Home / Articles / PHP October 2026, at 8pm / Versions / v1.1.0
PHP October 2026, at 8pm: what changed in v1.1.0
From v1.0.0 (2026-10-22, c80b07273) to v1.1.0 (2026-10-22, 3ac1a9cd7), paragraph by paragraph.
9 paragraphs added, 0 removed, 4 changed in place, 58 unchanged. About 496 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
1 unchanged paragraph
Summary: At 8pm UK time on 22 October, this is where the php2shell story stands. The fix has been out since 21 October; sixteen agencies say install it; attackers are trying, in large numbers, and Amazon saw an attempt four days before the announcement; no named organisation has confirmedsaid ait break-in,was broken into through these flaws, and the US list of flaws known to be used in attacks still does not include these two. The Dutch inventory of affected software has 724 rows, and only 61 of them have a fix. And behind that update is something I want to show properly: php.oct.2026.newsroom.sgit.ai, a site built today, from 09:27 to 19:04 UTC, in 34 versions, by two people and thirteen agents. It reads an evidence vault of 184 sources and 177 dated captures, now public. It has a front page in plain English and fifteen briefings, 70 claims each graded by a fact-check desk, ten contradictions in a ledger, a graph of 209 nodes, the fix read in the code, the inventory hour by hour, every section versioned, a phone app, synthetic readers and eight vaults. This is a guided tour of it, with the versions of everything, so the next update can say exactly what changed.
1 unchanged paragraph
> Updated at 22:15 UTC. The story's site has moved from v0.5.5 to v0.6.0 since 8pm. What changed is in since 8pm: a map of the evidence on compromise, a second fact-check run that answers the incomplete-fix report, and a new risk and compliance section. Two lines below are corrected to match: no *named* organisation has said it was compromised through these flaws, and the incomplete-fix report was answered that morning.
3 unchanged paragraphs, under In short {#in-short}
• No confirmednamed break-incompromise yet. And the US list of exploited flaws does not include these two.
11 unchanged paragraphs, under Where the story stands at 8pm {#stands}
• Compromise. No named organisation hashad confirmedsaid it was broken into through these flaws, in anything the vault hashad captured. At 19:00 the US government's catalogue of known exploited vulnerabilities still did not list either flaw; its latest edition was released at 14:04 UTC on 21 October.
5 unchanged paragraphs, under What we still do not know {#unknown}
• Whether the fix is complete.complete: since answered.** A relayed report on 21 October suggested it may not be;be. At 8pm the fact-check desk gradesgraded it "not shown"; its second run found that "notPHP's shown".security team had answered it publicly at 09:11 UTC that morning: an unrelated crash bug, nothing to do with the remote code execution. I should have caught that at 8pm.
22 unchanged paragraphs, under A site built in one day {#day}, The tour {#tour}
Since 8pm {#since}
[figure ay-layers.webp] From attempts to a named compromise, as of 20:50 UTC on 22 October: millions of attempts; three security vendors reporting exploitation without naming a victim; one named organisation saying it was attacked, with the attack stopped; and none saying php2shell was the way in. | comparison
By 22:00 the story's site had gone from v0.5.5 to v0.6.0, in five more versions. The ones that change the story:
• The compromise map (v0.5.9, 21:06 UTC). A page of its own for one statement: "No named organisation has said it was compromised through php2shell", as of 20:50 UTC. It searched the evidence vault's 184 sources, 773 pages watched hourly from 474 publishers in 57 countries, 3,444 news items and 295 named sites probed every 30 minutes. It found millions of attempts; three vendors, Hadrian, Patchstack and Amazon, reporting exploitation without naming a victim; one named organisation, the Czech Technical University, saying it faced an attack that was stopped; one Japanese company reporting a break-in without a cause; another that blamed the PHP flaw and then corrected itself; and none saying php2shell was the way in. The site moved its own claim from "confirmed" to "reported", because it is "a time-bounded absence, not a confirmed fact". I take this further, with three readings of the silence, in application behaviour policies.
• The second fact-check run (v0.5.8, 20:58 UTC). It found the PHP security team's public answer to the incomplete-fix report, opened an eleventh contradiction, and recorded that the US catalogue still lists neither flaw. When I checked at 22:09 UTC, its latest edition was still the one released at 14:04 UTC on 21 October.
• Risk and compliance (v0.6.0, 21:44 UTC). A new section with risk registers for php2shell: 34 risks assigned to 53 stakeholders, each joined to its weakness, CVE, fix and code, and mapped to 95 controls in 20 frameworks, from GDPR and NIS2 to ISO 27001. A data protection officer joins the readers, with a briefing on the GDPR 72-hour clock.
• Readers. The telemetry lane counted 235 anonymous events from 161 sessions by 20:35 UTC, against 120 from 74 in the afternoon.
The snapshot below stays as it was at 8pm; the next update will compare against it.
15 unchanged paragraphs, under A map for the next update {#map}, What the day showed {#lessons}, What this does not claim {#limits}…