{ "schema": "sgit.newsroom.factcheck/1", "desk": "factcheck@php.newsroom", "levels": [ { "code": "A0", "n": 0, "name": "Unsupported", "means": "No capture carries it, or the cited capture does not say it" }, { "code": "A1", "n": 1, "name": "Weak signal", "means": "Second hand, unnamed, blocked, or only partly carried by its capture" }, { "code": "A2", "n": 2, "name": "Reported", "means": "One named party says it, in a capture this desk checked" }, { "code": "A3", "n": 3, "name": "Echoed", "means": "Several outlets say it, tracing to one origin" }, { "code": "A4", "n": 4, "name": "Corroborated", "means": "Two or more independent parties say it, at least one checked in a capture" }, { "code": "A5", "n": 5, "name": "Confirmed", "means": "Two or more independent primary sources say it, each checked in a capture" }, { "code": "A6", "n": 6, "name": "Established", "means": "The authoritative primary record carries it, or this site counted it from a captured file" } ], "kinds": [ "record", "event", "state", "count", "quote", "attribution", "reading", "advice" ], "verdicts": [ "holds", "holds-in-part", "not-shown", "refuted" ], "tensions": [ "none", "measures-differently", "disputed", "contradicted", "superseded" ], "tension_cap": { "contradicted": 1, "disputed": 2 }, "assessments": [ { "id": "ac-high", "claim_hash": "ffa2f16a4ea6eb8c", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111906Z", "status_fit": "overstated", "reason": "The CVSS half is a record (AC:H in the CVE record, A6). The 'much easier' half is Imperva's characterisation, supported by Fastly (single-request trigger; RCE needs binary layout knowledge) and the advisory's reliability caveats; as a reading it caps at A3, so 'confirmed' overstates the claim as a whole.", "checked": [ { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "It’s worth noting that the attack complexity in both vulnerabilities is high", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "Triggering the bug is much easier than turning it into code execution.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "partial", "excerpt": "most deployments may be “safe” from RCE. Do not assume this holds true for you.", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "carries", "excerpt": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "outside_citation": false } ], "quotes_checked": [ { "quote": "most deployments may be safe from RCE. Do not assume this holds true for you.", "found": false, "where": "fastly-blog-php2shell" } ], "tickets": [ "Finding-53", "Finding-56" ], "mode2": "", "display": 3, "stale": false }, { "id": "affected-sites", "claim_hash": "02e44d4ce92fe97e", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080559Z", "status_fit": "ok", "reason": "Every element is carried by the BBC live page, but Edinburgh council, online stores, the BBC itself and the University of Geneva are only in the 07:55Z raw copy (summary bullet and header-image alt text), not in the cited 08:05Z text capture. One named secondary party, so A2; the vault holds independent and operator captures that raise most items (Wikipedia, Edinburgh, French prefectures, UNIGE) but not \"online shops\".", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "Wikipedia also took down parts of its website", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "Government websites are down around the world, including France, due to the exposure", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/raw/page.2026-10-22T0755Z.html", "sha256": "fe32274b64ee109a7e37fc4c26e37e793dc22481a6122888782c393e01102488", "result": "carries", "excerpt": "Among the impacted sites are Wikipedia, Edinburgh council, many online stores and the BBC", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/raw/initial-data.json", "sha256": "ee7445a58187bcd67df827007a8100941993a24dc3e7eea7e8a45f723a9e3305", "result": "carries", "excerpt": "the university of geneva's website shows an error message that says it is down for maintenance.", "outside_citation": false }, { "source": "unige-site", "file": "sources/unige-site/captures/20261022T081909Z/text.txt", "sha256": "4bdf3d6eb3f0d3b621b80a040ea09917da9c7b4a435f5ab1d995009e57ed3e92", "result": "carries", "excerpt": "The requested service is under maintenance for the moment.", "outside_citation": true }, { "source": "fr-prefecture-nord-down", "file": "sources/fr-prefecture-nord-down/captures/20261022T081940Z/text.txt", "sha256": "72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678", "result": "carries", "excerpt": "Maintenance en cours\nNotre site sera à nouveau accessible d'ici quelques instants.", "outside_citation": true }, { "source": "fr-prefecture-rhone-down", "file": "sources/fr-prefecture-rhone-down/captures/20261022T081939Z/text.txt", "sha256": "72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678", "result": "carries", "excerpt": "Maintenance en cours\nNotre site sera à nouveau accessible d'ici quelques instants.", "outside_citation": true }, { "source": "actu17-prefectures", "file": "sources/actu17-prefectures/captures/20261022T081432Z/text.txt", "sha256": "84edb7f59b55a5ce64bf9458671e49987b9e48e0e8388039de616a4c8c1e534d", "result": "carries", "excerpt": "Les sites internet des préfectures, dont celui de la préfecture de police, sont inaccessibles depuis ce mercredi 21 octobre.", "outside_citation": true }, { "source": "uk-edinburgh-council", "file": "sources/uk-edinburgh-council/captures/20261022T081940Z/text.txt", "sha256": "eef60737c49dfded7a4cf9d305998ac3db3278cf7683c33adb852be709ee3b97", "result": "absent", "excerpt": null, "outside_citation": true }, { "source": "wikimediastatus-page", "file": "sources/wikimediastatus-page/captures/20261022T081850Z/text.txt", "sha256": "13e068d2c2b3665d1ad67a02da3752c77bb617ab952507f4cbc16168b0e1a72f", "result": "absent", "excerpt": "All Systems Operational", "outside_citation": true }, { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "partial", "excerpt": "Edinburgh council’s website and pages for BBC programmes, including Doctor Who and The Traitors, also went dark, though neither has confirmed a PHP link.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-6", "Evidence-11", "Evidence-18", "Evidence-3", "Evidence-4", "Finding-22", "Finding-23", "Finding-57", "Gap-1" ], "mode2": "Capture the BBC page again and the University of Geneva, Wikimedia (Phabricator incident or status history for 21 Oct) and BBC programme pages own statements; an archived snapshot of edinburgh.gov.uk on the evening of 21 Oct would settle the Edinburgh outage directly.", "display": 2, "stale": false }, { "id": "ahead-of-attackers", "claim_hash": "59f673170219e4fa", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T081645Z", "status_fit": "ok", "reason": "OpenAI's post carries the sentence, but with the qualifier 'to our knowledge' that the claim drops. As a reading it rests on one interested party; the only counter-evidence (Amazon's 17 October honeypot hit) reaches the vault second-hand via The Hacker News, and it shows attackers had exploit information before disclosure, not before AI found the bug.", "checked": [ { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "partial", "excerpt": "it remains unclear how the actor acquired exploit information prior to disclosure.", "outside_citation": false } ], "quotes_checked": [ { "quote": "to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare", "found": true, "where": "x-openai-php2shell" } ], "tickets": [ "Finding-58", "Finding-7" ], "mode2": "Capture Amazon's own post (AWS Security Blog or CJ Moses on LinkedIn) on the 17 October MadPot hit.", "display": 2, "stale": false }, { "id": "ai-found", "claim_hash": "c9aaa180db69e506", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T081645Z", "status_fit": "ok", "reason": "That AI was used is said by each research party in its own capture (Calif, Wiz, OpenAI), but 'found by researchers using frontier AI under Patch the Planet' is a reading: Calif is the only finder shown to be under Patch the Planet, Calif never says 'frontier' and stresses generally available models, and Wiz never mentions Patch the Planet. Readings cap at A3.", "checked": [ { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "partial", "excerpt": "OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "The vulnerabilities were found by researchers at the security firms Calif and Wiz.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem", "outside_citation": false } ], "quotes_checked": [ { "quote": "No special harness, or access to models that weren't generally available to everyone were used", "found": true, "where": "calif-php2shell" } ], "tickets": [ "Finding-1", "Finding-59" ], "mode2": "Capture openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ (blocked by Cloudflare) for OpenAI's own naming of the model and of who was under Patch the Planet; ask Wiz whether its work was part of Patch the Planet.", "display": 3, "stale": false }, { "id": "amazon-honeypot", "claim_hash": "f893a4f684799232", "run": "Run-5", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds-in-part", "tension": "superseded", "contradictions": [ "K-002" ], "volatile": true, "as_of": "20261023T160435Z", "status_fit": "ok", "reason": "The quoted words were Amazon's in its post as captured at 11:17 UTC on 22 October. Amazon revised the sentence at 21:25 UTC that day, without a note, to 'now seeing broad exploitation attempts in the wild'; the vault's 23 October capture carries the new wording. The claim gives the first wording as Amazon's without its date. The rest (17 October honeypot hit, PoC attempts from 02:00 UTC on 21 October) holds as Amazon wrote it; one party, A2.", "checked": [ { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "The exploit attempt originated from an IP address associated with a commercial anonymization network.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "multiple proof of concept exploits for the vulnerability, with the earliest around 2026-10-21 0200 UTC.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "carries", "excerpt": "as the flaws come under broad exploitation in the wild following the release of the patches.", "outside_citation": false }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "partial", "excerpt": "The exploits being sprayed indiscriminately either don’t work at all, test for timing-based differences, or crash the target,", "outside_citation": true }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261023T160435Z/text.txt", "sha256": "4108b2850c48a8f2141f05996ef7e7ed115a0a0f80ce697b3d237b8d13e7c764", "result": "partial", "excerpt": "PHP2Shell is now seeing broad exploitation attempts in the wild.", "outside_citation": false } ], "quotes_checked": [ { "quote": "PHP2Shell is now being broadly exploited in the wild", "found": true, "where": "aws-security-blog-madpot" }, { "quote": "it's unclear if any of these attempts would have succeeded in real-world systems (capture has a typographic apostrophe: it’s)", "found": true, "where": "aws-security-blog-madpot" } ], "tickets": [ "Contradiction-2", "Evidence-12", "Finding-122", "Finding-126", "Finding-14", "Finding-60" ], "mode2": "An archived early copy of the AWS post (Wayback) to date the 'broadly exploited' sentence; any Amazon count or named victim behind 'broadly exploited'.", "display": 2, "stale": false }, { "id": "cf-millions", "claim_hash": "9ee30cc6607f1e7c", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "measures-differently", "contradictions": [], "volatile": true, "as_of": "20261022T111808Z", "status_fit": "ok", "reason": "Prince's own post carries all four figures and the 01:25 UTC time (UTC browser); the counter and date are known, the population is 'attempts across the Cloudflare network', but the method (what counts as an attempt: rule matches, requests, deduplication) is not stated, so A2 is the ceiling. SecurityWeek, the EADT and Tagesspiegel only repeat it.", "checked": [ { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "carries", "excerpt": "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.", "outside_citation": false }, { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "carries", "excerpt": "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.", "outside_citation": false }, { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "carries", "excerpt": "1:25 · 22 Oct 2026", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "absent", "excerpt": "During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.", "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-61" ], "mode2": "A Cloudflare Radar or blog post giving the counting method (WAF rule matches per request, unique sources) and a time series.", "display": 2, "stale": false }, { "id": "chainguard", "claim_hash": "41312071189761e7", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T113204Z", "status_fit": "ok", "reason": "The act and time (built images with the fix at 07:41 UTC on 21 October) are the Foundation's and Lorenc 'doesn't dispute the timeline' (The Register). 'Unilaterally broke the embargo' is the Foundation's reading; Lorenc says exploits were in the wild and he notified the coordinated disclosure channel first, which contests 'unilaterally'. Feross and The Hacker News restate the Foundation (one origin).", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images", "outside_citation": false }, { "source": "theregister-php-blames-chainguard", "file": "sources/theregister-php-blames-chainguard/captures/20261022T113204Z/text.txt", "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "result": "partial", "excerpt": "late Tuesday night Lorenc told us he decided to ship the fixes, and notified the PHP coordinated disclosure channel about his plans.", "outside_citation": false }, { "source": "x-feross-chainguard", "file": "sources/x-feross-chainguard/captures/20261022T112105Z/text.txt", "sha256": "de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6", "result": "partial", "excerpt": "Dan Lorenc says several vendors in the disclosure had reported exploits in the wild, and that he notified the group right after making the call.", "outside_citation": false }, { "source": "therecord-php-foundation-statement", "file": "sources/therecord-php-foundation-statement/captures/20261022T113158Z/text.txt", "sha256": "28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e", "result": "partial", "excerpt": "Dan Lorenc told Recorded Future News that he began to see exploitation attempts last night and made the judgement call to release the information.", "outside_citation": false } ], "quotes_checked": [ { "quote": "I made the call to get these out early when exploits hit in the wild", "found": false, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Finding-10", "Finding-62" ], "mode2": "Capture Chainguard's image publication record (registry timestamps) and Lorenc's own posts (LinkedIn, Hacker News); ask the PHP distros list for the notification message time.", "display": 2, "stale": false }, { "id": "cisa-none", "claim_hash": "8cb9302544e7fb1f", "run": "Run-1", "mode": "vault", "kind": "state", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081601Z", "status_fit": "ok", "reason": "The CISA alert itself carries the dated negative and the captured KEV JSON (catalogVersion 2026.10.21, 1754 entries, counted by this desk) contains neither CVE; the CVE record's CISA ADP SSVC also says Exploitation none at 14:34Z on 21 Oct. All three are CISA, one party, but each is the authoritative record for what it says.", "checked": [ { "source": "cisa-alert-php-20261021", "file": "sources/cisa-alert-php-20261021/captures/20261022T081353Z/text.txt", "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "result": "carries", "excerpt": "While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.", "outside_citation": false }, { "source": "cisa-kev-json", "file": "sources/cisa-kev-json/raw/known_exploited_vulnerabilities.20261022T0816Z.json", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/raw/cveawg-api.json", "sha256": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "absent", "excerpt": null, "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-2", "Evidence-1", "Evidence-10", "Evidence-18", "Evidence-6", "Finding-13", "Finding-63" ], "mode2": "A fresh fetch of the KEV JSON (and the CISA alert page, for any update line) on each run; the first KEV entry for either CVE settles it.", "display": 6, "stale": false }, { "id": "cloudflare-traffic", "claim_hash": "c763f6673b8cabe5", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081216Z", "status_fit": "ok", "reason": "Cloudflare's own post carries both halves nearly verbatim; one named party. Echoes (The Hacker News, SentinelOne) trace to the same post.", "checked": [ { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "carries", "excerpt": "Cloudflare has observed attack traffic targeting its customers, with threat actors \"mutating the attack payload to try to bypass our protections", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-64" ], "mode2": "Cloudflare's changelog or a follow-up post with dates and volumes of matched requests.", "display": 2, "stale": false }, { "id": "cvss-10", "claim_hash": "b8db1791ef083882", "run": "Run-1", "mode": "vault", "kind": "record", "level": 0, "verdict": "refuted", "tension": "contradicted", "contradictions": [ "K-007" ], "volatile": false, "as_of": "20261022T081256Z", "status_fit": "ok", "reason": "The CVE records (the authoritative record for the score) give 9.2 under CVSS 4.0 for both flaws, and the PHP Foundation names 10.0 as a wrong score from the leak. The statement is refuted; the site's status 'contradicted' matches.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2).", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "Florian Roth’s post, as Phoenix Security relayed it, said CVSS 10.0, and Cyber Daily reported watchTowr saying the same, while PHP’s own notice says 9.2.", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "carries", "excerpt": "9.2\tCRITICAL\t4.0", "outside_citation": false }, { "source": "cve-cve-2026-109619", "file": "sources/cve-cve-2026-109619/captures/20261022T081219Z/text.txt", "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "result": "carries", "excerpt": "9.2\tCRITICAL\t4.0", "outside_citation": false }, { "source": "thehackernews-php2shell-unpatched-alert", "file": "sources/thehackernews-php2shell-unpatched-alert/captures/20261022T113144Z/text.txt", "sha256": "33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b", "result": "carries", "excerpt": "The CVSS 10.0 figure is the leak's. PHP's rating is 9.2 on version 4.0 of the scale.", "outside_citation": false } ], "quotes_checked": [ { "quote": "a wrong CVSS score of 10.0 (the actual score is 9.2)", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Contradiction-7", "Finding-65" ], "mode2": "", "display": 0, "stale": false }, { "id": "disclosure-22oct", "claim_hash": "c7544df120e19b27", "run": "Run-1", "mode": "vault", "kind": "event", "level": 0, "verdict": "refuted", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T081658Z", "status_fit": "ok", "reason": "The primary records date the disclosure to 21 October UTC: GHSA published 13:34:25Z, tags 13:35:38 UTC, CVE records 13:48:34Z and 13:54:43Z, GitHub release 14:06:46Z, php.net '21 Oct 2026'. '22 October' is only right in Australian or Japanese local time (ACSC: 0100 AEDT on 22 October). The BBC capture never states a disclosure date, so the attribution to the BBC is not carried.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "absent", "excerpt": "Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "carries", "excerpt": "It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "github-php-src-tag-php-8.5.12", "file": "sources/github-php-src-tag-php-8.5.12/captures/20261022T081558Z/rendered.html", "sha256": "330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa", "result": "carries", "excerpt": "datetime=\"2026-10-21T14:06:46Z\"", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/rendered.html", "sha256": "79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110", "result": "carries", "excerpt": "datetime=\"2026-10-21T13:34:25Z\"", "outside_citation": false }, { "source": "github-php-src-tags", "file": "sources/github-php-src-tags/captures/20261022T081558Z/rendered.html", "sha256": "ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9", "result": "carries", "excerpt": "datetime=\"2026-10-21 13:35:38 UTC\"", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/raw/cveawg-api.json", "sha256": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1", "result": "carries", "excerpt": "\"datePublished\":\"2026-10-21T13:48:34.845Z\"", "outside_citation": false }, { "source": "acsc-alert-php", "file": "sources/acsc-alert-php/captures/20261022T081658Z/text.txt", "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "result": "partial", "excerpt": "with full details publicly announced on Thursday 22 October 2026 at 0100 AEDT.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "Apply the Oct 22 security release immediately", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-38", "Finding-66" ], "mode2": "", "display": 0, "stale": false }, { "id": "edinburgh", "claim_hash": "d10da2ddd74f869f", "run": "Run-1", "mode": "vault", "kind": "event", "level": 3, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112150Z", "status_fit": "ok", "reason": "The Scotsman carries the outage, the council's \"essential maintenance\" and that it had not confirmed a link; the Edinburgh Evening News piece is the same reporter and text (one origin, A3), while LBC, Insurance Business, The Cyber Express and the BBC raw copy independently report the outage. \"Late on 21 October\" loosely renders \"late on Wednesday afternoon\".", "checked": [ { "source": "scotsman-edinburgh-council-offline", "file": "sources/scotsman-edinburgh-council-offline/captures/20261022T112150Z/text.txt", "sha256": "fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6", "result": "carries", "excerpt": "A council spokesperson said the website was down for “essential maintenance”, however they are yet to confirm whether it is linked", "outside_citation": false }, { "source": "scotsman-edinburgh-council-offline", "file": "sources/scotsman-edinburgh-council-offline/captures/20261022T112150Z/text.txt", "sha256": "fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6", "result": "carries", "excerpt": "The website went down late on Wednesday afternoon", "outside_citation": false }, { "source": "edinburghnews-council-offline", "file": "sources/edinburghnews-council-offline/captures/20261022T081124Z/text.txt", "sha256": "ec7b1d470016d4f655c747a0bcd2b1f77d65d6b3d9e69ccf0386e948a34178e0", "result": "carries", "excerpt": "A council spokesperson said the website was down for “essential maintenance” however they did not confirm whether it was connected to the recently discovered vulnerabilities.", "outside_citation": true }, { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "partial", "excerpt": "Edinburgh and Oxford Council as well as the online home for The Traitors were taken down as was The Met Police website.", "outside_citation": false }, { "source": "uk-edinburgh-council", "file": "sources/uk-edinburgh-council/captures/20261022T081940Z/text.txt", "sha256": "eef60737c49dfded7a4cf9d305998ac3db3278cf7683c33adb852be709ee3b97", "result": "absent", "excerpt": null, "outside_citation": true } ], "quotes_checked": [ { "quote": "essential maintenance", "found": true, "where": "scotsman-edinburgh-council-offline" }, { "quote": "waiting on an update from our provider", "found": true, "where": "scotsman-edinburgh-council-offline" } ], "tickets": [ "Finding-67" ], "mode2": "A council statement or news release on the outage and restoration, or a web archive snapshot of edinburgh.gov.uk on the evening of 21 Oct.", "display": 3, "stale": false }, { "id": "fi-offline", "claim_hash": "6ac00a5b9c3208da", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113225Z", "status_fit": "ok", "reason": "Helsinki Times carries Valtori restricting incoming public traffic from 12:45 local as a preventive measure; Yle (STT copy) and the Reuters factbox corroborate the precautionary Valtori shutdown but not the 12:45 time. The time rests on one secondary outlet, so A2; status \"reported\" fits.", "checked": [ { "source": "helsinkitimes-finland-shutdown", "file": "sources/helsinkitimes-finland-shutdown/captures/20261022T112845Z/text.txt", "sha256": "524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118", "result": "carries", "excerpt": "Valtori, began restricting incoming public internet traffic at 12.45 pm local time to protect government systems against potential cyberattacks.", "outside_citation": false }, { "source": "helsinkitimes-finland-shutdown", "file": "sources/helsinkitimes-finland-shutdown/captures/20261022T112845Z/text.txt", "sha256": "524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118", "result": "carries", "excerpt": "Valtori stressed that the shutdowns were preventive measures rather than a response to a confirmed cyberattack or data breach.", "outside_citation": false }, { "source": "yle-finland-government-sites-shut", "file": "sources/yle-finland-government-sites-shut/captures/20261022T113225Z/text.txt", "sha256": "720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57", "result": "partial", "excerpt": "Finland's public internet web services were being taken offline on Wednesday as a precautionary move against a critical security vulnerability", "outside_citation": false }, { "source": "yle-finland-government-sites-shut", "file": "sources/yle-finland-government-sites-shut/captures/20261022T113225Z/text.txt", "sha256": "720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57", "result": "partial", "excerpt": "According to Valtori, services began being shut down in the early afternoon.", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "partial", "excerpt": "State IT centre Valtori shut down the government's public web services on Wednesday as \"a precautionary measure.\"", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-68" ], "mode2": "Valtori's own bulletin (valtori.fi) or NCSC-FI (Traficom) statement with the 12:45 time and the restoration time.", "display": 2, "stale": false }, { "id": "fix-authored", "claim_hash": "a9e9b0c99809360d", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112225Z", "status_fit": "ok", "reason": "The git output in the vault carries every time in the claim: author date 2026-10-18T17:26:39+02:00 (15:26:39Z), committer date 2026-10-21T16:06:22+02:00 (14:06:22Z), and Ilija Tovilo's merges 8.2 into 8.3 at 14:12:35Z, 8.3 into 8.4 at 14:27:03Z, 8.4 into 8.5 at 14:30:04Z, plus 389 files, +10689, five authors. 'Entered the public branches at 14:06' reads a committer timestamp as a push time, which git does not record.", "checked": [ { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.stat.txt", "sha256": "0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4b", "result": "carries", "excerpt": "author: Arnaud Le Blanc 2026-10-18T17:26:39+02:00", "outside_citation": false }, { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.stat.txt", "sha256": "0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4b", "result": "carries", "excerpt": "389 files changed, 10689 insertions(+), 976 deletions(-)", "outside_citation": false }, { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/merge-path-3584a98bd-to-PHP-8.5.txt", "sha256": "81c3025511c2f4744d1fcbe1d18fe7da97cfd68b005a6a883efc229a3c91193f", "result": "carries", "excerpt": "c1a5f468d09fc4afc5d738872d5b1d4e87ff1e39 2026-10-21T16:12:35+02:00 2026-10-21T16:12:35+02:00 Ilija Tovilo Merge branch 'PHP-8.2' into PHP-8.3", "outside_citation": false }, { "source": "github-php-src-tag-php-8.5.12", "file": "sources/github-php-src-tag-php-8.5.12/captures/20261022T081558Z/text.txt", "sha256": "3fa0b4ca147ee06698f340ee959bf381aee7c0fda597bd687ff1f128f4978799", "result": "absent", "excerpt": "The PHP development team announces the immediate availability of PHP 8.5.12.", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "Fix PR opened: 2026-09-25, final commit 01a40e89fbfc authored 2026-10-18", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-41", "Finding-69" ], "mode2": "GitHub's push events or the PR merge record for the fix (who merged it and when), to settle when it became public.", "display": 6, "stale": false }, { "id": "fix-bailout", "claim_hash": "d8ff29e16da933a7", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081558Z", "status_fit": "ok", "reason": "GHSA-w8hw's Mitigation section states the mechanism in nearly these words, the php.net ChangeLog carries the exact line for all four releases, and the 7.4 branch commit carries the same title. Primary records carry all of it.", "checked": [ { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "It is replaced with a delayed, graceful soft OOM triggered at the next VM safe point, and an immediate hard OOM using _exit()", "outside_citation": false }, { "source": "php-net-changelog-8", "file": "sources/php-net-changelog-8/captures/20261022T081558Z/text.txt", "sha256": "e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70", "result": "carries", "excerpt": "Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).", "outside_citation": false }, { "source": "github-php-src-branch-7.4-backport", "file": "sources/github-php-src-branch-7.4-backport/captures/20261022T081558Z/text.txt", "sha256": "bd71e98ee89b7c6ca97f0ec6029e0200f86d26f2528387a96c99ac93ea63dc1f", "result": "carries", "excerpt": "Avoid state corruption via bailout", "outside_citation": false } ], "quotes_checked": [ { "quote": "Avoid state corruption via bailout", "found": true, "where": "php-net-changelog-8" } ], "tickets": [ "Finding-70" ], "mode2": "", "display": 6, "stale": false }, { "id": "fix-engine", "claim_hash": "f383e3ffa94b4d29", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081558Z", "status_fit": "ok", "reason": "The fix commit itself (read from a clone, raw patch hashed in the vault) says 'Replace bailout on OOM with UnwindExit' and 'Properly reset various globals that may be accessed during startup', and removes zend_bailout() from the allocator; the two advisories describe the same two mechanisms. The authoritative record carries it.", "checked": [ { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.engine-main-session.patch", "sha256": "26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84", "result": "carries", "excerpt": "- Replace bailout on OOM with UnwindExit\n - Properly reset various globals that may be accessed during startup", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-71" ], "mode2": "", "display": 6, "stale": false }, { "id": "fix-incomplete", "claim_hash": "9202cc09588158e9", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 1, "verdict": "not-shown", "tension": "disputed", "contradictions": [ "K-011" ], "volatile": true, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "The only carrier is a relay on oss-security of unnamed Fediverse posts ('While not yet fully confirmed'), not captured themselves; PHP is reported second-hand to have called it unrelated. Second-hand and unconfirmed is A1, and nothing shows the fix is incomplete; 'unverified' fits.", "checked": [ { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-16.html", "sha256": "6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccf", "result": "partial", "excerpt": "While not yet fully confirmed, the Fediverse is reporting that the fix\nto at least PHP 8.5.12 may be incomplete:", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-17.html", "sha256": "059317aa4a1f458e19196e6add44a6b3106632b82c82f104a5b83d0df6fbe09f", "result": "partial", "excerpt": "ok thinking more about this, there's no way this is the same vuln, this is\n> another one.", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-23.html", "sha256": "39555f34a419becc6a47480eabb369e05f4bac6ce06e9e3843e4dfcb5c99801b", "result": "partial", "excerpt": "was told that it's \"unrelated and not a\nreal issue\".", "outside_citation": false } ], "quotes_checked": [ { "quote": "was told that it's unrelated and not a real issue", "found": false, "where": "openwall-oss-security-109619-thread" } ], "tickets": [ "Contradiction-11", "Evidence-5", "Evidence-7", "Evidence-8", "Finding-125", "Finding-72", "Gap-2" ], "mode2": "Capture fedi.katze.sh/@elise/117479383739450605 and 117478655339557825, and any PHP security team reply on the oss-security thread or a php-src issue/GHSA addressing an 8.5.12 regression or new bug.", "display": 1, "stale": false }, { "id": "four-reporters", "claim_hash": "db33457702f53597", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081256Z", "status_fit": "ok", "reason": "Both captured GitHub advisories list exactly these four handles as 'Reporter' (A6, the record itself). The affiliations in brackets are inferred from handle suffixes and other pages (Calif's '@lcfr_hax', Wiz author Sagi Tzadik, the Foundation's thanks to Amy Burnett of OpenAI Codex Security), not stated by the advisories.", "checked": [ { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Credits\n lcfr-hax\nReporter\n sagitzadik-wiz\nReporter\n tomash-areion\nReporter\n amyb-oai\nReporter", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "Credits\n sagitzadik-wiz\nReporter\n tomash-areion\nReporter\n lcfr-hax\nReporter\n amyb-oai\nReporter", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "Advisory opened: 2026-08-27, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "partial", "excerpt": "Ryan at Calif.io reporter\nWiz reporter\nOpenAI finder", "outside_citation": false }, { "source": "cve-cve-2026-109619", "file": "sources/cve-cve-2026-109619/captures/20261022T081219Z/text.txt", "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "result": "partial", "excerpt": "Wiz reporter\nRyan at Calif.io reporter\nOpenAI reporter", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-73" ], "mode2": "Identify tomash-areion (GitHub profile, Areion) and ask the PHP security team what was reported.", "display": 6, "stale": false }, { "id": "gov-patch-required", "claim_hash": "f77aa3e67f39c15e", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081329Z", "status_fit": "understated", "reason": "NSA's own press release says 'These risks are serious enough to require immediate patching across United States Government departments and agencies.' As a statement of what NSA says, the primary record carries it, so 'reported' understates. It is NSA's statement, not a binding directive; no CISA emergency directive is visible on the CISA home page at 08:13Z.", "checked": [ { "source": "nsa-press-php-4630238", "file": "sources/nsa-press-php-4630238/captures/20261022T080954Z/text.txt", "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "result": "carries", "excerpt": "These risks are serious enough to require immediate patching across United States Government departments and agencies.", "outside_citation": false }, { "source": "cisa-home", "file": "sources/cisa-home/captures/20261022T081329Z/text.txt", "sha256": "ab2aa07bb46ba14c14a2f76a312ff7b81e2c8c19ca3588de9313236b10007a34", "result": "absent", "excerpt": "Critical Vulnerabilities in PHP Require Immediate Patching", "outside_citation": false } ], "quotes_checked": [ { "quote": "require immediate patching across United States Government departments and agencies", "found": true, "where": "nsa-press-php-4630238" } ], "tickets": [ "Finding-74" ], "mode2": "CISA's directives page (cisa.gov/directives) on 21-22 October, to confirm whether an emergency directive was issued.", "display": 6, "stale": false }, { "id": "huntress-none", "claim_hash": "e407ff0ac75d92d7", "run": "Run-1", "mode": "vault", "kind": "state", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": true, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "The first half is carried exactly (4:30pm ET = 20:30 UTC). The second half comes from the pre-release section written before the 21 Oct release ('as of this writing'), not from the 20:30 UTC update, and by then Huntress's own 4:40pm update and other parties report public technical details and PoCs.", "checked": [ { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "carries", "excerpt": "As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "We have not built or reproduced a proof of concept for these vulnerabilities, and we're not aware of public exploit code as of this writing.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "Since PHP released its security advisory this morning to address the two critical vulnerabilities, several researchers have come forward to release the technical details", "outside_citation": false }, { "source": "cccs-al26-026", "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "result": "absent", "excerpt": "a Proof of Concept (PoC) is available, with no active exploitation being identified at this time", "outside_citation": true }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "absent", "excerpt": "WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub.", "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-17" ], "mode2": "A later Huntress update (the post says it will be updated) for the state on 22 October.", "display": 2, "stale": false }, { "id": "imperva-none", "claim_hash": "b05014327a0173e2", "run": "Run-1", "mode": "vault", "kind": "state", "level": 2, "verdict": "holds", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T111855Z", "status_fit": "ok", "reason": "Imperva's own post carries it verbatim, including that it had the details before disclosure; one named party, a negative about its own customer traffic in an undated window.", "checked": [ { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "The researchers shared vulnerability details confidentially with Imperva ahead of public disclosure, enabling Imperva to verify its protection and begin monitoring customer traffic", "outside_citation": false }, { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "absent", "excerpt": "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.", "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-75" ], "mode2": "Imperva's post-disclosure update (it says it continues to monitor) with counts.", "display": 2, "stale": false }, { "id": "kev-precedent", "claim_hash": "dd3f297886cc5fd3", "run": "Run-3", "mode": "vault", "kind": "record", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T112501Z", "status_fit": "ok", "reason": "'Reported' now fits, and the note says the one-day exploitation rests on Akamai alone. The claim text still calls CVE-2024-4577 'the last PHP core RCE', which the CVE record does not carry (a PHP-CGI argument injection on Windows); and 'not in KEV after one day' should name the catalog version checked. Finding-20 partly fixed; Finding-21 open.", "checked": [ { "source": "cisa-kev-json", "file": "sources/cisa-kev-json/raw/known_exploited_vulnerabilities.20261022T0816Z.json", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "cve-cve-2024-4577", "file": "sources/cve-cve-2024-4577/raw/cveawg-api.json", "sha256": "e8cc1b1dcd1a3333776e9a0f08cd4543bc662e0ee60fc094bda0820f84b114eb", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "akamai-blog-cve-2024-4577-one-day", "file": "sources/akamai-blog-cve-2024-4577-one-day/captures/20261022T112501Z/text.txt", "sha256": "f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567", "result": "carries", "excerpt": "As early as one day after disclosure, the SIRT observed numerous exploit attempts to abuse this vulnerability", "outside_citation": false }, { "source": "akamai-blog-cve-2024-4577-one-day", "file": "sources/akamai-blog-cve-2024-4577-one-day/captures/20261022T112501Z/text.txt", "sha256": "f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567", "result": "partial", "excerpt": "we observed exploit attempts targeting this PHP flaw on our honeypot network within 24 hours of its disclosure.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Evidence-1", "Finding-20", "Finding-21", "Finding-76" ], "mode2": "A later KEV fetch; a source on PHP RCE CVEs between June 2024 and October 2026 to support 'last'.", "display": 2, "stale": false }, { "id": "latvia-attempts", "claim_hash": "8da25937fdad760d", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081354Z", "status_fit": "ok", "reason": "CERT.LV's own page carries the automated attempts; it says there are 'no reports of successful attacks so far' (as of 21 Oct 23:00 local, 20:00Z), which is a dated absence of reports, not 'none succeeded'.", "checked": [ { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "partial", "excerpt": "Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības, taču līdz šim nav ziņu par sekmīgiem uzbrukumiem.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-16" ], "mode2": "A later CERT.LV update (the page says restrictions may last to 26 October) for a newer state.", "display": 2, "stale": false }, { "id": "latvia-offline", "claim_hash": "e78b99e07866d31b", "run": "Run-1", "mode": "vault", "kind": "event", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081354Z", "status_fit": "ok", "reason": "The CERT.LV notice, the national authority's own record, carries every part: a decision to restrict access from abroad to several state digital resources, possibly until Monday 26 October, and at the 23:00 local (EEST, 20:00Z) update lsm.lv and 112.lv restored. The UTC conversion is correct (Latvia on EEST until 25 Oct).", "checked": [ { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "pieņemts lēmums uz laiku ierobežot piekļuvi vairākiem valsts digitālajiem resursiem no ārvalstīm", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "Piekļuves ierobežojumi varētu būt spēkā līdz pirmdienai, 26. oktobrim", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "[Informācija papildināta: 21.10.2026, plkst. 23:00]", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "Šobrīd pieejamība atjaunota arī lsm.lv un 112.lv vietnēm.", "outside_citation": false }, { "source": "lv-latvija-gov", "file": "sources/lv-latvija-gov/captures/20261022T081939Z/provenance.json", "sha256": null, "result": "blocked", "excerpt": null, "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-24", "Finding-25", "Finding-77" ], "mode2": "A newer CERT.LV update (after 21 Oct 23:00 local) saying when the foreign-access restrictions were lifted; a capture of latvija.gov.lv from inside Latvia.", "display": 6, "stale": false }, { "id": "leak-cve-ids", "claim_hash": "0d740468ba0678c3", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-009" ], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "The Foundation states every element. The time and the CVE IDs circulating are corroborated independently (Equixly: Hacker News post 'about 15:20'; Huntress and CybelAngel: 'morning of October 20', which fits 15:00 UTC as US morning). 'No technical details leaked' is disputed: Daubois (PHP security team) describes a leaked tool screenshot and an exploitation video, and The Hacker News says a PoC leaked. The two Foundation slugs are the same page captured twice, not two sources.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media.", "outside_citation": false }, { "source": "phpfoundation-blog-security-release-leak", "file": "sources/phpfoundation-blog-security-release-leak/captures/20261022T081244Z/text.txt", "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "result": "carries", "excerpt": "They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.", "outside_citation": false }, { "source": "equixly-php2shell-what-we-know", "file": "sources/equixly-php2shell-what-we-know/captures/20261022T112832Z/text.txt", "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "result": "partial", "excerpt": "Oct 20, about 15:20\tA Hacker News post announces two upcoming PHP RCE CVEs; the post is later removed", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "On the morning of October 20, a post on Hacker News claimed that two critical PHP vulnerabilities were headed for public disclosure.", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down", "outside_citation": false } ], "quotes_checked": [ { "quote": "No technical details leaked", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Contradiction-9", "Finding-78" ], "mode2": "Capture the archived Hacker News post (the r/PHP thread links news.ycombinator.com/item?id=50176735 as context) and Florian Roth's CVSS 10.0 post.", "display": 4, "stale": false }, { "id": "leak-hn", "claim_hash": "33079c1ab822ee2d", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-009" ], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "The Hacker News post, its removal and the screenshots spreading are carried by Daubois and corroborated by Huntress, CybelAngel and Equixly (A4). 'Anonymous', 'citing a reliable source' and the screenshot 'credited to Calif.IO' are Daubois alone. Daubois says the screenshot 'leaked alongside the advisory', not that it came down; only the video 'went up and came down'.", "checked": [ { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "An anonymous Hacker News post citing a reliable source went up on October 20 and came down, but screenshots of it had already reached", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "The post was taken down, but not before screenshots made their way around social media.", "outside_citation": false }, { "source": "cybelangel-php2shell", "file": "sources/cybelangel-php2shell/captures/20261022T112625Z/text.txt", "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "result": "partial", "excerpt": "The incident started with a leak. On the morning of 20 October, a since-removed Hacker News post claimed the two flaws", "outside_citation": false }, { "source": "equixly-php2shell-what-we-know", "file": "sources/equixly-php2shell-what-we-know/captures/20261022T112832Z/text.txt", "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "result": "partial", "excerpt": "Sansec cites a leaked screenshot of an exploit tool named PHP2Shell, whose banner claims the tool works against PHP 5.4.0 and later.", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "partial", "excerpt": "details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time", "outside_citation": false } ], "quotes_checked": [ { "quote": "PHP2Shell tool", "found": true, "where": "daubois-blog-php2shell-rumors" }, { "quote": "no technical details leaked", "found": true, "where": "php-foundation-blog-security-release" }, { "quote": "a proof-of-concept exploit leaked", "found": false, "where": null } ], "tickets": [ "Contradiction-9", "Finding-79" ], "mode2": "Capture an archive of the Hacker News post and Sansec's research page that shows the leaked tool screenshot.", "display": 4, "stale": false }, { "id": "leak-mitigations", "claim_hash": "ca465bf39f4602af", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080901Z", "status_fit": "ok", "reason": "The Foundation's own sentence carries every element, including its hedge 'may have leaked'. It is one party's self-report; The Register and SecurityWeek repeat it without new evidence.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well.", "outside_citation": false } ], "quotes_checked": [], "tickets": [], "mode2": "Ask the Foundation which providers and what evidence of the leak; look for the mitigation text circulating before release.", "display": 2, "stale": false }, { "id": "leak-video", "claim_hash": "c4eac0ccce9cd74b", "run": "Run-1", "mode": "vault", "kind": "event", "level": 3, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113204Z", "status_fit": "ok", "reason": "The Foundation states it and the quoted phrase is verbatim; BBC, The Register, The Record and Feross echo the Foundation (one origin, A3). Daubois separately mentions a short exploitation video that went up and came down, without naming Calif. The time is uncertain: the Foundation's 'As a result of the leak and pre-announcement around 20:00 UTC' can attach '20:00 UTC' to the pre-announcement, which it puts at 19:30.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published", "outside_citation": false }, { "source": "phpfoundation-blog-security-release-leak", "file": "sources/phpfoundation-blog-security-release-leak/captures/20261022T081244Z/text.txt", "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "result": "carries", "excerpt": "The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "According to PHP, researchers at Calif then \"mistakenly published a video\" showing some basic details of how the flaws could be used", "outside_citation": false }, { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "absent", "excerpt": null, "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "a short exploitation video went up and came down the same way.", "outside_citation": false } ], "quotes_checked": [ { "quote": "contributed to accelerated development of various PoCs", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Contradiction-9", "Finding-80", "Finding-9" ], "mode2": "Ask Calif for the time and content of the deleted video; capture any copy circulated on X.", "display": 3, "stale": false }, { "id": "leak-watchtowr", "claim_hash": "9b69855ffb812921", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "Daubois says watchTowr confirmed the bugs and posted both CVE numbers; CybelAngel (via The Repository) independently says watchTowr named both CVEs, and Huntress quotes the same watchTowr line. CERT-EU lists the watchTowr X post as a public report; its ID 2112611507749982605 decodes to 2026-10-20T18:26:48Z, before the 19:30 UTC pre-announcement and the release. The post itself is not captured and watchtowr.com returns 403.", "checked": [ { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "“we were all supposed to wait until Thursday at 11am ET”, confirmed in public that the bugs were real and posted both CVE numbers.", "outside_citation": false }, { "source": "certeu-sa-2026-018", "file": "sources/certeu-sa-2026-018/captures/20261022T081329Z/text.txt", "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "result": "partial", "excerpt": "[3] https://x.com/watchtowrcyber/status/2112611507749982605", "outside_citation": false }, { "source": "cybelangel-php2shell", "file": "sources/cybelangel-php2shell/captures/20261022T112625Z/text.txt", "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "result": "carries", "excerpt": "watchTowr confirms the leaked vulnerabilities are real and names CVE-2026-109618 and CVE-2026-109619", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "Within a few hours, our good friends over at watchTowr confirmed the leak, writing that the vulnerabilities were real", "outside_citation": false } ], "quotes_checked": [ { "quote": "we were all supposed to wait until Thursday at 11am ET", "found": true, "where": "daubois-blog-php2shell-rumors" } ], "tickets": [ "Finding-81" ], "mode2": "Capture x.com/watchtowrcyber/status/2112611507749982605.", "display": 4, "stale": false }, { "id": "lorenc-ai-found", "claim_hash": "9f0097a2a4f9807b", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113204Z", "status_fit": "ok", "reason": "The Register reports, in its own words, that Lorenc said Chainguard learned 'something was coming in PHP' on Friday from one of the researchers and that night independently found the same bugs with its AI harness and a frontier model. One named party, second-hand through one outlet; nobody else checks it.", "checked": [ { "source": "theregister-php-blames-chainguard", "file": "sources/theregister-php-blames-chainguard/captures/20261022T113204Z/text.txt", "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "result": "carries", "excerpt": "Later that night, using his company’s AI harness and a frontier model, the CEO and the Chainguard team independently found the same memory corruption vulnerabilities.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-82" ], "mode2": "Capture Dan Lorenc's LinkedIn post (cited by The Register and ITdaily) for his own words.", "display": 2, "stale": false }, { "id": "more-paths", "claim_hash": "22cfde90943a85b0", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111906Z", "status_fit": "ok", "reason": "Fastly's post says nearly these words; it is one vendor's position (a reading), so A2. The second cited source (the oss-security thread) does not carry it. 'Reported' fits.", "checked": [ { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "carries", "excerpt": "Patching the specific paths that researchers demonstrated does not make the mechanism safe.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "carries", "excerpt": "Expect in-the-wild attacks and novel variants to emerge this week and next at minimum.", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-16.html", "sha256": "6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccf", "result": "absent", "excerpt": "While not yet fully confirmed, the Fediverse is reporting that the fix\nto at least PHP 8.5.12 may be incomplete:", "outside_citation": false }, { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.engine-main-session.patch", "sha256": "26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84", "result": "partial", "excerpt": "- Replace bailout on OOM with UnwindExit", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-11", "Evidence-7", "Finding-54", "Finding-55" ], "mode2": "Any later PHP advisory or CVE for a new bailout path after 8.5.12 would bear on this; none is in the vault.", "display": 2, "stale": false }, { "id": "most-severe", "claim_hash": "ee78e8907507801b", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 2, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T113134Z", "status_fit": "ok", "reason": "The BBC attributes to Wiz that the flaws are the 'most severe' ever detected by AI; Wiz's own blog, which the claim cites, says something narrower ('among the most severe vulnerabilities discovered in PHP, and arguably in software history'). A Substack piece relays the WSJ quoting Wiz's co-founder with close wording, so the BBC line probably traces to an interview, not the blog. A reading, held by one party, reported second-hand.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Wiz - one of the companies whose researchers uncovered the vulnerabilities - describes the flaws as the \"most severe\" ever detected by AI.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.", "outside_citation": false }, { "source": "substack-lopezkurtz-patch-is-the-exploit", "file": "sources/substack-lopezkurtz-patch-is-the-exploit/captures/20261022T113134Z/text.txt", "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "result": "partial", "excerpt": "Wiz’s co-founder told the Journal that PHP2Shell is “the most severe AI vulnerability that was ever found.”[40]", "outside_citation": false }, { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "partial", "excerpt": "Wiz called them the “most severe vulnerabilities ever discovered” by AI.", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "we consider this bug to be one of the most impactful vulnerabilities in recent memory.", "outside_citation": false } ], "quotes_checked": [ { "quote": "among the most severe vulnerabilities discovered in PHP, and arguably in software history", "found": true, "where": "wiz-blog-php2shell" }, { "quote": "one of the most impactful vulnerabilities in recent memory", "found": true, "where": "x-openai-php2shell" } ], "tickets": [ "Finding-8", "Finding-83" ], "mode2": "Capture the Wall Street Journal article with the Wiz co-founder quote.", "display": 2, "stale": false }, { "id": "nl-offline", "claim_hash": "835bc30ef1a0a16c", "run": "Run-3", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113213Z", "status_fit": "ok", "reason": "Rewritten as the evidence carries it: the government's notice names only NCSC.nl, as a precaution (Finding-27 fixed), and the other services are attributed to the Dutch press, which the TPO capture carries (DigiD, MijnOverheid, the Tweede Kamer). The 'no signs of exploitation of those services' overreach is gone (Finding-28 fixed).", "checked": [ { "source": "rijksoverheid-ncsc-php-news", "file": "sources/rijksoverheid-ncsc-php-news/captures/20261022T113033Z/text.txt", "sha256": "7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3", "result": "partial", "excerpt": "Vanwege de kwetsbaarheden in PHP is uit voorzorg de website NCSC.NL tijdelijk offline gehaald.", "outside_citation": false }, { "source": "rijksoverheid-ncsc-php-news", "file": "sources/rijksoverheid-ncsc-php-news/captures/20261022T113033Z/text.txt", "sha256": "7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3", "result": "partial", "excerpt": "het Nationaal Cyber Security Centrum (NCSC) heeft nog geen actief misbruik gesignaleerd.", "outside_citation": false }, { "source": "dutchitleaders-websites-offline", "file": "sources/dutchitleaders-websites-offline/captures/20261022T112724Z/text.txt", "sha256": "28f6003be69e3a9719618a62764a55d30d9d28570363ffd8126d1ef0f32a5803", "result": "blocked", "excerpt": "We're verifying you are human. This may take a few seconds.", "outside_citation": false }, { "source": "tpo-nl-digid-offline", "file": "sources/tpo-nl-digid-offline/captures/20261022T113213Z/text.txt", "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "result": "carries", "excerpt": "DigiD, MijnOverheid, de website van de Tweede Kamer en zelfs die van het Nationaal Cyber Security Centrum (NCSC) gingen uit voorzorg offline.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "partial", "excerpt": "The Dutch National Cyber Security Centre took its own site offline as a precaution, as did the following:", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "carries", "excerpt": "They included the Port of Rotterdam, government site Overheid.nl, the national football association KNVB", "outside_citation": false }, { "source": "rte-reuters-websites-go-dark", "file": "sources/rte-reuters-websites-go-dark/captures/20261022T081010Z/text.txt", "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "result": "carries", "excerpt": "including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB", "outside_citation": true }, { "source": "ncsc-nl-site", "file": "sources/ncsc-nl-site/captures/20261022T081919Z/text.txt", "sha256": "4cff0c7ba341429e99659d7404208300de0c4a702c9c28da82b183c71d30bd32", "result": "absent", "excerpt": "Ernstige kwetsbaarheden in PHP: update nu", "outside_citation": true }, { "source": "overheid-nl-site", "file": "sources/overheid-nl-site/captures/20261022T081927Z/text.txt", "sha256": "93278f942198c318881e84d7d62b8bf6f6613b8ed5da0dc5f37bd9f658d11c13", "result": "absent", "excerpt": null, "outside_citation": true } ], "quotes_checked": [ { "quote": "uit voorzorg", "found": true, "where": "rijksoverheid-ncsc-php-news" } ], "tickets": [ "Finding-27", "Finding-28", "Finding-84" ], "mode2": "Logius (DigiD, MijnOverheid) and KOOP (Overheid.nl) own status or news pages for 21 Oct, and an NCSC.NL statement on the return of its site.", "display": 4, "stale": false }, { "id": "no-confirmed-compromise", "claim_hash": "cd0268b126cc6fcb", "run": "Run-10", "mode": "vault", "kind": "state", "level": 4, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261026T121439Z", "status_fit": "ok", "reason": "Refreshed to 16:05 UTC on 24 October, still time-bounded and 'reported', which fits. More independent negatives now carry it: Sophos withdrew its success claim (scanning and a few failed attempts, via Cyber Security News), American Banker finds no US bank or credit union reporting a compromise, The Next Web's officials in three countries have 'not seen one succeed'. The vendor half (Hadrian, Patchstack) is still through the press, A3. Every new quote checked verbatim. Run 6 adds Die Presse ('In Österreich sind bisher keine erfolgreichen Angriffe bekannt') and RainForest's honeypot (21 PHP2Shell POST requests, attempts), both checked in their captures. Run 7 (as of 09:35 UTC on 25 October): the Turkish Presidency's Cyber Security Directorate, via Haber, says e-Devlet is safe and its services continue, naming no compromise; teleSUR, captured at 09:35 UTC on 25 October, says no massive successful intrusion had been publicly confirmed and that most activity was scanning and failed attempts. Of the 20 captures made since 16:05 UTC on 24 October, none names a compromised organisation. Run 8 (as of 14:40 UTC on 25 October, vault head 94352a55fbaa): La Razon, captured 24 October, reports attacks as attempts (Amazon's attempt of 17 October, Cloudflare and Amazon 'detectando ataques') and names no compromised organisation; it supports the attempts half, not the absence, so it is graded partial. No capture since 09:35 UTC on 25 October names a victim. Run 9 (as of 09:40 UTC on 26 October, vault head a7ab84771dfc): a new source, Wersm (captured 26 October), says 'Palo Alto Networks and Trail of Bits later reported confirmed compromises and post-exploit activity', secondhand from TechCrunch, naming no victim. It does not touch a claim about a named organisation, but it is not backed by any primary capture: Palo Alto's own bulletin, captured 22 October, says it is 'not aware of any malicious exploitation of this issue against our products'. Finding opened; the claim holds at A4. Run 10 (as of 12:14 UTC on 26 October, vault head 22a0c2920b88): 20 captures made since 09:40 UTC name no compromised organisation; YugaTech says the 70% figure 'does not mean 70% of websites have been confirmed compromised'. Holds at A4.", "checked": [ { "source": "cisa-kev-json", "file": "sources/cisa-kev-json/raw/known_exploited_vulnerabilities.20261022T0816Z.json", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "result": "partial", "excerpt": null, "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "carries", "excerpt": "As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "carries", "excerpt": "No indicators of compromise have been confirmed yet.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "partial", "excerpt": "Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "partial", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "outside_citation": false }, { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "partial", "excerpt": "it’s extremely likely that a bunch of old PHP fansites and forums have had their databases compromised", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "taču līdz šim nav ziņu par sekmīgiem uzbrukumiem.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "No successful break-ins had been confirmed as of Wednesday afternoon.", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "carries", "excerpt": "The temporary deactivation was purely preventive and no security incidents were known to have occurred, the spokesperson said.", "outside_citation": false }, { "source": "abc-au-politics-live", "file": "sources/abc-au-politics-live/captures/20261022T081530Z/text.txt", "sha256": "a86331d9b7a21f78af1750d3daf6ebbb696253e1216649e973e34262313040b1", "result": "carries", "excerpt": "Industry and Innovation Minister Tim Ayres says there has been no breach of Australian government websites", "outside_citation": true }, { "source": "the-verge-php2shell-websites-down", "file": "sources/the-verge-php2shell-websites-down/captures/20261023T012042Z/text.txt", "sha256": "1a9a20537e477cc84bdd688c3d13f165e980a7bae0aa54bd2f88011d32d3b3d3", "result": "carries", "excerpt": "to our knowledge, there has been no successful attempt at remote code execution", "outside_citation": false }, { "source": "pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw", "file": "sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/captures/20261023T080331Z/text.txt", "sha256": "82ef905cd2201bd4507643ba274b135e32b1e440606b1ded976617c782b28166", "result": "carries", "excerpt": "our telemetry shows only probing attacks, with no hard evidence of breaches yet", "outside_citation": false }, { "source": "recordedfuture-php2shell", "file": "sources/recordedfuture-php2shell/captures/20261023T012042Z/text.txt", "sha256": "39efeb7b8ae8152f98ccf53437e4070f12339a7e718570de9f01ac96d23b0622", "result": "partial", "excerpt": "Patchstack received reports of multiple active exploitation incidents from hosting partners by 07:34 UTC on October 21", "outside_citation": false }, { "source": "insurance-business-au-asiapac-attacks-begin", "file": "sources/insurance-business-au-asiapac-attacks-begin/captures/20261023T012042Z/text.txt", "sha256": "8d88bddde485e36f27c001a80e9ad0506055b64f3879347345be5ad336a10cad", "result": "partial", "excerpt": "Hadrian says it is seeing PHP2Shell exploited at scale, mostly through PHP’s session upload progress path.", "outside_citation": false }, { "source": "cybersecuritynews-critical-php2shell-exploit-code", "file": "sources/cybersecuritynews-critical-php2shell-exploit-code/captures/20261023T232528Z/text.txt", "sha256": "bdf6e94a1a8a118b2f1a5546ec71c6eda552a7289fb2b15ed34885ddcbfa89ac", "result": "carries", "excerpt": "Sophos said its customer data showed scanning and a small number of failed exploit attempts.", "outside_citation": false }, { "source": "americanbanker-news-banks-dodge-early-damage-from-php2s", "file": "sources/americanbanker-news-banks-dodge-early-damage-from-php2s/captures/20261024T083755Z/text.txt", "sha256": "2b6aa63f39e73b0ee1344ecc0362be26ac765764c3dac7b04da934c8ea3e6b3f", "result": "carries", "excerpt": "no U.S. bank or credit union has publicly reported a compromise", "outside_citation": false }, { "source": "the-next-web-php2shell-no-confirmed-breaches", "file": "sources/the-next-web-php2shell-no-confirmed-breaches/captures/20261024T083755Z/text.txt", "sha256": "75d67773b979aa86ec9f32e1690fa2d13b8d5905d6cfac239cfcd9331d8c17dc", "result": "carries", "excerpt": "Officials in Germany, the Netherlands and Japan say they have not seen one succeed.", "outside_citation": false }, { "source": "diepresse-41383717-die-php-sicherheitsluecke-ist-a", "file": "sources/diepresse-41383717-die-php-sicherheitsluecke-ist-a/captures/20261023T160435Z/text.txt", "sha256": "f6998ff009f030cc5aa035c7032038aa708ec871633b5604e0ba0b8f2bf46220", "result": "carries", "excerpt": "In Österreich sind bisher keine erfolgreichen Angriffe bekannt.", "outside_citation": false }, { "source": "voix-business-cards-rainforest-ip-activity-an", "file": "sources/voix-business-cards-rainforest-ip-activity-an/captures/20261024T160544Z/text.txt", "sha256": "3e5e879383dd76ceedde10291eb662d52a451e20b573d86c3b1c0ef1ace3b61a", "result": "partial", "excerpt": "PHP2Shell関連のHTTP POST通信が21件観測され", "outside_citation": false }, { "source": "haber-teknoloji-siber-guvenlik-baskanligi-ndan", "file": "sources/haber-teknoloji-siber-guvenlik-baskanligi-ndan/captures/20261023T160435Z/text.txt", "sha256": "2825ea23dc0ee99dad084b327460a78610b626aa1f93bcd95017881a08fbcea9", "result": "carries", "excerpt": "e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor", "outside_citation": false }, { "source": "telesurenglish-php2shell-vulnerabilities", "file": "sources/telesurenglish-php2shell-vulnerabilities/captures/20261025T093507Z/text.txt", "sha256": "6efd752b24f540730043417e4f8e1837289ad08b2351a62e22a4bc2bdc3e8ad6", "result": "carries", "excerpt": "no massive successful intrusion had been publicly confirmed as of Thursday", "outside_citation": false }, { "source": "larazon-tecnologia-consumo-php-nuevo-fallo-segur", "file": "sources/larazon-tecnologia-consumo-php-nuevo-fallo-segur/captures/20261024T083755Z/text.txt", "sha256": "21b72816e736ca309b04551b94e2e98a6bb02d5619415a05d7e31db3c15ee71e", "result": "partial", "excerpt": "Los ataques contra PHP2Shell ya se cuentan por millones", "outside_citation": false }, { "source": "wersm-php2shell-legacy-infrastructure-web-risk", "file": "sources/wersm-php2shell-legacy-infrastructure-web-risk/captures/20261026T013143Z/text.txt", "sha256": "e8ab2d9bb4f16fbe0aaeaaca8be044de7f36eeb785f83f36d6d2cd4ead2cd5e3", "result": "partial", "excerpt": "Palo Alto Networks and Trail of Bits later reported confirmed compromises and post-exploit activity", "outside_citation": false } ], "quotes_checked": [ { "quote": "broadly exploited", "found": true, "where": "aws-security-blog-madpot" } ], "tickets": [ "Contradiction-2", "Evidence-1", "Evidence-10", "Evidence-12", "Evidence-18", "Evidence-3", "Finding-128", "Finding-26", "Finding-85" ], "mode2": "Re-fetch the CISA KEV catalog and Huntress/Imperva/Wiz updates after 22 Oct; search breach-notification and regulator pages (ICO, AP NL, CNIL) and Have I Been Pwned for any organisation attributing a breach to CVE-2026-109618/109619.", "display": 4, "stale": false }, { "id": "no-exploitation", "claim_hash": "0d5463a99fc0d8fa", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-002" ], "volatile": true, "as_of": "20261022T080559Z", "status_fit": "ok", "reason": "The BBC (one named outlet, reporting its own Radio 4 interview) carries Austin saying \"Not at the moment\", but the claim's wording is the BBC headline, not his words, and his words are narrower: exploitation has not \"taken off or been widespread\". As a statement of fact it is disputed by Amazon's earlier \"broadly exploited in the wild\" and by NCSC NZ.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "he says: \"Not at the moment... it doesn't look like exploitation has taken off or been widespread.\"", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "No evidence that hackers have exploited flaw so far, says researcher", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "absent", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "outside_citation": true }, { "source": "ncsc-nz-alert-php", "file": "sources/ncsc-nz-alert-php/captures/20261022T081700Z/text.txt", "sha256": "992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301", "result": "absent", "excerpt": "The NCSC is aware of reports of active exploitation.", "outside_citation": true } ], "quotes_checked": [ { "quote": "Not at the moment", "found": true, "where": "bbc-live-ckgel5xp2xv9t" }, { "quote": "No evidence that hackers have exploited flaw so far (BBC headline, source of the claim's wording)", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Contradiction-2", "Finding-11", "Finding-12" ], "mode2": "Calif's own statement or a transcript/recording of the BBC Radio 4 Today interview at about 09:00 BST, 22 October, to fix the exact words and time.", "display": 2, "stale": false }, { "id": "nz-active", "claim_hash": "6383f951cca69ad9", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "disputed", "contradictions": [], "volatile": true, "as_of": "20261022T081700Z", "status_fit": "ok", "reason": "NCSC NZ's own alert carries the sentence verbatim; one named party, unsourced reports. Other agencies captured at about the same time say the opposite (CCCS: no active exploitation identified; ACSC: not aware of successful active exploitation in Australia; CISA: not observed as of publication).", "checked": [ { "source": "ncsc-nz-alert-php", "file": "sources/ncsc-nz-alert-php/captures/20261022T081700Z/text.txt", "sha256": "992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301", "result": "carries", "excerpt": "The NCSC is aware of reports of active exploitation.", "outside_citation": false }, { "source": "cccs-al26-026", "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "result": "absent", "excerpt": "a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.", "outside_citation": true }, { "source": "acsc-alert-php", "file": "sources/acsc-alert-php/captures/20261022T081658Z/text.txt", "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "result": "absent", "excerpt": "ASD’s ACSC is not aware of successful active exploitation within Australia, related to these vulnerabilities.", "outside_citation": true }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "partial", "excerpt": "Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības", "outside_citation": true } ], "quotes_checked": [ { "quote": "The NCSC is aware of reports of active exploitation.", "found": true, "where": "ncsc-nz-alert-php" } ], "tickets": [ "Finding-86" ], "mode2": "An NCSC NZ statement naming whose reports, or an archived copy of the 9:15am NZDT version of the alert.", "display": 2, "stale": false }, { "id": "offline-allies", "claim_hash": "0076f2a71f2ffcef", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 1, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T084815Z", "status_fit": "understated", "reason": "The captured BBC page does not say this: it says the NCSC 'as well as its counterparts in the EU and Australia' urged users 'to apply the fixes', and attributes the offline quote to the NCSC alone. On the substance, NCSC (after mitigations) and NSA advise offline, CERT-EU and CERT-FR advise isolation, and Italy's ACN advises taking sites offline; only Australia is not shown (ACSC's page as captured has no offline advice). 'Contradicted' overstates an absence for one of four parties and mislabels the BBC's statement.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.", "outside_citation": false }, { "source": "acsc-alert-php", "file": "sources/acsc-alert-php/captures/20261022T081658Z/text.txt", "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "result": "absent", "excerpt": "Apply available security updates and other appropriate mitigations", "outside_citation": false }, { "source": "certeu-sa-2026-018", "file": "sources/certeu-sa-2026-018/captures/20261022T081329Z/text.txt", "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "result": "carries", "excerpt": "Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/captures/20261022T084815Z/text.txt", "sha256": "f3eec24a226910fb8440714b4f44c40db5c5f7826f3c23b65aece1cc5775712e", "result": "absent", "excerpt": "If immediate patching is not possible, follow PHP's temporary mitigations, including disabling session.upload_progress, restarting workers,", "outside_citation": false }, { "source": "acn-it-php2shell", "file": "sources/acn-it-php2shell/captures/20261022T081354Z/text.txt", "sha256": "19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6", "result": "carries", "excerpt": "si raccomanda di valutare di porre offline i siti e i servizi web che utilizzano versioni vulnerabili di PHP", "outside_citation": false }, { "source": "jpcert-at260033", "file": "sources/jpcert-at260033/captures/20261022T081700Z/text.txt", "sha256": "1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5", "result": "absent", "excerpt": "十分なテストを実施の上、速やかに修正済みバージョンを適用してください。", "outside_citation": false }, { "source": "ncsc-news-php", "file": "sources/ncsc-news-php/captures/20261022T080903Z/text.txt", "sha256": "a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339", "result": "carries", "excerpt": "or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "nsa-press-php-4630238", "file": "sources/nsa-press-php-4630238/captures/20261022T080954Z/text.txt", "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "result": "carries", "excerpt": "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "carries", "excerpt": "Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-43", "Finding-44", "Finding-45", "Finding-87" ], "mode2": "An archived 21 October version of ACSC's alert (cyber.gov.au/alert/critical-vulnerabilities-in-php) to see whether it ever advised taking systems offline.", "display": 1, "stale": false }, { "id": "offline-cisa", "claim_hash": "5003889605e53374", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081353Z", "status_fit": "ok", "reason": "CISA's alert says organisations that cannot update immediately, or that use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until patched or updated. The party's own record carries it.", "checked": [ { "source": "cisa-alert-php-20261021", "file": "sources/cisa-alert-php-20261021/captures/20261022T081353Z/text.txt", "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "result": "carries", "excerpt": "Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-88" ], "mode2": "", "display": 6, "stale": false }, { "id": "offline-ncsc", "claim_hash": "56d2fa8986fa7e54", "run": "Run-1", "mode": "vault", "kind": "quote", "level": 3, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": true, "as_of": "20261022T112915Z", "status_fit": "ok", "reason": "The NCSC page as captured (last-modified 07:30:02 GMT on 22 Oct) gives the offline advice as step 4 of 6 in other words ('If you are unable to apply the temporary mitigations ...'), so the quote is not verbatim in the party's own capture. The exact sentence is in the BBC, in LBC's article of 21 Oct 15:41 (before the page was modified), and in a CyberExpress copy of the BBC. That is an echo, A3, and points to an earlier NCSC wording.