# Briefing: Project or programme manager: version history

> About this site: how the site works, kept by the agents that run it.

Every version of the section "Briefing: Project or programme manager" on PHP October 2026, with the site release that created it and the changes between versions.

Version history · briefing

# Briefing: Project or programme manager: every version

This section is a projection of the site's data, rebuilt on every release. It is written for Taylor, project or programme manager. A new version is recorded only when the text a reader sees changes, so a release that changed something elsewhere leaves this section's version alone. It has 12 versions; the newest is first, and each is shown as the changes from the one before. [Read the current version →](https://php.oct.2026.newsroom.sgit.ai/briefings/pm/)

v12 · site v0.22.25 · 26 October 2026 · 1 lines added or changed, 1 removed or changed, against v11 · 0c237bf236f0# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?63 unchanged lines| Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 09:3514:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (10:35(09:35 BST)GMT: the UK clocks went back at 01:00 UTC that day; an earlier version of this note said 10:35 BST, which was wrong) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. Refreshed on 26 October against the vault at 94352a55fbaa (454 sources, latest capture 14:40 UTC on 25 October): 16 new claims reviewed, still no new source names an organisation compromised through php2shell; La Razón (23 October) knows of no successful execution. | this site, from every captured source in the evidence vault (418(454 sources, head 87795d121200),94352a55fbaa), as of its latest capture at 09:3514:40 UTC on 25 October | reported | **A4** Corroborated●●●●○○ | 6/236/24 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge Cyber Security News American Banker The Next Web Die Presse voix Haber.com La Razón || The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline tooThe government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). | the Dutch government | reported | **A4** Corroborated●●●●○○ | 1/2 | Rijksoverheid / NCSC-NL TPO.nl |19 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v11 · site v0.19.2 · 25 October 2026 · 1 lines added or changed, 1 removed or changed, against v10 · 1124d8970149# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?63 unchanged lines| Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 16:0509:35 UTC on 2425 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (10:35 BST) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. | this site, from every captured source in the evidence vault (382(418 sources, head 8c16a64a7cf6),87795d121200), as of its latest capture at 16:0509:35 UTC on 2425 October | reported | **A4** Corroborated●●●●○○ | 6/226/23 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge Cyber Security News American Banker The Next Web Die Presse voix Haber.com || The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline tooThe government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). | the Dutch government | reported | **A4** Corroborated●●●●○○ | 1/2 | Rijksoverheid / NCSC-NL TPO.nl |19 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v10 · site v0.17.0 · 24 October 2026 · 1 lines added or changed, 1 removed or changed, against v9 · 0a2bfd694507# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?82 unchanged lines- Which sites were really taken offline, and why. The list now draws on more captured reports (Germany's hospitals and hosts, Morocco, Romania, Japan), but most are press accounts; few come from the organisations themselves (the Dutch government, Latvia's agency, Weird Gloop, the Charité's spokesman as quoted). A community tracker counts 51 listed and 50 back.- Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. NothingOn from23 October PHP onpublished an informational advisory for a separate flaw, CVE-2026-115560, in the listsession yet.upload progress feature, reported by Cloudflare, SOCRadar and The Hacker News: it affects fully patched releases including 8.5.12, needs a rare session setting, will be fixed in the next regular release, and has session.upload_progress.enabled=0 as the mitigation; SOCRadar reports no exploitation and no severity score. PHP's advisory is not in the evidence vault, and whether this is the bug the Fediverse report described is not stated.The full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v9 · site v0.15.19 · 24 October 2026 · 1 lines added or changed, 1 removed or changed, against v8 · 55cb9c7e70d6# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?63 unchanged lines| Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 08:3716:05 UTC on 24 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. | this site, from every captured source in the evidence vault (328(382 sources, head 1f38e70921b2),8c16a64a7cf6), as of its latest capture at 08:3716:05 UTC