{
 "about": "The evidence behind one statement, row by row. Authored by researcher@php.newsroom on 22 October 2026 at the editor's request. Each row says who said what, when, in their words, and where the capture is: 'sources' are evidence-vault slugs the gate checks; 'watch' is a dated snapshot folder in the source-watch vault (7r83qic5), held there until the evidence curator promotes it. This file maps evidence; it makes no assessment of risk.",
 "statement": "No named organisation has said it was compromised through php2shell.",
 "as_of": "2026-10-26T14:42Z",
 "claim": "no-confirmed-compromise",
 "status": "reported",
 "status_note": "A time-bounded absence, not a confirmed fact. It is true only as of the last check, and one statement from one organisation would end it.",
 "searched": [
  {
   "what": "The evidence vault",
   "count": 543,
   "unit": "sources",
   "detail": "head 2fc7e432584b; the site is built from all of it"
  },
  {
   "what": "The source watch",
   "count": 913,
   "unit": "pages watched",
   "detail": "597 publishers, head 20afaa62129d (the old watch, oq9gflln; the watch continues in pack vault 7r83qic5)"
  },
  {
   "what": "Read in their own language",
   "count": 339,
   "unit": "non-English pages",
   "detail": "28 languages; 568 new items with verbatim quotes; as counted on 22 October"
  },
  {
   "what": "Discovery feeds",
   "count": 3444,
   "unit": "news items scanned",
   "detail": "Google News and Bing News, 85 editions, from 1,621 publishers; as counted on 22 October"
  },
  {
   "what": "Named sites probed",
   "count": 295,
   "unit": "sites",
   "detail": "every site somebody named as taken offline, probed every 30 minutes; as counted on 22 October"
  }
 ],
 "kinds": [
  {
   "id": "attempts",
   "name": "Attempts seen",
   "can": "that someone tried",
   "cannot": "that anyone succeeded"
  },
  {
   "id": "vendor-exploitation",
   "name": "Exploitation reported, no victim named",
   "can": "that a party says exploitation happened",
   "cannot": "who was hit, or whether it was confirmed by the victim"
  },
  {
   "id": "no-success-known",
   "name": "No successful exploitation known",
   "can": "what a party with visibility has not seen",
   "cannot": "that nothing happened outside its view"
  },
  {
   "id": "named-organisation",
   "name": "Named organisations",
   "can": "what the organisation itself said",
   "cannot": "a cause the organisation did not state"
  },
  {
   "id": "allegation",
   "name": "Unnamed allegations",
   "can": "that a claim was made",
   "cannot": "who, or that php2shell was the way in"
  },
  {
   "id": "official-signal",
   "name": "Official exploited signals",
   "can": "what the official lists record",
   "cannot": "anything they have not yet recorded"
  }
 ],
 "rows": [
  {
   "kind": "attempts",
   "when": "2026-10-17",
   "who": "Amazon (AWS Threat Intelligence)",
   "says": "An exploit attempt against a MadPot honeypot four days before disclosure; \"it's unclear if any of these attempts would have succeeded in real-world systems.\"",
   "sources": [
    "aws-security-blog-madpot"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-21T08:36Z",
   "who": "ELLIO (via The Hacker News)",
   "says": "First sensor hit, about 55 minutes after Chainguard's images.",
   "sources": [
    "thehackernews-php2shell-4days"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-21",
   "who": "Cloudflare",
   "says": "\"We observed attack traffic targeting our customers\" and attackers \"mutating the attack payload to try to bypass our protections\".",
   "sources": [
    "cloudflare-blog-php2shell-waf"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-21",
   "who": "watchTowr (via SecurityWeek)",
   "says": "First in-the-wild attempts hit its sensors; \"Whilst nobody has been successful to date, we don't expect that will last long.\"",
   "sources": [
    "securityweek-first-attempts-sensors"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-21T20:00Z",
   "who": "CERT.LV (Latvia)",
   "says": "Automated exploitation attempts seen in Latvia; no successful attacks reported.",
   "sources": [
    "certlv-php-preventive"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-22",