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "\"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,\" the NCSC said in a note", "outside_citation": false }, { "source": "ncsc-news-php", "file": "sources/ncsc-news-php/captures/20261022T080903Z/text.txt", "sha256": "a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339", "result": "partial", "excerpt": "or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "ncsc-news-php", "file": "sources/ncsc-news-php/captures/20261022T080903Z/headers.json", "sha256": "642ad2462903a32f7050dae5e198654e710dadc0a6225333d96370031c7ede4c", "result": "partial", "excerpt": "\"last-modified\": \"Thu, 22 Oct 2026 07:30:02 GMT\"", "outside_citation": false }, { "source": "cccs-al26-026", "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "result": "partial", "excerpt": "Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.", "outside_citation": false }, { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "carries", "excerpt": "The NCSC warned: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”", "outside_citation": false }, { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "carries", "excerpt": "“Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated,” the NCSC said.", "outside_citation": false } ], "quotes_checked": [ { "quote": "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated", "found": true, "where": "lbc-uk-websites-offline" } ], "tickets": [ "Finding-42", "Finding-89" ], "mode2": "A Wayback Machine or archive.today snapshot of https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php from 21 October, or the NCSC press office, would show whether the quoted sentence was on the page before 07:30Z on 22 October.", "display": 2, "stale": false }, { "id": "offline-nsa", "claim_hash": "44eb047f0a7bff36", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080954Z", "status_fit": "ok", "reason": "Both of NSA's own pages carry the advice in nearly the claim's words: the press release ('it is recommended that organizations take the system offline until it can be fully mitigated') and the X post (with the typo 'recommend'). The X post's snowflake decodes to 2026-10-21T13:45:58Z and the capture shows 10.1M views, as the note says.", "checked": [ { "source": "nsa-x-2112903220209098897", "file": "sources/nsa-x-2112903220209098897/captures/20261022T080954Z/text.txt", "sha256": "92ebce791a7b35429d2fee94427932a19b1629de3821a52201648a58298d52e7", "result": "carries", "excerpt": "If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "nsa-press-php-4630238", "file": "sources/nsa-press-php-4630238/captures/20261022T080954Z/text.txt", "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "result": "carries", "excerpt": "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.", "outside_citation": false } ], "quotes_checked": [], "tickets": [], "mode2": "", "display": 6, "stale": false }, { "id": "only-update", "claim_hash": "4f13f57d964ac543", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081407Z", "status_fit": "ok", "reason": "php.net's advisory carries the claim almost word for word, and both GHSAs and the oss-security post say updating is the only complete/reliable mitigation. The party's own records carry the advice.", "checked": [ { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "carries", "excerpt": "while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-7", "file": "sources/openwall-oss-security-2026-10-21-7/captures/20261022T081407Z/text.txt", "sha256": "ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384", "result": "carries", "excerpt": "Updating is the only reliable mitigation; there is no\ncomplete generic configuration workaround.", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "Updating to a release containing the complete state reset patch is the only reliable mitigation.", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.", "outside_citation": false } ], "quotes_checked": [], "tickets": [], "mode2": "", "display": 6, "stale": false }, { "id": "openai-same-day", "claim_hash": "a1cdae209d126f39", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T112703Z", "status_fit": "ok", "reason": "The Foundation's page says this word for word (one named primary party, the recipient of the reports). The GHSA credits and the CVE records corroborate that OpenAI was a credited reporter or finder but carry no dates. OpenAI's own account is blocked; Cybernews relays OpenAI as saying its researcher 'subsequently' found additional flaws after Calif, and the X Community Note disputes OpenAI's discovery role.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "partial", "excerpt": " amyb-oai\nReporter", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "partial", "excerpt": "OpenAI finder", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "partial", "excerpt": "But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.", "outside_citation": false }, { "source": "cybernews-php2shell-millions", "file": "sources/cybernews-php2shell-millions/captures/20261022T112703Z/text.txt", "sha256": "a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb", "result": "partial", "excerpt": "According to OpenAI, Calif used GPT-5.6 Sol to investigate the flaw. OpenAI’s own researcher subsequently identified additional flaws", "outside_citation": false }, { "source": "openai-blog-coordinated-disclosure", "file": "sources/openai-blog-coordinated-disclosure/captures/20261022T112413Z/text.txt", "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "result": "blocked", "excerpt": null, "outside_citation": false } ], "quotes_checked": [ { "quote": "using GPT-5.6 Sol", "found": false, "where": null } ], "tickets": [ "Finding-3", "Finding-90" ], "mode2": "Capture OpenAI's blog post; ask the PHP security team or OpenAI (Amy Burnett) for the GHSA report timestamps.", "display": 2, "stale": false }, { "id": "oxford", "claim_hash": "90f92983e015ff48", "run": "Run-1", "mode": "vault", "kind": "quote", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112935Z", "status_fit": "ok", "reason": "The quoted words are verbatim in the @OxfordCity post embedded in the East Anglian Daily Times (PA) capture, but not in the cited Oxford Chronicle, which only paraphrases (\"a precautionary response to a worldwide technology problem rather than a cyber incident\"). One capture carries the exact words, so A2.", "checked": [ { "source": "oxfordchronicle-councils-offline", "file": "sources/oxfordchronicle-councils-offline/captures/20261022T112935Z/text.txt", "sha256": "35c847290193f872826f6d65f370bcb6863fafe692817cc449f97431f350ae73", "result": "partial", "excerpt": "In a social-media update, the council explained that the closure was a precautionary response to a worldwide technology problem rather than a cyber incident.", "outside_citation": false }, { "source": "eadt-minister-budget-no-breach", "file": "sources/eadt-minister-budget-no-breach/captures/20261022T112742Z/text.txt", "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "result": "carries", "excerpt": "This is a precaution because of a worldwide issue with the underlying technology and is not a cyber incident.", "outside_citation": false } ], "quotes_checked": [ { "quote": "a precaution because of a worldwide issue with the underlying technology and is not a cyber incident", "found": false, "where": "oxfordchronicle-councils-offline" }, { "quote": "a precaution because of a worldwide issue with the underlying technology and is not a cyber incident", "found": true, "where": "eadt-minister-budget-no-breach" } ], "tickets": [ "Finding-30" ], "mode2": "A capture of the @OxfordCity post itself on X, and of oxford.gov.uk on 21 to 22 Oct.", "display": 2, "stale": false }, { "id": "pocs-wrong", "claim_hash": "00addbc8e33e5aad", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 1, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T112853Z", "status_fit": "overstated", "reason": "rjmendez's README carries both halves, but the VulnCheck half is second-hand (VulnCheck's review is not captured), so A1; the lab half is rjmendez's own (A2). Huntress, the second cited source, does not carry either half. 'Reported' implies one named party checked first-hand, which only the lab half has.", "checked": [ { "source": "github-rjmendez-phpup-2026", "file": "sources/github-rjmendez-phpup-2026/captures/20261022T112003Z/text.txt", "sha256": "84742b6e86fb259d4db36361e86d4b739c6cd09184337f365f5e2958271f5379", "result": "carries", "excerpt": "a clean 200 OK, and VulnCheck independently reports that none of the public PoCs they reviewed have the correct mechanism.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "absent", "excerpt": "We have not built or reproduced a proof of concept for these vulnerabilities, and we're not aware of public exploit code as of this writing.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "partial", "excerpt": "the existing PoCs require knowledge of the specific, running PHP binary and address space layout on the server", "outside_citation": false }, { "source": "thehackernews-what-protects-you", "file": "sources/thehackernews-what-protects-you/captures/20261022T113151Z/text.txt", "sha256": "2301d254784fd6612f36f844e16a706e2e7ca5f8d8f942f7f36544c59d78d82c", "result": "partial", "excerpt": "the public exploit code going around has not been shown to work", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-52", "Finding-91", "Gap-3" ], "mode2": "Capture VulnCheck's own post or report on the public php2shell PoCs.", "display": 1, "stale": false }, { "id": "preannounce-time", "claim_hash": "8d6f059ee7b693ad", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "Only the PHP Foundation states 19:30 UTC, and the same post later says 'pre-announcement around 20:00 UTC'. The oss-security relay of the php.net text (Date 13:22:51 -0700 = 20:22:51Z) bounds it from above, and the feed's 20:32:00Z is later than that relay, so the feed time cannot be the publication time. One party's self-report, A2; 'disputed' fits.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-20-34", "file": "sources/openwall-oss-security-2026-10-20-34/captures/20261022T081408Z/text.txt", "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "result": "partial", "excerpt": "Date: Tue, 20 Oct 2026 13:22:51 -0700", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/raw/feed.atom", "sha256": "79c12996a433f66b2e2422e32d1dd5d4251c7c24531f75c3a0611f58dc1894a8", "result": "partial", "excerpt": "2026-10-20T20:32:00+00:00", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "absent", "excerpt": null, "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-40", "Finding-92" ], "mode2": "The php/web-php commit that added the 2026-10-20-1 archive entry, or the php-announce list message time.", "display": 2, "stale": false }, { "id": "probing", "claim_hash": "46373ec42044f7f9", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 5, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111755Z", "status_fit": "ok", "reason": "Woodward's remark is carried by the BBC, and both companies independently say it in their own captured posts: Amazon (scanning attempts, honeypot hits) and Cloudflare (attack traffic targeting customers). Two independent primary parties, each checked.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Woodward says companies like Amazon and Cloudflare that monitor what is going on online saw the weakness \"was being probed for\".", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "we observed attack traffic targeting our customers.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "Our internal threat intelligence system automatically detected and restricted malicious scanning attempts targeting this vulnerability.", "outside_citation": false } ], "quotes_checked": [ { "quote": "was being probed for", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Contradiction-2", "Finding-15", "Finding-93" ], "mode2": "", "display": 5, "stale": false }, { "id": "quarkslab-2024", "claim_hash": "dc72cf03a483f160", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T113008Z", "status_fit": "overstated", "reason": "Calif says Quarkslab's audit 'rediscovered the same OOM issue' and 'exploitation was not proven, hence the bug was not fixed', but Calif says it confirmed this 'from PHP', so it is not independent of the Foundation. The Foundation says something different: a PHP core developer found the OOM signs while fixing a Quarkslab finding, and the fix stalled over trade-offs and resources, not only unproven exploitation. Quarkslab's own summary describes no OOM finding. Run 6: Cloudflare's post was edited on 23 October ('Today,' became 'October 21,'); Quarkslab is still named, so the grade stands.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem", "outside_citation": false }, { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "carries", "excerpt": "OSTIF and Quarkslab performed an audit of PHP and rediscovered the same OOM issue. However, exploitation was not proven, hence the bug was not fixed.", "outside_citation": false }, { "source": "quarkslab-blog-php-src-audit", "file": "sources/quarkslab-blog-php-src-audit/captures/20261022T113008Z/text.txt", "sha256": "cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321", "result": "absent", "excerpt": "This audit report contains two security issues currently redacted while PHP maintainers are actively working on the fixes.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "Reported by: Calif, Wiz, OpenAI, and Quarkslab.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "partial", "excerpt": "Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261023T160435Z/text.txt", "sha256": "94476de6ec0b31e035ef97a1dbf9607bc81e7ddbb479c2d5217b8e8b0207ec02", "result": "carries", "excerpt": "October 21, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP", "outside_citation": false } ], "quotes_checked": [ { "quote": "a structural failure", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Finding-5", "Finding-6", "Finding-94" ], "mode2": "Ask Quarkslab or OSTIF whether any of the 27 findings (or redacted HIGH-1/MED-2) is the OOM issue; the full Quarkslab PDF report is linked from its blog and should be captured.", "display": 2, "stale": false }, { "id": "quarkslab-redacted", "claim_hash": "aa843b6073f64ddd", "run": "Run-1", "mode": "vault", "kind": "count", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113134Z", "status_fit": "understated", "reason": "Counted from the captured Quarkslab page: 2 high, 6 medium, 9 low and 10 informative issues (27 rows), with HIGH-1 and MED-2 redacted and the stated reason 'Fixes are complex and in progress.' No row describes an out-of-memory finding. The Substack piece says the same. The Foundation note is carried.", "checked": [ { "source": "quarkslab-blog-php-src-audit", "file": "sources/quarkslab-blog-php-src-audit/captures/20261022T113008Z/text.txt", "sha256": "cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321", "result": "carries", "excerpt": "two security issues currently redacted while PHP maintainers are actively working on the fixes. Details will be provided after fixes are applied", "outside_citation": false }, { "source": "substack-lopezkurtz-patch-is-the-exploit", "file": "sources/substack-lopezkurtz-patch-is-the-exploit/captures/20261022T113134Z/text.txt", "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "result": "carries", "excerpt": "lists 27 findings, two of them redacted because their fixes were “complex and in progress”; it does not describe an out-of-memory finding.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem", "outside_citation": false } ], "quotes_checked": [ { "quote": "complex and in progress", "found": true, "where": "quarkslab-blog-php-src-audit" } ], "tickets": [ "Finding-95" ], "mode2": "Capture the full Quarkslab PDF report and the OSTIF post; ask whether HIGH-1 or MED-2 concerns memory_limit handling.", "display": 6, "stale": false }, { "id": "rce-fpm", "claim_hash": "38e4e700d08c53f8", "run": "Run-1", "mode": "vault", "kind": "state", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [ "K-008" ], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "understated", "reason": "As worded, the claim is carried by the PHP security team's own advisory for CVE-2026-109619 (GHSA-6wmf) and its oss-security post, which say RCE was demonstrated on a normal dynamic FPM pool, given a suitable application operation. What is disputed is which flaw does it: the Foundation's blog puts FPM under CVE-2026-109618, whose own advisory says no complete FPM exploit was shown (K-008). That does not touch this claim, so the site's 'disputed' understates it.", "checked": [ { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "The fatal backtrace path has confirmed RCE against mod_php. Session lifecycle RCE was validated against mod_php and FPM.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-7", "file": "sources/openwall-oss-security-2026-10-21-7/captures/20261022T081407Z/text.txt", "sha256": "ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384", "result": "carries", "excerpt": "Unauthenticated RCE has been demonstrated against Apache mod_php and\nPHP-FPM. Exploitability depends on the affected state, configuration, and\napplication behavior.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "Remote code execution was also confirmed on PHP-FPM through application-level code paths.", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "partial", "excerpt": "Source analysis therefore supports FPM as a susceptible, though no complete FPM exploit has been demonstrated for this SAPI.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-6", "file": "sources/openwall-oss-security-2026-10-21-6/captures/20261022T081408Z/text.txt", "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "result": "partial", "excerpt": "Source analysis also indicates FPM\nsusceptibility, although a complete FPM exploit has not been demonstrated.", "outside_citation": false } ], "quotes_checked": [ { "quote": "no complete FPM exploit has been demonstrated for this SAPI", "found": true, "where": "github-ghsa-w8hw-w9fx-j79w" }, { "quote": "was also confirmed on PHP-FPM through application-level code paths", "found": true, "where": "php-foundation-blog-security-release" }, { "quote": "validated against mod_php and FPM", "found": true, "where": "github-ghsa-6wmf-4rv5-p3rp" } ], "tickets": [ "Contradiction-8", "Finding-48", "Finding-49", "Finding-96" ], "mode2": "A clarification from the PHP security team (oss-security reply or GHSA update) on whether CVE-2026-109618 has a demonstrated FPM exploit, or a correction of the Foundation blog, would settle the CVE attribution.", "display": 6, "stale": false }, { "id": "rce-modphp", "claim_hash": "d8af3294ee3196d8", "run": "Run-1", "mode": "vault", "kind": "state", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "GHSA-w8hw (the advisory record for CVE-2026-109618) says complete RCE was validated over HTTP against mod_php with default PHP input and memory limits, entirely before application code; oss-security and php.net repeat it. All parts carried by the primary record.", "checked": [ { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Complete remote code execution was validated over HTTP against mod_php with default PHP input and memory limits and normal prefork configurations with multiple workers.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-6", "file": "sources/openwall-oss-security-2026-10-21-6/captures/20261022T081408Z/text.txt", "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "result": "carries", "excerpt": "Unauthenticated RCE has been demonstrated over HTTP against Apache mod_php,\nbefore application code executes.", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "partial", "excerpt": "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-8", "Finding-97" ], "mode2": "", "display": 6, "stale": false }, { "id": "release-moved", "claim_hash": "b37f1485c644d1a3", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds", "tension": "measures-differently", "contradictions": [ "K-010" ], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "overstated", "reason": "The new time (21 October 14:00 UTC) is in the php.net pre-announcement relayed to oss-security (record). That the original date was 22 October is carried by the Foundation and indirectly by Wiz's thread and the php.net ChangeLog; that the move was because of the leak, by the Foundation and Daubois. The original hour '14:00 UTC' rests on the Foundation alone (echoed by The Hacker News), while watchTowr (via Daubois, Huntress, CybelAngel) put the embargo at Thursday 11am ET, which is 15:00 UTC.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-20-34", "file": "sources/openwall-oss-security-2026-10-20-34/captures/20261022T081408Z/text.txt", "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "result": "partial", "excerpt": "> It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "Patch: Apply the Oct 22 security release immediately (the only complete remediation).", "outside_citation": false }, { "source": "php-net-changelog-8", "file": "sources/php-net-changelog-8/captures/20261022T081558Z/text.txt", "sha256": "e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70", "result": "partial", "excerpt": "22 Oct 2026", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "The team scheduled that release for Wednesday, October 21 at 14:00 UTC, a day earlier than the original embargo", "outside_citation": false }, { "source": "cybelangel-php2shell", "file": "sources/cybelangel-php2shell/captures/20261022T112625Z/text.txt", "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "result": "partial", "excerpt": "The disclosure was originally under embargo until Thursday 22 October at 11:00 ET; after the leak, PHP scheduled its release for 21 October", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "partial", "excerpt": "Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC", "outside_citation": false } ], "quotes_checked": [ { "quote": "Apply the Oct 22 security release", "found": true, "where": "x-wiz-io-php2shell" } ], "tickets": [ "Contradiction-10", "Finding-98" ], "mode2": "Ask the PHP release managers or the distros list for the original embargo time; capture php/web-php commit history for the pre-announcement and release posts.", "display": 4, "stale": false }, { "id": "release-time", "claim_hash": "4bfc624d2663e75f", "run": "Run-9", "mode": "vault", "kind": "event", "level": 5, "verdict": "holds", "tension": "measures-differently", "contradictions": [ "K-010" ], "volatile": false, "as_of": "20261026T094000Z", "status_fit": "ok", "reason": "The correspondent reworded the claim on 26 October to what the records show: scheduled for 14:00 UTC on 21 October (php.net pre-announcement, the oss-security relay, the PHP Foundation), published between 13:31 and 13:35 UTC. The release manager's own timeline, from the repositories' history, gives 13:31 (tarballs), 13:33 (announcements), 13:34 (GitHub advisories) and 13:35 (php-src); the GitHub advisory is stamped 13:34:25Z and the tags 13:35:38 UTC, and CERT-EU says 13:30 UTC: independent primary records inside five minutes. Different artifacts carry other times (the GitHub release 14:06:46Z, the CVE records 13:48Z and 13:54Z, php.net feed authoring times), which is why the tension is 'measures-differently', not 'disputed'. K-010 stays open on the original embargo time, not on this claim.", "checked": [ { "source": "openwall-oss-security-2026-10-20-34", "file": "sources/openwall-oss-security-2026-10-20-34/captures/20261022T081408Z/text.txt", "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "result": "partial", "excerpt": "> It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "Published: 2026-10-21, 14:00 UTC", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "partial", "excerpt": "L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC).", "outside_citation": false }, { "source": "certeu-sa-2026-018", "file": "sources/certeu-sa-2026-018/captures/20261022T081329Z/text.txt", "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "result": "partial", "excerpt": "The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35", "outside_citation": false }, { "source": "github-php-src-tags", "file": "sources/github-php-src-tags/captures/20261022T081558Z/rendered.html", "sha256": "ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9", "result": "partial", "excerpt": "datetime=\"2026-10-21 13:35:38 UTC\"", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/rendered.html", "sha256": "79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110", "result": "partial", "excerpt": "datetime=\"2026-10-21T13:34:25Z\"", "outside_citation": false }, { "source": "github-php-src-tag-php-8.5.12", "file": "sources/github-php-src-tag-php-8.5.12/captures/20261022T081558Z/rendered.html", "sha256": "330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa", "result": "partial", "excerpt": "datetime=\"2026-10-21T14:06:46Z\"", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "partial", "excerpt": "It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.", "outside_citation": false }, { "source": "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell", "file": "sources/scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell/captures/20261025T114552Z/text.txt", "sha256": "ddee9f1e0bb292593c2674f5c54c40a85174c075d2ec55017124b0b23519a5f3", "result": "carries", "excerpt": "13:31: the php/web-php-distributions repository", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-10", "Finding-39", "Finding-99" ], "mode2": "The php/web-php commit history for the 21 October news entries (actual php.net publication time), and the php-announce mailing list post time.", "display": 5, "stale": false }, { "id": "scale-2.6m-hosts", "claim_hash": "8f7b6b24a8e18b7b", "run": "Run-3", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [ "K-004" ], "volatile": true, "as_of": "20261022T112314Z", "status_fit": "ok", "reason": "Rewritten to keep the counters apart: VulnCheck's 2.6 million hosts, and Censys's 1.57 million unpatched of the 1.58 million whose version it could read, of 2.58 million seen (Finding-34 fixed; K-004 now explained). Both reach the vault only through news outlets (Finding-100), so A2.", "checked": [ { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "carries", "excerpt": "VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3.", "outside_citation": false }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "carries", "excerpt": "roughly 1.58 million were reporting identifiable PHP versions, and approximately 1.57 million were not patched, Censys says.", "outside_citation": false }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "carries", "excerpt": "VulnCheck was seeing more than 2.6 million internet-facing hosts running PHP, nearly all of which were vulnerable.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "Palo Alto Networks’ Unit 42 has counted more than 22.6 million internet-facing systems that could be vulnerable.", "outside_citation": false } ], "quotes_checked": [ { "quote": "could be vulnerable", "found": true, "where": "insurancebusiness-uk-councils-met" } ], "tickets": [ "Contradiction-4", "Finding-100", "Finding-34" ], "mode2": "Censys's own post or dashboard for PHP2Shell exposure on 21-22 October; VulnCheck's blog or report giving 2,608,039 and the scan method; Unit 42's threat brief giving 22.6 million.", "display": 2, "stale": false }, { "id": "scale-30m", "claim_hash": "96652e8a49e35646", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080559Z", "status_fit": "ok", "reason": "The BBC capture carries Alan Woodward's words 'something like 30 million websites' (from Radio 4's Today). One named party, relayed by one outlet, with no population, method or counter, so A2; 'reported' fits.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Referencing the \"serious\" scale of it, he says it could affect \"something like 30 million websites\".", "outside_citation": false } ], "quotes_checked": [ { "quote": "something like 30 million websites", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Finding-101" ], "mode2": "The BBC Radio 4 Today programme audio of 22 October (Woodward segment), or Woodward's own post giving the basis for 30 million.", "display": 2, "stale": false }, { "id": "scale-70pc-internet", "claim_hash": "596a681da508c090", "run": "Run-3", "mode": "vault", "kind": "count", "level": 1, "verdict": "not-shown", "tension": "measures-differently", "contradictions": [ "K-001" ], "volatile": true, "as_of": "20261022T081624Z", "status_fit": "ok", "reason": "Reworded to Wiz's own words, with the BBC's 'roughly' attributed to the BBC (Finding-102 and Finding-124 fixed). As a statement of fact it is not shown: no capture measures a share of 'the Internet'; it is Wiz's headline restating a share of websites (K-001). 'Unverified' fits.", "checked": [ { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "a popular general-purpose scripting language that powers 70% of all websites in the world.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "with cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure.", "outside_citation": false } ], "quotes_checked": [ { "quote": "unable to independently verify that figure", "found": true, "where": "bbc-live-ckgel5xp2xv9t" }, { "quote": "roughly 70% (BBC quoting Wiz)", "found": false, "where": null } ], "tickets": [ "Contradiction-1", "Evidence-13", "Evidence-14", "Evidence-15", "Finding-102", "Finding-124" ], "mode2": "A capture of W3Techs' PHP usage page (https://w3techs.com/technologies/details/pl-php) dated 21 or 22 October, and Wiz's own answer on what 'affected' measures.", "display": 1, "stale": false }, { "id": "scale-70pc-websites", "claim_hash": "528cd61dc5f56938", "run": "Run-3", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "measures-differently", "contradictions": [ "K-001" ], "volatile": true, "as_of": "20261022T112331Z", "status_fit": "ok", "reason": "Now carries the population, 'websites whose server-side language is known' (Finding-33 fixed), which is how W3Techs measures it; Cloudflare's page links the figure to W3Techs. Three outlets repeat one survey, so A2 until the survey itself is captured (board 033). Outlets disagree on the value, about 69-70% against about 75% (Finding-103).", "checked": [ { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "PHP is used by almost 70% of websites.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/rendered.html", "sha256": "a0d3c37cde7c1721a08b028748a412672817c45958d05cc7fedaede582b5537b", "result": "carries", "excerpt": "PHP is used by almost 70% of websites.", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "an open-source programming language used to run an estimated 70% of websites.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "carries", "excerpt": "a popular general-purpose scripting language that powers 70% of all websites in the world.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "With PHP used by over 69% of websites whose server-side programming language is known", "outside_citation": false }, { "source": "tenable-php2shell-faq", "file": "sources/tenable-php2shell-faq/captures/20261022T112331Z/text.txt", "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "result": "partial", "excerpt": "According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known.", "outside_citation": false }, { "source": "rte-reuters-websites-go-dark", "file": "sources/rte-reuters-websites-go-dark/captures/20261022T081010Z/text.txt", "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "result": "partial", "excerpt": "PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs", "outside_citation": true }, { "source": "abc-au-gov-sites-exposed", "file": "sources/abc-au-gov-sites-exposed/captures/20261022T081518Z/text.txt", "sha256": "84937c7c5b87e7c94cf87f2aed94f82ebbf2824d6dea9841cd50e39111d2cb48", "result": "partial", "excerpt": "PHP runs about 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs.", "outside_citation": true } ], "quotes_checked": [ { "quote": "an estimated 70%", "found": true, "where": "x-openai-php2shell" } ], "tickets": [ "Contradiction-1", "Contradiction-12", "Evidence-15", "Finding-103", "Finding-32", "Finding-33" ], "mode2": "Capture W3Techs' PHP page (and its server-side language overview) with its date, to fix the figure, the population and the method.", "display": 2, "stale": false }, { "id": "scale-latvia", "claim_hash": "ef31c05ee9c1d1f7", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081354Z", "status_fit": "ok", "reason": "CERT.LV's own page (update of 21 Oct, 23:00 local) says about 6,000 potentially affected resources in Latvia, only a few hundred in the state sector. One primary party, no method stated, so A2 for a count; 'reported' fits.", "checked": [ { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "Kopumā Latvijā identificēti aptuveni 6000 potenciāli ietekmētu resursu, no kuriem tikai daži simti ir valsts sektorā.", "outside_citation": false } ], "quotes_checked": [ { "quote": "potentially", "found": false, "where": null } ], "tickets": [ "Finding-104" ], "mode2": "CERT.LV's English version of the post, or its method for identifying the 6,000 resources.", "display": 2, "stale": false }, { "id": "scale-ncsc-nl", "claim_hash": "1e071ad93c9cc798", "run": "Run-1", "mode": "vault", "kind": "count", "level": 6, "verdict": "holds-in-part", "tension": "contradicted", "contradictions": [], "volatile": true, "as_of": "20261022T084807Z", "status_fit": "overstated", "reason": "The inventory files at commit cca173c64ec5 are in the vault (tree and git bundle), and counting them gives 675 rows: 206 Vulnerable, 46 Fix, 418 Investigation, 4 Not vuln and 1 row with no status. The 206/46/418 figures hold; the total 674 and '3 not vulnerable' are contradicted by the file itself, because the vault's parsed JSON dropped the iBabs row. 'Confirmed' overstates a count the file contradicts.", "checked": [ { "source": "ncsc-nl-php2shell-software-list", "file": "sources/ncsc-nl-php2shell-software-list/captures/20261022T084807Z/text.txt", "sha256": "83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004", "result": "absent", "excerpt": "List of software with PHP dependency potentially affected by php2shell CVEs", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/software-list-cca173c64ec5.json", "sha256": "f0a17e96a336a8782231290acf4ba4a4f4fa469270c59a7c87a95da2207dad01", "result": "partial", "excerpt": "\"count\": 674,", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/tree-cca173c64ec5/software/software_list_i.md", "sha256": "f25e5ef68d476c053abd638b75441aa462fd630a83d7059696ff675f53fa55eb", "result": "carries", "excerpt": "|iBabs|iBabs bestuursportaal||Not vuln|Not vuln|PHP is not being used in iBabs.", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/tree-cca173c64ec5/software/README.md", "sha256": "f6516626233529762ddd0561b30cbe3d9ffb3f73802c23171bd5c48470550432", "result": "carries", "excerpt": "Product entries should still be treated as investigation leads until they are backed by an upstream or vendor source", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/php2shell-cca173c64ec5.bundle", "sha256": "4a72bcc9bbc58e886df6eee7cc875bd5deab547f1028f7525a7e7e808859411f", "result": "carries", "excerpt": null, "outside_citation": false } ], "quotes_checked": [ { "quote": "investigation leads", "found": true, "where": "ncsc-nl-php2shell" } ], "tickets": [ "Finding-105", "Finding-120", "Finding-35", "Finding-36", "Finding-37" ], "mode2": "", "display": 1, "stale": false }, { "id": "two-cves-9.2", "claim_hash": "7add37d4ad60f30a", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "Both CVE records (CNA PHP Group) carry CVSS 4.0 9.2 CRITICAL and the four fixed-in versions; the two GHSAs, both oss-security announcements and php.net agree. The authoritative record carries every number, so A6.", "checked": [ { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "carries", "excerpt": "9.2\tCRITICAL\t4.0\tCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "outside_citation": false }, { "source": "cve-cve-2026-109619", "file": "sources/cve-cve-2026-109619/captures/20261022T081219Z/text.txt", "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "result": "carries", "excerpt": "affectedfrom 8.5.*before 8.5.12", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Patched versions\n8.2.35\n8.3.36\n8.4.27\n8.5.12", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "Critical\n9.2\n/ 10\nCVSS v4 base metrics", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "carries", "excerpt": "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-6", "file": "sources/openwall-oss-security-2026-10-21-6/captures/20261022T081408Z/text.txt", "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "result": "carries", "excerpt": "Severity: Critical (CVSS v4.0: 9.2)", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-3", "Contradiction-7", "Evidence-10", "Evidence-17", "Evidence-6" ], "mode2": "", "display": 6, "stale": false }, { "id": "uk-list", "claim_hash": "dd7e07b64a5edc16", "run": "Run-1", "mode": "vault", "kind": "event", "level": 3, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112915Z", "status_fit": "ok", "reason": "LBC and Insurance Business carry Edinburgh and Oxford councils and the Met Police unavailable and errors on Bristol, Lambeth and Barnet, in near-identical wording that points to one origin (A3). Neither cited source mentions the Office for Budget Responsibility; only the uncited EADT (PA) says the OBR \"had to take down its website\".", "checked": [ { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "carries", "excerpt": "Edinburgh and Oxford Council as well as the online home for The Traitors were taken down as was The Met Police website.", "outside_citation": false }, { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "carries", "excerpt": "Error messages were displayed on the Bristol, Lambeth and Barnet council websites.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "In the UK, the sites reported unavailable included those of Edinburgh and Oxford councils and the Met Police.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "Error messages also appeared on the Bristol, Lambeth and Barnet council websites.", "outside_citation": false }, { "source": "eadt-minister-budget-no-breach", "file": "sources/eadt-minister-budget-no-breach/captures/20261022T112742Z/text.txt", "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "result": "carries", "excerpt": "because the Office for Budget Responsibility (OBR) had to take down its website.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-5", "Evidence-2", "Finding-106", "Finding-31" ], "mode2": "The OBR's and the Met Police's own statements, and captures of bristol.gov.uk, lambeth.gov.uk and barnet.gov.uk during 21 Oct.", "display": 3, "stale": false }, { "id": "versions-old", "claim_hash": "f0333afe41e4bf1c", "run": "Run-1", "mode": "vault", "kind": "state", "level": 3, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-003" ], "volatile": true, "as_of": "20261022T081624Z", "status_fit": "ok", "reason": "Wiz (a finder) says '>= 5.4'; PHP's own source backports for 7.4, 8.0 and 8.1 imply those are affected; only NCSC-NL and CERT-FR say all of 5.x, and both pre-release texts look like echoes of the leak (CERT-FR lists a 6.x that never shipped). The CVE records list only 8.2 to 8.5 with default unaffected. So 7.4+ is well supported, 5.4+ rests on Wiz, and 5.0 to 5.3 is not shown; disputed caps display at A2.", "checked": [ { "source": "ncsc-nl-advisories", "file": "sources/ncsc-nl-advisories/captures/20261022T081605Z/text.txt", "sha256": "b7e4ac6caf7d177d8b7e55fa8c587da75a1e78fafc951012d2d2595a6dfa5e8b", "result": "carries", "excerpt": "Alle versies vanaf versie 5 zijn in ieder geval kwetsbaar.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "All php versions >= 5.4 are affected by at least 1 of these vulnerabilities.", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "carries", "excerpt": "PHP toutes versions 5.x\nPHP toutes versions 6.x\nPHP toutes versions 7.x", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-22-2.html", "sha256": "bbc0f0fc06953b13308925334e39e7808796e46ea9505630917762502996bea2", "result": "partial", "excerpt": "which implies that at \nleast versions down to 7.4 are affected as well", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "absent", "excerpt": "Default Status: unaffected", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "partial", "excerpt": "the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "the same jump sits in the PHP-5.3 allocator. I have not seen an exploit shown on those old versions either.", "outside_citation": false }, { "source": "thehackernews-php2shell-unpatched-alert", "file": "sources/thehackernews-php2shell-unpatched-alert/captures/20261022T113144Z/text.txt", "sha256": "33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b", "result": "partial", "excerpt": "a post on HN said two PHP remote code execution flaws, rated CVSS 10.0 and affecting versions from PHP 5 onward", "outside_citation": false } ], "quotes_checked": [ { "quote": ">= 5.4", "found": true, "where": "x-wiz-io-php2shell" }, { "quote": "unaffected", "found": true, "where": "cve-cve-2026-109618" } ], "tickets": [ "Contradiction-3", "Evidence-16", "Evidence-9", "Finding-107", "Finding-50" ], "mode2": "A PHP security team statement or GHSA update on whether PHP 5.x and 7.0 to 7.3 are affected (or a CVE record update adding 7.4 to 8.1), and Wiz's technical basis for 5.4.", "display": 3, "stale": false }, { "id": "vibe-code", "claim_hash": "49983c1bd156e3ef", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 1, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080854Z", "status_fit": "ok", "reason": "The BBC carries it only as 'Researchers say', unnamed and second hand (A1). The nearest named source in the vault, watchTowr's Jake Knott via The Record, says it sees in-the-wild exploitation with proof-of-concept tools 'vibecoded with the help of AI'; that does not show who coded them.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Researchers say the criminals themselves are using AI to 'vibe code' a method of attack.", "outside_citation": false }, { "source": "therecord-php-warnings", "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "result": "partial", "excerpt": "observing in-the-wild exploitation of the vulnerabilities with a variety of proof-of-concept tools vibecoded with the help of AI.", "outside_citation": true } ], "quotes_checked": [ { "quote": "vibe code", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Finding-108" ], "mode2": "watchTowr's own intelligence post (blocked to the capture tool) or Knott's statement on the record.", "display": 1, "stale": false }, { "id": "waf", "claim_hash": "16a9665e0399137c", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081700Z", "status_fit": "understated", "reason": "CISA's alert carries the sentence nearly verbatim, so the advice is established as CISA's. BACS ('alone is not sufficient') and Cloudflare (attackers mutating payloads) qualify it but do not contradict 'some protection'; CERT-FR also recommends WAF-level blocking. 'Disputed' overstates the disagreement.", "checked": [ { "source": "cisa-alert-php-20261021", "file": "sources/cisa-alert-php-20261021/captures/20261022T081353Z/text.txt", "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "result": "carries", "excerpt": "A web application firewall may provide some protection until systems are updated or patched.", "outside_citation": false }, { "source": "ch-bacs-warnung-php", "file": "sources/ch-bacs-warnung-php/captures/20261022T081700Z/text.txt", "sha256": "99886a19aead8abe4faab9f41918c8654a2e070c816f856c0dd3e14a194d6890", "result": "partial", "excerpt": "They do not provide complete protection and are no substitute for security updates. Even a web application firewall alone is not sufficient.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "partial", "excerpt": "We observed how attackers were mutating the attack payload to try to bypass our protections", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "partial", "excerpt": "Ces mesures peuvent être réalisées au niveau d'un pare-feu applicatif (Web Application Firewall).", "outside_citation": false } ], "quotes_checked": [ { "quote": "Even a web application firewall alone is not sufficient.", "found": true, "where": "ch-bacs-warnung-php" } ], "tickets": [ "Finding-109", "Finding-51" ], "mode2": "", "display": 6, "stale": false }, { "id": "waf-nine-hours", "claim_hash": "47bf85da500a9265", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112525Z", "status_fit": "overstated", "reason": "Only Cloudflare gives a pre-disclosure go-live time (03:02 UTC on 21 Oct, its own account). Imperva says it verified protection and monitored before the announcement but gives no time; Akamai and Fastly give only a 21 October post date; Fortinet's article is dated 22 October 07:55, after disclosure, so 'went live hours before disclosure' does not cover it. Each date is the vendor's own word, A2; 'confirmed' overstates.", "checked": [ { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "enabling Imperva to verify its protection and begin monitoring customer traffic before the announcement.", "outside_citation": false }, { "source": "akamai-blog-php-core-rce", "file": "sources/akamai-blog-php-core-rce/captures/20261022T112525Z/text.txt", "sha256": "2a001600cd450bc582ed42e8355951626ef8ae60e5c4afe233629dbeeaacba5b", "result": "partial", "excerpt": "Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "partial", "excerpt": "To mitigate risk for your applications protected by NGWAF, Fastly customers may enable the signal covering both CVE-2026-109618 & CVE-2026-109619.", "outside_citation": false }, { "source": "fortinet-fortiweb-php2shell", "file": "sources/fortinet-fortiweb-php2shell/captures/20261022T112039Z/text.txt", "sha256": "66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4", "result": "partial", "excerpt": "10/22/2026 | 07:55 AM", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-110", "Finding-46", "Finding-47" ], "mode2": "Akamai's and Fastly's rule changelogs (rule 3000991 release time; Fastly NGWAF templated rule release), Imperva's release notes, and FortiGuard's database 0.00438 release time.", "display": 2, "stale": false }, { "id": "watchtowr-itw", "claim_hash": "ce7243b7fb249b85", "run": "Run-6", "mode": "vault", "kind": "attribution", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [ "K-002" ], "volatile": true, "as_of": "20261023T232528Z", "status_fit": "understated", "reason": "watchTowr's own pages are now captured (23 October): its intel page lists both CVEs as 'EXPLOITED IN THE WILD: Yes', and its FAQ says it 'has observed exploitation in the wild through its Attacker Eye honeypot network'. The claim is an attribution, and watchTowr's own page is the primary record of what watchTowr says: A6, and the site's 'unverified' understates it. What watchTowr measures is honeypot traffic, the same kind of evidence as Amazon's (K-002); its own words elsewhere say none of the sprayed exploits succeeded (Finding on the missing qualifier stays open).", "checked": [ { "source": "watchtowr-php2shell", "file": "sources/watchtowr-php2shell/captures/20261022T111839Z/text.txt", "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "result": "blocked", "excerpt": "Access to watchtowr.com was denied", "outside_citation": false }, { "source": "watchtowr-php2shell-faq", "file": "sources/watchtowr-php2shell-faq/captures/20261022T111847Z/text.txt", "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "result": "blocked", "excerpt": "Access to watchtowr.com was denied", "outside_citation": false }, { "source": "securityweek-first-attempts-sensors", "file": "sources/securityweek-first-attempts-sensors/captures/20261022T112324Z/text.txt", "sha256": "b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41", "result": "carries", "excerpt": "it has seen the first in-the-wild exploitation attempts hitting its sensors around the same time the patches landed, but has not observed successful attempts.", "outside_citation": true }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "carries", "excerpt": "WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub.", "outside_citation": true }, { "source": "darkreading-php2shell-red-alert", "file": "sources/darkreading-php2shell-red-alert/captures/20261022T112357Z/text.txt", "sha256": "6db30e279f5f38773c58ae71e0d753d7a7f90fcf4148ea65658c2f967de7f32d", "result": "carries", "excerpt": "WatchTowr reported it has observed exploitation attempts of both flaws in the wild.", "outside_citation": true }, { "source": "therecord-php-warnings", "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "result": "carries", "excerpt": "the cybersecurity company is also observing in-the-wild exploitation of the vulnerabilities", "outside_citation": true }, { "source": "tenable-php2shell-faq", "file": "sources/tenable-php2shell-faq/captures/20261022T112331Z/text.txt", "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "result": "carries", "excerpt": "watchTowr says it has reproduced both vulnerabilities and is observing exploitation attempts against both.", "outside_citation": true }, { "source": "equixly-php2shell-what-we-know", "file": "sources/equixly-php2shell-what-we-know/captures/20261022T112832Z/text.txt", "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "result": "absent", "excerpt": "watchTowr lists no reported exploitation, and neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog.", "outside_citation": true }, { "source": "securityweek-mass-exploitation-looms", "file": "sources/securityweek-mass-exploitation-looms/captures/20261022T113111Z/text.txt", "sha256": "693aa4300139d2afc431484c18fe038f9b0b2fb411a89b5defbdad622958e851", "result": "absent", "excerpt": "WatchTowr and Huntress say they have not seen either of the vulnerabilities being exploited in the wild.", "outside_citation": true }, { "source": "watchtowr-php2shell", "file": "sources/watchtowr-php2shell/captures/20261023T232528Z/text.txt", "sha256": "e09524178ed5f328df70485889aa78f37e3bf819682db33e22b4d1a875d1199f", "result": "carries", "excerpt": "EXPLOITED IN THE WILD: Yes , reported by watchTowr", "outside_citation": false }, { "source": "watchtowr-php2shell-faq", "file": "sources/watchtowr-php2shell-faq/captures/20261023T160435Z/text.txt", "sha256": "3c561d0c08e9343f817d78c30427c55eb4a491ccd2a59babcb879a65da8def37", "result": "carries", "excerpt": "watchTowr has observed exploitation in the wild through its Attacker Eye honeypot network.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-2", "Finding-111", "Finding-127", "Finding-18", "Finding-19" ], "mode2": "watchTowr's intelligence pages captured from a non-blocked client (or archive.org), to settle the 'lists as exploited' wording and its date.", "display": 6, "stale": false }, { "id": "weirdgloop-13h", "claim_hash": "1c331f2873fcbfac", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111827Z", "status_fit": "overstated", "reason": "The operator's own blog carries both parts verbatim: webservers off for all wikis, a 13-hour downtime, and about 94% of wiki pageviews served correctly. The 13-hour outage is the operator's own record of its own action, but the 94% is a self-reported figure with no stated method, which the model caps at A2, so \"confirmed\" overstates it.", "checked": [ { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "carries", "excerpt": "we turned off the webservers for all of the wikis hosted by Weird Gloop, until a patch was released 2 hours ago.", "outside_citation": false }, { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "carries", "excerpt": "This 13-hour downtime was the longest outage we’ve ever had.", "outside_citation": false }, { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "carries", "excerpt": "we were able to keep about 94% of wiki pageviews serving correctly, even with no database or PHP running.", "outside_citation": false } ], "quotes_checked": [ { "quote": "the longest outage we've ever had", "found": true, "where": "weirdgloop-blog-php2shell" } ], "tickets": [ "Finding-112" ], "mode2": "Weird Gloop's Cloudflare analytics or a follow-up post giving the start and end times and the measurement behind 94%.", "display": 2, "stale": false }, { "id": "who-first", "claim_hash": "3e517597ecfb2aef", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T081603Z", "status_fit": "overstated", "reason": "The dates under it are well carried: the hash tweet date is on X and the snowflake ID 2085031675382071483 decodes to 2026-08-05T15:54:24Z (A6); the 11 August report is in both Calif's and the Foundation's pages (A5); the 1 August discovery date is Calif's own word only (A2). 'Found the flaws first' is a reading (max A3): the Foundation says the OOM root cause was found in 2024, OpenAI reported the same root cause the same day, and nothing shows Calif found the second CVE first.", "checked": [ { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "carries", "excerpt": "Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.", "outside_citation": false }, { "source": "x-lcfr-hax-hash-tweet", "file": "sources/x-lcfr-hax-hash-tweet/captures/20261022T081603Z/text.txt", "sha256": "2c10f3991caf3a74b21df9d9e0362fd1bab8aefc5113877a412dac999ca36372", "result": "carries", "excerpt": "d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac\n15:54 · 5 Aug 2026", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "partial", "excerpt": "Ryan at Calif.io reporter\nWiz reporter\nOpenAI finder", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-113", "Finding-2" ], "mode2": "Ask Calif (Ryan Austin) for the pre-image of d935be02...24ac; ask OpenAI (Amy Burnett, Codex Security) for its own discovery date.", "display": 3, "stale": false }, { "id": "wikimedia-precaution", "claim_hash": "f90170e1f00e47de", "run": "Run-1", "mode": "vault", "kind": "quote", "level": 4, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113026Z", "status_fit": "ok", "reason": "The quoted words are verbatim in The Cyber Express and, outside this claim's citations, in Newsweek (emailed statement to Newsweek) and the Reuters factbox, which each received the Foundation's statement; CNN independently carries \"precautionary measure\". Several independent outlets but no Wikimedia-published page, so A4; \"reported\" fits.", "checked": [ { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "carries", "excerpt": "“We have taken down a number of other systems as a precautionary measure until they can be safely patched,” the Wikimedia Foundation said", "outside_citation": false }, { "source": "cnn-php2shell-websites-shut", "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "result": "partial", "excerpt": "and that a number of its systems had been taken down as a “precautionary measure.”", "outside_citation": false }, { "source": "newsweek-php2shell-websites", "file": "sources/newsweek-php2shell-websites/captures/20261022T112237Z/text.txt", "sha256": "323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294", "result": "carries", "excerpt": "We have taken down a number of other systems as a precautionary measure until they can be safely patched.", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "carries", "excerpt": "\"We have taken down a number of other systems as a precautionary measure until they can be safely patched,\" the foundation added.", "outside_citation": false }, { "source": "insiderpaper-archive-wikipedia", "file": "sources/insiderpaper-archive-wikipedia/captures/20261022T081314Z/text.txt", "sha256": "dba4741ae1b287deea2eafb352e4943ec73bc0fc0e568707b6083cdf1baade63", "result": "partial", "excerpt": "It said several systems had been taken offline as a precaution while security patches were being applied.", "outside_citation": true }, { "source": "wikimediastatus-page", "file": "sources/wikimediastatus-page/captures/20261022T081850Z/text.txt", "sha256": "13e068d2c2b3665d1ad67a02da3752c77bb617ab952507f4cbc16168b0e1a72f", "result": "absent", "excerpt": "All Systems Operational", "outside_citation": true } ], "quotes_checked": [ { "quote": "as a precautionary measure until they can be safely patched", "found": true, "where": "cyberexpress-php2shell-gov-sites" }, { "quote": "as a precautionary measure until they can be safely patched", "found": false, "where": "cnn-php2shell-websites-shut" } ], "tickets": [ "Finding-114", "Finding-29" ], "mode2": "A capture of the Foundation's own statement (diff.wikimedia.org, Phabricator task or the wikimediastatus.net incident history for 21 Oct).", "display": 4, "stale": false }, { "id": "wiz-independent", "claim_hash": "c7c4dd7d6ac3447b", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081624Z", "status_fit": "ok", "reason": "Wiz's timeline carries 'discovers the first PHP vulnerability' on 19 August and the report on 24 August, and the Foundation independently confirms a Wiz report on 24 August. 'Independently' is not in any captured primary: Wiz itself says it worked with Calif and OpenAI 'on discovery', and the Foundation frames Wiz's report as 'further attack vectors'. 'The first flaw' means Wiz's first finding, not the first flaw overall.", "checked": [ { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "BREAKING: @wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.", "outside_citation": false } ], "quotes_checked": [ { "quote": "Wiz Research uncovers", "found": false, "where": null } ], "tickets": [ "Finding-115", "Finding-4" ], "mode2": "Ask Wiz whether it knew of Calif's or OpenAI's reports before 19 August; capture OpenAI's blog (says 'independently', per snippet).", "display": 2, "stale": false }, { "id": "wordpress-drupal", "claim_hash": "5559da58f5b1dd44", "run": "Run-3", "mode": "vault", "kind": "state", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081047Z", "status_fit": "ok", "reason": "Now framed as the researchers' own tests, which is what the captures carry: Wiz and Calif say they achieved pre-authentication RCE against these applications. Eight of the eleven rest on Calif's list alone, and Calif's demonstration video is not captured, so it stays at A2 (Finding-116).", "checked": [ { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "carries", "excerpt": "We confirmed pre-auth RCE on the following PHP apps as well as arbitrary PHP scripts in some instances.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest)", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "absent", "excerpt": "We have not built or reproduced a proof of concept for these vulnerabilities", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-116" ], "mode2": "An independent reproduction (e.g. watchTowr, a CERT, or a vendor lab) against any of the listed applications, or capture of Calif's demo video.", "display": 2, "stale": false } ], "unassessed": [], "contradictions": [ { "id": "K-001", "measure": "How much of the web: 70% of websites, or 70% of the Internet?", "status": "explained", "claims": [ "scale-70pc-internet", "scale-70pc-websites" ], "statements": [ { "who": "Wiz (blog body)", "when": "2026-10-21", "says": "a popular general-purpose scripting language that powers 70% of all websites in the world", "measures": "share of websites using PHP", "sources": [ "wiz-blog-php2shell" ] }, { "who": "Wiz (blog headline and @wiz_io on X)", "when": "2026-10-21", "says": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "measures": "the same figure, restated as a share of the Internet", "sources": [ "wiz-blog-php2shell", "x-wiz-io-php2shell" ] }, { "who": "BBC live page", "when": "2026-10-22 08:05 UTC capture", "says": "cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure", "measures": "the Wiz figure, quoted with a word ('roughly') that is not in Wiz's post", "sources": [ "bbc-live-ckgel5xp2xv9t" ] }, { "who": "CNN", "when": "2026-10-22 11:26 UTC capture", "says": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet", "measures": "headline: share of the Internet; its own body says 'powers 70% of all websites'", "sources": [ "cnn-php2shell-websites-shut" ] } ], "reading": "One origin, Wiz, restated: a share of websites using PHP became a share of 'the Internet' affected, inside Wiz's own post. Every outlet in the vault that carries the figure traces to Wiz, so it is one source, not several (restates, not corroborates). None of them says how the 70% was measured; it matches the usual web-technology survey figure for sites whose server-side language is known, which is a share of websites, not of hosts, traffic or 'the Internet', and not a count of vulnerable installations. The BBC's 'roughly 70%' puts a word in Wiz's mouth that its post does not use. Run 3 (24 October): the investigation php-share traces 127 statements of the share in the vault to their origin and measures them against W3Techs, the HTTP Archive, BuiltWith and the scanners; it is on /factcheck/investigations/php-share/.", "settle": "The survey Wiz relied on, captured, with its population and method.", "ticket": "Contradiction-1" }, { "id": "K-002", "measure": "Is php2shell being exploited?", "status": "explained", "claims": [ "no-exploitation", "cisa-none", "amazon-honeypot", "probing", "watchtowr-itw", "no-confirmed-compromise" ], "statements": [ { "who": "Amazon Threat Intelligence (CJ Moses, AWS Security Blog)", "when": "2026-10-21", "says": "we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild.", "measures": "exploitation attempts against Amazon's MadPot honeypot sensors, from 17 October and in volume from 21 October 02:00 UTC", "sources": [ "aws-security-blog-madpot" ] }, { "who": "CISA (alert)", "when": "2026-10-21", "says": "While CISA has not observed exploitation of these vulnerabilities as of the time of publication", "measures": "exploitation observed by CISA, as of the alert's publication", "sources": [ "cisa-alert-php-20261021" ] }, { "who": "CISA ADP (SSVC in both CVE records)", "when": "2026-10-21 14:34 UTC", "says": "Exploitation: none", "measures": "CISA's SSVC exploitation decision point at the time it was scored; unchanged in the records fetched 2026-10-22 18:27 UTC", "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619" ], "outside": [ "https://cveawg.mitre.org/api/cve/CVE-2026-109618" ] }, { "who": "CISA KEV catalog", "when": "fetched 2026-10-22 18:27 UTC (catalog version 2026.10.21, released 2026-10-21 14:04 UTC)", "says": "Neither CVE-2026-109618 nor CVE-2026-109619 is in the catalog's 1,754 entries.", "measures": "CISA's official list of vulnerabilities with reliable evidence of exploitation", "outside": [ "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" ] }, { "who": "The Next Web", "when": "2026-10-22 (fetched 18:30 UTC, sha256 c51dfb0561b1bdb2)", "says": "Officials in Germany, the Netherlands and Japan say they have not seen one succeed.", "measures": "successful exploitation, as seen by national officials", "outside": [ "https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches" ] }, { "who": "Amazon (the same AWS Security Blog post, as revised)", "when": "modified 2026-10-22 21:25 UTC", "says": "PHP2Shell is now seeing broad exploitation attempts in the wild.", "measures": "Amazon's own revision of 'is now being broadly exploited in the wild', with no note; captured in the vault on 23 October (capture 20261023T160435Z)", "outside": [], "sources": [ "aws-security-blog-madpot" ] }, { "who": "Sophos, via Cyber Security News", "when": "correction at 2026-10-22 21:21 UTC", "says": "Sophos said its customer data showed scanning and a small number of failed exploit attempts.", "measures": "Sophos's own success claim, withdrawn", "sources": [ "cybersecuritynews-critical-php2shell-exploit-code" ] }, { "who": "watchTowr (its own intel page and FAQ)", "when": "captured 2026-10-23", "says": "watchTowr has observed exploitation in the wild through its Attacker Eye honeypot network.", "measures": "honeypot traffic, listed by watchTowr as 'EXPLOITED IN THE WILD: Yes'", "sources": [ "watchtowr-php2shell-faq", "watchtowr-php2shell" ] } ], "reading": "They measure different things at different times. Amazon counts attempts against its own sensors and honeypots; CISA and KEV record exploitation it has evidence of against real systems. Both can be true at once: attempts in volume, and no confirmed compromise of a named organisation. The site should never write 'exploited' without saying which of the two it means. Amazon's 'broadly exploited' is the stronger word, sourced to Amazon's own post in the vault; a KEV entry would be the first official signal that attempts have become compromises. Run 3 (24 October): Amazon itself has since narrowed its sentence from 'broadly exploited' to 'broad exploitation attempts', without a note: the strongest word on the exploitation side now agrees with the officials' reading. Run 5 (24 October): Sophos withdrew its earlier success claim at 21:21 UTC on 22 October, the same evening Amazon narrowed its wording: both strongest 'exploited' statements were walked back to attempts.", "settle": "A KEV entry for either CVE, or a named organisation confirming a compromise.", "ticket": "Contradiction-2" }, { "id": "K-003", "measure": "Which PHP versions are affected?", "status": "explained", "claims": [ "versions-old", "two-cves-9.2" ], "statements": [ { "who": "Cloudflare", "when": "2026-10-21", "says": "The vulnerabilities affect all web servers running PHP 5.4 or later", "measures": "affected versions", "sources": [ "cloudflare-blog-php2shell-waf" ] }, { "who": "The CVE records (CNA: PHP Group)", "when": "2026-10-21", "says": "affected: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12", "measures": "the supported branches that received a fixed release", "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619" ] }, { "who": "php.net advisory", "when": "2026-10-21", "says": "the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1", "measures": "the branches that got a source backport", "sources": [ "php-net-advisory" ] }, { "who": "NVD (configuration)", "when": "fetched 2026-10-22 18:27 UTC", "says": "cpe:2.3:a:php:php, versionEndExcluding 8.2.35, with no starting version", "measures": "NVD encodes every version before 8.2.35 as vulnerable", "sources": [ "nvd-cve-2026-109618", "nvd-cve-2026-109619" ] }, { "who": "CrowdStrike (blog), relayed to oss-security by Greenbone", "when": "fetched 2026-10-24 07:57 UTC", "says": "The specific HashTable ordering behind CVE-2026-109618 was introduced by a performance optimization in October 2017 and first shipped in PHP 7.3.0 (December 2018).", "measures": "when each flaw's code path entered PHP: CVE-2026-109618 from 7.3.0; CVE-2026-109619's paths from 7.1 (serialization) and 5.4 (session)", "outside": [ "https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/ (sha256 e46a2935d6002eed)" ] } ], "reading": "Affected, supported and patched are three different lists. The CVE record lists only the supported branches the PHP project fixed; the backports reach down to 7.4; Cloudflare and NVD describe what is vulnerable, which goes back further. They are compatible, but read as a contradiction unless the site says so where it shows the version table. Run 4 (24 October): CrowdStrike gives each flaw its own start: CVE-2026-109618 from PHP 7.3.0, CVE-2026-109619 back to 5.4 through the session path. If it holds, 'every version since 5.4' is true only of the second flaw. CrowdStrike's own page also says both are in 'every PHP release from the 7.x and 8.x series', which its next sentence contradicts for 7.0 to 7.2. Not captured; the PHP project has not said.", "settle": "The PHP project stating the earliest affected version.", "ticket": "Contradiction-3" }, { "id": "K-004", "measure": "How many systems are still unpatched?", "status": "explained", "claims": [ "scale-2.6m-hosts" ], "statements": [ { "who": "Censys, via SecurityWeek", "when": "2026-10-21 (SecurityWeek captured 2026-10-22 11:23 UTC)", "says": "Out of 2.58 million internet-facing hosts seen on October 21, roughly 1.58 million were reporting identifiable PHP versions, and approximately 1.57 million were not patched", "measures": "unpatched hosts among those whose PHP version is visible, on release day", "sources": [ "securityweek-exploitation-days-before" ] }, { "who": "VulnCheck, VirusTotal and Censys, via SecurityWeek", "when": "2026-10-21", "says": "more than 1 million PHP servers were running unpatched software releases as of October 21", "measures": "a floor, with no method given", "sources": [ "securityweek-exploitation-days-before" ] }, { "who": "BBC, attributed only to 'researchers'", "when": "2026-10-22, after the vault's last capture", "says": "Major providers have implemented a fix, but globally 90% of systems at risk are yet to do so, researchers say.", "measures": "unknown population and method", "outside": [ "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t (fetched 2026-10-22 18:30 UTC, sha256 3842343a8de23fc9)" ] } ], "reading": "The site's claim reads as 1.57 million unpatched out of about 2.6 million hosts (about 60%). The source says 1.57 million out of the 1.58 million whose version could be read (about 99%, on the day the fix shipped); the 2.58 million is all hosts seen, most of which do not announce a version. The two framings give very different pictures. The BBC's 90% has no named counter or method and is not captured. Open, because the site states one framing as fact. Run 3 (24 October): the site now states both counters and Censys's denominator, so the framing difference is explained on the page; the BBC's 90% stays uncaptured.", "settle": "Censys's own post (the vault notes say it was not found), or a later Censys count with the same population.", "ticket": "Contradiction-4" }, { "id": "K-005", "measure": "How many UK government services went down?", "status": "open", "claims": [ "uk-list" ], "statements": [ { "who": "The BBC live page, reporting a UK minister", "when": "2026-10-22, after the vault's last capture", "says": "In the UK, a minister said just after midday that 32 government services were unavailable and four partially unavailable because they were being fixed", "measures": "central government services, at one moment", "outside": [ "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t (fetched 2026-10-22 18:30 UTC, sha256 3842343a8de23fc9)" ] }, { "who": "The Register", "when": "2026-10-22", "says": "dozens of UK government services", "measures": "unspecified; seen in the coverage review session, not fetched or captured by this desk", "outside": [ "The Register follow-up, URL not recorded in the coverage review" ] } ], "reading": "Probably the same count, described loosely by The Register. The BBC's line is verified in a fetch by this desk; it says 'a minister' without naming one or the House, so the coverage review's 'in the House of Lords' is not yet carried by any source this desk has read. Neither is captured into the vault: this record is a request to capture.", "settle": "The Hansard record of the minister's answer, captured.", "ticket": "Contradiction-5" }, { "id": "K-006", "measure": "How many sites were taken offline?", "status": "explained", "claims": [ "affected-sites" ], "statements": [ { "who": "This site's impact ledger (data/impact.json)", "when": "vault capture to 2026-10-22 11:34 UTC", "says": "10 operators offline", "measures": "operators with a captured source in the exported manifest" }, { "who": "PHPocalypse Tracker (Luka Kladaric)", "when": "fetched 2026-10-22 18:27 UTC", "says": "50 sites in sites.csv, 2 of them with no back-up time", "measures": "sites first reported dark by any public source, aggregators included, with dark and back-up times", "outside": [ "https://allixsenos.github.io/phpocalypse-tracker/sites.csv" ] }, { "who": "The evidence vault itself", "when": "head 31ccc515c29f", "says": "40 sources not exported to this site, among them captures of Edinburgh council, French prefectures, ANTS, UNIGE, EPFL, Wikimedia status, and reports from Reuters, The Record and Global News", "measures": "captured but not yet on the site" } ], "reading": "Breadth of collection, and an export lag. The site requires a captured source per row; the tracker accepts aggregator reports and says so per row. Part of the gap is not collection at all: the vault already holds captures of more offline operators than the site shows, because the site's export stopped at 144 sources.", "settle": "Re-run the vault export; capture the tracker's sites.csv into the source watch on a schedule.", "ticket": "Contradiction-6" }, { "id": "K-007", "measure": "How severe: CVSS 10.0, 9.2 or 9.8?", "status": "explained", "claims": [ "cvss-10", "two-cves-9.2" ], "statements": [ { "who": "Social posts relayed during the leak", "when": "2026-10-20", "says": "a wrong CVSS score of 10.0 (the actual score is 9.2)", "measures": "a leaked number, corrected by the PHP Foundation", "sources": [ "php-foundation-blog-security-release" ] }, { "who": "The CVE records (CNA: PHP Group)", "when": "2026-10-21", "says": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, base score 9.2", "measures": "CVSS version 4.0, scored by the vendor", "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619" ] }, { "who": "NVD (NIST)", "when": "NVD record modified 2026-10-22 10:09 UTC", "says": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8", "measures": "CVSS version 3.1, scored by NIST, which rates attack complexity low where the vendor rated it high", "sources": [ "nvd-cve-2026-109618", "nvd-cve-2026-109619" ] } ], "reading": "10.0 was wrong. 