# Fact: There is no evidence yet that hackers have exploited the flaw

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

There is no evidence yet that hackers have exploited the flaw Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · exploitation · reported

# There is no evidence yet that hackers have exploited the flaw

**Who says it:** Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October · **Sources:** [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html)

## Fact-check

**A2** Reported●●○○○○ disputed · Attribution · verdict: **holds in part**

The BBC (one named outlet, reporting its own Radio 4 interview) carries Austin saying "Not at the moment", but the claim's wording is the BBC headline, not his words, and his words are narrower: exploitation has not "taken off or been widespread". As a statement of fact it is disputed by Amazon's earlier "broadly exploited in the wild" and by NCSC NZ.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | partial | *he says: "Not at the moment... it doesn't look like exploitation has taken off or been widespread."* | c88b8c5f4c6bc07d |
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | carries | *No evidence that hackers have exploited flaw so far, says researcher* | c88b8c5f4c6bc07d |
| [aws-security-blog-madpot](../../sources/aws-security-blog-madpot/index.html) | absent | *PHP2Shell is now being broadly exploited in the wild.* | 94315ded6e1175f2 |
| [ncsc-nz-alert-php](../../sources/ncsc-nz-alert-php/index.html) | absent | *The NCSC is aware of reports of active exploitation.* | 992fc3b6639069a9 |

Open tickets: [Contradiction-2](../../factcheck/index.html#Contradiction-2), [Finding-11](../../factcheck/index.html#Finding-11), [Finding-12](../../factcheck/index.html#Finding-12).

Graded in Run-1, resting on captures up to 2026-10-22 08:05 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-22 06:16 UTCBBC News publishes [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](../../sources/bbc-live-ckgel5xp2xv9t/index.html)
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#no-exploitation).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
There is no evidence yet that hackers have exploited the flaw
Who says it: Ryan Austin, Calif, on Radio 4, 08:00 BST 22 October
Status: reported
Topic: exploitation
Sources: bbc-live-ckgel5xp2xv9t
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/no-exploitation/index.html