   "who": "Cloudflare's CEO, Matthew Prince",
   "says": "\"thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.\"",
   "sources": [
    "x-eastdakota-php2shell-stats"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-22",
   "who": "VulnCheck (via SecurityWeek)",
   "says": "\"At least one Chinese IP address unsuccessfully attempted to exploit PHP2Shell to deploy a webshell.\"",
   "sources": [
    "securityweek-exploitation-days-before"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-22",
   "who": "QNAP PSIRT",
   "says": "Observed scanning activity and attack attempts using the PHP2Shell flaws.",
   "sources": [
    "qnap-statement-php2shell"
   ],
   "watch": "raw/tw/security-vendor/qnap/statement-php2shell/20261022T191720Z/"
  },
  {
   "kind": "attempts",
   "when": "2026-10-22",
   "who": "A Tencent News analyst, with ThreatBook sensors (China)",
   "says": "Captured scanning requests with the User-Agent php2shell-scan/1.0; no evidence of successful code execution.",
   "sources": [],
   "watch": "translations/hk/news/news-qq/rain-a-20261021a0eq4p00.json"
  },
  {
   "kind": "vendor-exploitation",
   "when": "2026-10-21",
   "who": "Hadrian (via SecurityWeek)",
   "says": "\"We are now seeing php2shell exploited in the wild at scale.\" No victim named.",
   "sources": [
    "securityweek-first-attempts-sensors"
   ]
  },
  {
   "kind": "vendor-exploitation",
   "when": "2026-10-21T07:34Z",
   "who": "Patchstack (via Recorded Future)",
   "says": "\"Received reports of multiple active exploitation incidents from hosting partners.\" No victim named.",
   "sources": [
    "recordedfuture-php2shell"
   ]
  },
  {
   "kind": "vendor-exploitation",
   "when": "2026-10-21",
   "who": "Amazon (AWS Threat Intelligence)",
   "says": "\"PHP2Shell is now being broadly exploited in the wild.\" Against its sensors; no victim named.",
   "sources": [
    "aws-security-blog-madpot"
   ]
  },
  {
   "kind": "vendor-exploitation",
   "when": "2026-10-21T20:15Z",
   "who": "NCSC New Zealand",
   "says": "\"The NCSC is aware of reports of active exploitation.\" Whose reports is not said.",
   "sources": [
    "ncsc-nz-alert-php"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-21",
   "who": "CISA",
   "says": "\"CISA has not observed exploitation of these vulnerabilities as of the time of publication.\"",
   "sources": [
    "cisa-alert-php-20261021"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-21T20:30Z",
   "who": "Huntress",
   "says": "\"As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.\"",
   "sources": [
    "huntress-php2shell-rapid-response"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-21",
   "who": "The PHP Foundation",
   "says": "The security team \"did not identify any functional exploits at the time of release/public disclosure.\"",
   "sources": [
    "php-foundation-blog-security-release"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "The PHP Foundation's executive director (to The Verge and WIRED)",
   "says": "\"To our knowledge, there has been no successful attempt at remote code execution.\"",
   "sources": [
    "the-verge-php2shell-websites-down"
   ],
   "watch": "raw/us/tech-press/the-verge/php2shell-websites-down/"
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "Germany's BSI, the Dutch NCSC, Japan's Chief Cabinet Secretary (via The Next Web, Politico)",
   "says": "Germany has seen attacks but no successful use; the Netherlands has no indication of active misuse; Japan says no attacks exploiting the flaws have been confirmed.",
   "sources": [
    "the-next-web-php2shell-no-confirmed-breaches"
   ],
   "watch": "raw/nl/tech-press/the-next-web/php2shell-no-confirmed-breaches/"
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "Switzerland's BACS",
   "says": "Knows of no attacks in Switzerland attributable to the flaws (via SRF, read in German).",
   "sources": [],
   "watch": "translations/ch/news/srf/news-schweiz-cyber-schwachstelle-bei-php-erste-schadensbilan.json"
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "Belgium's CCB",
   "says": "Has recorded no attacks on Belgian websites (via RTVE, read in Spanish; and Clickx, in French).",
   "sources": [
    "rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili"
