{
 "note": "Two ledgers. The first is systems taken offline, which is a decision an operator makes and can confirm; the second is systems compromised, which only evidence can establish. The columns say whether the entry comes from the organisation itself or from the press, because the difference is the whole point.",
 "offline": [
  {
   "who": "NCSC.nl (the Dutch national cyber security centre's own site)",
   "country": "NL",
   "what": "NCSC.nl taken offline 'uit voorzorg' (as a precaution), with no active misuse seen yet, says the government; DigiD and MijnOverheid also offline, says the Dutch press",
   "when": "2026-10-21",
   "said_by": "the Dutch government (NCSC.nl); TPO.NL (DigiD, MijnOverheid)",
   "status": "reported",
   "sources": [
    "rijksoverheid-ncsc-php-news",
    "tpo-nl-digid-offline"
   ]
  },
  {
   "who": "Finland's government public web services (Valtori)",
   "country": "FI",
   "what": "Incoming public traffic restricted from 12:45 local (09:45 UTC); described as preventive, not a response to a breach; internal networks unaffected",
   "when": "2026-10-21T09:45Z",
   "said_by": "Yle and Helsinki Times quoting Valtori and the National Cyber Security Centre Finland",
   "status": "reported",
   "sources": [
    "yle-finland-government-sites-shut",
    "helsinkitimes-finland-shutdown"
   ]
  },
  {
   "who": "Latvia: several state digital resources, lsm.lv, 112.lv",
   "country": "LV",
   "what": "Access restricted from abroad; state website platform patched by 20:00 UTC; lsm.lv and 112.lv restored; restrictions on others possibly until 26 October",
   "when": "2026-10-21T15:25Z",
   "said_by": "CERT.LV itself",
   "status": "confirmed",
   "sources": [
    "certlv-php-preventive"
   ]
  },
  {
   "who": "Wikimedia Foundation: 'a number of other systems'",
   "country": "US",
   "what": "'taken down a number of other systems as a precautionary measure until they can be safely patched'; parts of Wikipedia affected",
   "when": "2026-10-21",
   "said_by": "the Foundation, as quoted by CNN and The Cyber Express; the BBC",
   "status": "reported",
   "sources": [
    "cnn-php2shell-websites-shut",
    "cyberexpress-php2shell-gov-sites",
    "bbc-live-ckgel5xp2xv9t"
   ]
  },
  {
   "who": "Weird Gloop (RuneScape and other game wikis, about 500 million page views a month)",
   "country": "UK",
   "what": "Web servers off for 13 hours, 'the longest outage we've ever had'; about 94% of page views still served from cache",
   "when": "2026-10-21",
   "said_by": "Weird Gloop itself",
   "status": "confirmed",
   "sources": [
    "weirdgloop-blog-php2shell"
   ]
  },
  {
   "who": "City of Edinburgh Council",
   "country": "UK",
   "what": "Website offline from late Wednesday afternoon; the council says 'essential maintenance' and is 'waiting on an update from our provider'; it has not confirmed a link",
   "when": "2026-10-21",
   "said_by": "The Scotsman quoting a council spokesperson",
   "status": "reported",
   "sources": [
    "scotsman-edinburgh-council-offline"
   ]
  },
  {
   "who": "Oxford City Council and Oxfordshire County Council",
   "country": "UK",
   "what": "Sites removed from service; the city council's post: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'",
   "when": "2026-10-21",
   "said_by": "Oxford Chronicle quoting the councils' social posts",
   "status": "reported",
   "sources": [
    "oxfordchronicle-councils-offline"
   ]
  },
  {
   "who": "Metropolitan Police, Office for Budget Responsibility; errors on Bristol, Lambeth and Barnet council sites",
   "country": "UK",
   "what": "Reported unavailable; a minister said there was no breach of Budget security",
   "when": "2026-10-21",
   "said_by": "LBC, Insurance Business, East Anglian Daily Times",
   "status": "reported",
   "sources": [
    "lbc-uk-websites-offline",
    "insurancebusiness-uk-councils-met",
    "eadt-minister-budget-no-breach"
   ]
  },
  {
