{
 "about": "Who states each claim, number and exploitation row, as entity ids from data/entities.json. Kept by the ontologist. The free-text 'by' and 'who' on each row stay as written by its author; this file resolves them to nodes. 'states' names the originators. 'relays' names who passed a statement on, where the row says so ('via The Hacker News'). The build adds a relay only where the fact-check desk found the claim's words in a capture whose publisher is not an origin; a source that is merely cited is evidence, not a relay, and may support or contradict. 'counts' marks a figure this site counted from a captured file or a clone. Exploitation rows are keyed by position and carry their 'who' so the build can refuse a mismatch when that file is reordered.",
 "kept_by": "ontologist",
 "claims": {
  "two-cves-9.2": {
   "states": [
    "php-group",
    "zelenka"
   ]
  },
  "cvss-10": {
   "states": [
    "unnamed"
   ],
   "note": "Social posts on 20 October; the Foundation and Daubois relay and correct them."
  },
  "rce-modphp": {
   "states": [
    "php-security-team",
    "php-group"
   ]
  },
  "rce-fpm": {
   "states": [
    "php-foundation",
    "zelenka"
   ]
  },
  "fix-bailout": {
   "states": [
    "php-security-team"
   ]
  },
  "fix-incomplete": {
   "states": [
    "unnamed"
   ],
   "note": "Fediverse posts, relayed to oss-security by Rainbolt and Perez.",
   "relays": [
    "oss-security-replies"
   ]
  },
  "versions-old": {
   "states": [
    "ncsc-nl",
    "wiz",
    "cert-fr"
   ]
  },
  "only-update": {
   "states": [
    "php-group",
    "php-security-team"
   ]
  },
  "waf": {
   "states": [
    "cisa"
   ]
  },
  "wordpress-drupal": {
   "states": [
    "calif",
    "wiz"
   ]
  },
  "scale-70pc-internet": {
   "states": [
    "wiz"
   ],
   "relays": [
    "bbc"
   ]
  },
  "scale-70pc-websites": {
   "states": [
    "cloudflare",
    "openai",
    "wiz"
   ]
  },
  "scale-30m": {
   "states": [
    "woodward"
   ],
   "relays": [
    "bbc"
   ]
  },
  "scale-2.6m-hosts": {
   "states": [
    "vulncheck",
    "censys"
   ],
   "relays": [
    "thn",
    "securityweek"
   ]
  },
  "scale-latvia": {
   "states": [
    "cert-lv"
   ]
  },
  "scale-ncsc-nl": {
   "states": [
    "ncsc-nl"
   ],
   "counts": true
  },
  "ai-found": {
   "states": [
    "openai",
    "calif",
    "wiz"
   ]
  },
  "who-first": {
   "states": [
    "calif",
    "php-foundation"
   ]
  },
  "openai-same-day": {
   "states": [
    "php-foundation"
   ]
  },
  "wiz-independent": {
   "states": [
    "wiz",
    "php-foundation"
   ]
  },
  "four-reporters": {
   "states": [
    "zelenka"
   ]
  },
  "quarkslab-2024": {
   "states": [
    "php-foundation",
    "calif"
   ]
  },
  "ahead-of-attackers": {
   "states": [
    "openai"
   ]
  },
  "most-severe": {
   "states": [
    "wiz"
   ],
   "relays": [
    "bbc"
   ]
  },
  "leak-cve-ids": {
   "states": [
    "php-foundation"
   ]
  },
  "leak-hn": {
   "states": [
    "daubois"
   ]
  },
  "leak-watchtowr": {
   "states": [
    "daubois",
    "cert-eu"
   ]
  },
  "leak-video": {
   "states": [
    "php-foundation"
   ]
  },
  "leak-mitigations": {
   "states": [
    "php-foundation"
   ]
  },
  "chainguard": {
   "states": [
    "php-foundation",
    "chainguard-lorenc"
   ]
  },
  "release-moved": {
   "states": [
    "php-foundation",
    "php-group",
    "wiz"
   ]
  },
  "disclosure-22oct": {
   "states": [
    "bbc"
   ]
  },
  "release-time": {
   "states": [
    "php-group",
    "daubois",
    "cert-fr"
   ]
  },
  "preannounce-time": {
   "states": [
    "php-foundation"
   ]
  },
  "no-exploitation": {
   "states": [
    "austin"
   ],
   "relays": [
    "bbc"
   ]
  },
  "cisa-none": {
   "states": [
    "cisa"
   ]
