Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Impact: what was taken offline, and what was compromised
This page v9 written in site v0.19.2 on 25 October 2026 · history and changes, 8 earlier
Two ledgers, because they measure different things. Taking a system offline is a decision an operator makes and can confirm, and the first table is full. Being compromised is a fact only evidence establishes, and the second table has, as of the latest capture, no confirmed entry. That gap is the most important finding on this site: the reported cost of php2shell so far is the cost of precaution.
Two ledgers. The first is systems taken offline, which is a decision an operator makes and can confirm; the second is systems compromised, which only evidence can establish. The columns say whether the entry comes from the organisation itself or from the press, because the difference is the whole point.
Taken offline
| Who | What happened | When | Who says so | Status | Sources |
|---|---|---|---|---|---|
| NCSC.nl (the Dutch national cyber security centre's own site) NL | NCSC.nl taken offline 'uit voorzorg' (as a precaution), with no active misuse seen yet, says the government; DigiD and MijnOverheid also offline, says the Dutch press | 2026-10-21 | the Dutch government (NCSC.nl); TPO.NL (DigiD, MijnOverheid) | reported | Rijksoverheid / NCSC-NL TPO.nl |
| Finland's government public web services (Valtori) FI | Incoming public traffic restricted from 12:45 local (09:45 UTC); described as preventive, not a response to a breach; internal networks unaffected | 2026-10-21 09:45 UTC | Yle and Helsinki Times quoting Valtori and the National Cyber Security Centre Finland | reported | Yle Helsinki Times |
| Latvia: several state digital resources, lsm.lv, 112.lv LV | Access restricted from abroad; state website platform patched by 20:00 UTC; lsm.lv and 112.lv restored; restrictions on others possibly until 26 October | 2026-10-21 15:25 UTC | CERT.LV itself | confirmed | CERT.LV |
| Wikimedia Foundation: 'a number of other systems' US | 'taken down a number of other systems as a precautionary measure until they can be safely patched'; parts of Wikipedia affected | 2026-10-21 | the Foundation, as quoted by CNN and The Cyber Express; the BBC | reported | CNN The Cyber Express BBC News |
| Weird Gloop (RuneScape and other game wikis, about 500 million page views a month) UK | Web servers off for 13 hours, 'the longest outage we've ever had'; about 94% of page views still served from cache | 2026-10-21 | Weird Gloop itself | confirmed | Weird Gloop |
| City of Edinburgh Council UK | Website offline from late Wednesday afternoon; the council says 'essential maintenance' and is 'waiting on an update from our provider'; it has not confirmed a link | 2026-10-21 | The Scotsman quoting a council spokesperson | reported | The Scotsman |
| Oxford City Council and Oxfordshire County Council UK | Sites removed from service; the city council's post: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident' | 2026-10-21 | Oxford Chronicle quoting the councils' social posts | reported | Oxford Chronicle |
| Metropolitan Police, Office for Budget Responsibility; errors on Bristol, Lambeth and Barnet council sites UK | Reported unavailable; a minister said there was no breach of Budget security | 2026-10-21 | LBC, Insurance Business, East Anglian Daily Times | reported | LBC Insurance Business East Anglian Daily Times |
| French government services; the University of Geneva; the BBC; online shops FR, CH, UK | Listed by the BBC as affected or taken offline | 2026-10-22 | BBC News | reported | BBC News |
| Government sites in the Netherlands, France, Germany and Belgium EU | Listed by Reuters' factbox as having taken sites offline | 2026-10-21 | Reuters, via Global Banking and Finance | reported | Reuters factbox, via Global… |
| Germany: the City of Mainz's website; the Charité (website and online booking), Vivantes, MHH Hannover and other hospitals; the host Mittwald (all customer websites) DE | Taken offline on 21 October. The Charité's spokesman: it had "keinerlei Einfluss auf die Arbeit der Charité" (no effect on the Charité's work), and its main site was back that evening. Mittwald: every customer website offline from the afternoon, patches going in from 21:28, first checks with no sign of exploitation. | 2026-10-21 | Bitpage.de's situation report, quoting the organisations | reported | Bitpage.de |
| Morocco: the Maghreb Arabe Presse (MAP) and Bank Al-Maghrib websites MA | MAP's site put into maintenance; Bank Al-Maghrib's unavailable for part of the night | 2026-10-21 | Journal du Canada | reported | Journal Du Canada |
| Romania: the Romanian Police website RO | Replaced with a maintenance page | 2026-10-21 | Critic Arad | reported | Critic Arad |
