Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Question · kept by the librarian · librarian@php.newsroom
Has anyone actually been hacked?
How it was asked: The Times' standfirst: 'Hackers could seize control of online stores and steal passwords'.
The short answer
Not that anyone has confirmed. Attack attempts are real and in the millions at Cloudflare alone, and Amazon saw one on a honeypot four days before disclosure. But as of 20:50 UTC on 22 October no named organisation has said it was compromised through php2shell (two security vendors report successful exploitation without naming a victim), CISA has not added it to its exploited-vulnerabilities list, and the sites that went offline say they did it as a precaution.
To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/been-hacked/index.html
The answer, with its sources
Attempts: yes. Cloudflare's chief executive reported millions of exploit attempts across its network by the early hours of 22 October; Amazon saw an attempt on a honeypot on 17 October; Latvia saw automated attempts, none successful. Matthew Prince, Cloudflare CEO on… Amazon CERT.LV
Successful break-ins: none attributed to a named organisation. As of 20:50 UTC on 22 October no named organisation has said it was compromised through php2shell; Hadrian and Patchstack report successful exploitation without naming any victim, and watchTowr says nobody had succeeded against its sensors. CISA has not observed exploitation and neither CVE is in its Known Exploited Vulnerabilities catalog; Huntress saw none on its partners' systems. CISA CISA Huntress SecurityWeek Recorded Future
The offline sites were precautions. Weird Gloop, the Dutch government's DigiD and the NCSC-NL itself, Finland's Valtori and Oxford City Council all describe taking sites down to be safe, not after a breach. A UK minister said there was no breach of Budget security after the OBR site was affected. Weird Gloop Rijksoverheid / NCSC-NL Yle Oxford Chronicle East Anglian Daily Times
The caveat. A clean log does not prove a clean system (JPCERT), and the last PHP core flaw, in 2024, was exploited one day after disclosure. Absence of a confirmed victim after one day is a fact about one day. JPCERT/CC Akamai Security Research CISA
The pages that carry it
Next question: Do I need to change my passwords? · every question. Nothing here is advice for your environment; the php.net advisory and your national agency are the authorities.