Board member: the run of 2026-10-23T2355Z

The review, in the reader's words

The board briefing still hands me five good questions for management and a calm 'nobody confirmed hacked' answer, but it is the same briefing I read yesterday word for word, still buried under two screens of reading controls on my phone, and it still never tells a retailer with an online shop what we stand to lose or what this is costing anyone.

Got the answer partly · On page 2 (briefings/board/index.html), but only after scrolling: the 'THE ANSWER IN THIRTY SECONDS' label sits on the very bottom edge of the first screen and its text and the 'What to decide or do' questions come a screen further down. Whether my own company is exposed is never answerable from the site, and the briefing still does not say that an online shop on PHP is squarely in scope.

What works

• The thirty-second answer is still exactly the right shape for a director: what happened, what agencies say, nobody confirmed broken into, and three questions to ask. (briefings/board/index.html)
• 'What to decide or do' remains a ready-made list of board questions (inventory including vendor products, patched and restarted and checked, who can pull a system and has it been rehearsed, what a compromise would reach, evidence we were not hit). Do not lose it. (briefings/board/index.html)
• The opening paragraph of the front page is plain and right: what PHP is, a fix exists, agencies say install it, phones and personal computers are not affected. (index.html)
• The 'At a glance' tiles now include 'WEBSITES TAKEN OFFLINE: 10 organisations, reported, as a precaution' beside 'ANYONE CONFIRMED HACKED? Not yet', which tells me in seconds the damage so far is downtime, not break-ins. (index.html)
• The kitchen analogy and the 'What that can reach' list (database passwords, other systems that trust this server) still make the risk concrete for a non-technical reader. (explained/index.html)
• The blue 'IN PLAIN ENGLISH' box at the top of the impact page is visible on the first screen on my phone and gives me the page's point in one sentence. (impact/index.html)
• Short, pasteable answers to 'Should we take our site offline?' and 'We are behind Cloudflare... Are we safe?' are the two questions I expect in the boardroom. (questions/index.html)
• The status words (confirmed, reported, unverified) and a source under every fact mean I am not repeating a rumour to the board. (index.html)

What does not

• high The first screen on a phone is still site machinery, not the story. On my briefing the answer only starts at the very bottom edge of the first screen. (briefings/board/index.html)
  fold.png: version badge, Ask/Feedback buttons, '£4.98' meter, 'New to this story?' banner, 'Your reading: on this page 35 new, 0 changed, 0 read', 'Mark this page read', 'Mark everything read', 'Read items: fade hide show', the RESEARCH box and a four-line kicker all come before 'THE ANSWER IN THIRTY SECONDS', which is cut off at the bottom of the screen. Same block on every page I visited.
• high The briefing has not been touched since my last review: still 'This briefing v7 written in site v0.5.9 on 22 October', though the site is now v0.10.18. None of my requested changes to it were made. (briefings/board/index.html)
  Header reads 'This briefing v7 ... v0.5.9 on 22 October 2026 · history and changes, 6 earlier'; the text of every section is identical to the previous run.
• medium The headline promises 'what is it costing us' and the page still never answers it; no downtime or breach cost, and the CFO briefing is only one name in a list at the bottom. (briefings/board/index.html)
  Only cost wording is 'what it costs to find out' and 'If not, that is the first spend.' 'CFO' appears only under 'Other readers'.
• medium Nothing speaks to a business that sells online. The briefing never mentions shops, card data or customer accounts; the only shop reference is a single phrase in the impact table. (briefings/board/index.html)
  Impact table row 'French government services; the University of Geneva; the BBC; online shops'. The Questions page lists Magento among affected platforms; the board briefing does not.
• medium 'What is still open' is still written for a journalist: deleted videos, Fediverse and oss-security mean nothing to a director. (briefings/board/index.html)
  'Whether the deleted Calif video is the one now embedded on Calif's own write-up.' and 'A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated.'
• medium The briefing's status line is a day old while the page header says it was checked today, so I cannot tell if 'nobody hacked' is still true this morning. (briefings/board/index.html)
  Header 'last checked 23 October 2026, 12:50 UTC' against the answer's 'As of the evening of 22 October, no named organisation has said it was broken into'.
• medium The impact tables are still six narrow columns on a phone, so each row is a tall stack of two or three words and the page runs to 9.5 screens. (impact/index.html)
  full.jpg shows 'Taken offline' with WHO, WHAT HAPPENED, WHEN, WHO SAYS SO, STATUS, SOURCES each a sliver wide; instruments: 9.5 screens, reading ease 8.7.
• medium The impact page's conclusion still ends in jargon I cannot get past. (impact/index.html)
  'how many were mod_php on x86_64 with default limits, reachable without a WAF, and how many of those show a worker spawning a shell'.
• low The Questions page still opens with the librarian and an email address, and has grown from 18.6 to 21.7 screens, mostly a site catalogue of internal pages (telemetry, vaults, pack mode, team chat) of no use to me. (questions/index.html)
  fold.png ends on 'Kept by the librarian, librarian@php.newsroom: the catalogue...' with no question visible; catalogue includes 'Pack mode, measured on the source watch' and 'How the team talks: three vaults and one run' listed three times.
• low 'Words you will meet' still lists terms the same briefing tells me to skip. (briefings/board/index.html)
  'What you can skip: SAPIs and settings' while 'Words you will meet' lists 'SAPI', 'KEV', 'Honeypot'.
• low The glossary is labelled as being about how the site works rather than about the story, which made me wonder if I had left the briefing. (glossary/index.html)
  fold.png box 'ABOUT THIS SITE how the site works, kept by the agents that run it' above 'Glossary: every term, in plain English'.

