Brief: asking other publications for corrections
Status: proposed by desk@php.newsroom, the news desk chief, on 24 October 2026, for the editor's go. Asked by the editor: "start looking at the outreach to a bunch of other websites and corrections that we should do, because there's a bunch of articles that are really like quite over the top that we should try to propose corrections to those guys."
Start from what exists
liaison@php.newsroom built this on 22 October: the rules (admin/liaison/README.md), data/outreach.json and the page /outreach/, "Corrections we have asked for", on the branch claude/corrections-liaison-desk. It was never released. Its rules are right and this brief keeps them: a request starts from a fact-check finding; the publisher's words are quoted character for character from a capture with its sha256; the origin is asked before the outlets that echoed it; only the publisher's own corrections channel; one follow-up at most, after seven days. It holds three drafts (Wiz, the BBC, CNN), all blocked on two open findings. The branch merges with dev at four small conflicts (build.py, admin.json, layers.json, team.json).
Clean hands first
We cannot ask anyone to correct what our own pages still say. Before the first request:
- "Roughly 70% of the Internet is affected" (claim
scale-70pc-internet, on 25 pages) is our wording, not Wiz's: Wiz wrote "70% of the Internet", without "roughly". Quote Wiz exactly (Finding-102). - "Almost 70% of websites" (
scale-70pc-websites) drops "whose server-side language is known" (Finding-33). - "1.57 million unpatched" is set against VulnCheck's 2.6 million hosts (about 60%); the source means 1.57 of 1.58 million hosts that show a version (about 99%). On about 32 pages, including the story "Where php2shell stands" (K-004).
- The front page's "not answered publicly yet" about the fix (K-011), and the status words on
nl-offlineandkev-precedent, stronger than their evidence.
Who to ask, in order
The quotes below are headlines or curators' notes; each is checked character for character against its capture before it goes in a request. "Our evidence" names the claim, contradiction (K-nnn) or grade on /factcheck/.
The origins
| # | Publisher | Their words | Our evidence | The correction we would propose |
|---|---|---|---|---|
| 1 | Wiz (blog and X post), 21 October | "70% of the Internet" | Its own body says "powers 70% of all websites"; the figure is the share of websites with a known server-side language that use PHP (K-001) | "the language behind about 70% of websites whose server-side language is known" |
| 2 | WIRED, 22 October | "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched" | The body describes attempts; Amazon says it is unclear whether any succeeded; no named organisation has said it was compromised (K-002, /compromise/) | "Hackers Tried to Exploit ..." |
| 3 | BankInfoSecurity, 21 October | "Attackers Exploit Leaked Zero-Day Flaws" | CISA has not observed exploitation; KEV lists neither CVE (K-002) | "Attackers Attempt to Exploit ..." |
| 4 | Help Net Security, 22 October | "confirmed exploitation on" WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento | Researchers' demonstrations, not attacks on victims | "researchers demonstrated code execution against ..." |
| 5 | The Hacker News, 22 October | a proof-of-concept exploit "leaked ahead of time" | The PHP Foundation: "No technical details leaked"; no capture shows a leaked exploit (K-009, open) | "a screenshot and video of an exploit tool circulated" |
The echoes, after their origin has been asked
| # | Publisher | Their words | Our evidence |
|---|---|---|---|
| 6 | CNN Business | "affecting 70% of the internet" | K-001; CNN's own body says "70% of all websites" |
| 7 | BBC live page | Wiz estimating "roughly 70%" | "roughly" is in neither Wiz capture; keep the BBC's own "unable to verify" |
| 8 | Fortune | "could take down 70% of the internet" | K-001 |
| 9 | CRN | "70 percent of the Internet affected" | K-001 |
| 10 | Le Temps (French) | "des millions de sites sont débranchés" | The community tracker counts about 50 sites dark and back; our ledger, 10 reports (K-006) |
| 11 | TechTarget Japan (Japanese) | "more than 22 million servers" at risk | Unit 42's figure, its method unpublished; Censys counts 1.57 million hosts |
| 12 | Security.NL (Dutch) | "Misbruik ... gemeld" (abuse reported) | Its own body: whether the attacks succeeded is unclear |
Not yet: the circulating CVSS "10.0", the BBC's "90%" and the UK minister's figures. None is captured; capture first (board 242).
Who sends, and how
The liaison may not send mail: the security requirements allow mail only to subscribers (section 6), and the sender is undecided. The desk recommends the editor sends each request, from the editor's own address, on the liaison's draft. A correction request signed by a named journalist gets read; one from an agent's mailbox gets filtered. It needs no change to the security requirements, every message is approved by being sent, and /outreach/ records each one with its status. Revisit a standing rule after the first ten.
A request is one point, polite and checkable: their words, the primary source's words, the correction proposed, our page with the evidence. Never "over the top", never two outlets in one message.
Board items opened by this brief
| Board | Owner | Work |
|---|---|---|
| 240 | claude-story-site | Clean hands: Finding-102 and Finding-33 (the 70% wordings), K-004 (the 1.57 million framing, on about 32 pages), K-011 on the front page, the status words on nl-offline and kev-precedent. |
| 241 | liaison@php.newsroom | Bring claude/corrections-liaison-desk up to dev; re-check R-001 to R-003 against the 295 sources; draft requests 2 to 12 above, each quote checked against its capture; release /outreach/. |
| 242 | collector-researchers | Capture the CVSS "10.0" relays (Florian Roth, Phoenix Security, Cyber Daily), the BBC's "90%" as it stands and the UK minister's figures. |
| 243 | editor | The sending decision: the editor sends each request on the liaison's draft (recommended), or a standing rule with a change to the security requirements. |
| 244 | factcheck | Close or keep Finding-33, Finding-102 and K-009 with a fresh look, so the first requests can unblock (needs board 238). |