Board member: the run of 2026-10-22T1753Z

The review, in the reader's words

The board briefing gives me five sharp questions to put to management and a clear sense that nobody has been confirmed hacked, but on my phone I had to scroll past two screens of reading-tracker and research boxes before I saw it, and nothing told me what a retailer with an online shop should specifically worry about.

Got the answer partly · On page 2 (briefings/board/index.html): the thirty-second answer sits just below the first screen and the 'What to decide or do' list gives me my board questions about one screen further down; whether my own company is exposed is never answerable from the site, which is fair, but the briefing also does not say plainly that an online shop on PHP is squarely in scope until the explainer and the Questions page.

What works

• The thirty-second answer in the board briefing is exactly the shape I need: what happened, what agencies say, no confirmed break-in, and the three questions to ask. (briefings/board/index.html)
• 'What to decide or do' is a ready-made list of board questions (inventory including vendor products, patched and restarted, who can pull a system, what a compromise would reach, evidence we were not hit). I can copy these straight into my notes. (briefings/board/index.html)
• The 'At a glance' tiles (Is there a fix? Yes. Anyone confirmed hacked? Not yet.) tell me in seconds how worried to be. (index.html)
• The opening paragraph is plain and reassuring in the right way: it says what PHP is, that a fix exists and that phones and laptops are not affected. (index.html)
• The kitchen analogy and the 'What that can reach' list finally made the risk concrete for me: database passwords and other systems that trust the server. (explained/index.html)
• The 'IN PLAIN ENGLISH' line at the top of the impact page saves a non-technical reader: two lists, many offline as a precaution, nobody confirmed broken into. (impact/index.html)
• The Questions page answers 'Should we take our site offline?' and 'We are behind Cloudflare. Are we safe?' in short pasteable paragraphs, which are both questions I expect to hear in the boardroom. (questions/index.html)
• The status words (confirmed, reported, unverified) and the sources under each fact make me trust that I am not repeating a rumour to the board. (index.html)

What does not

• high On a phone the first screen of every page is site machinery, not the story: version badge, a £ meter, a reading tracker with 'fade / hide / show' buttons and a 'Research' box. On the board briefing the thirty-second answer only begins at the very bottom of the first screen. (briefings/board/index.html)
  fold.png shows 'Your reading: on this page 35 new, 0 changed, 0 read', 'Mark this page read', 'Mark everything read', 'Read items: fade hide show', the RESEARCH box and the 'New to this story?' banner before 'THE ANSWER IN THIRTY SECONDS' appears at the bottom edge.
• medium The briefing promises to cover 'what is it costing us' but never gives me any sense of cost, for downtime or for a breach; it only points me to other readers' briefings. (briefings/board/index.html)
  Heading question 'Are we exposed, what is it costing us...' while the body says 'what it costs to find out' and nothing more; the CFO briefing is only listed under 'Other readers'.
• medium Nothing speaks to my kind of business. Online shops are mentioned only in passing in a list of things the BBC reported offline; there is no line saying what an e-commerce site on PHP stands to lose (card data, customer accounts). (briefings/board/index.html)
  The only shop reference I found is 'French government services; the University of Geneva; the BBC; online shops' in the impact table; the Questions page says Magento runs on PHP but the board briefing does not.
• medium The 'What is still open' section in my briefing is written for a journalist, not a director: deleted videos, Fediverse reports and oss-security mean nothing to me. (briefings/board/index.html)
  'Whether the deleted Calif video is the one now embedded on Calif's own write-up.' and 'A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October'.
• medium The impact page tables are squeezed into six narrow columns on a phone, so each row becomes a tall stack of two- or three-word lines and the page runs to more than nine screens. (impact/index.html)
  full.jpg shows the 'Taken offline' table with columns WHO, WHAT HAPPENED, WHEN, WHO SAYS SO, STATUS, SOURCES each a sliver wide; instruments: 9.4 screens, reading ease 8.9.
• medium The closing summary of the impact page drops straight into technical jargon I cannot get past. (impact/index.html)
  'how many were mod_php on x86_64 with default limits, reachable without a WAF, and how many of those show a worker spawning a shell'.
• low Words listed for me to 'meet' include terms the briefing itself tells me to skip, which is confusing. (briefings/board/index.html)
  'What you can skip: SAPIs and settings' but 'Words you will meet' lists 'SAPI', 'KEV', 'Honeypot'.
• low The Questions page opens with a paragraph about a librarian and an email address before any question, and is 18.6 screens long, mostly a site catalogue I had no use for. (questions/index.html)
  'Kept by the librarian, librarian@php.newsroom: the catalogue: which page answers which question...'; instruments: 18.6 screens.

