{ "note": "Who reads this site, mapped. Each persona is a reader with a job, a question, a tolerance for jargon and a time budget. The briefing with the same id is written for them; the path is the order in which the rest of the site answers them. The build checks that every path points at a page that exists. Names are placeholders for a kind of reader, not real people.", "depths": { "1": { "label": "Plain English", "text": "No technical background assumed. Every term is explained on first use." }, "2": { "label": "Some technical", "text": "Comfortable with the idea of servers, versions and patches; does not need the internals." }, "3": { "label": "Deeply technical", "text": "Wants versions, settings, code paths and the primary records verbatim." } }, "groups": [ { "id": "understand", "label": "I want to understand it", "text": "You heard about this on the news or from a colleague and want to know what it is and whether it touches you." }, { "id": "decide", "label": "I make the decisions", "text": "You own a budget, a plan or a risk, and need what to decide, in what order, and what to ask your team." }, { "id": "communicate", "label": "I tell others", "text": "You write or speak about this, and need what is true, what is not, and who said it first." }, { "id": "act", "label": "I run or build systems", "text": "You patch, configure, monitor or write code, and need versions, settings and signals." }, { "id": "study", "label": "I study it", "text": "You research vulnerabilities or advise on policy, and need the evidence, the open questions and the precedent." } ], "personas": [ { "id": "everyone", "person": "Alex", "label": "Curious reader", "group": "understand", "depth": 1, "who": "Saw the headlines (websites offline, governments warning) and wants to know what happened and whether to worry.", "needs": [ "what PHP is, in one sentence", "whether their own phone or laptop is at risk", "why websites went offline", "whether anyone was actually hacked" ], "skip": [ "version numbers", "server settings", "the code" ], "answer": "Two serious holes were found in PHP, software that runs on the servers behind a large share of websites. They were fixed on 21 October 2026. Your phone and laptop are not the target: websites are, and it is the job of whoever runs them to update. Some sites were taken offline as a precaution. As of 14:42 UTC on 26 October, the latest capture in the evidence vault, no named organisation has said it was compromised through php2shell.", "path": [ "briefings/everyone/index.html", "explained/index.html", "impact/index.html", "numbers/index.html" ], "track": "a" }, { "id": "site-owner", "person": "Casey", "label": "Website owner", "group": "understand", "depth": 1, "who": "Runs a small business, charity or club website (often WordPress) on a hosting plan, and is not a developer.", "needs": [ "am I affected", "is it my job or my host's", "exactly what to ask the host", "whether updating WordPress plugins helps" ], "skip": [ "the code", "the disclosure politics", "the agency comparison" ], "answer": "If your website runs on WordPress, Drupal, Joomla or anything else written in PHP, it is in scope: the flaw is in PHP itself, underneath your site. Updating plugins does not fix it. If someone hosts the site for you, ask them in writing whether PHP has been updated to a fixed version and restarted. If you run the server yourself, update PHP today.", "path": [ "briefings/site-owner/index.html", "explained/index.html", "playbook/index.html", "affected/index.html" ], "track": "a" }, { "id": "board", "person": "Jordan", "label": "Board member or executive", "group": "decide", "depth": 1, "who": "Sits on a board or leadership team; will be asked whether the organisation is exposed and must not repeat a wrong number.", "needs": [ "are we exposed", "who owns the decision to take a system offline", "what to ask the CISO", "which headline figures not to use" ], "skip": [ "SAPIs and settings", "the C code", "the leak forensics" ], "answer": "A critical flaw in software that runs many websites, fixed on 21 October. Every agency says update first; some say take systems offline if you cannot. As of 14:42 UTC on 26 October, the latest capture in the evidence vault, no named organisation has said it was broken into through this flaw, though attempts are widespread. Your questions are: do we know every system running PHP, are they updated and restarted, and who can pull a system offline and how fast.", "path": [ "briefings/board/index.html", "explained/index.html", "impact/index.html", "agencies/index.html", "playbook/index.html" ], "track": "a" }, { "id": "pm", "person": "Taylor", "label": "Project or programme manager", "group": "decide", "depth": 1, "who": "Runs a delivery plan that depends on websites or web apps, and needs to know what this does to the schedule.", "needs": [ "what unplanned work this creates", "which systems and owners to chase", "what to tell stakeholders about downtime", "what changes after the fix" ], "skip": [ "the code", "the bug classes", "the detection rules" ], "answer": "Expect unplanned work this week: updating PHP on every system that uses it, restarting, and re-testing. Some teams may take systems offline for hours as a precaution. Anything still on PHP 8.1 or older has no ready-made fix and becomes a migration project. Ask each system owner for a patch date and a test plan.", "path": [ "briefings/pm/index.html", "explained/index.html", "playbook/index.html", "impact/index.html", "timeline/index.html" ], "track": "a" }, { "id": "cfo", "person": "Quinn", "label": "CFO", "group": "decide", "depth": 