# Fact: As of 14:40 UTC on 25 October, no named organisation has said it was compromised

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

As of 14:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts. Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · impact · reported

# As of 14:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.

**Who says it:** this site, from every captured source in the evidence vault (454 sources, head 94352a55fbaa), as of its latest capture at 14:40 UTC on 25 October · **Sources:** [CISA](../../sources/cisa-kev-json/index.html) [CISA](../../sources/cisa-alert-php-20261021/index.html) [Huntress](../../sources/huntress-php2shell-rapid-response/index.html) [Amazon](../../sources/aws-security-blog-madpot/index.html) [SecurityWeek](../../sources/securityweek-first-attempts-sensors/index.html) [SecurityWeek](../../sources/securityweek-exploitation-days-before/index.html) [Recorded Future](../../sources/recordedfuture-php2shell/index.html) [Imperva Threat Research](../../sources/imperva-blog-php2shell/index.html) [Weird Gloop](../../sources/weirdgloop-blog-php2shell/index.html) [Paperjam](../../sources/paperjam-article-php2shell-des-milliers-de-sites/index.html) [PCMag](../../sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/index.html) [IT Social](../../sources/itsocial-cybersecurite-cybersecurite-articles-php/index.html) [Lupa.cz](../../sources/lupa-cvut-cyber-attack/index.html) [Yahoo! News Japan](../../sources/yahoo-jp-gmo-fx-login-leak/index.html) [産経ニュース](../../sources/sankei-dmm-service-halt/index.html) [INTERNET Watch](../../sources/impress-watch-valtec/index.html) [The Verge](../../sources/the-verge-php2shell-websites-down/index.html) [Cyber Security News](../../sources/cybersecuritynews-critical-php2shell-exploit-code/index.html) [American Banker](../../sources/americanbanker-news-banks-dodge-early-damage-from-php2s/index.html) [The Next Web](../../sources/the-next-web-php2shell-no-confirmed-breaches/index.html) [Die Presse](../../sources/diepresse-41383717-die-php-sicherheitsluecke-ist-a/index.html) [voix](../../sources/voix-business-cards-rainforest-ip-activity-an/index.html) [Haber.com](../../sources/haber-teknoloji-siber-guvenlik-baskanligi-ndan/index.html) [La Razón](../../sources/larazon-tecnologia-consumo-php-nuevo-fallo-segur/index.html)

A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (09:35 GMT: the UK clocks went back at 01:00 UTC that day; an earlier version of this note said 10:35 BST, which was wrong) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. Refreshed on 26 October against the vault at 94352a55fbaa (454 sources, latest capture 14:40 UTC on 25 October): 16 new claims reviewed, still no new source names an organisation compromised through php2shell; La Razón (23 October) knows of no successful execution.