  },
  "nz-active": {
   "states": [
    "ncsc-nz"
   ]
  },
  "amazon-honeypot": {
   "states": [
    "amazon"
   ]
  },
  "cloudflare-traffic": {
   "states": [
    "cloudflare"
   ]
  },
  "probing": {
   "states": [
    "woodward",
    "amazon",
    "cloudflare"
   ],
   "relays": [
    "bbc"
   ]
  },
  "latvia-attempts": {
   "states": [
    "cert-lv"
   ]
  },
  "vibe-code": {
   "states": [
    "unnamed"
   ],
   "relays": [
    "bbc"
   ]
  },
  "offline-nsa": {
   "states": [
    "nsa"
   ]
  },
  "offline-cisa": {
   "states": [
    "cisa"
   ]
  },
  "offline-ncsc": {
   "states": [
    "ncsc-uk"
   ],
   "relays": [
    "bbc"
   ]
  },
  "offline-allies": {
   "states": [
    "bbc"
   ]
  },
  "affected-sites": {
   "states": [
    "bbc"
   ]
  },
  "latvia-offline": {
   "states": [
    "cert-lv"
   ]
  },
  "gov-patch-required": {
   "states": [
    "nsa"
   ]
  },
  "cf-millions": {
   "states": [
    "prince"
   ]
  },
  "imperva-none": {
   "states": [
    "imperva"
   ]
  },
  "huntress-none": {
   "states": [
    "huntress"
   ]
  },
  "watchtowr-itw": {
   "states": [
    "watchtowr"
   ]
  },
  "no-confirmed-compromise": {
   "states": [
    "this-site"
   ],
   "counts": true
  },
  "pocs-wrong": {
   "states": [
    "rjmendez",
    "vulncheck",
    "huntress"
   ]
  },
  "ac-high": {
   "states": [
    "imperva",
    "fastly",
    "cve-program"
   ]
  },
  "fix-authored": {
   "states": [
    "leblanc"
   ],
   "counts": true
  },
  "fix-engine": {
   "states": [
    "leblanc",
    "zelenka"
   ]
  },
  "more-paths": {
   "states": [
    "fastly"
   ]
  },
  "waf-nine-hours": {
   "states": [
    "cloudflare",
    "imperva",
    "akamai",
    "fastly",
    "fortinet"
   ]
  },
  "nl-offline": {
   "states": [
    "rijksoverheid"
   ]
  },
  "fi-offline": {
   "states": [
    "valtori"
   ],
   "relays": [
    "yle",
    "helsinki-times"
   ]
  },
  "wikimedia-precaution": {
   "states": [
    "wikimedia"
   ],
   "relays": [
    "cnn",
    "cyber-express"
   ]
  },
  "weirdgloop-13h": {
   "states": [
    "weirdgloop"
   ]
  },
  "edinburgh": {
   "states": [
    "edinburgh-council"
   ],
   "relays": [
    "scotsman"
   ]
  },
  "oxford": {
   "states": [
    "oxford-council"
   ],
   "relays": [
    "oxford-chronicle"
   ]
  },
  "uk-list": {
   "states": [
    "lbc",
    "insurance-business"
   ]
  },
  "quarkslab-redacted": {
   "states": [
    "quarkslab",
    "lopez-kurtz"
   ]
  },
  "lorenc-ai-found": {
   "states": [
    "chainguard-lorenc"
   ],
   "relays": [
    "the-register"
   ]
  },
  "kev-precedent": {
   "states": [
    "cisa",
    "akamai"
   ]
  }
 },
 "numbers": {
  "n-70-internet": {
   "states": [
    "wiz"
   ]
  },
  "n-70-websites": {
   "states": [
    "cloudflare",
    "openai"
   ]
  },
  "n-30m": {
   "states": [
    "woodward"
   ],
   "relays": [
    "bbc"
   ]
  },
  "n-2.6m-hosts": {
   "states": [
    "vulncheck"
   ],
   "relays": [
    "thn"
   ]
  },
  "n-6000-lv": {
   "states": [
    "cert-lv"
   ]
  },
  "n-674": {
   "states": [
    "ncsc-nl"
   ],
   "counts": true
  },
  "n-cvss": {
   "states": [
    "php-group",
    "zelenka",
    "cert-eu",
    "acn"
   ]
  },
  "n-views-nsa": {
   "states": [
    "x"
   ]
  },
  "n-4days": {
   "states": [
    "amazon"
   ],
   "relays": [
    "thn"
   ]
  },
  "n-9h": {
   "states": [
    "cloudflare"
   ]
  },
  "n-6h": {
   "states": [
    "php-foundation"
   ]
  },
  "n-censys": {
   "states": [
    "censys"
   ],
   "relays": [
    "securityweek"
   ]
  },
  "n-millions-attempts": {
   "states": [
    "prince"
   ]
  },
  "n-22.6m": {
   "states": [
    "unit42"
   ],
   "relays": [
    "insurance-business"
   ]
  },
  "n-94pc": {
   "states": [
    "weirdgloop"