   ],
   "watch": "translations/es/news/rtve/noticias-20261022-fallos-criticos-php2shell-vulnerabilidades.json"
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "Austria's Interior Ministry",
   "says": "No concrete reports of successful attacks so far (via Salzburg24, read in German).",
   "sources": [
    "salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic"
   ],
   "watch": "translations/at/news/salzburg24/news-oesterreich-massive-sache-folgen-der-php-sicherheitslue.json"
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "Cloudflare (to USA Today)",
   "says": "Its observations \"describe attack attempts; they do not, by themselves, establish successful compromises.\"",
   "sources": [
    "usa-today-php2shell-live"
   ],
   "watch": "raw/us/news/usa-today/php2shell-live/"
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-22",
   "who": "GMO Internet Group (Japan)",
   "says": "Malicious programs were found on 20 October on servers of its FX trading VPS service; 26,739 servers possibly affected; account logins may have been taken; fraudulent operations reported. The cause is not stated.",
   "reading": "A confirmed break-in, cause not stated",
   "sources": [
    "yahoo-jp-gmo-fx-login-leak"
   ],
   "watch": "raw/jp/news/yahoo-news-jp/gmo-fx-login-leak/20261022T191523Z/"
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-22",
   "who": "Czech Technical University (ČVUT)",
   "says": "Facing \"a cyber attack on its IT infrastructure… part of worldwide attempts to hit PHP sites\"; \"the active attack was stopped\"; some systems taken offline.",
   "reading": "An attack reported and stopped; success not stated",
   "sources": [
    "lupa-cvut-cyber-attack"
   ],
   "watch": "raw/cz/tech-press/lupa/cvut-cyber-attack/20261022T191510Z/"
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-22",
   "who": "Valtec (Japan)",
   "says": "First blamed a \"cyberattack targeting the PHP vulnerability\", then corrected: the attackers used a flaw in its own service.",
   "reading": "Attribution to php2shell retracted",
   "sources": [
    "impress-watch-valtec"
   ],
   "watch": "raw/jp/tech-press/impress-watch/valtec-php-attack/20261022T191433Z/"
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-21",
   "who": "DMM (Japan)",
   "says": "Halted services to respond to \"a vulnerability in external software\"; no data leaked; would not say whether it was PHP.",
   "reading": "Precaution; cause not stated",
   "sources": [
    "sankei-dmm-service-halt"
   ],
   "watch": "raw/jp/news/sankei/dmm-service-halt/20261022T191536Z/"
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-22",
   "who": "Germany's Interior Ministry (to Bild)",
   "says": "Its site \"was not hacked\", only taken down \"for a repair\".",
   "reading": "Precaution, stated not compromised",
   "sources": [],
   "watch": "translations/de/news/bild/leben-wissen-digital-php-sicherheitsluecken-behoerden-nehmen.json"
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-22",
   "who": "Anexia (Austria)",
   "says": "Confirmed attack attempts on websites it operates; bank data not affected (via ORF).",
   "reading": "Attempts, stated not compromised",
   "sources": [
    "orf-stories-3445806"
   ],
   "watch": "translations/at/news/orf/stories-3445806.json"
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-22",
   "who": "Ahold Delhaize",
   "says": "No reason to believe its recent cyberattack is linked to the PHP flaws (via Accountant.nl).",
   "reading": "A separate incident, link denied",
   "sources": [],
   "watch": "translations/nl/news/accountant/nieuws-2026-10-europese-cybersecuritydienst-waarschuwt-voor.json"
  },
  {
   "kind": "allegation",
   "when": "2026-10-21",
   "who": "An anonymous startup owner (via Fortune)",
   "says": "Alleges hackers stole source code, exposed cookie data and leaked legal documents. Unnamed; not attributed to php2shell; not verified.",
   "sources": [
    "fortune-ai-tools-php-vulnerability"
   ],
   "watch": "raw/us/news/fortune/ai-tools-php-vulnerability/"
  },
  {
   "kind": "official-signal",
   "when": "2026-10-23T08:03Z",
   "who": "CISA Known Exploited Vulnerabilities catalog",
