Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Analysis · data as of 23 October 2026, 16:04 UTC
70 facts. 19 confirmed. 15 still contested.
Every fact on this site carries one of five words for how far it can be trusted, and links to the saved pages it rests on. This is the view for weighing them: the numbers and what each measures, where governments disagree, and what is contested.
The 70% figure is a share of websites that use PHP, restated as a share of the Internet. The release was 21 October, not 22. Three parties claim the discovery; their dates do not conflict, their framing does. No agency has confirmed a successful compromise, and CISA has not listed either flaw as exploited.
How sure are we?
- 19 confirmed
- 36 reported
- 8 disputed
- 3 contradicted
- 4 unverified
The facts by topic, and by status
green confirmed, blue reported, amber disputed, red unverifiedThe numbers in the news, and how far each holds
What each one measuresThe spectrum
every agency, by what it says to do with a system you cannot patchNot readable from this capture environment: CCN-CERT, CNCS.
Contested: disputed, contradicted, unverified
15 facts- contradicted The flaws are CVSS 10.0who says it: social posts on 20 October, relayed by a vendor and a news site
- disputed Remote code execution is confirmed on PHP-FPMwho says it: PHP Foundation blog; GHSA-6wmf for the session path
- unverified The 8.5.12 fix may be incomplete, or there is a third, different bugwho says it: Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez
- disputed All PHP versions from 5 onwards are affected by at least one of the flawswho says it: NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1)
- disputed A web application firewall may provide some protection until systems are patchedwho says it: CISA
- unverified 70% of the Internet is affectedwho says it: Wiz (headline, X post); the BBC, which reports it as Wiz's 'roughly 70%'
- disputed Frontier AI found the flaw ahead of attackers, giving defenders time to preparewho says it: OpenAI
- disputed Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fixwho says it: PHP Foundation; Chainguard's CEO accepts the time and denies leaking
- contradicted The flaws were disclosed on 22 October 2026who says it: BBC framing (UK morning coverage)
- disputed The fixes were released at 14:00 UTC on 21 Octoberwho says it: php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)