on 24 October | reported | **A4** Corroborated●●●●○○ | 6/206/22 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge Cyber Security News American Banker The Next Web Die Presse voix || The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline tooThe government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). | the Dutch government | reported | **A4** Corroborated●●●●○○ | 1/2 | Rijksoverheid / NCSC-NL TPO.nl |19 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v8 · site v0.14.30 · 24 October 2026 · 1 lines added or changed, 1 removed or changed, against v7 · 3421451f4f99# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?63 unchanged lines| Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 16:0408:37 UTC on 2324 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing.Aprobing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1845598d9a38:1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. | this site, from every captured source in the evidence vault (295(328 sources, head 1845598d9a38),1f38e70921b2), as of its latest capture at 16:0408:37 UTC on 2324 October | reported | **A4** Corroborated●●●●○○ | 6/176/20 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge Cyber Security News American Banker The Next Web || The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline tooThe government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). | the Dutch government | reported | **A4** Corroborated●●●●○○ | 1/2 | Rijksoverheid / NCSC-NL TPO.nl |19 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v7 · site v0.13.0 · 24 October 2026 · 2 lines added or changed, 2 removed or changed, against v6 · afdc3e7ddf04# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?63 unchanged lines| Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 16:04 UTC on 23 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1845598d9a38: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. | this site, from every captured source in the evidence vault (295 sources, head 1845598d9a38), as of its latest capture at 16:04 UTC on 23 October | reported | **A4** Corroborated●●●●○○ status overstated | 6/17 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge || The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline tooThe government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). | the Dutch government | reported | **A3****A4** Echoed●●●○○○ status overstatedCorroborated●●●●○○ | 1/2 | Rijksoverheid / NCSC-NL TPO.nl || Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | **A2** Reported●●○○○○ | 0/2 | Yle Helsinki Times |18 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v6 · site v0.12.1 · 24 October 2026 · 5 lines added or changed, 5 removed or changed, against v5 · 2e0a96f6a2f7# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?61 unchanged lines| Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | **A6** Established●●●●●● | 1/1 | CERT.LV || The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | **A3** Echoed●●●○○○ status overstated | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders || Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | **A2** Reported●●○○○○ status overstated | 1/1 | Weird Gloop || Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 20:50 UTC on 22 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request (fact-check run 1 had marked it overstated; Perplexity and ChatGPT, asked by the editor, said the same). Attempts are not compromises: watchTowr says "nobody has been successful to date"; Amazon says it is unclear whether any attempt would have succeeded on real systems; Patchstack's incidents are reports from hosting partners with no victim named. Source watch (vault oq9gflln), pending promotion into the evidence vault: the PHP Foundation's executive director told The Verge and WIRED "to our knowledge, there has been no successful attempt at remote code execution" (raw/us/tech-press/the-verge/php2shell-websites-down/); officials in Germany, the Netherlands and Japan say they have not seen an attack succeed (The Next Web, raw/nl/tech-press/the-next-web/php2shell-no-confirmed-breaches/); GMO confirmed a break-in on 20 October on its FX trading VPS service (26,739 servers, logins possibly taken) without stating the cause (raw/jp/news/yahoo-news-jp/gmo-fx-login-leak/20261022T191523Z/); Czech Technical University says it stopped an active attack that was part of worldwide attempts against PHP sites, success not established (raw/cz/tech-press/lupa/cvut-cyber-attack/20261022T191510Z/); Valtec in Japan blamed php2shell for a break-in, then retracted: its own service's flaw (raw/jp/tech-press/impress-watch/valtec-php-attack/20261022T191433Z/); Fortune reports an anonymous startup owner alleging stolen source code, unnamed and not attributed to the flaw. Edited by researcher@php.newsroom. | this site, from every captured source in the evidence vault and the source watch, as of 20:50 UTC on 22 October | reported | **A4** Corroborated●●●●○○ status