# The side stories of php2shell: what changed in v1.1.0, sgit.ai > The changes to the article "The side stories of php2shell" in v1.1.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [The side stories of php2shell](../../the-side-stories-of-php2shell.md) / [Versions](../the-side-stories-of-php2shell.md) / v1.1.0 # The side stories of php2shell: what changed in v1.1.0 From v1.0.0 (2026-10-25, `872f937d1`) to v1.1.0 (2026-10-27, `db67c5ce1`), paragraph by paragraph. 0 paragraphs added, 0 removed, 3 changed in place, 57 unchanged. About 0 words added and 121 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [all versions](../the-side-stories-of-php2shell.md) 2 unchanged paragraphs !shot sz-stories.webp | images/ | The side stories of php2shell, from the data the PHP site keeps:keeps,provenance;frombuildingprovenanceon a real problem; who corrects, and how; no named victim; detection and the WAF; the sites that went dark; follow the money; the flaws nobody watched; andto how much of it was AI. | concept 37 unchanged paragraphs, under In short {#in-short}, The data behind the side stories {#data}, Provenance {#provenance}… !shot sz-coverage.webp | images/ | How fast the coverage faded: sources in the PHP site's evidence vault holdsby4publicationsources published onday, 20 October, 117 on 21 October, 94 on 22 October, 34 on 23 October and 8 onto 24 October, of 418 sources, 53 with no date; the latest days are partly the capture lag.October. | comparison 2 unchanged paragraphs, under The flaws nobody watched {#nobody-watched} !shot sz-attention.webp | images/ | Attention against evidence, from the Pulse data: English-language news items over 30 days against the furthest step of evidence of exploitation. php2shell, 175 items, a public proof of concept and attempts reported, not on CISA's exploited list; Windows command injection, 40, on the list with attempts reported; BeyondTrust, 24; Ivanti, 23, on the list; a GitLab flaw rated 10.0, 22, no step reached; Zimbra, 16, on the list with a national CERT reporting compromises; SharePoint, 1, on the list with attempts reported. | comparison 16 unchanged paragraphs, under How much of it was AI? {#ai}, What this does not claim {#limits}, Where this comes from {#sources} [all versions](../the-side-stories-of-php2shell.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/the-side-stories-of-php2shell/v1.1.0.html)*