# Prototype F: the line, the numbers

A content page under the line: the numbers in the news, with the facts by status as the line's picture.

> Prototype F for review, built from the data of release v0.18.2. Not the live site. Every part of the page is listed here; a reader sees the parts written for their role.

The numbers 
## The numbers in the news, and how far each holds

Every figure that has been repeated about this story, with where it comes from and whether it holds up. 

### How sure are we?
 70 facts 

- 19 confirmed 
- 36 reported 
- 8 disputed 
- 3 contradicted 
- 4 unverified 

### Every number

 70% Not stated. The headline is a restatement of the body's figure for websites. unverified 
 almost 70% The share of websites whose server-side language is PHP, as commonly published by web-technology surveys. Neither page names the survey. reported 
 about 30 million Not stated. reported 
 2,608,039 Hosts observed on the internet that expose PHP, as counted by one scanning vendor. reported 
 about 6,000 Resources identified by the national CERT as potentially affected, in one country. reported 
 674 Rows in the inventory: 206 marked Vulnerable, 46 Fix, 418 Investigation, 3 Not vulnerable, 1 without a status. confirmed 

### Contested

- contradicted The flaws are CVSS 10.0
who says it: social posts on 20 October, relayed by a vendor and a news site 
- disputed Remote code execution is confirmed on PHP-FPM
who says it: PHP Foundation blog; GHSA-6wmf for the session path 
- unverified The 8.5.12 fix may be incomplete, or there is a third, different bug
who says it: Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez 
- disputed All PHP versions from 5 onwards are affected by at least one of the flaws
who says it: NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1) 
- disputed A web application firewall may provide some protection until systems are patched
who says it: CISA

---
site v0.18.2 · https://php.oct.2026.newsroom.sgit.ai/admin/design/line/numbers/index.html