No named organisation has said it was compromised through php2shell.

What was searched

Where the statement was checked. A statement that something does not exist is only as good as the search behind it.

From attempts to a named compromise

The evidence, by kind

Attempts seen (9)

This kind of statement can show that someone tried. It cannot show that anyone succeeded.

Exploitation reported, no victim named (4)

This kind of statement can show that a party says exploitation happened. It cannot show who was hit, or whether it was confirmed by the victim.

No successful exploitation known (9)

This kind of statement can show what a party with visibility has not seen. It cannot show that nothing happened outside its view.

Named organisations (7)

This kind of statement can show what the organisation itself said. It cannot show a cause the organisation did not state.

Unnamed allegations (1)

This kind of statement can show that a claim was made. It cannot show who, or that php2shell was the way in.

Official exploited signals (3)

This kind of statement can show what the official lists record. It cannot show anything they have not yet recorded.

What would change the statement

• A named organisation saying it was compromised through php2shell, in its own notice, filing or statement.
• GMO, ČVUT or DMM stating a cause.
• A KEV listing for either CVE, with CISA's evidence.
• A regulator's breach notice (for example under GDPR or Australia's Notifiable Data Breaches scheme) naming the flaw.
• A security vendor naming a victim, with the victim's consent.

The source watch checks the official lists and the named organisations' pages every 30 minutes; this page is rebuilt from data/compromise.json when the evidence changes.

The disagreements, recorded

Where sources disagree, the disagreement is a record of its own in the source watch's contradiction ledger, with both statements and their captures: contradictions/is-it-exploited.json, contradictions/compromise-gmo-fx-vps.json, contradictions/compromise-cvut.json, contradictions/compromise-valtec.json, contradictions/compromise-dmm.json, contradictions/exploitation-germany-netherlands.json.

How this page is made

Every row is in data/compromise.json. Rows with sources cite captures in the evidence vault, which the build checks. Rows marked source watch cite a dated snapshot folder in the source-watch vault (oq9gflln), read with its published key; they move into the evidence vault as the evidence curator promotes them. Statements read in another language carry the reader’s English translation beside the verbatim original in the watch’s translations/ files. The charts are drawn from the same rows when the site is built.