1, "who": "Owns the money: the cost of downtime, the cost of a breach, and whether insurance responds.", "needs": [ "cost of acting against cost of not acting", "whether a precautionary shutdown is covered", "which figures are safe in a forecast" ], "skip": [ "versions and settings", "the code" ], "answer": "The documented cost so far is precaution, not breach: hours to a day of downtime for organisations that pulled sites, and engineering time to update. As of 14:42 UTC on 26 October, the latest capture in the evidence vault, no named organisation has said it was compromised through this flaw. Ask your broker now, in writing, whether a precautionary shutdown with no breach is covered. Do not use 70% of the Internet in any forecast.", "path": [ "briefings/cfo/index.html", "explained/index.html", "impact/index.html", "numbers/index.html", "context/index.html" ], "track": "a" }, { "id": "dpo", "person": "Morgan", "label": "Data protection officer", "group": "decide", "depth": 2, "who": "Advises the controller on GDPR; decides with it whether an incident is a personal data breach, whether the 72-hour clock has started, and what goes on the record.", "needs": [ "was personal data exposed", "whether this is a breach yet, and when the 72-hour clock starts", "what to ask the host and the other processors", "what to document, breach or no breach" ], "skip": [ "the C code", "server settings" ], "answer": "A flaw is not a breach. An unpatched, internet-facing PHP application holding personal data is a risk to record and treat; it becomes a breach to assess when there is a sign of compromise on it. No named organisation has said it was compromised through php2shell as of the last check. Ask your hosts in writing, review from 17 October, and document the assessment either way.", "path": [ "briefings/dpo/index.html", "compromise/index.html", "impact/index.html", "grc/risks/r06-1/index.html", "grc/frameworks/gdpr/index.html", "playbook/index.html" ], "track": "c" }, { "id": "ciso", "person": "Robin", "label": "CISO", "group": "decide", "depth": 2, "who": "Accountable for security risk; must report exposure and evidence of non-compromise to the board.", "needs": [ "exposure as a list", "evidence we were not hit, from which date", "the board line", "where agencies disagree" ], "skip": [ "the C code" ], "answer": "The flaw is in the PHP runtime, so exposure is every internet-facing system running PHP, including vendor appliances. Review logs from 17 October (the earliest reported attempt), not from the fix. Attempts are reported at scale; no named victim is confirmed. Patch first, isolate where you cannot.", "path": [ "briefings/ciso/index.html", "impact/index.html", "exploitation/index.html", "defence/index.html", "agencies/index.html", "playbook/index.html" ], "track": "b" }, { "id": "cto", "person": "Avery", "label": "CTO", "group": "decide", "depth": 2, "who": "Owns the platform and the engineering time; needs the patch order, what breaks, and what to change next.", "needs": [ "patch order", "what the fix changes in behaviour", "the end-of-life versions", "time-to-pull-the-plug as a platform property" ], "skip": [ "the disclosure politics" ], "answer": "Patch internet-facing mod_php first, then FPM, then the rest; restart every worker and rebuild every image. The fix changes how PHP behaves when memory runs out, so test under load. 7.4 to 8.1 have no release. Afterwards, invest in an inventory that answers 'where is PHP' in minutes.", "path": [ "briefings/cto/index.html", "flaws/index.html", "code/index.html", "playbook/index.html", "defence/index.html" ], "track": "b" }, { "id": "journalist", "person": "Rowan", "label": "Journalist", "group": "communicate", "depth": 2, "who": "Reporting the story; needs numbers that hold up, quotes that are on the page they are attributed to, and the order of events.", "needs": [ "which numbers hold up", "who said what first", "quotes checked against their source", "what is unverified" ], "skip": [ "server settings" ], "answer": "The 70% figure is a share of websites that use PHP, restated as a share of the Internet. The release was 21 October, not 22. Three parties claim the discovery; their dates do not conflict, their framing does. No agency has confirmed a successful compromise, and CISA has not listed either flaw as exploited.", "path": [ "briefings/journalist/index.html", "numbers/index.html", "claims/index.html", "discovery/index.html", "leak/index.html", "agencies/index.html" ], "track": "c" }, { "id": "comms", "person": "Riley", "label": "Communications team", "group": "communicate", "depth": 1, "who": "Writes the organisation's statement and answers the press; needs what is safe to say and what will be asked.", "needs": [ "the safe statement", "the phrases to avoid", "the questions coming", "where to point people" ], "skip": [ "the code", "the settings" ], "answer": "Safe to say: two critical flaws in PHP were fixed on 21 October; we updated or isolated our systems; we have no evidence of compromise and review continues. Do not say '70% of the Internet', 'the most severe ever' or 'exploited everywhere'. Point people to php.net and your national agency.", "path": [ "briefings/comms/index.html", "explained/index.html", "numbers/index.html", "impact/index.html", "agencies/index.html" ], "track": "a" }, { "id": "security", "person": "Sam", "label": "Security lead", "group": "act", "depth": 2, "who": "Runs the response: patch order, mitigations, monitoring and the