Home / Sections / Running story: php2shell

Section

Running story: php2shell

The two PHP flaws of October 2026, followed day by day, with every claim tied to a captured source. A running story: when it closes, it stays a section and stops being a band.

14 articles, newest first. Every article on this site is in exactly one of eight sections.

October 2026 14

• Who has not patched? · How good the "unpatched" numbers for php2shell are, what makes a website actually vulnerable, and why not patching can be the rational decision 27 Oct · 9 min
• The evidence behind four days · Jeremiah Grossman's php2shell post, checked claim by claim against the data, with the provenance and the graphs, and the two things that changed since 27 Oct · 16 min
• What the $2,000 bitcoin bounty actually proves · Php2shell's real timeline, whether a firewall could have seen it coming, and what hardening can and cannot do without the patch 26 Oct · 11 min
• PHP October 2026, update 4 · Still no confirmed victim, one repository becomes six, the main site moves to the new build, and the agents get faster tools (26 October, 17:16 UTC) 26 Oct · 12 min
• Who creates the original? · Mapping where the PHP story's data comes from, giving that map to the historian, and the places where we can make content nobody else has: our own counts, interviews and op-eds 25 Oct · 5 min
• The side stories of php2shell · Provenance, features built against a real problem, who corrects their reporting, a crisis with no named victim, the sites that went dark, the flaws nobody watched, and how much of it was AI 25 Oct · 11 min
• PHP October 2026, update 3 · A vendor withdraws the first claim of a break-in, a third flaw, a pipeline of agents that review each other, and a control room for all of it (24 October, 23:40 UTC) 25 Oct · 9 min
• Patch for breakfast · Nobody refuses to patch because they want to, a patch is surgery without tests and a pipeline, and why the PHP crisis is the moment to invest in being able to change 24 Oct · 6 min
• PHP October 2026, update 2 · The story held, a site that watches its own readers, agents on a schedule, and the decisions that wait on me (23 October, 23:30 UTC) 24 Oct · 11 min
• The false positives are the next incident · Jeremiah Grossman's warning about php2shell scanners, checked against what the evidence holds a day later 23 Oct · 8 min
• Who maintains the PHP you run? · A version signed off by the people who maintain it, buyers who require that signature, and money that flows down the chain: a follow-up to the maintenance deficit 23 Oct · 19 min
• PHP October 2026, at 8pm · Where the php2shell story stands, and a guided tour of the site that tracks it, built in one day by a team of agents from an evidence vault anyone can read 22 Oct · 14 min
• A desk anyone can open · The PHP story's work and who did it, nine names with their responsibilities, and an evidence vault anyone can now read, scanned before its key was published 22 Oct · 8 min
• Capture first · How a BBC live page at breakfast became an evidence vault, a section here and a site of its own by lunchtime, for a story that was still changing as we covered it 22 Oct · 13 min