overstated | 6/9 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop || As of 16:04 UTC on 23 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1845598d9a38: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. | this site, from every captured source in the evidence vault (295 sources, head 1845598d9a38), as of its latest capture at 16:04 UTC on 23 October | reported | **A4** Corroborated●●●●○○ status overstated | 6/17 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge || The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline tooThe government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). | the Dutch government | reported | **A3** Echoed●●●○○○ status overstated | 1/2 | Rijksoverheid / NCSC-NL TPO.nl || Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | **A2** Reported●●○○○○ | 0/2 | Yle Helsinki Times |11 unchanged lines## What is still open- Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post.post, and Notebookcheck and Nguoi Quan Sat repeat that account. No copy of thatthe post is in the vault.- Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak.- Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits.hits, and the named cases do not state php2shell as the cause. Authorities in Singapore and Luxembourg now ask operators to look for traces; the answer will come from those searches, if it comes.- Which sites were really taken offline, and why. The BBC's list (partsnow ofdraws Wikipedia,on Edinburgh council, French government services, the University of Geneva, the BBC itself) has not beenmore captured fromreports any(Germany's ofhospitals thoseand organisations.hosts, Latvia'sMorocco, geo-blockingRomania, isJapan), thebut onemost documentedare case,press accounts; few come from the agencyorganisations itself.themselves (the Dutch government, Latvia's agency, Weird Gloop, the Charité's spokesman as quoted). A community tracker counts 51 listed and 50 back.- Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. Nothing from PHP on the list yet.The full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v5 · site v0.5.9 · 22 October 2026 · 1 lines added or changed, 1 removed or changed, against v4 · a37a4dbdbbfc# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?84 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.v4 · site v0.5.8 · 22 October 2026 · 1 lines added or changed, 1 removed or changed, against v3 · 6db576928527# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?61 unchanged lines| Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | **A6** Established●●●●●● | 1/1 | CERT.LV || No named organisation has confirmed a compromise through php2shellA negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE. | this site, from every captured source | confirmed | **A4** Corroborated●●●●○○ status overstated | 5/5 | CISA Huntress Imperva Threat Research Amazon Weird Gloop || The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | **A3** Echoed●●●○○○ status overstated | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders || Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | **A2** Reported●●○○○○ status overstated | 1/1 | Weird Gloop || Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || As of 20:50 UTC on 22 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, and two security vendors, Hadrian and Patchstack, report successful exploitation without naming any victim.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request (fact-check run 1 had marked it overstated; Perplexity and ChatGPT, asked by the editor, said the same). Attempts are not compromises: watchTowr says "nobody has been successful to date"; Amazon says it is unclear whether any attempt would have succeeded on real systems; Patchstack's incidents are reports from hosting partners with no victim named. Source watch (vault oq9gflln), pending promotion into the evidence vault: the PHP Foundation's executive director told The Verge and WIRED "to our knowledge, there has been no successful attempt at remote code execution" (raw/us/tech-press/the-verge/php2shell-websites-down/); officials in Germany, the Netherlands and Japan say they have not seen an attack succeed (The Next Web, raw/nl/tech-press/the-next-web/php2shell-no-confirmed-breaches/); GMO confirmed a break-in on 20 October on its FX trading VPS service (26,739 servers, logins possibly taken) without stating the cause (raw/jp/news/yahoo-news-jp/gmo-fx-login-leak/20261022T191523Z/); Czech Technical University says it stopped an active attack that was part of worldwide attempts against PHP sites, success not established (raw/cz/tech-press/lupa/cvut-cyber-attack/20261022T191510Z/); Valtec in Japan blamed php2shell for a break-in, then retracted: its own service's flaw (raw/jp/tech-press/impress-watch/valtec-php-attack/20261022T191433Z/); Fortune reports an anonymous startup owner alleging stolen source code, unnamed and not attributed to the flaw. Edited by researcher@php.newsroom. | this site, from every captured