{
 "about": "The evidence behind one statement, row by row. Authored by researcher@php.newsroom on 22 October 2026 at the editor's request. Each row says who said what, when, in their words, and where the capture is: 'sources' are evidence-vault slugs the gate checks; 'watch' is a dated snapshot folder in the source-watch vault (oq9gflln), held there until the evidence curator promotes it. This file maps evidence; it makes no assessment of risk.",
 "statement": "No named organisation has said it was compromised through php2shell.",
 "as_of": "2026-10-22T20:50Z",
 "claim": "no-confirmed-compromise",
 "status": "reported",
 "status_note": "A time-bounded absence, not a confirmed fact. It is true only as of the last check, and one statement from one organisation would end it.",
 "searched": [
  {"what": "The evidence vault", "count": 184, "unit": "sources", "detail": "head 31ccc515c29f; the site is built from its manifest of 144"},
  {"what": "The source watch", "count": 773, "unit": "pages watched", "detail": "474 publishers in 57 countries and 34 languages, checked hourly"},
  {"what": "Read in their own language", "count": 339, "unit": "non-English pages", "detail": "28 languages; 568 new items with verbatim quotes"},
  {"what": "Discovery feeds", "count": 3444, "unit": "news items scanned", "detail": "Google News and Bing News, 85 editions, from 1,621 publishers"},
  {"what": "Named sites probed", "count": 295, "unit": "sites", "detail": "every site somebody named as taken offline, probed every 30 minutes"}
 ],
 "kinds": [
  {"id": "attempts", "name": "Attempts seen", "can": "that someone tried", "cannot": "that anyone succeeded"},
  {"id": "vendor-exploitation", "name": "Exploitation reported, no victim named", "can": "that a party says exploitation happened", "cannot": "who was hit, or whether it was confirmed by the victim"},
  {"id": "no-success-known", "name": "No successful exploitation known", "can": "what a party with visibility has not seen", "cannot": "that nothing happened outside its view"},
  {"id": "named-organisation", "name": "Named organisations", "can": "what the organisation itself said", "cannot": "a cause the organisation did not state"},
  {"id": "allegation", "name": "Unnamed allegations", "can": "that a claim was made", "cannot": "who, or that php2shell was the way in"},
  {"id": "official-signal", "name": "Official exploited signals", "can": "what the official lists record", "cannot": "anything they have not yet recorded"}
 ],
 "rows": [
  {"kind": "attempts", "when": "2026-10-17", "who": "Amazon (AWS Threat Intelligence)", "says": "An exploit attempt against a MadPot honeypot four days before disclosure; \"it's unclear if any of these attempts would have succeeded in real-world systems.\"", "sources": ["aws-security-blog-madpot"]},
  {"kind": "attempts", "when": "2026-10-21T08:36Z", "who": "ELLIO (via The Hacker News)", "says": "First sensor hit, about 55 minutes after Chainguard's images.", "sources": ["thehackernews-php2shell-4days"]},
  {"kind": "attempts", "when": "2026-10-21", "who": "Cloudflare", "says": "\"We observed attack traffic targeting our customers\" and attackers \"mutating the attack payload to try to bypass our protections\".", "sources": ["cloudflare-blog-php2shell-waf"]},
  {"kind": "attempts", "when": "2026-10-21", "who": "watchTowr (via SecurityWeek)", "says": "First in-the-wild attempts hit its sensors; \"Whilst nobody has been successful to date, we don't expect that will last long.\"", "sources": ["securityweek-first-attempts-sensors"]},
  {"kind": "attempts", "when": "2026-10-21T20:00Z", "who": "CERT.LV (Latvia)", "says": "Automated exploitation attempts seen in Latvia; no successful attacks reported.", "sources": ["certlv-php-preventive"]},
  {"kind": "attempts", "when": "2026-10-22", "who": "Cloudflare's CEO, Matthew Prince", "says": "\"thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.\"", "sources": ["x-eastdakota-php2shell-stats"]},
  {"kind": "attempts", "when": "2026-10-22", "who": "VulnCheck (via SecurityWeek)", "says": "\"At least one Chinese IP address unsuccessfully attempted to exploit PHP2Shell to deploy a webshell.\"", "sources": ["securityweek-exploitation-days-before"]},
  {"kind": "attempts", "when": "2026-10-22", "who": "QNAP PSIRT", "says": "Observed scanning activity and attack attempts using the PHP2Shell flaws.", "sources": [], "watch": "raw/tw/security-vendor/qnap/statement-php2shell/20261022T191720Z/"},