## Fact-check

**A4** Corroborated●●●●○○ · State · verdict: **holds**

Refreshed to 16:05 UTC on 24 October, still time-bounded and 'reported', which fits. More independent negatives now carry it: Sophos withdrew its success claim (scanning and a few failed attempts, via Cyber Security News), American Banker finds no US bank or credit union reporting a compromise, The Next Web's officials in three countries have 'not seen one succeed'. The vendor half (Hadrian, Patchstack) is still through the press, A3. Every new quote checked verbatim. Run 6 adds Die Presse ('In Österreich sind bisher keine erfolgreichen Angriffe bekannt') and RainForest's honeypot (21 PHP2Shell POST requests, attempts), both checked in their captures. Run 7 (as of 09:35 UTC on 25 October): the Turkish Presidency's Cyber Security Directorate, via Haber, says e-Devlet is safe and its services continue, naming no compromise; teleSUR, captured at 09:35 UTC on 25 October, says no massive successful intrusion had been publicly confirmed and that most activity was scanning and failed attempts. Of the 20 captures made since 16:05 UTC on 24 October, none names a compromised organisation.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [cisa-kev-json](../../sources/cisa-kev-json/index.html) | partial | *nothing that carries it* | ef8fffede5c47200 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | carries | *As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.* | a83d744768109a61 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | carries | *No indicators of compromise have been confirmed yet.* | a83d744768109a61 |
| [imperva-blog-php2shell](../../sources/imperva-blog-php2shell/index.html) | partial | *During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.* | 3da873bdb21219a6 |
| [aws-security-blog-madpot](../../sources/aws-security-blog-madpot/index.html) | partial | *Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.* | 94315ded6e1175f2 |
| [aws-security-blog-madpot](../../sources/aws-security-blog-madpot/index.html) | partial | *PHP2Shell is now being broadly exploited in the wild.* | 94315ded6e1175f2 |
| [weirdgloop-blog-php2shell](../../sources/weirdgloop-blog-php2shell/index.html) | partial | *it’s extremely likely that a bunch of old PHP fansites and forums have had their databases compromised* | 6bd492a6220e8eea |
| [certlv-php-preventive](../../sources/certlv-php-preventive/index.html) | carries | *taču līdz šim nav ziņu par sekmīgiem uzbrukumiem.* | e37a6582c4e6c685 |
| [insurancebusiness-uk-councils-met](../../sources/insurancebusiness-uk-councils-met/index.html) | carries | *No successful break-ins had been confirmed as of Wednesday afternoon.* | 89357150e0bc8363 |
| [reuters-factbox-websites-offline](../../sources/reuters-factbox-websites-offline/index.html) | carries | *The temporary deactivation was purely preventive and no security incidents were known to have occurred, the spokesperson said.* | d562e28995b00a19 |
| [abc-au-politics-live](../../sources/abc-au-politics-live/index.html) | carries | *Industry and Innovation Minister Tim Ayres says there has been no breach of Australian government websites* | a86331d9b7a21f78 |
| [the-verge-php2shell-websites-down](../../sources/the-verge-php2shell-websites-down/index.html) | carries | *to our knowledge, there has been no successful attempt at remote code execution* | 1a9a20537e477cc8 |
| [pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw](../../sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/index.html) | carries | *our telemetry shows only probing attacks, with no hard evidence of breaches yet* | 82ef905cd2201bd4 |
| [recordedfuture-php2shell](../../sources/recordedfuture-php2shell/index.html) | partial | *Patchstack received reports of multiple active exploitation incidents from hosting partners by 07:34 UTC on October 21* | 39efeb7b8ae8152f |
| [insurance-business-au-asiapac-attacks-begin](../../sources/insurance-business-au-asiapac-attacks-begin/index.html) | partial | *Hadrian says it is seeing PHP2Shell exploited at scale, mostly through PHP’s session upload progress path.* | 8d88bddde485e36f |
| [cybersecuritynews-critical-php2shell-exploit-code](../../sources/cybersecuritynews-critical-php2shell-exploit-code/index.html) | carries | *Sophos said its customer data showed scanning and a small number of failed exploit attempts.* | bdf6e94a1a8a118b |
| [americanbanker-news-banks-dodge-early-damage-from-php2s](../../sources/americanbanker-news-banks-dodge-early-damage-from-php2s/index.html) | carries | *no U.S. bank or credit union has publicly reported a compromise* | 2b6aa63f39e73b0e |
| [the-next-web-php2shell-no-confirmed-breaches](../../sources/the-next-web-php2shell-no-confirmed-breaches/index.html) | carries | *Officials in Germany, the Netherlands and Japan say they have not seen one succeed.* | 75d67773b979aa86 |
| [diepresse-41383717-die-php-sicherheitsluecke-ist-a](../../sources/diepresse-41383717-die-php-sicherheitsluecke-ist-a/index.html) | carries | *In Österreich sind bisher keine erfolgreichen Angriffe bekannt.* | f6998ff009f030cc |
| [voix-business-cards-rainforest-ip-activity-an](../../sources/voix-business-cards-rainforest-ip-activity-an/index.html) | partial | *PHP2Shell関連のHTTP POST通信が21件観測され* | 3e5e879383dd76ce |
| [haber-teknoloji-siber-guvenlik-baskanligi-ndan](../../sources/haber-teknoloji-siber-guvenlik-baskanligi-ndan/index.html) | carries | *e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor* | 2825ea23dc0ee99d |
| [telesurenglish-php2shell-vulnerabilities](../../sources/telesurenglish-php2shell-vulnerabilities/index.html) | carries | *no massive successful intrusion had been publicly confirmed as of Thursday* | 6efd752b24f54073 |