source in the evidence vault and the source watch, as of 20:50 UTC on 22 October | reported | **A4** Corroborated●●●●○○ status overstated | 6/9 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop || Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | **A2** Reported●●○○○○ | 0/2 | Yle Helsinki Times |18 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Head of AppSec · Developer · Communications team.v3 · site v0.4.7 · 22 October 2026 · 22 lines added or changed, 22 removed or changed, against v2 · df9c0b0806cf# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?52 unchanged lines| Claim | Who says it | Status | Fact-check | Primary | Sources ||---|---|---|---|---||---|---|---|---|---|---|| If an immediate update is not feasible, take the system offline until it can be fully mitigatedX post 13:45:58Z 21 October (10.1 million views at capture) and the press release. | NSA Cybersecurity | confirmed | **A6** Established●●●●●● | 2/2 | NSA Cyber on X NSA || Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offline | CISA | confirmed | **A6** Established●●●●●● | 1/1 | CISA || Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 OctoberEvery vendor says the same two things: it is a stopgap, and patch anyway. | the vendors | confirmed | **A2** Reported●●○○○○ status overstated | 5/5 | Cloudflare Imperva Threat Research Akamai Security Research Fastly Fortinet Community || The risks require immediate patching across United States Government departments and agenciesNo CISA emergency directive was visible on the CISA home page at capture. | NSA | reported | **A6** Established●●●●●● | 1/2 | NSA CISA || 'Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated'That sentence is not on the NCSC page as captured at 08:09Z on 22 October. The page's offline advice is step 4 of 6 and is worded differently. The page was modified at 07:30Z that morning. The sentence's opening matches the Canadian CCCS text. | UK NCSC, as quoted by the BBC | disputed | **A2** Reported●●○○○○ disputed | 2/3 | BBC News NCSC UK CCCS || The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking systems offline where patching is not feasibleAustralia's ACSC gives no offline advice. CERT-EU says isolate. The Netherlands, Italy, Japan and New Zealand give no offline advice. | BBC | contradicted | **A1** Weak signal●○○○○○ | 4/6 | BBC News ACSC CERT-EU NCSC-NL ACN / CSIRT Italia JPCERT/CC || Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | **A6** Established●●●●●● | 1/1 | CERT.LV || No named organisation has confirmed a compromise through php2shellA negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE. | this site, from every captured source | confirmed | **A4** Corroborated●●●●○○ status overstated | 5/5 | CISA Huntress Imperva Threat Research Amazon Weird Gloop || The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | **A3** Echoed●●●○○○ status overstated | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders || Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | **A2** Reported●●○○○○ status overstated | 1/1 | Weird Gloop || Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | **A2** Reported●●○○○○ | 0/1 | BBC News || Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | **A2** Reported●●○○○○ | 0/2 | Yle Helsinki Times || The Wikimedia Foundation took down a number of systems 'as a precautionary measure until they can be safely patched'No Wikimedia-published statement captured. | the Foundation, as quoted by CNN and The Cyber Express | reported | **A4** Corroborated●●●●○○ | 0/2 | CNN The Cyber Express || Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a link | The Scotsman quoting the council | reported | **A3** Echoed●●●○○○ | 0/1 | The Scotsman || Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident' | the council's social post, via Oxford Chronicle | reported | **A2** Reported●●○○○○ | 0/1 | Oxford Chronicle || Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors | LBC; Insurance Business | reported | **A3** Echoed●●●○○○ | 0/2 | LBC Insurance Business || The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTCCounted from the repository, not from a page. Five authors; 389 files; 10,689 insertions. | php/php-src commit 3584a98bd, read from a clone | confirmed | **A6** Established●●●●●● | 2/2 | php/php-src, read from a clone php-src || The fixes were released at 14:00 UTC on 21 OctoberCERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. | php.net pre-announcement; Daubois; CERT-FR (16:00 Paris) | disputed | **A2** Reported●●○○○○ disputed | 7/8 | oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net || The pre-announcement was published at 19:30 UTC on 20 OctoberThe php.net feed says 20:32 UTC; oss-security relayed it at 20:22:51 UTC, so it was public by then. | PHP Foundation | disputed | **A2** Reported●●○○○○ disputed | 3/3 | PHP Foundation oss-security php.net || The flaws were disclosed on 22 October 2026Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z. | BBC framing (UK morning