[
 {
  "when": "2026-10-17",
  "who": "Amazon (CJ Moses, AWS Security Blog)",
  "what": "One exploit attempt against a MadPot honeypot from a commercial anonymisation network, four days before disclosure; 'it remains unclear how the actor acquired exploit information prior to disclosure'.",
  "kind": "attempt",
  "status": "reported (primary party)",
  "sources": [
   "aws-security-blog-madpot"
  ]
 },
 {
  "when": "2026-10-17",
  "who": "Amazon (CJ Moses, via The Hacker News)",
  "what": "One exploit attempt against a MadPot honeypot from an IP on a commercial anonymisation network, geolocated to Australia, four days before disclosure. 'It remains unclear how the actor acquired exploit information prior to disclosure.'",
  "kind": "attempt",
  "status": "reported",
  "sources": [
   "thehackernews-php2shell-4days"
  ]
 },
 {
  "when": "2026-10-20 to 21",
  "who": "Cloudflare",
  "what": "'We observed attack traffic targeting our customers' after the leak, and attackers 'mutating the attack payload to try to bypass our protections'. No volumes given.",
  "kind": "attack traffic",
  "status": "reported (primary party)",
  "sources": [
   "cloudflare-blog-php2shell-waf"
  ]
 },
 {
  "when": "2026-10-21T02:00Z",
  "who": "Amazon (via The Hacker News)",
  "what": "Proof-of-concept attempts begin, then six hours of attempts from anonymised infrastructure; 'multiple threat actors'.",
  "kind": "attempts",
  "status": "reported",
  "sources": [
   "thehackernews-php2shell-4days"
  ]
 },
 {
  "when": "2026-10-21T08:36Z",
  "who": "ELLIO (via The Hacker News and a comment under the PHP Foundation post)",
  "what": "First sensor hit, about 55 minutes after Chainguard's images.",
  "kind": "sensor hit",
  "status": "reported",
  "sources": [
   "thehackernews-php2shell-4days",
   "phpfoundation-blog-security-release-leak"
  ]
 },
 {
  "when": "2026-10-21T14:34Z",
  "who": "CISA (ADP, SSVC on the CVE record)",
  "what": "Exploitation: none. Automatable: no. Technical impact: total.",
  "kind": "assessment",
  "status": "confirmed (primary)",
  "sources": [
   "cve-cve-2026-109618",
   "cve-cve-2026-109619"
  ]
 },
 {
  "when": "2026-10-21",
  "who": "CISA (alert)",
  "what": "'CISA has not observed exploitation of these vulnerabilities as of the time of publication.' Neither CVE is in the Known Exploited Vulnerabilities catalog (version 2026.10.21, fetched 2026-10-22T08:15Z).",
  "kind": "negative finding",
  "status": "confirmed (primary)",
  "sources": [
   "cisa-alert-php-20261021",
   "cisa-kev-json",
   "cisa-kev-catalog"
  ]
 },
 {
  "when": "2026-10-21",
  "who": "CCCS (Canada)",
  "what": "'a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.'",
  "kind": "assessment",
  "status": "confirmed (primary)",
  "sources": [
   "cccs-al26-026"
  ]
 },
 {
  "when": "2026-10-21T20:00Z",
  "who": "CERT.LV (Latvia)",
  "what": "Automated exploitation attempts seen in Latvia; no reports of successful attacks.",
  "kind": "attempts",
  "status": "confirmed (primary)",
  "sources": [
   "certlv-php-preventive"
  ]
 },
 {
  "when": "2026-10-21T20:15Z",
  "who": "NCSC New Zealand",
  "what": "'The NCSC is aware of reports of active exploitation.' Whose reports is not said.",
  "kind": "claim of exploitation",
  "status": "reported, sole agency",
  "sources": [
   "ncsc-nz-alert-php"
  ]
 },
 {
  "when": "2026-10-21",
  "who": "PHP Foundation",
  "what": "'did not identify any functional exploits at the time of release/public disclosure.'",
  "kind": "negative finding",
  "status": "reported (primary party)",
  "sources": [
   "php-foundation-blog-security-release"
  ]
 },
 {
  "when": "2026-10-22",
  "who": "ASD's ACSC (Australia)",
  "what": "'not aware of successful active exploitation within Australia'.",
  "kind": "negative finding",
  "status": "confirmed (primary)",
  "sources": [
   "acsc-alert-php"
  ]
 },
 {
  "when": "2026-10-22T07:00Z",
  "who": "Ryan Austin, Calif, on BBC Radio 4",
  "what": "No evidence of exploitation yet: 'Not at the moment'.",
  "kind": "statement",
  "status": "reported",
  "sources": [
   "bbc-live-ckgel5xp2xv9t"
  ]
 },
 {
  "when": "2026-10-22",
  "who": "Alan Woodward, on the BBC",
  "what": "Amazon and Cloudflare saw sites being probed for the flaw.",
  "kind": "second-hand",
  "status": "reported; Cloudflare's own post confirms attack traffic, Amazon's own post not found",
  "sources": [
   "bbc-live-ckgel5xp2xv9t",
   "cloudflare-blog-php2shell-waf",
   "thehackernews-php2shell-4days"
  ]
 },
 {
  "when": "2026-10-22",
  "who": "unnamed researchers, on the BBC",
  "what": "Criminals are using AI to 'vibe code' an attack method.",
  "kind": "claim",
  "status": "unverified",
  "sources": [
   "bbc-live-ckgel5xp2xv9t"
  ]
 },
 {
  "when": "2026-10-21",
  "who": "Imperva",
  "what": "No traffic matching the exploit patterns during pre-disclosure monitoring of customer traffic.",
  "kind": "negative finding",
  "status": "reported (primary party)",
  "sources": [
   "imperva-blog-php2shell"
  ]
 },
 {
  "when": "2026-10-21T20:30Z",
  "who": "Huntress",
  "what": "No exploitation observed on partner systems; no public exploit code known.",
  "kind": "negative finding",
  "status": "reported (primary party)",
  "sources": [
   "huntress-php2shell-rapid-response"
  ]
 },
 {
  "when": "2026-10-22T01:25Z",
  "who": "Matthew Prince, Cloudflare",
  "what": "Thousands of attempts in the ten hours before announcement; tens of thousands within 45 minutes after; hundreds of thousands within two hours; millions now.",
  "kind": "attempts",
  "status": "reported (primary party)",
  "sources": [
   "x-eastdakota-php2shell-stats"
  ]
 },
 {
  "when": "2026-10-22",
  "who": "Dan Lorenc, Chainguard, via The Register",
  "what": "Chainguard's honeypots trapped IPs from China and Russia; several unnamed vendors reported exploits in the wild.",
  "kind": "claim",
  "status": "reported, second-hand",
  "sources": [
   "theregister-php-blames-chainguard"
  ]
 },
 {
  "when": "2026-10-21",
  "who": "watchTowr",
  "what": "Active exploitation attempts; the flaws listed as exploited in the wild.",
  "kind": "claim",
  "status": "unverified: the site blocks capture",
  "sources": [
   "watchtowr-php2shell"
  ]
 }
]