What this reader would change, in order

1. Move the reading tracker, £ meter and Research box below the article on phones (or collapse them into one line), so the thirty-second answer is the first thing on the first screen. (briefings/board/index.html, medium)
   Between meetings I have seconds; today I scroll past controls I never use before I learn whether to worry.
2. Add two or three sentences on cost: what downtime has looked like for organisations so far (for example Weird Gloop's 13 hours) and what a breach would put at risk, with a link to the CFO briefing. (briefings/board/index.html, small)
   The headline asks 'what is it costing us' and the page never answers it.
3. Add one line for organisations that sell online: shop platforms such as Magento and WordPress shops run on PHP, and a compromise could reach customer data and payment settings. (briefings/board/index.html, small)
   It would tell me in one sentence that my company is squarely in scope and why it matters to us.
4. Rewrite 'What is still open' for a director: keep 'nobody confirmed hacked yet' and 'the fix may not be complete', drop the video and Fediverse details or move them to the journalist briefing. (briefings/board/index.html, small)
   The two open points that change my board questions are buried among forensics I cannot judge.
5. On phones, turn the two impact tables into stacked cards (who, what happened, who says so, status) instead of six narrow columns. (impact/index.html, medium)
   The page is the evidence that offline is a precaution, but on my phone it is unreadable slivers.
6. Replace the mod_php and x86_64 sentence at the end of the impact page with a plain version: nobody yet knows how many unpatched sites were actually broken into. (impact/index.html, small)
   It is the conclusion of the page and I could not follow it.
7. Add a 'What to ask management' heading wording (instead of 'What to decide or do') and number the questions. (briefings/board/index.html, small)
   Numbered questions are easier to read out in a meeting and to tick off as management answers.
8. Put the questions first and move the librarian paragraph and the page catalogue to the bottom or another page. (questions/index.html, small)
   The useful short answers are hidden behind an introduction about how the site is run.

Lines this reader reacted to

• briefings/board/index.html: Your questions are: do we know every system running PHP, are they updated and restarted, and who can pull a system offline and how fast.
  This is what I came for. I could read this sentence aloud at the board meeting.
• briefings/board/index.html: What is our evidence that we were not exploited between the leak on 20 October and our patch?
  A good, pointed question I would not have thought to ask on my own.
• briefings/board/index.html: Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak.
  I have no idea who Calif is or why this matters to my company; it lost me.
• index.html: Phones and personal computers are not affected.
  Useful straight away: it tells me this is about our servers, not our staff laptops.
• explained/index.html: it does not matter how well a website is written; if PHP underneath it is unpatched, it is in scope.
  Clear and alarming in the right way: I cannot be told 'our code is fine' as an answer.
• explained/index.html: Taking a site offline is a decision an organisation makes, not evidence it was attacked.
  Reassuring and worth repeating to colleagues who will see the headlines.
• impact/index.html: the reported cost of php2shell so far is the cost of precaution.
  The single best line for a board: so far the damage is downtime, not breaches.
• impact/index.html: how many were mod_php on x86_64 with default limits, reachable without a WAF, and how many of those show a worker spawning a shell.
  Complete jargon. I gave up on this paragraph.
• questions/index.html: Safer, not safe.
  Three words I will use if someone tells me our firewall provider has it covered.

Since the last run

First run: no previous review to compare against. Of the instruments' checks, the one that hurt me most was not on their list: the controls filling the first screen. The impact page's reading ease of 8.9 matched my experience at its end. Small tap targets (the breadcrumb and version badge) did not matter to me, as I never tapped them; the 11.84px text did not get in my way; page length mattered on the glossary and questions pages, which I skimmed rather than read.

Reviewer: agent-session.

The journey

The pages in the order read: the start, the reader's path, then the links that matched its interests.

What the instruments flagged

Measurements, not verdicts: the review says which of them mattered to this reader.

Everything this run saw

Vault 1zq458zk · read key sgit_public_read_f5578366fad746fe3273c3650bf76df06b1b69b157956ccf5a84e5ddb5ff73fb:1zq458zk (read-only, published on purpose)

Open the vault read-only in a new tab ↗ · sgit clone sgit_public_read_f5578366fad746fe3273c3650bf76df06b1b69b157956ccf5a84e5ddb5ff73fb:1zq458zk

This run is in the folder runs/2026-10-22T1753Z/: the served and rendered HTML, the text and the screenshots of every page, every request and console message, and what the reviewer was given.