9.2 and 9.8 are both right, on two different scales scored by two different parties, and they disagree on one input: the vendor says attack complexity is high, NIST says low. The site explains 10.0 against 9.2 but never mentions 9.8, which is what a reader checking NVD, or a scanner reporting CVSS 3.1, will see.", "settle": "Already settled as a reading; the site should carry the 9.8 and say what differs.", "ticket": "Contradiction-7" }, { "id": "K-008", "measure": "Which flaw was shown to give code execution on PHP-FPM?", "status": "open", "claims": [ "rce-fpm", "rce-modphp" ], "statements": [ { "who": "The PHP Foundation (blog)", "when": "2026-10-21", "says": "Remote code execution was also confirmed on PHP-FPM through application-level code paths", "measures": "placed under CVE-2026-109618 in the post", "sources": [ "php-foundation-blog-security-release" ] }, { "who": "PHP security team (GHSA-w8hw-w9fx-j79w, CVE-2026-109618)", "when": "2026-10-21", "says": "no complete FPM exploit has been demonstrated for this SAPI", "measures": "CVE-2026-109618 on FPM", "sources": [ "github-ghsa-w8hw-w9fx-j79w" ] }, { "who": "PHP security team (GHSA-6wmf-4rv5-p3rp, CVE-2026-109619)", "when": "2026-10-21", "says": "It works with a normal dynamic FPM pool, although it depends on a suitable application operation.", "measures": "CVE-2026-109619 on FPM", "sources": [ "github-ghsa-6wmf-4rv5-p3rp" ] } ], "reading": "The advisories, written by the PHP security team per CVE, put the demonstrated FPM exploit under CVE-2026-109619, and say none was demonstrated for CVE-2026-109618. The Foundation's blog places FPM confirmation under CVE-2026-109618. The blog appears to have swapped the attribution. That RCE was shown on FPM is not in doubt; which flaw does it is.", "settle": "A correction to the Foundation's post, or a PHP security team statement.", "ticket": "Contradiction-8" }, { "id": "K-009", "measure": "Did any technical detail leak on 20 October?", "status": "explained", "claims": [ "leak-cve-ids", "leak-hn", "leak-video" ], "statements": [ { "who": "The PHP Foundation", "when": "2026-10-21", "says": "They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.", "measures": "what circulated with the CVE IDs", "sources": [ "phpfoundation-blog-security-release-leak" ] }, { "who": "Daubois (a member of the PHP security team, own blog)", "when": "2026-10", "says": "A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down", "measures": "a tool screenshot and a video", "sources": [ "daubois-blog-php2shell-rumors" ] }, { "who": "The Hacker News", "when": "2026-10-21", "says": "details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time", "measures": "claims a PoC leaked", "sources": [ "thehackernews-php2shell-4days" ] }, { "who": "Equixly, citing Sansec", "when": "2026-10", "says": "Sansec cites a leaked screenshot of an exploit tool named PHP2Shell, whose banner claims the tool works against PHP 5.4.0 and later.", "measures": "a screenshot of a tool banner", "sources": [ "equixly-php2shell-what-we-know" ] }, { "who": "The Register, reporting the Foundation", "when": "2026-10-22", "says": "At that point, no technical details leaked.", "measures": "the Foundation's statement, with the time it applies to", "sources": [ "theregister-php-blames-chainguard" ] }, { "who": "Feross Aboukhadijeh (Socket) on X", "when": "2026-10-21 23:02 UTC", "says": "The CVE IDs leaked the day before, and Calif accidentally posted an exploit video that evening.", "measures": "the order of events on 20 October", "sources": [ "x-feross-chainguard" ] } ], "reading": "Probably different meanings of 'technical detail'. A screenshot of a tool banner and a demonstration video show that an exploit exists, not how it works; the Foundation may mean that no root cause or code leaked. The Hacker News's 'proof-of-concept exploit leaked' is stronger than anything else in the vault carries, and no capture shows a leaked PoC. Open until the Foundation or Daubois says what the Foundation meant. Run 3 (24 October), a fresh look with 112 more sources in the vault: the difference is time. The Foundation's 'no technical details leaked' describes the CVE IDs circulating from about 15:00 UTC on 20 October; The Register's report of it says 'At that point'. Calif's exploit video went up 'that evening' (Feross; Daubois; Wikipedia), after the pre-announcement. A video and a tool banner show that an exploit exists, not how it works; no capture shows leaked exploit code, so The Hacker News's 'proof-of-concept exploit leaked' most likely means the video. Both statements hold, each at its own time; a page that quotes the Foundation should keep its time.", "settle": "A capture of the leaked screenshot or video, or the Foundation saying what 'technical details' covers.", "ticket": "Contradiction-9" }, { "id": "K-010", "measure": "When was the release planned, and when did it ship?", "status": "open", "claims": [ "release-moved", "release-time" ], "statements": [ { "who": "The PHP Foundation", "when": "2026-10-21", "says": "It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.", "measures": "the planned times", "sources": [ "php-foundation-blog-security-release" ] }, { "who": "The Hacker News", "when": "2026-10-21", "says": "Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC", "measures": "the original plan, probably from the Foundation", "sources": [ "thehackernews-php2shell-4days" ] }, { "who": "CybelAngel", "when": "2026-10", "says": "The disclosure was originally under embargo until Thursday 22 October at 11:00 ET; after the leak, PHP scheduled its release for 21 October", "measures": "the original embargo, 15:00 UTC, attributed by others to watchTowr", "sources": [ "cybelangel-php2shell" ] }, { "who": "The php.net ChangeLog", "when": "captured 2026-10-22", "says": "22 Oct 2026", "measures": "the date the ChangeLog gives all four releases, which shipped on 21 October", "sources": [ "php-net-changelog-8" ] }, { "who": "Lorikeet Security (vendor blog)", "when": "2026-10-21", "says": "candidate pull requests under a private security branch scheduled for public disclosure on October 24.", "measures": "a third planned date, 24 October, given with no source; no other statement in the vault gives it", "sources": [ "lorikeet-php2shell" ] }, { "who": "PHP 8.5's release manager, Daniel Scherzer (timeline of 22 October, from the repositories' history)", "when": "2026-10-22", "says": "The coordinated releases were originally scheduled for 14:00 UTC on Thursday, October 22 ... rescheduled ... to Wednesday, October 21, at the same time.", "measures": "the original plan, 14:00 UTC, agreeing with the PHP Foundation; it does not give the 15:00 UTC value", "sources": [ "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell" ] } ], "reading": "The original embargo time has two values, 14:00 UTC (the Foundation, echoed by The Hacker News) and 11:00 ET, which is 15:00 UTC (watchTowr, echoed by CybelAngel and others). The release itself is stamped 13:34 UTC on the GitHub advisories, ahead of the announced 14:00. The ChangeLog still carries the original date. The site should say 'about 14:00 UTC, advisories at 13:34' and give both original times. Run 7: Lorikeet's blog gives a third planned date, 24 October, unsourced and alone in the vault (in its captures of 22 and 25 October); it does not change the reading. Run 9: the release manager's own timeline gives 14:00 UTC for the original plan, the Foundation's value; only the watchTowr/CybelAngel line gives 15:00.", "settle": "A PHP project statement of the embargo time, or the pre-announcement's original text.", "ticket": "Contradiction-10" }, { "id": "K-011", "measure": "Is the fix in PHP 8.5.12 incomplete?", "status": "open", "claims": [ "fix-incomplete", "more-paths" ], "statements": [ { "who": "Aaron Rainbolt on oss-security, relaying a Fediverse post", "when": "2026-10-21 15:24 UTC", "says": "the Fediverse is reporting that the fix to at least PHP 8.5.12 may be incomplete", "measures": "an unconfirmed report from an unnamed person, relayed", "sources": [ "openwall-oss-security-109619-thread" ] }, { "who": "The same, relaying Canonical via a Matrix channel", "when": "2026-10-21 17:29 UTC", "says": "was told that it's \"unrelated and not a real issue\"", "measures": "PHP's answer to Canonical, second-hand", "sources": [ "openwall-oss-security-109619-thread" ] }, { "who": "Jakub Zelenka, PHP security team, on oss-security (post 2026/10/22/15)", "when": "2026-10-22 09:11 UTC", "says": "This is unrelated issue with minimal impact (crash in one component in slightly unlikely scenario). It has nothing to do with the RCE.", "measures": "PHP's own public answer", "outside": [ "https://www.openwall.com/lists/oss-security/2026/10/22/15 (fetched 2026-10-22 20:5x UTC, sha256 94c69d8f1c07e67d)" ] } ], "reading": "The report and the answer are about different things: the Fediverse post describes some flaw in 8.5.12; the PHP security team says it is a separate crash bug of minimal impact, not a way around the RCE fix. The answer came at 09:11 UTC on 22 October, after the vault's copy of the thread (which stops at 22/2), so the site still says PHP has not answered. Open only until the reply is captured; then it should be marked explained and the claim re-graded.", "settle": "Capture oss-security 2026/10/22/15 into the vault.", "ticket": "Contradiction-11" }, { "id": "K-012", "measure": "What does W3Techs say: 69.3% or 75%?", "status": "explained", "claims": [ "scale-70pc-websites" ], "statements": [ { "who": "Reuters (via RTE, ABC Australia)", "when": "2026-10-21", "says": "PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs", "measures": "W3Techs' share, credited to W3Techs", "sources": [ "rte-reuters-websites-go-dark", "abc-au-gov-sites-exposed", "tuttotech-news-2026-10-22-vulnerabilita-php-html" ] }, { "who": "Tenable, and every other outlet that names W3Techs", "when": "2026-10-21 and 22", "says": "69.3% of websites whose server-side language is known", "measures": "W3Techs' share on the day", "sources": [ "tenable-php2shell-faq" ] }, { "who": "W3Techs' yearly table, fetched by the desk", "when": "2026-10-24 01:31 UTC", "says": "75.2% on 1 January 2025; 72.4% on 1 January 2026; 69.3% on 23 October 2026", "measures": "the same measure over time", "outside": [ "https://w3techs.com/technologies/history_overview/programming_language/ms/y" ] } ], "reading": "The same measurer at different dates. Reuters' 75% matches W3Techs' figure for January 2025, not the 69.3% W3Techs showed when Reuters wrote; the attribution is right and the number is out of date. Investigation php-share.", "settle": "Capture W3Techs' yearly table into the vault (board 033).", "ticket": "Contradiction-12" } ], "tickets": [ { "label": "Contradiction-1", "type": "contradiction", "status": "explained", "title": "K-001: How much of the web: 70_ of websites, or 70_ of the Internet?", "description": "One origin, Wiz, restated: a share of websites using PHP became a share of 'the Internet' affected, inside Wiz's own post. Every outlet in the vault that carries the figure traces to Wiz, so it is one source, not several (restates, not corroborates). None of them says how the 70% was measured; it matches the usual web-technology survey figure for sites whose server-side language is known, which is a share of websites, not of hosts, traffic or 'the Internet', and not a count of vulnerable installations. The BBC's 'roughly 70%' puts a word in Wiz's mouth that its post does not use.", "severity": "medium", "claims": [ "scale-70pc-internet", "scale-70pc-websites" ], "sources": [ "bbc-live-ckgel5xp2xv9t", "cnn-php2shell-websites-shut", "wiz-blog-php2shell", "x-wiz-io-php2shell" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Finding-124" }, { "verb": "supported-by", "to": "Evidence-13" }, { "verb": "supported-by", "to": "Evidence-14" }, { "verb": "supported-by", "to": "Evidence-15" } ] }, { "label": "Contradiction-2", "type": "contradiction", "status": "explained", "title": "K-002: Is php2shell being exploited?", "description": "They measure different things at different times. Amazon counts attempts against its own sensors and honeypots; CISA and KEV record exploitation it has evidence of against real systems. Both can be true at once: attempts in volume, and no confirmed compromise of a named organisation. The site should never write 'exploited' without saying which of the two it means. Amazon's 'broadly exploited' is the stronger word, sourced to Amazon's own post in the vault; a KEV entry would be the first official signal that attempts have become compromises.", "severity": "medium", "claims": [ "no-exploitation", "cisa-none", "amazon-honeypot", "probing", "watchtowr-itw", "no-confirmed-compromise" ], "sources": [ "aws-security-blog-madpot", "cisa-alert-php-20261021", "cve-cve-2026-109618", "cve-cve-2026-109619" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Finding-122" }, { "verb": "supported-by", "to": "Evidence-1" }, { "verb": "supported-by", "to": "Evidence-10" }, { "verb": "supported-by", "to": "Evidence-12" }, { "verb": "supported-by", "to": "Evidence-18" }, { "verb": "supported-by", "to": "Evidence-3" }, { "verb": "supported-by", "to": "Evidence-6" } ] }, { "label": "Contradiction-3", "type": "contradiction", "status": "explained", "title": "K-003: Which PHP versions are affected?", "description": "Affected, supported and patched are three different lists. The CVE record lists only the supported branches the PHP project fixed; the backports reach down to 7.4; Cloudflare and NVD describe what is vulnerable, which goes back further. They are compatible, but read as a contradiction unless the site says so where it shows the version table.", "severity": "medium", "claims": [ "versions-old", "two-cves-9.2" ], "sources": [ "cloudflare-blog-php2shell-waf", "cve-cve-2026-109618", "cve-cve-2026-109619", "nvd-cve-2026-109618", "nvd-cve-2026-109619", "php-net-advisory" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-16" }, { "verb": "supported-by", "to": "Evidence-9" } ] }, { "label": "Contradiction-4", "type": "contradiction", "status": "explained", "title": "K-004: How many systems are still unpatched?", "description": "The site's claim reads as 1.57 million unpatched out of about 2.6 million hosts (about 60%). The source says 1.57 million out of the 1.58 million whose version could be read (about 99%, on the day the fix shipped); the 2.58 million is all hosts seen, most of which do not announce a version. The two framings give very different pictures. The BBC's 90% has no named counter or method and is not captured. Open, because the site states one framing as fact.", "severity": "medium", "claims": [ "scale-2.6m-hosts" ], "sources": [ "securityweek-exploitation-days-before" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-2" } ] }, { "label": "Contradiction-5", "type": "contradiction", "status": "open", "title": "K-005: How many UK government services went down?", "description": "Probably the same count, described loosely by The Register. The BBC's line is verified in a fetch by this desk; it says 'a minister' without naming one or the House, so the coverage review's 'in the House of Lords' is not yet carried by any source this desk has read. Neither is captured into the vault: this record is a request to capture.", "severity": "medium", "claims": [ "uk-list" ], "sources": [], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-2" } ] }, { "label": "Contradiction-6", "type": "contradiction", "status": "explained", "title": "K-006: How many sites were taken offline?", "description": "Breadth of collection, and an export lag. The site requires a captured source per row; the tracker accepts aggregator reports and says so per row. Part of the gap is not collection at all: the vault already holds captures of more offline operators than the site shows, because the site's export stopped at 144 sources.", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-11" }, { "verb": "supported-by", "to": "Evidence-18" }, { "verb": "supported-by", "to": "Evidence-4" } ] }, { "label": "Contradiction-7", "type": "contradiction", "status": "explained", "title": "K-007: How severe: CVSS 10.0, 9.2 or 9.8?", "description": "10.0 was wrong. 9.2 and 9.8 are both right, on two different scales scored by two different parties, and they disagree on one input: the vendor says attack complexity is high, NIST says low. The site explains 10.0 against 9.2 but never mentions 9.8, which is what a reader checking NVD, or a scanner reporting CVSS 3.1, will see.", "severity": "medium", "claims": [ "cvss-10", "two-cves-9.2" ], "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619", "nvd-cve-2026-109618", "nvd-cve-2026-109619", "php-foundation-blog-security-release" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Finding-121" } ] }, { "label": "Contradiction-8", "type": "contradiction", "status": "open", "title": "K-008: Which flaw was shown to give code execution on PHP-FPM?", "description": "The advisories, written by the PHP security team per CVE, put the demonstrated FPM exploit under CVE-2026-109619, and say none was demonstrated for CVE-2026-109618. The Foundation's blog places FPM confirmation under CVE-2026-109618. The blog appears to have swapped the attribution. That RCE was shown on FPM is not in doubt; which flaw does it is.", "severity": "medium", "claims": [ "rce-fpm", "rce-modphp" ], "sources": [ "github-ghsa-6wmf-4rv5-p3rp", "github-ghsa-w8hw-w9fx-j79w", "php-foundation-blog-security-release" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Contradiction-9", "type": "contradiction", "status": "explained", "title": "K-009: Did any technical detail leak on 20 October?", "description": "Probably different meanings of 'technical detail'. A screenshot of a tool banner and a demonstration video show that an exploit exists, not how it works; the Foundation may mean that no root cause or code leaked. The Hacker News's 'proof-of-concept exploit leaked' is stronger than anything else in the vault carries, and no capture shows a leaked PoC. Open until the Foundation or Daubois says what the Foundation meant.", "severity": "medium", "claims": [ "leak-cve-ids", "leak-hn", "leak-video" ], "sources": [ "daubois-blog-php2shell-rumors", "equixly-php2shell-what-we-know", "phpfoundation-blog-security-release-leak", "thehackernews-php2shell-4days" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Contradiction-10", "type": "contradiction", "status": "open", "title": "K-010: When was the release planned, and when did it ship?", "description": "The original embargo time has two values, 14:00 UTC (the Foundation, echoed by The Hacker News) and 11:00 ET, which is 15:00 UTC (watchTowr, echoed by CybelAngel and others). The release itself is stamped 13:34 UTC on the GitHub advisories, ahead of the announced 14:00. The ChangeLog still carries the original date. The site should say 'about 14:00 UTC, advisories at 13:34' and give both original times.", "severity": "medium", "claims": [ "release-moved", "release-time" ], "sources": [ "cybelangel-php2shell", "php-foundation-blog-security-release", "php-net-changelog-8", "thehackernews-php2shell-4days" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Contradiction-11", "type": "contradiction", "status": "open", "title": "K-011: Is the fix in PHP 8.5.12 incomplete?", "description": "The report and the answer are about different things: the Fediverse post describes some flaw in 8.5.12; the PHP security team says it is a separate crash bug of minimal impact, not a way around the RCE fix. The answer came at 09:11 UTC on 22 October, after the vault's copy of the thread (which stops at 22/2), so the site still says PHP has not answered. Open only until the reply is captured; then it should be marked explained and the claim re-graded.", "severity": "medium", "claims": [ "fix-incomplete", "more-paths" ], "sources": [ "openwall-oss-security-109619-thread" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-2", "links": [ { "verb": "relates-to", "to": "Finding-125" }, { "verb": "supported-by", "to": "Evidence-7" }, { "verb": "supported-by", "to": "Evidence-8" } ] }, { "label": "Contradiction-12", "type": "contradiction", "status": "explained", "title": "K-012: What does W3Techs say: 69.3_ or 75_?", "description": "The same measurer at different dates. Reuters' 75% matches W3Techs' figure for January 2025, not the 69.3% W3Techs showed when Reuters wrote; the attribution is right and the number is out of date. Investigation php-share.", "severity": "low", "claims": [ "scale-70pc-websites" ], "sources": [], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-3", "links": [] }, { "label": "Evidence-1", "type": "evidence", "status": "proposed", "title": "CISA KEV, 18:27 UTC on 22 October: neither CVE is listed (catalog 2026.10.21, released 14:04 UTC on 21 October, 1,754 entries)", "description": "Fetched by the desk. The catalog has not been updated since 21 October 14:04 UTC, before CISA's own alert; so 'not in KEV' is as of that catalog version. Supports the front page's 'did not include these two when last checked' and board 010. Capture into the source watch on every run.", "severity": "medium", "claims": [ "cisa-none", "no-confirmed-compromise", "kev-precedent" ], "sources": [], "pages": [], "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "retrieved_at": "2026-10-22T18:27Z", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-2", "type": "evidence", "status": "proposed", "title": "BBC live page, 18:30 UTC: '32 government services were unavailable and four partially unavailable'; 'globally 90_ of systems at risk are yet to do so'", "description": "Fetched by the desk; the vault's three BBC captures end at 08:05 UTC and carry neither line. The minister is not named on the page, and 'House of Lords' (in the coverage review) is not on it. The 90% is attributed only to 'researchers'. Capture the page as it stands.", "severity": "medium", "claims": [ "uk-list" ], "sources": [], "pages": [], "url": "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t", "retrieved_at": "2026-10-22T18:30Z", "sha256": "3842343a8de23fc96beb029341d71675595b81441d8e88b183374e3095dcdce4", "excerpt": "a minister said just after midday that 32 government services were unavailable and four partially unavailable because they were being fixed", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-4" }, { "verb": "supports", "to": "Contradiction-5" } ] }, { "label": "Evidence-3", "type": "evidence", "status": "captured", "title": "The Next Web: 'Officials in Germany, the Netherlands and Japan say they have not seen one succeed'; Mizuho and Shizuoka Bank halted services", "description": "Fetched by the desk; not in the vault. Bears on no-confirmed-compromise (a dated negative from three governments) and on impact (Japanese banks, via Bloomberg). Capture it, then chase the officials' own statements.", "severity": "medium", "claims": [ "no-confirmed-compromise", "affected-sites" ], "sources": [], "pages": [], "url": "https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches", "retrieved_at": "2026-10-22T18:30Z", "sha256": "c51dfb0561b1bdb2cd0a5691a16ffc394908928d2deab03e90047ca1b6311bdb", "excerpt": "Officials in Germany, the Netherlands and Japan say they have not seen one succeed.", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-4", "type": "evidence", "status": "captured", "title": "PHPocalypse Tracker sites.csv: 50 sites, 2 with no back-up time, each with dark and back times and a source", "description": "Fetched by the desk at 18:27 UTC. Row-level provenance, and recovery times this site does not record. Its own header warns that aggregator reports are not confirmed at the original source, so each row is a lead, not a fact. Capture the CSV on a schedule (board 057).", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [], "url": "https://allixsenos.github.io/phpocalypse-tracker/sites.csv", "retrieved_at": "2026-10-22T18:27Z", "sha256": "8109506bc80264887f2bd36eb452c1ad5468db6330efe4f167623be9f9965fe6", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-6" } ] }, { "label": "Evidence-5", "type": "evidence", "status": "proposed", "title": "php.net releases feed, 18:27 UTC: no PHP release after 21 October", "description": "Fetched by the desk: the newest releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, dated 21 Oct 2026. Bears on fix-incomplete and the front page's open question 'Whether the fix is complete': no follow-up release as of this check.", "severity": "low", "claims": [ "fix-incomplete" ], "sources": [], "pages": [], "url": "https://www.php.net/releases/index.php?json&max=8&version=8", "retrieved_at": "2026-10-22T18:27Z", "sha256": "06f7ddd8254f82984e9a75300cf733327f32f3b862d08b200dccbbb2affee450", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Evidence-6", "type": "evidence", "status": "proposed", "title": "CVE records unchanged since the vault's capture; CISA's SSVC still says Exploitation: none", "description": "Fetched by the desk from the CVE API at 18:27 UTC. CVE-2026-109618 last updated 21 Oct 16:07 UTC, CVE-2026-109619 22 Oct 08:09 UTC, both before the vault's 08:12 UTC captures. CISA ADP SSVC, scored 21 Oct 14:34 UTC, still 'Exploitation: none'. Nothing to re-capture; recorded so the next run can tell if it changes.", "severity": "low", "claims": [ "two-cves-9.2", "cisa-none" ], "sources": [], "pages": [], "url": "https://cveawg.mitre.org/api/cve/CVE-2026-109618", "retrieved_at": "2026-10-22T18:27Z", "sha256": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-7", "type": "evidence", "status": "proposed", "title": "PHP security team on oss-security, 22 October 09:11 UTC: the 'incomplete fix' report is 'unrelated' and 'has nothing to do with the RCE'", "description": "Jakub Zelenka (who published both advisories) answering Rainbolt's relay of the Fediverse report. This is PHP's public answer that the site's front page says does not exist. High priority to capture: once captured, fix-incomplete should be re-graded and the front page's open question closed or reworded.", "severity": "high", "claims": [ "fix-incomplete", "more-paths" ], "sources": [], "pages": [], "url": "https://www.openwall.com/lists/oss-security/2026/10/22/15", "retrieved_at": "2026-10-22T20:54Z", "sha256": "94c69d8f1c07e67d6fd44cfaeeb6e1805262c60d07acd5cd750e0b7d1a90026d", "excerpt": "This is unrelated issue with minimal impact (crash in one component in slightly unlikely scenario). It has nothing to do with the RCE.", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-11" } ] }, { "label": "Evidence-8", "type": "evidence", "status": "proposed", "title": "oss-security 22_14: the deb.sury.org tracker quotes the PHP team, 'aware of that report and there are no new plans as of now'", "description": "Nicolas Vigier relays a comment on the Debian/Ubuntu PHP packager's issue tracker. Third-hand, but consistent with PHP's own answer in 22/15.", "severity": "low", "claims": [ "fix-incomplete" ], "sources": [], "pages": [], "url": "https://www.openwall.com/lists/oss-security/2026/10/22/14", "retrieved_at": "2026-10-22T20:54Z", "sha256": "7f8f85193e75133f88647d70733a69938c17e6f2773b4755c0dc67acd3512dbb", "excerpt": "The PHP team is aware of that report and there are no new plans as of now.", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-11" } ] }, { "label": "Evidence-9", "type": "evidence", "status": "proposed", "title": "oss-security 22_16, 22_19, 22_20: list members say every version from PHP 5.4 is affected, each citing Wiz", "description": "Three replies to Greenbone's question about versions older than 8.2. All three trace to Wiz's write-up (restates, not corroborates); no reply from the PHP project on versions. Adds echoes to K-003, not evidence.", "severity": "low", "claims": [ "versions-old" ], "sources": [], "pages": [], "url": "https://www.openwall.com/lists/oss-security/2026/10/22/16", "retrieved_at": "2026-10-22T20:54Z", "sha256": "04f109cae98defca4e2db749e7dc1cf106fc8503ae907aff9e16d60a285ea45e", "excerpt": "It's pubblically document in the writeup that everything from PHP 5.4 is affected", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-3" } ] }, { "label": "Evidence-10", "type": "evidence", "status": "proposed", "title": "Primary feeds at 20:53 UTC: KEV unchanged (neither CVE), no PHP release after 21 October, NVD now 'Analyzed', CVE-2026-109619 updated 20:08 UTC with five oss-security references", "description": "KEV is byte-identical to run 1 (catalog 2026.10.21). php.net releases unchanged. NVD moved CVE-2026-109618 from Modified to Analyzed at 20:45 UTC (scores unchanged). The CVE-2026-109619 record's ADP container added oss-security 22/14, 15, 16, 19 and 20 as references. The NCSC-NL repository head is unchanged at 94b4b16db9e5.", "severity": "low", "claims": [ "cisa-none", "no-confirmed-compromise", "two-cves-9.2" ], "sources": [], "pages": [], "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "retrieved_at": "2026-10-22T20:53Z", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "excerpt": "", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-11", "type": "evidence", "status": "rejected", "title": "PHPocalypse Tracker, 20:53 UTC: the Dutch data protection authority back at 19:25 UTC; one site still dark (French prefecture websites)", "description": "Was 2 still dark at 18:27 UTC. Of 50 rows, 49 now have a back-up time.", "severity": "low", "claims": [ "affected-sites" ], "sources": [], "pages": [], "url": "https://allixsenos.github.io/phpocalypse-tracker/sites.csv", "retrieved_at": "2026-10-22T20:53Z", "sha256": "1534d904219babed6a62bab19cbd061d9cc156b24b96f621b606af4e6587495b", "excerpt": "", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-6" } ] }, { "label": "Evidence-12", "type": "evidence", "status": "captured", "title": "AWS reworded its key sentence without a note: 'broadly exploited in the wild' is now 'seeing broad exploitation attempts in the wild'", "description": "Amazon's post (vault slug aws-security-blog-madpot, captured 11:17 UTC on 22 October with the first wording) was modified at 21:25 UTC on 22 October (article:modified_time 14:25:03 PDT). The vault's capture and every page of this site that quotes 'broadly exploited' carry the earlier wording. Capture the current page; then the pages that quote Amazon should give both wordings with their times.", "severity": "high", "claims": [ "amazon-honeypot", "no-confirmed-compromise" ], "sources": [], "pages": [], "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "retrieved_at": "2026-10-24T01:32Z", "sha256": "1889fa097c9073520cbb6526ebd4d044d224371107abd89b52dae3f4d7c862c4", "excerpt": "PHP2Shell is now seeing broad exploitation attempts in the wild.", "run": "Run-3", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-13", "type": "evidence", "status": "proposed", "title": "CNN reworded its 70_ lines twice without a note; the headline still says 'internet'", "description": "Updated 18:26 UTC on 22 October: the body's 'powers 70% of all websites in the world' became 'powers 70% of the world's websites', and the lede's 'could affect 70% of the internet' (08:09 UTC capture) became 'could affect 70% of the world's websites'. The headline still ends 'affecting 70% of the internet'. Bears on the correction request R-003.", "severity": "medium", "claims": [ "scale-70pc-internet" ], "sources": [], "pages": [], "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "retrieved_at": "2026-10-24T01:32Z", "sha256": "e3a57d45a3ace0974642017c6cd2b951e0664b5616061b377d22f13fa81f738b", "excerpt": "could affect 70% of the world’s websites", "run": "Run-3", "links": [ { "verb": "supports", "to": "Contradiction-1" } ] }, { "label": "Evidence-14", "type": "evidence", "status": "proposed", "title": "Wikipedia's PHP2Shell article added 'nearly 70_ of the commercial world wide web' (23 October 13:41 UTC)", "description": "Revision 1381581724 by Masem adds the sentence to the lead; the revision before it lacks it; still present at 01:37 UTC on 24 October. A new wording family: 'the commercial world wide web', with no measurement given.", "severity": "low", "claims": [ "scale-70pc-internet" ], "sources": [], "pages": [], "url": "https://en.wikipedia.org/wiki/PHP2Shell", "retrieved_at": "2026-10-24T01:40Z", "sha256": "786b2c1c89bcf866e33806e51edee170dd5592f4ea6a60e8133d28624628b0fa", "excerpt": "estimated to affect nearly 70% of the commercial world wide web", "run": "Run-3", "links": [ { "verb": "supports", "to": "Contradiction-1" } ] }, { "label": "Evidence-15", "type": "evidence", "status": "proposed", "title": "The measurement behind '70_', fetched: W3Techs, 69.3_ of websites whose server-side language is known (23 October); HTTP Archive, PHP on 48.3_ of all crawled origins; WordPress on 39.6_ of all websites", "description": "The desk fetched and hashed W3Techs' language page and its yearly history, the HTTP Archive's tech report API and the other measurers (investigation php-share, 29 measures). None of it is in a vault yet, so none of it is citable as evidence: capture W3Techs' pages and the HTTP Archive counts (boards 033, 043, 222). This answers the front page's open question 'Where the 70% figure comes from' (Finding-32).", "severity": "medium", "claims": [ "scale-70pc-websites", "scale-70pc-internet" ], "sources": [], "pages": [], "url": "https://w3techs.com/technologies/details/pl-php", "retrieved_at": "2026-10-24T01:31Z", "sha256": "f49b114f2c6055e2bb21b2009d25e781cf715553e782b83c0adbeec818780948", "excerpt": "PHP is used by 69.3% of all the websites whose server-side programming language we know.", "run": "Run-3", "links": [ { "verb": "supports", "to": "Contradiction-1" } ] }, { "label": "Evidence-16", "type": "evidence", "status": "proposed", "title": "CrowdStrike dates each flaw's code: CVE-2026-109618 from PHP 7.3.0 (2018), CVE-2026-109619 back to 5.4 (session path) and 7.1 (serialization)", "description": "Found through Greenbone's posts on oss-security (2026/10/23/4 and /5, now references in both CVE records). The first claim that splits the two flaws by version. If it holds, 'all versions from 5.4' is true only of CVE-2026-109619. The page contradicts itself ('present in every PHP release from the 7.x and 8.x series'). Capture it; then versions-old and the version table on /patching/ should be re-graded.", "severity": "medium", "claims": [ "versions-old" ], "sources": [], "pages": [], "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/", "retrieved_at": "2026-10-24T07:57Z", "sha256": "e46a2935d6002eed6d9082e3729ae7dd8cbd91e1d79bc830a5671f5cf4999a10", "excerpt": "The specific HashTable ordering behind CVE-2026-109618 was introduced by a performance optimization in October 2017 and first shipped in PHP 7.3.0", "run": "Run-4", "links": [ { "verb": "supports", "to": "Contradiction-3" } ] }, { "label": "Evidence-17", "type": "evidence", "status": "proposed", "title": "Siemens joins the CVE records as an affected supplier (RUGGEDCOM APE1808, SSA-566512); NVD now lists Palo Alto PAN-OS and the Siemens device among 306 vulnerable configurations", "description": "Both CVE records gained a Siemens supplier container on 23 October (14:07 UTC); NVD's configurations grew from four PHP ranges to 306 matches, including hundreds of PAN-OS versions (Palo Alto's own advisory is already in the vault, paloalto-psirt-cve-2026-109618). The first appliance vendors in the primary record. Capture Siemens SSA-566512; the inventory and affected pages are the owners'.", "severity": "medium", "claims": [ "two-cves-9.2" ], "sources": [], "pages": [], "url": "https://cveawg.mitre.org/api/cve/CVE-2026-109618", "retrieved_at": "2026-10-24T07:57Z", "sha256": "e90dc1df042aca8ba35d87d9748e2347a865ed285ca49e62e353e909d71547b8", "excerpt": "RUGGEDCOM APE1808", "run": "Run-4", "links": [] }, { "label": "Evidence-18", "type": "evidence", "status": "proposed", "title": "Primary feeds at 07:57 UTC on 24 October: KEV (catalog 2026.10.23, 1,756 entries) still lists neither CVE; CISA SSVC still 'Exploitation: none'; no PHP release after 21 October; the PHPocalypse Tracker has 51 rows and none dark; W3Techs still 69.3_", "description": "KEV has been updated twice since the release (2026.10.21, 2026.10.23) without either CVE. The NCSC-NL repository head moved from 94b4b16db9e5 to 2fdc314ded28 (the inventory's owners). Amazon's post still carries its revised sentence (Evidence-12).", "severity": "low", "claims": [ "cisa-none", "no-confirmed-compromise", "affected-sites" ], "sources": [], "pages": [], "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "retrieved_at": "2026-10-24T07:57Z", "sha256": "97a6e54bc74c651ab3c55657191db9adec6c63b05ca54e4205327cfd97a8fb70", "excerpt": "", "run": "Run-4", "links": [ { "verb": "supports", "to": "Contradiction-2" }, { "verb": "supports", "to": "Contradiction-6" } ] }, { "label": "Finding-1", "type": "finding", "status": "open", "title": "ai-found: Patch the Planet framing generalised to all finders", "description": "The claim says the flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative. Calif's page places Calif under Patch the Planet; Wiz's blog and X thread never mention Patch the Planet, and Wiz credits Gemini 4 Argon most. The OOM root cause was first seen by a PHP core developer in 2024 without AI (Foundation blog). Reword to 'Calif, working under Patch the Planet, and Wiz both used AI models'.", "severity": "medium", "claims": [ "ai-found" ], "sources": [], "pages": [ "facts/ai-found/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-2", "type": "finding", "status": "open", "title": "who-first: Priority reading carried as 'confirmed'", "description": "'Calif found the flaws first' is an attribution of priority, a reading. The Foundation's capture says the same root cause was 'the OOM problem we had found in 2024' and that 'OpenAI independently reported the same root cause on the same day'. The 1 August discovery date is Calif's own claim. Use status 'reported', or narrow it to 'Calif has the earliest public timestamp (hash on 5 August) of the 2026 reporters'.", "severity": "medium", "claims": [ "who-first" ], "sources": [], "pages": [ "facts/who-first/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-3", "type": "finding", "status": "open", "title": "openai-same-day: Note quotes OpenAI's blocked post", "description": "The note says OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol'. OpenAI's blog capture is blocked (text.txt is 0 bytes) and the captured X post contains no such phrase. The wording exists only as a search snippet in the collector's notes. Drop the quote marks or say it is from a search summary.", "severity": "medium", "claims": [ "openai-same-day" ], "sources": [], "pages": [ "facts/openai-same-day/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-4", "type": "finding", "status": "open", "title": "wiz-independent: 'independently' not carried by any primary capture", "description": "Wiz's blog says 'Prior to public disclosure, Wiz Research worked with the PHP team, Calif and OpenAI on discovery, coordination and patch verification'. The Foundation lists Wiz's 24 August report as 'further attack vectors'. Only OpenAI's blocked blog (search snippet) and Wikipedia say 'independently'. Attribute the word, or drop it.", "severity": "medium", "claims": [ "wiz-independent" ], "sources": [], "pages": [ "facts/wiz-independent/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-5", "type": "finding", "status": "open", "title": "quarkslab-2024: Who found the OOM issue in 2024: the two sources differ", "description": "The claim says the issue 'was found in a 2024 audit by Quarkslab'. The Foundation, the primary party, says a PHP core developer found the first signs 'while fixing one of the issues Quarkslab reported'. timeline.json (at 2024) states the Foundation's version correctly; this claim does not. Quarkslab's published summary lists no OOM finding.", "severity": "medium", "claims": [ "quarkslab-2024" ], "sources": [], "pages": [ "facts/quarkslab-2024/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-6", "type": "finding", "status": "open", "title": "quarkslab-2024: 'Two parties agree' is one origin, and 'confirmed' is overstated", "description": "Calif writes 'We were able to confirm from PHP a similar/related issue was uncovered but exploitation was not proven in 2024', so its account derives from PHP. The causal 'so it was not fixed' is Calif's; the Foundation says the fix stalled because of competing approaches, consensus decision-making and a lack of resources. Status should be 'reported', with the Foundation's version as the lead.", "severity": "medium", "claims": [ "quarkslab-2024" ], "sources": [], "pages": [ "facts/quarkslab-2024/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-7", "type": "finding", "status": "open", "title": "ahead-of-attackers: Claim drops OpenAI's hedge 'to our knowledge'", "description": "OpenAI wrote 'to our knowledge, frontier AI was able to find this vulnerability ahead of attackers'. The site states it unhedged. Restore the qualifier.", "severity": "medium", "claims": [ "ahead-of-attackers" ], "sources": [], "pages": [ "facts/ahead-of-attackers/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-8", "type": "finding", "status": "open", "title": "most-severe: Cited Wiz source does not say it; the real origin is uncited", "description": "The claim cites wiz-blog-php2shell, whose wording is 'among the most severe ... in PHP'. The 'ever detected by AI' framing appears in the BBC and, as a WSJ quote of Wiz's co-founder ('the most severe AI vulnerability that was ever found'), in substack-lopezkurtz-patch-is-the-exploit. Cite the Substack relay and label the claim as a quote of a quote from the WSJ.", "severity": "medium", "claims": [ "most-severe" ], "sources": [], "pages": [ "facts/most-severe/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-9", "type": "finding", "status": "open", "title": "leak-video: 'around 20:00 UTC' may be the pre-announcement's time, not the video's", "description": "The Foundation sentence reads 'As a result of the leak and pre-announcement around 20:00 UTC, Calif ... mistakenly published a video.' The time can modify the pre-announcement (oss-security relayed it at 20:22:51Z; php.net's feed says 20:32Z). The Register reads it as 'a couple of hours later' than 15:00; Feross says 'that evening'. The site (claim and timeline.json at 2026-10-20T20:00Z) presents 20:00 UTC as the video's time. Say 'evening of 20 October' or flag the ambiguity.", "severity": "medium", "claims": [ "leak-video" ], "sources": [], "pages": [ "facts/leak-video/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-10", "type": "finding", "status": "open", "title": "chainguard: Lorenc quote attributed to The Register is not in The Register", "description": "The note quotes Lorenc 'via The Register': 'I made the call to get these out early when exploits hit in the wild'. The Register capture has 'so we made the call to ship the fixes under that'. The quoted sentence appears only inside a Reddit comment embedded in the Foundation page ('but I made the call to get these out early when exploits hit in the wild.'), apparently quoting Lorenc elsewhere (likely Hacker News). Use The Register's words or capture the original.", "severity": "medium", "claims": [ "chainguard" ], "sources": [], "pages": [ "facts/chainguard/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-11", "type": "finding", "status": "open", "title": "no-exploitation: Time of the Austin interview is wrong: the post is 08:00 UTC (09:00 BST), not 08:00 BST", "description": "claims.json 'by' says '08:00 BST 22 October'; exploitation.json and timeline.json date it 2026-10-22T07:00Z. The capture's page.html JSON-LD gives the post datePublished 2026-10-22T08:00:23.293Z, and the rendered page (UTC browser) shows 'published at 08:00'. The vault's BBC notes.md is the origin of the BST error (the 07:55Z curl copy showed BST clock times, the Playwright capture shows UTC).", "severity": "medium", "claims": [ "no-exploitation" ], "sources": [], "pages": [ "facts/no-exploitation/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-12", "type": "finding", "status": "open", "title": "no-exploitation: Claim uses the BBC headline's absolute wording, not Austin's hedged words", "description": "Austin said \"Not at the moment... it doesn't look like exploitation has taken off or been widespread\", which allows some exploitation; 'There is no evidence yet that hackers have exploited the flaw' is the BBC's paraphrase. Reword to his words or attribute the headline to the BBC.", "severity": "medium", "claims": [ "no-exploitation" ], "sources": [], "pages": [ "facts/no-exploitation/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-13", "type": "finding", "status": "open", "title": "cisa-none: Claim drops CISA's own time qualifier", "description": "CISA says it 'has not observed exploitation ... as of the time of publication' (Release Date October 21, 2026, no time given). The claim text uses an undated present tense ('CISA has not observed exploitation'); the qualifier is only in the note. Put 'as of 21 October' in the claim itself, since Amazon, Cloudflare, watchTowr and NCSC NZ report exploitation attempts after that.", "severity": "medium", "claims": [ "cisa-none" ], "sources": [], "pages": [ "facts/cisa-none/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-14", "type": "finding", "status": "open", "title": "amazon-honeypot: The note narrows Amazon's sentence to honeypots; Amazon's text does not", "description": "Note: 'Attempts against honeypots, not compromises of victims'; history.json: \"Amazon saying it is 'broadly exploited' against honeypots\"; claims.json no-confirmed-compromise: \"'broadly exploited' against sensors\". Amazon writes 'we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild.' and also 'With PHP2Shell, compromise may predate the advisory.' The honeypot limit is this site's reading. Say instead: Amazon gives no counts and names no victim; its evidence shown is honeypot telemetry.", "severity": "medium", "claims": [ "amazon-honeypot" ], "sources": [], "pages": [ "facts/amazon-honeypot/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-15", "type": "finding", "status": "open", "title": "probing: exploitation.json's Woodward row says Amazon's own post was not found", "description": "exploitation.json row (2026-10-22, Alan Woodward) has status 'reported; Cloudflare's own post confirms attack traffic, Amazon's own post not found' and cites thehackernews-php2shell-4days, while this claim (confirmed) cites aws-security-blog-madpot as Amazon's own confirmation.", "severity": "medium", "claims": [ "probing" ], "sources": [], "pages": [ "facts/probing/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-16", "type": "finding", "status": "open", "title": "latvia-attempts: 'none succeeded' overstates 'no reports of successful attacks so far'", "description": "CERT.LV: 'ta_u l_dz _im nav zi_u par sekm_giem uzbrukumiem' (but so far there are no reports of successful attacks), in the update of 21.10.2026 23:00 (20:00Z). exploitation.json words it correctly; claims.json does not. Reword and date it.", "severity": "medium", "claims": [ "latvia-attempts" ], "sources": [], "pages": [ "facts/latvia-attempts/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-17", "type": "finding", "status": "open", "title": "huntress-none: 'No public exploit code known' is dated before release, not 20:30 UTC on 21 October", "description": "The sentence 'we're not aware of public exploit code as of this writing' sits in the original pre-release section ('The fixes aren't out yet'), i.e. about 20 October. The claim and impact.json put it under 'as of 20:30 UTC on 21 October'. By then Amazon reports PoCs 'within hours' of release, CCCS says a PoC is available, and watchTowr reports PoC code on GitHub. Split the two halves and date each.", "severity": "medium", "claims": [ "huntress-none" ], "sources": [], "pages": [ "facts/huntress-none/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-18", "type": "finding", "status": "open", "title": "watchtowr-itw: Status 'unverified' understates the attempts half; the vault has four outlets quoting watchTowr", "description": "securityweek-first-attempts-sensors, securityweek-exploitation-days-before, darkreading-php2shell-red-alert and tenable-php2shell-faq (in data/sources.json) and therecord-php-warnings (vault only) quote Jake Knott: watchTowr sees in-the-wild exploitation attempts. Cite them and mark that half reported or corroborated.", "severity": "medium", "claims": [ "watchtowr-itw" ], "sources": [], "pages": [ "facts/watchtowr-itw/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-19", "type": "finding", "status": "open", "title": "watchtowr-itw: Claim omits watchTowr's own qualifier: no successful attempt, and sprayed exploits mostly do not work", "description": "Knott: 'Whilst nobody has been successful to date' (SecurityWeek) and 'The exploits being sprayed indiscriminately either don't work at all, test for timing-based differences, or crash the target'. Without this the claim reads as more than attempts.", "severity": "medium", "claims": [ "watchtowr-itw" ], "sources": [], "pages": [ "facts/watchtowr-itw/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-20", "type": "finding", "status": "open", "title": "kev-precedent: Status 'confirmed' outruns the weakest part (A2), and 'last PHP core RCE' is not shown", "description": "The one-day exploitation rests on one party (Akamai). The CVE record calls CVE-2024-4577 'Argument Injection in PHP-CGI' on Windows with certain code pages, a SAPI bug rather than the PHP core; and nothing captured shows it is the most recent PHP RCE (only that it is the most recent PHP entry in KEV). Say 'the last PHP flaw in KEV'.", "severity": "medium", "claims": [ "kev-precedent" ], "sources": [], "pages": [ "facts/kev-precedent/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-21", "type": "finding", "status": "open", "title": "kev-precedent: Honeypot attempts count as 'exploited in the wild' for 2024 but not for php2shell", "description": "Akamai's one-day evidence is exploit attempts against its honeypot network, the same kind of evidence as Amazon's MadPot hits, which the site's notes (amazon-honeypot, history.json) say are 'attempts against honeypots, not compromises'. Apply one standard to both.", "severity": "medium", "claims": [ "kev-precedent" ], "sources": [], "pages": [ "facts/kev-precedent/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-22", "type": "finding", "status": "open", "title": "affected-sites: Cited text capture no longer carries most of the list", "description": "The 08:05:59Z text capture (sha c88b8c5f...) has no mention of Edinburgh council, the BBC, online stores or the University of Geneva. The list is only in raw/page.2026-10-22T0755Z.html (summary bullet \"Among the impacted sites are Wikipedia, Edinburgh council, many online stores and the BBC\") and the Geneva item only in the header image alt text in raw/initial-data.json. The BBC dropped the bullet between 07:55Z and 08:05Z. The assessment should cite the raw file and its sha, and say the bullet was later removed.", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-23", "type": "finding", "status": "open", "title": "affected-sites: Note \"Not captured from any of the named organisations\" is out of date", "description": "The vault holds operator captures: unige.ch returned HTTP 503 with an F5 \"under maintenance\" page at 2026-10-22 08:19:10Z (unige-site) and 08:19:43Z (ch-unige-down); nord.gouv.fr and rhone.gouv.fr served \"Maintenance en cours\" at 08:19:39-40Z; edinburgh.gov.uk was up (HTTP 200, normal homepage) at 08:19:03Z and 08:19:40Z; wikimediastatus.net showed \"All Systems Operational\" at 08:18:50Z. These show down/up state at capture time, not the reason. story.json repeats the out-of-date statement (\"has not been captured from any of those organisations\").", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-24", "type": "finding", "status": "open", "title": "latvia-offline: Note \"the one documented case ... from the agency itself\" is contradicted by other site data and captures", "description": "The claim note and story.json call Latvia the one documented case of government services pulled from the public internet by the agency itself. The site's own nl-offline claim (status confirmed, \"Primary statement\") rests on Rijksoverheid saying NCSC.NL was taken offline \"uit voorzorg\"; EPFL's own homepage (epfl-site, 08:19:13Z) says it \"has temporarily suspended access to some of its websites\"; nord.gouv.fr and rhone.gouv.fr served maintenance pages at 08:19Z on 22 Oct.", "severity": "medium", "claims": [ "latvia-offline" ], "sources": [], "pages": [ "facts/latvia-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-25", "type": "finding", "status": "open", "title": "latvia-offline: \"Pulled from the public internet\" overstates a geo-block", "description": "CERT.LV says access was restricted from abroad, selectively, and that residents accessing from Latvia should not be affected (\"Paredzams, ka iedz_vot_jus, kuri valsts digit_lajiem pakalpojumiem piek__st no Latvijas, _ie ierobe_ojumi neietekm_s\"). The note should say geo-blocked from abroad, not pulled from the public internet.", "severity": "medium", "claims": [ "latvia-offline" ], "sources": [], "pages": [ "facts/latvia-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-26", "type": "finding", "status": "fixed", "title": "no-confirmed-compromise: Claim text lacks its as-of and scope", "description": "The negative holds only \"in every captured source, as of the latest capture\" (newest checked 2026-10-22T11:33Z). The note says so, but the claim and status \"confirmed\" read as a settled fact about the world. The supporting negatives are old: Huntress as of 20:30Z on 21 Oct, Imperva pre-disclosure only, CERT.LV 20:00Z on 21 Oct, against Amazon's \"broadly exploited in the wild\" and Cloudflare's \"millions\" of attempts. Suggest status \"reported\" or wording \"No named organisation, in any captured source as of , ...\".", "severity": "medium", "claims": [ "no-confirmed-compromise" ], "sources": [], "pages": [ "facts/no-confirmed-compromise/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-27", "type": "finding", "status": "fixed", "title": "nl-offline: \"Primary statement\" covers only NCSC.NL", "description": "The Rijksoverheid capture names only NCSC.NL; DigiD, MijnOverheid and Overheid.nl are not in it, and dutchitleaders-websites-offline is a Cloudflare challenge (75 chars). Status \"confirmed\" with note \"Primary statement\" overstates three of the four services. Cite tpo-nl-digid-offline and insurancebusiness-uk-councils-met (DigiD, MijnOverheid) and reuters-factbox-websites-offline (Overheid.nl), and mark those parts reported.", "severity": "medium", "claims": [ "nl-offline" ], "sources": [], "pages": [ "facts/nl-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-28", "type": "finding", "status": "fixed", "title": "nl-offline: \"No signs of active exploitation of those services\" is narrower than any source", "description": "Rijksoverheid says NCSC has not yet seen active misuse in general (13:59 on 21 Oct, before the patch); TPO quotes the minister saying there were \"nog geen signalen\" of active misuse. Neither speaks about those services specifically. Same wording in impact.json.", "severity": "medium", "claims": [ "nl-offline" ], "sources": [], "pages": [ "facts/nl-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-29", "type": "finding", "status": "open", "title": "wikimedia-precaution: CNN does not carry the quoted phrase", "description": "The claim's \"by\" credits CNN, but CNN has only \"precautionary measure\" (told CNN on Thursday). The full phrase is in The Cyber Express, Newsweek (newsweek-php2shell-websites) and the Reuters factbox (reuters-factbox-websites-offline); cite those.", "severity": "medium", "claims": [ "wikimedia-precaution" ], "sources": [], "pages": [ "facts/wikimedia-precaution/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-30", "type": "finding", "status": "open", "title": "oxford: Quote is not in the cited source", "description": "oxfordchronicle-councils-offline (sha 35c84729...) does not contain the quoted words; only the collector's notes.md does. The words are in eadt-minister-budget-no-breach (sha 4c8556b5...), an embedded post signed \"Oxford City Council (@OxfordCity) October 21, 2026\". Cite that and change \"via Oxford Chronicle\"; impact.json also says Oxford Chronicle is \"quoting\" the councils' posts, which it is not.", "severity": "medium", "claims": [ "oxford" ], "sources": [], "pages": [ "facts/oxford/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-31", "type": "finding", "status": "open", "title": "uk-list: OBR is not in either cited source", "description": "Neither lbc-uk-websites-offline nor insurancebusiness-uk-councils-met mentions the Office for Budget Responsibility. It appears only in eadt-minister-budget-no-breach (PA), framing a question to the Scotland Secretary. Add that source or drop the OBR from this claim.", "severity": "medium", "claims": [ "uk-list" ], "sources": [], "pages": [ "facts/uk-list/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-32", "type": "finding", "status": "open", "title": "scale-70pc-websites: Cloudflare does cite its survey: the 70_ links to W3Techs", "description": "The claim note says 'None of the three cites the survey it comes from', numbers.json n-70-websites says 'Neither page names the survey', and a sections.json page says 'None of the pages that use it says how' it was measured. Cloudflare's rendered.html (capture 20261022T081216Z) hyperlinks '70% of websites' to https://w3techs.com/technologies/details/pl-php. The text.txt drops the link, which is likely why it was missed. OpenAI and Wiz do not cite a source.", "severity": "medium", "claims": [ "scale-70pc-websites" ], "sources": [], "pages": [ "facts/scale-70pc-websites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-33", "type": "finding", "status": "fixed", "title": "scale-70pc-websites: The claim drops the survey's population qualifier", "description": "W3Techs' figure, as relayed by Tenable (69.3%) and Imperva (over 69%), is a share of websites whose server-side language is known, not of all websites. 'used by almost 70% of websites' overstates the population. numbers.json n-70-websites 'measures' describes the population correctly; the claim text should match.", "severity": "medium", "claims": [ "scale-70pc-websites" ], "sources": [], "pages": [ "facts/scale-70pc-websites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-34", "type": "finding", "status": "fixed", "title": "scale-2.6m-hosts: 'of which' joins two different counters", "description": "The 2.6 million is VulnCheck's count; the 1.57 million unpatched is Censys's, out of the 2.58 million hosts Censys saw on 21 October (SecurityWeek). The same 'of which' framing recurs in questions.json and readings.json. Suggested wording: 'VulnCheck counts about 2.6 million; Censys saw 2.58 million on 21 October, of which 1.57 million were unpatched.'", "severity": "medium", "claims": [ "scale-2.6m-hosts" ], "sources": [], "pages": [ "facts/scale-2.6m-hosts/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-35", "type": "finding", "status": "open", "title": "scale-ncsc-nl: Confirmed: the inventory had 675 rows at cca173c64ec5, not 674; 4 not vulnerable, not 3", "description": "Counting table rows in raw/tree-cca173c64ec5/software/software_list_*.md gives 675 (Fix 46, Investigation 418, Vulnerable 206, Not vuln 4, blank 1). A fresh clone of raw/php2shell-cca173c64ec5.bundle (HEAD cca173c64ec5db92, 2026-10-22T10:40:58+02:00) gives the same 675 and its tree is identical to the vault's tree; the SPDX file software/spdx/PHP_Downstream_Inventory.spdx3.json has 675 software_Package elements and 4 NotAffected VEX relationships. The missing row is iBabs / iBabs bestuursportaal (Not vuln), in software_list_i.md, whose Links cell is empty, which is probably why the export parser skipped it. data/software.json (count 674, Not vuln 3) and raw/software-list-cca173c64ec5.json carry the error. This confirms BRIEF-CORRECTIONS.md v0.4.2.", "severity": "medium", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-36", "type": "finding", "status": "open", "title": "scale-ncsc-nl: Site data disagree on the inventory count", "description": "data/claims.json (scale-ncsc-nl), data/numbers.json n-674 ('674 ... 3 Not vulnerable, 1 without a status'), data/software.json (count 674), questions.json, sections.json and index.md ('reaches 674 products') say 674; data/inventory-history.json self_check says the parser 'also finds 1 row the vault missed: iBabs'. numbers.json n-674 agrees with the claim but both are wrong against the file.", "severity": "medium", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-37", "type": "finding", "status": "open", "title": "scale-ncsc-nl: The claim's status counts do not add up to its total", "description": "206 + 46 + 418 + 3 = 673, not 674. The 674th row is 'The PHP Group / PHP core and Zend Engine', an unversioned anchor with no status. numbers.json n-674 mentions it; the claim does not. Corrected: 675 rows: 206 vulnerable, 46 fixed, 418 under investigation, 4 not vulnerable, 1 PHP-core anchor without a status.", "severity": "medium", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-38", "type": "finding", "status": "open", "title": "disclosure-22oct: The BBC capture does not say the flaws were disclosed on 22 October", "description": "The claim's 'by' is 'BBC framing (UK morning coverage)', but the captured BBC live page (080559Z, and the 07:55Z raw copy) gives no disclosure date; it says details 'leaked online this week' and the patch 'has been rushed out'. Labelling a BBC statement 'contradicted' when the BBC did not make it misattributes. The '22 October' dates in the vault come from the original schedule (Foundation: 'from October 22nd, 14:00 UTC'), Wiz's thread ('Apply the Oct 22 security release') and ACSC's local time ('22 October 2026 at 0100 AEDT').", "severity": "medium", "claims": [ "disclosure-22oct" ], "sources": [], "pages": [ "facts/disclosure-22oct/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-39", "type": "finding", "status": "open", "title": "release-time: Three of the cited sources state a schedule, not a release time", "description": "php.net's pre-announcement and the oss-security relay say 'It is scheduled for ... 14:00 UTC'; CERT-FR says the publisher 'annonce la disponibilit_ des correctifs ... pour le 21 octobre 2026 _ 16h00 heure de Paris (14h00 UTC)'; the Foundation says it 'moved the release ... to October 21st, 14:00 UTC'. None of these observes the release. The 'by' line should read 'scheduled for 14:00 UTC' with Daubois as the one after-the-event statement.", "severity": "medium", "claims": [ "release-time" ], "sources": [], "pages": [ "facts/release-time/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-40", "type": "finding", "status": "open", "title": "preannounce-time: The Foundation's post gives two times for the pre-announcement", "description": "php-foundation-blog-security-release says 'published it at 19:30 UTC' and two paragraphs later 'the leak and pre-announcement around 20:00 UTC'. The note cites only the feed (20:32Z) and oss-security (20:22:51Z) against it; the source's own inconsistency should be shown.", "severity": "medium", "claims": [ "preannounce-time" ], "sources": [], "pages": [ "facts/preannounce-time/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-41", "type": "finding", "status": "open", "title": "fix-authored: Committer time is not the time a commit became public", "description": "3584a98bd's committer date is 2026-10-21T16:06:22+02:00 (14:06:22Z). Git records when the commit object was made, not when it was pushed; and the release tags (13:35:38 UTC, pointing at release commit 136e049 dated 2026-10-19) already shipped the fix before 14:06. Suggested wording: 'committed to the branch at 14:06 UTC'.", "severity": "medium", "claims": [ "fix-authored" ], "sources": [], "pages": [ "facts/fix-authored/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-42", "type": "finding", "status": "open", "title": "offline-ncsc: LBC carried the same NCSC sentence on 21 October, before the NCSC page was modified", "description": "lbc-uk-websites-offline (dated '21 Oct 2026, 15:41', written before the release: 'Full details ... have yet to be published') quotes the NCSC verbatim with the BBC's wording. The NCSC page captured at 08:09Z on 22 Oct has HTTP last-modified 07:30:02 GMT that morning. Two outlets, one of them hours earlier than the BBC, quoting the same sentence suggests an earlier NCSC version said it and was reworded. The note frames it as a BBC misquote whose opening 'matches the Canadian CCCS text'; it should mention LBC and the likely supersession. The quote is not in the NCSC capture, so A3 stands until an earlier NCSC version is captured.", "severity": "medium", "claims": [ "offline-ncsc" ], "sources": [], "pages": [ "facts/offline-ncsc/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-43", "type": "finding", "status": "open", "title": "offline-allies: Italy's ACN does advise taking sites offline; the site says it does not", "description": "acn-it-php2shell text.txt (sha 19fac2ed..., line 70): 'Qualora non fosse possibile applicare tempestivamente gli aggiornamenti di sicurezza, si raccomanda di valutare di porre offline i siti e i servizi web che utilizzano versioni vulnerabili di PHP, sospendendone l'accessibilit_ fino all'avvenuto aggiornamento.' The claim note ('Italy ... give[s] no offline advice'), data/agencies.json (IT: offline 'none', 'Update only') and the collector notes ('NO offline or isolation advice') are all wrong against the same capture. agencies.json's offline_text 'Si raccomanda di aggiornare i prodotti vulnerabili.' is also truncated: the sentence continues 'seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.'", "severity": "high", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-44", "type": "finding", "status": "open", "title": "offline-allies: The BBC capture does not make the claim the site marks 'contradicted'", "description": "BBC (06:30 post): 'The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.' The offline sentence is then attributed to the NCSC only; the NSA appears in a separate post. The site's claim merges these into the BBC saying all four advise offline, and then marks that 'contradicted'. A reader is told the BBC was wrong about something it did not say.", "severity": "high", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-45", "type": "finding", "status": "open", "title": "offline-allies: Australia is not-shown, not contradicted, and the EU part largely holds", "description": "ACSC's page lists other actions and no offline advice, but its body text is stale (pre-patch) and absence on one page is not a contradiction. For 'the EU', CERT-EU advises isolating internet-facing applications from public networks, CERT-FR recommends isolating affected equipment, ACN advises taking sites offline, and CERT.LV says systems that cannot be updated must have internet access restricted. Only NCSC-NL, ENISA's CNW page and JPCERT give no such advice.", "severity": "medium", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-46", "type": "finding", "status": "open", "title": "waf-nine-hours: 'Hours before disclosure' is shown only for Cloudflare, and Fortinet's date is after disclosure", "description": "The lead clause applies to all five vendors, but only Cloudflare states a time before the release. Imperva says protection was verified and monitoring began 'before the announcement' with no time; Akamai and Fastly posts are dated 21 October with no time; Fortinet's FortiWeb article was created 10/22/2026 07:55 AM (timezone not stated) and its signatures are 'in Alert Only mode' by default. Suggested: 'Cloudflare from 03:02 UTC on 21 October; Imperva before the announcement; Akamai and Fastly on 21 October; Fortinet signatures by 22 October.'", "severity": "medium", "claims": [ "waf-nine-hours" ], "sources": [], "pages": [ "facts/waf-nine-hours/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-47", "type": "finding", "status": "open", "title": "waf-nine-hours: The note's 'every vendor says ... patch anyway' is not carried for Fortinet", "description": "Cloudflare ('Customers should patch their PHP repos even with WAF protections'), Akamai ('The most effective defense continues to be the prompt application of vendor patches'), Fastly ('assume active mitigation will only serve as partial protection') and Imperva carry it. The Fortinet KB article gives signature and custom-rule steps and does not call them a stopgap or tell readers to patch.", "severity": "medium", "claims": [ "waf-nine-hours" ], "sources": [], "pages": [ "facts/waf-nine-hours/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-48", "type": "finding", "status": "open", "title": "rce-fpm: Status 'disputed' understates a claim the PHP advisory record carries; the dispute is about which CVE, not whether", "description": "GHSA-6wmf and openwall 2026/10/21/7 (PHP security team, CVE-2026-109619) both say unauthenticated RCE was demonstrated against PHP-FPM. Only the attribution to CVE-2026-109618 is in doubt. Suggest rewording to 'RCE is confirmed on PHP-FPM for CVE-2026-109619 (session upload progress path, needs a suitable application operation); for CVE-2026-109618 the advisory says no complete FPM exploit' and setting the status accordingly. Also cite openwall-oss-security-2026-10-21-7, which is in the manifest but not on this claim; the cited openwall 21/6 is the 109618 post and does not carry the claim.", "severity": "medium", "claims": [ "rce-fpm" ], "sources": [], "pages": [ "facts/rce-fpm/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-49", "type": "finding", "status": "open", "title": "rce-fpm: Glossary short text for PHP-FPM says 'whether a full exploit exists is disputed'", "description": "data/glossary.json (id fpm) short: 'Susceptible; whether a full exploit exists is disputed.' The PHP advisory GHSA-6wmf and oss-security 21/7 say FPM RCE was validated/demonstrated for CVE-2026-109619. The long text is accurate ('for the first flaw'); the short text misleads.", "severity": "medium", "claims": [ "rce-fpm" ], "sources": [], "pages": [ "facts/rce-fpm/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-50", "type": "finding", "status": "open", "title": "versions-old: 'from 5 onwards' is wider than the finder's '_= 5.4', and the 5.x sources look like echoes of the leak", "description": "Wiz (X post and blog) says 5.4 and later. NCSC-NL's text is the pre-patch banner ('vermoedelijk ... in ieder geval vanaf versie 5'), CERT-FR lists 'toutes versions 6.x' (PHP 6 never shipped; Daubois says watchTowr named 5, 6, 7 and 8), and The Hacker News says the HN leak claimed 'from PHP 5 onward'. These trace to one origin (A3 at most). Suggest the claim say '5.4 onwards per Wiz; PHP's backports imply 7.4 onwards'.", "severity": "medium", "claims": [ "versions-old" ], "sources": [], "pages": [ "facts/versions-old/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-51", "type": "finding", "status": "open", "title": "waf: Status 'disputed' understates: the sources agree a WAF is partial protection", "description": "CISA: 'may provide some protection'; BACS: 'alone is not sufficient'; Cloudflare: 'Customers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation.' These are the same position at different emphasis. Suggest 'confirmed' as CISA's advice, with the BACS and Cloudflare caveats in the note.", "severity": "medium", "claims": [ "waf" ], "sources": [], "pages": [ "facts/waf/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-52", "type": "finding", "status": "open", "title": "pocs-wrong: Huntress is cited but does not carry the claim", "description": "The Huntress capture says it had 'not built or reproduced a proof of concept' and was 'not aware of public exploit code as of this writing'; it says nothing about VulnCheck or a 200 response. The 'by' field names Huntress too. Remove it or cite what it actually says.", "severity": "medium", "claims": [ "pocs-wrong" ], "sources": [], "pages": [ "facts/pocs-wrong/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-53", "type": "finding", "status": "open", "title": "ac-high: Status 'confirmed' on a claim whose first half is a reading", "description": "'Triggering the bug is much easier than turning it into code execution' is Imperva's characterisation (verbatim, unquoted on the site). A reading caps at A3. Split the claim: the AC:H record is confirmed; the ease comparison should be shown as Imperva's reading (with Fastly agreeing).", "severity": "medium", "claims": [ "ac-high" ], "sources": [], "pages": [ "facts/ac-high/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-54", "type": "finding", "status": "open", "title": "more-paths: Missing context: the fix removed the OOM bailout itself, not only the demonstrated paths", "description": "The fix commit replaces bailout on OOM with UnwindExit and GHSA-w8hw says 'The patch removes longjmp() for OOM'. Fastly's point still applies to bailout on other fatal conditions (timeouts, uncaught errors), which GHSA-6wmf calls 'conditional', but a reader could take the claim to mean PHP only patched the demonstrated paths. Say which bailouts remain.", "severity": "medium", "claims": [ "more-paths" ], "sources": [], "pages": [ "facts/more-paths/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-55", "type": "finding", "status": "open", "title": "more-paths: Note leans on an unconfirmed report PHP reportedly rejected", "description": "'consistent with the Fediverse report of a third bug' cites the oss-security thread, which is an unnamed second-hand report, and the same thread says Canonical was told by PHP it is 'unrelated and not a real issue'. The thread does not carry Fastly's position and should not be cited as support.", "severity": "medium", "claims": [ "more-paths" ], "sources": [], "pages": [ "facts/more-paths/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-56", "type": "finding", "status": "open", "title": "ac-high: 2 smaller precision and sourcing points", "description": "Fastly quote drops the quotation marks around 'safe': Capture: 'most deployments may be _safe_ from RCE.' The site drops the scare quotes, which changes the tone: Fastly is hedging the word. | Imperva phrase used without attribution in the claim text: The claim's first clause is Imperva's sentence word for word; it should be quoted and attributed.", "severity": "low", "claims": [ "ac-high" ], "sources": [], "pages": [ "facts/ac-high/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-57", "type": "finding", "status": "open", "title": "affected-sites: 1 smaller precision and sourcing point", "description": "\"Online shops\" rests on the BBC alone and is vague: No capture names an online shop taken offline; the BBC capture otherwise mentions online shops only as platforms PHP powers. The University of Geneva item comes from an EPA photo alt text, not reporting text.", "severity": "low", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-58", "type": "finding", "status": "open", "title": "ahead-of-attackers: 1 smaller precision and sourcing point", "description": "Amazon's 17 October attempt is second-hand: The 17 October MadPot attempt is known only from CJ Moses 'in a post shared with The Hacker News'; no Amazon post is captured.", "severity": "low", "claims": [ "ahead-of-attackers" ], "sources": [], "pages": [ "facts/ahead-of-attackers/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-59", "type": "finding", "status": "open", "title": "ai-found: 2 smaller precision and sourcing points", "description": "'frontier' is not Calif's word: Calif writes 'No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery' and refers to an 'LLM companion'. 