   "who": "French government services; the University of Geneva; the BBC; online shops",
   "country": "FR, CH, UK",
   "what": "Listed by the BBC as affected or taken offline",
   "when": "2026-10-22",
   "said_by": "BBC News",
   "status": "reported",
   "sources": [
    "bbc-live-ckgel5xp2xv9t"
   ]
  },
  {
   "who": "Government sites in the Netherlands, France, Germany and Belgium",
   "country": "EU",
   "what": "Listed by Reuters' factbox as having taken sites offline",
   "when": "2026-10-21",
   "said_by": "Reuters, via Global Banking and Finance",
   "status": "reported",
   "sources": [
    "reuters-factbox-websites-offline"
   ]
  },
  {
   "who": "Germany: the City of Mainz's website; the Charité (website and online booking), Vivantes, MHH Hannover and other hospitals; the host Mittwald (all customer websites)",
   "country": "DE",
   "what": "Taken offline on 21 October. The Charité's spokesman: it had \"keinerlei Einfluss auf die Arbeit der Charité\" (no effect on the Charité's work), and its main site was back that evening. Mittwald: every customer website offline from the afternoon, patches going in from 21:28, first checks with no sign of exploitation.",
   "when": "2026-10-21",
   "said_by": "Bitpage.de's situation report, quoting the organisations",
   "status": "reported",
   "sources": [
    "bitpage-php2shell-php-sicherheitsluecke-webseite"
   ]
  },
  {
   "who": "Morocco: the Maghreb Arabe Presse (MAP) and Bank Al-Maghrib websites",
   "country": "MA",
   "what": "MAP's site put into maintenance; Bank Al-Maghrib's unavailable for part of the night",
   "when": "2026-10-21",
   "said_by": "Journal du Canada",
   "status": "reported",
   "sources": [
    "journalducanada-php2shell-des-serveurs-exposes-a-une-cyb"
   ]
  },
  {
   "who": "Romania: the Romanian Police website",
   "country": "RO",
   "what": "Replaced with a maintenance page",
   "when": "2026-10-21",
   "said_by": "Critic Arad",
   "status": "reported",
   "sources": [
    "criticarad-php2shell-cve-2026-109618-ghid-patch"
   ]
  },
  {
   "who": "Japan: a bank's online services; Prime Minister Takaichi's website",
   "country": "JP",
   "what": "Companies and organisations took precautionary measures; a bank suspended its online service for a time, and the Prime Minister's website was also stopped \"for countermeasures\" (対策のため)",
   "when": "2026-10-22",
   "said_by": "Jiji Press, as illustrated by Yahoo! News Japan",
   "status": "reported",
   "sources": [
    "news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94"
   ]
  },
  {
   "who": "Switzerland: the EPFL, the Basel-Stadt administration, the University of Geneva, the insurer La Mobilière",
   "country": "CH",
   "what": "Websites temporarily unavailable from 21 October, 'according to several media'; La Mobilière says it suspended access to its site itself; Basel-Stadt took servers and services offline to patch",
   "when": "2026-10-21",
   "said_by": "24 Heures",
   "status": "reported",
   "sources": [
    "24heures-php2shell-qui-est-affecte-par-la-faille"
   ]
  },
  {
   "who": "Japan: Shizuoka Bank (website and banking app)",
   "country": "JP",
   "what": "Announced a precautionary, temporary shutdown of its website and banking app over the PHP flaws; a precaution, not a compromise",
   "when": "2026-10-22",
   "said_by": "IT Finanzmagazin; The Next Web, citing Bloomberg",
   "status": "reported",
   "sources": [
    "it-finanzmagazin-php2shell-sicherheitsluecken-bedrohen-we",
    "the-next-web-php2shell-no-confirmed-breaches"
   ]
  },
  {
   "who": "Japan: Mizuho (bank and securities), companies of the MUFG group, All Nippon Airways (boarding passes in Apple Wallet), Japan Airlines, East Japan Railway, Seven-Eleven Japan and the National Tax Agency (some online services)",
   "country": "JP",
   "what": "Halted or took down some online services over the PHP flaws on 22 October, as a precaution; All Nippon Airways said it had found no evidence of a breach. The National Tax Agency is named by Latin Times only, Seven-Eleven Japan by The Next Web only",