offline call.", "needs": [ "patch order", "temporary mitigations and what each misses", "what to alert on", "the offline threshold" ], "skip": [ "the leak forensics" ], "answer": "Internet-facing mod_php first, then FPM, then everything else. Where patching slips, apply php.net's temporary settings and record that each blocks a known path only. Alert on PHP workers spawning shells or fetching tools. Decide now who calls isolate or offline, and when.", "path": [ "briefings/security/index.html", "playbook/index.html", "exploitation/index.html", "defence/index.html", "agencies/index.html" ], "track": "b" }, { "id": "appsec", "person": "Jamie", "label": "Head of AppSec", "group": "act", "depth": 3, "who": "Owns application security across many teams; needs scope, settings and the pipeline change.", "needs": [ "which applications are in scope", "settings in order of least breakage", "what to add to the pipeline", "where detection belongs" ], "skip": [ "the disclosure politics" ], "answer": "Every application on an affected runtime is in scope, including ones with no uploads or sessions: the demonstrated paths run before application code. Add the running PHP version to the SBOM and fail the pipeline on an unfixed one. Detection belongs at the edge and on the host, not in the app.", "path": [ "briefings/appsec/index.html", "flaws/index.html", "affected/index.html", "defence/index.html", "playbook/index.html" ], "track": "b" }, { "id": "engineer", "person": "Drew", "label": "PHP or platform engineer", "group": "act", "depth": 3, "who": "Runs the servers and containers; needs versions, SAPIs, ini settings and commands.", "needs": [ "fixed versions", "which SAPI is how exposed", "the exact settings and where they must be set", "how to verify the running version" ], "skip": [ "the board line", "the money" ], "answer": "Target 8.5.12, 8.4.27, 8.3.36 or 8.2.35; restart every worker and rebuild images. Until then: session.upload_progress.enabled=0 in php.ini or the pool, low post_max_size, fatal_error_backtraces=0 on 8.5, pm.max_requests=1 on FPM. Verify with php -v inside the running container. Keep session.upload_progress.enabled=0 after the update as well: CVE-2026-115560, published by PHP on 23 October (as Cloudflare and SOCRadar report), affects the fixed releases under a rare session setting and is fixed only in the next regular release.", "path": [ "briefings/engineer/index.html", "flaws/index.html", "playbook/index.html", "affected/index.html", "code/index.html" ], "track": "b" }, { "id": "developer", "person": "Lee", "label": "Developer", "group": "act", "depth": 2, "who": "Writes PHP applications; wants to know whether their code is the problem and what they can do.", "needs": [ "is my code the problem", "what I can and cannot do in userland", "how to check the box I deploy to" ], "skip": [ "the agency comparison", "the money" ], "answer": "Your code is not the problem and cannot be the fix: the flaw is in the engine beneath it. ini_set, .user.ini and auto_prepend_file all run too late. Check the running version where the code runs, after the restart, and tell the platform owner today if your target is 8.1 or older.", "path": [ "briefings/developer/index.html", "flaws/index.html", "code/index.html", "playbook/index.html" ], "track": "b" }, { "id": "researcher", "person": "Ash", "label": "Security researcher", "group": "study", "depth": 3, "who": "Studies vulnerabilities; wants the bug classes, what was demonstrated against what, and the open technical questions.", "needs": [ "the two bug classes", "what was demonstrated against which SAPI", "the fix in the code", "the open questions" ], "skip": [ "the board line" ], "answer": "Two classes: an out-of-memory longjmp leaving request memory uninitialised, and worker global state pointing at freed request memory across requests. mod_php was exploited before application code; FPM for the first flaw is disputed. The fix removes longjmp for OOM. A report of an incomplete fix is open.", "path": [ "briefings/researcher/index.html", "code/index.html", "flaws/index.html", "discovery/index.html", "context/index.html" ], "track": "c" }, { "id": "analyst", "person": "Blake", "label": "Analyst or policy advisor", "group": "study", "depth": 2, "who": "Advises on policy or markets; wants what this says about disclosure, AI-assisted discovery and how agencies responded.", "needs": [ "how coordinated disclosure failed", "what AI-assisted discovery changes", "why agencies diverged", "the precedent" ], "skip": [ "server settings", "the code" ], "answer": "A bug class seen and shelved in 2024 was turned into working exploits by three AI-assisted teams within three weeks in August 2026. The disclosure leaked 22.5 hours early. Agencies split on the hardest question, offline or not, along lines that look institutional rather than technical.", "path": [ "briefings/analyst/index.html", "discovery/index.html", "leak/index.html", "context/index.html", "agencies/index.html", "numbers/index.html" ], "track": "c" } ], "tracks": { "a": { "label": "Briefing", "home": "index.html", "text": "The situation, the numbers that matter and what to ask: for decision makers and anyone new to the story." }, "b": { "label": "Operations", "home": "ops/index.html", "text": "What changed, what to do next and the state of the evidence, side by side: for people who patch and defend." }, "c": { "label": "Analysis", "home": "analysis/index.html", "text": "The answer, the picture, then the evidence: for people who weigh sources, numbers and contradictions." } } }