'Frontier AI' is Wiz's and OpenAI's language, not Calif's. | Calif's model is named only second-hand: That Calif used GPT-5.6 Sol rests on OpenAI's blocked blog (openai-blog-coordinated-disclosure text.txt is 0 bytes) and press relays (cybernews, wikipedia). Calif's own page names no model.", "severity": "low", "claims": [ "ai-found" ], "sources": [], "pages": [ "facts/ai-found/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-60", "type": "finding", "status": "open", "title": "amazon-honeypot: 2 smaller precision and sourcing points", "description": "'from multiple actors' is stated as fact; Amazon says 'suggesting': Amazon: 'The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors.' Use 'probably from multiple actors'. | Only one capture of Amazon's post, 21 hours after its date: The post is dated 21 Oct with no time; the single capture is 11:17Z on 22 Oct. The Hacker News (captured 08:13Z) already reports 'broad exploitation in the wild', so the sentence existed by then, but whether it was in the first version cannot be shown.", "severity": "low", "claims": [ "amazon-honeypot" ], "sources": [], "pages": [ "facts/amazon-honeypot/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-61", "type": "finding", "status": "open", "title": "cf-millions: 1 smaller precision and sourcing point", "description": "Name the missing method, and set against Imperva's pre-disclosure zero: Thousands of attempts in the 10 hours before announcement (Cloudflare) and no matching traffic in pre-disclosure monitoring (Imperva, claim imperva-none) are different populations and probably different signatures; the site should say so where both appear.", "severity": "low", "claims": [ "cf-millions" ], "sources": [], "pages": [ "facts/cf-millions/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-62", "type": "finding", "status": "open", "title": "chainguard: 1 smaller precision and sourcing point", "description": "Notification timing differs between relays: The Register: Lorenc 'notified the PHP coordinated disclosure channel about his plans' (before). Feross: 'he notified the group right after making the call'. Feross's post ID 2113043398664015878 decodes to 2026-10-21T23:02:59Z, so the source's published '2026-10-22' is off by a day in UTC.", "severity": "low", "claims": [ "chainguard" ], "sources": [], "pages": [ "facts/chainguard/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-63", "type": "finding", "status": "open", "title": "cisa-none: 1 smaller precision and sourcing point", "description": "KEV fetch time is 08:16Z, and the catalog version is from 14:04Z on 21 Oct: The note says fetched 2026-10-22T08:15Z; the saved response headers say date Thu, 22 Oct 2026 08:16:01 GMT. The catalog itself (last-modified 21 Oct 14:04:39 GMT) predates the alert's likely release and is only 16 minutes after CVE publication (13:48Z), so 'not in KEV' is a check at 08:16Z on 22 Oct of a catalog last changed 14:04Z on 21 Oct. Re-check KEV on each run.", "severity": "low", "claims": [ "cisa-none" ], "sources": [], "pages": [ "facts/cisa-none/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-64", "type": "finding", "status": "open", "title": "cloudflare-traffic: 1 smaller precision and sourcing point", "description": "Timing 'after the leak' and exploitation.json's '2026-10-20 to 21' are inferred: Cloudflare does not date the traffic; its sentence ties it to the leak only by 'while'. Volumes do exist from the same party (claim cf-millions, Prince on X), so 'no volumes' is true only of this post; cross-link.", "severity": "low", "claims": [ "cloudflare-traffic" ], "sources": [], "pages": [ "facts/cloudflare-traffic/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-65", "type": "finding", "status": "open", "title": "cvss-10: 1 smaller precision and sourcing point", "description": "CVE records are the refuting primary but are not cited on this claim: The refutation rests on the PHP Foundation blog and Daubois; the CVE records cve-cve-2026-109618 and cve-cve-2026-109619 (CVSS 4.0 9.2) are the authoritative refutation and could be cited. The vault's own claim file (claude-story-site.json) records this claim as 'disputed' while the site says 'contradicted'; the site's word is the better fit.", "severity": "low", "claims": [ "cvss-10" ], "sources": [], "pages": [ "facts/cvss-10/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-66", "type": "finding", "status": "open", "title": "disclosure-22oct: 1 smaller precision and sourcing point", "description": "CVE records named in the note are not cited: The note gives CVE record times 13:48Z and 13:54Z; they are carried by cve-cve-2026-109618 and cve-cve-2026-109619 raw/cveawg-api.json (datePublished), which the claim does not cite.", "severity": "low", "claims": [ "disclosure-22oct" ], "sources": [], "pages": [ "facts/disclosure-22oct/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-67", "type": "finding", "status": "open", "title": "edinburgh: 2 smaller precision and sourcing points", "description": "\"Late on 21 October\" is looser than the source: The Scotsman says the site went down \"late on Wednesday afternoon\"; the Edinburgh Evening News version was published 17:24 BST with the site already down, so the outage began before about 16:24Z. \"Late on 21 October\" suggests the evening. | Site was back by 08:19Z on 22 Oct: The council's own homepage returned HTTP 200 with normal content at 08:19:03Z (edinburgh-council-site) and 08:19:40Z (uk-edinburgh-council). impact.json says \"Website offline\" with no end; the down period itself has no operator capture.", "severity": "low", "claims": [ "edinburgh" ], "sources": [], "pages": [ "facts/edinburgh/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-68", "type": "finding", "status": "open", "title": "fi-offline: 2 smaller precision and sourcing points", "description": "Two start times in the same sources: Helsinki Times gives 12:45 for restricting traffic but also says Naumanen told STT \"the shutdown process had begun shortly after 1 pm\"; Yle says the same. The timeline row (09:45Z, confidence \"inferred\") should note that 12:45 is the restriction start per Helsinki Times only. | Yle and Helsinki Times are not fully independent: Yle's piece is bylined \"Yle News / STT\" and Helsinki Times also relies on STT for Naumanen; only Helsinki Times carries 12:45. The Valtori site capture (fi-valtori) failed (\"Target page, context or browser has been closed\"), so there is no operator capture.", "severity": "low", "claims": [ "fi-offline" ], "sources": [], "pages": [ "facts/fi-offline/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-69", "type": "finding", "status": "open", "title": "fix-authored: 2 smaller precision and sourcing points", "description": "Other sources name different fix commits: Daubois's blog gives 'final commit 01a40e89fbfc authored 2026-10-18'; the collector notes record that rjmendez's repository names 82f8f31b16a. The authored day agrees (18 October), but the hashes are not reconciled with 3584a98bd (possibly the PR head or a per-branch cherry-pick). | raw/commit-3584a98bd.NEWS.diff is an empty file: Its SHA256SUMS entry is e3b0c442...b855, the hash of zero bytes. The NEWS entry (a34a205c2) appears only in the merge-path listing. The cited github-php-src-tag-php-8.5.12 capture carries none of the fix's times.", "severity": "low", "claims": [ "fix-authored" ], "sources": [], "pages": [ "facts/fix-authored/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-70", "type": "finding", "status": "open", "title": "fix-bailout: 1 smaller precision and sourcing point", "description": "ChangeLog dates the four releases 22 Oct 2026, a day after the release: php-net-changelog-8 lists 'Version 8.5.12 / 22 Oct 2026' (and the same for 8.4.27, 8.3.36, 8.2.35) although php.net and the Foundation say they shipped 21 Oct. Not a problem for this claim, but any page that dates the fix from the ChangeLog would be a day off.", "severity": "low", "claims": [ "fix-bailout" ], "sources": [], "pages": [ "facts/fix-bailout/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-71", "type": "finding", "status": "open", "title": "fix-engine: 3 smaller precision and sourcing points", "description": "'globals that survive a failed request' is narrower than the advisory: GHSA-6wmf: besides a fatal error, 'A warning or other nonfatal diagnostic can also repopulate error state after that state was already cleared during shutdown'. Stale state can survive a request that did not fail. | Three different fix-commit hashes across sources: The vault reads 3584a98bd (Arnaud Le Blanc, authored 2026-10-18T17:26:39+02:00); Daubois gives 'final commit 01a40e89fbfc authored 2026-10-18'; rjmendez gives 82f8f31b16a. Probably per-branch commits, but nothing in the vault reconciles them. Daubois also says 'The fix touches 390 files' where the site counts 389. | github-php-src-fix-commit-3584a98bd has no captures/ entry, and its NEWS.diff is empty: fc.py extract reports no text capture for this source; the evidence is raw/ git output with SHA256SUMS. raw/commit-3584a98bd.NEWS.diff has sha256 e3b0c442...b855, the hash of an empty file.", "severity": "low", "claims": [ "fix-engine" ], "sources": [], "pages": [ "facts/fix-engine/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-72", "type": "finding", "status": "open", "title": "fix-incomplete: 1 smaller precision and sourcing point", "description": "Note's quote drops the inner quotation marks and spans a line break: The capture (21/23) reads: was told that it's \"unrelated and not a real issue\". The site writes 'was told that it's unrelated and not a real issue', merging Rainbolt's words with the words he attributes to PHP. Restore the inner quotes so the reader sees which words are PHP's (as relayed).", "severity": "low", "claims": [ "fix-incomplete" ], "sources": [], "pages": [ "facts/fix-incomplete/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-73", "type": "finding", "status": "open", "title": "four-reporters: 2 smaller precision and sourcing points", "description": "CVE records credit three parties, not four: The cve.org records (CNA: PHP Group) credit 'Ryan at Calif.io', 'Wiz' and 'OpenAI' (finder on 109618, reporter on 109619) and omit tomash-areion. The site could say the advisories credit four and the CVE records three. | Affiliations are inferred: The advisories give handles only. The bracketed affiliations are reasonable but come from other pages; tomash-areion's affiliation is unknown. The note's 'appears nowhere else on this beat' should except Daubois, who repeats the advisory credits.", "severity": "low", "claims": [ "four-reporters" ], "sources": [], "pages": [ "facts/four-reporters/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-74", "type": "finding", "status": "open", "title": "gov-patch-required: 1 smaller precision and sourcing point", "description": "Status 'reported' understates a statement carried by NSA's own release; the wording should keep it NSA's: The claim drops 'are serious enough to' and, read without its 'by' line, sounds like a mandate. Suggested: 'NSA says the risks are serious enough to require immediate patching across US Government departments and agencies' with status confirmed (that NSA said it).", "severity": "low", "claims": [ "gov-patch-required" ], "sources": [], "pages": [ "facts/gov-patch-required/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-75", "type": "finding", "status": "open", "title": "imperva-none: 1 smaller precision and sourcing point", "description": "Population and window should be in the claim: Imperva's negative is about its customer traffic and 'the monitored' patterns, over an undated window ending at disclosure. Cloudflare (thousands of attempts before announcement) and Amazon (17 Oct and 02:00Z attempts) saw pre-disclosure activity elsewhere; say 'Imperva customer traffic' to avoid an apparent contradiction.", "severity": "low", "claims": [ "imperva-none" ], "sources": [], "pages": [ "facts/imperva-none/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-76", "type": "finding", "status": "open", "title": "kev-precedent: 1 smaller precision and sourcing point", "description": "'after one day' is about 18 hours, and the catalog checked is the 14:04Z 21 Oct version: CVE-2026-109618 published 2026-10-21T13:48Z; KEV fetched 2026-10-22T08:16Z (catalog last-modified 21 Oct 14:04Z). Say 'not in KEV at 08:16 UTC on 22 October'.", "severity": "low", "claims": [ "kev-precedent" ], "sources": [], "pages": [ "facts/kev-precedent/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-77", "type": "finding", "status": "open", "title": "latvia-offline: 1 smaller precision and sourcing point", "description": "Translations and UTC conversion are the site's own: The source is in Latvian; \"restored by 20:00 UTC\" is the site's conversion of the 23:00 local update stamp. Correct, but should be marked as this site's conversion. The latvija.gov.lv capture from outside Latvia failed with net::ERR_CERT_COMMON_NAME_INVALID at 08:19:39Z on 22 Oct, consistent with, but not proof of, the foreign-access restriction.", "severity": "low", "claims": [ "latvia-offline" ], "sources": [], "pages": [ "facts/latvia-offline/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-78", "type": "finding", "status": "open", "title": "leak-cve-ids: 1 smaller precision and sourcing point", "description": "Duplicate slugs for one page: php-foundation-blog-security-release and phpfoundation-blog-security-release-leak are the same URL captured 3 minutes apart (only the embedded Reddit vote counts differ). Citing both suggests two sources.", "severity": "low", "claims": [ "leak-cve-ids" ], "sources": [], "pages": [ "facts/leak-cve-ids/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-79", "type": "finding", "status": "open", "title": "leak-hn: 3 smaller precision and sourcing points", "description": "Screenshot 'came down' not carried: Daubois: 'A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down the same way.' Only the video is said to have come down. Also Daubois writes 'Calif.IO', not 'Calif.io'. | Note's quote of The Hacker News is not verbatim: The capture reads 'a proof-of-concept (PoC) exploit leaked ahead of time'; the note drops '(PoC)'. The Foundation's phrase is capitalised 'No technical details leaked.' in the source. | Uncited corroboration available: Huntress, CybelAngel and Equixly (all in the manifest) independently describe the removed Hacker News post; citing them would lift this above a single personal blog.", "severity": "low", "claims": [ "leak-hn" ], "sources": [], "pages": [ "facts/leak-hn/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-80", "type": "finding", "status": "open", "title": "leak-video: 1 smaller precision and sourcing point", "description": "Calif has not acknowledged the video in any capture: Calif's page embeds two demo videos and its timeline omits any leak. The deleted video is not in the vault.", "severity": "low", "claims": [ "leak-video" ], "sources": [], "pages": [ "facts/leak-video/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-81", "type": "finding", "status": "open", "title": "leak-watchtowr: 1 smaller precision and sourcing point", "description": "watchTowr's post is not captured: CERT-EU gives the URL (x.com/watchtowrcyber/status/2112611507749982605, decoded 2026-10-20T18:26:48Z) but the vault has no capture; watchtowr-php2shell and watchtowr-php2shell-faq are 403. CybelAngel and Huntress carry it and are not cited.", "severity": "low", "claims": [ "leak-watchtowr" ], "sources": [], "pages": [ "facts/leak-watchtowr/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-82", "type": "finding", "status": "open", "title": "lorenc-ai-found: 1 smaller precision and sourcing point", "description": "Should read as Lorenc's claim: The claim text states the finding as fact; the evidence is Lorenc's account as paraphrased by The Register ('independently found' is the reporter's wording). Prefix with 'Lorenc says'. 'Independently' also sits oddly with having been told by a researcher that 'something was coming in PHP'.", "severity": "low", "claims": [ "lorenc-ai-found" ], "sources": [], "pages": [ "facts/lorenc-ai-found/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-83", "type": "finding", "status": "open", "title": "most-severe: 1 smaller precision and sourcing point", "description": "OpenAI's wording differs between X post and press: The note's OpenAI quote matches the X post ('vulnerabilities'); the BBC and The Hacker News quote 'one of the most impactful security issues in recent memory', presumably from the blocked blog.", "severity": "low", "claims": [ "most-severe" ], "sources": [], "pages": [ "facts/most-severe/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-84", "type": "finding", "status": "open", "title": "nl-offline: 2 smaller precision and sourcing points", "description": "The phrasing mirrors Insurance Business, which does not list Overheid.nl: The claim's structure (\"took its own site offline as a precaution, as did ...\") matches Insurance Business, whose list is DigiD, MijnOverheid, the House of Representatives, Port of Rotterdam, KNVB and hospitals. Overheid.nl comes from Reuters (RTE, factbox; Mashable and Wikipedia cite Reuters), one origin. | Restoration not recorded: ncsc.nl (08:19:19Z) and overheid.nl (08:19:27Z) both returned HTTP 200 with normal content on 22 Oct; BBC says the Dutch cyber agency \"is now running again\". impact.json gives no end time.", "severity": "low", "claims": [ "nl-offline" ], "sources": [], "pages": [ "facts/nl-offline/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-85", "type": "finding", "status": "open", "title": "no-confirmed-compromise: 2 smaller precision and sourcing points", "description": "CISA KEV snapshot predates the patch release: The KEV file was fetched 08:16Z on 22 Oct but its catalogVersion 2026.10.21 was released 14:04:39Z on 21 Oct, minutes after the 14:00Z PHP release, so the absence of CVE-2026-109618/109619 says little. KEV also records exploitation, not a named victim. There is no text capture: the evidence is raw/known_exploited_vulnerabilities.20261022T0816Z.json (sha ef8fffed...). | Timeline says CERT.LV saw attempts \"none successful\": timeline.json (20:00Z event) says \"automated attempts seen, none successful\"; CERT.LV says only that there are no reports of successful attacks so far (\"l_dz _im nav zi_u par sekm_giem uzbrukumiem\"). Same nuance as this claim: absence of reports, not a finding of none.", "severity": "low", "claims": [ "no-confirmed-compromise" ], "sources": [], "pages": [ "facts/no-confirmed-compromise/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-86", "type": "finding", "status": "open", "title": "nz-active: 2 smaller precision and sourcing points", "description": "'The only agency saying so' needs a precise qualifier: Note (and agencies.json) say NCSC NZ is the only agency saying so. True for 'active exploitation', but CERT.LV, a national CERT, says automated exploitation attempts were already detected in Latvia (21 Oct, 23:00 local). Say 'the only agency to report active exploitation; CERT.LV reports attempts'. | Cannot tell whether the sentence was in the 9:15am original or the 10:20am update: The capture (08:17Z, 22 Oct) shows the page after its 10:20am NZDT update; only the platforms paragraph is marked as updated, so the sentence is probably original, but one capture cannot show it.", "severity": "low", "claims": [ "nz-active" ], "sources": [], "pages": [ "facts/nz-active/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-87", "type": "finding", "status": "open", "title": "offline-allies: 1 smaller precision and sourcing point", "description": "acn-it-php2shell is flagged primary=false: It is the Italian national cyber agency's own alert (AL07/261021/CSIRT-ITA) on acn.gov.it, which makes it a primary source for Italy's advice.", "severity": "low", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-88", "type": "finding", "status": "open", "title": "offline-cisa: 1 smaller precision and sourcing point", "description": "The paraphrase drops 'until they can be patched or updated': CISA's advice is time-bound ('offline until they can be patched or updated'). Without it, the claim reads as permanent removal.", "severity": "low", "claims": [ "offline-cisa" ], "sources": [], "pages": [ "facts/offline-cisa/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-89", "type": "finding", "status": "open", "title": "offline-ncsc: 1 smaller precision and sourcing point", "description": "CyberExpress is a copy of the BBC paragraph, not a third witness: cyberexpress-php2shell-gov-sites reproduces the BBC's sentence about the NCSC and its EU and Australian counterparts almost word for word, with US spelling ('organizations').", "severity": "low", "claims": [ "offline-ncsc" ], "sources": [], "pages": [ "facts/offline-ncsc/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-90", "type": "finding", "status": "open", "title": "openai-same-day: 1 smaller precision and sourcing point", "description": "OpenAI's own framing differs from 'independently, same day': Cybernews relays OpenAI: 'Calif used GPT-5.6 Sol to investigate the flaw. OpenAI's own researcher subsequently identified additional flaws'. The Foundation says OpenAI independently reported the same root cause on 11 August. Both may be true (same root cause on day one, more vectors on 18 September), but the site should show OpenAI's own framing.", "severity": "low", "claims": [ "openai-same-day" ], "sources": [], "pages": [ "facts/openai-same-day/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-91", "type": "finding", "status": "open", "title": "pocs-wrong: 2 smaller precision and sourcing points", "description": "Note overstates The Hacker News: THN says 'the public exploit code going around has not been shown to work', not that it has the wrong mechanism. | Fastly implies existing PoCs can yield code execution: Fastly: 'the existing PoCs require knowledge of the specific, running PHP binary and address space layout on the server for an attack to yield code execution on x86_64'. This reads as PoCs that work given layout knowledge, in tension with 'none has the correct mechanism' unless the populations differ (researcher PoCs vs leaked public ones). The note should say which.", "severity": "low", "claims": [ "pocs-wrong" ], "sources": [], "pages": [ "facts/pocs-wrong/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-92", "type": "finding", "status": "open", "title": "preannounce-time: 1 smaller precision and sourcing point", "description": "The feed's 20:32Z is not a competing publication time: Alan Coopersmith's oss-security message quoting the php.net archive URL is dated 20:22:51Z, ten minutes before the feed's 2026-10-20T20:32:00+00:00>, so the feed timestamp is an authoring or rebuild time. The dispute is between 19:30 and 'around 20:00', both earlier than 20:22:51Z.", "severity": "low", "claims": [ "preannounce-time" ], "sources": [], "pages": [ "facts/preannounce-time/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-93", "type": "finding", "status": "open", "title": "probing: 1 smaller precision and sourcing point", "description": "'Both companies have since said so' gets the order wrong: Both posts are dated 21 October; Woodward spoke on Radio 4 at 06:44 UTC on 22 October (post datePublished 06:44:49Z). The companies said it first.", "severity": "low", "claims": [ "probing" ], "sources": [], "pages": [ "facts/probing/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-94", "type": "finding", "status": "open", "title": "quarkslab-2024: 1 smaller precision and sourcing point", "description": "Note: Cloudflare is not alone in listing Quarkslab: The note says 'Cloudflare lists Quarkslab among the 2026 disclosers; nobody else does'. Imperva's capture (in the manifest) also says 'Reported by: Calif, Wiz, OpenAI, and Quarkslab.'", "severity": "low", "claims": [ "quarkslab-2024" ], "sources": [], "pages": [ "facts/quarkslab-2024/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-95", "type": "finding", "status": "open", "title": "quarkslab-redacted: 1 smaller precision and sourcing point", "description": "Status 'reported' understates a counted record: The count is checkable on Quarkslab's own page (A6). Status could be 'confirmed'. Note that 'does not describe' cannot rule out that a redacted item (HIGH-1, CVE-2024-8928, or MED-2) relates to the OOM issue.", "severity": "low", "claims": [ "quarkslab-redacted" ], "sources": [], "pages": [ "facts/quarkslab-redacted/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-96", "type": "finding", "status": "open", "title": "rce-fpm: 1 smaller precision and sourcing point", "description": "Claim omits that the validated FPM path is application-dependent: GHSA-6wmf: 'It works with a normal dynamic FPM pool, although it depends on a suitable application operation.' The bare claim reads as if FPM is exploitable as generically as mod_php.", "severity": "low", "claims": [ "rce-fpm" ], "sources": [], "pages": [ "facts/rce-fpm/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-97", "type": "finding", "status": "open", "title": "rce-modphp: 1 smaller precision and sourcing point", "description": "'default settings' is broader than the advisory's wording, and the claim does not name the CVE: GHSA-w8hw says 'default PHP input and memory limits and normal prefork configurations with multiple workers', and adds that 'Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout'. The before-application-code path is CVE-2026-109618 specifically; naming it would stop readers transferring it to CVE-2026-109619, whose confirmed mod_php case needs fatal_error_backtraces (PHP 8.5).", "severity": "low", "claims": [ "rce-modphp" ], "sources": [], "pages": [ "facts/rce-modphp/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-98", "type": "finding", "status": "open", "title": "release-moved: 1 smaller precision and sourcing point", "description": "Release actually shipped before 14:00 UTC; story.json says 'at 14:00 UTC': The schedule was 14:00 UTC, but the GHSAs show 13:34Z, Wiz posted at 13:32:25Z (decoded), CERT-EU says '13:30 UTC' and CybelAngel 'about 13:35 UTC'. story.json's lead says 'On 21 October 2026 at 14:00 UTC the PHP project released fixes'. The claim (schedule moved) is right; the lead sentence is not.", "severity": "low", "claims": [ "release-moved" ], "sources": [], "pages": [ "facts/release-moved/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-99", "type": "finding", "status": "open", "title": "release-time: 1 smaller precision and sourcing point", "description": "CERT-EU's 13:30 UTC matches no captured artifact: The earliest public artifacts are GHSA-6wmf at 13:34:13Z and GHSA-w8hw at 13:34:25Z, tags at 13:35:38 UTC. CERT-EU's 13:30 may be a rounding; its own publication time '15:20:18' has no timezone.", "severity": "low", "claims": [ "release-time" ], "sources": [], "pages": [ "facts/release-time/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-100", "type": "finding", "status": "open", "title": "scale-2.6m-hosts: 1 smaller precision and sourcing point", "description": "No scanner's own publication is captured; methods are not stated: VulnCheck, Censys, VirusTotal and Unit 42 figures all come through news outlets. numbers.json n-censys 'measures' ('Hosts whose HTTP response announces a PHP version below the fixed one') is a reasonable inference but no capture states Censys's method. gist-silascutler-censys-query holds only a Censys search URL.", "severity": "low", "claims": [ "scale-2.6m-hosts" ], "sources": [], "pages": [ "facts/scale-2.6m-hosts/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-101", "type": "finding", "status": "open", "title": "scale-30m: 1 smaller precision and sourcing point", "description": "Only one outlet, no basis, no original audio: No other vault capture repeats the 30 million figure. The BBC summary paraphrases it as 'around 30 million websites ... one expert tells the BBC'. Woodward's own words are from a Radio 4 interview that is not captured.", "severity": "low", "claims": [ "scale-30m" ], "sources": [], "pages": [ "facts/scale-30m/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-102", "type": "finding", "status": "fixed", "title": "scale-70pc-internet: 1 smaller precision and sourcing point", "description": "The BBC's quoted Wiz words 'roughly 70%' are not in either Wiz capture: The BBC puts \"roughly 70%\" in quotation marks as Wiz's estimate. Wiz's blog says 'affecting 70% of the Internet' (headline) and 'powers 70% of all websites in the world' (body); the X post says 'impacting 70% of the Internet'. The word 'roughly' is the BBC's. The claim text adopts 'Roughly' and attributes it to Wiz; it should either drop 'Roughly' or attribute the hedge to the BBC.", "severity": "low", "claims": [ "scale-70pc-internet" ], "sources": [], "pages": [ "facts/scale-70pc-internet/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-103", "type": "finding", "status": "open", "title": "scale-70pc-websites: 1 smaller precision and sourcing point", "description": "Outlets disagree on the W3Techs figure: about 69-70% versus about 75%: Tenable (69.3%), Imperva (over 69%) and Insurance Business (around 70%, 'W3Techs (August 2026)') against Reuters via RTE and ABC Australia ('roughly 75%' / 'about 75 per cent' of websites whose programming language can be identified). RTE and ABC are vault captures outside the site manifest. The difference may be a date or a different W3Techs measure; capturing W3Techs would settle it.", "severity": "low", "claims": [ "scale-70pc-websites" ], "sources": [], "pages": [ "facts/scale-70pc-websites/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-104", "type": "finding", "status": "open", "title": "scale-latvia: 1 smaller precision and sourcing point", "description": "Quoted 'potentially' is the site's translation, and 'public sector' renders 'valsts sektor_' (state sector): The note puts 'potentially' in quotation marks, but the capture is Latvian ('potenci_li'). Quoting a translation should be marked as a translation. 'valsts sektor_' is 'state sector'; 'public sector' is a fair gloss but not exact. numbers.json n-6000-lv also says this is 'the only one that says potentially', yet NCSC-NL's inventory title says 'potentially affected' too.", "severity": "low", "claims": [ "scale-latvia" ], "sources": [], "pages": [ "facts/scale-latvia/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-105", "type": "finding", "status": "open", "title": "scale-ncsc-nl: 1 smaller precision and sourcing point", "description": "The cited capture carries no counts: ncsc-nl-php2shell-software-list text.txt (sha 83f3aa60...) is the index page with letter links only. The counts rest on files under sources/ncsc-nl-php2shell/raw/, a source the claim does not cite (numbers.json n-674 does). The tree files are not listed in raw/SHA256SUMS; this desk verified them against the bundle, which is.", "severity": "low", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-106", "type": "finding", "status": "open", "title": "uk-list: 1 smaller precision and sourcing point", "description": "LBC and Insurance Business likely share an origin: The Bristol, Lambeth and Barnet sentence is almost word for word in both, and neither names its source for the list. Treat them as one origin. LBC was published 15:41 BST on 21 Oct, before the fix shipped.", "severity": "low", "claims": [ "uk-list" ], "sources": [], "pages": [ "facts/uk-list/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-107", "type": "finding", "status": "open", "title": "versions-old: 1 smaller precision and sourcing point", "description": "openwall-oss-security-109619-thread supports only 7.4+, not 5.x: The Greenbone reply carries 'at least versions down to 7.4'; it is cited as if it supports the 5.x statement.", "severity": "low", "claims": [ "versions-old" ], "sources": [], "pages": [ "facts/versions-old/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-108", "type": "finding", "status": "open", "title": "vibe-code: 1 smaller precision and sourcing point", "description": "The unnamed 'researchers' may be watchTowr; capture The Record and cite it: therecord-php-warnings (in the vault, not in data/sources.json) has watchTowr's Knott on AI-vibecoded PoC tools seen in the wild. Citing it would name a party; it still would not show the tool authors are criminals rather than researchers posting PoCs.", "severity": "low", "claims": [ "vibe-code" ], "sources": [], "pages": [ "facts/vibe-code/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-109", "type": "finding", "status": "open", "title": "waf: 1 smaller precision and sourcing point", "description": "Note says Cloudflare's rules 'blocked the traffic it saw'; the capture does not say that: Cloudflare says it 'successfully deployed multiple mitigations' and 'observed attack traffic targeting our customers', and that attackers mutated payloads to bypass. It does not state that all observed traffic was blocked.", "severity": "low", "claims": [ "waf" ], "sources": [], "pages": [ "facts/waf/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-110", "type": "finding", "status": "open", "title": "waf-nine-hours: 2 smaller precision and sourcing points", "description": "Cloudflare's 'about 9 hours ahead' does not match its own 03:02 UTC: From 03:02 UTC to the first public artifacts (13:34Z) or the scheduled 14:00 UTC is about 10.5 to 11 hours. The claim id says nine hours; the claim text does not. | Vendors differ on pre-disclosure attack traffic: Cloudflare says it 'observed attack traffic targeting our customers' before the release; Imperva says that during pre-disclosure monitoring it 'observed no traffic matching the monitored PHP2Shell exploit patterns'. Different networks and patterns, so this is probably measures-differently, but the site should not cite either as general.", "severity": "low", "claims": [ "waf-nine-hours" ], "sources": [], "pages": [ "facts/waf-nine-hours/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-111", "type": "finding", "status": "open", "title": "watchtowr-itw: 1 smaller precision and sourcing point", "description": "'Lists the flaws as exploited in the wild' rests only on search summaries: No capture shows a watchTowr listing; Equixly's pre-advisory page says the opposite at that time. Drop that half until a capture of watchTowr's page carries it.", "severity": "low", "claims": [ "watchtowr-itw" ], "sources": [], "pages": [ "facts/watchtowr-itw/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-112", "type": "finding", "status": "open", "title": "weirdgloop-13h: 2 smaller precision and sourcing points", "description": "94% is the operator's unaudited figure: No method is given for the 94% (it is \"about\" and credited to caching). Mark it as Weird Gloop's own figure. numbers.json carries it as a plain value \"94%\". | \"From cache\" and \"page views\" are paraphrase: The blog says \"about 94% of wiki pageviews serving correctly, even with no database or PHP running\" and credits \"very aggressive caching\"; it does not say all of them were served from cache. Also, impact.json's quote uses a straight apostrophe where the capture has U+2019 (\"we_ve\"): typographic only.", "severity": "low", "claims": [ "weirdgloop-13h" ], "sources": [], "pages": [ "facts/weirdgloop-13h/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-113", "type": "finding", "status": "open", "title": "who-first: 2 smaller precision and sourcing points", "description": "'the flaws' (plural) not shown: Calif reported its first bug on 11 August and 'the second bug' on 21 August; Wiz reported on 24 August and is listed first in the credits of GHSA-6wmf-4rv5-p3rp. Nothing captured shows which party first found CVE-2026-109619. | Hash pre-image unpublished: The tweet carries only a hex string. Its date is verified by the post ID decode (2026-08-05T15:54:24Z, matching the displayed '15:54 _ 5 Aug 2026'), but what it commits to cannot be checked.", "severity": "low", "claims": [ "who-first" ], "sources": [], "pages": [ "facts/who-first/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-114", "type": "finding", "status": "open", "title": "wikimedia-precaution: 2 smaller precision and sourcing points", "description": "\"other\" dropped from the paraphrase: The statement says \"a number of other systems\", after saying all Foundation-supported and volunteer-run PHP systems are affected; Mashable describes them as \"supporting tools\". The claim's \"a number of systems\" loses that nuance. | Restoration not recorded: wikimediastatus.net at 08:18:50Z on 22 Oct shows \"All Systems Operational\" (reading and editing). Insider Paper (via Mashable) says the status page had listed \"Emergency Maintenance\" on 21 Oct.", "severity": "low", "claims": [ "wikimedia-precaution" ], "sources": [], "pages": [ "facts/wikimedia-precaution/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-115", "type": "finding", "status": "open", "title": "wiz-independent: 2 smaller precision and sourcing points", "description": "Note's quote of the Wiz X post is not verbatim: The note quotes 'Wiz Research uncovers'; the capture reads '@wiz_io Research uncovers'. The note also says 'no credit to Calif or OpenAI': true of the lead post, but the same thread says 'Kudos to @GeminiApp, @php_net Core, @OpenAI, @calif_io'. Post ID 2112899813264277528 decodes to 2026-10-21T13:32:25Z, matching the displayed time. | 'the first flaw' is ambiguous: Wiz's 'the first PHP vulnerability' is Wiz's own first finding. Read on the site, 'the first flaw' can suggest Wiz found CVE-2026-109618 first, which the Calif and Foundation captures contradict. Use 'its first flaw'.", "severity": "low", "claims": [ "wiz-independent" ], "sources": [], "pages": [ "facts/wiz-independent/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-116", "type": "finding", "status": "open", "title": "wordpress-drupal: 2 smaller precision and sourcing points", "description": "'by' says Wiz for WordPress and Drupal; Wiz also confirms Joomla: Wiz's blog: 'achieved unauthenticated remote code execution on WordPress, Drupal and Joomla'. Joomla therefore also has two parties. | Eight of the eleven applications rest on Calif alone, and its demo video is not captured: MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS appear only in Calif's list; Calif gives versions (e.g. WordPress 7.1.2, Drupal 11.4.3) the claim omits.", "severity": "low", "claims": [ "wordpress-drupal" ], "sources": [], "pages": [ "facts/wordpress-drupal/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-117", "type": "finding", "status": "open", "title": "The site is 40 sources behind the evidence vault, and the missing ones change what it can say", "description": "The vault head is 31ccc515c29f with 184 source folders; data/sources.json has 144, exported at 200d08971937 (11:35 UTC), which is an ancestor of the head through the 12:06 UTC merge of the collectors' branches. The 40 not exported are 35 captures and 5 failed fetches, mostly by collector-news: Reuters (via RTE, Boursorama and a factbox), The Record, Global News, ABC Australia, BleepingComputer, Tagesspiegel/dpa, and captures of operators' own sites (UNIGE and EPFL, two French prefectures, ANTS, Edinburgh council, NCSC.nl, Overheid.nl, Wikimedia status). The impact checker used them: several operators the site does not list were down, and several it lists as down were back up by 08:19 UTC. Board 039 has asked for this re-export since v0.2; it is still not done. Every page footer names vault 200d08971937 as if it were the vault.", "severity": "high", "claims": [], "sources": [], "pages": [ "sources/index.html", "impact/index.html", "admin/vault/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-118", "type": "finding", "status": "open", "title": "data_vault.json lists five writing agents; the vault has a sixth, collector-news", "description": "collector-news wrote most of the 40 unexported sources (their source.json says added_by collector-news). The site's agent list and team page do not know it exists.", "severity": "low", "claims": [], "sources": [], "pages": [ "team/index.html", "admin/vault/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-119", "type": "finding", "status": "open", "title": "Front page: 'Websites on PHP 8.1 or older have no ready-made fix' is contradicted by the source it cites", "description": "data/plain.json, facts. The php.net advisory (php-net-advisory, cited) says: 'Some distributions and LTS vendors provide backported fixes, so contact your vendor for details'. The PHP project itself ships no release for 8.1 and older, and its minimal source backports for 7.4 to 8.1 are not packages; but distributions and LTS vendors do ship ready-made packages. Say: 'PHP itself has no release for 8.1 or older; your Linux distribution or LTS vendor may have one'.", "severity": "medium", "claims": [], "sources": [ "php-net-advisory" ], "pages": [ "index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-120", "type": "finding", "status": "open", "title": "Front page 'latest' still says the NCSC-NL list 'reaches 674 products'", "description": "BRIEF-CORRECTIONS.md (v0.4.2) records 675 rows at cca173c64ec5 (iBabs dropped by the vault's export). The front page's latest strip, from data/plain.json, still says 674. The correction says the data/software.json counts stay until the export is fixed (board 052); plain.json is hand-written and could carry 675 now.", "severity": "low", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-121", "type": "finding", "status": "open", "title": "NVD's CVSS 3.1 score of 9.8 is in the vault and nowhere on the site", "description": "The vault's raw NVD API captures (nvd-cve-2026-109618 and nvd-cve-2026-109619, raw/nvd-api-2.0.json) carry NIST's own CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) beside the vendor's CVSS 4.0 9.2; a fetch of the NVD API at 18:27 UTC on 22 October shows the same. No claim, number, glossary entry or page mentions 9.8. A reader or a scanner using CVSS 3.1 sees 9.8 and finds no explanation here. See K-007.", "severity": "medium", "claims": [], "sources": [ "nvd-cve-2026-109618", "nvd-cve-2026-109619" ], "pages": [ "flaws/index.html", "numbers/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Contradiction-7" } ] }, { "label": "Finding-122", "type": "finding", "status": "open", "title": "Front page 'Has anyone been hacked?' gives Amazon's honeypot hit but not Amazon's 'broadly exploited in the wild'", "description": "data/plain.json cards and facts say Amazon reports 'a decoy server was hit four days before the announcement'. Amazon's own post, in the vault (aws-security-blog-madpot), also says 'PHP2Shell is now being broadly exploited in the wild.' The front page is the most-read page and understates the strongest exploitation statement by a named party; it should carry Amazon's words and say what they rest on (its sensors) beside 'no confirmed break-in'. The coverage review flagged this; it is not yet done.", "severity": "medium", "claims": [ "amazon-honeypot" ], "sources": [ "aws-security-blog-madpot" ], "pages": [ "index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Contradiction-2" } ] }, { "label": "Finding-123", "type": "finding", "status": "open", "title": "The scheduled-capture brief attributes the Censys count to The Hacker News; the vault has it from SecurityWeek", "description": "admin/content/briefs/2026-10-22__brief__scheduled-capture-json-and-analysis.md, contradiction table: '1.57 million of about 2.6 million hosts unpatched on 21 October (Censys via The Hacker News)'. No Hacker News capture in the vault carries 1.57 million; securityweek-exploitation-days-before does, with a different denominator (K-004). The brief is the editor's and is not edited; this is a note for whoever builds on it.", "severity": "low", "claims": [], "sources": [], "pages": [ "admin/briefs/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-124", "type": "finding", "status": "fixed", "title": "The BBC's 'roughly 70_' is not Wiz's wording", "description": "The BBC live page (bbc-live-ckgel5xp2xv9t, 08:05 UTC capture) puts 'roughly 70%' in quotation marks as Wiz's estimate. Wiz's blog and X post say '70% of all websites' and '70% of the Internet'; neither says 'roughly'. Anything on the site that quotes the BBC's phrase as Wiz's would be a quote of a quote.", "severity": "low", "claims": [ "scale-70pc-internet" ], "sources": [ "bbc-live-ckgel5xp2xv9t", "wiz-blog-php2shell" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Contradiction-1" } ] }, { "label": "Finding-125", "type": "finding", "status": "fixed", "title": "Front page: 'the PHP project has not answered it publicly yet' has been out of date since 09:11 UTC on 22 October", "description": "data/plain.json, unknown: 'Whether the fix is complete. A report on 21 October suggested it may not be; the PHP project has not answered it publicly yet.' PHP's security team answered on oss-security at 09:11 UTC (2026/10/22/15): an unrelated crash bug of minimal impact, nothing to do with the RCE. It was true of the vault's capture, which stops before the reply; it is not true of the world. Capture the reply, then close or reword the question, and re-grade fix-incomplete (whose note says 'Nothing from PHP on the list at capture').", "severity": "high", "claims": [ "fix-incomplete" ], "sources": [], "pages": [ "index.html", "code/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-2", "links": [ { "verb": "relates-to", "to": "Contradiction-11" } ] }, { "label": "Finding-126", "type": "finding", "status": "open", "title": "amazon-honeypot quotes Amazon's first wording; Amazon revised it on 22 October at 21:25 UTC, and the vault now holds both", "description": "The claim quotes 'PHP2Shell is now being broadly exploited in the wild' as Amazon's. The vault's second capture of the same post (20261023T160435Z, text sha256 4108b2850c48a8f2) reads 'PHP2Shell is now seeing broad exploitation attempts in the wild.', page modified 14:25 PDT on 22 October, with no note. The words were Amazon's at the time; they are not Amazon's now. The claim, and the other data files that quote it (impact.json, history.json, compromise.json and others), should give both wordings with their times. Correction request R-004 asked for this change and can close as corrected without being sent.", "severity": "medium", "claims": [ "amazon-honeypot" ], "sources": [], "pages": [ "facts/amazon-honeypot/index.html", "compromise/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-5", "links": [] }, { "label": "Finding-127", "type": "finding", "status": "open", "title": "watchtowr-itw: watchTowr's own pages are now captured and carry the claim; the note still says watchtowr.com returns 403", "description": "The vault re-captured watchtowr-php2shell (20261023T232528Z) and watchtowr-php2shell-faq (20261023T160435Z) with content: 'EXPLOITED IN THE WILD: Yes, reported by watchTowr' and 'watchTowr has observed exploitation in the wild through its Attacker Eye honeypot network'. The claim's note ('returns HTTP 403 to this site's capture tool; known only from search summaries') is out of date and its status 'unverified' understates a primary statement. Say also what it rests on: honeypot observations, like Amazon's.", "severity": "medium", "claims": [ "watchtowr-itw" ], "sources": [], "pages": [ "facts/watchtowr-itw/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-6", "links": [] }, { "label": "Finding-128", "type": "finding", "status": "open", "title": "Wersm says Palo Alto Networks and Trail of Bits reported confirmed compromises; no primary capture says so", "description": "Wersm (captured 26 October 01:31 UTC) writes, secondhand from TechCrunch: 'Palo Alto Networks and Trail of Bits later reported confirmed compromises and post-exploit activity'. Palo Alto's own PSIRT bulletin (captured 22 October 19:17 UTC, sha256 16cb7bd74aee...) says it is 'not aware of any malicious exploitation of this issue against our products'; no capture of Trail of Bits or a TechCrunch article is in the vault. No victim is named, so the site's claim about a named organisation holds. Ask for: the TechCrunch article and any Trail of Bits post, captured. Not changed by the desk.", "severity": "medium", "claims": [ "no-confirmed-compromise" ], "sources": [ "wersm-php2shell-legacy-infrastructure-web-risk", "paloalto-psirt-cve-2026-109618" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-9", "links": [] }, { "label": "Gap-1", "type": "gap", "status": "open", "title": "affected-sites: Operators shown offline in the vault but absent from impact.json", "description": "EPFL own homepage at 08:19:13Z: \"Some EPFL websites are unavailable\" after a security alert (epfl-site). Canada: \"Some Government of Canada websites have been temporarily taken offline as a precaution\" (globalnews-ottawa-sites, AI Minister Evan Solomon). Australia: government sites including the ACSC pulled offline (abc-au-gov-sites-exposed, abc-au-politics-live; cyber.gov.au capture failed ERR_ABORTED). Switzerland: universities of Geneva and Fribourg, EPFL, Basel-Stadt canton (20min-fr-suisse-romande, letemps-php-sites-debranches). Germany: Laender, hospitals, universities still offline Thursday (tagesspiegel-dpa-noch-offline). Czech government site offline 17:00 GMT and Internet Archive (reuters-factbox-websites-offline). None of these are rows in impact.json.", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Gap-2", "type": "gap", "status": "open", "title": "fix-incomplete: The Fediverse posts (fedi.katze.sh__elise) are not captured; the thread has no text capture", "description": "The source openwall-oss-security-109619-thread has only raw/ curl copies (no captures/ entry, no text.txt, no manifest sha for a text file). The origin posts 117479383739450605 and 117478655339557825 are not in the vault, so the claim rests on a relay of an unnamed person.", "severity": "medium", "claims": [ "fix-incomplete" ], "sources": [], "pages": [ "facts/fix-incomplete/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Gap-3", "type": "gap", "status": "open", "title": "pocs-wrong: VulnCheck's review is not captured; the claim rests on a relay", "description": "Only rjmendez's README reports VulnCheck's finding. None of the five vault captures that mention VulnCheck carries a PoC-mechanism review.", "severity": "medium", "claims": [ "pocs-wrong" ], "sources": [], "pages": [ "facts/pocs-wrong/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] } ], "runs": [ { "id": "Run-1", "site_version": "0.4.7", "vault_commit": "31ccc515c29f", "site_export_commit": "200d08971937", "started": "2026-10-22T18:14Z", "finished": "2026-10-22T18:55Z", "checked": "all 70 claims against the evidence vault (mode 1); the front page's plain-English facts; 10 contradictions; mode 2: CISA KEV, the CVE and NVD records, php.net releases, the NCSC-NL repository, the BBC live page, The Next Web, the PHPocalypse Tracker", "opened": "3 high, 56 medium and 65 low findings; 3 evidence gaps; 10 contradictions; 6 new evidence", "audit": "Every excerpt recorded (one per capture checked) was re-found verbatim in its capture file by fc.py check, and every capture's sha256 matched the manifest: 0 mismatches.", "summary": "First run. 10 of 70 claims can be relied on without reservation; 11 carry a status word stronger than their evidence, 6 a weaker one; 2 are refuted as worded (the CVSS 10.0 and 'disclosed on 22 October', which is true only in Australian time). Five quotes on the site are not in the captures they are attributed to. Highest: Italy's ACN does advise taking sites offline, which the agencies table says it does not; the 'contradicted' mark on the allies' offline advice rests on something the BBC did not say; and the site is 40 sources behind the vault. KEV still lists neither CVE at 18:27 UTC.", "note": "Checked against the claims as they stood at site v0.4.7; data/claims.json is unchanged in dev up to v0.5.3." }, { "id": "Run-10", "site_version": "data v0.1.36", "vault_commit": "22a0c2920b88", "site_export_commit": "22a0c2920b88", "started": "2026-10-26T16:54Z", "finished": "2026-10-26T17:20Z", "quiet_wakes_before": 0, "checked": "fc.py changed (no-confirmed-compromise, refreshed to 12:14 UTC on 26 October); fc.py check (0 failures); fc.py drift (the same six); the 20 captures since 09:40 UTC read for a named compromise; KEV; NVD", "opened": "none", "audit": "fc.py check: 0 failures. fc.py drift: 6, unchanged and explained.", "summary": "no-confirmed-compromise still holds at 12:14 UTC on 26 October (A4); none of the 20 new captures names a compromised organisation. One new statement of the 70% figure added to the lineage (S-128, YugaTech, 'roughly 70% of websites worldwide, according to figures cited by researchers', no measurer named, family F-2). KEV (2026.10.23) lists neither CVE; NVD has no record for CVE-2026-115560." }, { "id": "Run-2", "site_version": "0.5.7", "vault_commit": "31ccc515c29f", "site_export_commit": "200d08971937", "started": "2026-10-22T20:52Z", "finished": "2026-10-22T21:10Z", "checked": "fc.py changed (no claim changed since run 1, no source or agencies, exploitation, impact or front-page data changed, vault head unchanged); every open ticket against the current data (none fixed); mode 2: CISA KEV, the CVE and NVD records, php.net releases, the NCSC-NL repository head, the PHPocalypse Tracker, and the five oss-security posts newly referenced by the CVE-2026-109619 record", "opened": "1 high finding; 1 contradiction (K-011); 5 new evidence (1 high); 0 tickets closed", "audit": "fc.py check: 0 failures; every recorded excerpt re-found verbatim, every hash matching.", "summary": "Nothing on the site changed and none of run 1's 143 tickets can close yet. The world moved: the PHP security team answered the 'incomplete fix' report publicly at 09:11 UTC on 22 October (an unrelated crash bug, 'nothing to do with the RCE'), so the front page's 'PHP has not answered it publicly yet' is out of date; capture the reply (Evidence-7). KEV still lists neither CVE; no PHP release after 21 October; NVD now 'Analyzed'; the PHPocalypse Tracker has one site still dark." }, { "id": "Run-3", "site_version": "0.13.0", "vault_commit": "1845598d9a38", "site_export_commit": "1845598d9a38", "started": "2026-10-24T01:25Z", "finished": "2026-10-24T02:20Z", "checked": "the seven claims that changed since run 2 (the news desk chief's fixes); every open ticket on them; board 212 and 244; K-009 with 112 more sources in the vault; K-011's capture; the export (now at the vault head, 296 sources); and the first investigation, php-share (the editor's brief of 24 October): 29 measures from the measurers, 127 statements of the share in the vault, 73 page records re-fetched live", "opened": "5 tickets (Evidence-12 high: AWS reworded its key sentence; Evidence-13 CNN; Evidence-14 Wikipedia; Evidence-15 the measurement; Contradiction-12 explained); closed 9: Finding-26, 27, 28, 33, 34, 102, 124 and 125 fixed, K-004 and K-009 explained", "audit": "fc.py check: 0 failures; the new excerpts (The Verge, PCMag, Recorded Future, Insurance Business, TPO) re-found verbatim in their captures. The investigation: 29 of 29 measures, 127 of 127 statements and 81 of 81 live excerpts re-found in the bytes whose sha256 they record, by a check independent of the researchers' own.", "summary": "The editor asked for a pass on 24 October; the scheduled task had not fired since 22 October 20:52 UTC. Seven claims changed: the desk chief's fixes carry the evidence now, so eight findings close and two contradictions are explained (K-004 by the restated counters; K-009 by time: the Foundation describes the IDs at about 15:00 UTC on 20 October, the exploit video came that evening). Finding-32 stays open: the claim note, numbers.json and the front page still say no page names the survey, and Cloudflare links W3Techs. The correction requests R-001 to R-003 no longer wait on the desk. K-011 waits on the capture of PHP's 09:11 UTC reply (board 250). Then the first investigation, at the editor's request: PHP is on 69.3% of the websites whose server-side language W3Techs can identify (80.6% in 2015), on about half of every site the HTTP Archive crawls (48.3%), and WordPress alone on 39.6% of all sites; scanners count about 2 to 3 million internet-facing hosts. '70% of the Internet' starts in Wiz's own X post and blog headline, whose body says 'websites'. Of 73 pages re-checked, none corrected the figure; CNN reworded it twice. AWS quietly narrowed 'broadly exploited' to 'broad exploitation attempts', which this site still quotes (Evidence-12, high)." }, { "id": "Run-4", "site_version": "0.14.10", "vault_commit": "b995a28fe67a", "site_export_commit": "1845598d9a38", "started": "2026-10-24T07:52Z", "finished": "2026-10-24T08:05Z", "checked": "fc.py changed (no claim changed); fc.py check (0 failures); the vault's new captures against the open tickets; mode 2: KEV, the CVE and NVD records and their new references, php.net releases, the NCSC-NL head, the PHPocalypse Tracker, W3Techs, Amazon's post, CrowdStrike", "opened": "3 evidence (Evidence-16 CrowdStrike's version origins, Evidence-17 Siemens and PAN-OS in the record, Evidence-18 the primary feeds); Evidence-4 marked captured (byte-identical), Evidence-11 superseded", "audit": "fc.py check: 0 failures.", "summary": "No claim changed and no fix landed. The world moved a little: CrowdStrike dates CVE-2026-109618 from PHP 7.3.0 and CVE-2026-109619 back to 5.4 (bears on K-003, 'every version since 5.4'); Siemens and Palo Alto PAN-OS are now in the primary record; KEV (2026.10.23) still lists neither CVE and CISA's SSVC still says no exploitation; every PHPocalypse site is back. Amazon's revised sentence is still not captured (Evidence-12, high). The vault moved to b995a28fe67a; the site's export is still at 1845598d9a38." }, { "id": "Run-5", "site_version": "0.15.3", "vault_commit": "9cfe2778c1b0", "site_export_commit": "1f38e70921b2", "started": "2026-10-24T15:53Z", "finished": "2026-10-24T16:10Z", "checked": "fc.py changed (no-confirmed-compromise refreshed by the journalist); fc.py check (0 failures); the open tickets against the vault's new captures; the desk's pages under the new Content-Security-Policy (no violations); KEV, php.net releases, the CVE record", "opened": "1 finding (Finding-126, amazon-honeypot quotes Amazon's first wording); closed: Evidence-12 and Evidence-3 captured", "audit": "fc.py check: 0 failures; Sophos (Cyber Security News), American Banker, The Next Web and Amazon's revised sentence re-found verbatim in their captures.", "quiet_wakes_before": 1, "summary": "Amazon's revised sentence is now captured (aws-security-blog-madpot, 23 October): 'broadly exploited in the wild' became 'seeing broad exploitation attempts in the wild' at 21:25 UTC on 22 October, so correction request R-004 can close as corrected without being sent, and amazon-honeypot is graded superseded until it gives both wordings (Finding-126). no-confirmed-compromise refreshed to 08:37 UTC on 24 October and still holds, now with Sophos's withdrawn success claim. KEV still lists neither CVE; no PHP release after 21 October. The 12:52 wake before this one was quiet." }, { "id": "Run-6", "site_version": "0.18.2", "vault_commit": "176e2dc212e1", "site_export_commit": "8c16a64a7cf6", "started": "2026-10-25T08:52Z", "finished": "2026-10-25T09:05Z", "quiet_wakes_before": 1, "checked": "fc.py changed (no-confirmed-compromise refreshed to 16:05 UTC on 24 October); fc.py check (0 failures); the first daily drift check (fc.py drift: every excerpt a grade rests on, against the newest capture of its source); the measures re-fetched (W3Techs, the HTTP Archive); KEV", "opened": "1 finding (Finding-127: watchtowr-itw is now carried by watchTowr's own pages)", "audit": "fc.py check: 0 failures. fc.py drift: 6 excerpts gone from re-captured sources, all explained: Amazon's revision (3, Finding-126), Cloudflare's 'Today' dated to 'October 21' (Quarkslab still named), watchTowr no longer blocking captures (2).", "summary": "The daily sweep, with a new tool: fc.py drift checks every excerpt a grade rests on against the newest capture of its source. Of about 30 claims whose sources were re-captured on 23 and 24 October, six excerpts had gone, all explained. watchTowr's own pages are now captured and say 'EXPLOITED IN THE WILD: Yes' from its honeypot network: watchtowr-itw is A6 and its 'unverified' understates it (Finding-127). no-confirmed-compromise still holds at 16:05 UTC on 24 October (Die Presse for Austria; RainForest's honeypot, attempts only). W3Techs now says 69.2%, the first move in the measure's series. KEV still lists neither CVE. The 20:52 wake of 24 October was quiet." }, { "id": "Run-7", "site_version": "0.20.3", "vault_commit": "87795d121200", "site_export_commit": "87795d121200", "started": "2026-10-25T12:53Z", "finished": "2026-10-25T13:20Z", "quiet_wakes_before": 0, "checked": "fc.py changed (no-confirmed-compromise refreshed to 09:35 UTC on 25 October, one new source); fc.py check (0 failures); fc.py drift (the same six excerpts as run 6, all explained); the 20 captures made since 16:05 UTC on 24 October, read for a named compromise; KEV; php.net releases", "opened": "none", "audit": "fc.py check: 0 failures. fc.py drift: 6, unchanged since run 6 and explained.", "summary": "no-confirmed-compromise still holds at 09:35 UTC on 25 October (A4): the Turkish Presidency's Cyber Security Directorate says e-Devlet is safe, and teleSUR says no massive successful intrusion has been publicly confirmed; none of the 20 new captures names a compromised organisation. Lorikeet Security's blog gives a third planned disclosure date, 24 October, with no source; added to K-010. KEV (2026.10.23) still lists neither CVE; php.net's latest releases are still those of 21 October." }, { "id": "Run-8", "site_version": "0.22.26", "vault_commit": "94352a55fbaa", "started": "2026-10-26T08:54Z", "finished": "2026-10-26T09:10Z", "quiet_wakes_before": 0, "checked": "fc.py changed (no-confirmed-compromise, refreshed to 14:40 UTC on 25 October, one new source: La Razon); fc.py check (0 failures); fc.py drift (the same six excerpts as run 6, all explained); KEV; NVD (CVE-2026-115560, no record yet); php.net releases; W3Techs", "opened": "none", "audit": "fc.py check: 0 failures. fc.py drift: 6, unchanged since run 6 and explained.", "summary": "no-confirmed-compromise still holds at 14:40 UTC on 25 October (A4): La Razon, the one new source, reports attacks as attempts and names no victim, so it is graded partial. The vault is read from the desk's own pack copy (hsmfer5w): a pull takes 15 seconds, a fresh clone 40. W3Techs still says 69.2%. KEV (2026.10.23) still lists neither CVE; NVD has no record yet for CVE-2026-115560, the third PHP flaw La Razon names; php.net's latest releases are those of 21 October.", "site_export_commit": "94352a55fbaa" }, { "id": "Run-9", "site_version": "data v0.1.28", "vault_commit": "a7ab84771dfc", "site_export_commit": "a7ab84771dfc", "started": "2026-10-26T12:59Z", "finished": "2026-10-26T13:30Z", "quiet_wakes_before": 0, "checked": "fc.py changed (release-time, reworded by the correspondent; no-confirmed-compromise, refreshed to 09:40 UTC on 26 October); fc.py check (0 failures); fc.py drift (the same six, explained); the 23 captures made since 14:40 UTC on 25 October, read for a named compromise; KEV; NVD", "opened": "1 finding (Wersm's unbacked 'confirmed compromises')", "audit": "fc.py check: 0 failures. fc.py drift: 6, unchanged and explained.", "summary": "release-time re-graded A5 holds: the release manager's own timeline (13:31, 13:33, 13:34, 13:35 UTC) agrees with the GitHub advisory and tags and with CERT-EU inside five minutes; the original plan, 14:00 UTC, is in K-010 from a third source. no-confirmed-compromise still holds at A4 as of 09:40 UTC on 26 October. A new source, Wersm, says Palo Alto Networks and Trail of Bits reported confirmed compromises, secondhand and naming no victim; Palo Alto's own bulletin says it is not aware of any exploitation against its products. Opened as a finding. KEV (2026.10.23) lists neither CVE; NVD has no record for CVE-2026-115560." } ], "investigations": [ { "id": "php-share", "title": "How much PHP is there, and where does '70%' come from?", "question": "How much of the web runs on PHP, by every measure that someone actually measures; and how did one of those measures become '70% of the Internet'?", "brief": "admin/content/briefs/2026-10-24__brief__factcheck-investigations-how-much-php.md", "opened": "2026-10-24", "as_of": "2026-10-24T01:50Z", "run": "Run-3", "status": "open", "answer": "About 69% of the websites whose server-side language W3Techs can identify, and falling: it was 80.6% in 2015. On every site the HTTP Archive crawls, PHP is detected on about half (48%). WordPress alone, which needs PHP, is on 39.6% of all websites. On the internet, the scanners count PHP on about 2 to 3 million hosts. No one measures a share of 'the Internet'. '70% of the Internet' is a website figure, restated in Wiz's own post, then copied.", "verdicts": [ { "wording": "PHP runs about 69-70% of the websites whose server-side language is known", "kind": "count", "level": 6, "verdict": "holds", "basis": "W3Techs' own page, fetched on 24 October: 69.3% as of 23 October, on 'all the websites whose server-side programming language we know'. The measurer is the primary record of its own measurement. It is one measurer, and W3Techs does not publish what share of sites have a known language.", "measures": [ "w3techs-php-share-known" ], "families": [ "F-5" ] }, { "wording": "PHP runs 70% of all websites", "kind": "count", "level": 1, "verdict": "holds-in-part", "basis": "No measurer of all websites gives 70%. The one that counts every crawled site, the HTTP Archive, detects PHP on 48.3% of mobile origins (September 2026, the desk's ratio of two published counts); WordPress alone is 39.6% of all sites (W3Techs). 