8c16a64a7cf6),87795d121200), as of its latest capture at 16:0509:35 UTC on 2425 October
Status: reported
Topic: impact
Sources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breaches, diepresse-41383717-die-php-sicherheitsluecke-ist-a, voix-business-cards-rainforest-ip-activity-anvoix-business-cards-rainforest-ip-activity-an, haber-teknoloji-siber-guvenlik-baskanligi-ndan
v7 · site v0.22.25 · 26 October 2026 · reported
As of 09:3514:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.
Who says it: this site, from every captured source in the evidence vault (418(454 sources, head 87795d121200),94352a55fbaa), as of its latest capture at 09:3514:40 UTC on 25 October
Status: reported
Topic: impact
Sources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breaches, diepresse-41383717-die-php-sicherheitsluecke-ist-a, voix-business-cards-rainforest-ip-activity-an, haber-teknoloji-siber-guvenlik-baskanligi-ndanhaber-teknoloji-siber-guvenlik-baskanligi-ndan, larazon-tecnologia-consumo-php-nuevo-fallo-segur