Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · exploitation · reported
There is no evidence yet that hackers have exploited the flaw
Fact-check
A2 Reported●●○○○○ disputed · Attribution · verdict: holds in part
The BBC (one named outlet, reporting its own Radio 4 interview) carries Austin saying "Not at the moment", but the claim's wording is the BBC headline, not his words, and his words are narrower: exploitation has not "taken off or been widespread". As a statement of fact it is disputed by Amazon's earlier "broadly exploited in the wild" and by NCSC NZ.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| bbc-live-ckgel5xp2xv9t | partial | he says: "Not at the moment... it doesn't look like exploitation has taken off or been widespread." | c88b8c5f4c6bc07d |
| bbc-live-ckgel5xp2xv9t | carries | No evidence that hackers have exploited flaw so far, says researcher | c88b8c5f4c6bc07d |
| aws-security-blog-madpot | absent | PHP2Shell is now being broadly exploited in the wild. | 94315ded6e1175f2 |
| ncsc-nz-alert-php | absent | The NCSC is aware of reports of active exploitation. | 992fc3b6639069a9 |
Open tickets: Contradiction-2, Finding-11, Finding-12.
Graded in Run-1, resting on captures up to 2026-10-22 08:05 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-22 06:16 UTCBBC News publishes PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
There is no evidence yet that hackers have exploited the flaw Who says it: Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October Status: reported Topic: exploitation Sources: bbc-live-ckgel5xp2xv9t