| Japan: a bank's online services; Prime Minister Takaichi's website JP | Companies and organisations took precautionary measures; a bank suspended its online service for a time, and the Prime Minister's website was also stopped "for countermeasures" (対策のため) | 2026-10-22 | Jiji Press, as illustrated by Yahoo! News Japan | reported | Yahoo!ニュース |
| Switzerland: the EPFL, the Basel-Stadt administration, the University of Geneva, the insurer La Mobilière CH | Websites temporarily unavailable from 21 October, 'according to several media'; La Mobilière says it suspended access to its site itself; Basel-Stadt took servers and services offline to patch | 2026-10-21 | 24 Heures | reported | 24 Heures |
| Japan: Shizuoka Bank (website and banking app) JP | Announced a precautionary, temporary shutdown of its website and banking app over the PHP flaws; a precaution, not a compromise | 2026-10-22 | IT Finanzmagazin; The Next Web, citing Bloomberg | reported | IT Finanzmagazin The Next Web |
| Nepal: government portals, the Nepal Rastra Bank's website and web services, the Department of Revenue Investigation's freight-tracking system NP | Taken offline or suspended as a precaution over the PHP flaws; the Department said it suspended its service because of the risk of exploitation; restoration in stages after patching and testing. The page's headline says 'thousands' of websites but gives no count | 2026-10-25 | The Kathmandu Post | reported | The Kathmandu Post |
Compromised
| Claim | Basis | Status | Sources |
|---|---|---|---|
| Amazon: 'PHP2Shell is now being broadly exploited in the wild' | MadPot honeypot telemetry: an attempt on 17 October, proof-of-concept attempts from 02:00 UTC on 21 October, use against sensors 'almost immediately' after release. 'It's unclear if any of these attempts would have succeeded in real-world systems.' | reported (primary party); attempts against sensors, not victims | Amazon |
| Cloudflare: thousands of attempts in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, 'millions now' | Matthew Prince on X, 22 October 01:25 UTC; attempts seen at the edge, not compromises; no blocked count published | reported (primary party) | Matthew Prince, Cloudflare CEO on… Cloudflare |
| Imperva: no traffic matching the exploit patterns during pre-disclosure monitoring | Imperva had the details under embargo and monitored customer traffic before the announcement | reported (primary party); a negative finding | Imperva Threat Research |
| Huntress: no exploitation observed on partner systems as of 20:30 UTC on 21 October; no public exploit code known | Huntress's own rapid-response post | reported (primary party); a negative finding | Huntress |
| watchTowr: active exploitation attempts seen; the flaws 'exploited in the wild' | watchTowr's pages, which block automated capture (HTTP 403); known through search summaries only | unverified the source could not be read | watchTowr watchTowr |
| Chainguard's honeypots trapped IPs from China and Russia; 'several other security vendors' reported exploits in the wild | Dan Lorenc, as reported by The Register; vendors not named, no evidence published | reported, second-hand | The Register |
| NCSC New Zealand: 'aware of reports of active exploitation' | Unattributed | reported | NCSC New Zealand |
| Weird Gloop: 'extremely likely that a bunch of old PHP fansites and forums have had their databases compromised' | The author's expectation; no case named | unverified an expectation, not a finding | Weird Gloop |
| A named organisation confirms it was compromised through php2shell | No captured source carries one | none found | CISA Huntress Imperva Threat Research |
What the two ledgers say together
- Precaution was the dominant response, and it was institutional: national CERTs, state IT providers and councils pulled sites on advice, often before the patch existed, and said so. The one operator who measured it served 94% of its traffic from cache for 13 hours.
- Attempts are not compromises. Cloudflare's millions and Amazon's honeypot hits are requests matching a shape at the edge or against a sensor. Nobody has published a count of successful exploitations, and the parties best placed to see one (CISA, Huntress, Imperva) report none.
- Absence of evidence is weak here. The detection authors are explicit that default web logs cannot show the attack shape and that no standard log carries the worker id the cross-request bug needs. A quiet log is not a clean host.
- The question that would settle it is one that no captured source answers: of the 1.57 million unpatched hosts Censys counted, how many were mod_php on x86_64 with default limits, reachable without a WAF, and how many of those show a worker spawning a shell. That number is what 'blast radius' means at internet scale, and it does not exist yet.
What a compromise of one system would reach is on the blast-radius section; how to tell is on detection and defence.