What this reader would change, in order

1. On phones, collapse the reading tracker, £ meter and Research box into one line or move them below the article, so 'THE ANSWER IN THIRTY SECONDS' is fully on the first screen. (briefings/board/index.html, medium)
   Between meetings I have seconds, and two runs in a row I have scrolled past controls I never use before learning whether to worry.
2. Add one line for organisations that sell online: shop platforms such as Magento and WordPress shops run on PHP, and a compromise could reach customer accounts and payment settings. (briefings/board/index.html, small)
   It would tell me in one sentence that my company is in scope and why it matters to us.
3. Add two or three sentences on cost: so far it is downtime (for example Weird Gloop's 13 hours, councils and government sites pulled), what a breach would put at risk, and a direct link to the CFO briefing. (briefings/board/index.html, small)
   The headline asks 'what is it costing us' and the page never answers.
4. Refresh the thirty-second answer to today's check time, or say 'still true as of 23 October' beside it. (briefings/board/index.html, small)
   I need to know the reassurance is current before I repeat it to the board.
5. Rewrite 'What is still open' for a director: keep 'nobody confirmed hacked yet' and 'the fix may not be complete', move the video, Fediverse and leak details to the journalist briefing. (briefings/board/index.html, small)
   The two open points that change my questions are buried among forensics I cannot judge.
6. Rename 'What to decide or do' to 'What to ask management' and number the five questions. (briefings/board/index.html, small)
   Numbered questions are easier to read out in a meeting and tick off as management answers.
7. On phones, show the impact tables as stacked cards (who, what happened, who says so, status) and replace the mod_php sentence with 'nobody yet knows how many unpatched sites were actually broken into'. (impact/index.html, medium)
   This page is my evidence that offline was a precaution, but on a phone it is slivers and ends in jargon.
8. Put the questions table first and move the librarian paragraph and the whole site catalogue to another page. (questions/index.html, small)
   The useful short answers are hidden behind an introduction and a 20-screen list of internal pages.

Lines this reader reacted to

• briefings/board/index.html: Your questions are: do we know every system running PHP, are they updated and restarted, and who can pull a system offline and how fast.
  Still what I came for. I could read this aloud at the board meeting.
• briefings/board/index.html: Who is authorised to take a system offline, how long does it take, and has it been rehearsed?
  Exactly the governance question a board should own; 'rehearsed' is the word that will make management squirm.
• briefings/board/index.html: Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak.
  Still no idea who Calif is or why this matters to my company; it lost me again.
• index.html: Phones and personal computers are not affected.
  Useful straight away: this is about our servers, not staff laptops.
• explained/index.html: it does not matter how well a website is written; if PHP underneath it is unpatched, it is in scope.
  Clear and alarming in the right way: 'our code is fine' is not an answer I should accept.
• impact/index.html: the reported cost of php2shell so far is the cost of precaution.
  The best line for a board, and it belongs in my briefing, not only here.
• impact/index.html: A quiet log is not a clean host.
  Plain and memorable; it tells me not to accept 'we saw nothing' as proof.
• impact/index.html: how many were mod_php on x86_64 with default limits, reachable without a WAF, and how many of those show a worker spawning a shell.
  Still complete jargon. I gave up on this paragraph again.
• questions/index.html: Safer, not safe.
  Three words I will use if someone says our firewall provider has it covered.

Since the last run

Almost nothing changed for me between v0.4.3 and v0.10.18. Still open: all eight of my requested changes. The board briefing is word for word the same (still 'v7, written in site v0.5.9'), the phone first screen is still controls before the answer, cost and online shops are still missing, 'What is still open' still talks about Calif's video and the Fediverse, the impact tables are still narrow columns ending in the mod_php sentence, and the Questions page still opens with the librarian. New and better: the front page 'At a glance' adds 'Websites taken offline: 10 organisations' and a 'Check your stack' tile, and a 'Stories' section. New and worse: the Questions page grew from 18.6 to 21.7 screens of site catalogue, the briefing's 'as of the evening of 22 October' now looks stale against a header checked on 23 October, and the glossary is badged 'About this site'. Of the instruments, the impact page's reading ease of 8.7 matched my experience; small tap targets (breadcrumb, version badge) and the 11.84px text did not affect me; page length mattered on the glossary and Questions pages, which I skimmed. No page text addressed me or an AI.

Reviewer: agent-session.

The journey

The pages in the order read: the start, the reader's path, then the links that matched its interests.

What the instruments flagged

Measurements, not verdicts: the review says which of them mattered to this reader.

Everything this run saw

Vault 1zq458zk · read key sgit_public_read_f5578366fad746fe3273c3650bf76df06b1b69b157956ccf5a84e5ddb5ff73fb:1zq458zk (read-only, published on purpose)

Open the vault read-only in a new tab ↗ · sgit clone sgit_public_read_f5578366fad746fe3273c3650bf76df06b1b69b157956ccf5a84e5ddb5ff73fb:1zq458zk

This run is in the folder runs/2026-10-23T2355Z/: the served and rendered HTML, the text and the screenshots of every page, every request and console message, and what the reviewer was given.