  {"kind": "attempts", "when": "2026-10-22", "who": "A Tencent News analyst, with ThreatBook sensors (China)", "says": "Captured scanning requests with the User-Agent php2shell-scan/1.0; no evidence of successful code execution.", "sources": [], "watch": "translations/hk/news/news-qq/rain-a-20261021a0eq4p00.json"},
  {"kind": "vendor-exploitation", "when": "2026-10-21", "who": "Hadrian (via SecurityWeek)", "says": "\"We are now seeing php2shell exploited in the wild at scale.\" No victim named.", "sources": ["securityweek-first-attempts-sensors"]},
  {"kind": "vendor-exploitation", "when": "2026-10-21T07:34Z", "who": "Patchstack (via Recorded Future)", "says": "\"Received reports of multiple active exploitation incidents from hosting partners.\" No victim named.", "sources": ["recordedfuture-php2shell"]},
  {"kind": "vendor-exploitation", "when": "2026-10-21", "who": "Amazon (AWS Threat Intelligence)", "says": "\"PHP2Shell is now being broadly exploited in the wild.\" Against its sensors; no victim named.", "sources": ["aws-security-blog-madpot"]},
  {"kind": "vendor-exploitation", "when": "2026-10-21T20:15Z", "who": "NCSC New Zealand", "says": "\"The NCSC is aware of reports of active exploitation.\" Whose reports is not said.", "sources": ["ncsc-nz-alert-php"]},
  {"kind": "no-success-known", "when": "2026-10-21", "who": "CISA", "says": "\"CISA has not observed exploitation of these vulnerabilities as of the time of publication.\"", "sources": ["cisa-alert-php-20261021"]},
  {"kind": "no-success-known", "when": "2026-10-21T20:30Z", "who": "Huntress", "says": "\"As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.\"", "sources": ["huntress-php2shell-rapid-response"]},
  {"kind": "no-success-known", "when": "2026-10-21", "who": "The PHP Foundation", "says": "The security team \"did not identify any functional exploits at the time of release/public disclosure.\"", "sources": ["php-foundation-blog-security-release"]},
  {"kind": "no-success-known", "when": "2026-10-22", "who": "The PHP Foundation's executive director (to The Verge and WIRED)", "says": "\"To our knowledge, there has been no successful attempt at remote code execution.\"", "sources": [], "watch": "raw/us/tech-press/the-verge/php2shell-websites-down/"},
  {"kind": "no-success-known", "when": "2026-10-22", "who": "Germany's BSI, the Dutch NCSC, Japan's Chief Cabinet Secretary (via The Next Web, Politico)", "says": "Germany has seen attacks but no successful use; the Netherlands has no indication of active misuse; Japan says no attacks exploiting the flaws have been confirmed.", "sources": [], "watch": "raw/nl/tech-press/the-next-web/php2shell-no-confirmed-breaches/"},
  {"kind": "no-success-known", "when": "2026-10-22", "who": "Switzerland's BACS", "says": "Knows of no attacks in Switzerland attributable to the flaws (via SRF, read in German).", "sources": [], "watch": "translations/ch/news/srf/news-schweiz-cyber-schwachstelle-bei-php-erste-schadensbilan.json"},
  {"kind": "no-success-known", "when": "2026-10-22", "who": "Belgium's CCB", "says": "Has recorded no attacks on Belgian websites (via RTVE, read in Spanish; and Clickx, in French).", "sources": [], "watch": "translations/es/news/rtve/noticias-20261022-fallos-criticos-php2shell-vulnerabilidades.json"},
  {"kind": "no-success-known", "when": "2026-10-22", "who": "Austria's Interior Ministry", "says": "No concrete reports of successful attacks so far (via Salzburg24, read in German).", "sources": [], "watch": "translations/at/news/salzburg24/news-oesterreich-massive-sache-folgen-der-php-sicherheitslue.json"},
  {"kind": "no-success-known", "when": "2026-10-22", "who": "Cloudflare (to USA Today)", "says": "Its observations \"describe attack attempts; they do not, by themselves, establish successful compromises.\"", "sources": [], "watch": "raw/us/news/usa-today/php2shell-live/"},
  {"kind": "named-organisation", "when": "2026-10-22", "who": "GMO Internet Group (Japan)", "says": "Malicious programs were found on 20 October on servers of its FX trading VPS service; 26,739 servers possibly affected; account logins may have been taken; fraudulent operations reported. The cause is not stated.", "reading": "A confirmed break-in, cause not stated", "sources": [], "watch": "raw/jp/news/yahoo-news-jp/gmo-fx-login-leak/20261022T191523Z/"},
