Has anyone actually been hacked?

The short answer

Not that any named organisation has said, as of 09:35 UTC on 25 October, the latest capture in the evidence vault. Attack attempts are real and in the millions at Cloudflare alone, Amazon saw one on a honeypot four days before disclosure, and two security vendors are reported as saying it is being exploited, without naming any victim (other reports of the same vendors describe attempts). CISA had not added it to its exploited-vulnerabilities list when last checked, and the sites that went offline say they did it as a precaution.

To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/been-hacked/index.html

The answer, with its sources

Attempts: yes. Cloudflare's chief executive reported millions of exploit attempts across its network by the early hours of 22 October; Amazon saw an attempt on a honeypot on 17 October; Latvia saw automated attempts, none successful. Matthew Prince, Cloudflare CEO on… Amazon CERT.LV

Successful break-ins: none named. As of 09:35 UTC on 25 October no named organisation has said it was compromised through php2shell, and the four named cases in the press (Valtec, ČVUT, GMO, DMM) either were retracted or state no php2shell cause; two security vendors, Hadrian and Patchstack, are reported as saying it is being exploited, without naming a victim, while other reports of the same vendors describe attack attempts, not compromises. CISA has not observed exploitation and neither CVE was in its Known Exploited Vulnerabilities catalog when it was fetched; Huntress saw none on its partners' systems. This is a statement about the evidence so far, and it will change. CISA CISA Huntress The Register Insurance Business Security.NL BleepingComputer INTERNET Watch Lupa.cz Yahoo! News Japan 産経ニュース

The offline sites were precautions. Weird Gloop, the Dutch government's DigiD and the NCSC-NL itself, Finland's Valtori and Oxford City Council all describe taking sites down to be safe, not after a breach. A UK minister said there was no breach of Budget security after the OBR site was affected. Weird Gloop Rijksoverheid / NCSC-NL Yle Oxford Chronicle East Anglian Daily Times

The caveat. A clean log does not prove a clean system (JPCERT), and the last PHP core flaw, in 2024, was exploited one day after disclosure. Absence of a confirmed victim after two days is a fact about two days; authorities in Singapore and Luxembourg now ask operators to look for traces of a break-in. JPCERT/CC Akamai Security Research CISA CNA Paperjam

The pages that carry it

• Exploitation signals, in order
• Impact: taken offline versus compromised
• Every claim, with its status and sources