   "when": "2026-10-22",
   "said_by": "The Next Web, citing Bloomberg; Latin Times",
   "status": "reported",
   "sources": [
    "the-next-web-php2shell-no-confirmed-breaches",
    "latintimes-php2shell-ai-found-bug-hiding-70-web-mil"
   ]
  },
  {
   "who": "Nepal: government portals, the Nepal Rastra Bank's website and web services, the Department of Revenue Investigation's freight-tracking system",
   "country": "NP",
   "what": "Taken offline or suspended as a precaution over the PHP flaws; the Department said it suspended its service because of the risk of exploitation; restoration in stages after patching and testing. The page's headline says 'thousands' of websites but gives no count",
   "when": "2026-10-25",
   "said_by": "The Kathmandu Post",
   "status": "reported",
   "sources": [
    "kathmandupost-science-technology-2026-10-25-php2shell"
   ]
  },
  {
   "who": "Italy: GARR, the research and education network (some of its platforms)",
   "country": "IT",
   "what": "GARR announced on 21 October that it had isolated some of its platforms to apply the fixes, as a precaution against remote access; patching and a gradual restoration of services followed. As Macitynet reports GARR's notice",
   "when": "2026-10-21",
   "said_by": "Macitynet, relaying GARR's notice",
   "status": "reported",
   "sources": [
    "macitynet-php2shell-vulnerabilita-php-siti-offline"
   ]
  },
  {
   "who": "Japan: BASE, Kodomon, pixiv, Niconico, Sakura Internet and game companies; the Ministry of Finance (related web content)",
   "country": "JP",
   "what": "From the afternoon of 21 October they suspended all or part of their services for emergency maintenance; BASE and Kodomon named the PHP flaw as the reason, the other reasons differ; the Ministry of Finance paused related web content. None is said to be compromised",
   "when": "2026-10-21",
   "said_by": "Business+IT (ビジネス+IT)",
   "status": "reported",
   "sources": [
    "sbbit-article-cont1-187672"
   ]
  },
  {
   "who": "Poland: some bodies' BIP pages in the national public-information system (SSDIP)",
   "country": "PL",
   "what": "The Central Informatics Centre (COI) temporarily switched off the pages as a precaution, affecting only some bodies; the date for restoring some services was unknown at publication",
   "when": "2026-10-22",
   "said_by": "Polskie Radio 24",
   "status": "reported",
   "sources": [
    "polskieradio24-pieniadze-strony-bip-znikaja-z-sieci-luk"
   ]
  },
  {
   "who": "Germany: East Westphalia-Lippe public and company websites: back by 23 October the Hochschule für Musik Detmold, Hochschule Bielefeld, Universität Paderborn, Stadtwerke Bielefeld, Bielefeld's service portal, the City of Gütersloh, Klinikum Bielefeld, the Lippe road traffic office, the Polizei NRW, the City of Herford, the Kreiskliniken Herford-Bünde, Westfalenwind and Bitel's webmail and hosting; still offline at 18:00 that day the Kreis Paderborn and the Bielefeld fire brigade",
   "country": "DE",
   "what": "Offline or in maintenance from the afternoon of 21 October; the paper lists who had solved it by 23 October and who was still offline at 18:00 that day. The paper's own survey; reasons not given beyond the PHP flaw",
   "when": "2026-10-21",
   "said_by": "Neue Westfälische",
   "status": "reported",
   "sources": [
    "nw-nachrichten-zwischen-weser-und-rhein-244"
   ]
  },
  {
   "who": "Netherlands (as of 20:55 CEST, 18:55 UTC, on 21 October): the Port of Rotterdam (Havenbedrijf Rotterdam); Overheid.nl; the Dutch football association (KNVB); the sites of VVD, CDA, PRO, BBB and PvdD (taken off as a precaution), Volt (down for 'maintenance'), D66, SGP, ChristenUnie, DENK and JA21 (offline, no reason given); the Tweede Kamer; MijnOverheid; thirteen of the 25 veiligheidsregio's, among them IJsselland, Twente, Gelderland-Midden, Noord-Holland-Noord, Rotterdam-Rijnmond and Zeeland; Schiphol's app; Odido's BEN and Simpel brands; the hospitals Maastricht UMC+, Jeroen Bosch Ziekenhuis, BovenIJ and Albert Schweitzer Ziekenhuis (offline), Haaglanden MC, St. Antonius Ziekenhuis and Elisabeth-TweeSteden Ziekenhuis (errors); AG Connect and its sister titles such as iBestuur",