   "says": "Version 2026.10.21, 1,754 entries; neither CVE listed. The source watch re-read it at 08:03 UTC on 23 October, unchanged since its capture at 18:16 UTC on 22 October.",
   "sources": [
    "cisa-kev-json"
   ],
   "watch": "series/kev-listed/"
  },
  {
   "kind": "official-signal",
   "when": "2026-10-21T14:34Z",
   "who": "CISA's assessment on the CVE records (SSVC)",
   "says": "Exploitation: none. Automatable: no. Technical impact: total.",
   "sources": [
    "cve-cve-2026-109618",
    "cve-cve-2026-109619"
   ]
  },
  {
   "kind": "official-signal",
   "when": "2026-10-22T17:51Z",
   "who": "EPSS (FIRST)",
   "says": "0.053 and 0.058: the modelled probability of exploitation activity in the next 30 days.",
   "sources": [],
   "watch": "series/epss/"
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-21",
   "who": "Australia's ACSC (via Information Age)",
   "says": "In its critical alert, ASD's ACSC said it was \"not aware of active exploitation related to these vulnerabilities\".",
   "sources": [
    "ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-21",
   "who": "Patchstack (via PCMag)",
   "says": "\"Shortly after PHP's update, our telemetry shows only probing attacks, with no hard evidence of breaches yet.\" Recorded Future reports the same company receiving reports of exploitation incidents from hosting partners that morning; the two accounts are not reconciled.",
   "sources": [
    "pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw",
    "recordedfuture-php2shell"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-23",
   "who": "Luxembourg (via Paperjam)",
   "says": "No Luxembourg financial institution, public service or operator had announced it had actually been infiltrated through php2shell; the state announced no confirmed compromise, and the authorities asked operators to search back for traces of compromise and to keep the evidence.",
   "reading": "An absence of announcements, not a finding",
   "sources": [
    "paperjam-article-php2shell-des-milliers-de-sites"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-22",
   "who": "Sophos (via Cyber Security News)",
   "says": "An exploitation attempt tried to deploy Potassium, a likely Mirai botnet variant; security controls blocked it and the malware was not delivered.",
   "sources": [
    "cybersecuritynews-critical-php2shell-exploit-code"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22T21:21Z",
   "who": "Sophos (via Cyber Security News)",
   "says": "In a correction issued at 21:21 UTC on 22 October, Sophos said its customer data showed scanning and a small number of failed exploit attempts, and no evidence of a successful compromise; an earlier success claim was withdrawn.",
   "reading": "A vendor's success claim, made and withdrawn",
   "sources": [
    "cybersecuritynews-critical-php2shell-exploit-code"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-23",
   "who": "US banks and credit unions (via American Banker)",
   "says": "\"Attackers have fired millions of attempts at the PHP2Shell flaws, but no U.S. bank or credit union has publicly reported a compromise.\"",
   "reading": "An absence of public reports, not a finding",
   "sources": [
    "americanbanker-news-banks-dodge-early-damage-from-php2s"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "Crypto exchanges and payment providers (via BTC-ECHO)",
   "says": "No evidence so far that large crypto trading platforms or payment providers were compromised through php2shell.",
   "reading": "An absence of evidence, reported by a trade outlet",
   "sources": [
    "btc-echo-news-krypto-boersen-akut-bedroht-kritisc"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-23T10:03Z",
   "who": "Austria (via Die Presse)",
   "says": "As of 12:03 Vienna time (10:03 UTC) on 23 October 2026 no successful attacks via PHP2Shell were known in Austria.",
   "reading": "A point-in-time absence, reported by a newspaper",
   "sources": [
    "diepresse-41383717-die-php-sicherheitsluecke-ist-a"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-23",
   "who": "RainForest (via VOIX, Japan)",
   "says": "RainForest's honeypot network matched 3 of 11 public IP addresses from VulnCheck and Amazon threat information and recorded 21 PHP2Shell-related HTTP POST requests, from 14 different source IPs.",