'Of all websites' drops W3Techs' qualifier; W3Techs' own PHP 8 page does the same. The truth is between about 40% and about 70%, depending on what the unknown-language sites run.", "measures": [ "httparchive-php-share-mobile", "w3techs-wordpress-share-all", "w3techs-php-share-known" ], "families": [ "F-2", "F-8" ] }, { "wording": "70% of the Internet", "kind": "count", "level": 0, "verdict": "not-shown", "basis": "Nothing measures a share of 'the Internet'. Scanners count PHP on about 2 to 3 million internet-facing hosts (Censys, VulnCheck, Shodan), 5.1 million IP addresses (VirusTotal). The phrase first appears in Wiz's X post at 13:32 UTC on 21 October; the body of Wiz's own blog post says 'websites'. It is a website share restated, a change of denominator, not a measurement.", "measures": [ "censys-php-hosts-securityweek", "vulncheck-php-hosts", "shodan-php-hosts-poley", "virustotal-php-ips" ], "families": [ "F-1", "F-7" ] }, { "wording": "75% of websites (Reuters, 'according to W3Techs')", "kind": "count", "level": 2, "verdict": "holds-in-part", "basis": "W3Techs' yearly table gives 75.2% on 1 January 2025, 72.4% on 1 January 2026 and 69.3% on 23 October 2026. Reuters' 75% matches the January 2025 figure, not the one W3Techs showed when Reuters wrote: an out-of-date number, correctly attributed.", "measures": [ "w3techs-php-share-known" ], "families": [ "F-6" ] }, { "wording": "could take down 70% of the internet (Fortune)", "kind": "reading", "level": 0, "verdict": "not-shown", "basis": "Fortune's headline and lede, in its own voice, with no source: a usage share became a share that could be taken down. Its only attributed 70% is an accurate quote of Wiz's conclusion. Nothing in the evidence measures what could be taken down.", "measures": [], "families": [ "F-1" ] } ], "findings": [ "The measurement exists, and it is W3Techs: 69.3% of the websites whose server-side programming language W3Techs knows, on 23 October 2026. Every outlet that names a measurer names W3Techs.", "It is falling, and has been for a decade: 80.6% in January 2015, 75.2% in January 2025, 72.4% in January 2026, 69.3% now. '70%' is already a rounding up.", "The bigger the site, the less PHP: 64.4% of the top million, 60.9% of the top 100,000, 58.7% of the top 1,000 (W3Techs, known-language sites).", "On all websites, the only measurer that counts every crawled site gives about half: the HTTP Archive detects PHP on 48.3% of mobile origins and 47.3% of desktop origins in September 2026, down from about 58% in January 2023.", "WordPress, which cannot run without PHP, is on 39.6% of all websites (W3Techs): a floor for PHP's share of all sites in that sample.", "Counted in sites rather than shares: BuiltWith 23.96 million live PHP sites, Wappalyzer about 22.7 million. Neither publishes a denominator.", "On the internet, scanners count hosts, not shares: about 2.6 million (Censys, VulnCheck), 1.9 million (Shodan), 5.1 million IP addresses (VirusTotal). Palo Alto's 22.6 million 'instances' (via Fortune) is not in Palo Alto's own advisory and is ten times every other count.", "In the evidence vault, 127 statements of PHP's share in 11 languages, from 94 sources: 39 against 'the Internet' or 'the web', 29 against all websites, 30 with W3Techs' known-language denominator, 23 with no denominator.", "'70% of the Internet' starts with Wiz: its X post at 13:32 UTC on 21 October, then its blog headline and conclusion. The same post's executive summary says 'powers 70% of all websites in the world'. The denominator changes inside the origin, which cites no measurement.", "17 statements link a measurement; only one of the 39 'Internet' statements does (MediaNama puts a W3Techs link on the words '70% of the internet').", "Re-checked live on 24 October: 73 page records at 68 addresses; 64 unchanged, 4 reworded without a note, 3 blocked, 2 could not be checked, none corrected. Wiz has changed nothing. CNN rewrote its 70% lines twice and still says 'internet' in the headline.", "Outside the 70%: AWS rewrote 'PHP2Shell is now being broadly exploited in the wild' as 'now seeing broad exploitation attempts in the wild', without a note. This site quotes the first wording." ], "limits": [ "W3Techs does not publish what share of sites have a known server-side language, so its 69.3% cannot be turned into a share of all websites.", "The HTTP Archive shares are the desk's own division of two published counts (PHP origins over all origins, same date and client); the HTTP Archive does not publish the ratio.", "Every host count except the Censys query gist reaches the vault through a news outlet; no scanner's own publication is captured.", "The Internet Archive could not be reached from the desk's session; the history of wording rests on the vault's repeat captures, the pages' own modified dates and Wikipedia's revision history.", "The measurers' pages were fetched by the desk on 24 October and are not captured into a vault; they are shown with URL, time and sha256, and are not evidence of the story until captured (board 033, 043 and 222 ask the collectors for W3Techs)." ], "measures": { "generated_at": "2026-10-24", "fetches": [ { "url": "https://w3techs.com/technologies/details/pl-php", "retrieved_at": "2026-10-24T01:31:13Z", "status": 200, "sha256": "f49b114f2c6055e2bb21b2009d25e781cf715553e782b83c0adbeec818780948", "file": "fetched/w3t-pl-php.html" }, { "url": "https://w3techs.com/technologies/overview/programming_language", "retrieved_at": "2026-10-24T01:31:15Z", "status": 200, "sha256": "9ff0583d5c0932e9e132d6ed5dc56796b21014dc6d7592b773879f614d19ea11", "file": "fetched/w3t-overview-pl.html" }, { "url": "https://w3techs.com/technologies/history_overview/programming_language/ms/y", "retrieved_at": "2026-10-24T01:31:17Z", "status": 200, "sha256": "bb824681f72b337d10e7d8620ab52eb76298431eb4257afe2903d3b568666eb2", "file": "fetched/w3t-history-pl.html" }, { "url": "https://w3techs.com/technologies/history_overview/programming_language/ms/q", "retrieved_at": "2026-10-24T01:31:20Z", "status": 200, "sha256": "1f32eccdc844c3b4176636cd416d1b697591dd85c04619db3b1ca8501cff7fe2", "file": "fetched/w3t-history-pl-q.html" }, { "url": "https://w3techs.com/technologies/details/pl-php/all/all", "retrieved_at": "2026-10-24T01:31:23Z", "status": 200, "sha256": "f49b114f2c6055e2bb21b2009d25e781cf715553e782b83c0adbeec818780948", "file": "fetched/w3t-php-versions.html" }, { "url": "https://w3techs.com/technologies/overview/content_management", "retrieved_at": "2026-10-24T01:31:26Z", "status": 200, "sha256": "b363d4408a378f860c971a45a8e63de3b99dce715dbc3c533b997105582a7c72", "file": "fetched/w3t-cms-overview.html" }, { "url": "https://trends.builtwith.com/framework/PHP", "retrieved_at": "2026-10-24T01:31:28Z", "status": 200, "sha256": "467433b45a8db4bed3e1fa4fa3df0e8f41f916263eb4b13e47df0f1ba047823a", "file": "fetched/builtwith-php.html", "note": "bytes are gzip (server sent gzip without curl --compressed); decoded copy in decoded/builtwith-php.html" }, { "url": "https://packagist.org/statistics", "retrieved_at": "2026-10-24T01:31:28Z", "status": 200, "sha256": "c81dcafd59845c51602e13361c182dc308e95fda5e6c71b68ce62f1f4faaec24", "file": "fetched/packagist-stats.html" }, { "url": "https://www.wappalyzer.com/technologies/programming-languages/php/", "retrieved_at": "2026-10-24T01:31:28Z", "status": 200, "sha256": "c96eba601b04e734a48c9c0bf72f0f2067b124fccbd28d31f5f98242d912924d", "file": "fetched/wappalyzer-php.html" }, { "url": "https://w3techs.com/technologies", "retrieved_at": "2026-10-24T01:31:52Z", "status": 200, "sha256": "e69c8859ef246e6c623083cc21421b8630409e8be407c56185ee64b66f6c86b2", "file": "fetched/w3t-technologies.html" }, { "url": "https://w3techs.com/faq", "retrieved_at": "2026-10-24T01:31:53Z", "status": 200, "sha256": "2ee7fbfdd6f223745a5a471a8cf999204926149b8b723cf32fea1942a441c0e3", "file": "fetched/w3t-faq.html" }, { "url": "https://w3techs.com/technologies/details/pl-php/8", "retrieved_at": "2026-10-24T01:31:54Z", "status": 200, "sha256": "2e4782e518ceee75a0bd8c1412e3235a8819198718dd29e033adcbd574f6970f", "file": "fetched/w3t-php8.html" }, { "url": "https://w3techs.com/technologies/details/pl-php/7", "retrieved_at": "2026-10-24T01:31:57Z", "status": "connection-failed", "sha256": null, "file": null }, { "url": "https://w3techs.com/technologies/details/pl-php/5", "retrieved_at": "2026-10-24T01:32:04Z", "status": "connection-failed", "sha256": null, "file": null }, { "url": "https://w3techs.com/technologies/details/cm-wordpress", "retrieved_at": "2026-10-24T01:32:12Z", "status": 200, "sha256": "c7c819ccd71cea94f7e02b6652664dcc2cb0b4411dedbb28fddc200d8fad24be", "file": "fetched/w3t-wordpress.html" }, { "url": "https://w3techs.com/technologies/history_details/pl-php", "retrieved_at": "2026-10-24T01:32:20Z", "status": 200, "sha256": "50ebc3d08c2decf724357faef0d01e7a51ac6316003ef4e60a363db0b69ed60b", "file": "fetched/w3t-hist-php-versions.html" }, { "url": "https://w3techs.com/technologies/history_overview/programming_language", "retrieved_at": "2026-10-24T01:32:22Z", "status": 200, "sha256": "aea4e6acf2397713fa68eb3a51d8fa276aea9ae611541102b2740354fa835747", "file": "fetched/w3t-hist-pl-monthly.html" }, { "url": "https://w3techs.com/technologies/history_overview/content_management/ms/y", "retrieved_at": "2026-10-24T01:32:27Z", "status": 200, "sha256": "ce63e40fecc4253414b087c6fe558aee4b6a3baf42c4139387d117b485379f78", "file": "fetched/w3t-hist-cms-y.html" }, { "url": "https://w3techs.com/technologies/market/programming_language", "retrieved_at": "2026-10-24T01:32:28Z", "status": 200, "sha256": "b81e072fc488200502831d7b14d61915ca2225ba5e4f818e8431cf681be62c77", "file": "fetched/w3t-market-pl.html" }, { "url": "https://w3techs.com/technologies/topsite/programming_language", "retrieved_at": "2026-10-24T01:32:29Z", "status": 200, "sha256": "8caa0d4e10dbda96d99e7ee3f0e651db1b448305e8d9e5c52f04d5ad476a317d", "file": "fetched/w3t-topsite-pl.html" }, { "url": "https://w3techs.com/technologies/details/pl-php/7", "retrieved_at": "2026-10-24T01:32:43Z", "status": 200, "sha256": "95b2d636702df6d0f2bcdb710bf1c9d2d21514fcd361eb508198a989040026f8", "file": "fetched/w3t-php7.html" }, { "url": "https://w3techs.com/technologies/details/pl-php/5", "retrieved_at": "2026-10-24T01:32:43Z", "status": 200, "sha256": "a2cd9ba5f26b6db66123c87c686d1c962bbce6359e542a12cf580eb7d7df8608", "file": "fetched/w3t-php5.html" }, { "url": "https://w3techs.com/technologies/history_overview/content_management/all/y", "retrieved_at": "2026-10-24T01:33:12Z", "status": 200, "sha256": "b624bcbb7cfe6b45009769ea8e1502046f817a2d387aa38e44a0615bb3082927", "file": "fetched/w3t-hist-cms-all-y.html" }, { "url": "https://w3techs.com/technologies/history_overview/programming_language/all/y", "retrieved_at": "2026-10-24T01:33:13Z", "status": "connection-failed", "sha256": null, "file": null }, { "url": "https://w3techs.com/technologies/overview/programming_language/all", "retrieved_at": "2026-10-24T01:33:44Z", "status": 200, "sha256": "661a714c7373843f13e839257a2046a2afb4b084241e6c78c4fc0152aa1c7bd4", "file": "fetched/w3t-overview-pl-all.html" }, { "url": "https://w3techs.com/technologies/history_overview/programming_language/all/y", "retrieved_at": "2026-10-24T01:33:56Z", "status": 404, "sha256": "32a6aee157cc63fc12f8465c4cac844b744d108424a29e7ef7fe4a8449549275", "file": "fetched/w3t-hist-pl-all-y.html" }, { "url": "https://packagist.org/php-statistics", "retrieved_at": "2026-10-24T01:34:44Z", "status": 200, "sha256": "cdf070b0ead2ef5835d9b852a22a44802513249c7c124329ab8a33d6754e2662", "file": "fetched/packagist-php-statistics.html" }, { "url": "https://packagist.org/statistics.json", "retrieved_at": "2026-10-24T01:34:45Z", "status": 200, "sha256": "9b04f05b713166c57f0eccf2bf1aaa60c0d1a0776168b9fb3e938a40d0657934", "file": "fetched/packagist-statistics.json" }, { "url": "https://reports-dot-httparchive.uc.r.appspot.com/v1/adoption?technology=PHP&geo=ALL&rank=ALL&start=latest", "retrieved_at": "2026-10-24T01:35:17Z", "status": 404, "sha256": "6b43b396ba4708e5ffe9da06909bc2059e55b300f2434bc4181ca3a842d83bd6", "file": "fetched/ha-techreport-adoption-php.json" }, { "url": "https://reports-dot-httparchive.uc.r.appspot.com/v1/technologies?technology=PHP", "retrieved_at": "2026-10-24T01:35:18Z", "status": 404, "sha256": "6b43b396ba4708e5ffe9da06909bc2059e55b300f2434bc4181ca3a842d83bd6", "file": "fetched/ha-techreport-tech-php.json" }, { "url": "https://reports-dot-httparchive.uc.r.appspot.com/v1/adoption?technology=PHP&geo=ALL&rank=ALL", "retrieved_at": "2026-10-24T01:35:18Z", "status": 404, "sha256": "6b43b396ba4708e5ffe9da06909bc2059e55b300f2434bc4181ca3a842d83bd6", "file": "fetched/ha-techreport-adoption-php-all.json" }, { "url": "https://httparchive.org/reports/techreport/tech?tech=PHP", "retrieved_at": "2026-10-24T01:35:26Z", "status": 200, "sha256": "8c3ff8bb868f913c2f232fd5d985a219b8d0b396c4178c395059dbb5e4d6fa72", "file": "fetched/ha-techreport-php-page.html" }, { "url": "https://httparchive.org/_astro/TechReportLayout.astro_astro_type_script_index_0_lang.sR8T6x9X.js", "retrieved_at": "2026-10-24T01:35:38Z", "status": 200, "sha256": "a2ee436112d61898cd8bd498ac2a1109e1f9faad6978cb5dcc14e3707a5ca399", "file": "fetched/ha-tr-layout0.js.txt" }, { "url": "https://httparchive.org/_astro/TechReportLayout.astro_astro_type_script_index_1_lang.Dy0l2-s9.js", "retrieved_at": "2026-10-24T01:35:39Z", "status": 200, "sha256": "6f1682a83e610c231285ab4f6b2ced5963a29e6763b4055efe2c89a8b719ff9e", "file": "fetched/ha-tr-layout1.js.txt" }, { "url": "https://httparchive.org/_astro/constants.C1noILWJ.js", "retrieved_at": "2026-10-24T01:35:50Z", "status": 200, "sha256": "7a2d0cb24e9ef95b56b64282f8e99909c8e1bbfa7393b13d1f98e9ff6516a02f", "file": "fetched/ha-tr-constants.js.txt" }, { "url": "https://cdn.httparchive.org/v1/adoption?technology=PHP&geo=ALL&rank=ALL", "retrieved_at": "2026-10-24T01:35:57Z", "status": 200, "sha256": "2013e7d1b47ecbd266cf27c364381c52d4eea5199fea2f1f740c81d066f90173", "file": "fetched/ha-v1-adoption-php.json" }, { "url": "https://cdn.httparchive.org/v1/technologies?technology=PHP", "retrieved_at": "2026-10-24T01:35:57Z", "status": 200, "sha256": "5eb523b421d5bf0a5f98ad44a8af9c1d747016162b573dc881170ac02ffb70fd", "file": "fetched/ha-v1-technologies-php.json" }, { "url": "https://cdn.httparchive.org/v1/adoption?technology=WordPress&geo=ALL&rank=ALL", "retrieved_at": "2026-10-24T01:35:58Z", "status": 200, "sha256": "7964a028052a05716ff8df036542f7afa086ec2ecbaa475a576f847e788b4c06", "file": "fetched/ha-v1-adoption-wordpress.json" }, { "url": "https://cdn.httparchive.org/v1/adoption?technology=ALL&geo=ALL&rank=ALL", "retrieved_at": "2026-10-24T01:35:58Z", "status": 200, "sha256": "2241b8e38794dec31edd727783abb65edcc456335d2d09f505d5bd63a013f74d", "file": "fetched/ha-v1-adoption-all.json" }, { "url": "https://www.shodan.io/search/facet?query=%22X-Powered-By%3A+PHP%22&facet=http.component", "retrieved_at": "2026-10-24T01:36:09Z", "status": 403, "sha256": "351d0688da1ad42070c9c930c580f20a21293bfaf1af9d7e647c1c5adb4bb5ac", "file": "fetched/shodan-facet-php.html", "note": "Cloudflare 'Just a moment... Enable JavaScript and cookies' challenge" }, { "url": "https://www.shodan.io/search?query=%22X-Powered-By%3A+PHP%22", "retrieved_at": "2026-10-24T01:36:09Z", "status": 403, "sha256": "f45ed4d0c0399feaee43fd0ebf6987da42f90060f0de0016b90dd05bdca05be8", "file": "fetched/shodan-count-php.html", "note": "Cloudflare 'Just a moment... Enable JavaScript and cookies' challenge" }, { "url": "https://search.censys.io/search?resource=hosts&q=services.software.product%3A%22PHP%22", "retrieved_at": "2026-10-24T01:36:10Z", "status": 403, "sha256": "5fb366d90b0ff91939e0bfa6f7b5c773665d597cf67271195d9e20f8cddf3e94", "file": "fetched/censys-search-php.html", "note": "Cloudflare 'Just a moment... Enable JavaScript and cookies' challenge" }, { "url": "https://www.netcraft.com/blog/", "retrieved_at": "2026-10-24T01:36:10Z", "status": 200, "sha256": "0c8f0d78eca54643df3ea0bdf841a3b825e1c56ac4b4c1ba4d32650efca4eeb0", "file": "fetched/netcraft-survey.html" }, { "url": "https://almanac.httparchive.org/en/2024/cms", "retrieved_at": "2026-10-24T01:36:11Z", "status": 200, "sha256": "b40c25d876bca91978f2aed2254d63a4851549a708863acb58e1b320412d6186", "file": "fetched/webalmanac-2024-cms.html" }, { "url": "https://almanac.httparchive.org/en/2025/cms", "retrieved_at": "2026-10-24T01:36:11Z", "status": 200, "sha256": "180e877aeccff347f42eab6926f5ca4192d99e01349b98be47ee3ec7f6d32ea6", "file": "fetched/webalmanac-2025-cms.html" }, { "url": "https://survey.stackoverflow.co/2026/technology", "retrieved_at": "2026-10-24T01:36:27Z", "status": 200, "sha256": "918e5dfab40b12805d3e84ee1db8d9041a94735eb2b068ae233b5c2158b20c6b", "file": "fetched/so-survey-2026-tech.html" }, { "url": "https://survey.stackoverflow.co/2025/technology", "retrieved_at": "2026-10-24T01:36:27Z", "status": 200, "sha256": "721a084a2139830bbdef949add7415104d59d85fb021e01c52b5ce63155dd577", "file": "fetched/so-survey-2025-tech.html" }, { "url": "https://www.tiobe.com/tiobe-index/", "retrieved_at": "2026-10-24T01:36:28Z", "status": 200, "sha256": "d55f43879550643acd749189a556da86d445ec70873d6c1a64ca8b68578d98c5", "file": "fetched/tiobe-index.html" }, { "url": "https://www.jetbrains.com/lp/devecosystem-2025/", "retrieved_at": "2026-10-24T01:36:29Z", "status": 200, "sha256": "c2e3e65f6a518ef835a0d254c119f02ff6754a9f253f6c1d0690a3b381c7f875", "file": "fetched/jetbrains-devecosystem-2025.html" }, { "url": "https://www.php.net/usage.php", "retrieved_at": "2026-10-24T01:36:30Z", "status": 404, "sha256": "cf09aae7f848064708cf5320637fb648e859fde1447c665535c1af22fca9034d", "file": "fetched/php-net-usage.html" }, { "url": "https://blog.jetbrains.com/phpstorm/2025/10/state-of-php-2025/", "retrieved_at": "2026-10-24T01:36:59Z", "status": 200, "sha256": "7720d77ce3d687615e70b606ad4b78a130b50f85968cb92f227c3cd99e6335dc", "file": "fetched/jetbrains-state-of-php-2025.html" }, { "url": "https://w3techs.com/technologies/breakdown/pl-php/ranking", "retrieved_at": "2026-10-24T01:37:59Z", "status": 200, "sha256": "c75051a6d55f368ceefca22ce84b6a81553fae04764bd46a45a8eb0008a89821", "file": "fetched/w3t-php-ranking.html" } ], "measures": [ { "id": "w3techs-php-share-known", "family": "websites", "measurer": "W3Techs (Q-Success)", "what": "share of websites whose server-side programming language W3Techs knows that use PHP", "value": 69.3, "unit": "%", "population": "all the websites whose server-side programming language we know (within W3Techs' relevant-web sample)", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-23", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/details/pl-php", "sha256": "f49b114f2c6055e2bb21b2009d25e781cf715553e782b83c0adbeec818780948", "retrieved_at": "2026-10-24T01:31:13Z", "file": "fetched/w3t-pl-php.html", "excerpt": "PHP is used by 69.3% of all the websites whose server-side programming language we know." }, "history": [ { "date": "2015-01-01", "value": 80.6 }, { "date": "2016-01-01", "value": 80.0 }, { "date": "2017-01-01", "value": 80.0 }, { "date": "2018-01-01", "value": 80.2 }, { "date": "2019-01-01", "value": 78.9 }, { "date": "2020-01-01", "value": 78.9 }, { "date": "2021-01-01", "value": 79.1 }, { "date": "2022-01-01", "value": 78.1 }, { "date": "2023-01-01", "value": 77.7 }, { "date": "2024-01-01", "value": 76.7 }, { "date": "2025-01-01", "value": 75.2 }, { "date": "2026-01-01", "value": 72.4 }, { "date": "2026-10-23", "value": 69.3 }, { "date": "2026-10-25", "value": 69.2 } ], "notes": "Denominator is sites with a KNOWN server-side language, not all websites. W3Techs' free pages do not publish what fraction of sites have a known language (no 'unknown/none' row for this category, unlike CMS). Multiple languages per site allowed. Same page dated 24 Oct 2026 on overview/programming_language/all.", "rechecks": [ { "retrieved_at": "2026-10-24T07:57Z", "value": 69.3, "sha256": "ca7ba9d1ce117cc1e4061e8509072182bda77ace4b7c40481d5de7ee4aa51c63", "run": "Run-4", "excerpt": "PHP is used by 69.3% of all the websites whose server-side programming language we know" }, { "retrieved_at": "2026-10-25T08:59Z", "value": 69.2, "sha256": "918957998f37697d1b1339a20f4b86ccb1ddb90744547325703ffaa2694eeb36", "run": "Run-6", "excerpt": "PHP is used by 69.2% of all the websites whose server-side programming language we know." }, { "retrieved_at": "2026-10-26T08:56Z", "value": 69.2, "sha256": "3fc3bc643bf82fd4cda77983dbc283735c98d6e05c46199fb722bb576435fea0", "run": "Run-8", "excerpt": "PHP is used by 69.2% of all the websites whose server-side programming language we know." } ] }, { "id": "w3techs-php-share-known-monthly", "family": "websites", "measurer": "W3Techs (Q-Success)", "what": "monthly trend of the same PHP share (known-language sites)", "value": 69.3, "unit": "%", "population": "all the websites whose server-side programming language we know", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-23", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/history_overview/programming_language", "sha256": "aea4e6acf2397713fa68eb3a51d8fa276aea9ae611541102b2740354fa835747", "retrieved_at": "2026-10-24T01:32:22Z", "file": "fetched/w3t-hist-pl-monthly.html", "excerpt": "This report shows the historical trends in the usage of the top server-side programming languages since October 2025." }, "history": [ { "date": "2025-10-01", "value": 73.4 }, { "date": "2025-11-01", "value": 73.1 }, { "date": "2025-12-01", "value": 72.9 }, { "date": "2026-01-01", "value": 72.4 }, { "date": "2026-02-01", "value": 72.2 }, { "date": "2026-03-01", "value": 72.0 }, { "date": "2026-04-01", "value": 71.7 }, { "date": "2026-05-01", "value": 71.4 }, { "date": "2026-06-01", "value": 71.1 }, { "date": "2026-07-01", "value": 70.8 }, { "date": "2026-08-01", "value": 70.6 }, { "date": "2026-09-01", "value": 70.2 }, { "date": "2026-10-01", "value": 69.8 }, { "date": "2026-10-23", "value": 69.3 } ], "notes": "Falls about 0.3 points a month: 73.4% on 1 Oct 2025 to 69.3% on 23 Oct 2026. JavaScript (server-side) rose from 5.0% to 8.2% over the same period." }, { "id": "w3techs-php-share-top-ranks", "family": "websites", "measurer": "W3Techs (Q-Success)", "what": "PHP share among known-language sites, by traffic rank band", "value": 64.4, "unit": "%", "population": "websites whose server-side programming language we know and that rank in the top 1,000,000 (CrUX plus customised Tranco ranking)", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-24", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/breakdown/pl-php/ranking", "sha256": "c75051a6d55f368ceefca22ce84b6a81553fae04764bd46a45a8eb0008a89821", "retrieved_at": "2026-10-24T01:37:59Z", "file": "fetched/w3t-php-ranking.html", "excerpt": "Overall 69.3% top 1,000,000 64.4% top 100,000 60.9% top 10,000 59.4% top 1,000 58.7%" }, "notes": "Value is top 1M; top 100k 60.9%, top 10k 59.4%, top 1k 58.7%. PHP share falls as traffic rises." }, { "id": "w3techs-wordpress-share-all", "family": "applications", "measurer": "W3Techs (Q-Success)", "what": "share of ALL websites (W3Techs sample) using WordPress (a PHP application)", "value": 39.6, "unit": "%", "population": "all websites in W3Techs' sample (CMS report includes a 'None' row)", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-24", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/details/cm-wordpress", "sha256": "c7c819ccd71cea94f7e02b6652664dcc2cb0b4411dedbb28fddc200d8fad24be", "retrieved_at": "2026-10-24T01:32:12Z", "file": "fetched/w3t-wordpress.html", "excerpt": "WordPress is used by 58.3% of all the websites whose content management system we know. This is 39.6% of all websites ." }, "history": [ { "date": "2015-01-01", "value": 23.3 }, { "date": "2016-01-01", "value": 25.6 }, { "date": "2017-01-01", "value": 27.3 }, { "date": "2018-01-01", "value": 29.2 }, { "date": "2019-01-01", "value": 32.7 }, { "date": "2020-01-01", "value": 35.4 }, { "date": "2021-01-01", "value": 39.5 }, { "date": "2022-01-01", "value": 43.2 }, { "date": "2023-01-01", "value": 43.1 }, { "date": "2024-01-01", "value": 43.1 }, { "date": "2025-01-01", "value": 43.6 }, { "date": "2026-01-01", "value": 43.0 }, { "date": "2026-10-24", "value": 39.6 } ], "notes": "Unlike the PHP language figure, this IS a share of all websites. Peaked at 43.6% on 1 Jan 2025 in the yearly trend; 'None' (no monitored CMS) rose from 28.6% (1 Jan 2026) to 32.1% (24 Oct 2026). WordPress alone implies PHP, so 39.6% of all sites is a floor-type figure for PHP on all sites in this sample." }, { "id": "w3techs-drupal-joomla-share-all", "family": "applications", "measurer": "W3Techs (Q-Success)", "what": "share of ALL websites using Joomla / Drupal (PHP CMSs)", "value": 1.1, "unit": "%", "population": "all websites in W3Techs' sample", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-24", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/overview/content_management", "sha256": "b363d4408a378f860c971a45a8e63de3b99dce715dbc3c533b997105582a7c72", "retrieved_at": "2026-10-24T01:31:26Z", "file": "fetched/w3t-cms-overview.html", "excerpt": "Joomla 1.1% 1.6% Tilda 0.8% 1.2% Webflow 0.8% 1.2% Duda 0.7% 1.1% Drupal 0.6% 0.9%" }, "history": [ { "date": "2015-01-01", "value": 3.3 }, { "date": "2016-01-01", "value": 3.3 }, { "date": "2017-01-01", "value": 3.4 }, { "date": "2018-01-01", "value": 3.2 }, { "date": "2019-01-01", "value": 3.0 }, { "date": "2020-01-01", "value": 2.6 }, { "date": "2021-01-01", "value": 2.2 }, { "date": "2022-01-01", "value": 1.7 }, { "date": "2023-01-01", "value": 1.8 }, { "date": "2024-01-01", "value": 1.7 }, { "date": "2025-01-01", "value": 1.6 }, { "date": "2026-01-01", "value": 1.3 }, { "date": "2026-10-24", "value": 1.1 } ], "notes": "Value and history are Joomla (share of all sites). Drupal 0.6% of all sites now; Drupal yearly history (all sites) from the same trend page: 2015 2.0%, 2016 2.1%, 2017 2.2%, 2018 2.3%, 2019 1.9%, 2020 1.7%, 2021 1.5%, 2022 1.3%, 2023 1.2%, 2024 1.1%, 2025 0.9%, 2026 0.8%, 2026-10-24 0.6%. Other PHP CMSs in the list: PrestaShop 0.5%, Bitrix 0.4%, TYPO3 0.3%, OpenCart 0.3%, MODx, phpBB, Moodle 0.1% each." }, { "id": "w3techs-php-v8-share", "family": "versions", "measurer": "W3Techs (Q-Success)", "what": "share of PHP websites on PHP major version 8", "value": 65.3, "unit": "%", "population": "all the websites who use PHP (and whose version W3Techs detects)", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-23", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/details/pl-php", "sha256": "f49b114f2c6055e2bb21b2009d25e781cf715553e782b83c0adbeec818780948", "retrieved_at": "2026-10-24T01:31:13Z", "file": "fetched/w3t-pl-php.html", "excerpt": "Version 8 is used by 65.3% of all the websites who use PHP. Version 8 65.3% Version 7 26.9% Version 5 7.7% Version 4 0.1%" }, "history": [ { "date": "2025-10-01", "value": 51.3 }, { "date": "2025-11-01", "value": 52.7 }, { "date": "2025-12-01", "value": 53.9 }, { "date": "2026-01-01", "value": 54.8 }, { "date": "2026-02-01", "value": 55.8 }, { "date": "2026-03-01", "value": 56.8 }, { "date": "2026-04-01", "value": 57.9 }, { "date": "2026-05-01", "value": 59.0 }, { "date": "2026-06-01", "value": 60.1 }, { "date": "2026-07-01", "value": 61.3 }, { "date": "2026-08-01", "value": 62.4 }, { "date": "2026-09-01", "value": 63.3 }, { "date": "2026-10-01", "value": 64.3 }, { "date": "2026-10-23", "value": 65.3 } ], "notes": "Expressed as share of known-language sites: v8 45.3%, v7 18.6%, v5 5.3%. Version is only known where sites expose it (e.g. X-Powered-By); W3Techs does not state the share of PHP sites with a known version." }, { "id": "w3techs-php-v7-share", "family": "versions", "measurer": "W3Techs (Q-Success)", "what": "share of PHP websites on PHP major version 7", "value": 26.9, "unit": "%", "population": "all the websites who use PHP", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-23", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/details/pl-php/7", "sha256": "95b2d636702df6d0f2bcdb710bf1c9d2d21514fcd361eb508198a989040026f8", "retrieved_at": "2026-10-24T01:32:43Z", "file": "fetched/w3t-php7.html", "excerpt": "Version 7.4 is used by 73.4% of all the websites who use PHP version 7." }, "history": [ { "date": "2025-10-01", "value": 38.7 }, { "date": "2025-11-01", "value": 37.6 }, { "date": "2025-12-01", "value": 36.6 }, { "date": "2026-01-01", "value": 35.7 }, { "date": "2026-02-01", "value": 34.9 }, { "date": "2026-03-01", "value": 34.2 }, { "date": "2026-04-01", "value": 33.2 }, { "date": "2026-05-01", "value": 32.3 }, { "date": "2026-06-01", "value": 31.4 }, { "date": "2026-07-01", "value": 30.4 }, { "date": "2026-08-01", "value": 29.5 }, { "date": "2026-09-01", "value": 28.7 }, { "date": "2026-10-01", "value": 27.8 }, { "date": "2026-10-23", "value": 26.9 } ], "notes": "Within v7: 7.4 73.4%, 7.3 10.5%, 7.2 8.4%, 7.0 4.0%, 7.1 3.7%. The excerpt is the 7.x subversion split; the 26.9% top-line is in the w3techs-php-v8-share excerpt. All v7 is end-of-life." }, { "id": "w3techs-php-v5-share", "family": "versions", "measurer": "W3Techs (Q-Success)", "what": "share of PHP websites on PHP major version 5", "value": 7.7, "unit": "%", "population": "all the websites who use PHP", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-23", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/details/pl-php/5", "sha256": "a2cd9ba5f26b6db66123c87c686d1c962bbce6359e542a12cf580eb7d7df8608", "retrieved_at": "2026-10-24T01:32:43Z", "file": "fetched/w3t-php5.html", "excerpt": "PHP version 5 is used by 5.3% of all the websites whose server-side programming language we know." }, "history": [ { "date": "2025-10-01", "value": 9.9 }, { "date": "2025-11-01", "value": 9.7 }, { "date": "2025-12-01", "value": 9.5 }, { "date": "2026-01-01", "value": 9.3 }, { "date": "2026-02-01", "value": 9.2 }, { "date": "2026-03-01", "value": 9.0 }, { "date": "2026-04-01", "value": 8.8 }, { "date": "2026-05-01", "value": 8.6 }, { "date": "2026-06-01", "value": 8.4 }, { "date": "2026-07-01", "value": 8.2 }, { "date": "2026-08-01", "value": 8.0 }, { "date": "2026-09-01", "value": 7.9 }, { "date": "2026-10-01", "value": 7.8 }, { "date": "2026-10-23", "value": 7.7 } ], "notes": "7.7% of PHP sites = 5.3% of known-language sites. Within v5: 5.6 54.9%, 5.3 15.4%, 5.4 14.7%." }, { "id": "w3techs-php8-subversions", "family": "versions", "measurer": "W3Techs (Q-Success)", "what": "split of PHP 8 sites by minor version (8.0/8.1 are end-of-life)", "value": 20.9, "unit": "%", "population": "all the websites who use PHP version 8", "method": "Crawl approx. monthly per site, several thousand indicators (HTML, headers, cookies, URL structure, DNS); dependencies inferred, e.g. WordPress implies PHP; reports updated daily", "as_of": "2026-10-23", "source": { "kind": "fetch", "url": "https://w3techs.com/technologies/details/pl-php/8", "sha256": "2e4782e518ceee75a0bd8c1412e3235a8819198718dd29e033adcbd574f6970f", "retrieved_at": "2026-10-24T01:31:54Z", "file": "fetched/w3t-php8.html", "excerpt": "Version 8.3 34.9% Version 8.2 27.6% Version 8.1 15.1% Version 8.4 12.1% Version 8.0 5.8% Version 8.5 4.5%" }, "notes": "value = 8.0 + 8.1 = 20.9% of PHP-8 sites (our sum). Derived: supported 8.2-8.5 = 79.1% of v8 = about 51.7% of PHP sites; so roughly 48% of version-detected PHP sites are on EoL branches (our arithmetic, not W3Techs')." }, { "id": "builtwith-php-live-sites", "family": "websites", "measurer": "BuiltWith", "what": "count of live websites BuiltWith detects using PHP", "value": 23961854, "unit": "count", "population": "BuiltWith's index of websites ('live websites'); also 80,459,242 that used PHP historically", "method": "BuiltWith technology lookup crawl (not described on this page)", "as_of": "2026-08-22", "source": { "kind": "fetch", "url": "https://trends.builtwith.com/framework/PHP", "sha256": "467433b45a8db4bed3e1fa4fa3df0e8f41f916263eb4b13e47df0f1ba047823a", "retrieved_at": "2026-10-24T01:31:28Z", "file": "fetched/builtwith-php.html", "excerpt": "We know of 23,961,854 live websites using PHP and an additional 80,459,242 sites that used PHP historically" }, "history": [ { "date": "2011-01-01", "value": 182686 }, { "date": "2012-01-28", "value": 854549 }, { "date": "2013-02-16", "value": 1433825 }, { "date": "2014-01-04", "value": 7880041 }, { "date": "2015-01-31", "value": 12829875 }, { "date": "2016-02-27", "value": 16328894 }, { "date": "2017-01-14", "value": 19613872 }, { "date": "2018-02-03", "value": 25294349 }, { "date": "2019-03-02", "value": 26997836 }, { "date": "2020-01-18", "value": 28815778 }, { "date": "2021-02-13", "value": 23240309 }, { "date": "2022-01-01", "value": 20035156 }, { "date": "2023-01-28", "value": 25581016 }, { "date": "2024-02-17", "value": 25256294 }, { "date": "2025-01-11", "value": 21759778 }, { "date": "2026-01-31", "value": 20346162 }, { "date": "2026-08-22", "value": 23961854 } ], "notes": "Absolute count, no denominator given on the page. History is BuiltWith's own chart series 'Entire Internet' (first point per year plus latest, 2026-08-22). Series peak 30,546,471 on 2020-10-03 (top 1m peak 547,327 same date); last chart point dated 2026-08-22. Bytes were gzip; excerpt from decoded copy." }, { "id": "builtwith-php-top1m", "family": "websites", "measurer": "BuiltWith", "what": "count of top-1-million sites (BuiltWith traffic ranking) using PHP", "value": 196288, "unit": "count", "population": "BuiltWith's top 1m sites", "method": "BuiltWith technology lookup crawl", "as_of": "2026-08-22", "source": { "kind": "fetch", "url": "https://trends.builtwith.com/framework/PHP", "sha256": "467433b45a8db4bed3e1fa4fa3df0e8f41f916263eb4b13e47df0f1ba047823a", "retrieved_at": "2026-10-24T01:31:28Z", "file": "fetched/builtwith-php.html", "excerpt": "Traffic Top 1m 196,288 Top 100k 13,440 Top 10k 1,362 Top 1000 134" }, "history": [ { "date": "2011-01-01", "value": 32559 }, { "date": "2012-01-28", "value": 110824 }, { "date": "2013-02-16", "value": 149870 }, { "date": "2014-01-04", "value": 240479 }, { "date": "2015-01-31", "value": 309372 }, { "date": "2016-02-27", "value": 359698 }, { "date": "2017-01-14", "value": 400767 }, { "date": "2018-02-03", "value": 451815 }, { "date": "2019-03-02", "value": 482574 }, { "date": "2020-01-18", "value": 502255 }, { "date": "2021-02-13", "value": 496189 }, { "date": "2022-01-01", "value": 323048 }, { "date": "2023-01-28", "value": 326422 }, { "date": "2024-02-17", "value": 302666 }, { "date": "2025-01-11", "value": 274233 }, { "date": "2026-01-31", "value": 193965 }, { "date": "2026-08-22", "value": 196288 } ], "notes": "About 19.6% of the top 1M, 13.4% of the top 100k, 13.6% of top 10k, 13.4% of top 1k (our division by the band size). Far below W3Techs' known-language shares: BuiltWith requires a positive PHP signal, W3Techs divides by known-language sites only." }, { "id": "wappalyzer-php-sites", "family": "websites", "measurer": "Wappalyzer", "what": "count of websites Wappalyzer tracks using PHP", "value": 22700000, "unit": "count", "population": "websites in Wappalyzer's dataset", "method": "Wappalyzer fingerprint detection (not described on this page)", "as_of": "2026-10-24 (retrieved; page gives no date)", "source": { "kind": "fetch", "url": "https://www.wappalyzer.com/technologies/programming-languages/php/", "sha256": "c96eba601b04e734a48c9c0bf72f0f2067b124fccbd28d31f5f98242d912924d", "retrieved_at": "2026-10-24T01:31:28Z", "file": "fetched/wappalyzer-php.html", "excerpt": "Wappalyzer tracks about 22,700,000 websites using PHP." }, "notes": "Rounded count, no denominator published on the page." }, { "id": "httparchive-php-origins-mobile", "family": "websites", "measurer": "HTTP Archive (Tech Report API, Wappalyzer detection)", "what": "count of origins in the HTTP Archive mobile crawl where PHP is detected", "value": 4221648, "unit": "count", "population": "origins in the HTTP Archive crawl (CrUX-derived list), mobile client; ALL ranks, ALL geos", "method": "Monthly crawl of CrUX origins with WebPageTest/Chrome; technologies by Wappalyzer rules", "as_of": "2026-09-01", "source": { "kind": "fetch", "url": "https://cdn.httparchive.org/v1/adoption?technology=PHP&geo=ALL&rank=ALL", "sha256": "2013e7d1b47ecbd266cf27c364381c52d4eea5199fea2f1f740c81d066f90173", "retrieved_at": "2026-10-24T01:35:57Z", "file": "fetched/ha-v1-adoption-php.json", "excerpt": "{\"date\":\"2026-09-01\",\"adoption\":{\"desktop\":2606557,\"mobile\":4221648},\"technology\":\"PHP\"}" }, "history": [ { "date": "2020-01-01", "value": 1735024 }, { "date": "2021-01-01", "value": 2864275 }, { "date": "2022-01-01", "value": 3617213 }, { "date": "2023-01-01", "value": 5618398 }, { "date": "2024-01-01", "value": 5376001 }, { "date": "2025-01-01", "value": 5007478 }, { "date": "2026-01-01", "value": 4634946 }, { "date": "2026-09-01", "value": 4221648 } ], "notes": "Desktop 2,606,557. bq/BigQuery not usable (no credentials) so the published Tech Report API at cdn.httparchive.org/v1 (the endpoint httparchive.org's own techreport page calls) was used." }, { "id": "httparchive-php-share-mobile", "family": "websites", "measurer": "HTTP Archive (Tech Report API, Wappalyzer detection)", "what": "share of all crawled origins where PHP is detected (mobile), computed from two published counts", "value": 48.3, "unit": "%", "population": "all origins in the HTTP Archive mobile crawl (8,739,300 in Sept 2026)", "method": "our ratio: PHP origins / ALL origins from the same API, same date", "as_of": "2026-09-01", "source": { "kind": "fetch", "url": "https://cdn.httparchive.org/v1/adoption?technology=ALL&geo=ALL&rank=ALL", "sha256": "2241b8e38794dec31edd727783abb65edcc456335d2d09f505d5bd63a013f74d", "retrieved_at": "2026-10-24T01:35:58Z", "file": "fetched/ha-v1-adoption-all.json", "excerpt": "{\"date\":\"2026-09-01\",\"adoption\":{\"desktop\":5515143,\"mobile\":8739300},\"technology\":\"ALL\"}" }, "history": [ { "date": "2020-01-01", "value": 51.0 }, { "date": "2021-01-01", "value": 50.2 }, { "date": "2022-01-01", "value": 56.9 }, { "date": "2023-01-01", "value": 58.0 }, { "date": "2024-01-01", "value": 56.4 }, { "date": "2025-01-01", "value": 54.6 }, { "date": "2026-01-01", "value": 52.3 }, { "date": "2026-09-01", "value": 48.3 } ], "notes": "Denominator is ALL origins, including those where no language is detectable, which is why it is lower than W3Techs. Desktop share history: 2020-01-01 50.9, 2021-01-01 50.7, 2022-01-01 56.3, 2023-01-01 55.9, 2024-01-01 54.9, 2025-01-01 53.3, 2026-01-01 50.5, 2026-09-01 47.3. Numerator excerpt is in httparchive-php-origins-mobile." }, { "id": "httparchive-wordpress-share-mobile", "family": "applications", "measurer": "HTTP Archive (Tech Report API, Wappalyzer detection)", "what": "share of all crawled mobile origins running WordPress, computed from published counts", "value": 31.1, "unit": "%", "population": "all origins in the HTTP Archive mobile crawl", "method": "our ratio of two published counts", "as_of": "2026-09-01", "source": { "kind": "fetch", "url": "https://cdn.httparchive.org/v1/adoption?technology=WordPress&geo=ALL&rank=ALL", "sha256": "7964a028052a05716ff8df036542f7afa086ec2ecbaa475a576f847e788b4c06", "retrieved_at": "2026-10-24T01:35:58Z", "file": "fetched/ha-v1-adoption-wordpress.json", "excerpt": "{\"date\":\"2026-09-01\",\"adoption\":{\"desktop\":1626771,\"mobile\":2714694},\"technology\":\"WordPress\"}" }, "history": [ { "date": "2020-01-01", "value": 30.5 }, { "date": "2021-01-01", "value": 32.2 }, { "date": "2022-01-01", "value": 33.6 }, { "date": "2023-01-01", "value": 35.1 }, { "date": "2024-01-01", "value": 34.9 }, { "date": "2025-01-01", "value": 34.4 }, { "date": "2026-01-01", "value": 33.6 }, { "date": "2026-09-01", "value": 31.1 } ], "notes": "Comparable with W3Techs' 39.6%-of-all-sites WordPress figure." }, { "id": "webalmanac-2025-wordpress", "family": "applications", "measurer": "HTTP Archive Web Almanac 2025 (CMS chapter)", "what": "WordPress share of all websites (mobile) in the 2025 Almanac crawl", "value": 35.0, "unit": "%", "population": "all websites in the HTTP Archive 2025 crawl, mobile", "method": "Wappalyzer detection on the HTTP Archive crawl", "as_of": "2025 (Almanac edition)", "source": { "kind": "fetch", "url": "https://almanac.httparchive.org/en/2025/cms", "sha256": "180e877aeccff347f42eab6926f5ca4192d99e01349b98be47ee3ec7f6d32ea6", "retrieved_at": "2026-10-24T01:36:11Z", "file": "fetched/webalmanac-2025-cms.html", "excerpt": "peaking at 35.0% for all websites." }, "history": [ { "date": "2022", "value": 35.1 }, { "date": "2023", "value": 34.9 }, { "date": "2024", "value": 35.6 }, { "date": "2025", "value": 35.0 } ], "notes": "2022-2024 points are from the 2024 chapter (webalmanac-2024-cms.html): 'WordPress was used on 35.1% in 2022, 34.9% in 2023, and 35.6% in 2024'. The Almanac chapters do not give a PHP-language share." }, { "id": "packagist-packages", "family": "packages", "measurer": "Packagist.org", "what": "packages registered on Packagist (the Composer PHP package repository)", "value": 475515, "unit": "count", "population": "Packagist.org registry", "method": "registry totals", "as_of": "2026-10-24", "source": { "kind": "fetch", "url": "https://packagist.org/statistics", "sha256": "c81dcafd59845c51602e13361c182dc308e95fda5e6c71b68ce62f1f4faaec24", "retrieved_at": "2026-10-24T01:31:28Z", "file": "fetched/packagist-stats.html", "excerpt": "Packages registered 475 515 Versions available 5 972 250 Packages installed (since 2012-04-13) 207 858 803 613" }, "notes": "statistics.json fetched seconds later gave packages 475503, versions 5967561, downloads 207859011119 (live counters)." }, { "id": "packagist-installs", "family": "packages", "measurer": "Packagist.org", "what": "cumulative package installs via Composer since 2012-04-13", "value": 207858803613, "unit": "count", "population": "Composer installs served by Packagist.org", "method": "install counter", "as_of": "2026-10-24", "source": { "kind": "fetch", "url": "https://packagist.org/statistics", "sha256": "c81dcafd59845c51602e13361c182dc308e95fda5e6c71b68ce62f1f4faaec24", "retrieved_at": "2026-10-24T01:31:28Z", "file": "fetched/packagist-stats.html", "excerpt": "Packages installed (since 2012-04-13) 207 858 803 613" }, "notes": "Installs, not users or sites. Packagist php-statistics page (installs by PHP minor version) is chart-only; numbers not in the static bytes." }, { "id": "stackoverflow-2025-php", "family": "developers", "measurer": "Stack Overflow Developer Survey 2025", "what": "share of all respondents who worked with PHP in the past year", "value": 18.9, "unit": "%", "population": "2025 survey respondents answering the language question (All Respondents)", "method": "self-selected online survey", "as_of": "2025", "source": { "kind": "fetch", "url": "https://survey.stackoverflow.co/2025/technology", "sha256": "721a084a2139830bbdef949add7415104d59d85fb021e01c52b5ce63155dd577", "retrieved_at": "2026-10-24T01:36:27Z", "file": "fetched/so-survey-2025-tech.html", "excerpt": "All Respondents JavaScript 66% HTML/CSS 61.9% SQL 58.6% Python 57.9%" }, "notes": "Excerpt anchors the 'All Respondents' list; the same list continues 'C++ 23.5% PowerShell 23.2% C 22% PHP 18.9% Go 16.4%'.Professional developers 19.1%. 12th language. The 2026 survey page lists only the top 10 languages (PHP not among them); PHP figure for 2026 not in the fetched bytes." }, { "id": "tiobe-2026-10-php", "family": "developers", "measurer": "TIOBE Index", "what": "PHP rating in the TIOBE index (search-engine popularity)", "value": 1.26, "unit": "%", "population": "TIOBE search-engine hit model", "method": "TIOBE rating", "as_of": "2026-10", "source": { "kind": "fetch", "url": "https://www.tiobe.com/tiobe-index/", "sha256": "d55f43879550643acd749189a556da86d445ec70873d6c1a64ca8b68578d98c5", "retrieved_at": "2026-10-24T01:36:28Z", "file": "fetched/tiobe-index.html", "excerpt": "12 14 PHP 1.26% -0.12%" }, "notes": "Rank 12 in October 2026, 14 a year earlier. Not a usage measure. Page heading 'TIOBE Index for October 2026'." }, { "id": "jetbrains-2025-php-versions", "family": "versions", "measurer": "JetBrains State of PHP 2025", "what": "share of surveyed PHP developers using PHP 8.x", "value": 89, "unit": "%", "population": "PHP developers in the JetBrains Developer Ecosystem survey 2025", "method": "survey; multiple versions per respondent", "as_of": "2025", "source": { "kind": "fetch", "url": "https://blog.jetbrains.com/phpstorm/2025/10/state-of-php-2025/", "sha256": "7720d77ce3d687615e70b606ad4b78a130b50f85968cb92f227c3cd99e6335dc", "retrieved_at": "2026-10-24T01:36:59Z", "file": "fetched/jetbrains-state-of-php-2025.html", "excerpt": "PHP 8.x dominates with 89% usage, while PHP 7.x has dropped to 33%. Legacy versions (5.6 and earlier) are now down to 8%" }, "notes": "Developer self-report, skewed to JetBrains users per its own disclaimer; not site counts." }, { "id": "censys-php-hosts-gist", "family": "hosts", "measurer": "Censys (query by Silas Cutler)", "what": "internet hosts whose service software product is PHP", "value": 2574043, "unit": "count", "population": "hosts in Censys platform index", "method": "Censys query host.services.software.product: \"PHP\"", "as_of": "2026-10-22 (capture date; query date not stated)", "source": { "kind": "vault", "url": "https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9", "sha256": "5cea858eacc35a20d7943cf8334baad5fa8b37ed7f19ecbf3416f489935edd49", "retrieved_at": "2026-10-22T11:28:41.000Z", "vault_slug": "gist-silascutler-censys-query", "vault_file": "sources/gist-silascutler-censys-query/captures/20261022T112841Z/text.txt", "excerpt": "For all PHP: host.services.software.product: \"PHP\" ( 2,574,043 results)" }, "notes": "Primary: the researcher's own published query result. Hosts (IPs), not websites." }, { "id": "censys-php-hosts-securityweek", "family": "hosts", "measurer": "Censys (via SecurityWeek)", "what": "internet-facing hosts running PHP; with identifiable version; unpatched", "value": 2580000, "unit": "count", "population": "internet-facing hosts seen by Censys on 2026-10-21", "method": "Censys scan, reported by SecurityWeek", "as_of": "2026-10-21", "source": { "kind": "vault", "url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "sha256": "b922b47f8fab0fa86af000c740795a67ad78d0d4cdc6a57a316408988acb5835", "retrieved_at": "2026-10-23T01:38:36.326Z", "vault_slug": "securityweek-exploitation-days-before", "vault_file": "sources/securityweek-exploitation-days-before/captures/20261023T012042Z/text.txt", "excerpt": "Out of 2.58 million internet-facing hosts seen on October 21, roughly 1.58 million were reporting identifiable PHP versions" }, "notes": "Same article: approx. 1.57 million not patched; 'nearly 3 million' hosts as of 22 Oct. Second-hand (news)." }, { "id": "censys-php-web-properties", "family": "hosts", "measurer": "Censys (via KrebsOnSecurity, via bitpage.de)", "what": "web properties serving PHP", "value": 54900000, "unit": "count", "population": "Censys web-property index", "method": "Censys; reported third-hand", "as_of": "2026-10 (not stated)", "source": { "kind": "vault", "url": "https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/", "sha256": "50d84bde38c55c1772d88500502e6aa7a1e20d4691519ca18654499441ad8786", "retrieved_at": "2026-10-23T16:12:58.182Z", "vault_slug": "bitpage-php2shell-php-sicherheitsluecke-webseite", "vault_file": "sources/bitpage-php2shell-php-sicherheitsluecke-webseite/captures/20261023T160435Z/text.txt", "excerpt": "Censys zählt laut KrebsOnSecurity 2,58 Millionen direkt aus dem Internet erreichbare Hosts mit PHP und 54,9 Millionen Web-Properties, die PHP ausliefern." }, "notes": "Third-hand; Krebs article not in the vault. Web properties (names) not hosts. Same German page later cites Censys '34,4 Millionen verwundbare PHP-Dienste'. Born (borncity) reports an unquoted Censys 'php' search giving 7 million hosts and 59 million software products." }, { "id": "vulncheck-php-hosts", "family": "hosts", "measurer": "VulnCheck (via The Hacker News)", "what": "internet-facing hosts with PHP identified", "value": 2608039, "unit": "count", "population": "internet-facing hosts in VulnCheck's scan data", "method": "VulnCheck analysis, reported by The Hacker News", "as_of": "2026-10-21/22", "source": { "kind": "vault", "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "retrieved_at": "2026-10-22T08:13:20.228Z", "vault_slug": "thehackernews-php2shell-4days", "vault_file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "excerpt": "VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3." }, "notes": "Same text: about 400,000 on 7.4/8.0/8.1 and 403,000 on supported 8.2-8.5. Second-hand." }, { "id": "virustotal-php-ips", "family": "hosts", "measurer": "VirusTotal (via SecurityWeek)", "what": "IP addresses running PHP; with version announced", "value": 5100000, "unit": "count", "population": "IP addresses seen by VirusTotal", "method": "VirusTotal estimate, reported by SecurityWeek", "as_of": "2026-10-21", "source": { "kind": "vault", "url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "sha256": "b922b47f8fab0fa86af000c740795a67ad78d0d4cdc6a57a316408988acb5835", "retrieved_at": "2026-10-23T01:38:36.326Z", "vault_slug": "securityweek-exploitation-days-before", "vault_file": "sources/securityweek-exploitation-days-before/captures/20261023T012042Z/text.txt", "excerpt": "VirusTotal says it sees roughly 5.1 million IP addresses running PHP, but only 1.1 million of them announce a version" }, "notes": "Of 1.1M with a version: approx. 272,000 supported, approx. 758,000 EoL (5.4-8.1). About four in five hide the version. Also in recordedfuture-php2shell and bleepingcomputer-php2shell captures. Second-hand." }, { "id": "mallory-shodan-php-versions", "family": "hosts", "measurer": "Mallory (Shodan banner counts, via The Hacker News)", "what": "hosts whose HTTP banner reports PHP 8.1 or older", "value": 884000, "unit": "count", "population": "internet-facing hosts in Shodan reporting any PHP version (approx. 1.5 million)", "method": "Shodan banner counts published by Mallory 2026-10-20", "as_of": "2026-10-20", "source": { "kind": "vault", "url": "https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html", "sha256": "33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b", "retrieved_at": "2026-10-22T11:31:44.588Z", "vault_slug": "thehackernews-php2shell-unpatched-alert", "vault_file": "sources/thehackernews-php2shell-unpatched-alert/captures/20261022T113144Z/text.txt", "excerpt": "Security company Mallory counted about 884,000 internet-facing hosts whose HTTP banner reported a PHP version of 8.1 or older" }, "notes": "59% of the roughly 1.5 million version-reporting hosts. cybelangel capture gives exact 883,717." }, { "id": "shodan-php-hosts-poley", "family": "hosts", "measurer": "Shodan (search by Henk Poley, via Tenable)", "what": "internet-exposed hosts running PHP (Shodan search)", "value": 1900000, "unit": "count", "population": "Shodan index", "method": "Shodan search, reported by Tenable FAQ", "as_of": "2026-10-21/22", "source": { "kind": "vault", "url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "retrieved_at": "2026-10-22T11:23:31.380Z", "vault_slug": "tenable-php2shell-faq", "vault_file": "sources/tenable-php2shell-faq/captures/20261022T112331Z/text.txt", "excerpt": "A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP." }, "notes": "Direct Shodan fetch was blocked (Cloudflare challenge). Same capture: Silas Cutler's rough estimate of over 1.3 million potentially vulnerable hosts." }, { "id": "unit42-22.6m-instances", "family": "hosts", "measurer": "Palo Alto Networks (as reported by Fortune and others)", "what": "'potentially vulnerable instances' / 'internet-exposed servers' (definition unclear)", "value": 22600000, "unit": "count", "population": "not stated", "method": "not stated ('initial analysis', 'Cortex Xpanse telemetry sweep' per Clarin)", "as_of": "2026-10-22/23", "source": { "kind": "vault", "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808", "retrieved_at": "2026-10-23T01:37:11.005Z", "vault_slug": "fortune-ai-tools-php-vulnerability", "vault_file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/text.txt", "excerpt": "An initial analysis by cybersecurity firm Palo Alto Networks identified 22.6 million potentially vulnerable instances." }, "notes": "UNVERIFIED and an outlier: about 10x every host count above. Vault curator marks claim scale-22m-paloalto 'unverified': Palo Alto's own advisory (paloalto-psirt-cve-2026-109618) gives no such figure. Claim cur3-22m-servers (TechTarget Japan) 'basis not stated'. Likely counts instances/sites, not hosts. Do not use as a host count without the primary." } ], "injection_seen": [ { "where": "all fetched pages and vault captures grepped for 'ignore (all|previous)', 'as an AI', 'language model', 'assistant'", "found": "none addressed to an AI. Matches were survey content (JetBrains/Stack Overflow questions about AI assistants) and a Stack Overflow 'Open Claude / Open ChatGPT' share button, neither an instruction." } ], "blocked": [ { "what": "HTTP Archive BigQuery (bq ls httparchive:)", "result": "BigQuery error in ls operation: Invalid Credentials; gcloud: No credentialed accounts", "status": "blocked", "workaround": "used published Tech Report API (cdn.httparchive.org/v1)" }, { "what": "Shodan search/facet pages", "url": "https://www.shodan.io/search?query=%22X-Powered-By%3A+PHP%22", "status": "blocked", "http": 403, "result": "Cloudflare challenge 'Just a moment...'" }, { "what": "Censys search", "url": "https://search.censys.io/search?resource=hosts&q=services.software.product%3A%22PHP%22", "status": "blocked", "http": 403, "result": "Cloudflare challenge 'Just a moment...'" }, { "what": "W3Techs yearly 'all' history for programming languages", "url": "https://w3techs.com/technologies/history_overview/programming_language/all/y", "status": "not-available", "http": 404, "result": "no 'share of all sites' history published for languages; first attempt connection reset" }, { "what": "php.net usage page", "url": "https://www.php.net/usage.php", "status": "not-available", "http": 404, "result": "php.net no longer publishes usage stats at this URL; no php.net/PHP Foundation usage number found" }, { "what": "Netcraft", "status": "not-a-measure", "result": "Netcraft surveys web servers, not server-side languages; fetched blog has no PHP usage figure" }, { "what": "Packagist installs by PHP version", "url": "https://packagist.org/php-statistics", "status": "not-extracted", "result": "chart rendered client-side; no figures in static bytes" } ] }, "lineage": { "generated": "2026-10-24", "method": "Every text.txt (all stamps), raw/*.html|md|txt, page/rendered and meta descriptions, and source.json titles scanned for 50-99 percent figures and their translations, fractions (three quarters, two thirds, 7割) and qualitative phrases (most/majority/large share and their translations), then read in context. Times come from page metadata (article:published_time/datePublished), the manifest, or X post IDs ((id>>22)+1288834974657 ms). Where a page was modified after publication, the captured wording may be from the later version; time_basis says so.", "statements": [ { "id": "S-001", "slug": "phparch-php-security-2025-audit", "publisher": "php[architect]", "url": "https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/", "title": "PHP Security in 2025: Lessons from the Core Security Audit | PHP Architect", "published": "2025-09", "time_utc": "2025-09-03T00:40:32Z", "time_basis": "page metadata article:published_time", "captures": [ "20261022T112947Z" ], "excerpt_found_in": [ "20261022T112947Z" ], "file": "sources/phparch-php-security-2025-audit/captures/20261022T112947Z/text.txt", "sha256": "95189f8e2e198e19e39271f1750db73ca525f593abbe9ec363969f3eae4499ec", "sha256_from": "provenance.json", "excerpt": "powers nearly three-quarters of all websites on the internet", "location": "lede", "value": 75, "denominator_text": "all websites on the internet", "denominator_class": "websites-all", "qualifier": "nearly", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "en", "translation": null, "notes": "Pre-event baseline (September 2025): the 'three quarters' framing predates php2shell by 13 months. No source given. Kept to show the share was already a stock phrase. (No earlier statement in the vault with this exact wording.)", "family": "F-8" }, { "id": "S-002", "slug": "rte-reuters-websites-go-dark", "publisher": "rte.ie", "url": "https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/", "title": "Websites go dark as AI exposes critical security flaws", "published": null, "time_utc": "2026-10-21T07:46:45Z", "time_basis": "page metadata published; modified 2026-10-22T06:53:42Z, so the captured wording is from the later update", "captures": [ "20261022T081010Z" ], "excerpt_found_in": [ "20261022T081010Z" ], "file": "sources/rte-reuters-websites-go-dark/captures/20261022T081010Z/text.txt", "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "sha256_from": "provenance.json", "excerpt": "PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs", "location": "body", "value": 75, "denominator_text": "websites whose programming language can be identified", "denominator_class": "websites-known-language", "qualifier": "roughly", "attribution": "W3Techs", "links_to_measurement": null, "role": "origin", "restates": null, "language": "en", "translation": null, "notes": "Reuters wording (RTE runs Reuters copy). Origin of the '75% ... W3Techs' family; the figure is higher than W3Techs' 69.3% that others quote for the same day. No link.", "family": "F-6" }, { "id": "S-003", "slug": "rte-reuters-websites-go-dark", "publisher": "rte.ie", "url": "https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/", "title": "Websites go dark as AI exposes critical security flaws", "published": null, "time_utc": "2026-10-21T07:46:45Z", "time_basis": "page metadata; modified 2026-10-22T06:53Z", "captures": [ "20261022T081010Z" ], "excerpt_found_in": [ "20261022T081010Z" ], "file": "sources/rte-reuters-websites-go-dark/captures/20261022T081010Z/text.txt", "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "sha256_from": "provenance.json", "excerpt": "He said the popular programme is used by 70% of websites worldwide.", "location": "quote of someone", "value": 70, "denominator_text": "websites worldwide", "denominator_class": "websites-all", "qualifier": "none", "attribution": "Brian Honan (cybersecurity expert, RTE interview)", "links_to_measurement": null, "role": "restates", "restates": null, "language": "en", "translation": null, "notes": "Reported speech of Brian Honan on RTE's Six One. Same page carries Reuters' 75%. (No earlier statement in the vault with this exact wording.)", "family": "F-2" }, { "id": "S-004", "slug": "tenable-php2shell-faq", "publisher": "Tenable", "url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "title": "php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®", "published": "2026-10-21", "time_utc": "2026-10-21T09:01:24Z", "time_basis": "page metadata published 05:01-04:00; modified 2026-10-22T04:05Z, so the captured wording may be later", "captures": [ "20261022T112331Z" ], "excerpt_found_in": [ "20261022T112331Z" ], "file": "sources/tenable-php2shell-faq/captures/20261022T112331Z/text.txt", "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "sha256_from": "provenance.json", "excerpt": "According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known.", "location": "body", "value": 69.3, "denominator_text": "websites whose server-side language is known", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "The measurement wording with W3Techs' exact figure and denominator. Links W3Techs.", "family": "F-5" }, { "id": "S-005", "slug": "socradar-blog-php2shell", "publisher": "SOCRadar", "url": "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "title": "PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix", "published": "2026-10-21T13:38:58+03:00", "time_utc": "2026-10-21T10:38:58Z", "time_basis": "page metadata published; modified 2026-10-23T12:14:31Z, so the captured wording may be later", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/socradar-blog-php2shell/captures/20261023T160435Z/text.txt", "sha256": "88edcdf127e01f96370214c807432bd24ffb506f250d1f9f1c38df6abd6b1083", "sha256_from": "provenance.json", "excerpt": "The exposure is large. PHP powers up to 80% of websites.", "location": "body", "value": 80, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "up to", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Highest figure in the vault ('up to 80%'), unattributed. Capture reflects a version modified 23 Oct. (No earlier statement in the vault with this exact wording.)", "family": "F-9" }, { "id": "S-006", "slug": "cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20", "publisher": "cyberkendra.com", "url": "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "title": "PHP2Shell: Critical PHP Flaws Allow Remote Code Execution - Cyber Kendra", "published": "2026-10-21T17:11:07+05:30", "time_utc": "2026-10-21T11:41:07Z", "time_basis": "page metadata published 17:11+05:30; modified 17:39:31Z", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20/captures/20261023T080331Z/text.txt", "sha256": "c604df6084ae12123c45d972380fb4ef9be0d787f0ef685f9be4161ce9bf5065", "sha256_from": "provenance.json", "excerpt": "PHP runs on about 70% of websites whose server-side language is known, according to W3Techs.", "location": "body", "value": 70, "denominator_text": "websites whose server-side language is known", "denominator_class": "websites-known-language", "qualifier": "about", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "Links the W3Techs PHP page (page.html). Capture reflects the version modified 17:39Z.", "family": "F-5" }, { "id": "S-007", "slug": "clickx-fr-actualites-200877-des-failles-php-critiques-menace", "publisher": "www.clickx.be", "url": "https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/", "title": "Des failles PHP critiques menacent les sites web du monde entier : DPG Media et les pouvoirs publics mettent leurs sites hors ligne | Clickx", "published": "2026-10-21T12:31:18+00:00", "time_utc": "2026-10-21T12:31:18Z", "time_basis": "page metadata (no modified time given)", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/clickx-fr-actualites-200877-des-failles-php-critiques-menace/captures/20261022T181608Z/text.txt", "sha256": "f1876f8dd43053e0c0b3e106e9409256b3487f7228617f8e2abf7aca5e6c053d", "sha256_from": "provenance.json", "excerpt": "On estime qu’environ 70 % des sites web ou des applications web fonctionnent sous PHP.", "location": "body", "value": 70, "denominator_text": "sites web ou des applications web", "denominator_class": "applications", "qualifier": "around", "attribution": "none ('on estime')", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "fr", "translation": "It is estimated that around 70% of websites or web applications run on PHP.", "notes": "Earliest timed statement in the vault with no later modification recorded; predates the Wiz post by about an hour. Widens the denominator to 'websites or web applications'. Unattributed. (No earlier statement in the vault with this exact wording.)", "family": "F-10" }, { "id": "S-008", "slug": "x-wiz-io-php2shell", "publisher": "Wiz (@wiz_io)", "url": "https://x.com/wiz_io/status/2112899813264277528", "title": "Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet", "published": "2026-10-21T13:32Z", "time_utc": "2026-10-21T13:32:25Z", "time_basis": "decoded from X post ID 2112899813264277528 (13:32:25.919Z); matches article:published_time", "captures": [ "20261022T081624Z" ], "excerpt_found_in": [ "20261022T081624Z" ], "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "sha256_from": "provenance.json", "excerpt": "Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.", "location": "social post", "value": 70, "denominator_text": "the Internet", "denominator_class": "internet", "qualifier": "none", "attribution": "Wiz (own claim)", "links_to_measurement": null, "role": "origin", "restates": null, "language": "en", "translation": null, "notes": "Earliest 'of the Internet' statement in the vault and the origin of that family. The X post precedes the Wiz blog's metadata time (13:59:59Z) by 27 minutes, though it links the blog. No measurement cited.", "family": "F-1" }, { "id": "S-009", "slug": "cyberscoop-php-emergency-patches-php2shell-vulnerab", "publisher": "CyberScoop", "url": "https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/", "title": "PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop", "published": "2026-10-21T13:40:02+00:00", "time_utc": "2026-10-21T13:40:02Z", "time_basis": "page metadata published; modified 19:14:59Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/cyberscoop-php-emergency-patches-php2shell-vulnerab/captures/20261023T160435Z/text.txt", "sha256": "b47b3a5031e3f0801e4df342b9542ec8aa684842f98b4f6b6c30920346d917af", "sha256_from": "provenance.json", "excerpt": "PHP runs between 70-80% of websites whose server-side language is known, according to market research", "location": "body", "value": 75, "denominator_text": "websites whose server-side language is known", "denominator_class": "websites-known-language", "qualifier": "between 70-80%", "attribution": "'market research' (unnamed)", "links_to_measurement": null, "role": "transforms", "restates": "S-004", "language": "en", "translation": null, "notes": "Uses the W3Techs denominator but inflates the range to 70-80% and credits unnamed 'market research'. value is the range midpoint; range 70-80.", "family": "F-9" }, { "id": "S-010", "slug": "imperva-blog-php2shell", "publisher": "Imperva Threat Research (Nadav Avital, Bar Menachem)", "url": "https://www.imperva.com/blog/php2shell-vulnerability-updates/", "title": "PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva", "published": "2026-10-21", "time_utc": "2026-10-21T13:47:21Z", "time_basis": "page metadata published; modified 14:30:52Z", "captures": [ "20261022T111855Z" ], "excerpt_found_in": [ "20261022T111855Z" ], "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "sha256_from": "provenance.json", "excerpt": "With PHP used by over 69% of websites whose server-side programming language is known, the potential exposure is substantial.", "location": "body", "value": 69, "denominator_text": "websites whose server-side programming language is known", "denominator_class": "websites-known-language", "qualifier": "over", "attribution": "none (W3Techs wording, no link)", "links_to_measurement": null, "role": "restates", "restates": "S-004", "language": "en", "translation": null, "notes": "W3Techs denominator without naming W3Techs.", "family": "F-5" }, { "id": "S-011", "slug": "globalnews-ottawa-sites", "publisher": "globalnews.ca", "url": "https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/", "title": "Ottawa taking down some federal websites over critical global vulnerability - National | Globalnews.ca", "published": null, "time_utc": "2026-10-21T13:48:03Z", "time_basis": "page metadata published 09:48-04:00; modified 21:00:11Z, so the captured wording is probably later than Wiz", "captures": [ "20261022T081641Z" ], "excerpt_found_in": [ "20261022T081641Z" ], "file": "sources/globalnews-ottawa-sites/captures/20261022T081641Z/text.txt", "sha256": "87d2ae5079c3620bd0b22f78e743865d283f1915fde2bc8badc1b1c56daf2ae8", "sha256_from": "provenance.json", "excerpt": "a serious vulnerability in the code that underpins roughly 70 per cent of the world’s websites.", "location": "lede", "value": 70, "denominator_text": "the world’s websites", "denominator_class": "websites-all", "qualifier": "roughly", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Published time precedes Wiz, but the captured version was modified at 21:00Z. (Restates a statement listed later: this page's published time precedes it, but the capture reflects a later modification.)", "family": "F-2" }, { "id": "S-012", "slug": "fastly-blog-php2shell", "publisher": "Fastly", "url": "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618", "title": "Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastly", "published": "2026-10-21", "time_utc": "2026-10-21T13:53:36Z", "time_basis": "page metadata published; modified 2026-10-22T00:56Z", "captures": [ "20261022T111906Z" ], "excerpt_found_in": [ "20261022T111906Z" ], "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "sha256_from": "provenance.json", "excerpt": "PHP – the runtime behind most of the web's content management systems, ecommerce platforms, and publishing infrastructure", "location": "lede", "value": null, "denominator_text": "the web's content management systems, ecommerce platforms, and publishing infrastructure", "denominator_class": "applications", "qualifier": "most", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "en", "translation": null, "notes": "Qualitative; share of applications, not of websites. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-013", "slug": "cloudflare-blog-php2shell-waf", "publisher": "Cloudflare", "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "title": "Cloudflare deploys protections against php2shell vulnerability", "published": "2026-10-21", "time_utc": "2026-10-21T13:56:45Z", "time_basis": "page metadata published; modified 19:12:17Z", "captures": [ "20261022T081216Z" ], "excerpt_found_in": [ "20261022T081216Z" ], "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "sha256_from": "provenance.json", "excerpt": "PHP is used by almost 70% of websites.", "location": "body", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "almost", "attribution": "W3Techs (by hyperlink only)", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "Origin of the 'almost 70% of websites' wording. The words '70% of websites' are the anchor of a link to the W3Techs PHP page (rendered.html), so the figure rests on W3Techs, but the text drops W3Techs' 'known server-side language' denominator.", "family": "F-4" }, { "id": "S-014", "slug": "wiz-blog-php2shell", "publisher": "Wiz (Wiz Research)", "url": "https://www.wiz.io/blog/php2shell-php-rce", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "published": "2026-10-21", "time_utc": "2026-10-21T13:59:59Z", "time_basis": "page metadata published 09:59:59-04:00 (no later modification)", "captures": [ "20261022T081047Z" ], "excerpt_found_in": [ "20261022T081047Z" ], "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "sha256_from": "provenance.json", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "location": "headline", "value": 70, "denominator_text": "the Internet", "denominator_class": "internet", "qualifier": "none", "attribution": "Wiz (own claim)", "links_to_measurement": null, "role": "restates", "restates": "S-008", "language": "en", "translation": null, "notes": "The blog headline the whole 'internet' family points back to. Same wording in <title>, og:title and twitter:title. The blog has no link to W3Techs or any measurement.", "family": "F-1" }, { "id": "S-015", "slug": "wiz-blog-php2shell", "publisher": "Wiz (Wiz Research)", "url": "https://www.wiz.io/blog/php2shell-php-rce", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "published": "2026-10-21", "time_utc": "2026-10-21T13:59:59Z", "time_basis": "page metadata", "captures": [ "20261022T081047Z" ], "excerpt_found_in": [ "20261022T081047Z" ], "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "sha256_from": "provenance.json", "excerpt": "a popular general-purpose scripting language that powers 70% of all websites in the world.", "location": "lede", "value": 70, "denominator_text": "all websites in the world", "denominator_class": "websites-all", "qualifier": "none", "attribution": "Wiz (own claim)", "links_to_measurement": null, "role": "origin", "restates": null, "language": "en", "translation": null, "notes": "Origin of the '70% of all websites (in the world)' wording. Wiz's executive summary uses 'websites', its headline and conclusion use 'the Internet': the transformation happens inside Wiz's own post. No source, no qualifier, and 'all websites' drops W3Techs' known-language denominator (69.3%).", "family": "F-2" }, { "id": "S-016", "slug": "wiz-blog-php2shell", "publisher": "Wiz (Wiz Research)", "url": "https://www.wiz.io/blog/php2shell-php-rce", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "published": "2026-10-21", "time_utc": "2026-10-21T13:59:59Z", "time_basis": "page metadata", "captures": [ "20261022T081047Z" ], "excerpt_found_in": [ "20261022T081047Z" ], "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "sha256_from": "provenance.json", "excerpt": "With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated.", "location": "body", "value": 70, "denominator_text": "the Internet", "denominator_class": "internet", "qualifier": "none", "attribution": "Wiz (own claim)", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "en", "translation": null, "notes": "Conclusion sentence; quoted by Fortune and CRN. Converts 'websites that use PHP' into 'Internet affected'.", "family": "F-1" }, { "id": "S-017", "slug": "x-openai-php2shell", "publisher": "OpenAI (@OpenAI)", "url": "https://x.com/OpenAI/status/2112907856018309586", "title": "OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP", "published": "2026-10-21T14:04Z", "time_utc": "2026-10-21T14:04:23Z", "time_basis": "decoded from X post ID 2112907856018309586 (14:04:23.461Z)", "captures": [ "20261022T081645Z" ], "excerpt_found_in": [ "20261022T081645Z" ], "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "sha256_from": "provenance.json", "excerpt": "critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.", "location": "social post", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "an estimated", "attribution": "none (OpenAI's own estimate)", "links_to_measurement": null, "role": "origin", "restates": null, "language": "en", "translation": null, "notes": "Origin of the 'an estimated 70% of websites' wording, reused by PCMag and embedded by Clarin and LeBigData.", "family": "F-3" }, { "id": "S-018", "slug": "bleepingcomputer-php2shell", "publisher": "bleepingcomputer.com", "url": "https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/", "title": "PHP ships emergency patches for critical PHP2Shell flaws", "published": null, "time_utc": "2026-10-21T14:07:05Z", "time_basis": "page metadata published 10:07-04:00; modified 23:55:54Z", "captures": [ "20261022T081018Z" ], "excerpt_found_in": [ "20261022T081018Z" ], "file": "sources/bleepingcomputer-php2shell/captures/20261022T081018Z/text.txt", "sha256": "ad35f92f5f9bf98f235b92c8180ba7ba15b7a222bf882cb8b3d074e060f862b1", "sha256_from": "provenance.json", "excerpt": "PHP (Hypertext Preprocessor) is an open-source, server-side web development language that powers 75% to 80% of all websites", "location": "body", "value": 77.5, "denominator_text": "all websites", "denominator_class": "websites-all", "qualifier": "75% to 80%", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Range 75-80%, no source; value is the midpoint. Higher than any measurement in the vault. (No earlier statement in the vault with this exact wording.)", "family": "F-9" }, { "id": "S-019", "slug": "boursorama-reuters-sites-gouv", "publisher": "boursorama.com", "url": "https://www.boursorama.com/bourse/actualites/des-sites-gouvernementaux-hors-service-sur-fond-de-failles-dans-php-un-correctif-critique-attendu-70b6b2c5823e9cf3e5dd17efb767a981", "title": "Des sites gouvernementaux hors service sur fond de failles dans PHP, un correctif critique attendu - 21/10/2026 à 16:44 - Boursorama", "published": null, "time_utc": "2026-10-21T14:44:34Z", "time_basis": "page metadata 16:44:34+0200", "captures": [ "20261022T081500Z" ], "excerpt_found_in": [ "20261022T081500Z" ], "file": "sources/boursorama-reuters-sites-gouv/captures/20261022T081500Z/text.txt", "sha256": "cc4667b91c744182995cf31ded0e703d9cfd3ea1f87983a11b665ae840d784d1", "sha256_from": "provenance.json", "excerpt": "PHP est utilisé sur une grande partie d'Internet", "location": "body", "value": null, "denominator_text": "Internet", "denominator_class": "internet", "qualifier": "a large part", "attribution": "Reuters (wire copy)", "links_to_measurement": null, "role": "origin", "restates": null, "language": "fr", "translation": "PHP is used on a large part of the Internet", "notes": "Reuters French wire. Reuters' English factboxes say 'a large share of the internet'. Qualitative, no number.", "family": "F-13" }, { "id": "S-020", "slug": "tpo-nl-digid-offline", "publisher": "TPO.nl", "url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "title": "PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL", "published": "2026-10-21", "time_utc": "2026-10-21T14:53:56Z", "time_basis": "page metadata", "captures": [ "20261022T113213Z" ], "excerpt_found_in": [ "20261022T113213Z" ], "file": "sources/tpo-nl-digid-offline/captures/20261022T113213Z/text.txt", "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "sha256_from": "provenance.json", "excerpt": "de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait.", "location": "body", "value": 70, "denominator_text": "de websites", "denominator_class": "unspecified", "qualifier": "around", "attribution": "PHP Foundation and Wiz", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "nl", "translation": "the language on which, according to the PHP Foundation and security firm Wiz, around 70 percent of websites run.", "notes": "Credits the PHP Foundation too; the Foundation's own posts in the vault say 'a large share of the web', not 70%.", "family": "F-2" }, { "id": "S-021", "slug": "tpo-tpo-nl-digid-offline", "publisher": "TPO", "url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "title": "PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL", "published": "2026-10-21T14:53:56+00:00", "time_utc": "2026-10-21T14:53:56Z", "time_basis": "page metadata", "captures": [ "20261022T171501Z" ], "excerpt_found_in": [ "20261022T171501Z" ], "file": "sources/tpo-tpo-nl-digid-offline/captures/20261022T171501Z/text.txt", "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "sha256_from": "provenance.json", "excerpt": "de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait.", "location": "body", "value": 70, "denominator_text": "de websites", "denominator_class": "unspecified", "qualifier": "around", "attribution": "PHP Foundation and Wiz", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "nl", "translation": "the language on which, according to the PHP Foundation and security firm Wiz, around 70 percent of websites run.", "notes": "Same URL as tpo-nl-digid-offline, captured later (17:15Z); identical wording.", "family": "F-2" }, { "id": "S-022", "slug": "openai-community-php-flaws", "publisher": "OpenAI Developer Community (user 'sps', Leader)", "url": "https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490", "title": "OpenAI models help researchers uncover critical PHP security flaws", "published": "2026-10-21", "time_utc": "2026-10-21T15:16:54Z", "time_basis": "page metadata", "captures": [ "20261022T081721Z" ], "excerpt_found_in": [ "20261022T081721Z" ], "file": "sources/openai-community-php-flaws/captures/20261022T081721Z/text.txt", "sha256": "43afe7a0a3b96a86e52cbeea1c6ae41560bab1566da848fc4f9067152f739cd5", "sha256_from": "provenance.json", "excerpt": "an open-source programming language used to run an estimated 70% of websites.", "location": "body", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "an estimated", "attribution": "OpenAI", "links_to_measurement": null, "role": "restates", "restates": "S-017", "language": "en", "translation": null, "notes": "Reposts OpenAI's announcement text.", "family": "F-3" }, { "id": "S-023", "slug": "seroundtable-google-php2shell-42353-html", "publisher": "Search Engine Roundtable", "url": "https://www.seroundtable.com/google-php2shell-42353.html", "title": "Google Advice On Taking Sites Down When Fixing PHP2Shell - The PHP Exploit", "published": "2026-10-21T11:35 (per the page)", "time_utc": "2026-10-21T15:35:00Z", "time_basis": "page metadata 11:35-04:00; modified 23:31Z", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/seroundtable-google-php2shell-42353-html/captures/20261023T080331Z/text.txt", "sha256": "ced33ac294361df1bd82380fede1bad604578ac5148f9ac7f71ba83ebabbb24e", "sha256_from": "provenance.json", "excerpt": "it can allow for unauthenticated remote code execution (RCE) and memory disclosure across roughly 70% of the world's websites.", "location": "body", "value": 70, "denominator_text": "the world's websites", "denominator_class": "unspecified", "qualifier": "roughly", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "States the exposure (RCE across 70% of websites) rather than usage.", "family": "F-2" }, { "id": "S-024", "slug": "actu17-prefectures", "publisher": "actu17.fr", "url": "https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html", "title": "Failles critiques dans PHP : des sites coupés en urgence dans le monde entier, dont ceux des préfectures en France", "published": null, "time_utc": "2026-10-21T15:36:14Z", "time_basis": "page metadata 17:36:14+02:00", "captures": [ "20261022T081432Z" ], "excerpt_found_in": [ "20261022T081432Z" ], "file": "sources/actu17-prefectures/captures/20261022T081432Z/text.txt", "sha256": "84edb7f59b55a5ce64bf9458671e49987b9e48e0e8388039de616a4c8c1e534d", "sha256_from": "provenance.json", "excerpt": "D'après le Wall Street Journal, PHP fait fonctionner jusqu'à 70 % des sites internet dans le monde. Ce chiffre correspond à la part des sites qui utilisent ce langage", "location": "body", "value": 70, "denominator_text": "sites internet dans le monde", "denominator_class": "unspecified", "qualifier": "up to", "attribution": "Wall Street Journal", "links_to_measurement": null, "role": "restates", "restates": null, "language": "fr", "translation": "According to the Wall Street Journal, PHP runs up to 70% of websites in the world. This figure is the share of sites that use the language, not the number of sites actually vulnerable.", "notes": "Restates the WSJ headline 'up to 70% of the World's Websites at Risk' (WSJ is not in the vault; cited by Substack, The Verge and Wikipedia). Adds its own caveat: share of use, not of vulnerable sites. (No earlier statement in the vault with this exact wording.)", "family": "F-2" }, { "id": "S-025", "slug": "jn-pt-sites-desligados", "publisher": "jn.pt", "url": "https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512", "title": "Erro crítico em PHP obriga desligação de vários sites", "published": null, "time_utc": "2026-10-21T15:41:00Z", "time_basis": "page metadata 16:41+01:00", "captures": [ "20261022T081616Z" ], "excerpt_found_in": [ "20261022T081616Z" ], "file": "sources/jn-pt-sites-desligados/captures/20261022T081616Z/text.txt", "sha256": "d0ab599600817fabee6ab55163b27b2738e2ac00ac5659cd0bac26dfa4eafd2e", "sha256_from": "provenance.json", "excerpt": "A linguagem PHP é a base da mais de 70% dos servidores da Internet.", "location": "body", "value": 70, "denominator_text": "servidores da Internet", "denominator_class": "servers-hosts", "qualifier": "over", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-008", "language": "pt", "translation": "The PHP language is the basis of more than 70% of Internet servers.", "notes": "Only statement that moves the denominator to servers, and raises the qualifier to 'more than'.", "family": "F-11" }, { "id": "S-026", "slug": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "time_utc": "2026-10-21T15:48:36Z", "time_basis": "page metadata published; live page modified through 20:32Z; 'Updated Oct. 21, 2026, 4:32 p.m. ET'", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "sha256_from": "provenance.json", "excerpt": "A critical security issue in a programming language used in as much as 70% of websites has put much of the internet at risk", "location": "lede", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "as much as", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "en", "translation": null, "notes": "'as much as' parallels the WSJ 'up to'. Repeated later in the live blog ('used in as much as 70% of websites'). (No earlier statement in the vault with this exact wording.)", "family": "F-2" }, { "id": "S-027", "slug": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "time_utc": "2026-10-21T15:48:36Z", "time_basis": "page metadata", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "sha256_from": "provenance.json", "excerpt": "Critical security flaw puts most websites at risk as NSA issues warning", "location": "headline", "value": null, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "most", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "en", "translation": null, "notes": "Headline converts usage share into 'at risk'. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-028", "slug": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "time_utc": "2026-10-21T15:48:36Z", "time_basis": "page metadata (live-blog entry, exact time not stated)", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "sha256_from": "provenance.json", "excerpt": "critical flaws affecting the technology powering nearly three-quarters of the internet", "location": "body", "value": 75, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "nearly", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Same live blog says 'roughly 70% of websites' elsewhere; here 'nearly three-quarters of the internet'. (No earlier statement in the vault with this exact wording.)", "family": "F-1" }, { "id": "S-029", "slug": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "time_utc": "2026-10-21T15:48:36Z", "time_basis": "page metadata (live-blog entry)", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "sha256_from": "provenance.json", "excerpt": "It is used by roughly 70% of websites whose server-side programming language is known.", "location": "body", "value": 70, "denominator_text": "websites whose server-side programming language is known", "denominator_class": "websites-known-language", "qualifier": "roughly", "attribution": "none (W3Techs wording)", "links_to_measurement": null, "role": "restates", "restates": "S-004", "language": "en", "translation": null, "notes": "", "family": "F-5" }, { "id": "S-030", "slug": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "time_utc": "2026-10-21T15:48:36Z", "time_basis": "page metadata (live-blog entry)", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "sha256_from": "provenance.json", "excerpt": "PHP, the underlying technology that powers three-quarters of websites worldwide.", "location": "body", "value": 75, "denominator_text": "websites worldwide", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Rounds up to three quarters without a qualifier. (No earlier statement in the vault with this exact wording.)", "family": "F-8" }, { "id": "S-031", "slug": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "time_utc": "2026-10-21T15:48:36Z", "time_basis": "page metadata (live-blog entry)", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "sha256_from": "provenance.json", "excerpt": "The open-source software is used by about 70% of websites globally.", "location": "body", "value": 70, "denominator_text": "websites globally", "denominator_class": "websites-all", "qualifier": "about", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "", "family": "F-2" }, { "id": "S-032", "slug": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "time_utc": "2026-10-21T15:48:36Z", "time_basis": "page metadata (live-blog entry)", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "sha256_from": "provenance.json", "excerpt": "nearly 70% of all websites that have a known server-side language (when users can identify a site’s programming language) use a PHP, according to web tech survey platform W3Techs.", "location": "body", "value": 70, "denominator_text": "all websites that have a known server-side language", "denominator_class": "websites-known-language", "qualifier": "nearly", "attribution": "W3Techs", "links_to_measurement": null, "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "Names W3Techs but has no link to it (the only measurement-type link on the page goes to the Wiz blog). One page, six different wordings (70% 'as much as', 'roughly', 'about', 'nearly'; 75% of websites; 75% of the internet; 'most websites').", "family": "F-5" }, { "id": "S-033", "slug": "abc-au-gov-sites-exposed", "publisher": "abc.net.au", "url": "https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812", "title": "Australian government sites among those exposed to 'critical' PHP software flaw - ABC News", "published": null, "time_utc": "2026-10-21T15:58:02Z", "time_basis": "page metadata published; modified 22:13:38Z", "captures": [ "20261022T081518Z" ], "excerpt_found_in": [ "20261022T081518Z" ], "file": "sources/abc-au-gov-sites-exposed/captures/20261022T081518Z/text.txt", "sha256": "84937c7c5b87e7c94cf87f2aed94f82ebbf2824d6dea9841cd50e39111d2cb48", "sha256_from": "provenance.json", "excerpt": "PHP runs about 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs.", "location": "body", "value": 75, "denominator_text": "websites whose programming language can be identified", "denominator_class": "websites-known-language", "qualifier": "about", "attribution": "W3Techs", "links_to_measurement": null, "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "Reuters-style wording (same as RTE's Reuters copy). Credits W3Techs for 75%, but every other W3Techs citation in the vault gives 69.3% (69.7% at Infosecurity); no link. The 75% does not match the measurement it names.", "family": "F-6" }, { "id": "S-034", "slug": "therecord-php-warnings", "publisher": "therecord.media", "url": "https://therecord.media/php-script-vulnerabilities-warnings", "title": "Hundreds of websites taken offline as concern grows over two PHP vulnerabilities | The Record from Recorded Future News", "published": null, "time_utc": "2026-10-21T16:12:21Z", "time_basis": "page metadata", "captures": [ "20261022T080854Z" ], "excerpt_found_in": [ "20261022T080854Z" ], "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "sha256_from": "provenance.json", "excerpt": "Some estimates show that more than 70% of all websites on the internet use PHP.", "location": "body", "value": 70, "denominator_text": "all websites on the internet", "denominator_class": "websites-all", "qualifier": "more than", "attribution": "'some estimates' (link to Wiz blog)", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "en", "translation": null, "notes": "'more than 70%' is the anchor of a link to wiz.io/blog/php2shell-php-rce, which says '70%' with no 'more than'. Not a measurement link. Also says PHP is used to run 'the vast majority of websites'.", "family": "F-2" }, { "id": "S-035", "slug": "therecord-php-warnings", "publisher": "therecord.media", "url": "https://therecord.media/php-script-vulnerabilities-warnings", "title": "Hundreds of websites taken offline as concern grows over two PHP vulnerabilities | The Record from Recorded Future News", "published": null, "time_utc": "2026-10-21T16:12:21Z", "time_basis": "page metadata", "captures": [ "20261022T080854Z" ], "excerpt_found_in": [ "20261022T080854Z" ], "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "sha256_from": "provenance.json", "excerpt": "used to build and run web applications and the vast majority of websites", "location": "lede", "value": null, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "the vast majority", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Qualitative. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-036", "slug": "insurancebusiness-uk-councils", "publisher": "insurancebusinessmag.com", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "published": null, "time_utc": "2026-10-21T16:25:58Z", "time_basis": "datePublished 16:25:58Z vs article:published_time 17:25:58Z (conflict in the page metadata); modified 18:01/19:01Z", "captures": [ "20261022T081252Z" ], "excerpt_found_in": [ "20261022T081252Z" ], "file": "sources/insurancebusiness-uk-councils/captures/20261022T081252Z/text.txt", "sha256": "daa04c79edfb56f49761d38fa7ce81c2aa1828f78a0b0b4694519818e4e507ca", "sha256_from": "provenance.json", "excerpt": "two critical bugs in software that runs around 70% of the web.", "location": "lede", "value": 70, "denominator_text": "the web", "denominator_class": "internet", "qualifier": "around", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Dek says 'of the web'; body says 'the code behind most of the internet' and, with a W3Techs link, 'around 70% of websites whose server-side language can be identified'. One article, three denominators. (No earlier statement in the vault with this exact wording.)", "family": "F-1" }, { "id": "S-037", "slug": "insurancebusiness-uk-councils", "publisher": "insurancebusinessmag.com", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "published": null, "time_utc": "2026-10-21T16:25:58Z", "time_basis": "page metadata", "captures": [ "20261022T081252Z" ], "excerpt_found_in": [ "20261022T081252Z" ], "file": "sources/insurancebusiness-uk-councils/captures/20261022T081252Z/text.txt", "sha256": "daa04c79edfb56f49761d38fa7ce81c2aa1828f78a0b0b4694519818e4e507ca", "sha256_from": "provenance.json", "excerpt": "two critical flaws in PHP, the code behind most of the internet.", "location": "body", "value": null, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "most", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Qualitative. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-038", "slug": "insurancebusiness-uk-councils", "publisher": "insurancebusinessmag.com", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "published": null, "time_utc": "2026-10-21T16:25:58Z", "time_basis": "page metadata", "captures": [ "20261022T081252Z" ], "excerpt_found_in": [ "20261022T081252Z" ], "file": "sources/insurancebusiness-uk-councils/captures/20261022T081252Z/text.txt", "sha256": "daa04c79edfb56f49761d38fa7ce81c2aa1828f78a0b0b4694519818e4e507ca", "sha256_from": "provenance.json", "excerpt": "According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified.", "location": "body", "value": 70, "denominator_text": "websites whose server-side language can be identified", "denominator_class": "websites-known-language", "qualifier": "around", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "Links W3Techs (rendered.html). An infographic in the same page says '~70% of websites whose server-side language is known use PHP'.", "family": "F-5" }, { "id": "S-039", "slug": "insurancebusiness-uk-councils-met", "publisher": "Insurance Business (Matthew Sellers)", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "published": "2026-10-21", "time_utc": "2026-10-21T16:25:58Z", "time_basis": "page metadata", "captures": [ "20261022T112225Z" ], "excerpt_found_in": [ "20261022T112225Z" ], "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "sha256_from": "provenance.json", "excerpt": "According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified.", "location": "body", "value": 70, "denominator_text": "websites whose server-side language can be identified", "denominator_class": "websites-known-language", "qualifier": "around", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "Same URL as insurancebusiness-uk-councils, captured 11:22Z vs 08:12Z; dek, 'most of the internet' and W3Techs sentences identical across the two captures.", "family": "F-5" }, { "id": "S-040", "slug": "cnn-php2shell-ai", "publisher": "cnn.com", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "title": "PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet | CNN Business", "published": null, "time_utc": "2026-10-21T16:36:24Z", "time_basis": "page metadata published; this capture's version modified 2026-10-22T04:00:36Z", "captures": [ "20261022T080952Z" ], "excerpt_found_in": [ "20261022T080952Z" ], "file": "sources/cnn-php2shell-ai/captures/20261022T080952Z/text.txt", "sha256": "81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef", "sha256_from": "provenance.json", "excerpt": "after artificial intelligence helped discover and address critical bugs that could affect 70% of the internet.", "location": "lede", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none (Wiz linked elsewhere in the story)", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "Version captured 22 Oct 08:09Z. 'could affect 70% of the internet' echoes the Wiz headline.", "family": "F-1" }, { "id": "S-041", "slug": "cnn-php2shell-ai", "publisher": "cnn.com", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "title": "PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet | CNN Business", "published": null, "time_utc": "2026-10-21T16:36:24Z", "time_basis": "page metadata", "captures": [ "20261022T080952Z" ], "excerpt_found_in": [ "20261022T080952Z" ], "file": "sources/cnn-php2shell-ai/captures/20261022T080952Z/page.html", "sha256": "d6d531efb9e3232aec5c2c74cdb854c9b4be45356e8b187001490e9ba5ed6a18", "sha256_from": "provenance.json", "excerpt": "PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet", "location": "title", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "HTML <title>; the visible headline and og:title of the same capture read 'Global websites shut down after AI found a critical flaw affecting 70% of the internet'. The <title> is probably the earlier headline.", "family": "F-1" }, { "id": "S-042", "slug": "cnn-php2shell-websites-shut", "publisher": "CNN", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "title": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business", "published": "2026-10-21", "time_utc": "2026-10-21T16:36:24Z", "time_basis": "page metadata; this version modified 2026-10-22T11:06:26Z", "captures": [ "20261022T112616Z" ], "excerpt_found_in": [ "20261022T112616Z" ], "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "sha256_from": "provenance.json", "excerpt": "two critical flaws in PHP, a programming language that powers 70% of all websites in the world", "location": "body", "value": 70, "denominator_text": "all websites in the world", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Added in the -intl rewrite (Lisa Eadicicco, Hanna Ziady); absent from the earlier capture. Headline now 'Websites shut down globally after AI finds a critical flaw affecting 70% of the internet'.", "family": "F-2" }, { "id": "S-043", "slug": "cnn-php2shell-websites-shut", "publisher": "CNN", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "title": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business", "published": "2026-10-21", "time_utc": "2026-10-21T16:36:24Z", "time_basis": "page metadata; modified 2026-10-22T11:06Z", "captures": [ "20261022T112616Z" ], "excerpt_found_in": [ "20261022T112616Z" ], "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "sha256_from": "provenance.json", "excerpt": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet", "location": "headline", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "", "family": "F-1" }, { "id": "S-044", "slug": "securityweek-first-attempts-sensors", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/", "title": "PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek", "published": "2026-10-21", "time_utc": "2026-10-21T16:50:40Z", "time_basis": "page metadata; modified 17:35:48Z", "captures": [ "20261022T112324Z" ], "excerpt_found_in": [ "20261022T112324Z" ], "file": "sources/securityweek-first-attempts-sensors/captures/20261022T112324Z/text.txt", "sha256": "b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41", "sha256_from": "provenance.json", "excerpt": "Because the security defects are in PHP itself, they impact 70% of all websites in the world, independent of their CMS.", "location": "body", "value": 70, "denominator_text": "all websites in the world", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none explicit (paragraph follows 'According to Wiz')", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Wiz's 'powers 70% of all websites in the world' turned into 'impact 70% of all websites'.", "family": "F-2" }, { "id": "S-045", "slug": "repubblica-tecnologia-2026-10-21-news-php2shell-ia", "publisher": "la Repubblica", "url": "https://www.repubblica.it/tecnologia/2026/10/21/news/php2shell_ia_due_falle_web-425663861/", "title": "PHP2Shell, l’IA svela due falle critiche nel web - la Repubblica", "published": "2026-10-21T17:55:56Z", "time_utc": "2026-10-21T17:55:56Z", "time_basis": "page metadata; modified 18:04:03Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/repubblica-tecnologia-2026-10-21-news-php2shell-ia/captures/20261023T160435Z/text.txt", "sha256": "15cece2248273664131179c3462761620f79e5f2ed3af09e3aee95a919e3b217", "sha256_from": "provenance.json", "excerpt": "W3Techs, società che rileva le tecnologie impiegate nei siti Internet, misura l’uso di PHP nel 69,3% dei siti dei quali riesce a identificare il linguaggio.", "location": "body", "value": 69.3, "denominator_text": "siti dei quali riesce a identificare il linguaggio", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "it", "translation": "W3Techs, a company that tracks the technologies used on websites, measures PHP use at 69.3% of the sites whose language it can identify.", "notes": "Links W3Techs (page.html).", "family": "F-5" }, { "id": "S-046", "slug": "substack-lopezkurtz-patch-is-the-exploit", "publisher": "David Lopez-Kurtz (Substack)", "url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit", "title": "The Patch Is the Exploit - by David Lopez-Kurtz", "published": "2026-10", "time_utc": "2026-10-21T17:58:25Z", "time_basis": "page metadata", "captures": [ "20261022T113134Z" ], "excerpt_found_in": [ "20261022T113134Z" ], "file": "sources/substack-lopezkurtz-patch-is-the-exploit/captures/20261022T113134Z/text.txt", "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "sha256_from": "provenance.json", "excerpt": "The Wall Street Journal’s headline puts “up to 70%” of the world’s websites at risk. The closest public number is W3Techs’ count of PHP on 69.3 percent", "location": "body", "value": 69.3, "denominator_text": "websites whose server-side language it can identify", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "WSJ (headline) and W3Techs (measurement)", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "The only source that sets the WSJ framing ('up to 70% ... at risk') against the measurement and says W3Techs 'measures market share rather than exposure'. Footnotes link WSJ and W3Techs.", "family": "F-5" }, { "id": "S-047", "slug": "paperjam-article-php2shell-des-milliers-de-sites", "publisher": "Paperjam", "url": "https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg", "title": "PHP2Shell: des milliers de sites exposés au Luxembourg | Paperjam News", "published": "not stated in the capture", "time_utc": "2026-10-21T18:12:20Z", "time_basis": "page metadata; modified 2026-10-22T03:24Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/paperjam-article-php2shell-des-milliers-de-sites/captures/20261023T160435Z/text.txt", "sha256": "73aed7ccd645b7172699b36b2e9dd8540c0300f2ff6c3de8ad218d7aeb29b20e", "sha256_from": "provenance.json", "excerpt": "PHP fait fonctionner près de 70% des sites dont le langage côté serveur peut être identifié dans le monde, selon W3Techs.", "location": "body", "value": 70, "denominator_text": "sites dont le langage côté serveur peut être identifié", "denominator_class": "websites-known-language", "qualifier": "nearly", "attribution": "W3Techs", "links_to_measurement": null, "role": "measures", "restates": null, "language": "fr", "translation": "PHP runs nearly 70% of sites worldwide whose server-side language can be identified, according to W3Techs.", "notes": "Also says PHP runs 'une grande partie des sites et applications web'. No W3Techs link found.", "family": "F-5" }, { "id": "S-048", "slug": "fortune-ai-tools-php-vulnerability", "publisher": "Fortune", "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "title": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "published": "2026-10-21 (URL date; updated 22 October per the page)", "time_utc": "2026-10-21T18:48:38Z", "time_basis": "page metadata published; modified 2026-10-22T14:56:06Z", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/text.txt", "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808", "sha256_from": "provenance.json", "excerpt": "AI tools discovered the PHP vulnerability that could take down 70% of the internet.", "location": "headline", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-014", "language": "en", "translation": null, "notes": "Wiz said 'affecting'; Fortune says 'could take down'. Matches the URL slug, so probably the original headline.", "family": "F-1" }, { "id": "S-049", "slug": "fortune-ai-tools-php-vulnerability", "publisher": "Fortune", "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "title": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "published": "2026-10-21 (URL date; updated 22 October per the page)", "time_utc": "2026-10-21T18:48:38Z", "time_basis": "page metadata", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/page.html", "sha256": "cd967fa20c098c9ad5adc7efb498607c1cbaa17dabf496d151ee77c8ffb52fe7", "sha256_from": "provenance.json", "excerpt": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "location": "title", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-014", "language": "en", "translation": null, "notes": "HTML <title>, og:title and twitter:title say 'AI helped discover' where the H1 says 'AI tools discovered': a softened headline on the AI claim, the 70% claim unchanged.", "family": "F-1" }, { "id": "S-050", "slug": "fortune-ai-tools-php-vulnerability", "publisher": "Fortune", "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "title": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "published": "2026-10-21 (URL date; updated 22 October per the page)", "time_utc": "2026-10-21T18:48:38Z", "time_basis": "page metadata", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/text.txt", "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808", "sha256_from": "provenance.json", "excerpt": "identifying a critical issue that stands to take down 70% of the internet if left unaddressed.", "location": "lede", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-016", "language": "en", "translation": null, "notes": "Fortune's own voice.", "family": "F-1" }, { "id": "S-051", "slug": "fortune-ai-tools-php-vulnerability", "publisher": "Fortune", "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "title": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "published": "2026-10-21 (URL date; updated 22 October per the page)", "time_utc": "2026-10-21T18:48:38Z", "time_basis": "page metadata", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/text.txt", "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808", "sha256_from": "provenance.json", "excerpt": "“With 70% of the internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings.", "location": "quote of someone", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "Wiz (blog post, linked)", "links_to_measurement": null, "role": "restates", "restates": "S-016", "language": "en", "translation": null, "notes": "Accurate quote of the Wiz conclusion (case changes only: 'Internet' to 'internet', 'PHP2Shell' to 'php2shell'). Links the Wiz blog, not a measurement.", "family": "F-1" }, { "id": "S-052", "slug": "agconnect-maatschappij-security-welke-nederlandse-websites-w", "publisher": "AG Connect", "url": "https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht", "title": "Offline door PHP kwetsbaarheden: Welke Nederlandse websites waren uit de lucht?", "published": "2026-10-21T20:55:05+02:00", "time_utc": "2026-10-21T18:55:05Z", "time_basis": "page metadata published 20:55:05+02:00; modified 2026-10-22T06:46Z", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/agconnect-maatschappij-security-welke-nederlandse-websites-w/captures/20261022T181608Z/text.txt", "sha256": "505809e89b530fe70249289f22bf5d7aa6c94100d0656851754fb9a469552cbc", "sha256_from": "provenance.json", "excerpt": "Naar schatting gebruikt ongeveer 70 procent van alle websites wereldwijd PHP of een voortvloeisel daarvan.", "location": "lede", "value": 70, "denominator_text": "alle websites wereldwijd", "denominator_class": "websites-all", "qualifier": "an estimated, around", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "nl", "translation": "By estimate, around 70 percent of all websites worldwide use PHP or a derivative of it.", "notes": "Also in meta description.", "family": "F-2" }, { "id": "S-053", "slug": "therecord-php-foundation-statement", "publisher": "The Record (Recorded Future News)", "url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities", "title": "PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Record from Recorded Future News", "published": "2026-10-22", "time_utc": "2026-10-21T18:59:13Z", "time_basis": "page metadata", "captures": [ "20261022T113158Z" ], "excerpt_found_in": [ "20261022T113158Z" ], "file": "sources/therecord-php-foundation-statement/captures/20261022T113158Z/text.txt", "sha256": "28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e", "sha256_from": "provenance.json", "excerpt": "Some estimates show that more than 70% of all websites on the internet use PHP.", "location": "body", "value": 70, "denominator_text": "all websites on the internet", "denominator_class": "websites-all", "qualifier": "more than", "attribution": "'some estimates' (link to Wiz blog)", "links_to_measurement": null, "role": "restates", "restates": "S-034", "language": "en", "translation": null, "notes": "Same sentence and same Wiz link as The Record's earlier story.", "family": "F-2" }, { "id": "S-054", "slug": "newsweek-php2shell-list", "publisher": "newsweek.com", "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "title": "PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek", "published": null, "time_utc": "2026-10-21T19:03:58Z", "time_basis": "page metadata", "captures": [ "20261022T081350Z" ], "excerpt_found_in": [ "20261022T081350Z" ], "file": "sources/newsweek-php2shell-list/captures/20261022T081350Z/text.txt", "sha256": "dc7ff69a1e38d3d6a18e69e19cca63a0b086601d4ae1fb2fe1c77654b30957be", "sha256_from": "provenance.json", "excerpt": "Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable", "location": "body", "value": 70, "denominator_text": "websites worldwide", "denominator_class": "websites-all", "qualifier": "roughly", "attribution": "Wiz Research", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Adds 'roughly', which Wiz does not use; adds an exposure caveat. Also: 'Malwarebytes describes PHP as powering a large part of the web'.", "family": "F-2" }, { "id": "S-055", "slug": "newsweek-php2shell-websites", "publisher": "Newsweek", "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "title": "PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek", "published": "2026-10-21", "time_utc": "2026-10-21T19:03:58Z", "time_basis": "page metadata", "captures": [ "20261022T112237Z" ], "excerpt_found_in": [ "20261022T112237Z" ], "file": "sources/newsweek-php2shell-websites/captures/20261022T112237Z/text.txt", "sha256": "323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294", "sha256_from": "provenance.json", "excerpt": "Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable", "location": "body", "value": 70, "denominator_text": "websites worldwide", "denominator_class": "websites-all", "qualifier": "roughly", "attribution": "Wiz Research", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Same URL as newsweek-php2shell-list, captured 11:22Z vs 08:13Z; identical wording.", "family": "F-2" }, { "id": "S-056", "slug": "abc-au-politics-live", "publisher": "abc.net.au", "url": "https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950", "title": "Federal politics: No government websites hacked after global security flaw found - as it happened - ABC News", "published": null, "time_utc": "2026-10-21T20:29:17Z", "time_basis": "page metadata (live blog; modified to 2026-10-22T03:02Z)", "captures": [ "20261022T081530Z" ], "excerpt_found_in": [ "20261022T081530Z" ], "file": "sources/abc-au-politics-live/captures/20261022T081530Z/text.txt", "sha256": "a86331d9b7a21f78af1750d3daf6ebbb696253e1216649e973e34262313040b1", "sha256_from": "provenance.json", "excerpt": "a vulnerability was discovered in 70 per cent of the world's websites by an OpenAI tool", "location": "body", "value": 70, "denominator_text": "the world's websites", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Says the vulnerability was 'discovered in' 70% of websites: usage turned into presence of the flaw. (No earlier statement in the vault with this exact wording.) (Title: an em dash in the original is written here as a hyphen.)", "family": "F-2" }, { "id": "S-057", "slug": "pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw", "publisher": "PCMag", "url": "https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw", "title": "Hackers Already Trying to Exploit Serious PHP Flaw | PCMag", "published": "2026-10-21", "time_utc": "2026-10-21T22:03:43Z", "time_basis": "page metadata", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/captures/20261023T080331Z/text.txt", "sha256": "82ef905cd2201bd4507643ba274b135e32b1e440606b1ded976617c782b28166", "sha256_from": "provenance.json", "excerpt": "The flaw affects PHP, a scripting language used by an estimated 70% of websites.", "location": "lede", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "an estimated", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-017", "language": "en", "translation": null, "notes": "Dek and body ('which an estimated 70% of websites use') reuse the OpenAI wording.", "family": "F-3" }, { "id": "S-058", "slug": "theregister-php-blames-chainguard", "publisher": "The Register", "url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "title": "PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk", "published": "2026-10-22", "time_utc": "2026-10-21T23:02:57Z", "time_basis": "page metadata", "captures": [ "20261022T113204Z" ], "excerpt_found_in": [ "20261022T113204Z" ], "file": "sources/theregister-php-blames-chainguard/captures/20261022T113204Z/text.txt", "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "sha256_from": "provenance.json", "excerpt": "adding the oft-quoted stat that PHP powers 70 percent of all websites in the world.", "location": "body", "value": 70, "denominator_text": "all websites in the world", "denominator_class": "websites-all", "qualifier": "none", "attribution": "Wiz researchers (Tzadik, Tamari, Ohfeld, Schwartz)", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Explicitly flags it as an 'oft-quoted stat'. Headline: 'huge chunks of the web at risk'.", "family": "F-2" }, { "id": "S-059", "slug": "x-feross-chainguard", "publisher": "Feross Aboukhadijeh (@feross) on X", "url": "https://x.com/feross/status/2113043398664015878", "title": "Feross on X: \"Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X", "published": "2026-10-22", "time_utc": "2026-10-21T23:02:59Z", "time_basis": "decoded from X post ID 2113043398664015878", "captures": [ "20261022T112105Z" ], "excerpt_found_in": [ "20261022T112105Z" ], "file": "sources/x-feross-chainguard/captures/20261022T112105Z/text.txt", "sha256": "de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6", "sha256_from": "provenance.json", "excerpt": "PHP runs 69% of websites whose server-side language is known.", "location": "social post", "value": 69, "denominator_text": "websites whose server-side language is known", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-004", "language": "en", "translation": null, "notes": "Measurement wording, no source named.", "family": "F-5" }, { "id": "S-060", "slug": "rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili", "publisher": "RTVE.es", "url": "https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml", "title": "Alerta por fallos críticos en PHP: riesgo en servidores web", "published": "2026-10-22T01:49:29+02:00", "time_utc": "2026-10-21T23:49:29Z", "time_basis": "page metadata 01:49+02:00; modified 2026-10-22T13:52Z", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili/captures/20261022T181608Z/text.txt", "sha256": "0c7f8e327e5c8bd0d5c3b0c7c6ab7cb7ef3a383f5da908cecc7da96ba7a19ccf", "sha256_from": "provenance.json", "excerpt": "está presente en cerca del 70% de las páginas web con lenguaje identificable", "location": "body", "value": 70, "denominator_text": "páginas web con lenguaje identificable", "denominator_class": "websites-known-language", "qualifier": "around", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-004", "language": "es", "translation": "it is present on around 70% of web pages with an identifiable language", "notes": "Also says 'utilizado en gran parte de Internet' (used in a large part of the Internet).", "family": "F-5" }, { "id": "S-061", "slug": "php-foundation-blog-security-release", "publisher": "The PHP Foundation", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "published": "2026-10-21", "time_utc": null, "time_basis": "comment, no time", "captures": [ "20261022T080901Z" ], "excerpt_found_in": [ "20261022T080901Z" ], "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "sha256_from": "provenance.json", "excerpt": "releasing the patch early and thus risking 70% of the web just to make sure you get less risk is absolutely wild and irresponsible", "location": "social post", "value": 70, "denominator_text": "the web", "denominator_class": "internet", "qualifier": "none", "attribution": "none (commenter Ok_Evidence_9745)", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "A reader comment under the PHP Foundation post; the Foundation's own text says 'PHP runs a large share of the web'.", "family": "F-1" }, { "id": "S-062", "slug": "php-foundation-blog-security-release", "publisher": "The PHP Foundation", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "published": "2026-10-21", "time_utc": null, "time_basis": "date only (21 Oct)", "captures": [ "20261022T080901Z" ], "excerpt_found_in": [ "20261022T080901Z" ], "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "sha256_from": "provenance.json", "excerpt": "PHP runs a large share of the web", "location": "body", "value": null, "denominator_text": "the web", "denominator_class": "internet", "qualifier": "a large share", "attribution": "PHP Foundation (own text)", "links_to_measurement": null, "role": "restates", "restates": null, "language": "en", "translation": null, "notes": "The maintainers never put a number on it in the vault, although TPO credits '70 procent' to them. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-063", "slug": "phpfoundation-blog-security-release-leak", "publisher": "The PHP Foundation", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "published": "2026-10-21", "time_utc": null, "time_basis": "comment, no time", "captures": [ "20261022T081244Z" ], "excerpt_found_in": [ "20261022T081244Z" ], "file": "sources/phpfoundation-blog-security-release-leak/captures/20261022T081244Z/text.txt", "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "sha256_from": "provenance.json", "excerpt": "releasing the patch early and thus risking 70% of the web just to make sure you get less risk is absolutely wild and irresponsible", "location": "social post", "value": 70, "denominator_text": "the web", "denominator_class": "internet", "qualifier": "none", "attribution": "none (commenter Ok_Evidence_9745)", "links_to_measurement": null, "role": "restates", "restates": "S-061", "language": "en", "translation": null, "notes": "Same URL as php-foundation-blog-security-release, captured 08:12Z vs 08:09Z; identical.", "family": "F-1" }, { "id": "S-064", "slug": "cccs-al26-026", "publisher": "Canadian Centre for Cyber Security (CCCS)", "url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "title": "AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619", "published": "2026-10-21", "time_utc": null, "time_basis": "date only", "captures": [ "20261022T081700Z" ], "excerpt_found_in": [ "20261022T081700Z" ], "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "sha256_from": "provenance.json", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "location": "reference list", "value": 70, "denominator_text": "the Internet", "denominator_class": "internet", "qualifier": "none", "attribution": "Wiz (cited title)", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "Canadian Centre for Cyber Security alert, footnote 6: the Wiz headline enters a government advisory as a reference title. The alert's own text has no share figure.", "family": "F-1" }, { "id": "S-065", "slug": "php2shell-com", "publisher": "OpenAI / Wiz / Calif joint microsite (php2shell.com)", "url": "https://www.php2shell.com/", "title": "PHP2Shell - AI uncovers critical vulnerabilities in the backbone of the web", "published": null, "time_utc": null, "time_basis": "date only (no date on page; assumed launched with the 21 Oct disclosure; captured 2026-10-22T11:18Z)", "captures": [ "20261022T111831Z" ], "excerpt_found_in": [ "20261022T111831Z" ], "file": "sources/php2shell-com/captures/20261022T111831Z/text.txt", "sha256": "b1e83b4f0feb87d5abb59bfb76015b154a7b678a51c0e965e06929f1e6b17f48", "sha256_from": "provenance.json", "excerpt": "PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki.", "location": "body", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "approximately", "attribution": "none (joint OpenAI/Wiz/Calif microsite)", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "The joint microsite also shows a stat tile '~70 % of websites use PHP'. Softer than the Wiz blog ('approximately', no 'all'). (Title: an em dash in the original is written here as a hyphen.)", "family": "F-2" }, { "id": "S-066", "slug": "lorikeet-php2shell", "publisher": "Lorikeet Security", "url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities", "title": "php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security", "published": "2026-10-21", "time_utc": null, "time_basis": "21 Oct (manifest); no time", "captures": [ "20261022T112438Z" ], "excerpt_found_in": [ "20261022T112438Z" ], "file": "sources/lorikeet-php2shell/captures/20261022T112438Z/text.txt", "sha256": "db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349", "sha256_from": "provenance.json", "excerpt": "exposing an estimated 70% of the public web.", "location": "lede", "value": 70, "denominator_text": "the public web", "denominator_class": "internet", "qualifier": "an estimated", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-014", "language": "en", "translation": null, "notes": "Section title 'The 70% Blast Radius'.", "family": "F-1" }, { "id": "S-067", "slug": "lorikeet-php2shell", "publisher": "Lorikeet Security", "url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities", "title": "php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security", "published": "2026-10-21", "time_utc": null, "time_basis": "21 Oct (manifest)", "captures": [ "20261022T112438Z" ], "excerpt_found_in": [ "20261022T112438Z" ], "file": "sources/lorikeet-php2shell/captures/20261022T112438Z/text.txt", "sha256": "db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349", "sha256_from": "provenance.json", "excerpt": "According to web technology surveys, PHP still underpins approximately 70% to 75% of all web servers worldwide.", "location": "body", "value": 72.5, "denominator_text": "all web servers worldwide", "denominator_class": "servers-hosts", "qualifier": "approximately 70% to 75%", "attribution": "'web technology surveys' (unnamed)", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Range; value is the midpoint. Moves the denominator to web servers and credits unnamed surveys. (No earlier statement in the vault with this exact wording.)", "family": "F-11" }, { "id": "S-068", "slug": "reuters-factbox-websites-offline", "publisher": "Reuters factbox, via Global Banking and Finance", "url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/", "title": "Global Websites Offline Amid PHP Security Flaws: Finance Sector Impact", "published": "2026-10-21", "time_utc": null, "time_basis": "manifest", "captures": [ "20261022T113026Z" ], "excerpt_found_in": [ "20261022T113026Z" ], "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "sha256_from": "provenance.json", "excerpt": "PHP, a programming language that powers a large share of the internet.", "location": "lede", "value": null, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "a large share", "attribution": "Reuters", "links_to_measurement": null, "role": "restates", "restates": "S-019", "language": "en", "translation": null, "notes": "Reuters English factbox; quoted verbatim by Search Engine Roundtable ('Reuters reported').", "family": "F-13" }, { "id": "S-069", "slug": "crn-news-security-2026-5-things-to-know-about-critical-php-vulne", "publisher": "CRN", "url": "https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation", "title": "5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation", "published": "2026-10-21 or 22 (date not in the text; the page refers to Wednesday 21 October)", "time_utc": null, "time_basis": "date not in the capture (21 or 22 Oct)", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/crn-news-security-2026-5-things-to-know-about-critical-php-vulne/captures/20261023T080331Z/text.txt", "sha256": "7e2214693dddacf72cedf3f64ad2898acb80fbee6504be4f8122dd7ddb481ee5", "sha256_from": "provenance.json", "excerpt": "“With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated,” researchers at Google-owned Wiz wrote in a post.", "location": "quote of someone", "value": 70, "denominator_text": "the Internet", "denominator_class": "internet", "qualifier": "none", "attribution": "Wiz (linked post)", "links_to_measurement": null, "role": "restates", "restates": "S-016", "language": "en", "translation": null, "notes": "Accurate quote of the Wiz conclusion ('70%' written as '70 percent').", "family": "F-1" }, { "id": "S-070", "slug": "insurance-business-au-asiapac-attacks-begin", "publisher": "Insurance Business", "url": "https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx", "title": "Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business", "published": "2026-10-22T11:59:56Z (modified 15:52:31Z, per the page's metadata)", "time_utc": "2026-10-22T00:59:56Z", "time_basis": "datePublished 00:59:56Z vs article:published_time 11:59:56Z (conflict); modified 15:52Z", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/insurance-business-au-asiapac-attacks-begin/captures/20261023T012042Z/text.txt", "sha256": "8d88bddde485e36f27c001a80e9ad0506055b64f3879347345be5ad336a10cad", "sha256_from": "provenance.json", "excerpt": "crucial bugs found in software that runs around 70% of the web", "location": "lede", "value": 70, "denominator_text": "the web", "denominator_class": "internet", "qualifier": "around", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-036", "language": "en", "translation": null, "notes": "Same author (Matthew Sellers) and dek wording as the UK story.", "family": "F-1" }, { "id": "S-071", "slug": "insurance-business-au-asiapac-attacks-begin", "publisher": "Insurance Business", "url": "https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx", "title": "Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business", "published": "2026-10-22T11:59:56Z (modified 15:52:31Z, per the page's metadata)", "time_utc": "2026-10-22T00:59:56Z", "time_basis": "page metadata", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/insurance-business-au-asiapac-attacks-begin/captures/20261023T012042Z/text.txt", "sha256": "8d88bddde485e36f27c001a80e9ad0506055b64f3879347345be5ad336a10cad", "sha256_from": "provenance.json", "excerpt": "Web technology tracker W3Techs puts PHP’s share at around 70% of websites whose server-side language it can identify.", "location": "body", "value": 70, "denominator_text": "websites whose server-side language it can identify", "denominator_class": "websites-known-language", "qualifier": "around", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "Also 'the code behind most of the world’s websites'.", "family": "F-5" }, { "id": "S-072", "slug": "ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php", "publisher": "Information Age (ACS)", "url": "https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html", "title": "Govt sites go down after AI finds 'critical' PHP vulnerabilities | Information Age | ACS", "published": "2026-10-22T12:09 local (per the page)", "time_utc": "2026-10-22T01:09:00Z", "time_basis": "'2026-10-22T12:09 local (per the page)', AEDT assumed", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php/captures/20261023T080331Z/text.txt", "sha256": "640f80b25de71eba27f0e3c27d8ff99a44a1fbfbff094fbba106b66ca99af2c5", "sha256_from": "provenance.json", "excerpt": "PHP is estimated to be used on around 70 per cent of the world's websites and web applications.", "location": "body", "value": 70, "denominator_text": "the world's websites and web applications", "denominator_class": "applications", "qualifier": "around", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Adds web applications to the denominator. (No earlier statement in the vault with this exact wording.)", "family": "F-10" }, { "id": "S-073", "slug": "trak-stories-70-websites-at-security-risk-due", "publisher": "Trak.in", "url": "https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/", "title": "70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell - Trak.in - Indian Business of Tech, Mobile & Startups", "published": "2026-10-22T01:39:26+00:00", "time_utc": "2026-10-22T01:39:26Z", "time_basis": "page metadata; modified 01:52Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/trak-stories-70-websites-at-security-risk-due/captures/20261023T160435Z/text.txt", "sha256": "019553b7a67c18ab791515f5de15e32683828dbee3ffb981c370cf741299b786", "sha256_from": "provenance.json", "excerpt": "70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell", "location": "headline", "value": 70, "denominator_text": "Websites", "denominator_class": "unspecified", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "en", "translation": null, "notes": "Turns usage into 'at security risk'.", "family": "F-2" }, { "id": "S-074", "slug": "trak-stories-70-websites-at-security-risk-due", "publisher": "Trak.in", "url": "https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/", "title": "70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell - Trak.in - Indian Business of Tech, Mobile & Startups", "published": "2026-10-22T01:39:26+00:00", "time_utc": "2026-10-22T01:39:26Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/trak-stories-70-websites-at-security-risk-due/captures/20261023T160435Z/text.txt", "sha256": "019553b7a67c18ab791515f5de15e32683828dbee3ffb981c370cf741299b786", "sha256_from": "provenance.json", "excerpt": "PHP powers an estimated 70% of websites worldwide, according to Wiz’s research.", "location": "body", "value": 70, "denominator_text": "websites worldwide", "denominator_class": "websites-all", "qualifier": "an estimated", "attribution": "Wiz", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Also 'a large portion of the internet' in the lede.", "family": "F-2" }, { "id": "S-075", "slug": "nsa-x-2113068811058622971", "publisher": "NSA Cybersecurity (@NSACyber)", "url": "https://x.com/NSACyber/status/2113068811058622971", "title": "NSA Cyber on X: UPDATE: Specific mitigation guidance ... now available", "published": "2026-10-22T00:43:58Z", "time_utc": "2026-10-22T02:10:00Z", "time_basis": "approximate: reply by @enoughtanu shown as '6h' in a capture taken 08:09Z", "captures": [ "20261022T080954Z" ], "excerpt_found_in": [ "20261022T080954Z" ], "file": "sources/nsa-x-2113068811058622971/captures/20261022T080954Z/text.txt", "sha256": "899e5ba4af69c5311210a846d98721e674abded497de292dfdc4af17b2ff1bd3", "sha256_from": "provenance.json", "excerpt": "the NSA just told 70% of the internet to “turn it off and on again” except the “on again” part is optional", "location": "social post", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-008", "language": "en", "translation": null, "notes": "A reply under the NSA post, by Tanu singh (@enoughtanu); shows the internet framing as a meme.", "family": "F-1" }, { "id": "S-076", "slug": "computerworld-article-4238887-dos-fallos-criticos-de-p", "publisher": "COMPUTERWORLD ESPAÑA", "url": "https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html", "title": "Dos fallos críticos de PHP ponen en alerta a Internet | Computerworld.es", "published": "October 22, 2026", "time_utc": "2026-10-22T06:04:52Z", "time_basis": "page metadata (several datePublished values: 08:04:52+02:00 earliest)", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/computerworld-article-4238887-dos-fallos-criticos-de-p/captures/20261023T160435Z/text.txt", "sha256": "e008b157b0ff9821a0995ada3ad6e5895f5f361231721c4191868b050a77d886", "sha256_from": "provenance.json", "excerpt": "PHP sustenta el 70% de los sitios web, lo que supone un enorme riesgo de concentración.", "location": "body", "value": 70, "denominator_text": "los sitios web", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none (follows a quote of Forrester analyst Madelein van der Hout)", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "es", "translation": "PHP supports 70% of websites, which represents an enormous concentration risk.", "notes": "Sits between quotes of a Forrester analyst; not clear whether the 70% is hers.", "family": "F-2" }, { "id": "S-077", "slug": "bbc-live-ckgel5xp2xv9t", "publisher": "BBC News", "url": "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t", "title": "PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live", "published": "2026-10-22T06:16:24Z", "time_utc": "2026-10-22T06:16:24Z", "time_basis": "live page published 06:16:24Z (summary text; exact insertion time unknown). A post at 07:14 UTC (08:14 BST) repeats it: 'Cyber-security firm Wiz estimates that \"roughly 70%\" of the internet is affected by the PHP flaws. We haven't been able to verify that figure'", "captures": [ "20261022T080453Z", "20261022T080526Z", "20261022T080559Z" ], "excerpt_found_in": [ "20261022T080453Z", "20261022T080526Z", "20261022T080559Z" ], "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080453Z/text.txt", "sha256": "df1dbe6b553a8c004f6d950a1d606138f2795062d3225feaa37043d24343bc99", "sha256_from": "provenance.json", "excerpt": "with cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure.", "location": "lede", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "roughly", "attribution": "Wiz", "links_to_measurement": null, "role": "transforms", "restates": "S-016", "language": "en", "translation": null, "notes": "Puts 'roughly 70%' in quotation marks and credits it to Wiz, but no Wiz text in the vault (X post, blog, php2shell.com) contains 'roughly'. Origin of the quoted-'roughly' variant, which Cyber Express (06:54Z, with the same 'not independently verified' caveat), CNN Portugal ('cerca de 70%') and Koran Jakarta ('sekitar 70%', citing the BBC) repeat. The BBC says it cannot verify the figure. Same wording in all three captures and in the raw page fetched 07:55Z.", "family": "F-7" }, { "id": "S-078", "slug": "bitpage-php2shell-php-sicherheitsluecke-webseite", "publisher": "Bitpage.de", "url": "https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/", "title": "PHP2Shell: Wer offline ist, wer gepatcht hat und was zu tun ist - Bitpage.de", "published": "2026-10-22T06:21:47+00:00", "time_utc": "2026-10-22T06:21:47Z", "time_basis": "page metadata; modified 2026-10-23T08:37Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/bitpage-php2shell-php-sicherheitsluecke-webseite/captures/20261023T160435Z/text.txt", "sha256": "50d84bde38c55c1772d88500502e6aa7a1e20d4691519ca18654499441ad8786", "sha256_from": "provenance.json", "excerpt": "Laut W3Techs läuft PHP auf 69,3 Prozent aller Webseiten, deren serverseitige Sprache bekannt ist, Stand 21. Oktober.", "location": "body", "value": 69.3, "denominator_text": "aller Webseiten, deren serverseitige Sprache bekannt ist", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "de", "translation": "According to W3Techs, PHP runs on 69.3 percent of all websites whose server-side language is known, as of 21 October.", "notes": "Links W3Techs. Elsewhere in the same article: 'zwei Drittel des Webs' (two thirds of the web).", "family": "F-5" }, { "id": "S-079", "slug": "bitpage-php2shell-php-sicherheitsluecke-webseite", "publisher": "Bitpage.de", "url": "https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/", "title": "PHP2Shell: Wer offline ist, wer gepatcht hat und was zu tun ist - Bitpage.de", "published": "2026-10-22T06:21:47+00:00", "time_utc": "2026-10-22T06:21:47Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/bitpage-php2shell-php-sicherheitsluecke-webseite/captures/20261023T160435Z/text.txt", "sha256": "50d84bde38c55c1772d88500502e6aa7a1e20d4691519ca18654499441ad8786", "sha256_from": "provenance.json", "excerpt": "obwohl zwei Drittel des Webs auf ihrer Arbeit laufen", "location": "body", "value": 66.7, "denominator_text": "des Webs", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-078", "language": "de", "translation": "although two thirds of the web run on their work", "notes": "The only statement in the vault that rounds DOWN (two thirds), and it widens to 'the web'.", "family": "F-8" }, { "id": "S-080", "slug": "20min-fr-suisse-romande", "publisher": "20min.ch", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "title": "Faille de sécurité: Panne mondiale des sites web: la Suisse romande touchée - 20 minutes", "published": null, "time_utc": "2026-10-22T06:25:10Z", "time_basis": "page metadata", "captures": [ "20261022T081421Z" ], "excerpt_found_in": [ "20261022T081421Z" ], "file": "sources/20min-fr-suisse-romande/captures/20261022T081421Z/text.txt", "sha256": "97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4", "sha256_from": "provenance.json", "excerpt": "a des failles qui mettent en danger «70% du web mondial».AFP", "location": "body", "value": 70, "denominator_text": "web mondial", "denominator_class": "internet", "qualifier": "none", "attribution": "quoted, source unnamed (photo caption credited AFP)", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "fr", "translation": "has flaws that endanger '70% of the global web'. (AFP)", "notes": "Photo caption; the quote marks enclose a phrase with no named speaker. 'AFP' is the photo credit.", "family": "F-1" }, { "id": "S-081", "slug": "20min-fr-suisse-romande", "publisher": "20min.ch", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "title": "Faille de sécurité: Panne mondiale des sites web: la Suisse romande touchée - 20 minutes", "published": null, "time_utc": "2026-10-22T06:25:10Z", "time_basis": "page metadata", "captures": [ "20261022T081421Z" ], "excerpt_found_in": [ "20261022T081421Z" ], "file": "sources/20min-fr-suisse-romande/captures/20261022T081421Z/text.txt", "sha256": "97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4", "sha256_from": "provenance.json", "excerpt": "un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée", "location": "body", "value": 70, "denominator_text": "sites web dont la technologie est identifiée", "denominator_class": "websites-known-language", "qualifier": "around", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-004", "language": "fr", "translation": "a programming language used by around 70% of websites whose technology is identified", "notes": "Same article: caption says '70% of the global web', body says 'websites whose technology is identified'.", "family": "F-5" }, { "id": "S-082", "slug": "20-minuten-20min-fr-suisse-romande", "publisher": "20 minutes / 20 Minuten", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "title": "Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes", "published": "2026-10-22T06:25:10.292Z", "time_utc": "2026-10-22T06:25:10Z", "time_basis": "page metadata", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/20-minuten-20min-fr-suisse-romande/captures/20261022T181608Z/text.txt", "sha256": "d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65", "sha256_from": "provenance.json", "excerpt": "a des failles qui mettent en danger «70% du web mondial».AFP", "location": "body", "value": 70, "denominator_text": "web mondial", "denominator_class": "internet", "qualifier": "none", "attribution": "quoted, source unnamed", "links_to_measurement": null, "role": "restates", "restates": "S-080", "language": "fr", "translation": "has flaws that endanger '70% of the global web'.", "notes": "Same URL, captured 18:16Z; the headline changed ('la Suisse romande touchée' to 'fortement impactée') but both 70% sentences are unchanged.", "family": "F-1" }, { "id": "S-083", "slug": "20-minuten-20min-fr-suisse-romande", "publisher": "20 minutes / 20 Minuten", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "title": "Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes", "published": "2026-10-22T06:25:10.292Z", "time_utc": "2026-10-22T06:25:10Z", "time_basis": "page metadata", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/20-minuten-20min-fr-suisse-romande/captures/20261022T181608Z/text.txt", "sha256": "d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65", "sha256_from": "provenance.json", "excerpt": "un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée", "location": "body", "value": 70, "denominator_text": "sites web dont la technologie est identifiée", "denominator_class": "websites-known-language", "qualifier": "around", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-081", "language": "fr", "translation": "a programming language used by around 70% of websites whose technology is identified", "notes": "Unchanged from the 08:14Z capture.", "family": "F-5" }, { "id": "S-084", "slug": "orf-stories-3445806", "publisher": "ORF", "url": "https://orf.at/stories/3445806/", "title": "PHP-Lücke: Millionen Angriffsversuche im Netz - news.ORF.at", "published": null, "time_utc": "2026-10-22T06:39:12Z", "time_basis": "page metadata; modified 08:21Z", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/orf-stories-3445806/captures/20261022T181608Z/text.txt", "sha256": "e88c6f39edbd6d1c325ec7cc18abe50a9b8ad94010b2d5a425ba59e4252b2d0d", "sha256_from": "provenance.json", "excerpt": "Nach Einschätzung des US-israelischen Cybersicherheitsunternehmen Wiz basieren etwa 70 Prozent der weltweiten Websites auf PHP.", "location": "body", "value": 70, "denominator_text": "der weltweiten Websites", "denominator_class": "websites-all", "qualifier": "around", "attribution": "Wiz", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "de", "translation": "According to the assessment of the US-Israeli cybersecurity company Wiz, about 70 percent of the world's websites are based on PHP.", "notes": "Adds 'etwa' (about).", "family": "F-2" }, { "id": "S-085", "slug": "cyberexpress-php2shell-gov-sites", "publisher": "The Cyber Express", "url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/", "title": "PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites", "published": "2026-10-21", "time_utc": "2026-10-22T06:54:10Z", "time_basis": "page metadata", "captures": [ "20261022T112646Z" ], "excerpt_found_in": [ "20261022T112646Z" ], "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "sha256_from": "provenance.json", "excerpt": "It estimates “roughly 70%” of the internet is affected; a figure not independently verified.", "location": "body", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "roughly", "attribution": "Wiz", "links_to_measurement": null, "role": "restates", "restates": "S-077", "language": "en", "translation": null, "notes": "Probably follows the BBC (same quoted 'roughly 70%' credited to Wiz and the same 'not independently verified' caveat); the BBC live page went up at 06:16Z. Also: 'PHP runs server-side on a large share, though not all, of the internet'.", "family": "F-7" }, { "id": "S-086", "slug": "tagesspiegel-dpa-noch-offline", "publisher": "tagesspiegel.de", "url": "https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-millionen-hacker-versuche-viele-webseiten-noch-offline-16186782.html", "title": "Sicherheitslücke: „Millionen“ Hacker-Versuche: Viele Webseiten noch offline", "published": null, "time_utc": "2026-10-22T07:06:28Z", "time_basis": "page metadata", "captures": [ "20261022T081509Z" ], "excerpt_found_in": [ "20261022T081509Z" ], "file": "sources/tagesspiegel-dpa-noch-offline/captures/20261022T081509Z/text.txt", "sha256": "0255857572a7411c4f2c88bf5ff7fd00a0bcb89cfca6f84234f0a55999ff3c79", "sha256_from": "provenance.json", "excerpt": "PHP, auf der ein Großteil des gesamten Internets basiert", "location": "body", "value": null, "denominator_text": "des gesamten Internets", "denominator_class": "internet", "qualifier": "a large part", "attribution": "none (dpa wire)", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "de", "translation": "PHP, on which a large part of the entire Internet is based", "notes": "dpa wire; qualitative. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-087", "slug": "ai4business-intelligenza-artificiale-php2shell-lai-s", "publisher": "AI4Business", "url": "https://www.ai4business.it/intelligenza-artificiale/php2shell-lai-scopre-falle-critiche-in-php-attacchi-gia-iniziati/", "title": "PHP2Shell: l’AI scopre falle critiche in PHP, attacchi già iniziati - AI4Business", "published": "2026-10-22T07:28:03+00:00", "time_utc": "2026-10-22T07:28:03Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/ai4business-intelligenza-artificiale-php2shell-lai-s/captures/20261023T160435Z/text.txt", "sha256": "0a757e69b13b1d9d4abb3f75ab2ceffd5627a758332d38335e6eb0e587c8248e", "sha256_from": "provenance.json", "excerpt": "Secondo W3Techs, il 21 ottobre il linguaggio era impiegato dal 69,3% dei siti dei quali è identificabile la tecnologia server.", "location": "body", "value": 69.3, "denominator_text": "siti dei quali è identificabile la tecnologia server", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/breakdown/pl-PHP/ranking", "role": "measures", "restates": null, "language": "it", "translation": "According to W3Techs, on 21 October the language was used by 69.3% of the sites whose server technology is identifiable.", "notes": "Also a chart 'PHP · 69,3% Quota dei siti con linguaggio server identificabile ... Fonte: W3Techs, 21 ottobre 2026'.", "family": "F-5" }, { "id": "S-088", "slug": "cnnportugal-php", "publisher": "cnnportugal.iol.pt", "url": "https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2", "title": "\"Um dos incidentes mais impactantes da memória recente\": o que se está a passar na Internet? - CNN Portugal", "published": null, "time_utc": "2026-10-22T07:41:00Z", "time_basis": "page metadata 08:41+01:00", "captures": [ "20261022T081548Z" ], "excerpt_found_in": [ "20261022T081548Z" ], "file": "sources/cnnportugal-php/captures/20261022T081548Z/text.txt", "sha256": "de3c730717888f1395fbb1acc2b293846e9b0bf90bc7104fec23d64aad5886c2", "sha256_from": "provenance.json", "excerpt": "De acordo com a empresa de cibersegurança Wiz, “cerca de 70%” de toda a Internet estará a ser afetada por este problema", "location": "body", "value": 70, "denominator_text": "toda a Internet", "denominator_class": "internet", "qualifier": "around", "attribution": "Wiz", "links_to_measurement": null, "role": "restates", "restates": "S-077", "language": "pt", "translation": "According to cybersecurity firm Wiz, 'around 70%' of the whole Internet is being affected by this problem", "notes": "Translates the BBC's quoted 'roughly 70%' and adds 'toda' (the whole).", "family": "F-7" }, { "id": "S-089", "slug": "koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana", "publisher": "Koran Jakarta ®", "url": "https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang", "title": "Upaya Global Perbaiki Celah Keamanan Siber PHP, dari Amazon hingga Kementerian Jepang", "published": null, "time_utc": "2026-10-22T07:47:00Z", "time_basis": "page metadata 14:47+07:00", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana/captures/20261022T181608Z/text.txt", "sha256": "f5c3e92816a8aaf3d21543436c76aa52fac6863eada37a37eb37b0618a5f987d", "sha256_from": "provenance.json", "excerpt": "Perusahaan keamanan siber Wiz memperkirakan \"sekitar 70%\" internet terpengaruh oleh celah keamanan PHP.", "location": "body", "value": 70, "denominator_text": "internet", "denominator_class": "internet", "qualifier": "around", "attribution": "Wiz (via BBC report)", "links_to_measurement": null, "role": "restates", "restates": "S-077", "language": "id", "translation": "Cybersecurity firm Wiz estimates 'around 70%' of the internet is affected by the PHP security flaw.", "notes": "Explicitly 'mengutip laporan BBC' (citing the BBC report).", "family": "F-7" }, { "id": "S-090", "slug": "tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell", "publisher": "SAPO Tek", "url": "https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/", "title": "Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias", "published": "2026-10-22T07:50:00+00:00", "time_utc": "2026-10-22T07:50:00Z", "time_basis": "page metadata; modified 16:49Z", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell/captures/20261022T181608Z/text.txt", "sha256": "7203d6e735dd3989c864ca946af9c9743d051148d4c016d9fc4c0af587b4023a", "sha256_from": "provenance.json", "excerpt": "Entre os sites com domínio .pt cuja tecnologia é identificável, 74,4% correm em PHP", "location": "body", "value": 74.4, "denominator_text": "sites com domínio .pt cuja tecnologia é identificável", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/segmentation/tld-pt-/programming_language", "role": "measures", "restates": null, "language": "pt", "translation": "Among .pt sites whose technology is identifiable, 74.4% run on PHP", "notes": "A national segment (.pt), not the global share. Same page: 'Três em cada quatro sites portugueses correm em PHP' (three in four Portuguese sites) and 'a linguagem em que corre a maior parte da web'.", "family": "F-12" }, { "id": "S-091", "slug": "tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell", "publisher": "SAPO Tek", "url": "https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/", "title": "Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias", "published": "2026-10-22T07:50:00+00:00", "time_utc": "2026-10-22T07:50:00Z", "time_basis": "page metadata", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell/captures/20261022T181608Z/text.txt", "sha256": "7203d6e735dd3989c864ca946af9c9743d051148d4c016d9fc4c0af587b4023a", "sha256_from": "provenance.json", "excerpt": "o PHP, a linguagem em que corre a maior parte da web", "location": "lede", "value": null, "denominator_text": "da web", "denominator_class": "internet", "qualifier": "most", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "pt", "translation": "PHP, the language most of the web runs on", "notes": "Qualitative. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-092", "slug": "20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit", "publisher": "20Minutos", "url": "https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html", "title": "Alerta de PHP: por qué gobiernos, hospitales y colegios desconectan sus webs", "published": "2026-10-22T09:57:42+02:00", "time_utc": "2026-10-22T07:57:42Z", "time_basis": "page metadata", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit/captures/20261022T181608Z/text.txt", "sha256": "96ea536b04fe59c76df5ae9fc13efbf08dc59d6eeb8232b7d4c22a85becff632", "sha256_from": "provenance.json", "excerpt": "Dos fallos \"críticos\" en el lenguaje de programación PHP ponen en riesgo cerca del 70% de las páginas web de todo el mundo", "location": "body", "value": 70, "denominator_text": "las páginas web de todo el mundo", "denominator_class": "websites-all", "qualifier": "around", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "es", "translation": "Two 'critical' flaws in the PHP programming language put at risk around 70% of the web pages in the whole world", "notes": "Related-article headline repeated on the page; turns usage into risk.", "family": "F-2" }, { "id": "S-093", "slug": "news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94", "publisher": "Yahoo!ニュース", "url": "https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6", "title": "【図解】重大な脆弱性が見つかった「PHP」とは？（Yahoo!ニュース オリジナル THE PAGE）", "published": "not stated in the capture", "time_utc": "2026-10-22T08:14:41Z", "time_basis": "page metadata of the Yahoo! page; the line is a related-video headline listed on it", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94/captures/20261023T160435Z/text.txt", "sha256": "3f6309ea905ada2a3609b89da18be043419e1e2c246a6acd26772a44a06cdee3", "sha256_from": "provenance.json", "excerpt": "世界の7割で使用『PHP』とは？", "location": "headline", "value": 70, "denominator_text": "世界 (the world)", "denominator_class": "unspecified", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "ja", "translation": "What is 'PHP', used by 70% of the world?", "notes": "Related headline on Yahoo! News Japan (Jiji-based page). The denominator is just 'the world'.", "family": "F-2" }, { "id": "S-094", "slug": "news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94", "publisher": "Yahoo!ニュース", "url": "https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6", "title": "【図解】重大な脆弱性が見つかった「PHP」とは？（Yahoo!