The state of affairs: every version

v3 · 24 October 2026, 12:30 UTC

The state of affairs on 24 October: a vendor withdraws the first claim of a break-in, banks report none, and the exploited list still does not have it

Three days after the release, still no organisation has said it was compromised through php2shell. The one security vendor that had claimed a successful compromise, Sophos, withdrew it: its data showed scanning and a few failed attempts. US banks and the large crypto platforms report none, the Netherlands joins the authorities that have seen no attack succeed, and neither CVE was in CISA's exploited list at 05:53 UTC today.

What changed from v2 →

v2 · 23 October 2026, 23:55 UTC

The state of affairs at the end of 23 October: still no named victim, and the advice turns from patching to looking for break-ins

Sixty-eight more sources, read by the curator, change none of the measures that matter most: no organisation has confirmed a compromise through php2shell, and neither CVE is in CISA's exploited list at this desk's last check. What moved is the advice. Singapore and Luxembourg now tell operators to check whether they were already broken into, and the first national count of servers still affected after the fix is in: about 3.5% in Switzerland.

What changed from v1 →

v1 · 23 October 2026, 14:11 UTC

The state of affairs on 23 October: still no named victim, three open cases, a patch that is reaching servers, and firewalls in the blast radius

Two days after the release, no organisation has confirmed a compromise through php2shell, and of four named incidents linked to it, one was retracted and three are unresolved. Fixes are moving through the supply chain: the NCSC-NL inventory went from 46 fixed products to 109 overnight. Ten security and network products are confirmed vulnerable.

What changed from v0 →

v0 · 22 October 2026, 11:34 UTC · reconstructed

The state of affairs on 22 October, as the site then stood

Reconstructed, not written at the time: what this site published with data as of 11:34 UTC on 22 October, so that the first real version has something to be compared with.