   "reading": "A small honeypot sample: attempts, not intrusions",
   "sources": [
    "voix-business-cards-rainforest-ip-activity-an"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "Turkey's Presidency Cybersecurity Directorate (via Haber and three other Turkish outlets)",
   "says": "Said the e-Devlet Kapisi government portal, with more than 69 million users, had no security problem from PHP2Shell and that services continued uninterrupted.",
   "reading": "An organisation's statement about its own portal, as four news sites relay it; the Directorate's own post is not among the captures (searched the text of every capture for its name and 'e-Devlet')",
   "sources": [
    "haber-teknoloji-siber-guvenlik-baskanligi-ndan",
    "haber7-teknoloji-haber-3670492-php-guvenlik-aci",
    "donanimhaber-php-acigindan-etkilenen-ulkeler-ve-sitel",
    "indigodergisi-2026-10-php-guvenlik-acigi-php2shell"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-23",
   "who": "La Razón (Spain), on the investigations it cites",
   "says": "As of 23 October 2026 attempts against PHP2Shell were real and in the millions, but no successful code execution had been established in the investigations cited.",
   "reading": "A point-in-time absence, reported by a newspaper",
   "sources": [
    "larazon-tecnologia-consumo-php-nuevo-fallo-segur"
   ]
  },
  {
   "kind": "attempts",
   "when": "2026-10-26",
   "who": "Amazon Threat Intelligence (via ZDNET Japan, translating ZDNET)",
   "says": "Threat actors in PHP2Shell attack chains are trying to deploy Mirai-family botnets.",
   "reading": "Attempts, no named actor; reported on 26 October. Amazon's own post in the vault does not contain the word 'Mirai'",
   "sources": [
    "japan-zdnet-article-35253966"
   ]
  },
  {
   "kind": "no-success-known",
   "when": "2026-10-22",
   "who": "ScaleCommerce (Germany, a hosting provider, in its own press release)",
   "says": "Its log review found only isolated attack attempts on customer shops and no indications of a broad compromise.",
   "reading": "One provider's own account of its own customers",
   "sources": [
    "pressebox-pressemitteilung-scalecommerce-gmbh-krit"
   ]
  },
  {
   "kind": "named-organisation",
   "when": "2026-10-22",
   "who": "Square Enix (Japan), as TechGaming.it reports it, citing Kotaku",
   "says": "Square Enix 'confirmed episodes of unauthorised access to its systems' in the same week as PHP2Shell.",
   "reading": "Unverified, second-hand: the outlet does not say the access came through the PHP flaws, and Kotaku's text and Square Enix's own words are not captured. Bitpage, the other page that names Square Enix, says it closed new Final Fantasy XIV logins and took patch servers offline, with the cause 'not an attack' but the PHP flaws",
   "sources": [
    "techgaming-internet-sotto-attacco-php2shell-vulnera",
    "bitpage-php2shell-php-sicherheitsluecke-webseite"
   ]
  }
 ],
 "layers": [
  {
   "label": "Attempts against sensors, honeypots and edges",
   "value": "millions",
   "note": "Cloudflare's CEO; Amazon, watchTowr, CERT.LV, QNAP and others report attempts"
  },
  {
   "label": "Exploitation reported by vendors",
   "value": "3 parties",
   "note": "Hadrian, Patchstack, Amazon; no victim named by any"
  },
  {
   "label": "Named organisations saying they were attacked",
   "value": "1",
   "note": "ČVUT: attack stopped, success not stated"
  },
  {
   "label": "Named organisations saying php2shell was the way in",
   "value": "0",
   "note": "GMO reports a break-in without a cause; Valtec retracted its attribution"
  }
 ],
 "would_change_it": [
  "A named organisation saying it was compromised through php2shell, in its own notice, filing or statement.",
  "GMO, ČVUT or DMM stating a cause.",
  "A KEV listing for either CVE, with CISA's evidence.",
  "A regulator's breach notice (for example under GDPR or Australia's Notifiable Data Breaches scheme) naming the flaw.",
  "A security vendor naming a victim, with the victim's consent."
 ],
 "contradictions": [
  "is-it-exploited",
  "compromise-gmo-fx-vps",
  "compromise-cvut",
  "compromise-valtec",
  "compromise-dmm",
  "exploitation-germany-netherlands"
 ]
}