Home / Articles / The side stories of php2shell / Versions / v1.1.0
The side stories of php2shell: what changed in v1.1.0
From v1.0.0 (2026-10-25, 872f937d1) to v1.1.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 57 unchanged. About 0 words added and 121 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot sz-stories.webp | images/ | The side stories of php2shell, from the data the PHP site keeps:keeps, provenance;from buildingprovenance on a real problem; who corrects, and how; no named victim; detection and the WAF; the sites that went dark; follow the money; the flaws nobody watched; andto how much of it was AI. | concept
37 unchanged paragraphs, under In short {#in-short}, The data behind the side stories {#data}, Provenance {#provenance}…
!shot sz-coverage.webp | images/ | How fast the coverage faded: sources in the PHP site's evidence vault holdsby 4publication sources published onday, 20 October, 117 on 21 October, 94 on 22 October, 34 on 23 October and 8 onto 24 October, of 418 sources, 53 with no date; the latest days are partly the capture lag.October. | comparison
2 unchanged paragraphs, under The flaws nobody watched {#nobody-watched}
!shot sz-attention.webp | images/ | Attention against evidence, from the Pulse data: English-language news items over 30 days against the furthest step of evidence of exploitation. php2shell, 175 items, a public proof of concept and attempts reported, not on CISA's exploited list; Windows command injection, 40, on the list with attempts reported; BeyondTrust, 24; Ivanti, 23, on the list; a GitLab flaw rated 10.0, 22, no step reached; Zimbra, 16, on the list with a national CERT reporting compromises; SharePoint, 1, on the list with attempts reported. | comparison
16 unchanged paragraphs, under How much of it was AI? {#ai}, What this does not claim {#limits}, Where this comes from {#sources}