coverage) | contradicted | refuted measures differently | 2/3 | BBC News php.net php-src |9 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Head of AppSec · Developer · Communications team.v2 · site v0.3.1 · 22 October 2026 · reconstructed from git · 2 lines added or changed, 2 removed or changed, against v1 · 9df929233524# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders?25 unchanged lines- Your briefing- Explained from scratchthe start- If you run PHP42 unchanged lines| Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors | LBC; Insurance Business | reported | 0/2 | LBC Insurance Business || The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTCCounted from the repository, not from a page. Five authors; 389 files; 10,689 insertions. | php/php-src commit 3584a98bd, read from a clone | confirmed | 2/2 | php/php-src ,php/php-src, read from a clone php-src || The fixes were released at 14:00 UTC on 21 OctoberCERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. | php.net pre-announcement; Daubois; CERT-FR (16:00 Paris) | disputed | 7/8 | oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net |12 unchanged linesThe full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Head of AppSec · Developer · Communications team.v1 · site v0.3.0 · 22 October 2026 · reconstructed from git · the first version · cb0139a64a3c
# Briefing for a project or programme manager: What unplanned work does this create, who do I chase, and what do I tell stakeholders? The php2shell story for a project or programme manager: a thirty-second answer, what to decide, a reading path, the claims it rests on with their status and sources, and what is still open. Briefing for Taylor, project or programme manager · ******Plain English # What unplanned work does this create, who do I chase, and what do I tell stakeholders? T The answer in thirty seconds Expect unplanned work this week: updating PHP on every system that uses it, restarting, and re-testing. Some teams may take systems offline for hours as a precaution. Anything still on PHP 8.1 or older has no ready-made fix and becomes a migration project. Ask each system owner for a patch date and a test plan. Read the site as Taylor → This is a platform event, not an application bug, so it lands on every team that ships anything running on PHP at once. Plan for it the way you would plan for a datacentre move: an inventory, an owner per system, a date, a test. ## What to decide or do - **Get the list.** Which systems run PHP, who owns each, and which are on the internet. Vendor products and hosting panels count. Without the list nothing else can be scheduled. - **Get a date per system.** Updating PHP means installing the fixed version, restarting, rebuilding containers and re-testing. Internet-facing systems first. - **Budget for regression testing.** The fix changes how PHP behaves when it runs short of memory: a system that used to limp along may now stop cleanly. Load tests are worth running before the release, not after. - **Plan for precautionary downtime.** Agencies advise isolating or taking offline what cannot be updated in time. Agree with stakeholders now who can make that call, how long it may last, and what users see meanwhile. - **Treat PHP 8.1 and older as a project.** There is no ready-made release for them. Moving to a supported version is a migration with its own scope and schedule. - **Expect a second round.** A report that the first fix may be incomplete is open. Keep a slot free in the next fortnight. ## Your reading path - Your briefing - Explained from scratch - If you run PHP - Impact: offline vs compromised - Timeline Choose *read as Taylor* and the bar under the menu keeps your place on every page. ### What this briefing covers - what unplanned work this creates - which systems and owners to chase - what to tell stakeholders about downtime - what changes after the fix ### What you can skip - the code - the bug classes - the detection rules ## The facts this rests on Show the 20 claims behind this briefing, each with its status and sources- confirmed two or more primary sources agree, or the fact was counted from a captured file - reported one party says so, and it has not been contradicted - disputed the sources disagree, and both readings are shown - contradicted a primary source says otherwise - unverified even the reporting outlet could not check it - p/n primary sources among the n cited; a blocked capture is counted and marked | Claim | Who says it | Status | Primary | Sources | |---|---|---|---|---| | If an immediate update is not feasible, take the system offline until it can be fully mitigatedX post 13:45:58Z 21 October (10.1 million views at capture) and the press release. | NSA Cybersecurity | confirmed | 2/2 | NSA Cyber on X NSA | | Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offline | CISA | confirmed | 1/1 | CISA | | Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 OctoberEvery vendor says the same two