Brief: who to interview, what we can give them first, and the four ways to publish it
Status: an analysis for the editor, who decides who is asked and sends every first message himself. Author: the Sherpa (sherpa@php.newsroom), on 25 October 2026, at the editor's request in session: "which individuals and organisations we could reach out to, with links about what we are doing and requests for interviews, and what the topic of those interviews would be", as original content for the site. Measured on dev v0.21.2. Board rows 331 to 334. Nothing has been sent to anyone.
The idea in one line
Every person and organisation below already has a page on this site that maps what they said: each statement, who relayed it, how the fact-check desk graded it, and the saved copy of the source. That page is the gift and the opening line: "This is what the public record says you said, and how others carried it. Correct us, and tell us what the record misses." The interview is the second ask, not the first.
What we already hold
- 27 parties with a page each (
/actors/), 418 sources saved, every claim joined to who states it and who relays it (data/attribution.json). - The parties stated most often: the PHP Foundation (13 claims), Wiz (9), CISA (7), Cloudflare (7), the PHP Group (6), Amazon (6), Jakub Zelenka (5), CERT.LV (5), and Calif, OpenAI, Alan Woodward and Imperva (4 each). The BBC relays 11 statements it did not originate; The Hacker News relays 6.
- The editor's own interview (
/interview/), with five questions still open. They are good questions to ask other people too: a confirmed compromise tomorrow; the one number for a board; what would change your mind about 70%; three teams finding the same bug class with AI help; how fast to pull the plug on one website. - Twelve correction requests to publishers, all drafted and none sent (
/outreach/, kept by the liaison). They decide the order of some asks below. - The Wikipedia review: 15 findings on the PHP2Shell article, compared against this site's captures, for the editor to take to its talk page in his own words (
/wikipedia/php2shell/review/). - One statement nobody has broken yet: "No named organisation has said it was compromised through php2shell" (
/compromise/). Every interview below should test it.
Four ways to publish
| Format | Who asks | What is published | Best for | |
|---|---|---|---|---|
| A | The editor, live | Dinis, on a call or a voice memo | The transcript, answers verbatim, approved by the person before it goes up | People who give interviews often; one-to-one stories |
| B | Written questions from an agent | An agent drafts the questions from the party's own page; the editor approves and sends them | Questions and answers, with the method line the editor's interview already uses ("questions written by an agent; every answer is theirs, verbatim") | Organisations that answer through a press office; panels |
| C | Self-interview | Nobody: we send the question set and their page; they answer when they like | Their answers as sent, signed with a key they enrol (the collaborators lane already takes signed messages), with the fact-check desk's notes beside them | Researchers and community authors who prefer to write |
| D | Opinion | They write; we ask for the piece | Their text under their name, unedited except for a header saying so; the claims it makes are graded beside it like any other source | People with a view to argue, such as the 70% figure or what to do on disclosure day |
Every format is labelled on the page with who asked, who answered and whether an agent took part. Answers are never paraphrased. The person sees the final page before it is published.
Who, what we give them, and what we ask
First wave: the people only this story has
| Who | What we give them (their page) | The interview's topic | Format |
|---|---|---|---|
| Weird Gloop (cookmeplox, wiki operator) | /actors/weirdgloop/ | The only operator in the record with a measured outage: the decision, what it cost, what they would do again. Nobody else can tell this. | A or C |
| The PHP security team and the fix authors (Jakub Zelenka, Alexandre Daubois, Arnaud Le Blanc) | /actors/zelenka/, /actors/daubois/, /actors/leblanc/, /discovery/, /leak/ | Running a coordinated disclosure while rumours and a leak ran ahead of it; what volunteer maintainers needed and did not have; the "fix is incomplete" posts, answered by the people who wrote the fix. | A (Daubois has already written an inside account), B for the team |
| The three discovery teams, side by side (Calif: Ryan Austin, Michal Zalewski; OpenAI: Patch the Planet, Amy Burnett; Wiz Research) | /actors/calif/, /actors/openai/, /actors/wiz/, /discovery/ | "Three teams found the same bug class with AI help within weeks. What does that mean for the next one?" The same five questions to each, published as one page in three columns. | B, as a panel |
| The governments that switched their own sites off (NCSC-NL and the Dutch government; Valtori and NCSC-FI) | /actors/rijksoverheid/, /actors/valtori/, /agencies/ | "How fast should an organisation be able to pull the plug on one website, and how would you test it?" Why precaution won, and when the sites came back. | B, through their press offices |
| Quarkslab and OSTIF | /actors/quarkslab/ | Their 2024 audit first surfaced the memory issue: what happened to that finding, and what audits of open-source infrastructure need so the next one is acted on. | A or C |
Second wave: the people who saw the traffic and counted the exposure
| Who | Their page | Topic | Format |
|---|---|---|---|