Open tickets: [Contradiction-2](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Contradiction-2), [Evidence-1](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Evidence-1), [Evidence-10](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Evidence-10), [Evidence-12](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Evidence-12), [Evidence-18](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Evidence-18), [Evidence-3](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Evidence-3), [Finding-26](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Finding-26), [Finding-85](https://php.oct.2026.newsroom.sgit.ai/factcheck/#Finding-85).

Graded in Run-7, resting on captures up to 2026-10-25 09:35 UTC. The scale is on [the fact-check page](https://php.oct.2026.newsroom.sgit.ai/factcheck/#ladder).

## This fact over time
- 2026-10-21CISA publishes [Critical Vulnerabilities in PHP Require Immediate Patching](../../sources/cisa-alert-php-20261021/index.html)
- 2026-10-21Huntress publishes [Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress](../../sources/huntress-php2shell-rapid-response/index.html)
- 2026-10-21Amazon publishes [Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Securi](../../sources/aws-security-blog-madpot/index.html)
- 2026-10-21SecurityWeek publishes [PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek](../../sources/securityweek-first-attempts-sensors/index.html)
- 2026-10-21Recorded Future publishes [PHP2Shell Exploitation: Two Critical PHP Flaws Explained](../../sources/recordedfuture-php2shell/index.html)
- 2026-10-21Imperva Threat Research publishes [PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva](../../sources/imperva-blog-php2shell/index.html)
- 2026-10-21Weird Gloop publishes [Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop](../../sources/weirdgloop-blog-php2shell/index.html)
- 2026-10-21PCMag publishes [Hackers Already Trying to Exploit Serious PHP Flaw | PCMag](../../sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/index.html)
- 2026-10-21 14:04 UTCCISA publishes [CISA Known Exploited Vulnerabilities catalog (JSON feed)](../../sources/cisa-kev-json/index.html)
- 2026-10-22SecurityWeek publishes [PHP2Shell Exploitation Started Days Before Patches - SecurityWeek](../../sources/securityweek-exploitation-days-before/index.html)
- 2026-10-22Lupa.cz publishes [ČVUT čelí kybernetickému útoku, údajně doplatilo na kritickou chybu v PHP - Lupa.cz](../../sources/lupa-cvut-cyber-attack/index.html)
- 2026-10-22INTERNET Watch publishes [バルテック、サイバー攻撃によりサービス停止、情報流出の可能性（記事訂正） - INTERNET Watch](../../sources/impress-watch-valtec/index.html)
- 2026-10-22 08:13 UTCSaved into the evidence vault: CISA
- 2026-10-22 09:40 UTCHaber.com publishes [Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor |](../../sources/haber-teknoloji-siber-guvenlik-baskanligi-ndan/index.html)
- 2026-10-22 11:11 UTC産経ニュース publishes [エンタメサイトDMMがサービス停止、外部システムの脆弱性への対応 「情報漏洩は無し」 - 産経ニュース](../../sources/sankei-dmm-service-halt/index.html)
- 2026-10-22 11:17 UTCSaved into the evidence vault: Amazon, then 1 more capture
- 2026-10-22 11:18 UTCSaved into the evidence vault: Imperva Threat Research, then 1 more capture
- 2026-10-22 11:18 UTCSaved into the evidence vault: Weird Gloop, then 1 more capture