   ]
  },
  "n-389": {
   "states": [
    "php-src"
   ],
   "counts": true
  },
  "n-kev-2026": {
   "states": [
    "cisa"
   ],
   "counts": true
  }
 },
 "exploitation": [
  {
   "who": "Amazon (CJ Moses, AWS Security Blog)",
   "states": [
    "amazon"
   ]
  },
  {
   "who": "Amazon (CJ Moses, via The Hacker News)",
   "states": [
    "amazon"
   ],
   "relays": [
    "thn"
   ]
  },
  {
   "who": "Cloudflare",
   "states": [
    "cloudflare"
   ]
  },
  {
   "who": "Amazon (via The Hacker News)",
   "states": [
    "amazon"
   ],
   "relays": [
    "thn"
   ]
  },
  {
   "who": "ELLIO (via The Hacker News and a comment under the PHP Foundation post)",
   "states": [
    "ellio"
   ],
   "relays": [
    "thn"
   ]
  },
  {
   "who": "CISA (ADP, SSVC on the CVE record)",
   "states": [
    "cisa"
   ]
  },
  {
   "who": "CISA (alert)",
   "states": [
    "cisa"
   ]
  },
  {
   "who": "CCCS (Canada)",
   "states": [
    "cccs"
   ]
  },
  {
   "who": "CERT.LV (Latvia)",
   "states": [
    "cert-lv"
   ]
  },
  {
   "who": "NCSC New Zealand",
   "states": [
    "ncsc-nz"
   ]
  },
  {
   "who": "PHP Foundation",
   "states": [
    "php-foundation"
   ]
  },
  {
   "who": "ASD's ACSC (Australia)",
   "states": [
    "acsc"
   ]
  },
  {
   "who": "Ryan Austin, Calif, on BBC Radio 4",
   "states": [
    "austin"
   ],
   "relays": [
    "bbc"
   ]
  },
  {
   "who": "Alan Woodward, on the BBC",
   "states": [
    "woodward"
   ],
   "relays": [
    "bbc"
   ]
  },
  {
   "who": "unnamed researchers, on the BBC",
   "states": [
    "unnamed"
   ],
   "relays": [
    "bbc"
   ]
  },
  {
   "who": "Imperva",
   "states": [
    "imperva"
   ]
  },
  {
   "who": "Huntress",
   "states": [
    "huntress"
   ]
  },
  {
   "who": "Matthew Prince, Cloudflare",
   "states": [
    "prince"
   ]
  },
  {
   "who": "Dan Lorenc, Chainguard, via The Register",
   "states": [
    "chainguard-lorenc"
   ],
   "relays": [
    "the-register"
   ]
  },
  {
   "who": "watchTowr",
   "states": [
    "watchtowr"
   ]
  }
 ],
 "agencies": {
  "NSA Cybersecurity|US": "nsa",
  "CISA|US": "cisa",
  "NCSC|UK": "ncsc-uk",
  "CERT-EU|EU institutions": "cert-eu",
  "ENISA CSIRTs Network|EU": "enisa-csirts",
  "CERT-FR (ANSSI)|FR": "cert-fr",
  "CCCS|CA": "cccs",
  "ASD's ACSC|AU": "acsc",
  "NCSC|NZ": "ncsc-nz",
  "NCSC-NL|NL": "ncsc-nl",
  "ACN / CSIRT Italia|IT": "acn",
  "BACS (NCSC)|CH": "bacs",
  "CERT.LV|LV": "cert-lv",
  "JPCERT/CC|JP": "jpcert",
  "CCN-CERT|ES": "ccn-cert",
  "CNCS|PT": "cncs"
 },
 "sources": {
  "boursorama-reuters-sites-gouv": {
   "syndicates": "reuters",
   "basis": "the collector's slug; Boursorama carries Reuters copy"
  },
  "eadt-minister-budget-no-breach": {
   "syndicates": "pa-media",
   "basis": "the publisher string: '(PA)'"
  },
  "reuters-factbox-gbaf": {
   "syndicates": "reuters",
   "basis": "a Reuters factbox, on Global Banking and Finance"
  },
  "reuters-factbox-websites-offline": {
   "syndicates": "reuters",
   "basis": "a Reuters factbox, on Global Banking and Finance"
  },
  "rte-reuters-websites-go-dark": {
   "syndicates": "reuters",
   "basis": "the collector's slug; RTÉ carries Reuters copy"
  },
  "tagesspiegel-dpa-noch-offline": {
   "syndicates": "dpa",
   "basis": "the collector's slug; Der Tagesspiegel carries dpa copy"
  },
  "thestar-aseanplus-aseanplus-news-2026-10-22-seri": {
   "syndicates": "dpa",
   "basis": "the page's own address ends 'reports-dpa'"
  },
  "yahoo-jp-gmo-fx-login-leak": {
   "syndicates": "j-cast",
   "basis": "the publisher string and the title: J-CAST News on Yahoo! News Japan"
  },
  "yahoo-mashable-affected-list": {
   "syndicates": "mashable",
   "basis": "the collector's slug; Yahoo carries Mashable's article"
  }
 }
}