Organisations
Any organisation running unpatched PHP is exposed. These are the ones that took visible action — mostly precautionary outages, not confirmed breaches.
Last reviewed 2026-10-22
Offline does not mean hacked
None of the organisations below reported a compromise. Taking a service offline to patch is a cautious response to a critical bug, and a good sign. Only verified, sourced entries are listed; last checked 2026-10-22.
Took app.bamboohr.com and www.bamboohr.com offline at 11:51 UTC on 21 Oct as a precaution (US, Canada, Ireland data centres), warning that payroll would be interrupted. Fix applied by 15:03 UTC; validation was still running at 16:01 UTC. No breach reported.
Source: BambooHR status page
Taken offline as a precaution on 21 Oct. Logius said DigiD login kept working at other organisations. The NCSC said it had seen no abuse. Explains why the Netherlands leads search interest.
Source: NOS
WAF rules for all plans live at 03:02 UTC on 21 Oct; reports early attacks and payload mutation.
Source: Cloudflare blog
Published fixed PHP images at 07:41 UTC on 21 Oct, before the coordinated release.
Source: PHP Foundation
Not a PHP2Shell victim. A separate incident in the same news cycle: eight weak eMudhra intermediate CA private keys were recovered and disclosed on 20 Oct. Mozilla pushed OneCRL revocations; update browsers, trust stores (e.g. certifi 2026.10.19) and Go (1.27.3 / 1.26.10).
Source: Trilogy AI