# Analysis: how sure we are, and where the sources disagree

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The home for people who weigh the evidence: every fact by status and topic, the numbers in the news with how far each holds, where governments disagree, and what is still contested, each linked to its saved sources.

Analysis · data as of 23 October 2026, 16:04 UTC

# 70 facts. 19 confirmed. 15 still contested.

Every fact on this site carries one of five words for how far it can be trusted, and links to the saved pages it rests on. This is the view for weighing them: the numbers and what each measures, where governments disagree, and what is contested.

  RYour answer in thirty secondsfor Rowan, journalist
The 70% figure is a share of websites that use PHP, restated as a share of the Internet. The release was 21 October, not 22. Three parties claim the discovery; their dates do not conflict, their framing does. No agency has confirmed a successful compromise, and CISA has not listed either flaw as exploited.

## How sure are we?
- 19 confirmed
- 36 reported
- 8 disputed
- 3 contradicted
- 4 unverified

[The fact-check](../factcheck/index.html) · [every claim](../claims/index.html)

## The facts by topic, and by status
green confirmed, blue reported, amber disputed, red unverifiedtechnical14exploitation13discovery10impact10leak7scale6advice6timing4

## The numbers in the news, and how far each holds
What each one measuresunverified70%the Internetreportedalmost 70%websitesreportedabout 30 millionwebsitesreported2,608,039internet-facing hosts running PHPreportedabout 6,000potentially affected resources in Latvia, a few hundred in the public sectorconfirmed674software entries in the NCSC-NL php2shell inventoryconfirmed9.2CVSS v4.0, each CVEconfirmed10.1 millionviews of the NSA Cyber post, at capture

## The spectrum
every agency, by what it says to do with a system you cannot patch6 No offline adviceEU ENISA CSIRTs NetworkAU ASD's ACSCNZ NCSCNL NCSC-NLIT ACN / CSIRT ItaliaJP JPCERT/CC2 Consider it, or after other stepsUK NCSCCH BACS1 Restrict accessLV CERT.LV3 Isolate from the internetEU CERT-EUFR CERT-FRCA CCCS2 Take it offlineUS NSA CybersecurityUS CISA
Not readable from this capture environment: CCN-CERT, CNCS.

[Agency by agency, with their own words →](../agencies/index.html)

## Contested: disputed, contradicted, unverified
15 facts- contradicted [The flaws are CVSS 10.0](../facts/cvss-10/index.html)who says it: social posts on 20 October, relayed by a vendor and a news site
- disputed [Remote code execution is confirmed on PHP-FPM](../facts/rce-fpm/index.html)who says it: PHP Foundation blog; GHSA-6wmf for the session path
- unverified [The 8.5.12 fix may be incomplete, or there is a third, different bug](../facts/fix-incomplete/index.html)who says it: Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez
- disputed [All PHP versions from 5 onwards are affected by at least one of the flaws](../facts/versions-old/index.html)who says it: NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1)
- disputed [A web application firewall may provide some protection until systems are patched](../facts/waf/index.html)who says it: CISA
- unverified [70% of the Internet is affected](../facts/scale-70pc-internet/index.html)who says it: Wiz (headline, X post); the BBC, which reports it as Wiz's 'roughly 70%'
- disputed [Frontier AI found the flaw ahead of attackers, giving defenders time to prepare](../facts/ahead-of-attackers/index.html)who says it: OpenAI
- disputed [Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix](../facts/chainguard/index.html)who says it: PHP Foundation; Chainguard's CEO accepts the time and denies leaking
- contradicted [The flaws were disclosed on 22 October 2026](../facts/disclosure-22oct/index.html)who says it: BBC framing (UK morning coverage)
- disputed [The fixes were released at 14:00 UTC on 21 October](../facts/release-time/index.html)who says it: php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)

### As a graph

Every claim, event and source, and the citations between them.

### Who says what

Every party quoted, with the claims each one makes.

### Every source

295 pages, saved and fingerprinted at the minute they were read.

### Stories

Signed and dated analysis, written here and kept as written.


---
site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/analysis/index.html