ニュース オリジナル THE PAGE）", "published": "not stated in the capture", "time_utc": "2026-10-22T08:14:41Z", "time_basis": "page metadata; related-article headline", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94/captures/20261023T160435Z/text.txt", "sha256": "3f6309ea905ada2a3609b89da18be043419e1e2c246a6acd26772a44a06cdee3", "sha256_from": "provenance.json", "excerpt": "世界のサイト7割が危険に", "location": "headline", "value": 70, "denominator_text": "世界のサイト (the world's sites)", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "ja", "translation": "70% of the world's sites at risk", "notes": "Related headline; usage turned into risk.", "family": "F-2" }, { "id": "S-095", "slug": "linternaute-hightech-internet-11310057-panne-interne", "publisher": "Linternaute.com", "url": "https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/", "title": "Failles PHP : c'est quoi ? On vous explique la panique mondiale sur internet, l'IA au coeur du problème", "published": "2026-10-22T19:36:04+02:00", "time_utc": "2026-10-22T08:30:11Z", "time_basis": "earliest datePublished 10:30:11+02:00; later versions 18:44, 18:58 and 19:36+02:00", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/linternaute-hightech-internet-11310057-panne-interne/captures/20261023T160435Z/text.txt", "sha256": "940e7811d3ae55de70fd3dac417e2c383c58e2a555b36c27a5e1a39140fa0a6b", "sha256_from": "provenance.json", "excerpt": "un langage de programmation qui structure près de 70% des sites web dans le monde.", "location": "body", "value": 70, "denominator_text": "sites web dans le monde", "denominator_class": "websites-all", "qualifier": "nearly", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "fr", "translation": "a programming language that structures nearly 70% of websites in the world.", "notes": "Page republished several times on 22 Oct; the capture reflects the 19:36 version.", "family": "F-2" }, { "id": "S-096", "slug": "criticarad-php2shell-cve-2026-109618-ghid-patch", "publisher": "Critic Arad", "url": "https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/", "title": "PHP2Shell | Panică mondială și ghidul complet de patch", "published": "2026-10-22T12:02:38+03:00", "time_utc": "2026-10-22T09:02:38Z", "time_basis": "page metadata 12:02+03:00", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/criticarad-php2shell-cve-2026-109618-ghid-patch/captures/20261023T160435Z/text.txt", "sha256": "2f3acccf122140590c9aec1ab56e7076bc1f9c3a6e5f0b693a80f742162a205c", "sha256_from": "provenance.json", "excerpt": "E în PHP însuși, limbajul pe care rulează aproximativ 70% din web.", "location": "lede", "value": 70, "denominator_text": "din web", "denominator_class": "internet", "qualifier": "approximately", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "ro", "translation": "It is in PHP itself, the language on which approximately 70% of the web runs.", "notes": "Lede says 'of the web'; body gives the W3Techs measure. (No earlier statement in the vault with this exact wording.)", "family": "F-1" }, { "id": "S-097", "slug": "criticarad-php2shell-cve-2026-109618-ghid-patch", "publisher": "Critic Arad", "url": "https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/", "title": "PHP2Shell | Panică mondială și ghidul complet de patch", "published": "2026-10-22T12:02:38+03:00", "time_utc": "2026-10-22T09:02:38Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/criticarad-php2shell-cve-2026-109618-ghid-patch/captures/20261023T160435Z/text.txt", "sha256": "2f3acccf122140590c9aec1ab56e7076bc1f9c3a6e5f0b693a80f742162a205c", "sha256_from": "provenance.json", "excerpt": "potrivit W3Techs, PHP rulează pe 69,3% dintre site-urile cu limbaj server identificabil.", "location": "body", "value": 69.3, "denominator_text": "site-urile cu limbaj server identificabil", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "ro", "translation": "according to W3Techs, PHP runs on 69.3% of sites with an identifiable server language.", "notes": "Links W3Techs.", "family": "F-5" }, { "id": "S-098", "slug": "cybernews-php2shell-millions", "publisher": "Cybernews", "url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/", "title": "PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernews", "published": "2026-10-22", "time_utc": "2026-10-22T09:27:00Z", "time_basis": "page metadata; modified 11:22Z", "captures": [ "20261022T112703Z" ], "excerpt_found_in": [ "20261022T112703Z" ], "file": "sources/cybernews-php2shell-millions/captures/20261022T112703Z/text.txt", "sha256": "a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb", "sha256_from": "provenance.json", "excerpt": "the programming language underpinning about 70% of known websites on the internet.", "location": "body", "value": 70, "denominator_text": "known websites on the internet", "denominator_class": "websites-known-language", "qualifier": "about", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-004", "language": "en", "translation": null, "notes": "'known websites' is a garbled form of 'websites whose server-side language is known'.", "family": "F-5" }, { "id": "S-099", "slug": "blogdumoderateur-failles-critiques-php-versions-mettre-a", "publisher": "BDM", "url": "https://www.blogdumoderateur.com/failles-critiques-php-versions-mettre-a-jour-comment-proteger-serveurs/", "title": "Failles critiques dans PHP : quelles versions mettre à jour et comment protéger ses serveurs", "published": "2026-10-22T11:32:58+02:00", "time_utc": "2026-10-22T09:32:58Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/blogdumoderateur-failles-critiques-php-versions-mettre-a/captures/20261023T160435Z/text.txt", "sha256": "795b299b2ea070a2915cafe3d2c86387b6ce281a3932d3cbbc183fa4cca9b2d0", "sha256_from": "provenance.json", "excerpt": "PHP fait fonctionner 69,3 % des sites dont le langage serveur est identifié, selon W3Techs", "location": "body", "value": 69.3, "denominator_text": "sites dont le langage serveur est identifié", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "fr", "translation": "PHP runs 69.3% of sites whose server language is identified, according to W3Techs", "notes": "Links W3Techs.", "family": "F-5" }, { "id": "S-100", "slug": "infosecurity-magazine-news-php2shell-exploitation-attempt", "publisher": "Infosecurity Magazine", "url": "https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/", "title": "PHP2Shell Exploitation Attempt Detected Four Days Before Disclosure - Infosecurity Magazine", "published": "2026-10-22T10:10:00", "time_utc": "2026-10-22T10:10:00Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/infosecurity-magazine-news-php2shell-exploitation-attempt/captures/20261023T160435Z/text.txt", "sha256": "723f0a0bfb538e435f2f44a92033c7e84a12742ff11daff23cba69a7ddf1df8d", "sha256_from": "provenance.json", "excerpt": "PHP is used by approximately 69.7% of websites whose server-side programming language is known, according to recent W3Techs data.", "location": "body", "value": 69.7, "denominator_text": "websites whose server-side programming language is known", "denominator_class": "websites-known-language", "qualifier": "approximately", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/comparison/pl-php", "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "69.7% differs from the 69.3% others cite for 21 October (different W3Techs page or date). The link is to a W3Techs comparison page; its Wiz link carries utm_source=chatgpt.com.", "family": "F-5" }, { "id": "S-101", "slug": "in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet", "publisher": "Mashable India", "url": "https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on", "title": "FBI Releases PHP2Shell Advisory As The Internet Explodes In Hilarious PHP Memes; Here Are The Best Ones", "published": "2026-10-22", "time_utc": "2026-10-22T10:53:21Z", "time_basis": "page metadata", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet/captures/20261023T080331Z/text.txt", "sha256": "072bc5f150b26f629c58d74b6a3e20e8f6b35a9e8d53fdcc2ce072df0ac34acb", "sha256_from": "provenance.json", "excerpt": "About 70 percent of websites run on PHP, according to Wiz Research, the security firm that found the bugs.", "location": "body", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "about", "attribution": "Wiz Research", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "A 'See Also' headline on the same page: 'Google, AWS & Microsoft Address PHP2Shell Vulnerability That Is Affecting 70% Of Internet'.", "family": "F-2" }, { "id": "S-102", "slug": "in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet", "publisher": "Mashable India", "url": "https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on", "title": "FBI Releases PHP2Shell Advisory As The Internet Explodes In Hilarious PHP Memes; Here Are The Best Ones", "published": "2026-10-22", "time_utc": "2026-10-22T10:53:21Z", "time_basis": "page metadata (related headline)", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet/captures/20261023T080331Z/text.txt", "sha256": "072bc5f150b26f629c58d74b6a3e20e8f6b35a9e8d53fdcc2ce072df0ac34acb", "sha256_from": "provenance.json", "excerpt": "PHP2Shell Vulnerability That Is Affecting 70% Of Internet", "location": "headline", "value": 70, "denominator_text": "Internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "Related 'See Also' headline.", "family": "F-1" }, { "id": "S-103", "slug": "wikipedia-php2shell", "publisher": "Wikipedia (English)", "url": "https://en.wikipedia.org/wiki/PHP2Shell", "title": "PHP2Shell - Wikipedia", "published": null, "time_utc": "2026-10-22T11:12:29Z", "time_basis": "revision dateModified (article created 2026-10-21T07:50:01Z)", "captures": [ "20261022T112309Z" ], "excerpt_found_in": [ "20261022T112309Z" ], "file": "sources/wikipedia-php2shell/captures/20261022T112309Z/text.txt", "sha256": "bbb51bbd069506b09282b45086984565ae875b5d974d121584c8e2b3c912222f", "sha256_from": "provenance.json", "excerpt": "Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress", "location": "body", "value": 69, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "approximately", "attribution": "refs [24][25] (ref 24 is NBC News, Kevin Collier)", "links_to_measurement": null, "role": "restates", "restates": "S-004", "language": "en", "translation": null, "notes": "Drops the known-language denominator. Its reference list also cites the Wiz '70% of the Internet' and WSJ 'up to 70% of the World's Websites' headlines.", "family": "F-5" }, { "id": "S-104", "slug": "salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic", "publisher": "salzburg24", "url": "https://www.salzburg24.at/news/oesterreich/massive-sache-folgen-der-php-sicherheitsluecke-fuer-heimische-wirtschaft-noch-unklar-art-342173", "title": "\"Massive Sache\": Folgen der PHP-Sicherheitslücke für heimische Wirtschaft noch unklar - Salzburg24.at", "published": "2026-10-22T13:23:30+02:00", "time_utc": "2026-10-22T11:23:30Z", "time_basis": "page metadata; modified 16:28Z", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic/captures/20261022T181608Z/text.txt", "sha256": "c08f50a226214f7bc04c16d3d05dce23038cc1a460fa4349860046d0f0a1e74f", "sha256_from": "provenance.json", "excerpt": "Ungefähr zwei Drittel bis drei Viertel aller Websites bauen auf PHP auf.", "location": "body", "value": 70.8, "denominator_text": "aller Websites", "denominator_class": "websites-all", "qualifier": "roughly two thirds to three quarters", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "de", "translation": "Roughly two thirds to three quarters of all websites are built on PHP.", "notes": "Range 66.7-75%; value is the midpoint. Also 'Ein Großteil aller Internetseiten nutzt PHP'. (No earlier statement in the vault with this exact wording.)", "family": "F-8" }, { "id": "S-105", "slug": "marketing4ecommerce-crisis-seguridad-php", "publisher": "Marketing4eCommerce", "url": "https://marketing4ecommerce.net/crisis-seguridad-php/", "title": "La crisis de seguridad en PHP, explicada para dummies", "published": "2026-10-22T11:40:23+00:00", "time_utc": "2026-10-22T11:40:23Z", "time_basis": "page metadata; modified 2026-10-23T11:24Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/marketing4ecommerce-crisis-seguridad-php/captures/20261023T160435Z/text.txt", "sha256": "f6697167654f81fa7d28a48e73539bfc43e7c2851bae6a17daabc65ab7caea36", "sha256_from": "provenance.json", "excerpt": "Según datos de W3Techs, PHP está presente en el 69,3% de las webs con lenguaje de servidor identificado. Otras estimaciones sitúan su presencia entre el 72% y el 79%.", "location": "body", "value": 69.3, "denominator_text": "las webs con lenguaje de servidor identificado", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs; 'other estimates' 72-79% unnamed; BuiltWith for a count", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "es", "translation": "According to W3Techs data, PHP is present on 69.3% of websites with an identified server language. Other estimates put its presence between 72% and 79%.", "notes": "Links W3Techs and BuiltWith (trends.builtwith.com, cited for '24 millones de webs', a count, not a share). The 72-79% range has no source.", "family": "F-5" }, { "id": "S-106", "slug": "eadt-minister-budget-no-breach", "publisher": "East Anglian Daily Times (PA)", "url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/", "title": "No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times", "published": "2026-10-21", "time_utc": "2026-10-22T12:22:17Z", "time_basis": "page metadata", "captures": [ "20261022T112742Z" ], "excerpt_found_in": [ "20261022T112742Z" ], "file": "sources/eadt-minister-budget-no-breach/captures/20261022T112742Z/text.txt", "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "sha256_from": "provenance.json", "excerpt": "the programming language PHP, used by almost 70% of websites according cybersecurity firm Cloudflare.", "location": "body", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "almost", "attribution": "Cloudflare", "links_to_measurement": null, "role": "restates", "restates": "S-013", "language": "en", "translation": null, "notes": "PA wire copy. Credits Cloudflare, whose post took the figure from W3Techs; the attribution skips the measurement. Lede: 'a programming language used by the majority of websites'.", "family": "F-4" }, { "id": "S-107", "slug": "eadt-minister-budget-no-breach", "publisher": "East Anglian Daily Times (PA)", "url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/", "title": "No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times", "published": "2026-10-21", "time_utc": "2026-10-22T12:22:17Z", "time_basis": "page metadata", "captures": [ "20261022T112742Z" ], "excerpt_found_in": [ "20261022T112742Z" ], "file": "sources/eadt-minister-budget-no-breach/captures/20261022T112742Z/text.txt", "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "sha256_from": "provenance.json", "excerpt": "a critical security flaw in a programming language used by the majority of websites", "location": "lede", "value": null, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "the majority", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "en", "translation": null, "notes": "PA wire lede; body credits 'almost 70%' to Cloudflare. (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-108", "slug": "moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu", "publisher": "Morocco World News", "url": "https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/", "title": "Morocco’s DGSSI Warns of Critical ‘PHP2Shell’ Vulnerabilities", "published": "2026-10-22", "time_utc": "2026-10-22T12:36:54Z", "time_basis": "page metadata", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu/captures/20261023T080331Z/text.txt", "sha256": "56b8e97d863b6884f74d8af7f5d2b7cae0e071eb875027895e35e8c483eaacdc", "sha256_from": "provenance.json", "excerpt": "is used by 75.4% of .ma websites whose server-side language can be identified, according to W3Techs data.", "location": "lede", "value": 75.4, "denominator_text": ".ma websites whose server-side language can be identified", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": null, "role": "measures", "restates": null, "language": "en", "translation": null, "notes": "National segment (.ma), not the global share.", "family": "F-12" }, { "id": "S-109", "slug": "medianama-2026-10-223-php-vulnerabilities-global-rush-update", "publisher": "MediaNama", "url": "https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/", "title": "What are the two PHP vulnerabilities behind a global rush to update", "published": "2026-10-22", "time_utc": "2026-10-22T12:47:51Z", "time_basis": "page metadata; modified 2026-10-23T04:43Z", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/medianama-2026-10-223-php-vulnerabilities-global-rush-update/captures/20261023T080331Z/text.txt", "sha256": "b30b86dc910dc8d60cbb6deaf6383d04f99c68b984c5d04673dd949e1cb4f04d", "sha256_from": "provenance.json", "excerpt": "PHP, the programming language behind around 70% of the internet", "location": "lede", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "around", "attribution": "W3Techs (by hyperlink only)", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Key transformation point: the anchor '70% of the internet,' links the W3Techs page, which measures websites with a known server-side language. Measurement cited, denominator changed. (No earlier statement in the vault with this exact wording.)", "family": "F-1" }, { "id": "S-110", "slug": "bleepingcomputer-amazon-4-days-before", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/", "title": "Amazon says PHP2Shell exploitation began 4 days before patches", "published": null, "time_utc": "2026-10-22T13:09:12Z", "time_basis": "page metadata 09:09:12-04:00; modified 21:34Z", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/bleepingcomputer-amazon-4-days-before/captures/20261023T012042Z/text.txt", "sha256": "2978662261ce3880962943cd129485066fab46e3bc7a181762dbe83479aa8997", "sha256_from": "provenance.json", "excerpt": "PHP (Hypertext Preprocessor) is an open-source web development language that powers up to 80% of all websites on the Internet", "location": "body", "value": 80, "denominator_text": "all websites on the Internet", "denominator_class": "websites-all", "qualifier": "up to", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-018", "language": "en", "translation": null, "notes": "BleepingComputer's second story moves from '75% to 80%' to 'up to 80%'.", "family": "F-9" }, { "id": "S-111", "slug": "clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv", "publisher": "Clarin (English edition)", "url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html", "title": "PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet", "published": "2026-10-22T13:38", "time_utc": "2026-10-22T13:38:41Z", "time_basis": "page metadata", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/captures/20261023T080331Z/text.txt", "sha256": "c11dd717273bac9546aaf433f103637af20d579a0fb1ba06943929d81a70e82d", "sha256_from": "provenance.json", "excerpt": "How AI uncovered a massive 14-year-old flaw threatening 70% of the internet", "location": "headline", "value": 70, "denominator_text": "the internet", "denominator_class": "internet", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "Dek: 'A flaw buried for over a decade in the code running 70% of the internet'. Subhead: 'Why 'PHP2Shell' Endangers 70% of the Web'.", "family": "F-1" }, { "id": "S-112", "slug": "clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv", "publisher": "Clarin (English edition)", "url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html", "title": "PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet", "published": "2026-10-22T13:38", "time_utc": "2026-10-22T13:38:41Z", "time_basis": "page metadata", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/captures/20261023T080331Z/text.txt", "sha256": "c11dd717273bac9546aaf433f103637af20d579a0fb1ba06943929d81a70e82d", "sha256_from": "provenance.json", "excerpt": "The open-source language serves as the backbone of roughly 70 percent of all web applications and websites worldwide", "location": "body", "value": 70, "denominator_text": "all web applications and websites worldwide", "denominator_class": "applications", "qualifier": "roughly", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "en", "translation": null, "notes": "Adds 'all web applications'. The page also embeds OpenAI's post ('an estimated 70% of websites').", "family": "F-10" }, { "id": "S-113", "slug": "clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv", "publisher": "Clarin (English edition)", "url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html", "title": "PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet", "published": "2026-10-22T13:38", "time_utc": "2026-10-22T13:38:41Z", "time_basis": "page metadata", "captures": [ "20261023T080331Z" ], "excerpt_found_in": [ "20261023T080331Z" ], "file": "sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/captures/20261023T080331Z/text.txt", "sha256": "c11dd717273bac9546aaf433f103637af20d579a0fb1ba06943929d81a70e82d", "sha256_from": "provenance.json", "excerpt": "an open-source programming language used to run an estimated 70% of websites.", "location": "quote of someone", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "an estimated", "attribution": "OpenAI (embedded X post)", "links_to_measurement": null, "role": "restates", "restates": "S-017", "language": "en", "translation": null, "notes": "Embedded post.", "family": "F-3" }, { "id": "S-114", "slug": "tuttotech-news-2026-10-22-vulnerabilita-php-html", "publisher": "TuttoTech.net", "url": "https://www.tuttotech.net/news/2026/10/22/vulnerabilita-php.html", "title": "Due gravi falle in PHP mandano offline i siti web governativi", "published": "2026-10-22T16:41:29+02:00", "time_utc": "2026-10-22T14:41:29Z", "time_basis": "page metadata", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/tuttotech-news-2026-10-22-vulnerabilita-php-html/captures/20261022T181608Z/text.txt", "sha256": "cd3f99c6c9f942595087eaa47ae8e71639cd4526a4453110ddd6a6365de3ae26", "sha256_from": "provenance.json", "excerpt": "Secondo W3Techs, PHP è utilizzato da circa il 75% dei siti web per i quali è possibile identificare il linguaggio di programmazione.", "location": "body", "value": 75, "denominator_text": "siti web per i quali è possibile identificare il linguaggio di programmazione", "denominator_class": "websites-known-language", "qualifier": "around", "attribution": "W3Techs", "links_to_measurement": null, "role": "restates", "restates": "S-002", "language": "it", "translation": "According to W3Techs, PHP is used by around 75% of websites whose programming language can be identified.", "notes": "Repeats the Reuters 75% (with Reuters' 'programming language can be identified' wording), not the W3Techs 69.3%.", "family": "F-6" }, { "id": "S-115", "slug": "the-verge-php2shell-websites-down", "publisher": "The Verge", "url": "https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down", "title": "Everything we know so far about the PHP2Shell vulnerability | The Verge", "published": "2026-10-22T15:12:27Z (modified 16:49:48Z, per the page's metadata)", "time_utc": "2026-10-22T15:12:27Z", "time_basis": "page metadata; modified 16:49Z", "captures": [ "20261023T012042Z" ], "excerpt_found_in": [ "20261023T012042Z" ], "file": "sources/the-verge-php2shell-websites-down/captures/20261023T012042Z/text.txt", "sha256": "1a9a20537e477cc84bdd688c3d13f165e980a7bae0aa54bd2f88011d32d3b3d3", "sha256_from": "provenance.json", "excerpt": "By some accounts, up to 70 percent of websites use PHP in some capacity.", "location": "lede", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "up to", "attribution": "'some accounts' (WSJ linked elsewhere in the story)", "links_to_measurement": null, "role": "restates", "restates": "S-024", "language": "en", "translation": null, "notes": "'up to' tracks the WSJ headline; also 'enormous swaths of the internet' and 'a large portion of the internet'.", "family": "F-2" }, { "id": "S-116", "slug": "lesaffaires-opinions-php2shell-ce-quil-faut-en-reten", "publisher": "Les Affaires", "url": "https://www.lesaffaires.com/opinions/php2shell-ce-quil-faut-en-retenir/", "title": "PHP2Shell: ce qu’il faut retenir des failles révélées cette semaine - Les Affaires", "published": "2026-10-22T15:14:06+00:00", "time_utc": "2026-10-22T15:14:06Z", "time_basis": "page metadata; modified 23:05Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/lesaffaires-opinions-php2shell-ce-quil-faut-en-reten/captures/20261023T160435Z/text.txt", "sha256": "d70540e1f61d216bb6281a083b5e728524b4ec3f55e1bfe492fda10fedf69ab8", "sha256_from": "provenance.json", "excerpt": "PHP: c’est la fondation de la majorité des sites web.", "location": "body", "value": null, "denominator_text": "des sites web", "denominator_class": "unspecified", "qualifier": "the majority", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "fr", "translation": "PHP: it is the foundation of the majority of websites.", "notes": "Qualitative. Same piece cites W3Techs for the PHP 8 share (other_shares). (No earlier statement in the vault with this exact wording.)", "family": "F-13" }, { "id": "S-117", "slug": "computerweekly-news-366652674-botched-php2shell-disclos", "publisher": "Computer Weekly", "url": "https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues", "title": "Botched PHP2Shell disclosure revealed as panic continues | Computer Weekly", "published": "not stated in the capture", "time_utc": "2026-10-22T16:19:00Z", "time_basis": "page metadata datePublished '2026-10-22T16:19Z'", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/computerweekly-news-366652674-botched-php2shell-disclos/captures/20261023T160435Z/text.txt", "sha256": "8c5ef3c6921c8db90001a45a4cecbcc172ebbad178e2dcb66d150a72029dbb4e", "sha256_from": "provenance.json", "excerpt": "in the core PHP code underpinning almost three-quarters of the world’s websites", "location": "lede", "value": 75, "denominator_text": "the world’s websites", "denominator_class": "websites-all", "qualifier": "almost", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": null, "language": "en", "translation": null, "notes": "Rounds to three quarters. (No earlier statement in the vault with this exact wording.)", "family": "F-8" }, { "id": "S-118", "slug": "rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi", "publisher": "RTL.de", "url": "https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html", "title": "PHP-Lücke: BSI warnt vor Cyber-Gefahr – Firmen oft unwissend", "published": "2026-10-22T19:41:37", "time_utc": "2026-10-22T17:41:37Z", "time_basis": "page metadata 19:41:37+02:00", "captures": [ "20261022T181608Z" ], "excerpt_found_in": [ "20261022T181608Z" ], "file": "sources/rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi/captures/20261022T181608Z/text.txt", "sha256": "a69da5f39287ad4307292733dfaf03317eb57edfcc30fc1959d41922af77bcf7", "sha256_from": "provenance.json", "excerpt": "Schätzungsweise 70 Prozent aller Websites basieren auf dem Skript.", "location": "body", "value": 70, "denominator_text": "aller Websites", "denominator_class": "websites-all", "qualifier": "an estimated", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "de", "translation": "An estimated 70 percent of all websites are based on the script.", "notes": "", "family": "F-2" }, { "id": "S-119", "slug": "lebigdata-php2shell-des-millions-dattaques-frappen", "publisher": "LEBIGDATA.FR", "url": "https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant", "title": "PHP2Shell : comment protéger votre site des attaques PHP", "published": "2026-10-22T17:52:24+00:00", "time_utc": "2026-10-22T17:52:24Z", "time_basis": "page metadata; modified 2026-10-23T14:42Z", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/lebigdata-php2shell-des-millions-dattaques-frappen/captures/20261023T160435Z/text.txt", "sha256": "e2295f56852e6bb0a72ce660e7a5be199cf097dfdd19e09a4a5b7cc649ad5f13", "sha256_from": "provenance.json", "excerpt": "Près de 70 % du Web utilise PHP : mais non, 70 % des sites ne sont pas automatiquement piratables", "location": "body", "value": 70, "denominator_text": "du Web", "denominator_class": "internet", "qualifier": "nearly", "attribution": "none", "links_to_measurement": null, "role": "restates", "restates": null, "language": "fr", "translation": "Nearly 70% of the Web uses PHP: but no, 70% of sites are not automatically hackable", "notes": "Subheading. The article explicitly warns against reading the figure as exposure ('Le chiffre tourne partout'). (No earlier statement in the vault with this exact wording.)", "family": "F-1" }, { "id": "S-120", "slug": "lebigdata-php2shell-des-millions-dattaques-frappen", "publisher": "LEBIGDATA.FR", "url": "https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant", "title": "PHP2Shell : comment protéger votre site des attaques PHP", "published": "2026-10-22T17:52:24+00:00", "time_utc": "2026-10-22T17:52:24Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/lebigdata-php2shell-des-millions-dattaques-frappen/captures/20261023T160435Z/text.txt", "sha256": "e2295f56852e6bb0a72ce660e7a5be199cf097dfdd19e09a4a5b7cc649ad5f13", "sha256_from": "provenance.json", "excerpt": "D’après W3Techs, PHP équipe toujours près de 70 % des sites dont le langage serveur est identifiable.", "location": "body", "value": 70, "denominator_text": "sites dont le langage serveur est identifiable", "denominator_class": "websites-known-language", "qualifier": "nearly", "attribution": "W3Techs", "links_to_measurement": "https://w3techs.com/technologies/details/pl-php", "role": "measures", "restates": null, "language": "fr", "translation": "According to W3Techs, PHP still powers nearly 70% of sites whose server language is identifiable.", "notes": "Links W3Techs. Also embeds OpenAI's post.", "family": "F-5" }, { "id": "S-121", "slug": "thehackernews-php2shell-4days", "publisher": "The Hacker News (Ravie Lakshmanan)", "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "title": "Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed", "published": "2026-10-22", "time_utc": null, "time_basis": "date only (22 Oct, manifest)", "captures": [ "20261022T081320Z" ], "excerpt_found_in": [ "20261022T081320Z" ], "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "sha256_from": "provenance.json", "excerpt": "\"PHP is used by almost 70% of websites,\" Cloudflare said.", "location": "quote of someone", "value": 70, "denominator_text": "websites", "denominator_class": "unspecified", "qualifier": "almost", "attribution": "Cloudflare", "links_to_measurement": null, "role": "restates", "restates": "S-013", "language": "en", "translation": null, "notes": "Quotes Cloudflare's sentence, without Cloudflare's W3Techs link.", "family": "F-4" }, { "id": "S-122", "slug": "thehackernews-php2shell-4days", "publisher": "The Hacker News (Ravie Lakshmanan)", "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "title": "Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed", "published": "2026-10-22", "time_utc": null, "time_basis": "date only (22 Oct, manifest)", "captures": [ "20261022T081320Z" ], "excerpt_found_in": [ "20261022T081320Z" ], "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "sha256_from": "provenance.json", "excerpt": "With PHP powering a majority of the websites in the world, the vast attack surface", "location": "body", "value": null, "denominator_text": "the websites in the world", "denominator_class": "websites-all", "qualifier": "a majority", "attribution": "Wiz (by hyperlink only)", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "The words 'majority of the websites in the world' are the anchor of a link to the Wiz blog (rendered.html): Wiz's '70% of all websites in the world' turned qualitative. The link is to Wiz, not to a measurement.", "family": "F-13" }, { "id": "S-123", "slug": "jpcert-at260033", "publisher": "JPCERT/CC (Japan)", "url": "https://www.jpcert.or.jp/at/2026/at260033.html", "title": "PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (JPCERT-AT-2026-0033)", "published": "2026-10-22", "time_utc": null, "time_basis": "date only", "captures": [ "20261022T081700Z" ], "excerpt_found_in": [ "20261022T081700Z" ], "file": "sources/jpcert-at260033/captures/20261022T081700Z/text.txt", "sha256": "1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5", "sha256_from": "provenance.json", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "location": "reference list", "value": 70, "denominator_text": "the Internet", "denominator_class": "internet", "qualifier": "none", "attribution": "Wiz (cited title)", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "en", "translation": null, "notes": "JPCERT/CC alert, reference section (Japanese page, English title).", "family": "F-1" }, { "id": "S-124", "slug": "securitynl-misbruik-gemeld", "publisher": "Security.NL", "url": "https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online", "title": "Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online - Security.NL", "published": null, "time_utc": null, "time_basis": "date only (reader comment, 22 Oct)", "captures": [ "20261022T191411Z" ], "excerpt_found_in": [ "20261022T191411Z" ], "file": "sources/securitynl-misbruik-gemeld/captures/20261022T191411Z/text.txt", "sha256": "95d1565c5959e61fa188ea5af37ef0518b3c171d442554cbee86484dd03ddd09", "sha256_from": "provenance.json", "excerpt": "En toch hangt ruim 70 procent van het internet aan elkaar van PHP oplossingen", "location": "social post", "value": 70, "denominator_text": "het internet", "denominator_class": "internet", "qualifier": "over", "attribution": "none (anonymous reader comment)", "links_to_measurement": null, "role": "restates", "restates": "S-014", "language": "nl", "translation": "And yet over 70 percent of the internet is held together by PHP solutions", "notes": "Another comment on the same page: 'Om die reden draait het op 70% vd sites' (for that reason it runs on 70% of sites).", "family": "F-1" }, { "id": "S-125", "slug": "nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan", "publisher": "nguoiquansat.vn", "url": "https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html", "title": "Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ", "published": "10/23/2026 10:02:01 AM", "time_utc": "2026-10-23T03:02:01Z", "time_basis": "page metadata 10:02:01+07:00", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan/captures/20261023T160435Z/text.txt", "sha256": "176d23d05dee09bd3ec76145b7258bdc602945e0ae56615e62e4164b7e2def48", "sha256_from": "provenance.json", "excerpt": "Lỗ hổng php2shell đe dọa 70% website toàn cầu", "location": "headline", "value": 70, "denominator_text": "website toàn cầu", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "vi", "translation": "php2shell vulnerability threatens 70% of websites worldwide", "notes": "Body: 'khoảng 70% trang web trên toàn cầu' (about 70% of web pages worldwide).", "family": "F-2" }, { "id": "S-126", "slug": "techtarget-itmedia-tt-article-2610-23-2000002526", "publisher": "TechTargetジャパン", "url": "https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/", "title": "PHP脆弱性「PHP2Shell」で2260万件に影響　情シスの緊急チェックリスト：OpenAIモデルが暴いた脆弱性 - TechTargetジャパン", "published": "not stated in the capture", "time_utc": "2026-10-23T05:00:00Z", "time_basis": "page metadata", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/techtarget-itmedia-tt-article-2610-23-2000002526/captures/20261023T160435Z/text.txt", "sha256": "14c421632d9592d8a6b0b2bef1f45af7363175b91bd978cc453d73de9b51dbdb", "sha256_from": "provenance.json", "excerpt": "サーバサイドプログラミング言語が判明しているWebサイトを対象に実施した調査（2026年10月時点）では、Webサイトの69.3％をPHPが支えている。", "location": "body", "value": 69.3, "denominator_text": "サーバサイドプログラミング言語が判明しているWebサイト", "denominator_class": "websites-known-language", "qualifier": "none", "attribution": "W3Techs", "links_to_measurement": null, "role": "measures", "restates": null, "language": "ja", "translation": "In a survey of websites whose server-side programming language is known (as of October 2026), PHP supports 69.3% of websites.", "notes": "Names W3Techs ('Web技術調査機関W3Techs'); no link found.", "family": "F-5" }, { "id": "S-127", "slug": "tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo", "publisher": "Everyeye Tech", "url": "https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html", "title": "Vulnerabilità PHP: il 70% dei siti al mondo è stato a rischio per più di 10 anni!", "published": "2026-10-23T08:30:00+02:00", "time_utc": "2026-10-23T06:30:00Z", "time_basis": "page metadata 08:30+02:00", "captures": [ "20261023T160435Z" ], "excerpt_found_in": [ "20261023T160435Z" ], "file": "sources/tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo/captures/20261023T160435Z/page.html", "sha256": "c12e14252ec4e468f220422f9b5516d5b5716fac875a8b1fd725e0632a551cdd", "sha256_from": "provenance.json", "excerpt": "il 70% dei siti al mondo è stato a rischio per più di 10 anni!", "location": "title", "value": 70, "denominator_text": "siti al mondo", "denominator_class": "websites-all", "qualifier": "none", "attribution": "none", "links_to_measurement": null, "role": "transforms", "restates": "S-015", "language": "it", "translation": "70% of the world's sites have been at risk for more than 10 years!", "notes": "Usage share turned into a decade of risk. Body: 'il linguaggio che alimenta quasi il 70% dei siti web' (nearly 70% of websites).", "family": "F-2" }, { "id": "S-128", "slug": "yugatech-news-ai-helps-uncover-php2shell-flaws-th", "publisher": "YugaTech", "url": "https://www.yugatech.com/news/ai-helps-uncover-php2shell-flaws-that-put-websites-worldwide-at-risk/", "title": "AI helps uncover PHP2Shell flaws", "published": "2026-10-26", "time_utc": null, "time_basis": "date only on the page (October 26, 2026)", "captures": [ "20261026T121439Z" ], "excerpt_found_in": [ "20261026T121439Z" ], "file": "sources/yugatech-news-ai-helps-uncover-php2shell-flaws-th/captures/20261026T121439Z/text.txt", "sha256": "ea3e1134c60159b819defacd7c8ab12409727fd23768da3247338feaa1472d9c", "sha256_from": "the desk's own hash of the capture's text.txt in the evidence vault, run 10", "excerpt": "PHP is used by roughly 70% of websites worldwide, according to figures cited by researchers.", "location": "body", "value": 70, "denominator_text": "websites worldwide", "denominator_class": "websites-all", "qualifier": "roughly", "attribution": "figures cited by researchers (unnamed)", "links_to_measurement": null, "role": "restates", "restates": "S-015", "language": "en", "translation": null, "notes": "Says in the next sentence that this does not mean 70% of websites have been confirmed compromised. Another statement under 'of all websites' with no measurer named.", "family": "F-2" } ], "families": [ { "id": "F-1", "wording": "70% of the Internet / the web (Wiz headline and X post)", "origin": "S-008", "members": [ "S-008", "S-014", "S-016", "S-028", "S-036", "S-040", "S-041", "S-043", "S-048", "S-049", "S-050", "S-051", "S-061", "S-063", "S-064", "S-066", "S-069", "S-070", "S-075", "S-080", "S-082", "S-096", "S-102", "S-109", "S-111", "S-119", "S-123", "S-124" ], "denominator_class": "internet", "count": 28, "origin_note": "The Wiz X post (13:32:25Z) precedes the Wiz blog's metadata time (13:59:59Z)." }, { "id": "F-2", "wording": "70% of (all) websites (in the world) (Wiz blog executive summary)", "origin": "S-015", "members": [ "S-003", "S-011", "S-015", "S-020", "S-021", "S-023", "S-024", "S-026", "S-031", "S-034", "S-042", "S-044", "S-052", "S-053", "S-054", "S-055", "S-056", "S-058", "S-065", "S-073", "S-074", "S-076", "S-084", "S-092", "S-093", "S-094", "S-095", "S-101", "S-115", "S-118", "S-125", "S-127", "S-128" ], "denominator_class": "websites-all", "count": 33, "origin_note": "WSJ 'up to 70% of the World's Websites at Risk' (Robert McMillan, 21 Oct) is an outside sub-origin for the 'up to' wording (actu17, The Verge, Substack); WSJ is not captured in the vault." }, { "id": "F-3", "wording": "an estimated 70% of websites (OpenAI)", "origin": "S-017", "members": [ "S-017", "S-022", "S-057", "S-113" ], "denominator_class": "unspecified", "count": 4 }, { "id": "F-4", "wording": "almost 70% of websites (Cloudflare, linked to W3Techs)", "origin": "S-013", "members": [ "S-013", "S-106", "S-121" ], "denominator_class": "unspecified", "count": 3 }, { "id": "F-5", "wording": "69.3% / about 70% of websites whose server-side language is known (W3Techs measurement)", "origin": "S-004", "members": [ "S-004", "S-006", "S-010", "S-029", "S-032", "S-038", "S-039", "S-045", "S-046", "S-047", "S-059", "S-060", "S-071", "S-078", "S-081", "S-083", "S-087", "S-097", "S-098", "S-099", "S-100", "S-103", "S-105", "S-120", "S-126" ], "denominator_class": "websites-known-language", "count": 25, "origin_note": "W3Techs itself is not captured in the vault; Tenable (S-004) is the earliest in-vault statement of the measured figure." }, { "id": "F-6", "wording": "roughly 75% of websites whose programming language can be identified, per W3Techs (Reuters)", "origin": "S-002", "members": [ "S-002", "S-033", "S-114" ], "denominator_class": "websites-known-language", "count": 3, "origin_note": "Reuters wire copy carried by RTE; Reuters' original is not in the vault. The 75% does not match W3Techs' 69.3% cited elsewhere for 21 October." }, { "id": "F-7", "wording": "\"roughly 70%\" of the internet, quoted and credited to Wiz (BBC)", "origin": "S-077", "members": [ "S-077", "S-085", "S-088", "S-089" ], "denominator_class": "internet", "count": 4, "origin_note": "No Wiz text in the vault contains 'roughly'; the quoted qualifier is the BBC's." }, { "id": "F-8", "wording": "three quarters / two thirds rounding", "origin": "S-001", "members": [ "S-001", "S-030", "S-079", "S-104", "S-117" ], "denominator_class": "websites-all", "count": 5 }, { "id": "F-9", "wording": "inflated ranges and ceilings (70-80%, 75-80%, up to 80%)", "origin": "S-005", "members": [ "S-005", "S-009", "S-018", "S-110" ], "denominator_class": "unspecified", "count": 4 }, { "id": "F-10", "wording": "websites and web applications", "origin": "S-007", "members": [ "S-007", "S-072", "S-112" ], "denominator_class": "applications", "count": 3 }, { "id": "F-11", "wording": "servers", "origin": "S-025", "members": [ "S-025", "S-067" ], "denominator_class": "servers-hosts", "count": 2 }, { "id": "F-12", "wording": "national segments (.pt, .ma)", "origin": "S-090", "members": [ "S-090", "S-108" ], "denominator_class": "websites-known-language", "count": 2 }, { "id": "F-13", "wording": "qualitative: a large share / most / the majority (no number)", "origin": "S-019", "members": [ "S-012", "S-019", "S-027", "S-035", "S-037", "S-062", "S-068", "S-086", "S-091", "S-107", "S-116", "S-122" ], "denominator_class": "unspecified", "count": 12 } ], "edits": [ { "slug": "cnn-php2shell-ai -> cnn-php2shell-websites-shut", "note": "Same CNN story (URL gains '-intl'); article:published_time 2026-10-21T16:36:24Z in both; modified 04:00:36Z then 11:06:26Z. The 70% claim moves from the lede ('could affect 70% of the internet') to a new body sentence that uses Wiz's websites wording, and the headline is rewritten twice.", "before": { "stamp": "20261022T080952Z", "excerpt": "after artificial intelligence helped discover and address critical bugs that could affect 70% of the internet.", "headline": "Global websites shut down after AI found a critical flaw affecting 70% of the internet", "html_title": "PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet" }, "after": { "stamp": "20261022T112616Z", "excerpt": "two critical flaws in PHP, a programming language that powers 70% of all websites in the world", "headline": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet", "lede": "after artificial intelligence helped find critical vulnerabilities in a widely used programming language." } }, { "slug": "fortune-ai-tools-php-vulnerability", "note": "One capture, two headlines: the visible H1 (matching the URL slug) and the HTML <title>/og:title. The AI verb is softened; the '70% of the internet' wording is unchanged.", "before": { "stamp": "20261023T012042Z", "excerpt": "AI tools discovered the PHP vulnerability that could take down 70% of the internet.", "where": "H1 in text.txt; URL slug" }, "after": { "stamp": "20261023T012042Z", "excerpt": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "where": "<title> and og:title in page.html" } }, { "slug": "20min-fr-suisse-romande -> 20-minuten-20min-fr-suisse-romande", "note": "Same URL captured twice. The headline changed ('Panne mondiale des sites web: la Suisse romande touchée' became 'Panne mondiale: la Suisse romande fortement impactée'); both 70% sentences are unchanged.", "before": { "stamp": "20261022T081421Z", "excerpt": "utilisé par environ 70% des sites web dont la technologie est identifiée" }, "after": { "stamp": "20261022T181608Z", "excerpt": "utilisé par environ 70% des sites web dont la technologie est identifiée" } } ], "unchanged_across_captures": [ { "slug": "bbc-live-ckgel5xp2xv9t", "stamps": [ "20261022T080453Z", "20261022T080526Z", "20261022T080559Z", "raw/page.2026-10-22T0755Z.html" ], "result": "'roughly 70%' sentences identical in all four" }, { "slug": "insurancebusiness-uk-councils / insurancebusiness-uk-councils-met", "stamps": [ "20261022T081252Z", "20261022T112225Z" ], "result": "identical" }, { "slug": "newsweek-php2shell-list / newsweek-php2shell-websites", "stamps": [ "20261022T081350Z", "20261022T112237Z" ], "result": "identical" }, { "slug": "tpo-nl-digid-offline / tpo-tpo-nl-digid-offline", "stamps": [ "20261022T113213Z", "20261022T171501Z" ], "result": "identical" }, { "slug": "php-foundation-blog-security-release / phpfoundation-blog-security-release-leak", "stamps": [ "20261022T080901Z", "20261022T081244Z" ], "result": "identical (reader comment and Foundation text)" } ], "fortune": { "slug": "fortune-ai-tools-php-vulnerability", "statements": [ "S-048", "S-049", "S-050", "S-051" ], "published": "2026-10-21T18:48:38Z (datePublished); modified 2026-10-22T14:56:06Z; captured 2026-10-23T01:20Z", "author": "Emily Forlini, Senior AI Reporter", "wording": { "h1": "AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack", "html_title": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "lede": "Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.", "quote": "“With 70% of the internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings.", "other_share_sentences": [ "Most web pages run using an open-source programming language called PHP.", "Among the most well known sites that run on PHP is WordPress, which powers roughly 40% of all websites, according to Reuters." ] }, "attributes": "The 70% figure is attributed only through the quote of Wiz's conclusion, linked to the Wiz blog. The headline and lede state it in Fortune's own voice with no source. Fortune's one W3Techs link (anchor 'according to') supports a list of example PHP sites (Microsoft.com, Wikipedia.org, Archive.org, TheGuardian.com, Baidu.com), not the share; the WordPress 40% is credited to Reuters.", "vs_wiz": "Fortune quotes the Wiz conclusion accurately (only 'Internet' to 'internet' and 'PHP2Shell' to 'php2shell'). But its headline and lede change Wiz's verb: Wiz wrote 'affecting 70% of the Internet' and 'With 70% of the Internet affected'; Fortune wrote 'could take down 70% of the internet' and 'stands to take down 70% of the internet if left unaddressed'. Usage share becomes the share that could be knocked offline. Fortune does not use Wiz's other wording, 'powers 70% of all websites in the world'.", "vs_w3techs": "W3Techs measures PHP on 69.3% (21 Oct, as cited by Tenable, Bitpage, AI4Business, Critic Arad, BDM, Marketing4eCommerce, TechTarget Japan) of websites whose server-side programming language it can identify: a usage share among sites with a detectable language, not of all websites, not of 'the internet', and not of exposure. Fortune links W3Techs but not for this figure, keeps no qualifier, and turns the denominator into 'the internet' and the measure into what could be 'taken down'. Its body does carry a softer qualitative line ('Most web pages run using ... PHP').", "classification": "transforms (headline, title, lede: internet, 'take down'); restates (quote of Wiz conclusion)", "edit": "H1 'AI tools discovered...' versus <title>/og:title 'AI helped discover...': the AI claim is softened between headline versions; the 70% wording stays." }, "other_shares": [ { "slug": "fortune-ai-tools-php-vulnerability", "excerpt": "WordPress, which powers roughly 40% of all websites, according to Reuters", "measure": "WordPress share of all websites" }, { "slug": "cnn-php2shell-ai", "excerpt": "an encryption technology estimated to be used by two-thirds of the Web", "measure": "OpenSSL/Heartbleed share of the web, 2014 (comparison)" }, { "slug": "usa-today-php2shell-live", "excerpt": "Cybersecurity firm Cisco Talos estimates that about 50% of all PHP systems worldwide will not receive an official patch", "measure": "share of PHP systems without an official patch" }, { "slug": "usa-today-php2shell-live", "excerpt": "Nearly half of all affected websites may never receive the patch", "measure": "share of affected websites without a patch" }, { "slug": "computerweekly-news-366652674-botched-php2shell-disclos", "excerpt": "hundreds of millions of PHP package installations in the wild, with almost three-quarters of them on internet-facing assets", "measure": "Qualys: share of PHP installations on internet-facing assets (not a share of websites)" }, { "slug": "cybelangel-php2shell", "excerpt": "59% of those that report a version (883,717 of about 1.5 million) run a branch with no official release", "measure": "share of version-reporting PHP hosts on unpatched branches (Shodan/Mallory)" }, { "slug": "cybelangel-php2shell", "excerpt": "Among the sites that reveal their PHP version, 54% run an end-of-life branch", "measure": "CybelAngel scan, EOL share" }, { "slug": "thehackernews-php2shell-unpatched-alert", "excerpt": "59% of the roughly 1.5 million hosts that reported any version", "measure": "Mallory: hosts on PHP 8.1 or older" }, { "slug": "bitpage-php2shell-php-sicherheitsluecke-webseite", "excerpt": "Von diesen PHP-Seiten laufen 65,2 Prozent auf PHP 8, aber 27 Prozent noch auf PHP 7 und 7,7 Prozent auf PHP 5", "measure": "W3Techs version split of PHP sites" }, { "slug": "lesaffaires-opinions-php2shell-ce-quil-faut-en-reten", "excerpt": "selon W3Techs, la version 8 n’équipe qu’environ 63% des sites PHP", "measure": "W3Techs: PHP 8 share of PHP sites" }, { "slug": "criticarad-php2shell-cve-2026-109618-ghid-patch", "excerpt": "Dintre acestea, 34,7% sunt pe ramuri ieșite complet din suport", "measure": "W3Techs: share of PHP sites on EOL branches" }, { "slug": "tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell", "excerpt": "391 sites do setor público: 58% mostram PHP", "measure": "CyberS3c: Portuguese public-sector sites showing PHP" }, { "slug": "tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell", "excerpt": "Dos 2 135 que dizem a versão, 83% estão em versões sem suporte", "measure": "Shodan: Portuguese PHP services on unsupported versions" }, { "slug": "tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell", "excerpt": "66,1% dos que têm gestor de conteúdos usam WordPress", "measure": "W3Techs: WordPress share of .pt CMS sites" }, { "slug": "rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili", "excerpt": "la base de WordPress, el sistema que impulsa alrededor del 40% de los", "measure": "WordPress share" }, { "slug": "marketing4ecommerce-crisis-seguridad-php", "excerpt": "Builtwith hablan de 24 millones de webs que lo utilizan", "measure": "BuiltWith: count of PHP websites (not a share)" }, { "slug": "wikipedia-log4shell", "excerpt": "the vulnerability affected 93% of enterprise cloud environments", "measure": "Log4Shell, Wiz and EY (comparison case, not PHP)" } ], "injection_seen": [ { "where": "notes/2026-10-23__curator@php.newsroom.md, section 'A page that addresses an AI, skipped'", "source": "Journal du Net, 'PHP2Shell : le prompt pour sécuriser ses sites PHP face à la faille avec Claude Code ou Codex' (Benjamin Polge, 21 October 2026), queue row journaldunet-intelligence-artificielle-1556939-pour-s", "status": "Not in sources/: the curator skipped it because it is a block of second-person instructions written for an AI coding assistant. This lineage did not read the page and did not act on it.", "in_sources": false }, { "where": "sources/linternaute-hightech-internet-11310057-panne-interne/captures/20261023T160435Z/page.html", "source": "footer links to journaldunet.com (same publishing group)", "status": "Navigation link only; no AI-addressed text.", "in_sources": true }, { "where": "all captures scanned for share statements", "source": "-", "status": "No captured text addressed to an AI was found in the share statements read for this lineage.", "in_sources": true } ] }, "live": { "generated_at": "2026-10-24T01:46:33Z", "method": "curl -sS -L -m 40 with a Chrome UA; sha256 of the bytes saved under fetched/; tags stripped; 70% sentences compared with the vault capture text.txt (sha256 checked against provenance.json). Excerpts verified as substrings of the saved bytes (after HTML-entity decoding and whitespace collapsing). Em-dashes inside verbatim quotes are written as the JSON escape \\u2014.", "counts": { "page_records": 73, "unique_urls": 68, "by_classification": { "unchanged": 64, "changed": 4, "blocked": 3, "unverifiable": 2 }, "new_outlets": 14, "changes": 9 }, "pages": [ { "slug_or_url": "20-minuten-20min-fr-suisse-romande", "publisher": "20 minutes (20min.ch)", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "vault": { "stamp": "20261022T181608Z", "file": "sources/20-minuten-20min-fr-suisse-romande/captures/20261022T181608Z/text.txt", "sha256": "d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65", "excerpt": "Le PHP, un langage de programmation créé au début des années 1990, a des failles qui mettent en danger «70% du web mondial».AFP" }, "now": { "retrieved_at": "2026-10-24T01:32:04Z", "status": 200, "sha256": "0ee22cf60217a261fbc9b36e15183bc5bc5423dee76cc4ef24e6fe9b59fb7166", "file": "fetched/20-minuten-20min-fr-suisse-romande__20261024T013203Z.html", "final_url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "title": "Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes", "excerpt": "En cause, une faille critique dans PHP, un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée, a conduit à la mise hors ligne" }, "classification": "unchanged", "correction_note": null, "notes": "70% wording unchanged (the AFP photo caption \"«70% du web mondial»\" is now only in the page JSON). Headline changed between vault captures 08:14 and 18:16 UTC on 22 Oct (\"Panne mondiale des sites web: la Suisse romande touchée\" to \"Panne mondiale: la Suisse romande fortement impactée\"); not a 70% change." }, { "slug_or_url": "20min-fr-suisse-romande", "publisher": "20 minutes (20min.ch)", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "vault": { "stamp": "20261022T081421Z", "file": "sources/20min-fr-suisse-romande/captures/20261022T081421Z/text.txt", "sha256": "97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4", "excerpt": "Le PHP, un langage de programmation créé au début des années 1990, a des failles qui mettent en danger «70% du web mondial».AFP" }, "now": { "retrieved_at": "2026-10-24T01:32:04Z", "status": 200, "sha256": "0ee22cf60217a261fbc9b36e15183bc5bc5423dee76cc4ef24e6fe9b59fb7166", "file": "fetched/20-minuten-20min-fr-suisse-romande__20261024T013203Z.html", "final_url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "title": "Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes", "excerpt": "En cause, une faille critique dans PHP, un langage de programmation utilisé par environ 70% des sites web dont la technologie est identifiée, a conduit à la mise hors ligne" }, "classification": "unchanged", "correction_note": null, "notes": "Same URL as another vault slug; one fetch serves both. See 20-minuten-20min-fr-suisse-romande." }, { "slug_or_url": "20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit", "publisher": "20minutos", "url": "https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html", "vault": { "stamp": "20261022T181608Z", "file": "sources/20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit/captures/20261022T181608Z/text.txt", "sha256": "96ea536b04fe59c76df5ae9fc13efbf08dc59d6eeb8232b7d4c22a85becff632", "excerpt": "Dos fallos \"críticos\" en el lenguaje de programación PHP ponen en riesgo cerca del 70% de las páginas web de todo el mundo" }, "now": { "retrieved_at": "2026-10-24T01:32:05Z", "status": 200, "sha256": "4b42d75c91a18f1e8fd77a73a7a5d9fe412d9bc62a24d61c444e6af9f229c239", "file": "fetched/20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit__20261024T013204Z.html", "final_url": "https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html", "title": "Alerta de PHP: por qué gobiernos, hospitales y colegios desconectan sus webs", "excerpt": "Dos fallos \"críticos\" en el lenguaje de programación PHP ponen en riesgo cerca del 70% de las páginas web de todo el mundo" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "abc-au-politics-live", "publisher": "ABC News (Australia)", "url": "https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950", "vault": { "stamp": "20261022T081530Z", "file": "sources/abc-au-politics-live/captures/20261022T081530Z/text.txt", "sha256": "a86331d9b7a21f78af1750d3daf6ebbb696253e1216649e973e34262313040b1", "excerpt": "Several government sites went offline overnight after a vulnerability was discovered in 70 per cent of the world's websites by an OpenAI tool, which detected a flaw in the PHP" }, "now": { "retrieved_at": "2026-10-24T01:32:06Z", "status": 200, "sha256": "6da9d74b0c806972684d1a30e9f1b77bebb1eac7c2009f57bd25c6038b97ff6a", "file": "fetched/abc-au-politics-live__20261024T013205Z.html", "final_url": "https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950", "title": "Federal politics: No government websites hacked after global security flaw found — as it happened - ABC News", "excerpt": "Several government sites went offline overnight after a vulnerability was discovered in 70 per cent of the world's websites by an OpenAI tool, which detected a flaw in the PHP" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "actu17-prefectures", "publisher": "Actu17", "url": "https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html", "vault": { "stamp": "20261022T081432Z", "file": "sources/actu17-prefectures/captures/20261022T081432Z/text.txt", "sha256": "84edb7f59b55a5ce64bf9458671e49987b9e48e0e8388039de616a4c8c1e534d", "excerpt": "D'après le Wall Street Journal, PHP fait fonctionner jusqu'à 70 % des sites internet dans le monde" }, "now": { "retrieved_at": "2026-10-24T01:32:07Z", "status": 200, "sha256": "6a6c2d28dc206b2dd46ca801ff8f7c3b38defcb1de2e92fe16b7b8e768829cb0", "file": "fetched/actu17-prefectures__20261024T013206Z.html", "final_url": "https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html", "title": "Failles critiques dans PHP : des sites coupés en urgence dans le monde entier, dont ceux des préfectures en France", "excerpt": "D'après le Wall Street Journal, PHP fait fonctionner jusqu'à 70 % des sites internet dans le monde" }, "classification": "unchanged", "correction_note": null, "notes": "Sentence still present; vault and live differ only by whitespace around a link." }, { "slug_or_url": "agconnect-maatschappij-security-welke-nederlandse-websites-w", "publisher": "AG Connect", "url": "https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht", "vault": { "stamp": "20261022T181608Z", "file": "sources/agconnect-maatschappij-security-welke-nederlandse-websites-w/captures/20261022T181608Z/text.txt", "sha256": "505809e89b530fe70249289f22bf5d7aa6c94100d0656851754fb9a469552cbc", "excerpt": "Naar schatting gebruikt ongeveer 70 procent van alle websites wereldwijd PHP of een voortvloeisel daarvan" }, "now": { "retrieved_at": "2026-10-24T01:32:07Z", "status": 200, "sha256": "27c92b6d5f2fc28778ee5520093d21d8506f737f4c3a37fb2f0a7b59a3b22401", "file": "fetched/agconnect-maatschappij-security-welke-nederlandse-websites-w__20261024T013207Z.html", "final_url": "https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht", "title": "Offline door PHP kwetsbaarheden: Welke Nederlandse websites waren uit de lucht?", "excerpt": "Naar schatting gebruikt ongeveer 70 procent van alle websites wereldwijd PHP of een voortvloeisel daarvan" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "bbc-live-ckgel5xp2xv9t", "publisher": "BBC News", "url": "https://www.bbc.com/news/live/ckgel5xp2xv9t", "vault": { "stamp": "20261022T080559Z", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "excerpt": "Cyber-security firm Wiz estimates that \"roughly 70%\" of the internet is affected by the PHP flaws" }, "now": { "retrieved_at": "2026-10-24T01:34:20Z", "status": 200, "sha256": "2fda11d58b21bbe97f21a578aee86756cb83b711934f2e8d9b47782cd1f58682", "file": "fetched/bbc-live-ckgel5xp2xv9t_page3__20261024T013419Z.html", "final_url": "https://www.bbc.com/news/live/ckgel5xp2xv9t", "title": "Scale of cyber-security flaw 'unprecedented' but no sign of breaches, says expert - BBC News", "excerpt": "with cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure" }, "classification": "unchanged", "correction_note": null, "notes": "Live page: the two \"roughly 70%\" entries (06:15 and 07:14 UTC, 22 Oct) are unchanged but now sit on ?page=3 (fetched 2026-10-24T01:34:20Z). Later entries word it differently: 13:54 and 16:27 UTC \"PHP powers 70% of the world's websites\" (attributed to Wiz); 17:12 UTC \"which helps run around 70% of sites\". Page title now: \"Scale of cyber-security flaw 'unprecedented' but no sign of breaches, says expert\". No correction note." }, { "slug_or_url": "cccs-al26-026", "publisher": "Canadian Centre for Cyber Security", "url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "vault": { "stamp": "20261022T081700Z", "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" }, "now": { "retrieved_at": "2026-10-24T01:32:09Z", "status": 200, "sha256": "84eaffa97f6cb91189f9235f94786222f61bb6cd9e0575222a9ffe586ff384a8", "file": "fetched/cccs-al26-026__20261024T013208Z.html", "final_url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "title": "AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1 - Canadian Centre for Cyber Security", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" }, "classification": "unchanged", "correction_note": null, "notes": "Title now ends \"Update 1\" (Updated: October 23, 2026), about a new CVE-2026-115560; the 70% wording is only the Wiz blog title in a footnote, unchanged." }, { "slug_or_url": "clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv", "publisher": "Clarin (English edition)", "url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html", "vault": { "stamp": "20261023T080331Z", "file": "sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/captures/20261023T080331Z/text.txt", "sha256": "c11dd717273bac9546aaf433f103637af20d579a0fb1ba06943929d81a70e82d", "excerpt": "PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet" }, "now": { "retrieved_at": "2026-10-24T01:32:09Z", "status": 200, "sha256": "2e0a107308cde91901e0e94a9d139331ef13cd72ca2ddbd289aec9c6b5a3c722", "file": "fetched/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv__20261024T013209Z.html", "final_url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html", "title": "PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet", "excerpt": "PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet" }, "classification": "unchanged", "correction_note": null, "notes": "All vault 70% sentences still present (some differ only by whitespace)." }, { "slug_or_url": "clickx-fr-actualites-200877-des-failles-php-critiques-menace", "publisher": "Clickx", "url": "https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/", "vault": { "stamp": "20261022T181608Z", "file": "sources/clickx-fr-actualites-200877-des-failles-php-critiques-menace/captures/20261022T181608Z/text.txt", "sha256": "f1876f8dd43053e0c0b3e106e9409256b3487f7228617f8e2abf7aca5e6c053d", "excerpt": "On estime qu’environ 70 % des sites web ou des applications web fonctionnent sous PHP" }, "now": { "retrieved_at": "2026-10-24T01:32:10Z", "status": 200, "sha256": "cf7fcc7006deb59d6bbb754f9e0b6524f8a70509f938374dfc6c554ba7263216", "file": "fetched/clickx-fr-actualites-200877-des-failles-php-critiques-menace__20261024T013209Z.html", "final_url": "https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/", "title": "Des failles PHP critiques menacent les sites web du monde entier : DPG Media et les pouvoirs publics mettent leurs sites hors ligne | Clickx", "excerpt": "On estime qu’environ 70 % des sites web ou des applications web fonctionnent sous PHP" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "cloudflare-blog-php2shell-waf", "publisher": "Cloudflare", "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "vault": { "stamp": "20261022T081216Z", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "excerpt": "PHP is used by almost 70% of websites" }, "now": { "retrieved_at": "2026-10-24T01:32:10Z", "status": 200, "sha256": "86ea19bbbde206f9339a36bc7e3a2276a5263296cfd3c902395ab2bd27801484", "file": "fetched/cloudflare-blog-php2shell-waf__20261024T013210Z.html", "final_url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "title": "Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog", "excerpt": "PHP is used by almost 70% of websites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "cnn-php2shell-ai", "publisher": "CNN Business", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "vault": { "stamp": "20261022T080952Z", "file": "sources/cnn-php2shell-ai/captures/20261022T080952Z/text.txt", "sha256": "81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef", "excerpt": "Global websites shut down after AI found a critical flaw affecting 70% of the internet" }, "now": { "retrieved_at": "2026-10-24T01:32:10Z", "status": 200, "sha256": "e3a57d45a3ace0974642017c6cd2b951e0664b5616061b377d22f13fa81f738b", "file": "fetched/cnn-php2shell-ai__20261024T013210Z.html", "final_url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "title": "Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet | CNN Business", "excerpt": "Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet" }, "classification": "changed", "correction_note": null, "notes": "This URL now 301-redirects to the -intl article (headers file cnn-nonintl-headers). The vault 08:09 UTC capture had title \"PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet\" and lede \"could affect 70% of the internet\"; live lede now says \"could affect 70% of the world's websites\"." }, { "slug_or_url": "cnn-php2shell-websites-shut", "publisher": "CNN Business", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "vault": { "stamp": "20261022T112616Z", "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "excerpt": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet" }, "now": { "retrieved_at": "2026-10-24T01:32:11Z", "status": 200, "sha256": "e3a57d45a3ace0974642017c6cd2b951e0664b5616061b377d22f13fa81f738b", "file": "fetched/cnn-php2shell-websites-shut__20261024T013210Z.html", "final_url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "title": "Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet | CNN Business", "excerpt": "Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet" }, "classification": "changed", "correction_note": null, "notes": "Headline lost \"a critical\" (now \"cybersecurity flaw\"); body \"powers 70% of all websites in the world\" now reads \"powers 70% of the world's websites\"; new lede \"could affect 70% of the world's websites\". Page shows \"Updated Oct 22, 2026, 2:26 PM ET\" (dateModified 2026-10-22T18:26:13Z). No correction or editor's note. Headline still says \"70% of the internet\"." }, { "slug_or_url": "cnnportugal-php", "publisher": "CNN Portugal", "url": "https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2", "vault": { "stamp": "20261022T081548Z", "file": "sources/cnnportugal-php/captures/20261022T081548Z/text.txt", "sha256": "de3c730717888f1395fbb1acc2b293846e9b0bf90bc7104fec23d64aad5886c2", "excerpt": "De acordo com a empresa de cibersegurança Wiz, “cerca de 70%” de toda a Internet estará a ser afetada por este problema, o que não significa que todos os sites" }, "now": { "retrieved_at": "2026-10-24T01:32:12Z", "status": 200, "sha256": "bcb4ae3fe4bcf6c5a36ef81d99172e519f05aadaa0e65f97ce8f304a8102bb3e", "file": "fetched/cnnportugal-php__20261024T013211Z.html", "final_url": "https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2", "title": "\"Um dos incidentes mais impactantes da memória recente\": o que se está a passar na Internet? - CNN Portugal", "excerpt": "De acordo com a empresa de cibersegurança Wiz, “cerca de 70%” de toda a Internet estará a ser afetada por este problema, o que não significa que todos os sites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "computerworld-article-4238887-dos-fallos-criticos-de-p", "publisher": "Computerworld Espana", "url": "https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html", "vault": { "stamp": "20261023T160435Z", "file": "sources/computerworld-article-4238887-dos-fallos-criticos-de-p/captures/20261023T160435Z/text.txt", "sha256": "e008b157b0ff9821a0995ada3ad6e5895f5f361231721c4191868b050a77d886", "excerpt": "PHP sustenta el 70% de los sitios web, lo que supone un enorme riesgo de concentración" }, "now": { "retrieved_at": "2026-10-24T01:32:15Z", "status": 200, "sha256": "ca514cc649f3fb54b2015387c081dbbee853cacab94a0e2e83c6c6db67d3b1ff", "file": "fetched/computerworld-article-4238887-dos-fallos-criticos-de-p__20261024T013214Z.html", "final_url": "https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html", "title": "Dos fallos críticos de PHP ponen en alerta a Internet | Computerworld.es", "excerpt": "PHP sustenta el 70% de los sitios web, lo que supone un enorme riesgo de concentración" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "criticarad-php2shell-cve-2026-109618-ghid-patch", "publisher": "Critica Rad", "url": "https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/", "vault": { "stamp": "20261023T160435Z", "file": "sources/criticarad-php2shell-cve-2026-109618-ghid-patch/captures/20261023T160435Z/text.txt", "sha256": "2f3acccf122140590c9aec1ab56e7076bc1f9c3a6e5f0b693a80f742162a205c", "excerpt": "E în PHP însuși, limbajul pe care rulează aproximativ 70% din web" }, "now": { "retrieved_at": "2026-10-24T01:32:16Z", "status": 200, "sha256": "b249e56d39be586f7ba0e711be62225d78ce7dc89ed47a3569e32eddfc1f5b6b", "file": "fetched/criticarad-php2shell-cve-2026-109618-ghid-patch__20261024T013215Z.html", "final_url": "https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/", "title": "PHP2Shell | Panică mondială și ghidul complet de patch", "excerpt": "E în PHP însuși, limbajul pe care rulează aproximativ 70% din web" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "crn-news-security-2026-5-things-to-know-about-critical-php-vulne", "publisher": "CRN", "url": "https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation", "vault": { "stamp": "20261023T080331Z", "file": "sources/crn-news-security-2026-5-things-to-know-about-critical-php-vulne/captures/20261023T080331Z/text.txt", "sha256": "7e2214693dddacf72cedf3f64ad2898acb80fbee6504be4f8122dd7ddb481ee5", "excerpt": "PHP is a key technology behind numerous web platforms including WordPress and Drupal.[Related: 10 Major Cyberattacks And Data Breaches In 2026 (So Far)]“With 70 percent of the Internet affected, the" }, "now": { "retrieved_at": "2026-10-24T01:32:16Z", "status": 200, "sha256": "15e4ed3c6f1ec67eb7b83108c4a9a5843d8ef30d577677fa6216182062bbe177", "file": "fetched/crn-news-security-2026-5-things-to-know-about-critical-php-vulne__20261024T013216Z.html", "final_url": "https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation", "title": "5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation", "excerpt": "“With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated,” researchers at Google-owned Wiz wrote in a post" }, "classification": "unchanged", "correction_note": null, "notes": "Vault and live differ only by whitespace." }, { "slug_or_url": "cyberexpress-php2shell-gov-sites", "publisher": "The Cyber Express", "url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/", "vault": { "stamp": "20261022T112646Z", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "excerpt": "It estimates “roughly 70%” of the internet is affected; a figure not independently verified." }, "now": { "retrieved_at": "2026-10-24T01:32:16Z", "status": 200, "sha256": "b0d09d30872aed02a6389b180f10e386655c19a6ace0cdf204f2a8d010c2366c", "file": "fetched/cyberexpress-php2shell-gov-sites__20261024T013216Z.html", "final_url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/", "title": "PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites", "excerpt": "It estimates “roughly 70%” of the internet is affected; a figure not independently verified." }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20", "publisher": "Cyber Kendra", "url": "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "vault": { "stamp": "20261023T080331Z", "file": "sources/cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20/captures/20261023T080331Z/text.txt", "sha256": "c604df6084ae12123c45d972380fb4ef9be0d787f0ef685f9be4161ce9bf5065", "excerpt": "PHP runs on about 70% of websites whose server-side language is known, according to W3Techs" }, "now": { "retrieved_at": "2026-10-24T01:32:17Z", "status": 403, "sha256": "3bb40456027c77d05b991e4686f10e51739a6ebdca3e33ec5edcd1e2c28b34cf", "file": "fetched/cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20__20261024T013216Z.html", "final_url": "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "title": "Bot Verification", "excerpt": null }, "classification": "blocked", "correction_note": null, "notes": "HTTP 403; page title now: 'Bot Verification'. Not guessed." }, { "slug_or_url": "cybernews-php2shell-millions", "publisher": "Cybernews", "url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/", "vault": { "stamp": "20261022T112703Z", "file": "sources/cybernews-php2shell-millions/captures/20261022T112703Z/text.txt", "sha256": "a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb", "excerpt": "As Cybernews reported yesterday, the flaws affect PHP, the programming language underpinning about 70% of known websites on the internet" }, "now": { "retrieved_at": "2026-10-24T01:32:17Z", "status": 403, "sha256": "7fd73b5f6052ce7d5dda13ef8e9fcb97739d90648dfbcca97c1ebacea9e460fb", "file": "fetched/cybernews-php2shell-millions__20261024T013217Z.html", "final_url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/", "title": "Just a moment...", "excerpt": null }, "classification": "blocked", "correction_note": null, "notes": "HTTP 403; page title now: 'Just a moment...'. Not guessed." }, { "slug_or_url": "eadt-minister-budget-no-breach", "publisher": "East Anglian Daily Times (PA)", "url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/", "vault": { "stamp": "20261022T112742Z", "file": "sources/eadt-minister-budget-no-breach/captures/20261022T112742Z/text.txt", "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "excerpt": "It comes after cyber security chiefs warned UK organisations on Wednesday that a “critical security issue” had been discovered in the programming language PHP, used by almost 70% of websites" }, "now": { "retrieved_at": "2026-10-24T01:32:19Z", "status": 200, "sha256": "d26191174e4f9e85f147a7c88216d4905eb293537b1fd9f9b79703868ec50e96", "file": "fetched/eadt-minister-budget-no-breach__20261024T013217Z.html", "final_url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/", "title": "No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times", "excerpt": "It comes after cyber security chiefs warned UK organisations on Wednesday that a “critical security issue” had been discovered in the programming language PHP, used by almost 70% of websites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "fortune-ai-tools-php-vulnerability", "publisher": "Fortune", "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "vault": { "stamp": "20261023T012042Z", "file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/text.txt", "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808", "excerpt": "AI tools discovered the PHP vulnerability that could take down 70% of the internet" }, "now": { "retrieved_at": "2026-10-24T01:32:19Z", "status": 200, "sha256": "c5d640eceed2f2f49ea871c10b6041292c1bff4e28c681163c32e1b4295ab12a", "file": "fetched/fortune-ai-tools-php-vulnerability__20261024T013219Z.html", "final_url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "title": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "excerpt": "AI tools discovered the PHP vulnerability that could take down 70% of the internet" }, "classification": "unchanged", "correction_note": null, "notes": "Unchanged since the vault capture; dateModified still 2026-10-22T14:56:06Z. See \"fortune\"." }, { "slug_or_url": "globalnews-ottawa-sites", "publisher": "Global News", "url": "https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/", "vault": { "stamp": "20261022T081641Z", "file": "sources/globalnews-ottawa-sites/captures/20261022T081641Z/text.txt", "sha256": "87d2ae5079c3620bd0b22f78e743865d283f1915fde2bc8badc1b1c56daf2ae8", "excerpt": "The Canadian government is temporarily taking down some of its own websites to patch a serious vulnerability in the code that underpins roughly 70 per cent of the world’s websites" }, "now": { "retrieved_at": "2026-10-24T01:32:19Z", "status": 200, "sha256": "95471aac6073b2bf15e45b4bbee98c2d37bf5d90ce7b2b56e02daf0add90969e", "file": "fetched/globalnews-ottawa-sites__20261024T013219Z.html", "final_url": "https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/", "title": "Ottawa taking down some federal websites over critical global vulnerability - National | Globalnews.ca", "excerpt": "The Canadian government is temporarily taking down some of its own websites to patch a serious vulnerability in the code that underpins roughly 70 per cent of the world’s websites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php", "publisher": "Information Age (ACS)", "url": "https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html", "vault": { "stamp": "20261023T080331Z", "file": "sources/ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php/captures/20261023T080331Z/text.txt", "sha256": "640f80b25de71eba27f0e3c27d8ff99a44a1fbfbff094fbba106b66ca99af2c5", "excerpt": "PHP is estimated to be used on around 70 per cent of the world's websites and web applications" }, "now": { "retrieved_at": "2026-10-24T01:32:20Z", "status": 200, "sha256": "382bf8b6c0139a1b5d162323579656c954dcb016b6166af28d87cdd13057ce06", "file": "fetched/ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php__20261024T013219Z.html", "final_url": "https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html", "title": "Govt sites go down after AI finds 'critical' PHP vulnerabilities | Information Age | ACS", "excerpt": "PHP is estimated to be used on around 70 per cent of the world's websites and web applications" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet", "publisher": "Mashable India", "url": "https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on", "vault": { "stamp": "20261023T080331Z", "file": "sources/in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet/captures/20261023T080331Z/text.txt", "sha256": "072bc5f150b26f629c58d74b6a3e20e8f6b35a9e8d53fdcc2ce072df0ac34acb", "excerpt": "About 70 percent of websites run on PHP, according to Wiz Research, the security firm that found the bugs" }, "now": { "retrieved_at": "2026-10-24T01:32:21Z", "status": 200, "sha256": "7b81520e5e8fd0a928db78f163b883aff81370419460a752be242b2833664ab8", "file": "fetched/in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet__20261024T013220Z.html", "final_url": "https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on", "title": "FBI Releases PHP2Shell Advisory As The Internet Explodes In Hilarious PHP Memes; Here Are The Best Ones", "excerpt": "About 70 percent of websites run on PHP, according to Wiz Research, the security firm that found the bugs" }, "classification": "unchanged", "correction_note": null, "notes": "All vault 70% sentences still present (some differ only by whitespace)." }, { "slug_or_url": "insurance-business-au-asiapac-attacks-begin", "publisher": "Insurance Business", "url": "https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx", "vault": { "stamp": "20261023T012042Z", "file": "sources/insurance-business-au-asiapac-attacks-begin/captures/20261023T012042Z/text.txt", "sha256": "8d88bddde485e36f27c001a80e9ad0506055b64f3879347345be5ad336a10cad", "excerpt": "Global high profile websites have been taken down as crucial bugs found in software that runs around 70% of the web" }, "now": { "retrieved_at": "2026-10-24T01:32:21Z", "status": 200, "sha256": "193c8e7c63e579939f5a7f4694f7432ae0cbd1bccc941c4ebc3a5893bd65d309", "file": "fetched/insurance-business-au-asiapac-attacks-begin__20261024T013221Z.html", "final_url": "https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx", "title": "Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business", "excerpt": "Global high profile websites have been taken down as crucial bugs found in software that runs around 70% of the web" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "insurancebusiness-uk-councils", "publisher": "Insurance Business", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "vault": { "stamp": "20261022T081252Z", "file": "sources/insurancebusiness-uk-councils/captures/20261022T081252Z/text.txt", "sha256": "daa04c79edfb56f49761d38fa7ce81c2aa1828f78a0b0b4694519818e4e507ca", "excerpt": "Organisations across the UK and Europe are taking websites offline as emergency fixes arrive for “PHP2Shell”, two critical bugs in software that runs around 70% of the web" }, "now": { "retrieved_at": "2026-10-24T01:32:21Z", "status": 200, "sha256": "ed3ff0ee80ee2de2f9752fc2df9b9b6731550925563e5ae6b095d4db32d6155a", "file": "fetched/insurancebusiness-uk-councils__20261024T013221Z.html", "final_url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "excerpt": "Organisations across the UK and Europe are taking websites offline as emergency fixes arrive for “PHP2Shell”, two critical bugs in software that runs around 70% of the web" }, "classification": "unchanged", "correction_note": null, "notes": "All vault 70% sentences still present (some differ only by whitespace)." }, { "slug_or_url": "insurancebusiness-uk-councils-met", "publisher": "Insurance Business", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "vault": { "stamp": "20261022T112225Z", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "excerpt": "Organisations across the UK and Europe are taking websites offline as emergency fixes arrive for “PHP2Shell”, two critical bugs in software that runs around 70% of the web" }, "now": { "retrieved_at": "2026-10-24T01:32:21Z", "status": 200, "sha256": "ed3ff0ee80ee2de2f9752fc2df9b9b6731550925563e5ae6b095d4db32d6155a", "file": "fetched/insurancebusiness-uk-councils__20261024T013221Z.html", "final_url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "excerpt": "Organisations across the UK and Europe are taking websites offline as emergency fixes arrive for “PHP2Shell”, two critical bugs in software that runs around 70% of the web" }, "classification": "unchanged", "correction_note": null, "notes": "Same URL as another vault slug; one fetch serves both. All vault 70% sentences still present (some differ only by whitespace)." }, { "slug_or_url": "jn-pt-sites-desligados", "publisher": "Jornal de Noticias", "url": "https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512", "vault": { "stamp": "20261022T081616Z", "file": "sources/jn-pt-sites-desligados/captures/20261022T081616Z/text.txt", "sha256": "d0ab599600817fabee6ab55163b27b2738e2ac00ac5659cd0bac26dfa4eafd2e", "excerpt": "A linguagem PHP é a base da mais de 70% dos servidores da Internet" }, "now": { "retrieved_at": "2026-10-24T01:32:22Z", "status": 200, "sha256": "dadde9f00e81998e8e225a185c05c86c722a81005b76578ce5a0383ed23a5cb6", "file": "fetched/jn-pt-sites-desligados__20261024T013221Z.html", "final_url": "https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512", "title": "Erro crítico em PHP obriga desligação de vários sites", "excerpt": "A linguagem PHP é a base da mais de 70% dos servidores da Internet" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "jpcert-at260033", "publisher": "JPCERT/CC", "url": "https://www.jpcert.or.jp/at/2026/at260033.html", "vault": { "stamp": "20261022T081700Z", "file": "sources/jpcert-at260033/captures/20261022T081700Z/text.txt", "sha256": "1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" }, "now": { "retrieved_at": "2026-10-24T01:32:23Z", "status": 200, "sha256": "85db7a09e865158643525fef5aa5cfc69513aaf896fcb2da4562189d43decf44", "file": "fetched/jpcert-at260033__20261024T013222Z.html", "final_url": "https://www.jpcert.or.jp/at/2026/at260033.html", "title": "PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana", "publisher": "Koran Jakarta", "url": "https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang", "vault": { "stamp": "20261022T181608Z", "file": "sources/koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana/captures/20261022T181608Z/text.txt", "sha256": "f5c3e92816a8aaf3d21543436c76aa52fac6863eada37a37eb37b0618a5f987d", "excerpt": "Perusahaan keamanan siber Wiz memperkirakan \"sekitar 70%\" internet terpengaruh oleh celah keamanan PHP" }, "now": { "retrieved_at": "2026-10-24T01:32:24Z", "status": 200, "sha256": "f192038c9db609935938ad402e4604d3c6ebfcac98d0f7f5516b4a084fd30716", "file": "fetched/koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana__20261024T013223Z.html", "final_url": "https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang", "title": "Upaya Global Perbaiki Celah Keamanan Siber PHP, dari Amazon hingga Kementerian Jepang", "excerpt": "Perusahaan keamanan siber Wiz memperkirakan \"sekitar 70%\" internet terpengaruh oleh celah keamanan PHP" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "lebigdata-php2shell-des-millions-dattaques-frappen", "publisher": "LeBigData", "url": "https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant", "vault": { "stamp": "20261023T160435Z", "file": "sources/lebigdata-php2shell-des-millions-dattaques-frappen/captures/20261023T160435Z/text.txt", "sha256": "e2295f56852e6bb0a72ce660e7a5be199cf097dfdd19e09a4a5b7cc649ad5f13", "excerpt": "Près de 70 % du Web utilise PHP : mais non, 70 % des sites ne sont pas automatiquement piratables" }, "now": { "retrieved_at": "2026-10-24T01:32:24Z", "status": 200, "sha256": "117c392c1899b61bddfb4642c4c1b0c8312cd994d4f77609d015e03ce30dabae", "file": "fetched/lebigdata-php2shell-des-millions-dattaques-frappen__20261024T013224Z.html", "final_url": "https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant", "title": "PHP2Shell : comment protéger votre site des attaques PHP", "excerpt": "Près de 70 % du Web utilise PHP : mais non, 70 % des sites ne sont pas automatiquement piratables" }, "classification": "unchanged", "correction_note": null, "notes": "All vault 70% sentences still present (some differ only by whitespace)." }, { "slug_or_url": "linternaute-hightech-internet-11310057-panne-interne", "publisher": "L'Internaute", "url": "https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/", "vault": { "stamp": "20261023T160435Z", "file": "sources/linternaute-hightech-internet-11310057-panne-interne/captures/20261023T160435Z/text.txt", "sha256": "940e7811d3ae55de70fd3dac417e2c383c58e2a555b36c27a5e1a39140fa0a6b", "excerpt": "La cause de cette panne sur Internet est l'identification de deux failles de sécurité dans PHP (pour Hypertext Preprocessor), un langage de programmation qui structure près de 70% des sites" }, "now": { "retrieved_at": "2026-10-24T01:32:24Z", "status": 200, "sha256": "605b95f5ac959e916755c5843f737e9f252c3800892a61ef561fc898614fda36", "file": "fetched/linternaute-hightech-internet-11310057-panne-interne__20261024T013224Z.html", "final_url": "https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/", "title": "Failles PHP : c'est quoi ? On vous explique la panique mondiale sur internet, l'IA au coeur du problème", "excerpt": "La cause de cette panne sur Internet est l'identification de deux failles de sécurité dans PHP (pour Hypertext Preprocessor), un langage de programmation qui structure près de 70% des sites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "lorikeet-php2shell", "publisher": "Lorikeet Security", "url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities", "vault": { "stamp": "20261022T112438Z", "file": "sources/lorikeet-php2shell/captures/20261022T112438Z/text.txt", "sha256": "db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349", "excerpt": "The 70% Blast Radius: Why CMS Security & Web Plugins Fail" }, "now": { "retrieved_at": "2026-10-24T01:32:25Z", "status": 200, "sha256": "d65e4a94ff7eb5bc34f60a5bf1da95d7ad5a61c4e248f5c1c1fd765b8c942fd5", "file": "fetched/lorikeet-php2shell__20261024T013224Z.html", "final_url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities", "title": "php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security", "excerpt": "The 70% Blast Radius: Why CMS Security & Web Plugins Fail" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "medianama-2026-10-223-php-vulnerabilities-global-rush-update", "publisher": "MediaNama", "url": "https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/", "vault": { "stamp": "20261023T080331Z", "file": "sources/medianama-2026-10-223-php-vulnerabilities-global-rush-update/captures/20261023T080331Z/text.txt", "sha256": "b30b86dc910dc8d60cbb6deaf6383d04f99c68b984c5d04673dd949e1cb4f04d", "excerpt": "Two critical security vulnerabilities in PHP, the programming language behind around 70% of the internet, were disclosed publicly on October 21, 2026, along with fixed patches" }, "now": { "retrieved_at": "2026-10-24T01:32:25Z", "status": 200, "sha256": "2a93594773b63af269563964dba65a753859ff4bfe3916fc635931039dd84f39", "file": "fetched/medianama-2026-10-223-php-vulnerabilities-global-rush-update__20261024T013225Z.html", "final_url": "https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/", "title": "What are the two PHP vulnerabilities behind a global rush to update", "excerpt": "Two critical security vulnerabilities in PHP, the programming language behind around 70% of the internet, were disclosed publicly on October 21, 2026, along with fixed patches" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94", "publisher": "Yahoo! News Japan (THE PAGE)", "url": "https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6", "vault": { "stamp": "20261023T160435Z", "file": "sources/news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94/captures/20261023T160435Z/text.txt", "sha256": "3f6309ea905ada2a3609b89da18be043419e1e2c246a6acd26772a44a06cdee3", "excerpt": "出典記事は「PHP欠陥、企業・団体が予防措置 銀行サービス一時停止」「プログラミング言語「PHP」に脆弱性 世界のサイト7割が危険に」" }, "now": { "retrieved_at": "2026-10-24T01:32:27Z", "status": 200, "sha256": "af45f1a112fb2e83bf4a371aa9970df9a84b6839ed5e0817b132bda2808c6ca6", "file": "fetched/news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94__20261024T013225Z.html", "final_url": "https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6", "title": "【図解】重大な脆弱性が見つかった「PHP」とは？