# Views: the state of affairs and the journalist's analyses

> Story: written here by this site, signed and dated. By the journalist.

The journalist's living state of affairs, versioned with every change visible, and the dated analyses behind it.

# Views: the journalist's reading of where things stand

Two things, kept apart. **The state of affairs** is one living page: what is known now, with the measures that say so, rewritten whenever the evidence moves enough to matter. Every version is kept, and every change can be seen, measure by measure and line by line. **The analyses** are the journalist's dated stories, each written against one state of the evidence and kept as written.

## The state of affairs, now

[v3: The state of affairs on 24 October: a vendor withdraws the first claim of a break-in, banks report none, and the exploited list still does not have it24 October 2026, 12:30 UTC · Three days after the release, still no organisation has said it was compromised through php2shell. The one security vendor that had claimed a successful compromise, Sophos, withdrew it: its data showed scanning and a few failed attempts. US banks and the large crypto platforms report none, the Netherlands joins the authorities that have seen no attack succeed, and neither CVE was in CISA's exploited list at 05:53 UTC today.](state/index.html)

[Every version](state/history/index.html) · [what changed in the latest](state/v2-v3/index.html)

## The analyses
- [What changed in a day: no victim yet, four named cases tested, a patch moving through the supply chain, and firewalls on the list](https://php.oct.2026.newsroom.sgit.ai/articles/what-changed-in-a-day/) 2026-10-23
- [Why can't every version of PHP just be patched?](https://php.oct.2026.newsroom.sgit.ai/articles/why-not-patch-every-version/) 2026-10-22
- [Where php2shell stands: many sites dark, millions of attempts, no confirmed breach](https://php.oct.2026.newsroom.sgit.ai/articles/where-php2shell-stands/) 2026-10-22
- [Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit](https://php.oct.2026.newsroom.sgit.ai/articles/exposed-is-not-exploited/) 2026-10-22


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://updates.php.oct.2026.newsroom.sgit.ai/views/index.html