things: it is a stopgap, and patch anyway. | the vendors | confirmed | 5/5 | Cloudflare Imperva Threat Research Akamai Security Research Fastly Fortinet Community | | The risks require immediate patching across United States Government departments and agenciesNo CISA emergency directive was visible on the CISA home page at capture. | NSA | reported | 1/2 | NSA CISA | | 'Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated'That sentence is not on the NCSC page as captured at 08:09Z on 22 October. The page's offline advice is step 4 of 6 and is worded differently. The page was modified at 07:30Z that morning. The sentence's opening matches the Canadian CCCS text. | UK NCSC, as quoted by the BBC | disputed | 2/3 | BBC News NCSC UK CCCS | | The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking systems offline where patching is not feasibleAustralia's ACSC gives no offline advice. CERT-EU says isolate. The Netherlands, Italy, Japan and New Zealand give no offline advice. | BBC | contradicted | 4/6 | BBC News ACSC CERT-EU NCSC-NL ACN / CSIRT Italia JPCERT/CC | | Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCThe one documented case of government services being pulled from the public internet, from the agency itself. | CERT.LV | confirmed | 1/1 | CERT.LV | | No named organisation has confirmed a compromise through php2shellA negative finding as of the latest capture. Amazon says 'broadly exploited' against sensors; Weird Gloop expects old forums to have been hit; CISA has not listed either CVE. | this site, from every captured source | confirmed | 5/5 | CISA Huntress Imperva Threat Research Amazon Weird Gloop | | The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders | | Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of page views from cachePrimary, and the one outage with a measured cost. | Weird Gloop | confirmed | 1/1 | Weird Gloop | | Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlineNot captured from any of the named organisations. | BBC | reported | 0/1 | BBC News | | Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precaution | Yle; Helsinki Times, quoting Valtori | reported | 0/2 | Yle Helsinki Times | | The Wikimedia Foundation took down a number of systems 'as a precautionary measure until they can be safely patched'No Wikimedia-published statement captured. | the Foundation, as quoted by CNN and The Cyber Express | reported | 0/2 | CNN The Cyber Express | | Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a link | The Scotsman quoting the council | reported | 0/1 | The Scotsman | | Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident' | the council's social post, via Oxford Chronicle | reported | 0/1 | Oxford Chronicle | | Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors | LBC; Insurance Business | reported | 0/2 | LBC Insurance Business | | The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTCCounted from the repository, not from a page. Five authors; 389 files; 10,689 insertions. | php/php-src commit 3584a98bd, read from a clone | confirmed | 2/2 | php/php-src , read from a clone php-src | | The fixes were released at 14:00 UTC on 21 OctoberCERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. | php.net pre-announcement; Daubois; CERT-FR (16:00 Paris) | disputed | 7/8 | oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net | | The pre-announcement was published at 19:30 UTC on 20 OctoberThe php.net feed says 20:32 UTC; oss-security relayed it at 20:22:51 UTC, so it was public by then. | PHP Foundation | disputed | 3/3 | PHP Foundation oss-security php.net | | The flaws were disclosed on 22 October 2026Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z. | BBC framing (UK morning coverage) | contradicted | 2/3 | BBC News php.net php-src | Every sentence above rests on these rows. They are folded away because they are written in the sources' own vocabulary; the glossary explains each term. ## What is still open - Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post. No copy of that post is in the vault. - Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak. - Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits. - Which sites were really taken offline, and why. The BBC's list (parts of Wikipedia, Edinburgh council, French government services, the University of Geneva, the BBC itself) has not been captured from any of those organisations. Latvia's geo-blocking is the one documented case, from the agency itself. - Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. Nothing from PHP on the list yet. The full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Board member or executive · Security lead · PHP or platform engineer · Journalist · Security researcher · Analyst or policy advisor · CISO · CTO · CFO · Head of AppSec · Developer · Communications team. [Every section, across every release →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://updates.php.oct.2026.newsroom.sgit.ai/versions/briefing-pm/index.html