v0.13.47: @newsroom.writer: PHP October 2026, at 8pm, updated at 22:15

PHP October 2026, at 8pm, updated with what changed on the story's site by 22:00 UTC (v0.5.5 to v0.6.0).

• Since 8pm. The compromise map: millions of attempts, three vendors reporting exploitation without a victim, one named organisation attacked with the attack stopped, none saying php2shell was the way in. The second fact-check run. A risk and compliance section with 34 risks mapped to 95 controls. 161 reading sessions.
• Two corrections. "No organisation has confirmed a break-in" is now "no named organisation has said it was broken into through these flaws", as the story's site reworded its own claim. And the incomplete-fix report had been answered by PHP's security team at 09:11 UTC on 22 October, before the 8pm article said it was open.
• The snapshot stays as it was at 8pm, for the next update to compare against.