# Mockup A: the front page for a board member, Focus view

The front page for a board member who wants only what their role needs: the situation, five numbers, three questions for the team, what is new, and one picture each of how it unfolded and what governments advise.

> Mockup A for review, built from the data of release v0.10.9. Not the live site.

Developing  ·  last checked 23 October 2026, 01:20 UTC 

## Two serious security flaws in PHP, the software behind many of the world's websites

PHP is the software that WordPress and millions of other websites run on. A fix came out on 21 October 2026. Government cyber agencies have told organisations to install it now, or to take websites offline if they cannot. Phones and personal computers are not affected. 

 J 
 Your answer in thirty seconds 
for Jordan, board member or executive 

A critical flaw in software that runs many websites, fixed on 21 October. Every agency says update first; some say take systems offline if you cannot. As of the evening of 22 October, no named organisation has said it was broken into through this flaw, though attempts are widespread. Your questions are: do we know every system running PHP, are they updated and restarted, and who can pull a system offline and how fast. 

A fix 
Available 
PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, since 21 Oct 

Severity 
Critical 
9.2 out of 10, both flaws 

Confirmed break-ins 
None 
no named organisation, as of the latest capture 

Taken offline 
10 organisations 
as a precaution, across 6 countries 

Agencies compared 
16 
all say update; they split on offline 

### Three questions to put to your team this week
 from your briefing 

1 

#### Are we exposed?

Ask for the list, not a percentage: every system that runs PHP, including vendor products and hosting panels, and which are on the internet. 

2 

#### Is everything updated and restarted?

Updating is not enough until PHP is restarted. Ask for the running version, checked after the restart, system by system. 

3 

#### Who can pull a system offline, and how fast?

Every agency puts offline last, but you need to be able to do it in minutes. Name the person and rehearse it once. 

### Since you last looked
 3 new 
- New 22 Oct, 06:55 UTC 
The BBC reports the US NSA's advice: take systems offline if they cannot be updated. 
- New 22 Oct, 07:00 UTC 
One of the researchers who found the flaws tells BBC Radio 4 there is no evidence yet of them being used in attacks. 
- New 22 Oct, 08:40 UTC 
The Dutch national cyber agency's list of affected software reaches 674 products. 
Read items disappear from this list. Everything new → 

#### Ask about it

"What should I tell the board on Thursday?" Answers cite the evidence. Ask a question 

### How it unfolded
 The full timeline 

2024 
An audit spots the out-of-memory weakness. Nobody can show it is exploitable, so it is left. 

Aug 2026 
Three teams using AI turn it into working attacks within three weeks and report them to PHP. 

20 Oct 
The secret leaks: the CVE numbers circulate two days early, with a wrong severity score. 

21 Oct 
PHP releases the fix a day ahead of plan. Firewall vendors already have rules live. 

22 Oct 
Agencies warn: update, or take systems offline. Sites go dark as a precaution. 

### What governments advise
 16 agencies 

All say install the fix. They split on what to do if you cannot. 

- 2 take offline 
- 4 isolate 
- 2 offline after other steps 
- 6 no offline advice 
- 2 not readable 

 See every agency → 

 Focus view shows 26 of 621 pages for this reader. Switch to Standard for the story and the evidence, or Everything for the whole site. Every number here links to its saved source on the live site.

---
site v0.10.9 · https://php.oct.2026.newsroom.sgit.ai/admin/design/a/index.html