- 2026-10-22 11:23 UTCSaved into the evidence vault: SecurityWeek, then 1 more capture
- 2026-10-22 11:23 UTCSaved into the evidence vault: SecurityWeek, then 2 more captures
- 2026-10-22 11:28 UTCSaved into the evidence vault: Huntress
- 2026-10-22 11:30 UTCSaved into the evidence vault: Recorded Future, then 2 more captures
- 2026-10-22 13:03 UTCThe Next Web publishes [Millions of PHP2Shell attempts so far, but officials see no break-in](../../sources/the-next-web-php2shell-no-confirmed-breaches/index.html)
- 2026-10-22 15:12 UTCThe Verge publishes [Everything we know so far about the PHP2Shell vulnerability | The Verge](../../sources/the-verge-php2shell-websites-down/index.html)
- 2026-10-22 19:14 UTCSaved into the evidence vault: INTERNET Watch
- 2026-10-22 19:15 UTCSaved into the evidence vault: Lupa.cz
- 2026-10-22 19:15 UTCSaved into the evidence vault: Yahoo! News Japan
- 2026-10-22 19:15 UTCSaved into the evidence vault: 産経ニュース
- 2026-10-22Enters this site as confirmed in v0.2.0 (reconstructed from git)
- 2026-10-22Status changes from confirmed to reported in v0.5.8
- 2026-10-23 01:20 UTCSaved into the evidence vault: The Verge
- 2026-10-23 07:58 UTCIT Social publishes [PHP2Shell, la mise à jour ferme la faille, mais oblige à traquer les compromissions possibles - IT SOCIAL](../../sources/itsocial-cybersecurite-cybersecurite-articles-php/index.html)
- 2026-10-23 08:03 UTCSaved into the evidence vault: PCMag, then 1 more capture
- 2026-10-23 09:16 UTCvoix publishes [RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIX](../../sources/voix-business-cards-rainforest-ip-activity-an/index.html)
- 2026-10-23 13:00 UTCCyber Security News publishes [Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware](../../sources/cybersecuritynews-critical-php2shell-exploit-code/index.html)
- 2026-10-23 16:04 UTCSaved into the evidence vault: Paperjam
- 2026-10-23 16:04 UTCSaved into the evidence vault: IT Social
- 2026-10-23 16:04 UTCSaved into the evidence vault: Die Presse
- 2026-10-23 16:04 UTCSaved into the evidence vault: Haber.com
- 2026-10-23 16:18 UTCAmerican Banker publishes [Banks dodge early damage from PHP2Shell flaws | American Banker](../../sources/americanbanker-news-banks-dodge-early-damage-from-php2s/index.html)
- 2026-10-23 17:15 UTCLa Razón publishes [PHP descubre otro fallo de seguridad sin parche apenas dos días después de una actualización urgente: Cloudfla](../../sources/larazon-tecnologia-consumo-php-nuevo-fallo-segur/index.html)
- 2026-10-23 23:25 UTCSaved into the evidence vault: Cyber Security News
- 2026-10-24 08:37 UTCSaved into the evidence vault: American Banker
- 2026-10-24 08:37 UTCSaved into the evidence vault: The Next Web
- 2026-10-24 08:37 UTCSaved into the evidence vault: La Razón
- 2026-10-24 16:05 UTCSaved into the evidence vault: voix
- 2026-10-24Reworded or re-sourced in v0.12.1
- 2026-10-24Reworded or re-sourced in v0.14.30
- 2026-10-24Reworded or re-sourced in v0.15.19
- 2026-10-25Reworded or re-sourced in v0.19.2
- 2026-10-26Reworded or re-sourced in v0.22.25

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerTTaylorProject or programme managerJJordanBoard member or executiveRRobinCISOQQuinnCFOMMorganData protection officerRRileyCommunications team
And on [every claim](https://php.oct.2026.newsroom.sgit.ai/claims/#no-confirmed-compromise).

## Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · confirmed
```
No named organisation has confirmed a compromise through php2shell
Who says it: this site, from every captured source
Status: confirmed
Topic: impact
Sources: cisa-kev-json, huntress-php2shell-rapid-response, imperva-blog-php2shell, aws-security-blog-madpot, weirdgloop-blog-php2shell
```
v2 · site v0.5.8 · 22 October 2026 · reportedNoAs of 20:50 UTC on 22 October, no named organisation has confirmedsaid ait compromisewas compromised through php2shellphp2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.Who says it: this site, from every captured source in the evidence vault and the source watch, as of 20:50 UTC on 22 OctoberStatus: confirmedreportedTopic: impactSources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, aws-security-blog-madpot, weirdgloop-blog-php2shellv3 · site v0.12.1 · 24 October 2026 · reportedAs of 20:5016:04 UTC on 2223 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, andin two security vendors,millions; Hadrian and Patchstack, report successfulreports exploitation withoutat scale and Patchstack received reports of incidents from hosting partners, neither naming anya victim.victim, and Patchstack's own telemetry showed only probing.Who says it: this site, from every captured source in the evidence vault and(295 thesources, sourcehead watch,1845598d9a38), as of 20:50its latest capture at 16:04 UTC on 2223 OctoberStatus: reportedTopic: impactSources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shellweirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-downv4 · site v0.14.30 · 24 October 2026 · reportedAs of 16:0408:37 UTC on 2324 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.Who says it: this site, from every captured source in the evidence vault (295(328 sources, head 1845598d9a38),1f38e70921b2), as of its latest capture at 16:0408:37 UTC on 2324 OctoberStatus: reportedTopic: impactSources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-downthe-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breachesv5 · site v0.15.19 · 24 October 2026 · reportedAs of 08:3716:05 UTC on 24 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.Who says it: this site, from every captured source in the evidence vault (328(382 sources, head 1f38e70921b2),8c16a64a7cf6), as of its latest capture at 08:3716:05 UTC on 24 OctoberStatus: reportedTopic: impactSources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breachesthe-next-web-php2shell-no-confirmed-breaches, diepresse-41383717-die-php-sicherheitsluecke-ist-a, voix-business-cards-rainforest-ip-activity-anv6 · site v0.19.2 · 25 October 2026 · reportedAs of 16:0509:35 UTC on 2425 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.Who says it: this site, from every captured source in the evidence vault (382(418 sources, head 8c16a64a7cf6),87795d121200), as of its latest capture at 16:0509:35 UTC on 2425 OctoberStatus: reportedTopic: impactSources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breaches, diepresse-41383717-die-php-sicherheitsluecke-ist-a, voix-business-cards-rainforest-ip-activity-anvoix-business-cards-rainforest-ip-activity-an, haber-teknoloji-siber-guvenlik-baskanligi-ndanv7 · site v0.22.25 · 26 October 2026 · reportedAs of 09:3514:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.Who says it: this site, from every captured source in the evidence vault (418(454 sources, head 87795d121200),94352a55fbaa), as of its latest capture at 09:3514:40 UTC on 25 OctoberStatus: reportedTopic: impactSources: cisa-kev-json, cisa-alert-php-20261021, huntress-php2shell-rapid-response, aws-security-blog-madpot, securityweek-first-attempts-sensors, securityweek-exploitation-days-before, recordedfuture-php2shell, imperva-blog-php2shell, weirdgloop-blog-php2shell, paperjam-article-php2shell-des-milliers-de-sites, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw, itsocial-cybersecurite-cybersecurite-articles-php, lupa-cvut-cyber-attack, yahoo-jp-gmo-fx-login-leak, sankei-dmm-service-halt, impress-watch-valtec, the-verge-php2shell-websites-down, cybersecuritynews-critical-php2shell-exploit-code, americanbanker-news-banks-dodge-early-damage-from-php2s, the-next-web-php2shell-no-confirmed-breaches, diepresse-41383717-die-php-sicherheitsluecke-ist-a, voix-business-cards-rainforest-ip-activity-an, haber-teknoloji-siber-guvenlik-baskanligi-ndanhaber-teknoloji-siber-guvenlik-baskanligi-ndan, larazon-tecnologia-consumo-php-nuevo-fallo-segur


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/facts/no-confirmed-compromise/index.html