（Yahoo!ニュース オリジナル THE PAGE）", "excerpt": "出典記事は「PHP欠陥、企業・団体が予防措置 銀行サービス一時停止」「プログラミング言語「PHP」に脆弱性 世界のサイト7割が危険に」" }, "classification": "unchanged", "correction_note": null, "notes": "Article text unchanged; a related-article link titled with 7割 seen in the vault capture is not in the live static HTML." }, { "slug_or_url": "newsweek-php2shell-list", "publisher": "Newsweek", "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "vault": { "stamp": "20261022T081350Z", "file": "sources/newsweek-php2shell-list/captures/20261022T081350Z/text.txt", "sha256": "dc7ff69a1e38d3d6a18e69e19cca63a0b086601d4ae1fb2fe1c77654b30957be", "excerpt": "Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable to these particular attacks" }, "now": { "retrieved_at": "2026-10-24T01:32:27Z", "status": 200, "sha256": "59cbf9a0f2b5ad6f951b71935dd286edb880161c424584f229d8947bab0a79dc", "file": "fetched/newsweek-php2shell-list__20261024T013227Z.html", "final_url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "title": "PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek", "excerpt": "Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable to these particular attacks" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "newsweek-php2shell-websites", "publisher": "Newsweek", "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "vault": { "stamp": "20261022T112237Z", "file": "sources/newsweek-php2shell-websites/captures/20261022T112237Z/text.txt", "sha256": "323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294", "excerpt": "Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable to these particular attacks" }, "now": { "retrieved_at": "2026-10-24T01:32:27Z", "status": 200, "sha256": "59cbf9a0f2b5ad6f951b71935dd286edb880161c424584f229d8947bab0a79dc", "file": "fetched/newsweek-php2shell-list__20261024T013227Z.html", "final_url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "title": "PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek", "excerpt": "Wiz Research estimates that PHP powers roughly 70 percent of websites worldwide, though that does not mean 70 percent of websites are vulnerable to these particular attacks" }, "classification": "unchanged", "correction_note": null, "notes": "Same URL as another vault slug; one fetch serves both." }, { "slug_or_url": "nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan", "publisher": "Nguoi Quan Sat", "url": "https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html", "vault": { "stamp": "20261023T160435Z", "file": "sources/nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan/captures/20261023T160435Z/text.txt", "sha256": "176d23d05dee09bd3ec76145b7258bdc602945e0ae56615e62e4164b7e2def48", "excerpt": "Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ" }, "now": { "retrieved_at": "2026-10-24T01:32:29Z", "status": 200, "sha256": "0fce5e9309c3073d9d78a9b839366b0de5afd13d64cb8096d37ed7e475c39f61", "file": "fetched/nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan__20261024T013227Z.html", "final_url": "https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html", "title": "Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ", "excerpt": "Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "nsa-x-2113068811058622971", "publisher": "NSA Cybersecurity (X)", "url": "https://x.com/NSACyber/status/2113068811058622971", "vault": { "stamp": "20261022T080954Z", "file": "sources/nsa-x-2113068811058622971/captures/20261022T080954Z/text.txt", "sha256": "899e5ba4af69c5311210a846d98721e674abded497de292dfdc4af17b2ff1bd3", "excerpt": "the NSA just told 70% of the internet to “turn it off and on again”" }, "now": { "retrieved_at": "2026-10-24T01:32:29Z", "status": 200, "sha256": "3019588332aecb098afe9bd16f716730b4f35f39f72a6834810819c94e7c668f", "file": "fetched/nsa-x-2113068811058622971__20261024T013229Z.html", "final_url": "https://x.com/NSACyber/status/2113068811058622971", "title": "NSA Cyber on X: \"UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: https://t.co/nuXgQ10Fzc\" / X", "excerpt": "the NSA just told 70% of the internet to “turn it off and on again”" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "openai-community-php-flaws", "publisher": "OpenAI Community", "url": "https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490", "vault": { "stamp": "20261022T081721Z", "file": "sources/openai-community-php-flaws/captures/20261022T081721Z/text.txt", "sha256": "43afe7a0a3b96a86e52cbeea1c6ae41560bab1566da848fc4f9067152f739cd5", "excerpt": "OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites" }, "now": { "retrieved_at": "2026-10-24T01:32:30Z", "status": 200, "sha256": "80decc77eef0ff91161b2161f5123a5d29a8d8232e12565d8ea5f01de46ff08e", "file": "fetched/openai-community-php-flaws__20261024T013229Z.html", "final_url": "https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490", "title": "OpenAI models help researchers uncover critical PHP security flaws - Community - OpenAI Developer Community", "excerpt": "OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "orf-stories-3445806", "publisher": "ORF", "url": "https://orf.at/stories/3445806/", "vault": { "stamp": "20261022T181608Z", "file": "sources/orf-stories-3445806/captures/20261022T181608Z/text.txt", "sha256": "e88c6f39edbd6d1c325ec7cc18abe50a9b8ad94010b2d5a425ba59e4252b2d0d", "excerpt": "Nach Einschätzung des US-israelischen Cybersicherheitsunternehmen Wiz basieren etwa 70 Prozent der weltweiten Websites auf PHP" }, "now": { "retrieved_at": "2026-10-24T01:32:31Z", "status": 200, "sha256": "e6e819c970cd07143bba576750bd3778fd9613309af974447b013b2b5d311608", "file": "fetched/orf-stories-3445806__20261024T013230Z.html", "final_url": "https://orf.at/stories/3445806/", "title": "PHP-Lücke: Millionen Angriffsversuche im Netz - news.ORF.at", "excerpt": "Nach Einschätzung des US-israelischen Cybersicherheitsunternehmen Wiz basieren etwa 70 Prozent der weltweiten Websites auf PHP" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "paperjam-article-php2shell-des-milliers-de-sites", "publisher": "Paperjam", "url": "https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg", "vault": { "stamp": "20261023T160435Z", "file": "sources/paperjam-article-php2shell-des-milliers-de-sites/captures/20261023T160435Z/text.txt", "sha256": "73aed7ccd645b7172699b36b2e9dd8540c0300f2ff6c3de8ad218d7aeb29b20e", "excerpt": "PHP fait fonctionner près de 70% des sites dont le langage côté serveur peut être identifié dans le monde, selon W3Techs" }, "now": { "retrieved_at": "2026-10-24T01:32:31Z", "status": 200, "sha256": "844c7944fa663762adf8ac6c27adfb39a47b63e02d5ec15756ddd0ac1973f74d", "file": "fetched/paperjam-article-php2shell-des-milliers-de-sites__20261024T013231Z.html", "final_url": "https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg", "title": "PHP2Shell: des milliers de sites exposés au Luxembourg | Paperjam News", "excerpt": "PHP fait fonctionner près de 70% des sites dont le langage côté serveur peut être identifié dans le monde, selon W3Techs" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw", "publisher": "PCMag", "url": "https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw", "vault": { "stamp": "20261023T080331Z", "file": "sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/captures/20261023T080331Z/text.txt", "sha256": "82ef905cd2201bd4507643ba274b135e32b1e440606b1ded976617c782b28166", "excerpt": "The flaw affects PHP, a scripting language used by an estimated 70% of websites" }, "now": { "retrieved_at": "2026-10-24T01:32:32Z", "status": 200, "sha256": "eda3fa74492dddcf641d889e0d82adcc673d99e5e3d4886e5493d531fcd8d3b1", "file": "fetched/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw__20261024T013231Z.html", "final_url": "https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw", "title": "Hackers Already Trying to Exploit Serious PHP Flaw | PCMag", "excerpt": "The flaw affects PHP, a scripting language used by an estimated 70% of websites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "php-foundation-blog-security-release", "publisher": "The PHP Foundation", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "vault": { "stamp": "20261022T080901Z", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "excerpt": "I also saw a lot of \"PoCs\", so I understand the fear, but releasing the patch early and thus risking 70% of the web just to make sure you get" }, "now": { "retrieved_at": "2026-10-24T01:32:32Z", "status": 200, "sha256": "03c22f760a3da8749d98ddd40dbb79d50464e5be7e10c1433da16f589e656158", "file": "fetched/php-foundation-blog-security-release__20261024T013232Z.html", "final_url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation — Supporting, Advancing, and Developing the PHP Language", "excerpt": null }, "classification": "unverifiable", "correction_note": null, "notes": "The only 70% wording is in a reader comment that the page renders by script (vault rendered.html has it, vault page.html does not). curl gets the static HTML only, so the comment could not be re-checked. The post body has no 70% figure." }, { "slug_or_url": "php2shell-com", "publisher": "php2shell.com (Wiz/Calif)", "url": "https://www.php2shell.com/", "vault": { "stamp": "20261022T111831Z", "file": "sources/php2shell-com/captures/20261022T111831Z/text.txt", "sha256": "b1e83b4f0feb87d5abb59bfb76015b154a7b678a51c0e965e06929f1e6b17f48", "excerpt": "PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki" }, "now": { "retrieved_at": "2026-10-24T01:32:32Z", "status": 200, "sha256": "3cd8d65ea92fff67fe8ba33a859adf17d23ec992b51a919ea16ace361b803805", "file": "fetched/php2shell-com__20261024T013232Z.html", "final_url": "https://www.php2shell.com/", "title": "PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web", "excerpt": "PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "phpfoundation-blog-security-release-leak", "publisher": "The PHP Foundation", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "vault": { "stamp": "20261022T081244Z", "file": "sources/phpfoundation-blog-security-release-leak/captures/20261022T081244Z/text.txt", "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "excerpt": "I also saw a lot of \"PoCs\", so I understand the fear, but releasing the patch early and thus risking 70% of the web just to make sure you get" }, "now": { "retrieved_at": "2026-10-24T01:32:32Z", "status": 200, "sha256": "03c22f760a3da8749d98ddd40dbb79d50464e5be7e10c1433da16f589e656158", "file": "fetched/php-foundation-blog-security-release__20261024T013232Z.html", "final_url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation — Supporting, Advancing, and Developing the PHP Language", "excerpt": null }, "classification": "unverifiable", "correction_note": null, "notes": "Same URL as another vault slug; one fetch serves both. The only 70% wording is in a reader comment that the page renders by script (vault rendered.html has it, vault page.html does not). curl gets the static HTML only, so the comment could not be re-checked. The post body has no 70% figure." }, { "slug_or_url": "rte-reuters-websites-go-dark", "publisher": "RTE (Reuters)", "url": "https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/", "vault": { "stamp": "20261022T081010Z", "file": "sources/rte-reuters-websites-go-dark/captures/20261022T081010Z/text.txt", "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "excerpt": "He said the popular programme is used by 70% of websites worldwide" }, "now": { "retrieved_at": "2026-10-24T01:32:33Z", "status": 200, "sha256": "c7a716b8c2b2f5be15981c4b1f23f4e9b578b7afcbcd451b60ee52fc23533252", "file": "fetched/rte-reuters-websites-go-dark__20261024T013232Z.html", "final_url": "https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/", "title": "Websites go dark as AI exposes critical security flaws", "excerpt": "He said the popular programme is used by 70% of websites worldwide" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi", "publisher": "RTL.de", "url": "https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html", "vault": { "stamp": "20261022T181608Z", "file": "sources/rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi/captures/20261022T181608Z/text.txt", "sha256": "a69da5f39287ad4307292733dfaf03317eb57edfcc30fc1959d41922af77bcf7", "excerpt": "Schätzungsweise 70 Prozent aller Websites basieren auf dem Skript" }, "now": { "retrieved_at": "2026-10-24T01:32:33Z", "status": 200, "sha256": "26b4143fd623867ce2676beb4af822d0b8e9bf1d6580bd02fefa2d5d0ca7f6ff", "file": "fetched/rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi__20261024T013233Z.html", "final_url": "https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html", "title": "PHP-Lücke: BSI warnt vor Cyber-Gefahr – Firmen oft unwissend", "excerpt": "Schätzungsweise 70 Prozent aller Websites basieren auf dem Skript" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili", "publisher": "RTVE", "url": "https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml", "vault": { "stamp": "20261022T181608Z", "file": "sources/rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili/captures/20261022T181608Z/text.txt", "sha256": "0c7f8e327e5c8bd0d5c3b0c7c6ab7cb7ef3a383f5da908cecc7da96ba7a19ccf", "excerpt": "Su alcance es masivo: está presente en cerca del 70% de las páginas web con lenguaje identificable y también es la base de WordPress, el sistema que impulsa alrededor del" }, "now": { "retrieved_at": "2026-10-24T01:32:34Z", "status": 200, "sha256": "3c2bc244f4b26f84e3a9b22b7841160b32b71e70475192c29631acb8e0392cce", "file": "fetched/rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili__20261024T013233Z.html", "final_url": "https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml", "title": "Alerta por fallos críticos en PHP: riesgo en servidores web", "excerpt": "Su alcance es masivo: está presente en cerca del 70% de las páginas web con lenguaje identificable y también es la base de WordPress, el sistema que impulsa alrededor del" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "securitynl-misbruik-gemeld", "publisher": "Security.NL", "url": "https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online", "vault": { "stamp": "20261022T191411Z", "file": "sources/securitynl-misbruik-gemeld/captures/20261022T191411Z/text.txt", "sha256": "95d1565c5959e61fa188ea5af37ef0518b3c171d442554cbee86484dd03ddd09", "excerpt": "Om die reden draait het op 70% vd sites" }, "now": { "retrieved_at": "2026-10-24T01:32:35Z", "status": 200, "sha256": "5bf8b35957e71b5da98257cf047b4f0432c28eadb757401c197e7af34a8ee393", "file": "fetched/securitynl-misbruik-gemeld__20261024T013234Z.html", "final_url": "https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online", "title": "Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online - Security.NL", "excerpt": "Om die reden draait het op 70% vd sites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "securityweek-first-attempts-sensors", "publisher": "SecurityWeek", "url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/", "vault": { "stamp": "20261022T112324Z", "file": "sources/securityweek-first-attempts-sensors/captures/20261022T112324Z/text.txt", "sha256": "b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41", "excerpt": "Because the security defects are in PHP itself, they impact 70% of all websites in the world, independent of their CMS" }, "now": { "retrieved_at": "2026-10-24T01:32:35Z", "status": 200, "sha256": "a95fcd372006a4351b8dad9a6a10275a2d469562b5681cd0739e6a2abdd2c7c7", "file": "fetched/securityweek-first-attempts-sensors__20261024T013235Z.html", "final_url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/", "title": "PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek", "excerpt": "Because the security defects are in PHP itself, they impact 70% of all websites in the world, independent of their CMS" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "seroundtable-google-php2shell-42353-html", "publisher": "Search Engine Roundtable", "url": "https://www.seroundtable.com/google-php2shell-42353.html", "vault": { "stamp": "20261023T080331Z", "file": "sources/seroundtable-google-php2shell-42353-html/captures/20261023T080331Z/text.txt", "sha256": "ced33ac294361df1bd82380fede1bad604578ac5148f9ac7f71ba83ebabbb24e", "excerpt": "This PHP exploit is serious; it can allow for unauthenticated remote code execution (RCE) and memory disclosure across roughly 70% of the world's websites" }, "now": { "retrieved_at": "2026-10-24T01:32:36Z", "status": 200, "sha256": "8fa18c77b5e68e44d9fb6f7a2df58dc2e10dcfef3cdb80ecfa031b948f9f31ab", "file": "fetched/seroundtable-google-php2shell-42353-html__20261024T013235Z.html", "final_url": "https://www.seroundtable.com/google-php2shell-42353.html", "title": "Google Advice On Taking Sites Down When Fixing PHP2Shell - The PHP Exploit", "excerpt": "This PHP exploit is serious; it can allow for unauthenticated remote code execution (RCE) and memory disclosure across roughly 70% of the world's websites" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "substack-lopezkurtz-patch-is-the-exploit", "publisher": "David Lopez-Kurtz (Substack)", "url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit", "vault": { "stamp": "20261022T113134Z", "file": "sources/substack-lopezkurtz-patch-is-the-exploit/captures/20261022T113134Z/text.txt", "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "excerpt": "he attack before any application code runs.” PHP’s advisories skip the branding and stick to plainer titles (“RCE via OOM corruption” and “RCE via stale global state”).[1] The Wall Street" }, "now": { "retrieved_at": "2026-10-24T01:32:36Z", "status": 200, "sha256": "a9e7bfa66631ad1e6cdda3e12e498ea816319de08b4cb6a46920f26ae16c95f7", "file": "fetched/substack-lopezkurtz-patch-is-the-exploit__20261024T013236Z.html", "final_url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit", "title": "The Patch Is the Exploit - by David Lopez-Kurtz", "excerpt": "he attack before any application code runs.” PHP’s advisories skip the branding and stick to plainer titles (“RCE via OOM corruption” and “RCE via stale global state”).[1] The Wall Street" }, "classification": "unchanged", "correction_note": null, "notes": "All vault 70% sentences still present (some differ only by whitespace)." }, { "slug_or_url": "tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo", "publisher": "Everyeye Tech", "url": "https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html", "vault": { "stamp": "20261023T160435Z", "file": "sources/tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo/captures/20261023T160435Z/text.txt", "sha256": "e7a5a2d24c7eb2aa38181b0292f6a2cc695ad4388ed7ca476335140c75cab18d", "excerpt": "VULNERABILITÀ PHP: IL 70% DEI SITI AL MONDO È STATO A RISCHIO PER PIÙ DI 10 ANNI!" }, "now": { "retrieved_at": "2026-10-24T01:32:36Z", "status": 200, "sha256": "6b9d1a356b39ccd72abf285020223ae38a01ecc6c427205c1121dacb6708aafb", "file": "fetched/tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo__20261024T013236Z.html", "final_url": "https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html", "title": "Vulnerabilità PHP: il 70% dei siti al mondo è stato a rischio per più di 10 anni!", "excerpt": "Vulnerabilità PHP: il 70% dei siti al mondo è stato a rischio per più di 10 anni!" }, "classification": "unchanged", "correction_note": null, "notes": "Vault text is upper-cased by CSS; live HTML has the same headline in mixed case." }, { "slug_or_url": "the-verge-php2shell-websites-down", "publisher": "The Verge", "url": "https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down", "vault": { "stamp": "20261023T012042Z", "file": "sources/the-verge-php2shell-websites-down/captures/20261023T012042Z/text.txt", "sha256": "1a9a20537e477cc84bdd688c3d13f165e980a7bae0aa54bd2f88011d32d3b3d3", "excerpt": "By some accounts, up to 70 percent of websites use PHP in some capacity" }, "now": { "retrieved_at": "2026-10-24T01:32:37Z", "status": 200, "sha256": "0568576d8c28d24d154c2fed13f2739b7486959a6349100805af11b387972cce", "file": "fetched/the-verge-php2shell-websites-down__20261024T013236Z.html", "final_url": "https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down", "title": "Everything we know so far about the PHP2Shell vulnerability | The Verge", "excerpt": "By some accounts, up to 70 percent of websites use PHP in some capacity" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "thehackernews-php2shell-4days", "publisher": "The Hacker News", "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "vault": { "stamp": "20261022T081320Z", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "excerpt": "\"PHP is used by almost 70% of websites,\" Cloudflare said" }, "now": { "retrieved_at": "2026-10-24T01:32:37Z", "status": 200, "sha256": "efe7ccaf49d1d8e4c23ba319ec35e1c7f7f1ede785b0422537de4d5935c29dc8", "file": "fetched/thehackernews-php2shell-4days__20261024T013237Z.html", "final_url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "title": "Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed", "excerpt": "\"PHP is used by almost 70% of websites,\" Cloudflare said" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "therecord-php-foundation-statement", "publisher": "The Record", "url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities", "vault": { "stamp": "20261022T113158Z", "file": "sources/therecord-php-foundation-statement/captures/20261022T113158Z/text.txt", "sha256": "28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e", "excerpt": "Some estimates show that more than 70% of all websites on the internet use PHP" }, "now": { "retrieved_at": "2026-10-24T01:32:37Z", "status": 200, "sha256": "1c24b8ba8f40a8b0b76a06f202f1641f71498af0f74d4a389e65ab605582e4aa", "file": "fetched/therecord-php-foundation-statement__20261024T013237Z.html", "final_url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities", "title": "PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Record from Recorded Future News", "excerpt": "Some estimates show that more than 70% of all websites on the internet use PHP" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "therecord-php-warnings", "publisher": "The Record", "url": "https://therecord.media/php-script-vulnerabilities-warnings", "vault": { "stamp": "20261022T080854Z", "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "excerpt": "Some estimates show that more than 70% of all websites on the internet use PHP" }, "now": { "retrieved_at": "2026-10-24T01:32:38Z", "status": 200, "sha256": "a3f188b988cf10baf5432642662b2c1f0ffba1722abc633c4612d4d659bd423c", "file": "fetched/therecord-php-warnings__20261024T013237Z.html", "final_url": "https://therecord.media/php-script-vulnerabilities-warnings", "title": "Hundreds of websites taken offline as concern grows over two PHP vulnerabilities | The Record from Recorded Future News", "excerpt": "Some estimates show that more than 70% of all websites on the internet use PHP" }, "classification": "unchanged", "correction_note": null, "notes": "New correction note since the vault capture, unrelated to 70%: \"Correction: A previous version of this article used an incorrect pronoun for Detectify researcher Joviane Jardim.\" The 70% sentence is unchanged." }, { "slug_or_url": "theregister-php-blames-chainguard", "publisher": "The Register", "url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "vault": { "stamp": "20261022T113204Z", "file": "sources/theregister-php-blames-chainguard/captures/20261022T113204Z/text.txt", "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "excerpt": "affected servers, steal sensitive data, and deface the websites running on them,” Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz warned on Wednesday, adding the oft-quoted stat" }, "now": { "retrieved_at": "2026-10-24T01:32:38Z", "status": 200, "sha256": "250e37d95551326ffb238f5c39a6920df2b677e81f04e44e475c4338ffd840a3", "file": "fetched/theregister-php-blames-chainguard__20261024T013238Z.html", "final_url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "title": "PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk", "excerpt": "affected servers, steal sensitive data, and deface the websites running on them,” Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz warned on Wednesday, adding the oft-quoted stat" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "tpo-nl-digid-offline", "publisher": "TPO.NL", "url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "vault": { "stamp": "20261022T113213Z", "file": "sources/tpo-nl-digid-offline/captures/20261022T113213Z/text.txt", "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "excerpt": "Het gaat om twee kwetsbaarheden in de kern van PHP, de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait" }, "now": { "retrieved_at": "2026-10-24T01:32:39Z", "status": 200, "sha256": "1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad", "file": "fetched/tpo-nl-digid-offline__20261024T013238Z.html", "final_url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "title": "PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL", "excerpt": "Het gaat om twee kwetsbaarheden in de kern van PHP, de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "tpo-tpo-nl-digid-offline", "publisher": "TPO.NL", "url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "vault": { "stamp": "20261022T171501Z", "file": "sources/tpo-tpo-nl-digid-offline/captures/20261022T171501Z/text.txt", "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "excerpt": "Het gaat om twee kwetsbaarheden in de kern van PHP, de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait" }, "now": { "retrieved_at": "2026-10-24T01:32:39Z", "status": 200, "sha256": "1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad", "file": "fetched/tpo-nl-digid-offline__20261024T013238Z.html", "final_url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "title": "PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL", "excerpt": "Het gaat om twee kwetsbaarheden in de kern van PHP, de taal waarop volgens de PHP Foundation en beveiligingsbedrijf Wiz zo’n 70 procent van de websites draait" }, "classification": "unchanged", "correction_note": null, "notes": "Same URL as another vault slug; one fetch serves both." }, { "slug_or_url": "trak-stories-70-websites-at-security-risk-due", "publisher": "Trak.in", "url": "https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/", "vault": { "stamp": "20261023T160435Z", "file": "sources/trak-stories-70-websites-at-security-risk-due/captures/20261023T160435Z/text.txt", "sha256": "019553b7a67c18ab791515f5de15e32683828dbee3ffb981c370cf741299b786", "excerpt": "70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell" }, "now": { "retrieved_at": "2026-10-24T01:32:39Z", "status": 200, "sha256": "d2073c4cf5aab41ec0cae39f83e7cd9fce8caef46e2c7791b35b609d137f13ce", "file": "fetched/trak-stories-70-websites-at-security-risk-due__20261024T013239Z.html", "final_url": "https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/", "title": "70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell - Trak.in - Indian Business of Tech, Mobile & Startups", "excerpt": "70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "usa-today-php2shell-live", "publisher": "USA Today", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "vault": { "stamp": "20261023T012042Z", "file": "sources/usa-today-php2shell-live/captures/20261023T012042Z/text.txt", "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "excerpt": "A critical security issue in a programming language used in as much as 70% of websites has put much of the internet at risk, sending shock waves around the globe" }, "now": { "retrieved_at": "2026-10-24T01:32:39Z", "status": 402, "sha256": "e8dbc3dd43c22a207485dc95fbec2a04690a23b6ab2d5bbe64715c2829e7ffac", "file": "fetched/usa-today-php2shell-live__20261024T013239Z.html", "final_url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "title": "Access Restricted", "excerpt": null }, "classification": "blocked", "correction_note": null, "notes": "HTTP 402; page title now: 'Access Restricted'. Not guessed." }, { "slug_or_url": "wikipedia-php2shell", "publisher": "Wikipedia", "url": "https://en.wikipedia.org/wiki/PHP2Shell", "vault": { "stamp": "20261022T112309Z", "file": "sources/wikipedia-php2shell/captures/20261022T112309Z/text.txt", "sha256": "bbb51bbd069506b09282b45086984565ae875b5d974d121584c8e2b3c912222f", "excerpt": "\"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog\"" }, "now": { "retrieved_at": "2026-10-24T01:32:39Z", "status": 200, "sha256": "f7acb60f6cc157187728644dd16ec491689c3e9164c4c5bda572cc3da22b5239", "file": "fetched/wikipedia-php2shell__20261024T013239Z.html", "final_url": "https://en.wikipedia.org/wiki/PHP2Shell", "title": "PHP2Shell - Wikipedia", "excerpt": "PHP is a popular programming language that many website architectures are built upon, with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web" }, "classification": "changed", "correction_note": null, "notes": "Vault capture (22 Oct 11:23 UTC) had 70% only in reference titles. The lead sentence was added in revision 1381581724 (13:41 UTC, 23 Oct 2026, editor Masem); revision 1381578822 (13:11 UTC) lacks it. Still present in the latest revision 1381672424 (01:37 UTC, 24 Oct)." }, { "slug_or_url": "wiz-blog-php2shell", "publisher": "Wiz", "url": "https://www.wiz.io/blog/php2shell-php-rce", "vault": { "stamp": "20261022T081047Z", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" }, "now": { "retrieved_at": "2026-10-24T01:32:40Z", "status": 200, "sha256": "4aaa4cf67373e369b913a25cfd18b8081f283ac1ba53909c986f153c2b39e14a", "file": "fetched/wiz-blog-php2shell__20261024T013239Z.html", "final_url": "https://www.wiz.io/blog/php2shell-php-rce", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "x-openai-php2shell", "publisher": "OpenAI (X)", "url": "https://x.com/OpenAI/status/2112907856018309586", "vault": { "stamp": "20261022T081645Z", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "excerpt": "OpenAI on X: \"OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70%" }, "now": { "retrieved_at": "2026-10-24T01:32:41Z", "status": 200, "sha256": "15454eed879f64e65ed9407e0169b63801a8c39c5a15d2e5512f620f155e19e0", "file": "fetched/x-openai-php2shell__20261024T013240Z.html", "final_url": "https://x.com/OpenAI/status/2112907856018309586", "title": "OpenAI on X: \"OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and s… / X", "excerpt": "OpenAI on X: \"OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70%" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "x-wiz-io-php2shell", "publisher": "Wiz (X)", "url": "https://x.com/wiz_io/status/2112899813264277528", "vault": { "stamp": "20261022T081624Z", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "excerpt": "Wiz on X: \"🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.\"" }, "now": { "retrieved_at": "2026-10-24T01:32:41Z", "status": 200, "sha256": "a3c6238d99d088c05114a9b8fbc8e552779419ebf465975879680c24176aac64", "file": "fetched/x-wiz-io-php2shell__20261024T013241Z.html", "final_url": "https://x.com/wiz_io/status/2112899813264277528", "title": "Wiz on X: \"🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.\" / X", "excerpt": "Wiz on X: \"🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.\"" }, "classification": "unchanged", "correction_note": null, "notes": "" }, { "slug_or_url": "aws-security-blog-madpot", "publisher": "AWS Security Blog", "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "vault": { "stamp": "20261022T111755Z", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "outreach": "R-004" }, "now": { "retrieved_at": "2026-10-24T01:32:42Z", "status": 200, "sha256": "1889fa097c9073520cbb6526ebd4d044d224371107abd89b52dae3f4d7c862c4", "file": "fetched/aws-security-blog-madpot__20261024T013241Z.html", "final_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "title": "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog", "excerpt": "PHP2Shell is now seeing broad exploitation attempts in the wild." }, "classification": "changed", "correction_note": null, "notes": "Not a 70% wording but outreach R-004: \"now being broadly exploited in the wild\" became \"now seeing broad exploitation attempts in the wild\". article:modified_time moved from 2026-10-21T21:36:56-07:00 (vault) to 2026-10-22T14:25:03-07:00. No update note found on the page." }, { "slug_or_url": "wired-exploited-days-before-patched", "publisher": "WIRED", "url": "https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/", "vault": { "stamp": "20261023T012042Z", "file": "sources/wired-exploited-days-before-patched/captures/20261023T012042Z/text.txt", "sha256": "d43b99af65d563ddd047c20c80d5318813eda28abd497763f91dd0a6ab8427cd", "excerpt": "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched", "outreach": "R-005" }, "now": { "retrieved_at": "2026-10-24T01:32:42Z", "status": 200, "sha256": "853f594c681c4fc1c71943d28b80be1438592f356aed671c697d5613c3cf978d", "file": "fetched/wired-exploited-days-before-patched__20261024T013242Z.html", "final_url": "https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/", "title": "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED", "excerpt": "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched" }, "classification": "unchanged", "correction_note": null, "notes": "Outreach R-005 page; no 70% wording; headline unchanged." }, { "slug_or_url": "bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a", "publisher": "BankInfoSecurity (ISMG)", "url": "https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161", "vault": { "stamp": "20261023T080331Z", "file": "sources/bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a/captures/20261023T080331Z/text.txt", "sha256": "c0242ed45a367f748a8e597436b19a84a00c9199c5e0300ff98dfc94e55c43c3", "excerpt": "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP", "outreach": "R-006" }, "now": { "retrieved_at": "2026-10-24T01:32:44Z", "status": 200, "sha256": "2767ab90064697398e44c3e3c00735bede8ec2d1cbf3381944d443ec7a5b58d3", "file": "fetched/bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a__20261024T013242Z.html", "final_url": "https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161", "title": "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP", "excerpt": "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP" }, "classification": "unchanged", "correction_note": null, "notes": "Outreach R-006 page; no 70% wording; headline unchanged; its \"Update Oct. 22, 2026 07:45 UTC\" note was already in the vault capture." }, { "slug_or_url": "letemps-php-sites-debranches", "publisher": "Le Temps", "url": "https://letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php", "vault": { "stamp": "20261022T081413Z", "file": "sources/letemps-php-sites-debranches/captures/20261022T081413Z/text.txt", "sha256": "4330f33c3b6763a95df44d21cfc602ec5f9bfd9df6141e863545c6a9a276cf4e", "excerpt": "des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP", "outreach": "R-010" }, "now": { "retrieved_at": "2026-10-24T01:32:45Z", "status": 200, "sha256": "1fe1216bec77f5bd95c45bb33e37abc93dc9b20b945b0bcdb43fbf2970279cb2", "file": "fetched/letemps-php-sites-debranches__20261024T013244Z.html", "final_url": "https://www.letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php", "title": "Alerte sur le Web: des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP - Le Temps", "excerpt": "des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP" }, "classification": "unchanged", "correction_note": null, "notes": "Outreach R-010 page; no 70% wording; headline unchanged (URL now redirects to www.letemps.ch)." }, { "slug_or_url": "techtarget-itmedia-tt-article-2610-23-2000002526", "publisher": "TechTarget Japan (ITmedia)", "url": "https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/", "vault": { "stamp": "20261023T160435Z", "file": "sources/techtarget-itmedia-tt-article-2610-23-2000002526/captures/20261023T160435Z/text.txt", "sha256": "14c421632d9592d8a6b0b2bef1f45af7363175b91bd978cc453d73de9b51dbdb", "excerpt": "2200万台以上のサーバが危険にさらされた", "outreach": "R-011" }, "now": { "retrieved_at": "2026-10-24T01:32:47Z", "status": 200, "sha256": "d8a949ebfaf6eb46e9a048c51151bacaf979b55cbbcc6461d7b2dd6480a76803", "file": "fetched/techtarget-itmedia-tt-article-2610-23-2000002526__20261024T013245Z.html", "final_url": "https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/", "title": "PHP脆弱性「PHP2Shell」で2260万件に影響 情シスの緊急チェックリスト：OpenAIモデルが暴いた脆弱性 - TechTargetジャパン", "excerpt": "2200万台以上のサーバが危険にさらされた" }, "classification": "unchanged", "correction_note": null, "notes": "Outreach R-011 page; no 70% wording; summary unchanged. Page shows 公開 2026年10月23日 05時00分 更新 2026年10月23日 09時43分 (same as at capture time)." } ], "snapshots": [ { "url": "https://www.wiz.io/blog/php2shell-php-rce", "timestamp": "20261021134412", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261021000000)", "evidence": { "file": "fetched/cdx/avail_1_20261021000000__20261024T013902Z.json", "sha256": "2f3a55d4b4b146ce1565dce491e65d9e929618f3159275587b63692a1db67dc3" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://www.wiz.io/blog/php2shell-php-rce", "timestamp": "20261023160032", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261024000000)", "evidence": { "file": "fetched/cdx/avail_1_20261024000000__20261024T013906Z.json", "sha256": "9756677281d9269dcdbf04d097890533a54a6ef54b103d302336dc45b769c0a9" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "timestamp": null, "digest": null, "status": null, "excerpt": null, "source": "archive.org/wayback/available (closest to 20261021000000)", "evidence": { "file": "fetched/cdx/avail_2_20261021000000__20261024T013907Z.json", "sha256": "89471b287217ff5168b8a58b28fd031a281fcf704daa38e93a7cec37f7a1e147" }, "notes": "No snapshot at or near this time." }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "timestamp": "20261023185704", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261024000000)", "evidence": { "file": "fetched/cdx/avail_2_20261024000000__20261024T013912Z.json", "sha256": "7117df615cfa6ba70e4a4bd074da5858399cd3e5c315460ff671463e57a96877" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "timestamp": null, "digest": null, "status": null, "excerpt": null, "source": "archive.org/wayback/available (closest to 20261021000000)", "evidence": { "file": "fetched/cdx/avail_3_20261021000000__20261024T013915Z.json", "sha256": "daf5c4a3b732b21a2b2cc3a94af29478ee67b91984d8d3542f9f15217700806a" }, "notes": "No snapshot at or near this time." }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "timestamp": null, "digest": null, "status": null, "excerpt": null, "source": "archive.org/wayback/available (closest to 20261024000000)", "evidence": { "file": "fetched/cdx/avail_3_20261024000000__20261024T013915Z.json", "sha256": "517673e0737bbdcc0ac41b26948529ea25149bc3624905ab78132743c86b840c" }, "notes": "No snapshot at or near this time." }, { "url": "https://www.bbc.com/news/live/ckgel5xp2xv9t", "timestamp": "20261022070738", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261021000000)", "evidence": { "file": "fetched/cdx/avail_4_20261021000000__20261024T013916Z.json", "sha256": "fd1748f0ac365447422a6376d4b8ab722e5fcdd3dcbfa352155b5804cb8386a1" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://www.bbc.com/news/live/ckgel5xp2xv9t", "timestamp": "20261023133740", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261024000000)", "evidence": { "file": "fetched/cdx/avail_4_20261024000000__20261024T013917Z.json", "sha256": "c7db3d79f74ce0ad732165d0c350f2994540b753d4584cf6f867310cbd7ff422" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "timestamp": null, "digest": null, "status": null, "excerpt": null, "source": "archive.org/wayback/available (closest to 20261021000000)", "evidence": { "file": "fetched/cdx/avail_5_20261021000000__20261024T013918Z.json", "sha256": "01d6da13c11740a1abfb7fc49a48efaa31a41046dd3bbccbc7db449995ed2539" }, "notes": "No snapshot at or near this time." }, { "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "timestamp": "20261022113203", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261024000000)", "evidence": { "file": "fetched/cdx/avail_5_20261024000000__20261024T013924Z.json", "sha256": "36258081f5517560596f12ccaad9ec7bf9cd2fe55ab5cc230b65fe1aa68ddfb5" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "timestamp": "20261022091249", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261021000000)", "evidence": { "file": "fetched/cdx/avail_6_20261021000000__20261024T013924Z.json", "sha256": "48ea5a1d6a3968afcad34b5ce082309f5dfaa48a5aeee525414b25774b9ff207" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "timestamp": "20261022174502", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261024000000)", "evidence": { "file": "fetched/cdx/avail_6_20261024000000__20261024T013925Z.json", "sha256": "be434ea13f9f8d32926e0951149267843c3a5094028c75a4cb440b887e5d0a64" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://www.php2shell.com/", "timestamp": "20261021134854", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261021000000)", "evidence": { "file": "fetched/cdx/avail_7_20261021000000__20261024T013926Z.json", "sha256": "4dd5132c9db683c26bd1b7578234f1a0943b6f9e6daddb048cfd5965e4abc1b0" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://www.php2shell.com/", "timestamp": "20261023045525", "digest": null, "status": "200", "excerpt": null, "source": "archive.org/wayback/available (closest to 20261024000000)", "evidence": { "file": "fetched/cdx/avail_7_20261024000000__20261024T013927Z.json", "sha256": "a009746339180902798f24ec1aeaebf2eef3e62616f70129a415fd620dd29596" }, "notes": "Snapshot exists but its content could not be fetched: web.archive.org (CDX and id_ snapshots) is unreachable from this session (connection reset by the egress proxy); no digest available." }, { "url": "https://en.wikipedia.org/wiki/PHP2Shell?oldid=1381578822", "timestamp": "2026-10-23T13:11Z", "digest": "7d00f61e24959f99add32e0a7971ac50365c4917ce8ca46ba44ff33855bea38c", "status": "200", "excerpt": null, "source": "Wikipedia action=raw (digest is sha256 of the wikitext fetched)", "evidence": { "file": "fetched/wiki/rev_1381578822__20261024T014016Z.txt", "sha256": "7d00f61e24959f99add32e0a7971ac50365c4917ce8ca46ba44ff33855bea38c" } }, { "url": "https://en.wikipedia.org/wiki/PHP2Shell?oldid=1381581724", "timestamp": "2026-10-23T13:41:34Z", "digest": "786b2c1c89bcf866e33806e51edee170dd5592f4ea6a60e8133d28624628b0fa", "status": "200", "excerpt": "with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web.", "source": "Wikipedia action=raw (digest is sha256 of the wikitext fetched)", "evidence": { "file": "fetched/wiki/rev_1381581724__20261024T014017Z.txt", "sha256": "786b2c1c89bcf866e33806e51edee170dd5592f4ea6a60e8133d28624628b0fa" } }, { "url": "https://en.wikipedia.org/wiki/PHP2Shell?oldid=1381672424", "timestamp": "2026-10-24T01:37:29Z", "digest": "765648102637b69f1d559ef7d1c34d8f0494b19265603635842f17c448c06bbc", "status": "200", "excerpt": "with the two vulnerabilities estimated to affect nearly 70% of the commercial [[world wide web]]", "source": "Wikipedia action=raw (digest is sha256 of the wikitext fetched)", "evidence": { "file": "fetched/wiki/rev_1381672424__20261024T014009Z.txt", "sha256": "765648102637b69f1d559ef7d1c34d8f0494b19265603635842f17c448c06bbc" } }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "timestamp": "20261022T080952Z", "digest": "81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef", "status": "200", "excerpt": "PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet | CNN Business", "source": "evidence vault capture (excerpt is the page title; digest is text.txt sha256)", "evidence": { "file": "sources/cnn-php2shell-ai/captures/20261022T080952Z/text.txt (vault)", "sha256": "81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef" } }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "timestamp": "20261022T112616Z", "digest": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "status": "200", "excerpt": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business", "source": "evidence vault capture (excerpt is the page title; digest is text.txt sha256)", "evidence": { "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt (vault)", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533" } }, { "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "timestamp": "20261022T081421Z", "digest": "97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4", "status": "200", "excerpt": "Faille de sécurité: Panne mondiale des sites web: la Suisse romande touchée - 20 minutes", "source": "evidence vault capture (excerpt is the page title; digest is text.txt sha256)", "evidence": { "file": "sources/20min-fr-suisse-romande/captures/20261022T081421Z/text.txt (vault)", "sha256": "97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4" } }, { "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "timestamp": "20261022T181608Z", "digest": "d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65", "status": "200", "excerpt": "Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes", "source": "evidence vault capture (excerpt is the page title; digest is text.txt sha256)", "evidence": { "file": "sources/20-minuten-20min-fr-suisse-romande/captures/20261022T181608Z/text.txt (vault)", "sha256": "d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65" } }, { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "timestamp": "20261022T111755Z", "digest": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "status": "200", "excerpt": "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog", "source": "evidence vault capture (excerpt is the page title; digest is text.txt sha256)", "evidence": { "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt (vault)", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d" } } ], "changes": [ { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "publisher": "CNN Business", "kind": "headline", "before": { "when": "2026-10-22T08:09:52Z (vault capture)", "excerpt": "Global websites shut down after AI found a critical flaw affecting 70% of the internet", "evidence": { "file": "sources/cnn-php2shell-ai/captures/20261022T080952Z/text.txt (vault)", "sha256": "81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef" } }, "after": { "when": "2026-10-22T11:26:16Z (vault capture of the -intl URL; dateModified 2026-10-22T11:06:26Z)", "excerpt": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet", "evidence": { "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt (vault)", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533" } }, "notes": "The non-intl URL now 301-redirects to the -intl article. Its vault title was \"PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet\"." }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "publisher": "CNN Business", "kind": "headline", "before": { "when": "2026-10-22T11:26:16Z (vault capture)", "excerpt": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet", "evidence": { "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt (vault)", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533" } }, "after": { "when": "page says Updated Oct 22, 2026, 2:26 PM ET (dateModified 2026-10-22T18:26:13Z); fetched 2026-10-24", "excerpt": "Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet", "evidence": { "file": "fetched/cnn-php2shell-websites-shut__20261024T013210Z.html", "sha256": "e3a57d45a3ace0974642017c6cd2b951e0664b5616061b377d22f13fa81f738b" } }, "notes": "Only \"a critical\" became \"cybersecurity\"; \"70% of the internet\" kept. No correction note." }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "publisher": "CNN Business", "kind": "body", "before": { "when": "2026-10-22T11:26:16Z (vault capture)", "excerpt": "a programming language that powers 70% of all websites in the world, including WordPress and Drupal", "evidence": { "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt (vault)", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533" } }, "after": { "when": "Updated Oct 22, 2026, 2:26 PM ET; fetched 2026-10-24", "excerpt": "a programming language that powers 70% of the world’s websites", "evidence": { "file": "fetched/cnn-php2shell-websites-shut__20261024T013210Z.html", "sha256": "e3a57d45a3ace0974642017c6cd2b951e0664b5616061b377d22f13fa81f738b" } }, "notes": "Same meaning, reworded; no note." }, { "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "publisher": "CNN Business", "kind": "body", "before": { "when": "2026-10-22T08:09:52Z (vault capture, original URL)", "excerpt": "after artificial intelligence helped discover and address critical bugs that could affect 70% of the internet", "evidence": { "file": "sources/cnn-php2shell-ai/captures/20261022T080952Z/text.txt (vault)", "sha256": "81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef" } }, "after": { "when": "Updated Oct 22, 2026, 2:26 PM ET; fetched 2026-10-24", "excerpt": "Governments and companies around the world are racing to fix vulnerabilities revealed by artificial intelligence that could affect 70% of the world’s websites", "evidence": { "file": "fetched/cnn-php2shell-websites-shut__20261024T013210Z.html", "sha256": "e3a57d45a3ace0974642017c6cd2b951e0664b5616061b377d22f13fa81f738b" } }, "notes": "The lede moved from \"70% of the internet\" to \"70% of the world's websites\", while the headline still says \"70% of the internet\". The 11:26 UTC capture opened with a lede that has no 70% figure." }, { "url": "https://en.wikipedia.org/wiki/PHP2Shell", "publisher": "Wikipedia", "kind": "body", "before": { "when": "revision 1381578822, 2026-10-23T13:11Z", "excerpt": "that allow [[Arbitrary code execution|remote code execution]] (RCE). Their existence was publicly announced on 20 October 2026.", "evidence": { "file": "fetched/wiki/rev_1381578822__20261024T014016Z.txt", "sha256": "7d00f61e24959f99add32e0a7971ac50365c4917ce8ca46ba44ff33855bea38c" } }, "after": { "when": "revision 1381581724, 2026-10-23T13:41:34Z (editor Masem); still in 1381672424, 2026-10-24T01:37Z", "excerpt": "with the two vulnerabilities estimated to affect nearly 70% of the commercial world wide web.", "evidence": { "file": "fetched/wiki/rev_1381581724__20261024T014017Z.txt", "sha256": "786b2c1c89bcf866e33806e51edee170dd5592f4ea6a60e8133d28624628b0fa" } }, "notes": "In 1381578822 the lead sentence ends at \"(RCE).\" with no 70% sentence (grep count 0); 1381581724 adds it; a later edit wikilinked [[world wide web]]. Vault capture 2026-10-22T11:23Z had 70% only in reference titles." }, { "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "publisher": "AWS Security Blog", "kind": "body", "before": { "when": "2026-10-22T11:17:55Z (vault capture; article:modified_time 2026-10-21T21:36:56-07:00)", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "evidence": { "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt (vault)", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d" } }, "after": { "when": "article:modified_time 2026-10-22T14:25:03-07:00; fetched 2026-10-24", "excerpt": "PHP2Shell is now seeing broad exploitation attempts in the wild.", "evidence": { "file": "fetched/aws-security-blog-madpot__20261024T013241Z.html", "sha256": "1889fa097c9073520cbb6526ebd4d044d224371107abd89b52dae3f4d7c862c4" } }, "notes": "Not a 70% wording; relevant to outreach R-004 (exploited vs attempts). Silent edit: no update note found." }, { "url": "https://www.bbc.com/news/live/ckgel5xp2xv9t", "publisher": "BBC News", "kind": "body", "before": { "when": "entry published 2026-10-22T06:15:41Z (still on ?page=3, fetched 2026-10-24T01:34:20Z)", "excerpt": "with cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure", "evidence": { "file": "fetched/bbc-live-ckgel5xp2xv9t_page3__20261024T013419Z.html", "sha256": "2fda11d58b21bbe97f21a578aee86756cb83b711934f2e8d9b47782cd1f58682" } }, "after": { "when": "later entries 13:54 and 16:27 UTC, 22 Oct (live page, fetched 2026-10-24)", "excerpt": "According to cyber-security firm Wiz, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world’s websites", "evidence": { "file": "fetched/bbc-live-ckgel5xp2xv9t__20261024T013207Z.html", "sha256": "5ed3e9b103d357537ebc6b96fc00edfbfd8bd7ec19a20193f73ff154228cd4e3" } }, "notes": "Not an edit of the old entry: the early entries are unchanged; later entries use websites wording (and at 17:12 UTC \"which helps run around 70% of sites\")." }, { "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "publisher": "20 minutes (20min.ch)", "kind": "headline", "before": { "when": "2026-10-22T08:14:21Z (vault capture)", "excerpt": "Panne mondiale des sites web: la Suisse romande touchée", "evidence": { "file": "sources/20min-fr-suisse-romande/captures/20261022T081421Z/text.txt (vault)", "sha256": "97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4" } }, "after": { "when": "2026-10-22T18:16:08Z (vault capture) and live 2026-10-24", "excerpt": "Panne mondiale: la Suisse romande fortement impactée", "evidence": { "file": "sources/20-minuten-20min-fr-suisse-romande/captures/20261022T181608Z/text.txt (vault)", "sha256": "d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65" } }, "notes": "Headline change not involving 70%; the 70% caption and body sentence are unchanged." }, { "url": "https://therecord.media/php-script-vulnerabilities-warnings", "publisher": "The Record", "kind": "correction-note", "before": { "when": "vault capture", "excerpt": null, "evidence": { "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt (vault)", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "check": "note absent" } }, "after": { "when": "fetched 2026-10-24", "excerpt": "Correction: A previous version of this article used an incorrect pronoun for Detectify researcher Joviane Jardim.", "evidence": { "file": "fetched/therecord-php-warnings__20261024T013237Z.html", "sha256": "a3f188b988cf10baf5432642662b2c1f0ffba1722abc633c4612d4d659bd423c" } }, "notes": "Correction unrelated to 70%; the 70% sentence (\"Some estimates show that more than 70% of all websites on the internet use PHP\") is unchanged." } ], "new_outlets": [ { "slug_or_url": "https://tidbits.com/2026/10/21/php2shell-vulnerabilities-put-70-of-websites-at-risk/", "publisher": "TidBITS", "url": "https://tidbits.com/2026/10/21/php2shell-vulnerabilities-put-70-of-websites-at-risk/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:36Z", "status": 200, "sha256": "798930ccfc966c0d8752f46611b5043627226d458c6091a8862a4c39003d9d10", "file": "fetched/new/tidbits__20261024T014136Z.html", "excerpt": "PHP2Shell Vulnerabilities Put 70% of Websites at Risk" }, "classification": "new", "correction_note": null, "notes": "Body quotes Wiz: \"powers 70% of all websites in the world\"." }, { "slug_or_url": "https://protos.com/remotely-exploitable-php-bug-found-on-70-of-worlds-websites/", "publisher": "Protos", "url": "https://protos.com/remotely-exploitable-php-bug-found-on-70-of-worlds-websites/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:37Z", "status": 200, "sha256": "9d197451aaaa70772ff9234a03083bc45712ff9ca1b69fba431cb45a2b214e8f", "file": "fetched/new/protos__20261024T014136Z.html", "excerpt": "PHP is trying to patch two remotely exploitable bugs that AI found hiding in the language behind up to 70% of the world’s websites" }, "classification": "new", "correction_note": null, "notes": "Headline: \"Remotely exploitable PHP bug found on 70% of world’s websites\"." }, { "slug_or_url": "https://www.island.io/blog/php2shell-turns-nearly-half-of-the-web-into-exploitation-infrastructure", "publisher": "Island", "url": "https://www.island.io/blog/php2shell-turns-nearly-half-of-the-web-into-exploitation-infrastructure", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:38Z", "status": 200, "sha256": "3d2a405e1164dba287598b7fce92fe8a17717134b26f1b5f7bc81fbffe1d6e63", "file": "fetched/new/island__20261024T014138Z.html", "excerpt": "According to W3Techs, PHP runs 69.3% of websites" }, "classification": "new", "correction_note": null, "notes": "Elsewhere: \"PHP runs about 70% of the web\". Drops the \"whose server-side language we know\" qualifier." }, { "slug_or_url": "https://hackernoon.com/nsa-says-patch-or-go-offline-as-ai-found-php2shell-flaws-reach-70percent-of-the-web", "publisher": "HackerNoon", "url": "https://hackernoon.com/nsa-says-patch-or-go-offline-as-ai-found-php2shell-flaws-reach-70percent-of-the-web", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:38Z", "status": 200, "sha256": "b8fd7c0eaa0d8288cffca9e61c8443c0751eb985ddc34c21c2d533bb79645c68", "file": "fetched/new/hackernoon__20261024T014138Z.html", "excerpt": "The share figures cover only sites whose server language can be identified, so \"70% of the web\" is shorthand for that" }, "classification": "new", "correction_note": null, "notes": "Headline: \"NSA Says Patch PHP or Go Offline as AI-Found PHP2Shell Flaws Reach ~70% of the Web\". Qualifies the figure in the body." }, { "slug_or_url": "https://tech-insider.org/ai-php2shell-vulnerability-70-percent-web-2026/", "publisher": "Tech Insider", "url": "https://tech-insider.org/ai-php2shell-vulnerability-70-percent-web-2026/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:39Z", "status": 200, "sha256": "b4c55da6a5d28f3ad17a0ebbfc7fc1abfa06439815520aaf185f6e3a39557aa7", "file": "fetched/new/techinsider__20261024T014138Z.html", "excerpt": "PHP is the open-source programming language that processes code on the back end of roughly 70% of the world’s websites and web applications" }, "classification": "new", "correction_note": null, "notes": "Headline \"AI Finds PHP2Shell Flaw Hitting 70% of the Web\"." }, { "slug_or_url": "https://www.bestanswerhub.com/playbooks/php2shell-php-vulnerability/", "publisher": "Best Answer Hub", "url": "https://www.bestanswerhub.com/playbooks/php2shell-php-vulnerability/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:40Z", "status": 200, "sha256": "75a35e619b62dc8ab3745dca28c4de75bc787f7587080e66f55c426a00e37c73", "file": "fetched/new/bestanswerhub__20261024T014139Z.html", "excerpt": "The headline number, \"up to 70% of the world's websites\", is PHP's market share, not a count of hackable sites" }, "classification": "new", "correction_note": null, "notes": "Explainer pushing back on the 70% headline; cites W3Techs 69.3%." }, { "slug_or_url": "https://dev.to/bargan/php2shell-your-php-app-can-be-secure-and-still-be-vulnerable-odd", "publisher": "DEV Community (bargan)", "url": "https://dev.to/bargan/php2shell-your-php-app-can-be-secure-and-still-be-vulnerable-odd", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:40Z", "status": 200, "sha256": "bf5daea3ef0206f3888c300967b72c639eb7424f0fcc1f06dab4e350a44e188c", "file": "fetched/new/devto__20261024T014140Z.html", "excerpt": "Does PHP2Shell really affect 70% of the internet?" }, "classification": "new", "correction_note": null, "notes": "Explainer; says W3Techs reported roughly 69% and qualifies it." }, { "slug_or_url": "https://abc7news.com/story/urgent-security-fix-issued-code-vital-estimated-70-websites/19965216/", "publisher": "ABC7 (ABC owned stations; same story on abc30, abc13, 6abc, abc11)", "url": "https://abc7news.com/story/urgent-security-fix-issued-code-vital-estimated-70-websites/19965216/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:41Z", "status": 200, "sha256": "9936da39f5dd96538c352b25a3d007827d282c9791710e2e7ee2c3035ec8b13f", "file": "fetched/new/abc7news__20261024T014140Z.html", "excerpt": "Nearly 70% of the internet is estimated to use PHP" }, "classification": "new", "correction_note": null, "notes": "Headline \"Urgent security fix issued for code vital to estimated 70% of all websites\"." }, { "slug_or_url": "https://larepublica.co/globoeconomia/ia-detecta-fallo-de-seguridad-que-pone-en-riesgo-a-70-de-los-sitios-web-4507904", "publisher": "La Republica (Colombia)", "url": "https://larepublica.co/globoeconomia/ia-detecta-fallo-de-seguridad-que-pone-en-riesgo-a-70-de-los-sitios-web-4507904", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:41Z", "status": 200, "sha256": "551c91530563b89861441c8ee6232b17c31d790212e98c37c8c8a3b007ff4f0a", "file": "fetched/new/larepublica__20261024T014141Z.html", "excerpt": "IA detecta fallo de seguridad que pone en riesgo a 70% de los sitios web" }, "classification": "new", "correction_note": null, "notes": "Attributes the figure to The Wall Street Journal." }, { "slug_or_url": "https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/", "publisher": "CybelAngel", "url": "https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:42Z", "status": 200, "sha256": "a5870e66e263ece967c4d744fe6a1d7d58b6eb9018745d0f1e6156a139b4e84b", "file": "fetched/new/cybelangel__20261024T014141Z.html", "excerpt": null }, "classification": "new", "correction_note": null, "notes": "Counts hosts (2.24M internet-facing PHP hosts); no 70% figure in static text." }, { "slug_or_url": "https://hermes-ai.net/news/openai-s-php2shell-exposes-70-of-websites-to-remote-code-attacks/", "publisher": "Hermes AI News (indexed from AlphaSignal)", "url": "https://hermes-ai.net/news/openai-s-php2shell-exposes-70-of-websites-to-remote-code-attacks/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:43Z", "status": 200, "sha256": "6f8ab009e6fd1f344b5baafdab9ffaab286a01be20cee0ffc2c70a1325657814", "file": "fetched/new/hermesai__20261024T014142Z.html", "excerpt": "two critical RCE flaws impacting roughly 70% of the web" }, "classification": "new", "correction_note": null, "notes": "Headline \"OpenAI's PHP2Shell Exposes 70% of Websites to Remote Code Attacks\"." }, { "slug_or_url": "https://itdaily.com/blogs/software/php2shell-bug-php/", "publisher": "ITdaily", "url": "https://itdaily.com/blogs/software/php2shell-bug-php/", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:44Z", "status": 200, "sha256": "d63d2aba97062d34a500f6866442730159da0dfdfba4abcb3546989f7dd61a66", "file": "fetched/new/itdaily__20261024T014143Z.html", "excerpt": "Nearly 70 percent of all websites worldwide are affected." }, "classification": "new", "correction_note": null, "notes": "States affected, not uses." }, { "slug_or_url": "https://w3techs.com/technologies/overview/programming_language", "publisher": "W3Techs (measurer)", "url": "https://w3techs.com/technologies/overview/programming_language", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:44Z", "status": 200, "sha256": "661a714c7373843f13e839257a2046a2afb4b084241e6c78c4fc0152aa1c7bd4", "file": "fetched/new/w3techs-pl__20261024T014144Z.html", "excerpt": "PHP is used by 69.3% of all the websites whose server-side programming language we know." }, "classification": "new", "correction_note": null, "notes": "The measurer's own wording today. No mention of php2shell on the page, so no W3Techs comment on how the figure is used was found." }, { "slug_or_url": "https://w3techs.com/technologies/details/pl-php", "publisher": "W3Techs (measurer)", "url": "https://w3techs.com/technologies/details/pl-php", "vault": null, "now": { "retrieved_at": "2026-10-24T01:41:45Z", "status": 200, "sha256": "ca7ba9d1ce117cc1e4061e8509072182bda77ace4b7c40481d5de7ee4aa51c63", "file": "fetched/new/w3techs-php__20261024T014144Z.html", "excerpt": "PHP is used by 69.3% of all the websites whose server-side programming language we know." }, "classification": "new", "correction_note": null, "notes": "As above." } ], "fortune": { "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "outreach": "R-008 (UF-005.1)", "now": { "retrieved_at": "2026-10-24T01:32:19Z", "status": 200, "sha256": "c5d640eceed2f2f49ea871c10b6041292c1bff4e28c681163c32e1b4295ab12a", "file": "fetched/fortune-ai-tools-php-vulnerability__20261024T013219Z.html" }, "vault": { "stamp": "20261023T012042Z", "file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/text.txt", "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808" }, "byline": "Emily Forlini, Senior AI Reporter", "datePublished": "2026-10-21T18:48:38-00:00", "dateModified": "2026-10-22T14:56:06-00:00 (same in vault capture and now)", "sentences_about_70pc": [ { "where": "headline (h1 / schema headline)", "excerpt": "AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack", "attribution": "Fortune's own words, unattributed" }, { "where": "<title> and og:title", "excerpt": "AI helped discover the PHP vulnerability that could take down 70% of the internet", "attribution": "Fortune's own words; the HTML title differs from the visible headline (\"AI helped discover\" vs \"AI tools discovered\"), both in the vault capture and now" }, { "where": "body, paragraph 1", "excerpt": "Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.", "attribution": "Fortune's own words, unattributed" }, { "where": "body, quoting Wiz", "excerpt": "“With 70% of the internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post announcing its findings.", "attribution": "Attributed to Wiz's blog post; the Wiz post's Conclusion has \"With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated.\"" } ], "update_note": "Update, Oct. 22: This story has been updated to include Cloudflare’s early data on the number of exploit attempts after the news got out, and comment from Amazon Web Services", "update_note_about_70pc": false, "what_it_attributes_70pc_to": "Headline and lede: no attribution (Fortune's voice, \"could take down\" / \"stands to take down\"). One sentence quotes Wiz's blog (\"With 70% of the internet affected\"). No mention of W3Techs or of websites as the base.", "changed": false, "classification": "unchanged", "correction_note": null }, "injection_seen": [], "injection_scan": "All fetched files were searched for text addressed to an AI or a model (the usual override phrasings, 'if you are an AI', notes to language models). The only hits were Wiz page UI strings describing agent command-line tools, which are product copy, not addressed to a reader's AI. Nothing recorded as injection.", "excluded_false_positives": [ { "slug": "bursahakimiyet-teknoloji-php-deki-kritik-guvenlik-acigi-alar", "url": "https://www.bursahakimiyet.com.tr/teknoloji/php-deki-kritik-guvenlik-acigi-alarmi-dunya-genelinde-cok-sayida-site-erisime-kapatildi-1734665", "reason": "only \"70%\" match is a market-ticker figure, not about PHP" }, { "slug": "cointelegraph-news-php-foundation-admits-structural-failure", "url": "https://cointelegraph.com.br/news/php-foundation-admits-structural-failure-delayed-critical-security-fix", "reason": "only \"70%\" match is a crypto price change, not about PHP" } ], "blocked": [ { "url": "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "status": 403, "retrieved_at": "2026-10-24T01:32:17Z", "sha256": "3bb40456027c77d05b991e4686f10e51739a6ebdca3e33ec5edcd1e2c28b34cf", "file": "fetched/cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20__20261024T013216Z.html", "what": "Bot Verification" }, { "url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/", "status": 403, "retrieved_at": "2026-10-24T01:32:17Z", "sha256": "7fd73b5f6052ce7d5dda13ef8e9fcb97739d90648dfbcca97c1ebacea9e460fb", "file": "fetched/cybernews-php2shell-millions__20261024T013217Z.html", "what": "Just a moment..." }, { "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "status": 402, "retrieved_at": "2026-10-24T01:32:39Z", "sha256": "e8dbc3dd43c22a207485dc95fbec2a04690a23b6ab2d5bbe64715c2829e7ffac", "file": "fetched/usa-today-php2shell-live__20261024T013239Z.html", "what": "Access Restricted" }, { "url": "https://www.digitec.ch/en/page/php2shell-half-the-internet-is-at-risk-only-patching-php-will-help-44165", "status": 403, "retrieved_at": "2026-10-24T01:41:37Z", "sha256": "c98ec82e2d954c3262c566085d339c347d2b76285c4dbca548c748a43814193c", "file": "fetched/new/digitec__20261024T014137Z.html", "what": "found by WebSearch; HTTP 403 (bot challenge), not read" }, { "url": "https://ecosistemastartup.com/php2shell-fallo-critico-en-php-afecta-al-70-de-la-web/", "status": 403, "retrieved_at": "2026-10-24T01:41:38Z", "sha256": "cac05ee6a91f0f0f309fabeb8f3aaa5d7a1711cf2f5327f17b171b411641b1db", "file": "fetched/new/ecosistemastartup__20261024T014137Z.html", "what": "found by WebSearch; HTTP 403 (bot challenge), not read" }, { "url": "https://fourweekmba.com/ai-gemini-and-gpt-helped-find-php-flaws-in-up-to-70-of-sites/", "status": 403, "retrieved_at": "2026-10-24T01:41:40Z", "sha256": "b4b94e6496f82953c3c9d3d25bb482409d0204bf741e0db198b944bfe1409172", "file": "fetched/new/fourweekmba__20261024T014140Z.html", "what": "found by WebSearch; HTTP 403 (bot challenge), not read" }, { "url": "https://cybernews.com/security/wordpress-php-severe-rce-flaws-emergency-patches/", "status": 403, "retrieved_at": "2026-10-24T01:41:43Z", "sha256": "0a05649b66f3f2aab79642caf0b7a58e11b9990a23d8b2659fe01bfb03c90ced", "file": "fetched/new/cybernews-wp__20261024T014143Z.html", "what": "found by WebSearch; HTTP 403 (bot challenge), not read" }, { "url": "https://web.archive.org/cdx/search/cdx and https://web.archive.org/web/<ts>id_/<url>", "status": null, "retrieved_at": "2026-10-24T01:36Z to 01:38Z", "sha256": null, "file": null, "what": "Connection reset on every request (proxy recentRelayFailures: tunnel closed after 517 B sent, 39 B received, host web.archive.org:443); WebFetch also refuses web.archive.org. Only archive.org/wayback/available answered (timestamps, no digests, no content)." } ], "normalised": [ "1 zero-width word joiner (U+2060) removed from captured titles; invisible, and the gate refuses it in published text." ] } } ] }