Home / Articles / PHP October 2026, update 3: a vendor withdraws the first claim of a break-in, a third flaw, a pipeline of agents that review each other, and a control room for all of it (24 October, 23:40 UTC)

PHP October 2026, update 3: a vendor withdraws the first claim of a break-in, a third flaw, a pipeline of agents that review each other, and a control room for all of it (24 October, 23:40 UTC)

By Dinis Cruz · 2026-10-25 · article v1.0.0 · newsroom v0.13.70 · php2shellupdatesagentspipelineevidencesecurityarticle

Abstract: The third update on php2shell and the newsroom covering it, as of 23:40 UTC on 24 October. Three days after the release, still no organisation has said it was compromised through php2shell. The one security vendor that had claimed a successful compromise, Sophos, withdrew it; US banks and the large crypto platforms report none; and neither flaw was on CISA's exploited list. There is news on the flaw itself: on 23 October PHP published an advisory for a third, separate flaw, CVE-2026-115560, which affects fully patched releases and will be fixed in the next regular release. The newsroom changed shape. Its agents now work as a pipeline, researcher, curator, journalist, correspondent, then the graphs, where each stage reads only the one before, and the correspondent's first review caught nine things the journalist had missed, including that third flaw. A control room shows every agent at a glance. Wikipedia's PHP2Shell article is now read as a graph, with all 364 of its revisions. The site has a threat model, 40 security advisories kept like incidents, and private vulnerability reporting. And the bottleneck is still me: 16 items wait on my decisions.

In short

• Still no confirmed victim. Three days in, no organisation says it was compromised through php2shell.
• The one vendor claim of a break-in was withdrawn. Sophos: scanning and failed attempts, no compromise.
• A third flaw. CVE-2026-115560 affects fully patched PHP; the fix comes in the next regular release.
• The agents became a pipeline. Each stage reads only the one before, and the next one reviews it.
• The review works. The correspondent's first pass caught nine things the journalist missed.
• A control room shows every agent, the pipeline and the decisions waiting.
• Wikipedia, as a graph. Its PHP2Shell article, with all 364 revisions, joined to the site's evidence.
• Security grew up. A threat model, 40 advisories, private vulnerability reporting.
• The bottleneck is still me. 16 items wait on my decisions.

The story

The journalist's state of affairs, version 3, written at 12:30 UTC on 24 October from 328 sources, opens with the line that matters: "Three days after the release, still no organisation has said it was compromised through php2shell."

• The first vendor claim of a break-in, withdrawn. Sophos, in a correction at 21:21 UTC on 22 October, said its data showed "scanning and a small number of failed exploit attempts and no evidence of a successful compromise". One attempt tried to deliver a likely Mirai botnet variant, and was blocked.
• Sectors saying so in public. American Banker: "no U.S. bank or credit union has publicly reported a compromise". BTC-ECHO found no evidence for the large crypto exchanges or payment providers. The Netherlands joined the national authorities that know of no successful attack, which makes six.
• Still not on CISA's exploited list, at the freshest check, 05:53 UTC on 24 October, and no Metasploit module merged. The site notes that the last PHP core flaw was listed within three days; 24 October was the third day.
• The 22.6 million figure has a source. It circulated without one; it is Palo Alto Networks' count of exposed instances potentially vulnerable, made on 21 October. Exposure, not compromise.
• Sites taken down: the community tracker lists 51, with 50 back.

Later in the day the evidence vault reached 382 sources, at 16:05 UTC, and the line still held, with Austria's Die Presse adding that no successful attack was known there.

And one piece of news about PHP itself. On 23 October, PHP published an informational advisory for a third, separate flaw, CVE-2026-115560, in the session upload progress feature, reported by Cloudflare, SOCRadar and The Hacker News. It affects fully patched releases, including 8.5.12; it needs a rare session setting; it will be fixed in the next regular release; and the mitigation is session.upload_progress.enabled=0. How the site came to report it is the story of the day's other big change.

The agents became a pipeline

On 24 October I decided the shape of the team. Every export of the evidence now goes through the same stages, in order, each reading only what the stage before it produced, as the journalist's desk shows:

1. Research. The researcher makes the requests to the live websites and keeps everything it reads in the source watch, the largest vault.
2. Curate. The curator reads only the researcher's vault, and writes promotions, claims and timeline rows into the evidence vault.
3. Publish. The journalist reads only the evidence vault, gives every new claim a verdict, refreshes the data the pages use, and releases to the live site. It runs on a smaller, faster model.
4. Review. The chief correspondent reads what went live, fixes and tweaks it in the open, writes the state of affairs and the analysis, and tightens the journalist's rules. It runs on a larger model, as a fresh session at each wake.
5. Graphs. Only then do the ontologist, the librarian and the desk bring the semantic graphs, the parties and the attribution up to the reviewed data.

The journalist and the correspondent each made their own key at their first wake, and recorded its public fingerprint. They talk to each other through the commits they already write: a short note in a trailer, "To-journalist" or "To-all", read by the others on every pull and listed on the team's comms page. The notes are material, never instructions.