   "country": "NL",
   "what": "Taken off or partly off as a precaution, in line with CERT-EU's advice; the PHP Foundation had no sign of active exploitation. Stayed online per AG Connect: the veiligheidsregio's Groningen, Friesland, Drenthe and Amsterdam-Amstelland, the airport's website, Odido's own site (it does not use PHP), most national-government sites, Open overheid, and the sites of PVV, FVD, Groep Markuszower (DNA), SP and 50PLUS. IT168 (22 October) lists the Port of Rotterdam, Overheid.nl, the football association, five national parties and several hospitals",
   "when": "2026-10-21",
   "said_by": "AG Connect (Kim de Vries); IT168",
   "status": "reported",
   "sources": [
    "agconnect-maatschappij-security-welke-nederlandse-websites-w",
    "software-it168-a2026-1022-6954-000006954576-shtml"
   ]
  },
  {
   "who": "France: the prefectures' websites, the Paris police prefecture's included (Ministry of the Interior)",
   "country": "FR",
   "what": "Taken offline as a precaution while awaiting a fix for the framework they run on; the ministry's communiqué, quoted by Reuters, says so; Actu17 says at ANSSI's request. The Paris police prefecture portal returned a 503 when Stéphane Larue checked",
   "when": "2026-10-21",
   "said_by": "Reuters, via Boursorama; Actu17; Stéphane Larue News",
   "status": "reported",
   "sources": [
    "boursorama-reuters-sites-gouv",
    "actu17-prefectures",
    "stephanelarue-sites-des-prefectures-inaccessibles-lint"
   ]
  },
  {
   "who": "Indonesia: the Ministry of Industry's digital services: the TKDN site, SIINas and all kemenperin.go.id domains",
   "country": "ID",
   "what": "Switched off from 22:00 WIB (15:00 UTC) on 22 October to Sunday 25 October as a precaution; the TKDN site was still unreachable when Selular.ID checked on 24 October (14:00 WIB, 07:00 UTC)",
   "when": "2026-10-22",
   "said_by": "Selular.ID, citing the ministry's own notice",
   "status": "reported",
   "sources": [
    "selular-2026-10-ancaman-serangan-siber-php2shell"
   ]
  },
  {
   "who": "Belgium: the Foreign Affairs, Finance and Labour ministries' websites; media and education platforms",
   "country": "BE",
   "what": "Temporarily disabled after a warning from the Cyber Security Centre (CCB); a precaution, not a cyber attack. Takvim also lists the Netherlands (DigiD, the Rotterdam port portal, Schiphol's app, the House of Representatives), prefectures, police units and portals in France, Germany and Finland, all already on this ledger",
   "when": "2026-10-22",
   "said_by": "Takvim (Turkey)",
   "status": "reported",
   "sources": [
    "takvim-guncel-2026-10-22-php2shell-guvenlik-aci"
   ]
  },
  {
   "who": "Japan, games and web services (Bitpage's list of 22 October): Square Enix (new logins to Final Fantasy XIV closed on all worlds, patch servers offline); Cygames (Umamusume, Granblue Fantasy, Shadowverse, Princess Connect); Pokemon Sleep, Pokemon HOME and Pokemon Champions; Sega (CHUNITHM); Bandai Namco ID; Niconico; the host Sakura Internet; the shop platforms BASE and Color Me Shop; the daycare software Kodomon",
   "country": "JP",
   "what": "Sent into emergency maintenance or closed in part, as the Bitpage.de situation report lists them (published 22 October, 06:21 UTC, updated through the day); TechGaming.it, citing Kotaku, reports Pokemon apps suspended and Square Enix. Bitpage says the cause was not an attack but the two PHP flaws. Part of this list (Niconico, Sakura Internet, BASE, Kodomon) is also on the Business+IT row",
   "when": "2026-10-21",
   "said_by": "Bitpage.de; TechGaming.it",
   "status": "reported",
   "sources": [
    "bitpage-php2shell-php-sicherheitsluecke-webseite",