  {"kind": "named-organisation", "when": "2026-10-22", "who": "Czech Technical University (ČVUT)", "says": "Facing \"a cyber attack on its IT infrastructure… part of worldwide attempts to hit PHP sites\"; \"the active attack was stopped\"; some systems taken offline.", "reading": "An attack reported and stopped; success not stated", "sources": [], "watch": "raw/cz/tech-press/lupa/cvut-cyber-attack/20261022T191510Z/"},
  {"kind": "named-organisation", "when": "2026-10-22", "who": "Valtec (Japan)", "says": "First blamed a \"cyberattack targeting the PHP vulnerability\", then corrected: the attackers used a flaw in its own service.", "reading": "Attribution to php2shell retracted", "sources": [], "watch": "raw/jp/tech-press/impress-watch/valtec-php-attack/20261022T191433Z/"},
  {"kind": "named-organisation", "when": "2026-10-21", "who": "DMM (Japan)", "says": "Halted services to respond to \"a vulnerability in external software\"; no data leaked; would not say whether it was PHP.", "reading": "Precaution; cause not stated", "sources": [], "watch": "raw/jp/news/sankei/dmm-service-halt/20261022T191536Z/"},
  {"kind": "named-organisation", "when": "2026-10-22", "who": "Germany's Interior Ministry (to Bild)", "says": "Its site \"was not hacked\", only taken down \"for a repair\".", "reading": "Precaution, stated not compromised", "sources": [], "watch": "translations/de/news/bild/leben-wissen-digital-php-sicherheitsluecken-behoerden-nehmen.json"},
  {"kind": "named-organisation", "when": "2026-10-22", "who": "Anexia (Austria)", "says": "Confirmed attack attempts on websites it operates; bank data not affected (via ORF).", "reading": "Attempts, stated not compromised", "sources": [], "watch": "translations/at/news/orf/stories-3445806.json"},
  {"kind": "named-organisation", "when": "2026-10-22", "who": "Ahold Delhaize", "says": "No reason to believe its recent cyberattack is linked to the PHP flaws (via Accountant.nl).", "reading": "A separate incident, link denied", "sources": [], "watch": "translations/nl/news/accountant/nieuws-2026-10-europese-cybersecuritydienst-waarschuwt-voor.json"},
  {"kind": "allegation", "when": "2026-10-21", "who": "An anonymous startup owner (via Fortune)", "says": "Alleges hackers stole source code, exposed cookie data and leaked legal documents. Unnamed; not attributed to php2shell; not verified.", "sources": [], "watch": "raw/us/news/fortune/ai-tools-php-vulnerability/"},
  {"kind": "official-signal", "when": "2026-10-22T18:16Z", "who": "CISA Known Exploited Vulnerabilities catalog", "says": "Version 2026.10.21, 1,754 entries; neither CVE listed.", "sources": ["cisa-kev-json"], "watch": "series/kev-listed/"},
  {"kind": "official-signal", "when": "2026-10-21T14:34Z", "who": "CISA's assessment on the CVE records (SSVC)", "says": "Exploitation: none. Automatable: no. Technical impact: total.", "sources": ["cve-cve-2026-109618", "cve-cve-2026-109619"]},
  {"kind": "official-signal", "when": "2026-10-22T17:51Z", "who": "EPSS (FIRST)", "says": "0.053 and 0.058: the modelled probability of exploitation activity in the next 30 days.", "sources": [], "watch": "series/epss/"}
 ],
 "layers": [
  {"label": "Attempts against sensors, honeypots and edges", "value": "millions", "note": "Cloudflare's CEO; Amazon, watchTowr, CERT.LV, QNAP and others report attempts"},
  {"label": "Exploitation reported by vendors", "value": "3 parties", "note": "Hadrian, Patchstack, Amazon; no victim named by any"},
  {"label": "Named organisations saying they were attacked", "value": "1", "note": "ČVUT: attack stopped, success not stated"},
  {"label": "Named organisations saying php2shell was the way in", "value": "0", "note": "GMO reports a break-in without a cause; Valtec retracted its attribution"}
 ],
 "would_change_it": [
  "A named organisation saying it was compromised through php2shell, in its own notice, filing or statement.",
  "GMO, ČVUT or DMM stating a cause.",
  "A KEV listing for either CVE, with CISA's evidence.",
  "A regulator's breach notice (for example under GDPR or Australia's Notifiable Data Breaches scheme) naming the flaw.",
  "A security vendor naming a victim, with the victim's consent."
 ],
 "contradictions": ["is-it-exploited", "compromise-gmo-fx-vps", "compromise-cvut", "compromise-valtec", "compromise-dmm", "exploitation-germany-netherlands"]
}