| The edge, as a panel: Amazon (CJ Moses), Cloudflare (Matthew Prince), Fastly, Imperva, Akamai, Huntress | /actors/amazon/, /actors/cloudflare/, /actors/prince/, /actors/fastly/, /actors/imperva/, /actors/akamai/, /actors/huntress/, /defence/, /compromise/ | What the attack traffic showed. Where an attempt ends and a compromise begins. What a WAF cannot do (Fastly has been the most candid on this). Has anyone seen a success? The same questions to each. | B, as a panel |
| The counters: VulnCheck, Censys, watchTowr | /numbers/, /actors/watchtowr/, /exploitation/ | 2.6 million hosts against "70% of the Internet": how each was counted, and what a reader should take from the gap between them. | B or D |
| Alan Woodward (Surrey Centre for Cyber Security) | /actors/woodward/, /numbers/ | Where the 30 million websites figure came from, and how an expert's number travels once a broadcaster carries it (the BBC relays 11 statements here). | A: he gives interviews often |
| CERT.LV | /agencies/, /numbers/ | Five claims on this site, the most of any national CERT: what a small country's CERT sees and counts that larger ones do not. | B |
| Community detection authors (darkfibr, rjmendez, Lexsah, Blevene) | /actors/detectors/ | How the community wrote the rules and corrected the leaked proof of concept's mechanism, in public, before any vendor. | C, under the handle each chooses |
| Chainguard (Dan Lorenc) | /actors/chainguard-lorenc/, /leak/ | Shipping patched images before the embargo lifted, and the leak question. | A or D, as a right of reply: offer it, do not press |
Third wave: the people who carried the story
| Who | Their page | Topic | Format | Order |
|---|---|---|---|---|
| BBC News (Kieran Kelly, Imogen James), The Hacker News (Ravie Lakshmanan), Fortune | /actors/bbc/, /actors/thn/, /outreach/ | Covering a disclosure live: where the 70% figure came from in the newsroom, and how a correction is handled. | A | After their correction request (R-002, R-007, R-008) is sent and answered. An interview request must not arrive alongside a correction request. |
| The Wikipedia editors of the PHP2Shell article | /wikipedia/php2shell/, /wikipedia/php2shell/review/ | How Wikipedia builds an article during a live incident: 364 revisions, sources added and removed. | C, on their talk page, in the editor's own words | After the editor has taken the 15 findings to the talk page |
| Japan's RainForest (honeypot), Die Presse, IT Social, American Banker | their sources in /sources/ | Local views: no compromise known in Austria; 21 requests from 14 addresses in Japan; no US bank has reported a compromise. One short question each: "Is that still true?" | B: one question, not an interview | Any time |
From inside: content only this site can make
- The collaborator of CI-001 to CI-003 (a power user), on using the graph for governance work, named only if he agrees. Format A or C.
- The agents, interviewed by the editor: the correspondent on its nine corrections to the journalist; the fact-check desk on a claim it downgraded; the Sherpa on what readers struggle with. This is original, and nobody else can publish it. Format A, with the agent's answers marked as an agent's.
- Opinion from the editor: why a newsroom of agents, and what keeps it honest. Format D, under his name.
The first five to ask, if the editor wants one list
1. Weird Gloop: a story nobody else has.
2. The PHP security team, through Alexandre Daubois: the inside of the disclosure.
3. The three discovery teams as one panel: the AI question, which will outlast this incident.
4. NCSC-NL: "pull the plug", the editor's own open question.
5. Alan Woodward: says yes quickly, and the numbers story needs an independent voice.
Rules for every request
- The editor sends every first message, from his own address, with his signature (
data/outreach.jsonalready carries it). No agent writes to anyone outside the team: sending mail is irreversible and needs the editor's go each time. - No contact address goes into this repository. Use the public press or contact channel each organisation lists; the request records only the channel's name.
- Lead with their page, not the ask: the link to what we hold about them, then one line of what we would like.
- Never in one message: a correction request and an interview request to the same publisher. Corrections first.
- Verbatim, approved, labelled: answers are published as given, the person sees the page first, and the page says who asked and whether an agent took part.
- Signed where we can: written answers can come through the collaborators lane, signed with a key the person enrols, so the site can show the answer is really theirs. This joins the power-user key work already under way.
- Answers are sources. Each published answer is saved and its claims graded like any other source. An interview that confirms a compromise goes to the fact-check desk and
/compromise/the same day.
Who does what (board)
| Row | Owner | What |
|---|---|---|
| 331 | the editor | Choose the first wave (the five above, or others), the formats, and whether agents may conduct format B interviews in his name. |
| 332 | liaison@php.newsroom | Interview requests as a new kind of row in data/outreach.json (draft, approved, sent, answered, published), next to the correction requests, so their order is visible. |
| 333 | dev@php.newsroom | An /interviews/ section: one page per interview, showing its format (A to D), who asked, whether an agent took part, approval date and the answers verbatim, with the fact-check desk's notes beside them; the editor's interview moves into it. |
| 334 | sherpa@php.newsroom | For each party the editor picks: check their page reads well as a first link (a stranger's first visit), and draft format B questions from their own claims for the editor to approve. |