    "techgaming-internet-sotto-attacco-php2shell-vulnera"
   ]
  },
  {
   "who": "Canada: federal government websites, among them Innovation, Science and Economic Development Canada (ISED)",
   "country": "CA",
   "what": "Some federal websites taken offline: Minister Evan Solomon confirmed they were down \"as a precaution to protect government systems and Canadians’ information\", ISED among them, and Rajiv Gupta of the Canadian Centre for Cyber Security called PHP \"ubiquitous\"; Bitpage's update of 22 October, 08:30, says ISED still answered \"Service Unavailable\". All as Bitpage.de reports it; the minister's and the Cyber Centre's own words are not captured",
   "when": "2026-10-21",
   "said_by": "Bitpage.de",
   "status": "reported",
   "sources": [
    "bitpage-php2shell-php-sicherheitsluecke-webseite"
   ]
  }
 ],
 "compromised": [
  {
   "claim": "Amazon: 'PHP2Shell is now being broadly exploited in the wild'",
   "basis": "MadPot honeypot telemetry: an attempt on 17 October, proof-of-concept attempts from 02:00 UTC on 21 October, use against sensors 'almost immediately' after release. 'It's unclear if any of these attempts would have succeeded in real-world systems.'",
   "status": "reported (primary party); attempts against sensors, not victims",
   "sources": [
    "aws-security-blog-madpot"
   ]
  },
  {
   "claim": "Cloudflare: thousands of attempts in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, 'millions now'",
   "basis": "Matthew Prince on X, 22 October 01:25 UTC; attempts seen at the edge, not compromises; no blocked count published",
   "status": "reported (primary party)",
   "sources": [
    "x-eastdakota-php2shell-stats",
    "cloudflare-blog-php2shell-waf"
   ]
  },
  {
   "claim": "Imperva: no traffic matching the exploit patterns during pre-disclosure monitoring",
   "basis": "Imperva had the details under embargo and monitored customer traffic before the announcement",
   "status": "reported (primary party); a negative finding",
   "sources": [
    "imperva-blog-php2shell"
   ]
  },
  {
   "claim": "Huntress: no exploitation observed on partner systems as of 20:30 UTC on 21 October; no public exploit code known",
   "basis": "Huntress's own rapid-response post",
   "status": "reported (primary party); a negative finding",
   "sources": [
    "huntress-php2shell-rapid-response"
   ]
  },
  {
   "claim": "watchTowr: active exploitation attempts seen; the flaws 'exploited in the wild'",
   "basis": "watchTowr's pages, which block automated capture (HTTP 403); known through search summaries only",
   "status": "unverified: the source could not be read",
   "sources": [
    "watchtowr-php2shell",
    "watchtowr-php2shell-faq"
   ]
  },
  {
   "claim": "Chainguard's honeypots trapped IPs from China and Russia; 'several other security vendors' reported exploits in the wild",
   "basis": "Dan Lorenc, as reported by The Register; vendors not named, no evidence published",
   "status": "reported, second-hand",
   "sources": [
    "theregister-php-blames-chainguard"
   ]
  },
  {
   "claim": "NCSC New Zealand: 'aware of reports of active exploitation'",
   "basis": "Unattributed",
   "status": "reported",
   "sources": [
    "ncsc-nz-alert-php"
   ]
  },
  {
   "claim": "Weird Gloop: 'extremely likely that a bunch of old PHP fansites and forums have had their databases compromised'",
   "basis": "The author's expectation; no case named",
   "status": "unverified: an expectation, not a finding",
   "sources": [
    "weirdgloop-blog-php2shell"
   ]
  },
  {
   "claim": "A named organisation confirms it was compromised through php2shell",
   "basis": "No captured source carries one",
   "status": "none found",
   "sources": [
    "cisa-kev-json",
    "huntress-php2shell-rapid-response",
    "imperva-blog-php2shell"
   ]
  }
 ],
 "sources": [
  "rijksoverheid-ncsc-php-news",
  "weirdgloop-blog-php2shell",
  "aws-security-blog-madpot",
  "x-eastdakota-php2shell-stats"
 ]
}