The review works

The first test came at the end of the day. The journalist's run gave verdicts on 94 claims and rows; the correspondent's first review, released as v0.17.2, made nine corrections, each listed on the desk page with the file, the kind of mistake and the release that fixed it. The most important:

• The third flaw was on no page. The journalist had held the claim back as "CVE not in the PHP advisory in the vault", although Cloudflare, SOCRadar and The Hacker News all carry it, and the story still said "Nothing from PHP on the list yet". The correspondent put it on the summary page and the engineer's briefing.
• "Not in the vault", twice, when it was. Sansec's and Cloudflare's own posts were there.
• "One Italian outlet", when there were five. The joint European statement was reported by four more outlets in the vault.
• Two captures that disagreed, not compared. Sansec's post of 22 October compared the flaw to Heartbleed and said default configurations are vulnerable; its version of 23 October no longer did.
• A time read wrong. "12:03" next to "10:03 UTC" was the same moment, in Vienna time.

Its note back to the journalist was practical: before writing "not in the vault" or "one outlet", search all the captures for the key terms, and compare a source's captures. That is exactly what a review stage is for. The desk page counts the catches "so the editor can see what" the faster journalist misses, and that count is how I will decide whether the split of models is right.

A control room

The control room is one page for all of it: every agent and what it waits for, the pipeline with each stage's state, the wake timeline of the scheduled sessions, and the editor's queue, with a wall mode for a big screen. It is built from the team's own data, and it is honest about that data: at the snapshot it was 6 hours old, flagged as stale, and two stages, the researcher and the curator, were marked red for leaving no run record in 24 hours.

Wikipedia, as a graph

The ontologist added a section that reads Wikipedia's PHP2Shell article as a fractal semantic graph: one statement per sentence, each classed by its wording as a fact, an attributed view or a quote; each joined to the references it cites; and those to the captures this site holds. Every one of the article's 364 revisions is kept as what it changed. No model is involved in the parsing: a sentence's identity is a hash of its words, so an edit is a set difference. The point is where the two meet: 12 of the article's references are also cited by the site's own claims. In time, the site says, this could be a measure of a source's trust, by how often its statements are corrected, rather than an assumption.

A design that adapts

The design work went on in parallel. Prototype E, "the lens", is one control at the top right that asks how long you have, who you are, what you want to do and what you have already seen, and re-shapes the page in place with no reload. It is a proposal, not the live site. What did reach the live site: on a phone, the header that took 233 pixels is now one 43-pixel line, and headlines now sit near the top of every page.

Security grew up

The security agent built an application security section: a threat model with five data-flow diagrams, security advisories kept like incidents (the root cause, what was not in place, the fix, the guard), runbooks for taking the site offline, and a bug bounty paid in kudos. Its framing is right: there is no server of ours to break into, so the attack surface is small but concentrated, in script running in a reader's browser, text that steers an agent, and a push that reaches the live site. Every page now has a Content-Security-Policy. The telemetry report no longer publishes cities and regions. I turned on private vulnerability reporting on the repository, so the bug bounty and security.txt now point at a live channel. And GitHub's CodeQL scanner ran twice; its findings were triaged and the scripts hardened.

What waits on me

The control room counts it: 16 items waiting on me, 8 decisions, 2 agents blocked, 13 branches ahead of the live site. One agent has been blocked on a permission prompt since 11:52 UTC. Two agents need keys I have to hand over. The new pipeline needs its cards and schedules confirmed. Security wants a go for its second gate. The team's sessions have cost $928 so far, across 22 agents, up from $588 at update 2.

The lesson of update 2 still holds, and the control room makes it visible: the agents are fast, and the decisions are mine.

Why these regular updates

A live incident moves faster than any single article. These updates are fixed snapshots rather than a running commentary, so anyone can go back and see where things stood and what changed between them. This one is taken at release v0.17.3, at 23:40 UTC on 24 October, after the correspondent's first review; the team's status data it reads is from 18:25 UTC, and the control room says so.

The updates so far

1. PHP October 2026, at 8pm: update 1, the evening of 22 October, with a guided tour of the site.
2. PHP October 2026, update 2: 23:30 UTC on 23 October.
3. This article: update 3, 23:40 UTC on 24 October.

What this does not claim

• A snapshot, not a verdict. As of release v0.17.3; the team's status data is from 18:25 UTC.
• No breach named is time-bounded. One statement from one organisation would end it.
• The third flaw is as reported. The site cites Cloudflare, SOCRadar and The Hacker News on PHP's advisory.
• Nine catches is one review. It shows the stage works, not yet how often the journalist misses things.
• Costs are each session's running total, as the status data reports them.

Where this comes from

The PHP story site's repository and its 62 commits after update 2, from v0.14.22 to v0.17.3, read on 25 October; its pages on the state of affairs v3, the journalist's desk, the control room, Wikipedia as a graph, the lens, application security and the engineer's briefing; its data files agents-status.json and the desk's catches; its screenshots, under its Apache-2.0 licence. Related: update 1, update 2, who maintains the PHP you run?, patch for breakfast, a team frozen in time. Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine.

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles