{ "schema": "sgit.newsroom.factcheck/1", "desk": "factcheck@php.newsroom", "levels": [ { "code": "A0", "n": 0, "name": "Unsupported", "means": "No capture carries it, or the cited capture does not say it" }, { "code": "A1", "n": 1, "name": "Weak signal", "means": "Second hand, unnamed, blocked, or only partly carried by its capture" }, { "code": "A2", "n": 2, "name": "Reported", "means": "One named party says it, in a capture this desk checked" }, { "code": "A3", "n": 3, "name": "Echoed", "means": "Several outlets say it, tracing to one origin" }, { "code": "A4", "n": 4, "name": "Corroborated", "means": "Two or more independent parties say it, at least one checked in a capture" }, { "code": "A5", "n": 5, "name": "Confirmed", "means": "Two or more independent primary sources say it, each checked in a capture" }, { "code": "A6", "n": 6, "name": "Established", "means": "The authoritative primary record carries it, or this site counted it from a captured file" } ], "kinds": [ "record", "event", "state", "count", "quote", "attribution", "reading", "advice" ], "verdicts": [ "holds", "holds-in-part", "not-shown", "refuted" ], "tensions": [ "none", "measures-differently", "disputed", "contradicted", "superseded" ], "tension_cap": { "contradicted": 1, "disputed": 2 }, "assessments": [ { "id": "ac-high", "claim_hash": "ffa2f16a4ea6eb8c", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111906Z", "status_fit": "overstated", "reason": "The CVSS half is a record (AC:H in the CVE record, A6). The 'much easier' half is Imperva's characterisation, supported by Fastly (single-request trigger; RCE needs binary layout knowledge) and the advisory's reliability caveats; as a reading it caps at A3, so 'confirmed' overstates the claim as a whole.", "checked": [ { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "It’s worth noting that the attack complexity in both vulnerabilities is high", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "Triggering the bug is much easier than turning it into code execution.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "partial", "excerpt": "most deployments may be “safe” from RCE. Do not assume this holds true for you.", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "carries", "excerpt": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "outside_citation": false } ], "quotes_checked": [ { "quote": "most deployments may be safe from RCE. Do not assume this holds true for you.", "found": false, "where": "fastly-blog-php2shell" } ], "tickets": [ "Finding-53", "Finding-56" ], "mode2": "", "display": 3, "stale": false }, { "id": "affected-sites", "claim_hash": "02e44d4ce92fe97e", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080559Z", "status_fit": "ok", "reason": "Every element is carried by the BBC live page, but Edinburgh council, online stores, the BBC itself and the University of Geneva are only in the 07:55Z raw copy (summary bullet and header-image alt text), not in the cited 08:05Z text capture. One named secondary party, so A2; the vault holds independent and operator captures that raise most items (Wikipedia, Edinburgh, French prefectures, UNIGE) but not \"online shops\".", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "Wikipedia also took down parts of its website", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "Government websites are down around the world, including France, due to the exposure", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/raw/page.2026-10-22T0755Z.html", "sha256": "fe32274b64ee109a7e37fc4c26e37e793dc22481a6122888782c393e01102488", "result": "carries", "excerpt": "Among the impacted sites are Wikipedia, Edinburgh council, many online stores and the BBC", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/raw/initial-data.json", "sha256": "ee7445a58187bcd67df827007a8100941993a24dc3e7eea7e8a45f723a9e3305", "result": "carries", "excerpt": "the university of geneva's website shows an error message that says it is down for maintenance.", "outside_citation": false }, { "source": "unige-site", "file": "sources/unige-site/captures/20261022T081909Z/text.txt", "sha256": "4bdf3d6eb3f0d3b621b80a040ea09917da9c7b4a435f5ab1d995009e57ed3e92", "result": "carries", "excerpt": "The requested service is under maintenance for the moment.", "outside_citation": true }, { "source": "fr-prefecture-nord-down", "file": "sources/fr-prefecture-nord-down/captures/20261022T081940Z/text.txt", "sha256": "72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678", "result": "carries", "excerpt": "Maintenance en cours\nNotre site sera à nouveau accessible d'ici quelques instants.", "outside_citation": true }, { "source": "fr-prefecture-rhone-down", "file": "sources/fr-prefecture-rhone-down/captures/20261022T081939Z/text.txt", "sha256": "72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678", "result": "carries", "excerpt": "Maintenance en cours\nNotre site sera à nouveau accessible d'ici quelques instants.", "outside_citation": true }, { "source": "actu17-prefectures", "file": "sources/actu17-prefectures/captures/20261022T081432Z/text.txt", "sha256": "84edb7f59b55a5ce64bf9458671e49987b9e48e0e8388039de616a4c8c1e534d", "result": "carries", "excerpt": "Les sites internet des préfectures, dont celui de la préfecture de police, sont inaccessibles depuis ce mercredi 21 octobre.", "outside_citation": true }, { "source": "uk-edinburgh-council", "file": "sources/uk-edinburgh-council/captures/20261022T081940Z/text.txt", "sha256": "eef60737c49dfded7a4cf9d305998ac3db3278cf7683c33adb852be709ee3b97", "result": "absent", "excerpt": null, "outside_citation": true }, { "source": "wikimediastatus-page", "file": "sources/wikimediastatus-page/captures/20261022T081850Z/text.txt", "sha256": "13e068d2c2b3665d1ad67a02da3752c77bb617ab952507f4cbc16168b0e1a72f", "result": "absent", "excerpt": "All Systems Operational", "outside_citation": true }, { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "partial", "excerpt": "Edinburgh council’s website and pages for BBC programmes, including Doctor Who and The Traitors, also went dark, though neither has confirmed a PHP link.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-6", "Evidence-11", "Evidence-3", "Evidence-4", "Finding-22", "Finding-23", "Finding-57", "Gap-1" ], "mode2": "Capture the BBC page again and the University of Geneva, Wikimedia (Phabricator incident or status history for 21 Oct) and BBC programme pages own statements; an archived snapshot of edinburgh.gov.uk on the evening of 21 Oct would settle the Edinburgh outage directly.", "display": 2, "stale": false }, { "id": "ahead-of-attackers", "claim_hash": "59f673170219e4fa", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T081645Z", "status_fit": "ok", "reason": "OpenAI's post carries the sentence, but with the qualifier 'to our knowledge' that the claim drops. As a reading it rests on one interested party; the only counter-evidence (Amazon's 17 October honeypot hit) reaches the vault second-hand via The Hacker News, and it shows attackers had exploit information before disclosure, not before AI found the bug.", "checked": [ { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "partial", "excerpt": "it remains unclear how the actor acquired exploit information prior to disclosure.", "outside_citation": false } ], "quotes_checked": [ { "quote": "to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare", "found": true, "where": "x-openai-php2shell" } ], "tickets": [ "Finding-58", "Finding-7" ], "mode2": "Capture Amazon's own post (AWS Security Blog or CJ Moses on LinkedIn) on the 17 October MadPot hit.", "display": 2, "stale": false }, { "id": "ai-found", "claim_hash": "c9aaa180db69e506", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T081645Z", "status_fit": "ok", "reason": "That AI was used is said by each research party in its own capture (Calif, Wiz, OpenAI), but 'found by researchers using frontier AI under Patch the Planet' is a reading: Calif is the only finder shown to be under Patch the Planet, Calif never says 'frontier' and stresses generally available models, and Wiz never mentions Patch the Planet. Readings cap at A3.", "checked": [ { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "partial", "excerpt": "OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "The vulnerabilities were found by researchers at the security firms Calif and Wiz.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem", "outside_citation": false } ], "quotes_checked": [ { "quote": "No special harness, or access to models that weren't generally available to everyone were used", "found": true, "where": "calif-php2shell" } ], "tickets": [ "Finding-1", "Finding-59" ], "mode2": "Capture openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ (blocked by Cloudflare) for OpenAI's own naming of the model and of who was under Patch the Planet; ask Wiz whether its work was part of Patch the Planet.", "display": 3, "stale": false }, { "id": "amazon-honeypot", "claim_hash": "f893a4f684799232", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "disputed", "contradictions": [ "K-002" ], "volatile": true, "as_of": "20261022T111755Z", "status_fit": "ok", "reason": "Amazon's own post (now cited first) carries all three parts and the quoted sentence character for character; The Hacker News is an echo of the same Amazon post, not independent, so the level stays A2. Amazon's 'broadly exploited in the wild' is disputed by CISA's dated negative and by Austin and Huntress, partly because they measure different things (attempts versus successful compromise) at different times.", "checked": [ { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "The exploit attempt originated from an IP address associated with a commercial anonymization network.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "multiple proof of concept exploits for the vulnerability, with the earliest around 2026-10-21 0200 UTC.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "carries", "excerpt": "as the flaws come under broad exploitation in the wild following the release of the patches.", "outside_citation": false }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "partial", "excerpt": "The exploits being sprayed indiscriminately either don’t work at all, test for timing-based differences, or crash the target,", "outside_citation": true } ], "quotes_checked": [ { "quote": "PHP2Shell is now being broadly exploited in the wild", "found": true, "where": "aws-security-blog-madpot" }, { "quote": "it's unclear if any of these attempts would have succeeded in real-world systems (capture has a typographic apostrophe: it’s)", "found": true, "where": "aws-security-blog-madpot" } ], "tickets": [ "Contradiction-2", "Finding-122", "Finding-14", "Finding-60" ], "mode2": "An archived early copy of the AWS post (Wayback) to date the 'broadly exploited' sentence; any Amazon count or named victim behind 'broadly exploited'.", "display": 2, "stale": false }, { "id": "cf-millions", "claim_hash": "9ee30cc6607f1e7c", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "measures-differently", "contradictions": [], "volatile": true, "as_of": "20261022T111808Z", "status_fit": "ok", "reason": "Prince's own post carries all four figures and the 01:25 UTC time (UTC browser); the counter and date are known, the population is 'attempts across the Cloudflare network', but the method (what counts as an attempt: rule matches, requests, deduplication) is not stated, so A2 is the ceiling. SecurityWeek, the EADT and Tagesspiegel only repeat it.", "checked": [ { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "carries", "excerpt": "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.", "outside_citation": false }, { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "carries", "excerpt": "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.", "outside_citation": false }, { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "carries", "excerpt": "1:25 · 22 Oct 2026", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "absent", "excerpt": "During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.", "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-61" ], "mode2": "A Cloudflare Radar or blog post giving the counting method (WAF rule matches per request, unique sources) and a time series.", "display": 2, "stale": false }, { "id": "chainguard", "claim_hash": "41312071189761e7", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T113204Z", "status_fit": "ok", "reason": "The act and time (built images with the fix at 07:41 UTC on 21 October) are the Foundation's and Lorenc 'doesn't dispute the timeline' (The Register). 'Unilaterally broke the embargo' is the Foundation's reading; Lorenc says exploits were in the wild and he notified the coordinated disclosure channel first, which contests 'unilaterally'. Feross and The Hacker News restate the Foundation (one origin).", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images", "outside_citation": false }, { "source": "theregister-php-blames-chainguard", "file": "sources/theregister-php-blames-chainguard/captures/20261022T113204Z/text.txt", "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "result": "partial", "excerpt": "late Tuesday night Lorenc told us he decided to ship the fixes, and notified the PHP coordinated disclosure channel about his plans.", "outside_citation": false }, { "source": "x-feross-chainguard", "file": "sources/x-feross-chainguard/captures/20261022T112105Z/text.txt", "sha256": "de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6", "result": "partial", "excerpt": "Dan Lorenc says several vendors in the disclosure had reported exploits in the wild, and that he notified the group right after making the call.", "outside_citation": false }, { "source": "therecord-php-foundation-statement", "file": "sources/therecord-php-foundation-statement/captures/20261022T113158Z/text.txt", "sha256": "28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e", "result": "partial", "excerpt": "Dan Lorenc told Recorded Future News that he began to see exploitation attempts last night and made the judgement call to release the information.", "outside_citation": false } ], "quotes_checked": [ { "quote": "I made the call to get these out early when exploits hit in the wild", "found": false, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Finding-10", "Finding-62" ], "mode2": "Capture Chainguard's image publication record (registry timestamps) and Lorenc's own posts (LinkedIn, Hacker News); ask the PHP distros list for the notification message time.", "display": 2, "stale": false }, { "id": "cisa-none", "claim_hash": "8cb9302544e7fb1f", "run": "Run-1", "mode": "vault", "kind": "state", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081601Z", "status_fit": "ok", "reason": "The CISA alert itself carries the dated negative and the captured KEV JSON (catalogVersion 2026.10.21, 1754 entries, counted by this desk) contains neither CVE; the CVE record's CISA ADP SSVC also says Exploitation none at 14:34Z on 21 Oct. All three are CISA, one party, but each is the authoritative record for what it says.", "checked": [ { "source": "cisa-alert-php-20261021", "file": "sources/cisa-alert-php-20261021/captures/20261022T081353Z/text.txt", "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "result": "carries", "excerpt": "While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.", "outside_citation": false }, { "source": "cisa-kev-json", "file": "sources/cisa-kev-json/raw/known_exploited_vulnerabilities.20261022T0816Z.json", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/raw/cveawg-api.json", "sha256": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "absent", "excerpt": null, "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-2", "Evidence-1", "Evidence-10", "Evidence-6", "Finding-13", "Finding-63" ], "mode2": "A fresh fetch of the KEV JSON (and the CISA alert page, for any update line) on each run; the first KEV entry for either CVE settles it.", "display": 6, "stale": false }, { "id": "cloudflare-traffic", "claim_hash": "c763f6673b8cabe5", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081216Z", "status_fit": "ok", "reason": "Cloudflare's own post carries both halves nearly verbatim; one named party. Echoes (The Hacker News, SentinelOne) trace to the same post.", "checked": [ { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "carries", "excerpt": "Cloudflare has observed attack traffic targeting its customers, with threat actors \"mutating the attack payload to try to bypass our protections", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-64" ], "mode2": "Cloudflare's changelog or a follow-up post with dates and volumes of matched requests.", "display": 2, "stale": false }, { "id": "cvss-10", "claim_hash": "b8db1791ef083882", "run": "Run-1", "mode": "vault", "kind": "record", "level": 0, "verdict": "refuted", "tension": "contradicted", "contradictions": [ "K-007" ], "volatile": false, "as_of": "20261022T081256Z", "status_fit": "ok", "reason": "The CVE records (the authoritative record for the score) give 9.2 under CVSS 4.0 for both flaws, and the PHP Foundation names 10.0 as a wrong score from the leak. The statement is refuted; the site's status 'contradicted' matches.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2).", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "Florian Roth’s post, as Phoenix Security relayed it, said CVSS 10.0, and Cyber Daily reported watchTowr saying the same, while PHP’s own notice says 9.2.", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "carries", "excerpt": "9.2\tCRITICAL\t4.0", "outside_citation": false }, { "source": "cve-cve-2026-109619", "file": "sources/cve-cve-2026-109619/captures/20261022T081219Z/text.txt", "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "result": "carries", "excerpt": "9.2\tCRITICAL\t4.0", "outside_citation": false }, { "source": "thehackernews-php2shell-unpatched-alert", "file": "sources/thehackernews-php2shell-unpatched-alert/captures/20261022T113144Z/text.txt", "sha256": "33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b", "result": "carries", "excerpt": "The CVSS 10.0 figure is the leak's. PHP's rating is 9.2 on version 4.0 of the scale.", "outside_citation": false } ], "quotes_checked": [ { "quote": "a wrong CVSS score of 10.0 (the actual score is 9.2)", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Contradiction-7", "Finding-65" ], "mode2": "", "display": 0, "stale": false }, { "id": "disclosure-22oct", "claim_hash": "c7544df120e19b27", "run": "Run-1", "mode": "vault", "kind": "event", "level": 0, "verdict": "refuted", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T081658Z", "status_fit": "ok", "reason": "The primary records date the disclosure to 21 October UTC: GHSA published 13:34:25Z, tags 13:35:38 UTC, CVE records 13:48:34Z and 13:54:43Z, GitHub release 14:06:46Z, php.net '21 Oct 2026'. '22 October' is only right in Australian or Japanese local time (ACSC: 0100 AEDT on 22 October). The BBC capture never states a disclosure date, so the attribution to the BBC is not carried.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "absent", "excerpt": "Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "carries", "excerpt": "It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "github-php-src-tag-php-8.5.12", "file": "sources/github-php-src-tag-php-8.5.12/captures/20261022T081558Z/rendered.html", "sha256": "330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa", "result": "carries", "excerpt": "datetime=\"2026-10-21T14:06:46Z\"", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/rendered.html", "sha256": "79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110", "result": "carries", "excerpt": "datetime=\"2026-10-21T13:34:25Z\"", "outside_citation": false }, { "source": "github-php-src-tags", "file": "sources/github-php-src-tags/captures/20261022T081558Z/rendered.html", "sha256": "ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9", "result": "carries", "excerpt": "datetime=\"2026-10-21 13:35:38 UTC\"", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/raw/cveawg-api.json", "sha256": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1", "result": "carries", "excerpt": "\"datePublished\":\"2026-10-21T13:48:34.845Z\"", "outside_citation": false }, { "source": "acsc-alert-php", "file": "sources/acsc-alert-php/captures/20261022T081658Z/text.txt", "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "result": "partial", "excerpt": "with full details publicly announced on Thursday 22 October 2026 at 0100 AEDT.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "Apply the Oct 22 security release immediately", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-38", "Finding-66" ], "mode2": "", "display": 0, "stale": false }, { "id": "edinburgh", "claim_hash": "d10da2ddd74f869f", "run": "Run-1", "mode": "vault", "kind": "event", "level": 3, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112150Z", "status_fit": "ok", "reason": "The Scotsman carries the outage, the council's \"essential maintenance\" and that it had not confirmed a link; the Edinburgh Evening News piece is the same reporter and text (one origin, A3), while LBC, Insurance Business, The Cyber Express and the BBC raw copy independently report the outage. \"Late on 21 October\" loosely renders \"late on Wednesday afternoon\".", "checked": [ { "source": "scotsman-edinburgh-council-offline", "file": "sources/scotsman-edinburgh-council-offline/captures/20261022T112150Z/text.txt", "sha256": "fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6", "result": "carries", "excerpt": "A council spokesperson said the website was down for “essential maintenance”, however they are yet to confirm whether it is linked", "outside_citation": false }, { "source": "scotsman-edinburgh-council-offline", "file": "sources/scotsman-edinburgh-council-offline/captures/20261022T112150Z/text.txt", "sha256": "fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6", "result": "carries", "excerpt": "The website went down late on Wednesday afternoon", "outside_citation": false }, { "source": "edinburghnews-council-offline", "file": "sources/edinburghnews-council-offline/captures/20261022T081124Z/text.txt", "sha256": "ec7b1d470016d4f655c747a0bcd2b1f77d65d6b3d9e69ccf0386e948a34178e0", "result": "carries", "excerpt": "A council spokesperson said the website was down for “essential maintenance” however they did not confirm whether it was connected to the recently discovered vulnerabilities.", "outside_citation": true }, { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "partial", "excerpt": "Edinburgh and Oxford Council as well as the online home for The Traitors were taken down as was The Met Police website.", "outside_citation": false }, { "source": "uk-edinburgh-council", "file": "sources/uk-edinburgh-council/captures/20261022T081940Z/text.txt", "sha256": "eef60737c49dfded7a4cf9d305998ac3db3278cf7683c33adb852be709ee3b97", "result": "absent", "excerpt": null, "outside_citation": true } ], "quotes_checked": [ { "quote": "essential maintenance", "found": true, "where": "scotsman-edinburgh-council-offline" }, { "quote": "waiting on an update from our provider", "found": true, "where": "scotsman-edinburgh-council-offline" } ], "tickets": [ "Finding-67" ], "mode2": "A council statement or news release on the outage and restoration, or a web archive snapshot of edinburgh.gov.uk on the evening of 21 Oct.", "display": 3, "stale": false }, { "id": "fi-offline", "claim_hash": "6ac00a5b9c3208da", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113225Z", "status_fit": "ok", "reason": "Helsinki Times carries Valtori restricting incoming public traffic from 12:45 local as a preventive measure; Yle (STT copy) and the Reuters factbox corroborate the precautionary Valtori shutdown but not the 12:45 time. The time rests on one secondary outlet, so A2; status \"reported\" fits.", "checked": [ { "source": "helsinkitimes-finland-shutdown", "file": "sources/helsinkitimes-finland-shutdown/captures/20261022T112845Z/text.txt", "sha256": "524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118", "result": "carries", "excerpt": "Valtori, began restricting incoming public internet traffic at 12.45 pm local time to protect government systems against potential cyberattacks.", "outside_citation": false }, { "source": "helsinkitimes-finland-shutdown", "file": "sources/helsinkitimes-finland-shutdown/captures/20261022T112845Z/text.txt", "sha256": "524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118", "result": "carries", "excerpt": "Valtori stressed that the shutdowns were preventive measures rather than a response to a confirmed cyberattack or data breach.", "outside_citation": false }, { "source": "yle-finland-government-sites-shut", "file": "sources/yle-finland-government-sites-shut/captures/20261022T113225Z/text.txt", "sha256": "720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57", "result": "partial", "excerpt": "Finland's public internet web services were being taken offline on Wednesday as a precautionary move against a critical security vulnerability", "outside_citation": false }, { "source": "yle-finland-government-sites-shut", "file": "sources/yle-finland-government-sites-shut/captures/20261022T113225Z/text.txt", "sha256": "720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57", "result": "partial", "excerpt": "According to Valtori, services began being shut down in the early afternoon.", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "partial", "excerpt": "State IT centre Valtori shut down the government's public web services on Wednesday as \"a precautionary measure.\"", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-68" ], "mode2": "Valtori's own bulletin (valtori.fi) or NCSC-FI (Traficom) statement with the 12:45 time and the restoration time.", "display": 2, "stale": false }, { "id": "fix-authored", "claim_hash": "a9e9b0c99809360d", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112225Z", "status_fit": "ok", "reason": "The git output in the vault carries every time in the claim: author date 2026-10-18T17:26:39+02:00 (15:26:39Z), committer date 2026-10-21T16:06:22+02:00 (14:06:22Z), and Ilija Tovilo's merges 8.2 into 8.3 at 14:12:35Z, 8.3 into 8.4 at 14:27:03Z, 8.4 into 8.5 at 14:30:04Z, plus 389 files, +10689, five authors. 'Entered the public branches at 14:06' reads a committer timestamp as a push time, which git does not record.", "checked": [ { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.stat.txt", "sha256": "0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4b", "result": "carries", "excerpt": "author: Arnaud Le Blanc 2026-10-18T17:26:39+02:00", "outside_citation": false }, { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.stat.txt", "sha256": "0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4b", "result": "carries", "excerpt": "389 files changed, 10689 insertions(+), 976 deletions(-)", "outside_citation": false }, { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/merge-path-3584a98bd-to-PHP-8.5.txt", "sha256": "81c3025511c2f4744d1fcbe1d18fe7da97cfd68b005a6a883efc229a3c91193f", "result": "carries", "excerpt": "c1a5f468d09fc4afc5d738872d5b1d4e87ff1e39 2026-10-21T16:12:35+02:00 2026-10-21T16:12:35+02:00 Ilija Tovilo Merge branch 'PHP-8.2' into PHP-8.3", "outside_citation": false }, { "source": "github-php-src-tag-php-8.5.12", "file": "sources/github-php-src-tag-php-8.5.12/captures/20261022T081558Z/text.txt", "sha256": "3fa0b4ca147ee06698f340ee959bf381aee7c0fda597bd687ff1f128f4978799", "result": "absent", "excerpt": "The PHP development team announces the immediate availability of PHP 8.5.12.", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "Fix PR opened: 2026-09-25, final commit 01a40e89fbfc authored 2026-10-18", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-41", "Finding-69" ], "mode2": "GitHub's push events or the PR merge record for the fix (who merged it and when), to settle when it became public.", "display": 6, "stale": false }, { "id": "fix-bailout", "claim_hash": "d8ff29e16da933a7", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081558Z", "status_fit": "ok", "reason": "GHSA-w8hw's Mitigation section states the mechanism in nearly these words, the php.net ChangeLog carries the exact line for all four releases, and the 7.4 branch commit carries the same title. Primary records carry all of it.", "checked": [ { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "It is replaced with a delayed, graceful soft OOM triggered at the next VM safe point, and an immediate hard OOM using _exit()", "outside_citation": false }, { "source": "php-net-changelog-8", "file": "sources/php-net-changelog-8/captures/20261022T081558Z/text.txt", "sha256": "e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70", "result": "carries", "excerpt": "Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).", "outside_citation": false }, { "source": "github-php-src-branch-7.4-backport", "file": "sources/github-php-src-branch-7.4-backport/captures/20261022T081558Z/text.txt", "sha256": "bd71e98ee89b7c6ca97f0ec6029e0200f86d26f2528387a96c99ac93ea63dc1f", "result": "carries", "excerpt": "Avoid state corruption via bailout", "outside_citation": false } ], "quotes_checked": [ { "quote": "Avoid state corruption via bailout", "found": true, "where": "php-net-changelog-8" } ], "tickets": [ "Finding-70" ], "mode2": "", "display": 6, "stale": false }, { "id": "fix-engine", "claim_hash": "f383e3ffa94b4d29", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081558Z", "status_fit": "ok", "reason": "The fix commit itself (read from a clone, raw patch hashed in the vault) says 'Replace bailout on OOM with UnwindExit' and 'Properly reset various globals that may be accessed during startup', and removes zend_bailout() from the allocator; the two advisories describe the same two mechanisms. The authoritative record carries it.", "checked": [ { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.engine-main-session.patch", "sha256": "26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84", "result": "carries", "excerpt": "- Replace bailout on OOM with UnwindExit\n - Properly reset various globals that may be accessed during startup", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-71" ], "mode2": "", "display": 6, "stale": false }, { "id": "fix-incomplete", "claim_hash": "9202cc09588158e9", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 1, "verdict": "not-shown", "tension": "disputed", "contradictions": [ "K-011" ], "volatile": true, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "The only carrier is a relay on oss-security of unnamed Fediverse posts ('While not yet fully confirmed'), not captured themselves; PHP is reported second-hand to have called it unrelated. Second-hand and unconfirmed is A1, and nothing shows the fix is incomplete; 'unverified' fits.", "checked": [ { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-16.html", "sha256": "6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccf", "result": "partial", "excerpt": "While not yet fully confirmed, the Fediverse is reporting that the fix\nto at least PHP 8.5.12 may be incomplete:", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-17.html", "sha256": "059317aa4a1f458e19196e6add44a6b3106632b82c82f104a5b83d0df6fbe09f", "result": "partial", "excerpt": "ok thinking more about this, there's no way this is the same vuln, this is\n> another one.", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-23.html", "sha256": "39555f34a419becc6a47480eabb369e05f4bac6ce06e9e3843e4dfcb5c99801b", "result": "partial", "excerpt": "was told that it's \"unrelated and not a\nreal issue\".", "outside_citation": false } ], "quotes_checked": [ { "quote": "was told that it's unrelated and not a real issue", "found": false, "where": "openwall-oss-security-109619-thread" } ], "tickets": [ "Contradiction-11", "Evidence-5", "Evidence-7", "Evidence-8", "Finding-125", "Finding-72", "Gap-2" ], "mode2": "Capture fedi.katze.sh/@elise/117479383739450605 and 117478655339557825, and any PHP security team reply on the oss-security thread or a php-src issue/GHSA addressing an 8.5.12 regression or new bug.", "display": 1, "stale": false }, { "id": "four-reporters", "claim_hash": "db33457702f53597", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081256Z", "status_fit": "ok", "reason": "Both captured GitHub advisories list exactly these four handles as 'Reporter' (A6, the record itself). The affiliations in brackets are inferred from handle suffixes and other pages (Calif's '@lcfr_hax', Wiz author Sagi Tzadik, the Foundation's thanks to Amy Burnett of OpenAI Codex Security), not stated by the advisories.", "checked": [ { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Credits\n lcfr-hax\nReporter\n sagitzadik-wiz\nReporter\n tomash-areion\nReporter\n amyb-oai\nReporter", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "Credits\n sagitzadik-wiz\nReporter\n tomash-areion\nReporter\n lcfr-hax\nReporter\n amyb-oai\nReporter", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "Advisory opened: 2026-08-27, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "partial", "excerpt": "Ryan at Calif.io reporter\nWiz reporter\nOpenAI finder", "outside_citation": false }, { "source": "cve-cve-2026-109619", "file": "sources/cve-cve-2026-109619/captures/20261022T081219Z/text.txt", "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "result": "partial", "excerpt": "Wiz reporter\nRyan at Calif.io reporter\nOpenAI reporter", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-73" ], "mode2": "Identify tomash-areion (GitHub profile, Areion) and ask the PHP security team what was reported.", "display": 6, "stale": false }, { "id": "gov-patch-required", "claim_hash": "f77aa3e67f39c15e", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081329Z", "status_fit": "understated", "reason": "NSA's own press release says 'These risks are serious enough to require immediate patching across United States Government departments and agencies.' As a statement of what NSA says, the primary record carries it, so 'reported' understates. It is NSA's statement, not a binding directive; no CISA emergency directive is visible on the CISA home page at 08:13Z.", "checked": [ { "source": "nsa-press-php-4630238", "file": "sources/nsa-press-php-4630238/captures/20261022T080954Z/text.txt", "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "result": "carries", "excerpt": "These risks are serious enough to require immediate patching across United States Government departments and agencies.", "outside_citation": false }, { "source": "cisa-home", "file": "sources/cisa-home/captures/20261022T081329Z/text.txt", "sha256": "ab2aa07bb46ba14c14a2f76a312ff7b81e2c8c19ca3588de9313236b10007a34", "result": "absent", "excerpt": "Critical Vulnerabilities in PHP Require Immediate Patching", "outside_citation": false } ], "quotes_checked": [ { "quote": "require immediate patching across United States Government departments and agencies", "found": true, "where": "nsa-press-php-4630238" } ], "tickets": [ "Finding-74" ], "mode2": "CISA's directives page (cisa.gov/directives) on 21-22 October, to confirm whether an emergency directive was issued.", "display": 6, "stale": false }, { "id": "huntress-none", "claim_hash": "e407ff0ac75d92d7", "run": "Run-1", "mode": "vault", "kind": "state", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": true, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "The first half is carried exactly (4:30pm ET = 20:30 UTC). The second half comes from the pre-release section written before the 21 Oct release ('as of this writing'), not from the 20:30 UTC update, and by then Huntress's own 4:40pm update and other parties report public technical details and PoCs.", "checked": [ { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "carries", "excerpt": "As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "We have not built or reproduced a proof of concept for these vulnerabilities, and we're not aware of public exploit code as of this writing.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "Since PHP released its security advisory this morning to address the two critical vulnerabilities, several researchers have come forward to release the technical details", "outside_citation": false }, { "source": "cccs-al26-026", "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "result": "absent", "excerpt": "a Proof of Concept (PoC) is available, with no active exploitation being identified at this time", "outside_citation": true }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "absent", "excerpt": "WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub.", "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-17" ], "mode2": "A later Huntress update (the post says it will be updated) for the state on 22 October.", "display": 2, "stale": false }, { "id": "imperva-none", "claim_hash": "b05014327a0173e2", "run": "Run-1", "mode": "vault", "kind": "state", "level": 2, "verdict": "holds", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T111855Z", "status_fit": "ok", "reason": "Imperva's own post carries it verbatim, including that it had the details before disclosure; one named party, a negative about its own customer traffic in an undated window.", "checked": [ { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "carries", "excerpt": "The researchers shared vulnerability details confidentially with Imperva ahead of public disclosure, enabling Imperva to verify its protection and begin monitoring customer traffic", "outside_citation": false }, { "source": "x-eastdakota-php2shell-stats", "file": "sources/x-eastdakota-php2shell-stats/captures/20261022T111808Z/text.txt", "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "result": "absent", "excerpt": "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.", "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-75" ], "mode2": "Imperva's post-disclosure update (it says it continues to monitor) with counts.", "display": 2, "stale": false }, { "id": "kev-precedent", "claim_hash": "8ee68af567e4c285", "run": "Run-1", "mode": "vault", "kind": "record", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T112501Z", "status_fit": "overstated", "reason": "The KEV JSON (dateAdded 2024-06-12) and the CVE record (datePublished 2024-06-09T19:42Z) give three days (A6), and the php2shell KEV absence is A6 at 08:16Z on 22 Oct. 'Exploited in the wild one day after' rests on Akamai alone (A2), and it describes honeypot exploit attempts; 'the last PHP core RCE' is not shown (CVE-2024-4577 is a PHP-CGI argument injection on Windows).", "checked": [ { "source": "cisa-kev-json", "file": "sources/cisa-kev-json/raw/known_exploited_vulnerabilities.20261022T0816Z.json", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "cve-cve-2024-4577", "file": "sources/cve-cve-2024-4577/raw/cveawg-api.json", "sha256": "e8cc1b1dcd1a3333776e9a0f08cd4543bc662e0ee60fc094bda0820f84b114eb", "result": "carries", "excerpt": null, "outside_citation": false }, { "source": "akamai-blog-cve-2024-4577-one-day", "file": "sources/akamai-blog-cve-2024-4577-one-day/captures/20261022T112501Z/text.txt", "sha256": "f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567", "result": "carries", "excerpt": "As early as one day after disclosure, the SIRT observed numerous exploit attempts to abuse this vulnerability", "outside_citation": false }, { "source": "akamai-blog-cve-2024-4577-one-day", "file": "sources/akamai-blog-cve-2024-4577-one-day/captures/20261022T112501Z/text.txt", "sha256": "f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567", "result": "partial", "excerpt": "we observed exploit attempts targeting this PHP flaw on our honeypot network within 24 hours of its disclosure.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Evidence-1", "Finding-20", "Finding-21", "Finding-76" ], "mode2": "A later KEV fetch; a source on PHP RCE CVEs between June 2024 and October 2026 to support 'last'.", "display": 2, "stale": false }, { "id": "latvia-attempts", "claim_hash": "8da25937fdad760d", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081354Z", "status_fit": "ok", "reason": "CERT.LV's own page carries the automated attempts; it says there are 'no reports of successful attacks so far' (as of 21 Oct 23:00 local, 20:00Z), which is a dated absence of reports, not 'none succeeded'.", "checked": [ { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "partial", "excerpt": "Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības, taču līdz šim nav ziņu par sekmīgiem uzbrukumiem.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-16" ], "mode2": "A later CERT.LV update (the page says restrictions may last to 26 October) for a newer state.", "display": 2, "stale": false }, { "id": "latvia-offline", "claim_hash": "e78b99e07866d31b", "run": "Run-1", "mode": "vault", "kind": "event", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081354Z", "status_fit": "ok", "reason": "The CERT.LV notice, the national authority's own record, carries every part: a decision to restrict access from abroad to several state digital resources, possibly until Monday 26 October, and at the 23:00 local (EEST, 20:00Z) update lsm.lv and 112.lv restored. The UTC conversion is correct (Latvia on EEST until 25 Oct).", "checked": [ { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "pieņemts lēmums uz laiku ierobežot piekļuvi vairākiem valsts digitālajiem resursiem no ārvalstīm", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "Piekļuves ierobežojumi varētu būt spēkā līdz pirmdienai, 26. oktobrim", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "[Informācija papildināta: 21.10.2026, plkst. 23:00]", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "Šobrīd pieejamība atjaunota arī lsm.lv un 112.lv vietnēm.", "outside_citation": false }, { "source": "lv-latvija-gov", "file": "sources/lv-latvija-gov/captures/20261022T081939Z/provenance.json", "sha256": null, "result": "blocked", "excerpt": null, "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Finding-24", "Finding-25", "Finding-77" ], "mode2": "A newer CERT.LV update (after 21 Oct 23:00 local) saying when the foreign-access restrictions were lifted; a capture of latvija.gov.lv from inside Latvia.", "display": 6, "stale": false }, { "id": "leak-cve-ids", "claim_hash": "0d740468ba0678c3", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-009" ], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "The Foundation states every element. The time and the CVE IDs circulating are corroborated independently (Equixly: Hacker News post 'about 15:20'; Huntress and CybelAngel: 'morning of October 20', which fits 15:00 UTC as US morning). 'No technical details leaked' is disputed: Daubois (PHP security team) describes a leaked tool screenshot and an exploitation video, and The Hacker News says a PoC leaked. The two Foundation slugs are the same page captured twice, not two sources.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media.", "outside_citation": false }, { "source": "phpfoundation-blog-security-release-leak", "file": "sources/phpfoundation-blog-security-release-leak/captures/20261022T081244Z/text.txt", "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "result": "carries", "excerpt": "They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.", "outside_citation": false }, { "source": "equixly-php2shell-what-we-know", "file": "sources/equixly-php2shell-what-we-know/captures/20261022T112832Z/text.txt", "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "result": "partial", "excerpt": "Oct 20, about 15:20\tA Hacker News post announces two upcoming PHP RCE CVEs; the post is later removed", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "On the morning of October 20, a post on Hacker News claimed that two critical PHP vulnerabilities were headed for public disclosure.", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down", "outside_citation": false } ], "quotes_checked": [ { "quote": "No technical details leaked", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Contradiction-9", "Finding-78" ], "mode2": "Capture the archived Hacker News post (the r/PHP thread links news.ycombinator.com/item?id=50176735 as context) and Florian Roth's CVSS 10.0 post.", "display": 2, "stale": false }, { "id": "leak-hn", "claim_hash": "33079c1ab822ee2d", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-009" ], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "The Hacker News post, its removal and the screenshots spreading are carried by Daubois and corroborated by Huntress, CybelAngel and Equixly (A4). 'Anonymous', 'citing a reliable source' and the screenshot 'credited to Calif.IO' are Daubois alone. Daubois says the screenshot 'leaked alongside the advisory', not that it came down; only the video 'went up and came down'.", "checked": [ { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "An anonymous Hacker News post citing a reliable source went up on October 20 and came down, but screenshots of it had already reached", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "The post was taken down, but not before screenshots made their way around social media.", "outside_citation": false }, { "source": "cybelangel-php2shell", "file": "sources/cybelangel-php2shell/captures/20261022T112625Z/text.txt", "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "result": "partial", "excerpt": "The incident started with a leak. On the morning of 20 October, a since-removed Hacker News post claimed the two flaws", "outside_citation": false }, { "source": "equixly-php2shell-what-we-know", "file": "sources/equixly-php2shell-what-we-know/captures/20261022T112832Z/text.txt", "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "result": "partial", "excerpt": "Sansec cites a leaked screenshot of an exploit tool named PHP2Shell, whose banner claims the tool works against PHP 5.4.0 and later.", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "partial", "excerpt": "details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time", "outside_citation": false } ], "quotes_checked": [ { "quote": "PHP2Shell tool", "found": true, "where": "daubois-blog-php2shell-rumors" }, { "quote": "no technical details leaked", "found": true, "where": "php-foundation-blog-security-release" }, { "quote": "a proof-of-concept exploit leaked", "found": false, "where": null } ], "tickets": [ "Contradiction-9", "Finding-79" ], "mode2": "Capture an archive of the Hacker News post and Sansec's research page that shows the leaked tool screenshot.", "display": 2, "stale": false }, { "id": "leak-mitigations", "claim_hash": "ca465bf39f4602af", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080901Z", "status_fit": "ok", "reason": "The Foundation's own sentence carries every element, including its hedge 'may have leaked'. It is one party's self-report; The Register and SecurityWeek repeat it without new evidence.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well.", "outside_citation": false } ], "quotes_checked": [], "tickets": [], "mode2": "Ask the Foundation which providers and what evidence of the leak; look for the mitigation text circulating before release.", "display": 2, "stale": false }, { "id": "leak-video", "claim_hash": "c4eac0ccce9cd74b", "run": "Run-1", "mode": "vault", "kind": "event", "level": 3, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113204Z", "status_fit": "ok", "reason": "The Foundation states it and the quoted phrase is verbatim; BBC, The Register, The Record and Feross echo the Foundation (one origin, A3). Daubois separately mentions a short exploitation video that went up and came down, without naming Calif. The time is uncertain: the Foundation's 'As a result of the leak and pre-announcement around 20:00 UTC' can attach '20:00 UTC' to the pre-announcement, which it puts at 19:30.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published", "outside_citation": false }, { "source": "phpfoundation-blog-security-release-leak", "file": "sources/phpfoundation-blog-security-release-leak/captures/20261022T081244Z/text.txt", "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "result": "carries", "excerpt": "The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "According to PHP, researchers at Calif then \"mistakenly published a video\" showing some basic details of how the flaws could be used", "outside_citation": false }, { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "absent", "excerpt": null, "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "a short exploitation video went up and came down the same way.", "outside_citation": false } ], "quotes_checked": [ { "quote": "contributed to accelerated development of various PoCs", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Contradiction-9", "Finding-80", "Finding-9" ], "mode2": "Ask Calif for the time and content of the deleted video; capture any copy circulated on X.", "display": 3, "stale": false }, { "id": "leak-watchtowr", "claim_hash": "9b69855ffb812921", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "ok", "reason": "Daubois says watchTowr confirmed the bugs and posted both CVE numbers; CybelAngel (via The Repository) independently says watchTowr named both CVEs, and Huntress quotes the same watchTowr line. CERT-EU lists the watchTowr X post as a public report; its ID 2112611507749982605 decodes to 2026-10-20T18:26:48Z, before the 19:30 UTC pre-announcement and the release. The post itself is not captured and watchtowr.com returns 403.", "checked": [ { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "“we were all supposed to wait until Thursday at 11am ET”, confirmed in public that the bugs were real and posted both CVE numbers.", "outside_citation": false }, { "source": "certeu-sa-2026-018", "file": "sources/certeu-sa-2026-018/captures/20261022T081329Z/text.txt", "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "result": "partial", "excerpt": "[3] https://x.com/watchtowrcyber/status/2112611507749982605", "outside_citation": false }, { "source": "cybelangel-php2shell", "file": "sources/cybelangel-php2shell/captures/20261022T112625Z/text.txt", "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "result": "carries", "excerpt": "watchTowr confirms the leaked vulnerabilities are real and names CVE-2026-109618 and CVE-2026-109619", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "Within a few hours, our good friends over at watchTowr confirmed the leak, writing that the vulnerabilities were real", "outside_citation": false } ], "quotes_checked": [ { "quote": "we were all supposed to wait until Thursday at 11am ET", "found": true, "where": "daubois-blog-php2shell-rumors" } ], "tickets": [ "Finding-81" ], "mode2": "Capture x.com/watchtowrcyber/status/2112611507749982605.", "display": 4, "stale": false }, { "id": "lorenc-ai-found", "claim_hash": "9f0097a2a4f9807b", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113204Z", "status_fit": "ok", "reason": "The Register reports, in its own words, that Lorenc said Chainguard learned 'something was coming in PHP' on Friday from one of the researchers and that night independently found the same bugs with its AI harness and a frontier model. One named party, second-hand through one outlet; nobody else checks it.", "checked": [ { "source": "theregister-php-blames-chainguard", "file": "sources/theregister-php-blames-chainguard/captures/20261022T113204Z/text.txt", "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "result": "carries", "excerpt": "Later that night, using his company’s AI harness and a frontier model, the CEO and the Chainguard team independently found the same memory corruption vulnerabilities.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-82" ], "mode2": "Capture Dan Lorenc's LinkedIn post (cited by The Register and ITdaily) for his own words.", "display": 2, "stale": false }, { "id": "more-paths", "claim_hash": "22cfde90943a85b0", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111906Z", "status_fit": "ok", "reason": "Fastly's post says nearly these words; it is one vendor's position (a reading), so A2. The second cited source (the oss-security thread) does not carry it. 'Reported' fits.", "checked": [ { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "carries", "excerpt": "Patching the specific paths that researchers demonstrated does not make the mechanism safe.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "carries", "excerpt": "Expect in-the-wild attacks and novel variants to emerge this week and next at minimum.", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-21-16.html", "sha256": "6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccf", "result": "absent", "excerpt": "While not yet fully confirmed, the Fediverse is reporting that the fix\nto at least PHP 8.5.12 may be incomplete:", "outside_citation": false }, { "source": "github-php-src-fix-commit-3584a98bd", "file": "sources/github-php-src-fix-commit-3584a98bd/raw/commit-3584a98bd.engine-main-session.patch", "sha256": "26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84", "result": "partial", "excerpt": "- Replace bailout on OOM with UnwindExit", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-11", "Evidence-7", "Finding-54", "Finding-55" ], "mode2": "Any later PHP advisory or CVE for a new bailout path after 8.5.12 would bear on this; none is in the vault.", "display": 2, "stale": false }, { "id": "most-severe", "claim_hash": "ee78e8907507801b", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 2, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T113134Z", "status_fit": "ok", "reason": "The BBC attributes to Wiz that the flaws are the 'most severe' ever detected by AI; Wiz's own blog, which the claim cites, says something narrower ('among the most severe vulnerabilities discovered in PHP, and arguably in software history'). A Substack piece relays the WSJ quoting Wiz's co-founder with close wording, so the BBC line probably traces to an interview, not the blog. A reading, held by one party, reported second-hand.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Wiz - one of the companies whose researchers uncovered the vulnerabilities - describes the flaws as the \"most severe\" ever detected by AI.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.", "outside_citation": false }, { "source": "substack-lopezkurtz-patch-is-the-exploit", "file": "sources/substack-lopezkurtz-patch-is-the-exploit/captures/20261022T113134Z/text.txt", "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "result": "partial", "excerpt": "Wiz’s co-founder told the Journal that PHP2Shell is “the most severe AI vulnerability that was ever found.”[40]", "outside_citation": false }, { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "partial", "excerpt": "Wiz called them the “most severe vulnerabilities ever discovered” by AI.", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "we consider this bug to be one of the most impactful vulnerabilities in recent memory.", "outside_citation": false } ], "quotes_checked": [ { "quote": "among the most severe vulnerabilities discovered in PHP, and arguably in software history", "found": true, "where": "wiz-blog-php2shell" }, { "quote": "one of the most impactful vulnerabilities in recent memory", "found": true, "where": "x-openai-php2shell" } ], "tickets": [ "Finding-8", "Finding-83" ], "mode2": "Capture the Wall Street Journal article with the Wiz co-founder quote.", "display": 2, "stale": false }, { "id": "nl-offline", "claim_hash": "f42e1366cc38eb79", "run": "Run-1", "mode": "vault", "kind": "event", "level": 3, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113213Z", "status_fit": "overstated", "reason": "The cited primary (Rijksoverheid, 21 Oct 13:59) carries only NCSC.NL taken offline \"uit voorzorg\" and a general \"no active misuse seen yet\"; it does not name DigiD, MijnOverheid or Overheid.nl, and the second cited source is a blocked Cloudflare page. DigiD and MijnOverheid are carried by TPO and Insurance Business, Overheid.nl only by Reuters copy (one origin), so A3 for the claim as worded, and \"of those services\" is the site's own narrowing.", "checked": [ { "source": "rijksoverheid-ncsc-php-news", "file": "sources/rijksoverheid-ncsc-php-news/captures/20261022T113033Z/text.txt", "sha256": "7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3", "result": "partial", "excerpt": "Vanwege de kwetsbaarheden in PHP is uit voorzorg de website NCSC.NL tijdelijk offline gehaald.", "outside_citation": false }, { "source": "rijksoverheid-ncsc-php-news", "file": "sources/rijksoverheid-ncsc-php-news/captures/20261022T113033Z/text.txt", "sha256": "7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3", "result": "partial", "excerpt": "het Nationaal Cyber Security Centrum (NCSC) heeft nog geen actief misbruik gesignaleerd.", "outside_citation": false }, { "source": "dutchitleaders-websites-offline", "file": "sources/dutchitleaders-websites-offline/captures/20261022T112724Z/text.txt", "sha256": "28f6003be69e3a9719618a62764a55d30d9d28570363ffd8126d1ef0f32a5803", "result": "blocked", "excerpt": "We're verifying you are human. This may take a few seconds.", "outside_citation": false }, { "source": "tpo-nl-digid-offline", "file": "sources/tpo-nl-digid-offline/captures/20261022T113213Z/text.txt", "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "result": "carries", "excerpt": "DigiD, MijnOverheid, de website van de Tweede Kamer en zelfs die van het Nationaal Cyber Security Centrum (NCSC) gingen uit voorzorg offline.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "partial", "excerpt": "The Dutch National Cyber Security Centre took its own site offline as a precaution, as did the following:", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "carries", "excerpt": "They included the Port of Rotterdam, government site Overheid.nl, the national football association KNVB", "outside_citation": false }, { "source": "rte-reuters-websites-go-dark", "file": "sources/rte-reuters-websites-go-dark/captures/20261022T081010Z/text.txt", "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "result": "carries", "excerpt": "including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB", "outside_citation": true }, { "source": "ncsc-nl-site", "file": "sources/ncsc-nl-site/captures/20261022T081919Z/text.txt", "sha256": "4cff0c7ba341429e99659d7404208300de0c4a702c9c28da82b183c71d30bd32", "result": "absent", "excerpt": "Ernstige kwetsbaarheden in PHP: update nu", "outside_citation": true }, { "source": "overheid-nl-site", "file": "sources/overheid-nl-site/captures/20261022T081927Z/text.txt", "sha256": "93278f942198c318881e84d7d62b8bf6f6613b8ed5da0dc5f37bd9f658d11c13", "result": "absent", "excerpt": null, "outside_citation": true } ], "quotes_checked": [ { "quote": "uit voorzorg", "found": true, "where": "rijksoverheid-ncsc-php-news" } ], "tickets": [ "Finding-27", "Finding-28", "Finding-84" ], "mode2": "Logius (DigiD, MijnOverheid) and KOOP (Overheid.nl) own status or news pages for 21 Oct, and an NCSC.NL statement on the return of its site.", "display": 3, "stale": false }, { "id": "no-confirmed-compromise", "claim_hash": "3739c906c344c801", "run": "Run-1", "mode": "vault", "kind": "state", "level": 4, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T112853Z", "status_fit": "overstated", "reason": "A search of every vault capture (manifest and unexported) finds no named organisation confirming a php2shell compromise, and several independent parties say none known (Huntress, Imperva, CERT.LV, the German digital ministry via Reuters, the Australian industry minister). A universal negative from a finite, time-bound capture set cannot exceed A4, and it is volatile; \"confirmed\" without an as-of in the claim text is overstated.", "checked": [ { "source": "cisa-kev-json", "file": "sources/cisa-kev-json/raw/known_exploited_vulnerabilities.20261022T0816Z.json", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "result": "partial", "excerpt": null, "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "carries", "excerpt": "As of October 21 at 4:30pm ET, Huntress has not observed in-the-wild exploitation on partner systems.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "carries", "excerpt": "No indicators of compromise have been confirmed yet.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "partial", "excerpt": "Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "partial", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "outside_citation": false }, { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "partial", "excerpt": "it’s extremely likely that a bunch of old PHP fansites and forums have had their databases compromised", "outside_citation": false }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "taču līdz šim nav ziņu par sekmīgiem uzbrukumiem.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "No successful break-ins had been confirmed as of Wednesday afternoon.", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "carries", "excerpt": "The temporary deactivation was purely preventive and no security incidents were known to have occurred, the spokesperson said.", "outside_citation": false }, { "source": "abc-au-politics-live", "file": "sources/abc-au-politics-live/captures/20261022T081530Z/text.txt", "sha256": "a86331d9b7a21f78af1750d3daf6ebbb696253e1216649e973e34262313040b1", "result": "carries", "excerpt": "Industry and Innovation Minister Tim Ayres says there has been no breach of Australian government websites", "outside_citation": true } ], "quotes_checked": [ { "quote": "broadly exploited", "found": true, "where": "aws-security-blog-madpot" } ], "tickets": [ "Contradiction-2", "Evidence-1", "Evidence-10", "Evidence-3", "Finding-26", "Finding-85" ], "mode2": "Re-fetch the CISA KEV catalog and Huntress/Imperva/Wiz updates after 22 Oct; search breach-notification and regulator pages (ICO, AP NL, CNIL) and Have I Been Pwned for any organisation attributing a breach to CVE-2026-109618/109619.", "display": 4, "stale": false }, { "id": "no-exploitation", "claim_hash": "0d5463a99fc0d8fa", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-002" ], "volatile": true, "as_of": "20261022T080559Z", "status_fit": "ok", "reason": "The BBC (one named outlet, reporting its own Radio 4 interview) carries Austin saying \"Not at the moment\", but the claim's wording is the BBC headline, not his words, and his words are narrower: exploitation has not \"taken off or been widespread\". As a statement of fact it is disputed by Amazon's earlier \"broadly exploited in the wild\" and by NCSC NZ.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "he says: \"Not at the moment... it doesn't look like exploitation has taken off or been widespread.\"", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "No evidence that hackers have exploited flaw so far, says researcher", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "absent", "excerpt": "PHP2Shell is now being broadly exploited in the wild.", "outside_citation": true }, { "source": "ncsc-nz-alert-php", "file": "sources/ncsc-nz-alert-php/captures/20261022T081700Z/text.txt", "sha256": "992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301", "result": "absent", "excerpt": "The NCSC is aware of reports of active exploitation.", "outside_citation": true } ], "quotes_checked": [ { "quote": "Not at the moment", "found": true, "where": "bbc-live-ckgel5xp2xv9t" }, { "quote": "No evidence that hackers have exploited flaw so far (BBC headline, source of the claim's wording)", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Contradiction-2", "Finding-11", "Finding-12" ], "mode2": "Calif's own statement or a transcript/recording of the BBC Radio 4 Today interview at about 09:00 BST, 22 October, to fix the exact words and time.", "display": 2, "stale": false }, { "id": "nz-active", "claim_hash": "6383f951cca69ad9", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "disputed", "contradictions": [], "volatile": true, "as_of": "20261022T081700Z", "status_fit": "ok", "reason": "NCSC NZ's own alert carries the sentence verbatim; one named party, unsourced reports. Other agencies captured at about the same time say the opposite (CCCS: no active exploitation identified; ACSC: not aware of successful active exploitation in Australia; CISA: not observed as of publication).", "checked": [ { "source": "ncsc-nz-alert-php", "file": "sources/ncsc-nz-alert-php/captures/20261022T081700Z/text.txt", "sha256": "992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301", "result": "carries", "excerpt": "The NCSC is aware of reports of active exploitation.", "outside_citation": false }, { "source": "cccs-al26-026", "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "result": "absent", "excerpt": "a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.", "outside_citation": true }, { "source": "acsc-alert-php", "file": "sources/acsc-alert-php/captures/20261022T081658Z/text.txt", "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "result": "absent", "excerpt": "ASD’s ACSC is not aware of successful active exploitation within Australia, related to these vulnerabilities.", "outside_citation": true }, { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "partial", "excerpt": "Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības", "outside_citation": true } ], "quotes_checked": [ { "quote": "The NCSC is aware of reports of active exploitation.", "found": true, "where": "ncsc-nz-alert-php" } ], "tickets": [ "Finding-86" ], "mode2": "An NCSC NZ statement naming whose reports, or an archived copy of the 9:15am NZDT version of the alert.", "display": 2, "stale": false }, { "id": "offline-allies", "claim_hash": "0076f2a71f2ffcef", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 1, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T084815Z", "status_fit": "understated", "reason": "The captured BBC page does not say this: it says the NCSC 'as well as its counterparts in the EU and Australia' urged users 'to apply the fixes', and attributes the offline quote to the NCSC alone. On the substance, NCSC (after mitigations) and NSA advise offline, CERT-EU and CERT-FR advise isolation, and Italy's ACN advises taking sites offline; only Australia is not shown (ACSC's page as captured has no offline advice). 'Contradicted' overstates an absence for one of four parties and mislabels the BBC's statement.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.", "outside_citation": false }, { "source": "acsc-alert-php", "file": "sources/acsc-alert-php/captures/20261022T081658Z/text.txt", "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "result": "absent", "excerpt": "Apply available security updates and other appropriate mitigations", "outside_citation": false }, { "source": "certeu-sa-2026-018", "file": "sources/certeu-sa-2026-018/captures/20261022T081329Z/text.txt", "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "result": "carries", "excerpt": "Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/captures/20261022T084815Z/text.txt", "sha256": "f3eec24a226910fb8440714b4f44c40db5c5f7826f3c23b65aece1cc5775712e", "result": "absent", "excerpt": "If immediate patching is not possible, follow PHP's temporary mitigations, including disabling session.upload_progress, restarting workers,", "outside_citation": false }, { "source": "acn-it-php2shell", "file": "sources/acn-it-php2shell/captures/20261022T081354Z/text.txt", "sha256": "19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6", "result": "carries", "excerpt": "si raccomanda di valutare di porre offline i siti e i servizi web che utilizzano versioni vulnerabili di PHP", "outside_citation": false }, { "source": "jpcert-at260033", "file": "sources/jpcert-at260033/captures/20261022T081700Z/text.txt", "sha256": "1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5", "result": "absent", "excerpt": "十分なテストを実施の上、速やかに修正済みバージョンを適用してください。", "outside_citation": false }, { "source": "ncsc-news-php", "file": "sources/ncsc-news-php/captures/20261022T080903Z/text.txt", "sha256": "a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339", "result": "carries", "excerpt": "or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "nsa-press-php-4630238", "file": "sources/nsa-press-php-4630238/captures/20261022T080954Z/text.txt", "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "result": "carries", "excerpt": "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "carries", "excerpt": "Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-43", "Finding-44", "Finding-45", "Finding-87" ], "mode2": "An archived 21 October version of ACSC's alert (cyber.gov.au/alert/critical-vulnerabilities-in-php) to see whether it ever advised taking systems offline.", "display": 1, "stale": false }, { "id": "offline-cisa", "claim_hash": "5003889605e53374", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081353Z", "status_fit": "ok", "reason": "CISA's alert says organisations that cannot update immediately, or that use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until patched or updated. The party's own record carries it.", "checked": [ { "source": "cisa-alert-php-20261021", "file": "sources/cisa-alert-php-20261021/captures/20261022T081353Z/text.txt", "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "result": "carries", "excerpt": "Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-88" ], "mode2": "", "display": 6, "stale": false }, { "id": "offline-ncsc", "claim_hash": "56d2fa8986fa7e54", "run": "Run-1", "mode": "vault", "kind": "quote", "level": 3, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": true, "as_of": "20261022T112915Z", "status_fit": "ok", "reason": "The NCSC page as captured (last-modified 07:30:02 GMT on 22 Oct) gives the offline advice as step 4 of 6 in other words ('If you are unable to apply the temporary mitigations ...'), so the quote is not verbatim in the party's own capture. The exact sentence is in the BBC, in LBC's article of 21 Oct 15:41 (before the page was modified), and in a CyberExpress copy of the BBC. That is an echo, A3, and points to an earlier NCSC wording.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "\"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,\" the NCSC said in a note", "outside_citation": false }, { "source": "ncsc-news-php", "file": "sources/ncsc-news-php/captures/20261022T080903Z/text.txt", "sha256": "a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339", "result": "partial", "excerpt": "or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "ncsc-news-php", "file": "sources/ncsc-news-php/captures/20261022T080903Z/headers.json", "sha256": "642ad2462903a32f7050dae5e198654e710dadc0a6225333d96370031c7ede4c", "result": "partial", "excerpt": "\"last-modified\": \"Thu, 22 Oct 2026 07:30:02 GMT\"", "outside_citation": false }, { "source": "cccs-al26-026", "file": "sources/cccs-al26-026/captures/20261022T081700Z/text.txt", "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "result": "partial", "excerpt": "Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.", "outside_citation": false }, { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "carries", "excerpt": "The NCSC warned: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”", "outside_citation": false }, { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "carries", "excerpt": "“Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated,” the NCSC said.", "outside_citation": false } ], "quotes_checked": [ { "quote": "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated", "found": true, "where": "lbc-uk-websites-offline" } ], "tickets": [ "Finding-42", "Finding-89" ], "mode2": "A Wayback Machine or archive.today snapshot of https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php from 21 October, or the NCSC press office, would show whether the quoted sentence was on the page before 07:30Z on 22 October.", "display": 2, "stale": false }, { "id": "offline-nsa", "claim_hash": "44eb047f0a7bff36", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080954Z", "status_fit": "ok", "reason": "Both of NSA's own pages carry the advice in nearly the claim's words: the press release ('it is recommended that organizations take the system offline until it can be fully mitigated') and the X post (with the typo 'recommend'). The X post's snowflake decodes to 2026-10-21T13:45:58Z and the capture shows 10.1M views, as the note says.", "checked": [ { "source": "nsa-x-2112903220209098897", "file": "sources/nsa-x-2112903220209098897/captures/20261022T080954Z/text.txt", "sha256": "92ebce791a7b35429d2fee94427932a19b1629de3821a52201648a58298d52e7", "result": "carries", "excerpt": "If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.", "outside_citation": false }, { "source": "nsa-press-php-4630238", "file": "sources/nsa-press-php-4630238/captures/20261022T080954Z/text.txt", "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "result": "carries", "excerpt": "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.", "outside_citation": false } ], "quotes_checked": [], "tickets": [], "mode2": "", "display": 6, "stale": false }, { "id": "only-update", "claim_hash": "4f13f57d964ac543", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081407Z", "status_fit": "ok", "reason": "php.net's advisory carries the claim almost word for word, and both GHSAs and the oss-security post say updating is the only complete/reliable mitigation. The party's own records carry the advice.", "checked": [ { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "carries", "excerpt": "while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-7", "file": "sources/openwall-oss-security-2026-10-21-7/captures/20261022T081407Z/text.txt", "sha256": "ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384", "result": "carries", "excerpt": "Updating is the only reliable mitigation; there is no\ncomplete generic configuration workaround.", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "Updating to a release containing the complete state reset patch is the only reliable mitigation.", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.", "outside_citation": false } ], "quotes_checked": [], "tickets": [], "mode2": "", "display": 6, "stale": false }, { "id": "openai-same-day", "claim_hash": "a1cdae209d126f39", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T112703Z", "status_fit": "ok", "reason": "The Foundation's page says this word for word (one named primary party, the recipient of the reports). The GHSA credits and the CVE records corroborate that OpenAI was a credited reporter or finder but carry no dates. OpenAI's own account is blocked; Cybernews relays OpenAI as saying its researcher 'subsequently' found additional flaws after Calif, and the X Community Note disputes OpenAI's discovery role.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "partial", "excerpt": " amyb-oai\nReporter", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "partial", "excerpt": "OpenAI finder", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "partial", "excerpt": "But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.", "outside_citation": false }, { "source": "cybernews-php2shell-millions", "file": "sources/cybernews-php2shell-millions/captures/20261022T112703Z/text.txt", "sha256": "a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb", "result": "partial", "excerpt": "According to OpenAI, Calif used GPT-5.6 Sol to investigate the flaw. OpenAI’s own researcher subsequently identified additional flaws", "outside_citation": false }, { "source": "openai-blog-coordinated-disclosure", "file": "sources/openai-blog-coordinated-disclosure/captures/20261022T112413Z/text.txt", "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "result": "blocked", "excerpt": null, "outside_citation": false } ], "quotes_checked": [ { "quote": "using GPT-5.6 Sol", "found": false, "where": null } ], "tickets": [ "Finding-3", "Finding-90" ], "mode2": "Capture OpenAI's blog post; ask the PHP security team or OpenAI (Amy Burnett) for the GHSA report timestamps.", "display": 2, "stale": false }, { "id": "oxford", "claim_hash": "90f92983e015ff48", "run": "Run-1", "mode": "vault", "kind": "quote", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112935Z", "status_fit": "ok", "reason": "The quoted words are verbatim in the @OxfordCity post embedded in the East Anglian Daily Times (PA) capture, but not in the cited Oxford Chronicle, which only paraphrases (\"a precautionary response to a worldwide technology problem rather than a cyber incident\"). One capture carries the exact words, so A2.", "checked": [ { "source": "oxfordchronicle-councils-offline", "file": "sources/oxfordchronicle-councils-offline/captures/20261022T112935Z/text.txt", "sha256": "35c847290193f872826f6d65f370bcb6863fafe692817cc449f97431f350ae73", "result": "partial", "excerpt": "In a social-media update, the council explained that the closure was a precautionary response to a worldwide technology problem rather than a cyber incident.", "outside_citation": false }, { "source": "eadt-minister-budget-no-breach", "file": "sources/eadt-minister-budget-no-breach/captures/20261022T112742Z/text.txt", "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "result": "carries", "excerpt": "This is a precaution because of a worldwide issue with the underlying technology and is not a cyber incident.", "outside_citation": false } ], "quotes_checked": [ { "quote": "a precaution because of a worldwide issue with the underlying technology and is not a cyber incident", "found": false, "where": "oxfordchronicle-councils-offline" }, { "quote": "a precaution because of a worldwide issue with the underlying technology and is not a cyber incident", "found": true, "where": "eadt-minister-budget-no-breach" } ], "tickets": [ "Finding-30" ], "mode2": "A capture of the @OxfordCity post itself on X, and of oxford.gov.uk on 21 to 22 Oct.", "display": 2, "stale": false }, { "id": "pocs-wrong", "claim_hash": "00addbc8e33e5aad", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 1, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T112853Z", "status_fit": "overstated", "reason": "rjmendez's README carries both halves, but the VulnCheck half is second-hand (VulnCheck's review is not captured), so A1; the lab half is rjmendez's own (A2). Huntress, the second cited source, does not carry either half. 'Reported' implies one named party checked first-hand, which only the lab half has.", "checked": [ { "source": "github-rjmendez-phpup-2026", "file": "sources/github-rjmendez-phpup-2026/captures/20261022T112003Z/text.txt", "sha256": "84742b6e86fb259d4db36361e86d4b739c6cd09184337f365f5e2958271f5379", "result": "carries", "excerpt": "a clean 200 OK, and VulnCheck independently reports that none of the public PoCs they reviewed have the correct mechanism.", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "absent", "excerpt": "We have not built or reproduced a proof of concept for these vulnerabilities, and we're not aware of public exploit code as of this writing.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "partial", "excerpt": "the existing PoCs require knowledge of the specific, running PHP binary and address space layout on the server", "outside_citation": false }, { "source": "thehackernews-what-protects-you", "file": "sources/thehackernews-what-protects-you/captures/20261022T113151Z/text.txt", "sha256": "2301d254784fd6612f36f844e16a706e2e7ca5f8d8f942f7f36544c59d78d82c", "result": "partial", "excerpt": "the public exploit code going around has not been shown to work", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-52", "Finding-91", "Gap-3" ], "mode2": "Capture VulnCheck's own post or report on the public php2shell PoCs.", "display": 1, "stale": false }, { "id": "preannounce-time", "claim_hash": "8d6f059ee7b693ad", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "Only the PHP Foundation states 19:30 UTC, and the same post later says 'pre-announcement around 20:00 UTC'. The oss-security relay of the php.net text (Date 13:22:51 -0700 = 20:22:51Z) bounds it from above, and the feed's 20:32:00Z is later than that relay, so the feed time cannot be the publication time. One party's self-report, A2; 'disputed' fits.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-20-34", "file": "sources/openwall-oss-security-2026-10-20-34/captures/20261022T081408Z/text.txt", "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "result": "partial", "excerpt": "Date: Tue, 20 Oct 2026 13:22:51 -0700", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/raw/feed.atom", "sha256": "79c12996a433f66b2e2422e32d1dd5d4251c7c24531f75c3a0611f58dc1894a8", "result": "partial", "excerpt": "2026-10-20T20:32:00+00:00", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "absent", "excerpt": null, "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-40", "Finding-92" ], "mode2": "The php/web-php commit that added the 2026-10-20-1 archive entry, or the php-announce list message time.", "display": 2, "stale": false }, { "id": "probing", "claim_hash": "46373ec42044f7f9", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 5, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111755Z", "status_fit": "ok", "reason": "Woodward's remark is carried by the BBC, and both companies independently say it in their own captured posts: Amazon (scanning attempts, honeypot hits) and Cloudflare (attack traffic targeting customers). Two independent primary parties, each checked.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Woodward says companies like Amazon and Cloudflare that monitor what is going on online saw the weakness \"was being probed for\".", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "we observed attack traffic targeting our customers.", "outside_citation": false }, { "source": "aws-security-blog-madpot", "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt", "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "result": "carries", "excerpt": "Our internal threat intelligence system automatically detected and restricted malicious scanning attempts targeting this vulnerability.", "outside_citation": false } ], "quotes_checked": [ { "quote": "was being probed for", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Contradiction-2", "Finding-15", "Finding-93" ], "mode2": "", "display": 5, "stale": false }, { "id": "quarkslab-2024", "claim_hash": "dc72cf03a483f160", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [], "volatile": false, "as_of": "20261022T113008Z", "status_fit": "overstated", "reason": "Calif says Quarkslab's audit 'rediscovered the same OOM issue' and 'exploitation was not proven, hence the bug was not fixed', but Calif says it confirmed this 'from PHP', so it is not independent of the Foundation. The Foundation says something different: a PHP core developer found the OOM signs while fixing a Quarkslab finding, and the fix stalled over trade-offs and resources, not only unproven exploitation. Quarkslab's own summary describes no OOM finding.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem", "outside_citation": false }, { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "carries", "excerpt": "OSTIF and Quarkslab performed an audit of PHP and rediscovered the same OOM issue. However, exploitation was not proven, hence the bug was not fixed.", "outside_citation": false }, { "source": "quarkslab-blog-php-src-audit", "file": "sources/quarkslab-blog-php-src-audit/captures/20261022T113008Z/text.txt", "sha256": "cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321", "result": "absent", "excerpt": "This audit report contains two security issues currently redacted while PHP maintainers are actively working on the fixes.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "Reported by: Calif, Wiz, OpenAI, and Quarkslab.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "partial", "excerpt": "Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two", "outside_citation": false } ], "quotes_checked": [ { "quote": "a structural failure", "found": true, "where": "php-foundation-blog-security-release" } ], "tickets": [ "Finding-5", "Finding-6", "Finding-94" ], "mode2": "Ask Quarkslab or OSTIF whether any of the 27 findings (or redacted HIGH-1/MED-2) is the OOM issue; the full Quarkslab PDF report is linked from its blog and should be captured.", "display": 2, "stale": false }, { "id": "quarkslab-redacted", "claim_hash": "aa843b6073f64ddd", "run": "Run-1", "mode": "vault", "kind": "count", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113134Z", "status_fit": "understated", "reason": "Counted from the captured Quarkslab page: 2 high, 6 medium, 9 low and 10 informative issues (27 rows), with HIGH-1 and MED-2 redacted and the stated reason 'Fixes are complex and in progress.' No row describes an out-of-memory finding. The Substack piece says the same. The Foundation note is carried.", "checked": [ { "source": "quarkslab-blog-php-src-audit", "file": "sources/quarkslab-blog-php-src-audit/captures/20261022T113008Z/text.txt", "sha256": "cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321", "result": "carries", "excerpt": "two security issues currently redacted while PHP maintainers are actively working on the fixes. Details will be provided after fixes are applied", "outside_citation": false }, { "source": "substack-lopezkurtz-patch-is-the-exploit", "file": "sources/substack-lopezkurtz-patch-is-the-exploit/captures/20261022T113134Z/text.txt", "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "result": "carries", "excerpt": "lists 27 findings, two of them redacted because their fixes were “complex and in progress”; it does not describe an out-of-memory finding.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem", "outside_citation": false } ], "quotes_checked": [ { "quote": "complex and in progress", "found": true, "where": "quarkslab-blog-php-src-audit" } ], "tickets": [ "Finding-95" ], "mode2": "Capture the full Quarkslab PDF report and the OSTIF post; ask whether HIGH-1 or MED-2 concerns memory_limit handling.", "display": 6, "stale": false }, { "id": "rce-fpm", "claim_hash": "38e4e700d08c53f8", "run": "Run-1", "mode": "vault", "kind": "state", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [ "K-008" ], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "understated", "reason": "As worded, the claim is carried by the PHP security team's own advisory for CVE-2026-109619 (GHSA-6wmf) and its oss-security post, which say RCE was demonstrated on a normal dynamic FPM pool, given a suitable application operation. What is disputed is which flaw does it: the Foundation's blog puts FPM under CVE-2026-109618, whose own advisory says no complete FPM exploit was shown (K-008). That does not touch this claim, so the site's 'disputed' understates it.", "checked": [ { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "The fatal backtrace path has confirmed RCE against mod_php. Session lifecycle RCE was validated against mod_php and FPM.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-7", "file": "sources/openwall-oss-security-2026-10-21-7/captures/20261022T081407Z/text.txt", "sha256": "ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384", "result": "carries", "excerpt": "Unauthenticated RCE has been demonstrated against Apache mod_php and\nPHP-FPM. Exploitability depends on the affected state, configuration, and\napplication behavior.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "Remote code execution was also confirmed on PHP-FPM through application-level code paths.", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "partial", "excerpt": "Source analysis therefore supports FPM as a susceptible, though no complete FPM exploit has been demonstrated for this SAPI.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-6", "file": "sources/openwall-oss-security-2026-10-21-6/captures/20261022T081408Z/text.txt", "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "result": "partial", "excerpt": "Source analysis also indicates FPM\nsusceptibility, although a complete FPM exploit has not been demonstrated.", "outside_citation": false } ], "quotes_checked": [ { "quote": "no complete FPM exploit has been demonstrated for this SAPI", "found": true, "where": "github-ghsa-w8hw-w9fx-j79w" }, { "quote": "was also confirmed on PHP-FPM through application-level code paths", "found": true, "where": "php-foundation-blog-security-release" }, { "quote": "validated against mod_php and FPM", "found": true, "where": "github-ghsa-6wmf-4rv5-p3rp" } ], "tickets": [ "Contradiction-8", "Finding-48", "Finding-49", "Finding-96" ], "mode2": "A clarification from the PHP security team (oss-security reply or GHSA update) on whether CVE-2026-109618 has a demonstrated FPM exploit, or a correction of the Foundation blog, would settle the CVE attribution.", "display": 6, "stale": false }, { "id": "rce-modphp", "claim_hash": "d8af3294ee3196d8", "run": "Run-1", "mode": "vault", "kind": "state", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "GHSA-w8hw (the advisory record for CVE-2026-109618) says complete RCE was validated over HTTP against mod_php with default PHP input and memory limits, entirely before application code; oss-security and php.net repeat it. All parts carried by the primary record.", "checked": [ { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Complete remote code execution was validated over HTTP against mod_php with default PHP input and memory limits and normal prefork configurations with multiple workers.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-6", "file": "sources/openwall-oss-security-2026-10-21-6/captures/20261022T081408Z/text.txt", "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "result": "carries", "excerpt": "Unauthenticated RCE has been demonstrated over HTTP against Apache mod_php,\nbefore application code executes.", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "partial", "excerpt": "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-8", "Finding-97" ], "mode2": "", "display": 6, "stale": false }, { "id": "release-moved", "claim_hash": "b37f1485c644d1a3", "run": "Run-1", "mode": "vault", "kind": "event", "level": 4, "verdict": "holds", "tension": "measures-differently", "contradictions": [ "K-010" ], "volatile": false, "as_of": "20261022T112853Z", "status_fit": "overstated", "reason": "The new time (21 October 14:00 UTC) is in the php.net pre-announcement relayed to oss-security (record). That the original date was 22 October is carried by the Foundation and indirectly by Wiz's thread and the php.net ChangeLog; that the move was because of the leak, by the Foundation and Daubois. The original hour '14:00 UTC' rests on the Foundation alone (echoed by The Hacker News), while watchTowr (via Daubois, Huntress, CybelAngel) put the embargo at Thursday 11am ET, which is 15:00 UTC.", "checked": [ { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "carries", "excerpt": "It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-20-34", "file": "sources/openwall-oss-security-2026-10-20-34/captures/20261022T081408Z/text.txt", "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "result": "partial", "excerpt": "> It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "Patch: Apply the Oct 22 security release immediately (the only complete remediation).", "outside_citation": false }, { "source": "php-net-changelog-8", "file": "sources/php-net-changelog-8/captures/20261022T081558Z/text.txt", "sha256": "e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70", "result": "partial", "excerpt": "22 Oct 2026", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "partial", "excerpt": "The team scheduled that release for Wednesday, October 21 at 14:00 UTC, a day earlier than the original embargo", "outside_citation": false }, { "source": "cybelangel-php2shell", "file": "sources/cybelangel-php2shell/captures/20261022T112625Z/text.txt", "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "result": "partial", "excerpt": "The disclosure was originally under embargo until Thursday 22 October at 11:00 ET; after the leak, PHP scheduled its release for 21 October", "outside_citation": false }, { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "partial", "excerpt": "Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC", "outside_citation": false } ], "quotes_checked": [ { "quote": "Apply the Oct 22 security release", "found": true, "where": "x-wiz-io-php2shell" } ], "tickets": [ "Contradiction-10", "Finding-98" ], "mode2": "Ask the PHP release managers or the distros list for the original embargo time; capture php/web-php commit history for the pre-announcement and release posts.", "display": 4, "stale": false }, { "id": "release-time", "claim_hash": "8334b0bd75496a85", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-010" ], "volatile": false, "as_of": "20261022T081558Z", "status_fit": "ok", "reason": "21 October is carried by every primary record. 14:00 UTC was the scheduled time (php.net pre-announcement, oss-security relay, CERT-FR, ACSC 0100 AEDT); only Daubois states it after the event ('Published: 2026-10-21, 14:00 UTC'). The artifacts are stamped earlier and later: GHSA 13:34Z, tags 13:35:38 UTC, CVE records 13:48Z and 13:54Z, GitHub release 14:06:46Z; CERT-EU says 13:30 UTC. 'Disputed' fits.", "checked": [ { "source": "openwall-oss-security-2026-10-20-34", "file": "sources/openwall-oss-security-2026-10-20-34/captures/20261022T081408Z/text.txt", "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "result": "partial", "excerpt": "> It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "carries", "excerpt": "Published: 2026-10-21, 14:00 UTC", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "partial", "excerpt": "L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC).", "outside_citation": false }, { "source": "certeu-sa-2026-018", "file": "sources/certeu-sa-2026-018/captures/20261022T081329Z/text.txt", "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "result": "partial", "excerpt": "The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35", "outside_citation": false }, { "source": "github-php-src-tags", "file": "sources/github-php-src-tags/captures/20261022T081558Z/rendered.html", "sha256": "ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9", "result": "partial", "excerpt": "datetime=\"2026-10-21 13:35:38 UTC\"", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/rendered.html", "sha256": "79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110", "result": "partial", "excerpt": "datetime=\"2026-10-21T13:34:25Z\"", "outside_citation": false }, { "source": "github-php-src-tag-php-8.5.12", "file": "sources/github-php-src-tag-php-8.5.12/captures/20261022T081558Z/rendered.html", "sha256": "330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa", "result": "partial", "excerpt": "datetime=\"2026-10-21T14:06:46Z\"", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "partial", "excerpt": "It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-10", "Finding-39", "Finding-99" ], "mode2": "The php/web-php commit history for the 21 October news entries (actual php.net publication time), and the php-announce mailing list post time.", "display": 2, "stale": false }, { "id": "scale-2.6m-hosts", "claim_hash": "b7e087105a530a21", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [ "K-004" ], "volatile": true, "as_of": "20261022T112314Z", "status_fit": "ok", "reason": "Both figures are carried, but only second hand: VulnCheck's 2,608,039 hosts via The Hacker News and SecurityWeek (one origin), and Censys's 2.58 million seen, 1.57 million unpatched via SecurityWeek alone; no scanner's own page or method is captured, so A2. 'Of which' wrongly makes Censys's 1.57 million a subset of VulnCheck's 2.6 million; it is a subset of Censys's own 2.58 million.", "checked": [ { "source": "thehackernews-php2shell-4days", "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt", "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "result": "carries", "excerpt": "VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3.", "outside_citation": false }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "carries", "excerpt": "roughly 1.58 million were reporting identifiable PHP versions, and approximately 1.57 million were not patched, Censys says.", "outside_citation": false }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "carries", "excerpt": "VulnCheck was seeing more than 2.6 million internet-facing hosts running PHP, nearly all of which were vulnerable.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "Palo Alto Networks’ Unit 42 has counted more than 22.6 million internet-facing systems that could be vulnerable.", "outside_citation": false } ], "quotes_checked": [ { "quote": "could be vulnerable", "found": true, "where": "insurancebusiness-uk-councils-met" } ], "tickets": [ "Contradiction-4", "Finding-100", "Finding-34" ], "mode2": "Censys's own post or dashboard for PHP2Shell exposure on 21-22 October; VulnCheck's blog or report giving 2,608,039 and the scan method; Unit 42's threat brief giving 22.6 million.", "display": 2, "stale": false }, { "id": "scale-30m", "claim_hash": "96652e8a49e35646", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080559Z", "status_fit": "ok", "reason": "The BBC capture carries Alan Woodward's words 'something like 30 million websites' (from Radio 4's Today). One named party, relayed by one outlet, with no population, method or counter, so A2; 'reported' fits.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Referencing the \"serious\" scale of it, he says it could affect \"something like 30 million websites\".", "outside_citation": false } ], "quotes_checked": [ { "quote": "something like 30 million websites", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Finding-101" ], "mode2": "The BBC Radio 4 Today programme audio of 22 October (Woodward segment), or Woodward's own post giving the basis for 30 million.", "display": 2, "stale": false }, { "id": "scale-70pc-internet", "claim_hash": "43c3c01390316dd5", "run": "Run-1", "mode": "vault", "kind": "count", "level": 1, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [ "K-001" ], "volatile": true, "as_of": "20261022T081624Z", "status_fit": "ok", "reason": "Wiz's own headline and X post carry '70% of the Internet', but the body of the same post gives the basis as PHP powering '70% of all websites', a share of websites using PHP with no measurement of what is affected. A count with no population, method or counter for 'affected' stays weak; the status 'unverified' fits.", "checked": [ { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "a popular general-purpose scripting language that powers 70% of all websites in the world.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.", "outside_citation": false }, { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "partial", "excerpt": "with cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure.", "outside_citation": false } ], "quotes_checked": [ { "quote": "unable to independently verify that figure", "found": true, "where": "bbc-live-ckgel5xp2xv9t" }, { "quote": "roughly 70% (BBC quoting Wiz)", "found": false, "where": null } ], "tickets": [ "Contradiction-1", "Finding-102", "Finding-124" ], "mode2": "A capture of W3Techs' PHP usage page (https://w3techs.com/technologies/details/pl-php) dated 21 or 22 October, and Wiz's own answer on what 'affected' measures.", "display": 1, "stale": false }, { "id": "scale-70pc-websites", "claim_hash": "8da5ec0df4412c53", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [ "K-001" ], "volatile": true, "as_of": "20261022T112331Z", "status_fit": "ok", "reason": "Cloudflare, OpenAI and Wiz each state roughly 70%, but they restate one survey (Cloudflare links W3Techs; Tenable and Imperva name W3Techs), so this is an echo of one origin, and the survey's method is not captured, which caps a count at A2. The figure W3Techs publishes is a share of websites whose server-side language is known, a qualifier the claim drops.", "checked": [ { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "PHP is used by almost 70% of websites.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/rendered.html", "sha256": "a0d3c37cde7c1721a08b028748a412672817c45958d05cc7fedaede582b5537b", "result": "carries", "excerpt": "PHP is used by almost 70% of websites.", "outside_citation": false }, { "source": "x-openai-php2shell", "file": "sources/x-openai-php2shell/captures/20261022T081645Z/text.txt", "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "result": "carries", "excerpt": "an open-source programming language used to run an estimated 70% of websites.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "carries", "excerpt": "a popular general-purpose scripting language that powers 70% of all websites in the world.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "With PHP used by over 69% of websites whose server-side programming language is known", "outside_citation": false }, { "source": "tenable-php2shell-faq", "file": "sources/tenable-php2shell-faq/captures/20261022T112331Z/text.txt", "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "result": "partial", "excerpt": "According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known.", "outside_citation": false }, { "source": "rte-reuters-websites-go-dark", "file": "sources/rte-reuters-websites-go-dark/captures/20261022T081010Z/text.txt", "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "result": "partial", "excerpt": "PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs", "outside_citation": true }, { "source": "abc-au-gov-sites-exposed", "file": "sources/abc-au-gov-sites-exposed/captures/20261022T081518Z/text.txt", "sha256": "84937c7c5b87e7c94cf87f2aed94f82ebbf2824d6dea9841cd50e39111d2cb48", "result": "partial", "excerpt": "PHP runs about 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs.", "outside_citation": true } ], "quotes_checked": [ { "quote": "an estimated 70%", "found": true, "where": "x-openai-php2shell" } ], "tickets": [ "Contradiction-1", "Finding-103", "Finding-32", "Finding-33" ], "mode2": "Capture W3Techs' PHP page (and its server-side language overview) with its date, to fix the figure, the population and the method.", "display": 2, "stale": false }, { "id": "scale-latvia", "claim_hash": "ef31c05ee9c1d1f7", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": true, "as_of": "20261022T081354Z", "status_fit": "ok", "reason": "CERT.LV's own page (update of 21 Oct, 23:00 local) says about 6,000 potentially affected resources in Latvia, only a few hundred in the state sector. One primary party, no method stated, so A2 for a count; 'reported' fits.", "checked": [ { "source": "certlv-php-preventive", "file": "sources/certlv-php-preventive/captures/20261022T081354Z/text.txt", "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "result": "carries", "excerpt": "Kopumā Latvijā identificēti aptuveni 6000 potenciāli ietekmētu resursu, no kuriem tikai daži simti ir valsts sektorā.", "outside_citation": false } ], "quotes_checked": [ { "quote": "potentially", "found": false, "where": null } ], "tickets": [ "Finding-104" ], "mode2": "CERT.LV's English version of the post, or its method for identifying the 6,000 resources.", "display": 2, "stale": false }, { "id": "scale-ncsc-nl", "claim_hash": "1e071ad93c9cc798", "run": "Run-1", "mode": "vault", "kind": "count", "level": 6, "verdict": "holds-in-part", "tension": "contradicted", "contradictions": [], "volatile": true, "as_of": "20261022T084807Z", "status_fit": "overstated", "reason": "The inventory files at commit cca173c64ec5 are in the vault (tree and git bundle), and counting them gives 675 rows: 206 Vulnerable, 46 Fix, 418 Investigation, 4 Not vuln and 1 row with no status. The 206/46/418 figures hold; the total 674 and '3 not vulnerable' are contradicted by the file itself, because the vault's parsed JSON dropped the iBabs row. 'Confirmed' overstates a count the file contradicts.", "checked": [ { "source": "ncsc-nl-php2shell-software-list", "file": "sources/ncsc-nl-php2shell-software-list/captures/20261022T084807Z/text.txt", "sha256": "83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004", "result": "absent", "excerpt": "List of software with PHP dependency potentially affected by php2shell CVEs", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/software-list-cca173c64ec5.json", "sha256": "f0a17e96a336a8782231290acf4ba4a4f4fa469270c59a7c87a95da2207dad01", "result": "partial", "excerpt": "\"count\": 674,", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/tree-cca173c64ec5/software/software_list_i.md", "sha256": "f25e5ef68d476c053abd638b75441aa462fd630a83d7059696ff675f53fa55eb", "result": "carries", "excerpt": "|iBabs|iBabs bestuursportaal||Not vuln|Not vuln|PHP is not being used in iBabs.", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/tree-cca173c64ec5/software/README.md", "sha256": "f6516626233529762ddd0561b30cbe3d9ffb3f73802c23171bd5c48470550432", "result": "carries", "excerpt": "Product entries should still be treated as investigation leads until they are backed by an upstream or vendor source", "outside_citation": false }, { "source": "ncsc-nl-php2shell", "file": "sources/ncsc-nl-php2shell/raw/php2shell-cca173c64ec5.bundle", "sha256": "4a72bcc9bbc58e886df6eee7cc875bd5deab547f1028f7525a7e7e808859411f", "result": "carries", "excerpt": null, "outside_citation": false } ], "quotes_checked": [ { "quote": "investigation leads", "found": true, "where": "ncsc-nl-php2shell" } ], "tickets": [ "Finding-105", "Finding-120", "Finding-35", "Finding-36", "Finding-37" ], "mode2": "", "display": 1, "stale": false }, { "id": "two-cves-9.2", "claim_hash": "7add37d4ad60f30a", "run": "Run-1", "mode": "vault", "kind": "record", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081408Z", "status_fit": "ok", "reason": "Both CVE records (CNA PHP Group) carry CVSS 4.0 9.2 CRITICAL and the four fixed-in versions; the two GHSAs, both oss-security announcements and php.net agree. The authoritative record carries every number, so A6.", "checked": [ { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "carries", "excerpt": "9.2\tCRITICAL\t4.0\tCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "outside_citation": false }, { "source": "cve-cve-2026-109619", "file": "sources/cve-cve-2026-109619/captures/20261022T081219Z/text.txt", "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "result": "carries", "excerpt": "affectedfrom 8.5.*before 8.5.12", "outside_citation": false }, { "source": "github-ghsa-w8hw-w9fx-j79w", "file": "sources/github-ghsa-w8hw-w9fx-j79w/captures/20261022T080901Z/text.txt", "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "result": "carries", "excerpt": "Patched versions\n8.2.35\n8.3.36\n8.4.27\n8.5.12", "outside_citation": false }, { "source": "github-ghsa-6wmf-4rv5-p3rp", "file": "sources/github-ghsa-6wmf-4rv5-p3rp/captures/20261022T080901Z/text.txt", "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "result": "carries", "excerpt": "Critical\n9.2\n/ 10\nCVSS v4 base metrics", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "carries", "excerpt": "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.", "outside_citation": false }, { "source": "openwall-oss-security-2026-10-21-6", "file": "sources/openwall-oss-security-2026-10-21-6/captures/20261022T081408Z/text.txt", "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "result": "carries", "excerpt": "Severity: Critical (CVSS v4.0: 9.2)", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-3", "Contradiction-7", "Evidence-10", "Evidence-6" ], "mode2": "", "display": 6, "stale": false }, { "id": "uk-list", "claim_hash": "dd7e07b64a5edc16", "run": "Run-1", "mode": "vault", "kind": "event", "level": 3, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112915Z", "status_fit": "ok", "reason": "LBC and Insurance Business carry Edinburgh and Oxford councils and the Met Police unavailable and errors on Bristol, Lambeth and Barnet, in near-identical wording that points to one origin (A3). Neither cited source mentions the Office for Budget Responsibility; only the uncited EADT (PA) says the OBR \"had to take down its website\".", "checked": [ { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "carries", "excerpt": "Edinburgh and Oxford Council as well as the online home for The Traitors were taken down as was The Met Police website.", "outside_citation": false }, { "source": "lbc-uk-websites-offline", "file": "sources/lbc-uk-websites-offline/captures/20261022T112915Z/text.txt", "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "result": "carries", "excerpt": "Error messages were displayed on the Bristol, Lambeth and Barnet council websites.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "In the UK, the sites reported unavailable included those of Edinburgh and Oxford councils and the Met Police.", "outside_citation": false }, { "source": "insurancebusiness-uk-councils-met", "file": "sources/insurancebusiness-uk-councils-met/captures/20261022T112225Z/text.txt", "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "result": "carries", "excerpt": "Error messages also appeared on the Bristol, Lambeth and Barnet council websites.", "outside_citation": false }, { "source": "eadt-minister-budget-no-breach", "file": "sources/eadt-minister-budget-no-breach/captures/20261022T112742Z/text.txt", "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "result": "carries", "excerpt": "because the Office for Budget Responsibility (OBR) had to take down its website.", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Contradiction-5", "Evidence-2", "Finding-106", "Finding-31" ], "mode2": "The OBR's and the Met Police's own statements, and captures of bristol.gov.uk, lambeth.gov.uk and barnet.gov.uk during 21 Oct.", "display": 3, "stale": false }, { "id": "versions-old", "claim_hash": "f0333afe41e4bf1c", "run": "Run-1", "mode": "vault", "kind": "state", "level": 3, "verdict": "holds-in-part", "tension": "disputed", "contradictions": [ "K-003" ], "volatile": true, "as_of": "20261022T081624Z", "status_fit": "ok", "reason": "Wiz (a finder) says '>= 5.4'; PHP's own source backports for 7.4, 8.0 and 8.1 imply those are affected; only NCSC-NL and CERT-FR say all of 5.x, and both pre-release texts look like echoes of the leak (CERT-FR lists a 6.x that never shipped). The CVE records list only 8.2 to 8.5 with default unaffected. So 7.4+ is well supported, 5.4+ rests on Wiz, and 5.0 to 5.3 is not shown; disputed caps display at A2.", "checked": [ { "source": "ncsc-nl-advisories", "file": "sources/ncsc-nl-advisories/captures/20261022T081605Z/text.txt", "sha256": "b7e4ac6caf7d177d8b7e55fa8c587da75a1e78fafc951012d2d2595a6dfa5e8b", "result": "carries", "excerpt": "Alle versies vanaf versie 5 zijn in ieder geval kwetsbaar.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "All php versions >= 5.4 are affected by at least 1 of these vulnerabilities.", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "carries", "excerpt": "PHP toutes versions 5.x\nPHP toutes versions 6.x\nPHP toutes versions 7.x", "outside_citation": false }, { "source": "openwall-oss-security-109619-thread", "file": "sources/openwall-oss-security-109619-thread/raw/oss-security-2026-10-22-2.html", "sha256": "bbc0f0fc06953b13308925334e39e7808796e46ea9505630917762502996bea2", "result": "partial", "excerpt": "which implies that at \nleast versions down to 7.4 are affected as well", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "absent", "excerpt": "Default Status: unaffected", "outside_citation": false }, { "source": "php-net-advisory", "file": "sources/php-net-advisory/captures/20261022T080901Z/text.txt", "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "result": "partial", "excerpt": "the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1", "outside_citation": false }, { "source": "daubois-blog-php2shell-rumors", "file": "sources/daubois-blog-php2shell-rumors/captures/20261022T081256Z/text.txt", "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "result": "partial", "excerpt": "the same jump sits in the PHP-5.3 allocator. I have not seen an exploit shown on those old versions either.", "outside_citation": false }, { "source": "thehackernews-php2shell-unpatched-alert", "file": "sources/thehackernews-php2shell-unpatched-alert/captures/20261022T113144Z/text.txt", "sha256": "33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b", "result": "partial", "excerpt": "a post on HN said two PHP remote code execution flaws, rated CVSS 10.0 and affecting versions from PHP 5 onward", "outside_citation": false } ], "quotes_checked": [ { "quote": ">= 5.4", "found": true, "where": "x-wiz-io-php2shell" }, { "quote": "unaffected", "found": true, "where": "cve-cve-2026-109618" } ], "tickets": [ "Contradiction-3", "Evidence-9", "Finding-107", "Finding-50" ], "mode2": "A PHP security team statement or GHSA update on whether PHP 5.x and 7.0 to 7.3 are affected (or a CVE record update adding 7.4 to 8.1), and Wiz's technical basis for 5.4.", "display": 3, "stale": false }, { "id": "vibe-code", "claim_hash": "49983c1bd156e3ef", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 1, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T080854Z", "status_fit": "ok", "reason": "The BBC carries it only as 'Researchers say', unnamed and second hand (A1). The nearest named source in the vault, watchTowr's Jake Knott via The Record, says it sees in-the-wild exploitation with proof-of-concept tools 'vibecoded with the help of AI'; that does not show who coded them.", "checked": [ { "source": "bbc-live-ckgel5xp2xv9t", "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt", "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "result": "carries", "excerpt": "Researchers say the criminals themselves are using AI to 'vibe code' a method of attack.", "outside_citation": false }, { "source": "therecord-php-warnings", "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "result": "partial", "excerpt": "observing in-the-wild exploitation of the vulnerabilities with a variety of proof-of-concept tools vibecoded with the help of AI.", "outside_citation": true } ], "quotes_checked": [ { "quote": "vibe code", "found": true, "where": "bbc-live-ckgel5xp2xv9t" } ], "tickets": [ "Finding-108" ], "mode2": "watchTowr's own intelligence post (blocked to the capture tool) or Knott's statement on the record.", "display": 1, "stale": false }, { "id": "waf", "claim_hash": "16a9665e0399137c", "run": "Run-1", "mode": "vault", "kind": "advice", "level": 6, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081700Z", "status_fit": "understated", "reason": "CISA's alert carries the sentence nearly verbatim, so the advice is established as CISA's. BACS ('alone is not sufficient') and Cloudflare (attackers mutating payloads) qualify it but do not contradict 'some protection'; CERT-FR also recommends WAF-level blocking. 'Disputed' overstates the disagreement.", "checked": [ { "source": "cisa-alert-php-20261021", "file": "sources/cisa-alert-php-20261021/captures/20261022T081353Z/text.txt", "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "result": "carries", "excerpt": "A web application firewall may provide some protection until systems are updated or patched.", "outside_citation": false }, { "source": "ch-bacs-warnung-php", "file": "sources/ch-bacs-warnung-php/captures/20261022T081700Z/text.txt", "sha256": "99886a19aead8abe4faab9f41918c8654a2e070c816f856c0dd3e14a194d6890", "result": "partial", "excerpt": "They do not provide complete protection and are no substitute for security updates. Even a web application firewall alone is not sufficient.", "outside_citation": false }, { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "partial", "excerpt": "We observed how attackers were mutating the attack payload to try to bypass our protections", "outside_citation": false }, { "source": "certfr-2026-ale-014", "file": "sources/certfr-2026-ale-014/captures/20261022T081353Z/text.txt", "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "result": "partial", "excerpt": "Ces mesures peuvent être réalisées au niveau d'un pare-feu applicatif (Web Application Firewall).", "outside_citation": false } ], "quotes_checked": [ { "quote": "Even a web application firewall alone is not sufficient.", "found": true, "where": "ch-bacs-warnung-php" } ], "tickets": [ "Finding-109", "Finding-51" ], "mode2": "", "display": 6, "stale": false }, { "id": "waf-nine-hours", "claim_hash": "47bf85da500a9265", "run": "Run-1", "mode": "vault", "kind": "event", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T112525Z", "status_fit": "overstated", "reason": "Only Cloudflare gives a pre-disclosure go-live time (03:02 UTC on 21 Oct, its own account). Imperva says it verified protection and monitored before the announcement but gives no time; Akamai and Fastly give only a 21 October post date; Fortinet's article is dated 22 October 07:55, after disclosure, so 'went live hours before disclosure' does not cover it. Each date is the vendor's own word, A2; 'confirmed' overstates.", "checked": [ { "source": "cloudflare-blog-php2shell-waf", "file": "sources/cloudflare-blog-php2shell-waf/captures/20261022T081216Z/text.txt", "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "result": "carries", "excerpt": "Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell.", "outside_citation": false }, { "source": "imperva-blog-php2shell", "file": "sources/imperva-blog-php2shell/captures/20261022T111855Z/text.txt", "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "result": "partial", "excerpt": "enabling Imperva to verify its protection and begin monitoring customer traffic before the announcement.", "outside_citation": false }, { "source": "akamai-blog-php-core-rce", "file": "sources/akamai-blog-php-core-rce/captures/20261022T112525Z/text.txt", "sha256": "2a001600cd450bc582ed42e8355951626ef8ae60e5c4afe233629dbeeaacba5b", "result": "partial", "excerpt": "Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts.", "outside_citation": false }, { "source": "fastly-blog-php2shell", "file": "sources/fastly-blog-php2shell/captures/20261022T111906Z/text.txt", "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "result": "partial", "excerpt": "To mitigate risk for your applications protected by NGWAF, Fastly customers may enable the signal covering both CVE-2026-109618 & CVE-2026-109619.", "outside_citation": false }, { "source": "fortinet-fortiweb-php2shell", "file": "sources/fortinet-fortiweb-php2shell/captures/20261022T112039Z/text.txt", "sha256": "66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4", "result": "partial", "excerpt": "10/22/2026 | 07:55 AM", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-110", "Finding-46", "Finding-47" ], "mode2": "Akamai's and Fastly's rule changelogs (rule 3000991 release time; Fastly NGWAF templated rule release), Imperva's release notes, and FortiGuard's database 0.00438 release time.", "display": 2, "stale": false }, { "id": "watchtowr-itw", "claim_hash": "ce7243b7fb249b85", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 4, "verdict": "holds-in-part", "tension": "superseded", "contradictions": [ "K-002" ], "volatile": true, "as_of": "20261022T113111Z", "status_fit": "understated", "reason": "Both cited watchTowr captures are HTTP 403 (A1 as cited), but four independent outlets in the vault quote watchTowr's Jake Knott directly saying it sees in-the-wild exploitation attempts against its sensors, so the first half is A4. 'Lists the flaws as exploited in the wild' is not carried by any capture; Equixly (written before the PHP advisory) says watchTowr 'lists no reported exploitation', an earlier state since overtaken.", "checked": [ { "source": "watchtowr-php2shell", "file": "sources/watchtowr-php2shell/captures/20261022T111839Z/text.txt", "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "result": "blocked", "excerpt": "Access to watchtowr.com was denied", "outside_citation": false }, { "source": "watchtowr-php2shell-faq", "file": "sources/watchtowr-php2shell-faq/captures/20261022T111847Z/text.txt", "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "result": "blocked", "excerpt": "Access to watchtowr.com was denied", "outside_citation": false }, { "source": "securityweek-first-attempts-sensors", "file": "sources/securityweek-first-attempts-sensors/captures/20261022T112324Z/text.txt", "sha256": "b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41", "result": "carries", "excerpt": "it has seen the first in-the-wild exploitation attempts hitting its sensors around the same time the patches landed, but has not observed successful attempts.", "outside_citation": true }, { "source": "securityweek-exploitation-days-before", "file": "sources/securityweek-exploitation-days-before/captures/20261022T112314Z/text.txt", "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "result": "carries", "excerpt": "WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub.", "outside_citation": true }, { "source": "darkreading-php2shell-red-alert", "file": "sources/darkreading-php2shell-red-alert/captures/20261022T112357Z/text.txt", "sha256": "6db30e279f5f38773c58ae71e0d753d7a7f90fcf4148ea65658c2f967de7f32d", "result": "carries", "excerpt": "WatchTowr reported it has observed exploitation attempts of both flaws in the wild.", "outside_citation": true }, { "source": "therecord-php-warnings", "file": "sources/therecord-php-warnings/captures/20261022T080854Z/text.txt", "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "result": "carries", "excerpt": "the cybersecurity company is also observing in-the-wild exploitation of the vulnerabilities", "outside_citation": true }, { "source": "tenable-php2shell-faq", "file": "sources/tenable-php2shell-faq/captures/20261022T112331Z/text.txt", "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "result": "carries", "excerpt": "watchTowr says it has reproduced both vulnerabilities and is observing exploitation attempts against both.", "outside_citation": true }, { "source": "equixly-php2shell-what-we-know", "file": "sources/equixly-php2shell-what-we-know/captures/20261022T112832Z/text.txt", "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "result": "absent", "excerpt": "watchTowr lists no reported exploitation, and neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog.", "outside_citation": true }, { "source": "securityweek-mass-exploitation-looms", "file": "sources/securityweek-mass-exploitation-looms/captures/20261022T113111Z/text.txt", "sha256": "693aa4300139d2afc431484c18fe038f9b0b2fb411a89b5defbdad622958e851", "result": "absent", "excerpt": "WatchTowr and Huntress say they have not seen either of the vulnerabilities being exploited in the wild.", "outside_citation": true } ], "quotes_checked": [], "tickets": [ "Contradiction-2", "Finding-111", "Finding-18", "Finding-19" ], "mode2": "watchTowr's intelligence pages captured from a non-blocked client (or archive.org), to settle the 'lists as exploited' wording and its date.", "display": 4, "stale": false }, { "id": "weirdgloop-13h", "claim_hash": "1c331f2873fcbfac", "run": "Run-1", "mode": "vault", "kind": "count", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T111827Z", "status_fit": "overstated", "reason": "The operator's own blog carries both parts verbatim: webservers off for all wikis, a 13-hour downtime, and about 94% of wiki pageviews served correctly. The 13-hour outage is the operator's own record of its own action, but the 94% is a self-reported figure with no stated method, which the model caps at A2, so \"confirmed\" overstates it.", "checked": [ { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "carries", "excerpt": "we turned off the webservers for all of the wikis hosted by Weird Gloop, until a patch was released 2 hours ago.", "outside_citation": false }, { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "carries", "excerpt": "This 13-hour downtime was the longest outage we’ve ever had.", "outside_citation": false }, { "source": "weirdgloop-blog-php2shell", "file": "sources/weirdgloop-blog-php2shell/captures/20261022T111827Z/text.txt", "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "result": "carries", "excerpt": "we were able to keep about 94% of wiki pageviews serving correctly, even with no database or PHP running.", "outside_citation": false } ], "quotes_checked": [ { "quote": "the longest outage we've ever had", "found": true, "where": "weirdgloop-blog-php2shell" } ], "tickets": [ "Finding-112" ], "mode2": "Weird Gloop's Cloudflare analytics or a follow-up post giving the start and end times and the measurement behind 94%.", "display": 2, "stale": false }, { "id": "who-first", "claim_hash": "3e517597ecfb2aef", "run": "Run-1", "mode": "vault", "kind": "reading", "level": 3, "verdict": "holds-in-part", "tension": "measures-differently", "contradictions": [], "volatile": false, "as_of": "20261022T081603Z", "status_fit": "overstated", "reason": "The dates under it are well carried: the hash tweet date is on X and the snowflake ID 2085031675382071483 decodes to 2026-08-05T15:54:24Z (A6); the 11 August report is in both Calif's and the Foundation's pages (A5); the 1 August discovery date is Calif's own word only (A2). 'Found the flaws first' is a reading (max A3): the Foundation says the OOM root cause was found in 2024, OpenAI reported the same root cause the same day, and nothing shows Calif found the second CVE first.", "checked": [ { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "carries", "excerpt": "Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.", "outside_citation": false }, { "source": "x-lcfr-hax-hash-tweet", "file": "sources/x-lcfr-hax-hash-tweet/captures/20261022T081603Z/text.txt", "sha256": "2c10f3991caf3a74b21df9d9e0362fd1bab8aefc5113877a412dac999ca36372", "result": "carries", "excerpt": "d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac\n15:54 · 5 Aug 2026", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem", "outside_citation": false }, { "source": "cve-cve-2026-109618", "file": "sources/cve-cve-2026-109618/captures/20261022T081218Z/text.txt", "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "result": "partial", "excerpt": "Ryan at Calif.io reporter\nWiz reporter\nOpenAI finder", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-113", "Finding-2" ], "mode2": "Ask Calif (Ryan Austin) for the pre-image of d935be02...24ac; ask OpenAI (Amy Burnett, Codex Security) for its own discovery date.", "display": 3, "stale": false }, { "id": "wikimedia-precaution", "claim_hash": "f90170e1f00e47de", "run": "Run-1", "mode": "vault", "kind": "quote", "level": 4, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T113026Z", "status_fit": "ok", "reason": "The quoted words are verbatim in The Cyber Express and, outside this claim's citations, in Newsweek (emailed statement to Newsweek) and the Reuters factbox, which each received the Foundation's statement; CNN independently carries \"precautionary measure\". Several independent outlets but no Wikimedia-published page, so A4; \"reported\" fits.", "checked": [ { "source": "cyberexpress-php2shell-gov-sites", "file": "sources/cyberexpress-php2shell-gov-sites/captures/20261022T112646Z/text.txt", "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "result": "carries", "excerpt": "“We have taken down a number of other systems as a precautionary measure until they can be safely patched,” the Wikimedia Foundation said", "outside_citation": false }, { "source": "cnn-php2shell-websites-shut", "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt", "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "result": "partial", "excerpt": "and that a number of its systems had been taken down as a “precautionary measure.”", "outside_citation": false }, { "source": "newsweek-php2shell-websites", "file": "sources/newsweek-php2shell-websites/captures/20261022T112237Z/text.txt", "sha256": "323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294", "result": "carries", "excerpt": "We have taken down a number of other systems as a precautionary measure until they can be safely patched.", "outside_citation": false }, { "source": "reuters-factbox-websites-offline", "file": "sources/reuters-factbox-websites-offline/captures/20261022T113026Z/text.txt", "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "result": "carries", "excerpt": "\"We have taken down a number of other systems as a precautionary measure until they can be safely patched,\" the foundation added.", "outside_citation": false }, { "source": "insiderpaper-archive-wikipedia", "file": "sources/insiderpaper-archive-wikipedia/captures/20261022T081314Z/text.txt", "sha256": "dba4741ae1b287deea2eafb352e4943ec73bc0fc0e568707b6083cdf1baade63", "result": "partial", "excerpt": "It said several systems had been taken offline as a precaution while security patches were being applied.", "outside_citation": true }, { "source": "wikimediastatus-page", "file": "sources/wikimediastatus-page/captures/20261022T081850Z/text.txt", "sha256": "13e068d2c2b3665d1ad67a02da3752c77bb617ab952507f4cbc16168b0e1a72f", "result": "absent", "excerpt": "All Systems Operational", "outside_citation": true } ], "quotes_checked": [ { "quote": "as a precautionary measure until they can be safely patched", "found": true, "where": "cyberexpress-php2shell-gov-sites" }, { "quote": "as a precautionary measure until they can be safely patched", "found": false, "where": "cnn-php2shell-websites-shut" } ], "tickets": [ "Finding-114", "Finding-29" ], "mode2": "A capture of the Foundation's own statement (diff.wikimedia.org, Phabricator task or the wikimediastatus.net incident history for 21 Oct).", "display": 4, "stale": false }, { "id": "wiz-independent", "claim_hash": "c7c4dd7d6ac3447b", "run": "Run-1", "mode": "vault", "kind": "attribution", "level": 2, "verdict": "holds-in-part", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081624Z", "status_fit": "ok", "reason": "Wiz's timeline carries 'discovers the first PHP vulnerability' on 19 August and the report on 24 August, and the Foundation independently confirms a Wiz report on 24 August. 'Independently' is not in any captured primary: Wiz itself says it worked with Calif and OpenAI 'on discovery', and the Foundation frames Wiz's report as 'further attack vectors'. 'The first flaw' means Wiz's first finding, not the first flaw overall.", "checked": [ { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.", "outside_citation": false }, { "source": "php-foundation-blog-security-release", "file": "sources/php-foundation-blog-security-release/captures/20261022T080901Z/text.txt", "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "result": "partial", "excerpt": "followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th.", "outside_citation": false }, { "source": "x-wiz-io-php2shell", "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt", "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "result": "partial", "excerpt": "BREAKING: @wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.", "outside_citation": false } ], "quotes_checked": [ { "quote": "Wiz Research uncovers", "found": false, "where": null } ], "tickets": [ "Finding-115", "Finding-4" ], "mode2": "Ask Wiz whether it knew of Calif's or OpenAI's reports before 19 August; capture OpenAI's blog (says 'independently', per snippet).", "display": 2, "stale": false }, { "id": "wordpress-drupal", "claim_hash": "9c68de69deab7a08", "run": "Run-1", "mode": "vault", "kind": "state", "level": 2, "verdict": "holds", "tension": "none", "contradictions": [], "volatile": false, "as_of": "20261022T081047Z", "status_fit": "ok", "reason": "Calif's own post lists all eleven applications as confirmed pre-auth RCE; Wiz independently confirms WordPress, Drupal and Joomla. The full list rests on one named party (A2); WordPress/Drupal/Joomla alone would be A4. No third-party reproduction in the vault (Huntress says it did not reproduce), so 'reported' fits.", "checked": [ { "source": "calif-php2shell", "file": "sources/calif-php2shell/captures/20261022T081033Z/text.txt", "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "result": "carries", "excerpt": "We confirmed pre-auth RCE on the following PHP apps as well as arbitrary PHP scripts in some instances.", "outside_citation": false }, { "source": "wiz-blog-php2shell", "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt", "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "result": "partial", "excerpt": "demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest)", "outside_citation": false }, { "source": "huntress-php2shell-rapid-response", "file": "sources/huntress-php2shell-rapid-response/captures/20261022T112853Z/text.txt", "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "result": "absent", "excerpt": "We have not built or reproduced a proof of concept for these vulnerabilities", "outside_citation": false } ], "quotes_checked": [], "tickets": [ "Finding-116" ], "mode2": "An independent reproduction (e.g. watchTowr, a CERT, or a vendor lab) against any of the listed applications, or capture of Calif's demo video.", "display": 2, "stale": false } ], "unassessed": [], "contradictions": [ { "id": "K-001", "measure": "How much of the web: 70% of websites, or 70% of the Internet?", "status": "explained", "claims": [ "scale-70pc-internet", "scale-70pc-websites" ], "statements": [ { "who": "Wiz (blog body)", "when": "2026-10-21", "says": "a popular general-purpose scripting language that powers 70% of all websites in the world", "measures": "share of websites using PHP", "sources": [ "wiz-blog-php2shell" ] }, { "who": "Wiz (blog headline and @wiz_io on X)", "when": "2026-10-21", "says": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "measures": "the same figure, restated as a share of the Internet", "sources": [ "wiz-blog-php2shell", "x-wiz-io-php2shell" ] }, { "who": "BBC live page", "when": "2026-10-22 08:05 UTC capture", "says": "cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure", "measures": "the Wiz figure, quoted with a word ('roughly') that is not in Wiz's post", "sources": [ "bbc-live-ckgel5xp2xv9t" ] }, { "who": "CNN", "when": "2026-10-22 11:26 UTC capture", "says": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet", "measures": "headline: share of the Internet; its own body says 'powers 70% of all websites'", "sources": [ "cnn-php2shell-websites-shut" ] } ], "reading": "One origin, Wiz, restated: a share of websites using PHP became a share of 'the Internet' affected, inside Wiz's own post. Every outlet in the vault that carries the figure traces to Wiz, so it is one source, not several (restates, not corroborates). None of them says how the 70% was measured; it matches the usual web-technology survey figure for sites whose server-side language is known, which is a share of websites, not of hosts, traffic or 'the Internet', and not a count of vulnerable installations. The BBC's 'roughly 70%' puts a word in Wiz's mouth that its post does not use.", "settle": "The survey Wiz relied on, captured, with its population and method.", "ticket": "Contradiction-1" }, { "id": "K-002", "measure": "Is php2shell being exploited?", "status": "explained", "claims": [ "no-exploitation", "cisa-none", "amazon-honeypot", "probing", "watchtowr-itw", "no-confirmed-compromise" ], "statements": [ { "who": "Amazon Threat Intelligence (CJ Moses, AWS Security Blog)", "when": "2026-10-21", "says": "we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild.", "measures": "exploitation attempts against Amazon's MadPot honeypot sensors, from 17 October and in volume from 21 October 02:00 UTC", "sources": [ "aws-security-blog-madpot" ] }, { "who": "CISA (alert)", "when": "2026-10-21", "says": "While CISA has not observed exploitation of these vulnerabilities as of the time of publication", "measures": "exploitation observed by CISA, as of the alert's publication", "sources": [ "cisa-alert-php-20261021" ] }, { "who": "CISA ADP (SSVC in both CVE records)", "when": "2026-10-21 14:34 UTC", "says": "Exploitation: none", "measures": "CISA's SSVC exploitation decision point at the time it was scored; unchanged in the records fetched 2026-10-22 18:27 UTC", "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619" ], "outside": [ "https://cveawg.mitre.org/api/cve/CVE-2026-109618" ] }, { "who": "CISA KEV catalog", "when": "fetched 2026-10-22 18:27 UTC (catalog version 2026.10.21, released 2026-10-21 14:04 UTC)", "says": "Neither CVE-2026-109618 nor CVE-2026-109619 is in the catalog's 1,754 entries.", "measures": "CISA's official list of vulnerabilities with reliable evidence of exploitation", "outside": [ "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" ] }, { "who": "The Next Web", "when": "2026-10-22 (fetched 18:30 UTC, sha256 c51dfb0561b1bdb2)", "says": "Officials in Germany, the Netherlands and Japan say they have not seen one succeed.", "measures": "successful exploitation, as seen by national officials", "outside": [ "https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches" ] } ], "reading": "They measure different things at different times. Amazon counts attempts against its own sensors and honeypots; CISA and KEV record exploitation it has evidence of against real systems. Both can be true at once: attempts in volume, and no confirmed compromise of a named organisation. The site should never write 'exploited' without saying which of the two it means. Amazon's 'broadly exploited' is the stronger word, sourced to Amazon's own post in the vault; a KEV entry would be the first official signal that attempts have become compromises.", "settle": "A KEV entry for either CVE, or a named organisation confirming a compromise.", "ticket": "Contradiction-2" }, { "id": "K-003", "measure": "Which PHP versions are affected?", "status": "explained", "claims": [ "versions-old", "two-cves-9.2" ], "statements": [ { "who": "Cloudflare", "when": "2026-10-21", "says": "The vulnerabilities affect all web servers running PHP 5.4 or later", "measures": "affected versions", "sources": [ "cloudflare-blog-php2shell-waf" ] }, { "who": "The CVE records (CNA: PHP Group)", "when": "2026-10-21", "says": "affected: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12", "measures": "the supported branches that received a fixed release", "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619" ] }, { "who": "php.net advisory", "when": "2026-10-21", "says": "the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1", "measures": "the branches that got a source backport", "sources": [ "php-net-advisory" ] }, { "who": "NVD (configuration)", "when": "fetched 2026-10-22 18:27 UTC", "says": "cpe:2.3:a:php:php, versionEndExcluding 8.2.35, with no starting version", "measures": "NVD encodes every version before 8.2.35 as vulnerable", "sources": [ "nvd-cve-2026-109618", "nvd-cve-2026-109619" ] } ], "reading": "Affected, supported and patched are three different lists. The CVE record lists only the supported branches the PHP project fixed; the backports reach down to 7.4; Cloudflare and NVD describe what is vulnerable, which goes back further. They are compatible, but read as a contradiction unless the site says so where it shows the version table.", "settle": "The PHP project stating the earliest affected version.", "ticket": "Contradiction-3" }, { "id": "K-004", "measure": "How many systems are still unpatched?", "status": "open", "claims": [ "scale-2.6m-hosts" ], "statements": [ { "who": "Censys, via SecurityWeek", "when": "2026-10-21 (SecurityWeek captured 2026-10-22 11:23 UTC)", "says": "Out of 2.58 million internet-facing hosts seen on October 21, roughly 1.58 million were reporting identifiable PHP versions, and approximately 1.57 million were not patched", "measures": "unpatched hosts among those whose PHP version is visible, on release day", "sources": [ "securityweek-exploitation-days-before" ] }, { "who": "VulnCheck, VirusTotal and Censys, via SecurityWeek", "when": "2026-10-21", "says": "more than 1 million PHP servers were running unpatched software releases as of October 21", "measures": "a floor, with no method given", "sources": [ "securityweek-exploitation-days-before" ] }, { "who": "BBC, attributed only to 'researchers'", "when": "2026-10-22, after the vault's last capture", "says": "Major providers have implemented a fix, but globally 90% of systems at risk are yet to do so, researchers say.", "measures": "unknown population and method", "outside": [ "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t (fetched 2026-10-22 18:30 UTC, sha256 3842343a8de23fc9)" ] } ], "reading": "The site's claim reads as 1.57 million unpatched out of about 2.6 million hosts (about 60%). The source says 1.57 million out of the 1.58 million whose version could be read (about 99%, on the day the fix shipped); the 2.58 million is all hosts seen, most of which do not announce a version. The two framings give very different pictures. The BBC's 90% has no named counter or method and is not captured. Open, because the site states one framing as fact.", "settle": "Censys's own post (the vault notes say it was not found), or a later Censys count with the same population.", "ticket": "Contradiction-4" }, { "id": "K-005", "measure": "How many UK government services went down?", "status": "open", "claims": [ "uk-list" ], "statements": [ { "who": "The BBC live page, reporting a UK minister", "when": "2026-10-22, after the vault's last capture", "says": "In the UK, a minister said just after midday that 32 government services were unavailable and four partially unavailable because they were being fixed", "measures": "central government services, at one moment", "outside": [ "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t (fetched 2026-10-22 18:30 UTC, sha256 3842343a8de23fc9)" ] }, { "who": "The Register", "when": "2026-10-22", "says": "dozens of UK government services", "measures": "unspecified; seen in the coverage review session, not fetched or captured by this desk", "outside": [ "The Register follow-up, URL not recorded in the coverage review" ] } ], "reading": "Probably the same count, described loosely by The Register. The BBC's line is verified in a fetch by this desk; it says 'a minister' without naming one or the House, so the coverage review's 'in the House of Lords' is not yet carried by any source this desk has read. Neither is captured into the vault: this record is a request to capture.", "settle": "The Hansard record of the minister's answer, captured.", "ticket": "Contradiction-5" }, { "id": "K-006", "measure": "How many sites were taken offline?", "status": "explained", "claims": [ "affected-sites" ], "statements": [ { "who": "This site's impact ledger (data/impact.json)", "when": "vault capture to 2026-10-22 11:34 UTC", "says": "10 operators offline", "measures": "operators with a captured source in the exported manifest" }, { "who": "PHPocalypse Tracker (Luka Kladaric)", "when": "fetched 2026-10-22 18:27 UTC", "says": "50 sites in sites.csv, 2 of them with no back-up time", "measures": "sites first reported dark by any public source, aggregators included, with dark and back-up times", "outside": [ "https://allixsenos.github.io/phpocalypse-tracker/sites.csv" ] }, { "who": "The evidence vault itself", "when": "head 31ccc515c29f", "says": "40 sources not exported to this site, among them captures of Edinburgh council, French prefectures, ANTS, UNIGE, EPFL, Wikimedia status, and reports from Reuters, The Record and Global News", "measures": "captured but not yet on the site" } ], "reading": "Breadth of collection, and an export lag. The site requires a captured source per row; the tracker accepts aggregator reports and says so per row. Part of the gap is not collection at all: the vault already holds captures of more offline operators than the site shows, because the site's export stopped at 144 sources.", "settle": "Re-run the vault export; capture the tracker's sites.csv into the source watch on a schedule.", "ticket": "Contradiction-6" }, { "id": "K-007", "measure": "How severe: CVSS 10.0, 9.2 or 9.8?", "status": "explained", "claims": [ "cvss-10", "two-cves-9.2" ], "statements": [ { "who": "Social posts relayed during the leak", "when": "2026-10-20", "says": "a wrong CVSS score of 10.0 (the actual score is 9.2)", "measures": "a leaked number, corrected by the PHP Foundation", "sources": [ "php-foundation-blog-security-release" ] }, { "who": "The CVE records (CNA: PHP Group)", "when": "2026-10-21", "says": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, base score 9.2", "measures": "CVSS version 4.0, scored by the vendor", "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619" ] }, { "who": "NVD (NIST)", "when": "NVD record modified 2026-10-22 10:09 UTC", "says": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8", "measures": "CVSS version 3.1, scored by NIST, which rates attack complexity low where the vendor rated it high", "sources": [ "nvd-cve-2026-109618", "nvd-cve-2026-109619" ] } ], "reading": "10.0 was wrong. 9.2 and 9.8 are both right, on two different scales scored by two different parties, and they disagree on one input: the vendor says attack complexity is high, NIST says low. The site explains 10.0 against 9.2 but never mentions 9.8, which is what a reader checking NVD, or a scanner reporting CVSS 3.1, will see.", "settle": "Already settled as a reading; the site should carry the 9.8 and say what differs.", "ticket": "Contradiction-7" }, { "id": "K-008", "measure": "Which flaw was shown to give code execution on PHP-FPM?", "status": "open", "claims": [ "rce-fpm", "rce-modphp" ], "statements": [ { "who": "The PHP Foundation (blog)", "when": "2026-10-21", "says": "Remote code execution was also confirmed on PHP-FPM through application-level code paths", "measures": "placed under CVE-2026-109618 in the post", "sources": [ "php-foundation-blog-security-release" ] }, { "who": "PHP security team (GHSA-w8hw-w9fx-j79w, CVE-2026-109618)", "when": "2026-10-21", "says": "no complete FPM exploit has been demonstrated for this SAPI", "measures": "CVE-2026-109618 on FPM", "sources": [ "github-ghsa-w8hw-w9fx-j79w" ] }, { "who": "PHP security team (GHSA-6wmf-4rv5-p3rp, CVE-2026-109619)", "when": "2026-10-21", "says": "It works with a normal dynamic FPM pool, although it depends on a suitable application operation.", "measures": "CVE-2026-109619 on FPM", "sources": [ "github-ghsa-6wmf-4rv5-p3rp" ] } ], "reading": "The advisories, written by the PHP security team per CVE, put the demonstrated FPM exploit under CVE-2026-109619, and say none was demonstrated for CVE-2026-109618. The Foundation's blog places FPM confirmation under CVE-2026-109618. The blog appears to have swapped the attribution. That RCE was shown on FPM is not in doubt; which flaw does it is.", "settle": "A correction to the Foundation's post, or a PHP security team statement.", "ticket": "Contradiction-8" }, { "id": "K-009", "measure": "Did any technical detail leak on 20 October?", "status": "open", "claims": [ "leak-cve-ids", "leak-hn", "leak-video" ], "statements": [ { "who": "The PHP Foundation", "when": "2026-10-21", "says": "They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.", "measures": "what circulated with the CVE IDs", "sources": [ "phpfoundation-blog-security-release-leak" ] }, { "who": "Daubois (a member of the PHP security team, own blog)", "when": "2026-10", "says": "A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down", "measures": "a tool screenshot and a video", "sources": [ "daubois-blog-php2shell-rumors" ] }, { "who": "The Hacker News", "when": "2026-10-21", "says": "details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time", "measures": "claims a PoC leaked", "sources": [ "thehackernews-php2shell-4days" ] }, { "who": "Equixly, citing Sansec", "when": "2026-10", "says": "Sansec cites a leaked screenshot of an exploit tool named PHP2Shell, whose banner claims the tool works against PHP 5.4.0 and later.", "measures": "a screenshot of a tool banner", "sources": [ "equixly-php2shell-what-we-know" ] } ], "reading": "Probably different meanings of 'technical detail'. A screenshot of a tool banner and a demonstration video show that an exploit exists, not how it works; the Foundation may mean that no root cause or code leaked. The Hacker News's 'proof-of-concept exploit leaked' is stronger than anything else in the vault carries, and no capture shows a leaked PoC. Open until the Foundation or Daubois says what the Foundation meant.", "settle": "A capture of the leaked screenshot or video, or the Foundation saying what 'technical details' covers.", "ticket": "Contradiction-9" }, { "id": "K-010", "measure": "When was the release planned, and when did it ship?", "status": "open", "claims": [ "release-moved", "release-time" ], "statements": [ { "who": "The PHP Foundation", "when": "2026-10-21", "says": "It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.", "measures": "the planned times", "sources": [ "php-foundation-blog-security-release" ] }, { "who": "The Hacker News", "when": "2026-10-21", "says": "Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC", "measures": "the original plan, probably from the Foundation", "sources": [ "thehackernews-php2shell-4days" ] }, { "who": "CybelAngel", "when": "2026-10", "says": "The disclosure was originally under embargo until Thursday 22 October at 11:00 ET; after the leak, PHP scheduled its release for 21 October", "measures": "the original embargo, 15:00 UTC, attributed by others to watchTowr", "sources": [ "cybelangel-php2shell" ] }, { "who": "The php.net ChangeLog", "when": "captured 2026-10-22", "says": "22 Oct 2026", "measures": "the date the ChangeLog gives all four releases, which shipped on 21 October", "sources": [ "php-net-changelog-8" ] } ], "reading": "The original embargo time has two values, 14:00 UTC (the Foundation, echoed by The Hacker News) and 11:00 ET, which is 15:00 UTC (watchTowr, echoed by CybelAngel and others). The release itself is stamped 13:34 UTC on the GitHub advisories, ahead of the announced 14:00. The ChangeLog still carries the original date. The site should say 'about 14:00 UTC, advisories at 13:34' and give both original times.", "settle": "A PHP project statement of the embargo time, or the pre-announcement's original text.", "ticket": "Contradiction-10" }, { "id": "K-011", "measure": "Is the fix in PHP 8.5.12 incomplete?", "status": "open", "claims": [ "fix-incomplete", "more-paths" ], "statements": [ { "who": "Aaron Rainbolt on oss-security, relaying a Fediverse post", "when": "2026-10-21 15:24 UTC", "says": "the Fediverse is reporting that the fix to at least PHP 8.5.12 may be incomplete", "measures": "an unconfirmed report from an unnamed person, relayed", "sources": [ "openwall-oss-security-109619-thread" ] }, { "who": "The same, relaying Canonical via a Matrix channel", "when": "2026-10-21 17:29 UTC", "says": "was told that it's \"unrelated and not a real issue\"", "measures": "PHP's answer to Canonical, second-hand", "sources": [ "openwall-oss-security-109619-thread" ] }, { "who": "Jakub Zelenka, PHP security team, on oss-security (post 2026/10/22/15)", "when": "2026-10-22 09:11 UTC", "says": "This is unrelated issue with minimal impact (crash in one component in slightly unlikely scenario). It has nothing to do with the RCE.", "measures": "PHP's own public answer", "outside": [ "https://www.openwall.com/lists/oss-security/2026/10/22/15 (fetched 2026-10-22 20:5x UTC, sha256 94c69d8f1c07e67d)" ] } ], "reading": "The report and the answer are about different things: the Fediverse post describes some flaw in 8.5.12; the PHP security team says it is a separate crash bug of minimal impact, not a way around the RCE fix. The answer came at 09:11 UTC on 22 October, after the vault's copy of the thread (which stops at 22/2), so the site still says PHP has not answered. Open only until the reply is captured; then it should be marked explained and the claim re-graded.", "settle": "Capture oss-security 2026/10/22/15 into the vault.", "ticket": "Contradiction-11" } ], "tickets": [ { "label": "Contradiction-1", "type": "contradiction", "status": "explained", "title": "K-001: How much of the web: 70_ of websites, or 70_ of the Internet?", "description": "One origin, Wiz, restated: a share of websites using PHP became a share of 'the Internet' affected, inside Wiz's own post. Every outlet in the vault that carries the figure traces to Wiz, so it is one source, not several (restates, not corroborates). None of them says how the 70% was measured; it matches the usual web-technology survey figure for sites whose server-side language is known, which is a share of websites, not of hosts, traffic or 'the Internet', and not a count of vulnerable installations. The BBC's 'roughly 70%' puts a word in Wiz's mouth that its post does not use.", "severity": "medium", "claims": [ "scale-70pc-internet", "scale-70pc-websites" ], "sources": [ "bbc-live-ckgel5xp2xv9t", "cnn-php2shell-websites-shut", "wiz-blog-php2shell", "x-wiz-io-php2shell" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Finding-124" } ] }, { "label": "Contradiction-2", "type": "contradiction", "status": "explained", "title": "K-002: Is php2shell being exploited?", "description": "They measure different things at different times. Amazon counts attempts against its own sensors and honeypots; CISA and KEV record exploitation it has evidence of against real systems. Both can be true at once: attempts in volume, and no confirmed compromise of a named organisation. The site should never write 'exploited' without saying which of the two it means. Amazon's 'broadly exploited' is the stronger word, sourced to Amazon's own post in the vault; a KEV entry would be the first official signal that attempts have become compromises.", "severity": "medium", "claims": [ "no-exploitation", "cisa-none", "amazon-honeypot", "probing", "watchtowr-itw", "no-confirmed-compromise" ], "sources": [ "aws-security-blog-madpot", "cisa-alert-php-20261021", "cve-cve-2026-109618", "cve-cve-2026-109619" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Finding-122" }, { "verb": "supported-by", "to": "Evidence-1" }, { "verb": "supported-by", "to": "Evidence-10" }, { "verb": "supported-by", "to": "Evidence-3" }, { "verb": "supported-by", "to": "Evidence-6" } ] }, { "label": "Contradiction-3", "type": "contradiction", "status": "explained", "title": "K-003: Which PHP versions are affected?", "description": "Affected, supported and patched are three different lists. The CVE record lists only the supported branches the PHP project fixed; the backports reach down to 7.4; Cloudflare and NVD describe what is vulnerable, which goes back further. They are compatible, but read as a contradiction unless the site says so where it shows the version table.", "severity": "medium", "claims": [ "versions-old", "two-cves-9.2" ], "sources": [ "cloudflare-blog-php2shell-waf", "cve-cve-2026-109618", "cve-cve-2026-109619", "nvd-cve-2026-109618", "nvd-cve-2026-109619", "php-net-advisory" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-9" } ] }, { "label": "Contradiction-4", "type": "contradiction", "status": "open", "title": "K-004: How many systems are still unpatched?", "description": "The site's claim reads as 1.57 million unpatched out of about 2.6 million hosts (about 60%). The source says 1.57 million out of the 1.58 million whose version could be read (about 99%, on the day the fix shipped); the 2.58 million is all hosts seen, most of which do not announce a version. The two framings give very different pictures. The BBC's 90% has no named counter or method and is not captured. Open, because the site states one framing as fact.", "severity": "medium", "claims": [ "scale-2.6m-hosts" ], "sources": [ "securityweek-exploitation-days-before" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-2" } ] }, { "label": "Contradiction-5", "type": "contradiction", "status": "open", "title": "K-005: How many UK government services went down?", "description": "Probably the same count, described loosely by The Register. The BBC's line is verified in a fetch by this desk; it says 'a minister' without naming one or the House, so the coverage review's 'in the House of Lords' is not yet carried by any source this desk has read. Neither is captured into the vault: this record is a request to capture.", "severity": "medium", "claims": [ "uk-list" ], "sources": [], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-2" } ] }, { "label": "Contradiction-6", "type": "contradiction", "status": "explained", "title": "K-006: How many sites were taken offline?", "description": "Breadth of collection, and an export lag. The site requires a captured source per row; the tracker accepts aggregator reports and says so per row. Part of the gap is not collection at all: the vault already holds captures of more offline operators than the site shows, because the site's export stopped at 144 sources.", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supported-by", "to": "Evidence-11" }, { "verb": "supported-by", "to": "Evidence-4" } ] }, { "label": "Contradiction-7", "type": "contradiction", "status": "explained", "title": "K-007: How severe: CVSS 10.0, 9.2 or 9.8?", "description": "10.0 was wrong. 9.2 and 9.8 are both right, on two different scales scored by two different parties, and they disagree on one input: the vendor says attack complexity is high, NIST says low. The site explains 10.0 against 9.2 but never mentions 9.8, which is what a reader checking NVD, or a scanner reporting CVSS 3.1, will see.", "severity": "medium", "claims": [ "cvss-10", "two-cves-9.2" ], "sources": [ "cve-cve-2026-109618", "cve-cve-2026-109619", "nvd-cve-2026-109618", "nvd-cve-2026-109619", "php-foundation-blog-security-release" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Finding-121" } ] }, { "label": "Contradiction-8", "type": "contradiction", "status": "open", "title": "K-008: Which flaw was shown to give code execution on PHP-FPM?", "description": "The advisories, written by the PHP security team per CVE, put the demonstrated FPM exploit under CVE-2026-109619, and say none was demonstrated for CVE-2026-109618. The Foundation's blog places FPM confirmation under CVE-2026-109618. The blog appears to have swapped the attribution. That RCE was shown on FPM is not in doubt; which flaw does it is.", "severity": "medium", "claims": [ "rce-fpm", "rce-modphp" ], "sources": [ "github-ghsa-6wmf-4rv5-p3rp", "github-ghsa-w8hw-w9fx-j79w", "php-foundation-blog-security-release" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Contradiction-9", "type": "contradiction", "status": "open", "title": "K-009: Did any technical detail leak on 20 October?", "description": "Probably different meanings of 'technical detail'. A screenshot of a tool banner and a demonstration video show that an exploit exists, not how it works; the Foundation may mean that no root cause or code leaked. The Hacker News's 'proof-of-concept exploit leaked' is stronger than anything else in the vault carries, and no capture shows a leaked PoC. Open until the Foundation or Daubois says what the Foundation meant.", "severity": "medium", "claims": [ "leak-cve-ids", "leak-hn", "leak-video" ], "sources": [ "daubois-blog-php2shell-rumors", "equixly-php2shell-what-we-know", "phpfoundation-blog-security-release-leak", "thehackernews-php2shell-4days" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Contradiction-10", "type": "contradiction", "status": "open", "title": "K-010: When was the release planned, and when did it ship?", "description": "The original embargo time has two values, 14:00 UTC (the Foundation, echoed by The Hacker News) and 11:00 ET, which is 15:00 UTC (watchTowr, echoed by CybelAngel and others). The release itself is stamped 13:34 UTC on the GitHub advisories, ahead of the announced 14:00. The ChangeLog still carries the original date. The site should say 'about 14:00 UTC, advisories at 13:34' and give both original times.", "severity": "medium", "claims": [ "release-moved", "release-time" ], "sources": [ "cybelangel-php2shell", "php-foundation-blog-security-release", "php-net-changelog-8", "thehackernews-php2shell-4days" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Contradiction-11", "type": "contradiction", "status": "open", "title": "K-011: Is the fix in PHP 8.5.12 incomplete?", "description": "The report and the answer are about different things: the Fediverse post describes some flaw in 8.5.12; the PHP security team says it is a separate crash bug of minimal impact, not a way around the RCE fix. The answer came at 09:11 UTC on 22 October, after the vault's copy of the thread (which stops at 22/2), so the site still says PHP has not answered. Open only until the reply is captured; then it should be marked explained and the claim re-graded.", "severity": "medium", "claims": [ "fix-incomplete", "more-paths" ], "sources": [ "openwall-oss-security-109619-thread" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-2", "links": [ { "verb": "relates-to", "to": "Finding-125" }, { "verb": "supported-by", "to": "Evidence-7" }, { "verb": "supported-by", "to": "Evidence-8" } ] }, { "label": "Evidence-1", "type": "evidence", "status": "proposed", "title": "CISA KEV, 18:27 UTC on 22 October: neither CVE is listed (catalog 2026.10.21, released 14:04 UTC on 21 October, 1,754 entries)", "description": "Fetched by the desk. The catalog has not been updated since 21 October 14:04 UTC, before CISA's own alert; so 'not in KEV' is as of that catalog version. Supports the front page's 'did not include these two when last checked' and board 010. Capture into the source watch on every run.", "severity": "medium", "claims": [ "cisa-none", "no-confirmed-compromise", "kev-precedent" ], "sources": [], "pages": [], "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "retrieved_at": "2026-10-22T18:27Z", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-2", "type": "evidence", "status": "proposed", "title": "BBC live page, 18:30 UTC: '32 government services were unavailable and four partially unavailable'; 'globally 90_ of systems at risk are yet to do so'", "description": "Fetched by the desk; the vault's three BBC captures end at 08:05 UTC and carry neither line. The minister is not named on the page, and 'House of Lords' (in the coverage review) is not on it. The 90% is attributed only to 'researchers'. Capture the page as it stands.", "severity": "medium", "claims": [ "uk-list" ], "sources": [], "pages": [], "url": "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t", "retrieved_at": "2026-10-22T18:30Z", "sha256": "3842343a8de23fc96beb029341d71675595b81441d8e88b183374e3095dcdce4", "excerpt": "a minister said just after midday that 32 government services were unavailable and four partially unavailable because they were being fixed", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-4" }, { "verb": "supports", "to": "Contradiction-5" } ] }, { "label": "Evidence-3", "type": "evidence", "status": "proposed", "title": "The Next Web: 'Officials in Germany, the Netherlands and Japan say they have not seen one succeed'; Mizuho and Shizuoka Bank halted services", "description": "Fetched by the desk; not in the vault. Bears on no-confirmed-compromise (a dated negative from three governments) and on impact (Japanese banks, via Bloomberg). Capture it, then chase the officials' own statements.", "severity": "medium", "claims": [ "no-confirmed-compromise", "affected-sites" ], "sources": [], "pages": [], "url": "https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches", "retrieved_at": "2026-10-22T18:30Z", "sha256": "c51dfb0561b1bdb2cd0a5691a16ffc394908928d2deab03e90047ca1b6311bdb", "excerpt": "Officials in Germany, the Netherlands and Japan say they have not seen one succeed.", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-4", "type": "evidence", "status": "proposed", "title": "PHPocalypse Tracker sites.csv: 50 sites, 2 with no back-up time, each with dark and back times and a source", "description": "Fetched by the desk at 18:27 UTC. Row-level provenance, and recovery times this site does not record. Its own header warns that aggregator reports are not confirmed at the original source, so each row is a lead, not a fact. Capture the CSV on a schedule (board 057).", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [], "url": "https://allixsenos.github.io/phpocalypse-tracker/sites.csv", "retrieved_at": "2026-10-22T18:27Z", "sha256": "8109506bc80264887f2bd36eb452c1ad5468db6330efe4f167623be9f9965fe6", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-6" } ] }, { "label": "Evidence-5", "type": "evidence", "status": "proposed", "title": "php.net releases feed, 18:27 UTC: no PHP release after 21 October", "description": "Fetched by the desk: the newest releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, dated 21 Oct 2026. Bears on fix-incomplete and the front page's open question 'Whether the fix is complete': no follow-up release as of this check.", "severity": "low", "claims": [ "fix-incomplete" ], "sources": [], "pages": [], "url": "https://www.php.net/releases/index.php?json&max=8&version=8", "retrieved_at": "2026-10-22T18:27Z", "sha256": "06f7ddd8254f82984e9a75300cf733327f32f3b862d08b200dccbbb2affee450", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Evidence-6", "type": "evidence", "status": "proposed", "title": "CVE records unchanged since the vault's capture; CISA's SSVC still says Exploitation: none", "description": "Fetched by the desk from the CVE API at 18:27 UTC. CVE-2026-109618 last updated 21 Oct 16:07 UTC, CVE-2026-109619 22 Oct 08:09 UTC, both before the vault's 08:12 UTC captures. CISA ADP SSVC, scored 21 Oct 14:34 UTC, still 'Exploitation: none'. Nothing to re-capture; recorded so the next run can tell if it changes.", "severity": "low", "claims": [ "two-cves-9.2", "cisa-none" ], "sources": [], "pages": [], "url": "https://cveawg.mitre.org/api/cve/CVE-2026-109618", "retrieved_at": "2026-10-22T18:27Z", "sha256": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1", "excerpt": "", "run": "Run-1", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-7", "type": "evidence", "status": "proposed", "title": "PHP security team on oss-security, 22 October 09:11 UTC: the 'incomplete fix' report is 'unrelated' and 'has nothing to do with the RCE'", "description": "Jakub Zelenka (who published both advisories) answering Rainbolt's relay of the Fediverse report. This is PHP's public answer that the site's front page says does not exist. High priority to capture: once captured, fix-incomplete should be re-graded and the front page's open question closed or reworded.", "severity": "high", "claims": [ "fix-incomplete", "more-paths" ], "sources": [], "pages": [], "url": "https://www.openwall.com/lists/oss-security/2026/10/22/15", "retrieved_at": "2026-10-22T20:54Z", "sha256": "94c69d8f1c07e67d6fd44cfaeeb6e1805262c60d07acd5cd750e0b7d1a90026d", "excerpt": "This is unrelated issue with minimal impact (crash in one component in slightly unlikely scenario). It has nothing to do with the RCE.", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-11" } ] }, { "label": "Evidence-8", "type": "evidence", "status": "proposed", "title": "oss-security 22_14: the deb.sury.org tracker quotes the PHP team, 'aware of that report and there are no new plans as of now'", "description": "Nicolas Vigier relays a comment on the Debian/Ubuntu PHP packager's issue tracker. Third-hand, but consistent with PHP's own answer in 22/15.", "severity": "low", "claims": [ "fix-incomplete" ], "sources": [], "pages": [], "url": "https://www.openwall.com/lists/oss-security/2026/10/22/14", "retrieved_at": "2026-10-22T20:54Z", "sha256": "7f8f85193e75133f88647d70733a69938c17e6f2773b4755c0dc67acd3512dbb", "excerpt": "The PHP team is aware of that report and there are no new plans as of now.", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-11" } ] }, { "label": "Evidence-9", "type": "evidence", "status": "proposed", "title": "oss-security 22_16, 22_19, 22_20: list members say every version from PHP 5.4 is affected, each citing Wiz", "description": "Three replies to Greenbone's question about versions older than 8.2. All three trace to Wiz's write-up (restates, not corroborates); no reply from the PHP project on versions. Adds echoes to K-003, not evidence.", "severity": "low", "claims": [ "versions-old" ], "sources": [], "pages": [], "url": "https://www.openwall.com/lists/oss-security/2026/10/22/16", "retrieved_at": "2026-10-22T20:54Z", "sha256": "04f109cae98defca4e2db749e7dc1cf106fc8503ae907aff9e16d60a285ea45e", "excerpt": "It's pubblically document in the writeup that everything from PHP 5.4 is affected", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-3" } ] }, { "label": "Evidence-10", "type": "evidence", "status": "proposed", "title": "Primary feeds at 20:53 UTC: KEV unchanged (neither CVE), no PHP release after 21 October, NVD now 'Analyzed', CVE-2026-109619 updated 20:08 UTC with five oss-security references", "description": "KEV is byte-identical to run 1 (catalog 2026.10.21). php.net releases unchanged. NVD moved CVE-2026-109618 from Modified to Analyzed at 20:45 UTC (scores unchanged). The CVE-2026-109619 record's ADP container added oss-security 22/14, 15, 16, 19 and 20 as references. The NCSC-NL repository head is unchanged at 94b4b16db9e5.", "severity": "low", "claims": [ "cisa-none", "no-confirmed-compromise", "two-cves-9.2" ], "sources": [], "pages": [], "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "retrieved_at": "2026-10-22T20:53Z", "sha256": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b", "excerpt": "", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-2" } ] }, { "label": "Evidence-11", "type": "evidence", "status": "proposed", "title": "PHPocalypse Tracker, 20:53 UTC: the Dutch data protection authority back at 19:25 UTC; one site still dark (French prefecture websites)", "description": "Was 2 still dark at 18:27 UTC. Of 50 rows, 49 now have a back-up time.", "severity": "low", "claims": [ "affected-sites" ], "sources": [], "pages": [], "url": "https://allixsenos.github.io/phpocalypse-tracker/sites.csv", "retrieved_at": "2026-10-22T20:53Z", "sha256": "1534d904219babed6a62bab19cbd061d9cc156b24b96f621b606af4e6587495b", "excerpt": "", "run": "Run-2", "links": [ { "verb": "supports", "to": "Contradiction-6" } ] }, { "label": "Finding-1", "type": "finding", "status": "open", "title": "ai-found: Patch the Planet framing generalised to all finders", "description": "The claim says the flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative. Calif's page places Calif under Patch the Planet; Wiz's blog and X thread never mention Patch the Planet, and Wiz credits Gemini 4 Argon most. The OOM root cause was first seen by a PHP core developer in 2024 without AI (Foundation blog). Reword to 'Calif, working under Patch the Planet, and Wiz both used AI models'.", "severity": "medium", "claims": [ "ai-found" ], "sources": [], "pages": [ "facts/ai-found/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-2", "type": "finding", "status": "open", "title": "who-first: Priority reading carried as 'confirmed'", "description": "'Calif found the flaws first' is an attribution of priority, a reading. The Foundation's capture says the same root cause was 'the OOM problem we had found in 2024' and that 'OpenAI independently reported the same root cause on the same day'. The 1 August discovery date is Calif's own claim. Use status 'reported', or narrow it to 'Calif has the earliest public timestamp (hash on 5 August) of the 2026 reporters'.", "severity": "medium", "claims": [ "who-first" ], "sources": [], "pages": [ "facts/who-first/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-3", "type": "finding", "status": "open", "title": "openai-same-day: Note quotes OpenAI's blocked post", "description": "The note says OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol'. OpenAI's blog capture is blocked (text.txt is 0 bytes) and the captured X post contains no such phrase. The wording exists only as a search snippet in the collector's notes. Drop the quote marks or say it is from a search summary.", "severity": "medium", "claims": [ "openai-same-day" ], "sources": [], "pages": [ "facts/openai-same-day/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-4", "type": "finding", "status": "open", "title": "wiz-independent: 'independently' not carried by any primary capture", "description": "Wiz's blog says 'Prior to public disclosure, Wiz Research worked with the PHP team, Calif and OpenAI on discovery, coordination and patch verification'. The Foundation lists Wiz's 24 August report as 'further attack vectors'. Only OpenAI's blocked blog (search snippet) and Wikipedia say 'independently'. Attribute the word, or drop it.", "severity": "medium", "claims": [ "wiz-independent" ], "sources": [], "pages": [ "facts/wiz-independent/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-5", "type": "finding", "status": "open", "title": "quarkslab-2024: Who found the OOM issue in 2024: the two sources differ", "description": "The claim says the issue 'was found in a 2024 audit by Quarkslab'. The Foundation, the primary party, says a PHP core developer found the first signs 'while fixing one of the issues Quarkslab reported'. timeline.json (at 2024) states the Foundation's version correctly; this claim does not. Quarkslab's published summary lists no OOM finding.", "severity": "medium", "claims": [ "quarkslab-2024" ], "sources": [], "pages": [ "facts/quarkslab-2024/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-6", "type": "finding", "status": "open", "title": "quarkslab-2024: 'Two parties agree' is one origin, and 'confirmed' is overstated", "description": "Calif writes 'We were able to confirm from PHP a similar/related issue was uncovered but exploitation was not proven in 2024', so its account derives from PHP. The causal 'so it was not fixed' is Calif's; the Foundation says the fix stalled because of competing approaches, consensus decision-making and a lack of resources. Status should be 'reported', with the Foundation's version as the lead.", "severity": "medium", "claims": [ "quarkslab-2024" ], "sources": [], "pages": [ "facts/quarkslab-2024/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-7", "type": "finding", "status": "open", "title": "ahead-of-attackers: Claim drops OpenAI's hedge 'to our knowledge'", "description": "OpenAI wrote 'to our knowledge, frontier AI was able to find this vulnerability ahead of attackers'. The site states it unhedged. Restore the qualifier.", "severity": "medium", "claims": [ "ahead-of-attackers" ], "sources": [], "pages": [ "facts/ahead-of-attackers/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-8", "type": "finding", "status": "open", "title": "most-severe: Cited Wiz source does not say it; the real origin is uncited", "description": "The claim cites wiz-blog-php2shell, whose wording is 'among the most severe ... in PHP'. The 'ever detected by AI' framing appears in the BBC and, as a WSJ quote of Wiz's co-founder ('the most severe AI vulnerability that was ever found'), in substack-lopezkurtz-patch-is-the-exploit. Cite the Substack relay and label the claim as a quote of a quote from the WSJ.", "severity": "medium", "claims": [ "most-severe" ], "sources": [], "pages": [ "facts/most-severe/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-9", "type": "finding", "status": "open", "title": "leak-video: 'around 20:00 UTC' may be the pre-announcement's time, not the video's", "description": "The Foundation sentence reads 'As a result of the leak and pre-announcement around 20:00 UTC, Calif ... mistakenly published a video.' The time can modify the pre-announcement (oss-security relayed it at 20:22:51Z; php.net's feed says 20:32Z). The Register reads it as 'a couple of hours later' than 15:00; Feross says 'that evening'. The site (claim and timeline.json at 2026-10-20T20:00Z) presents 20:00 UTC as the video's time. Say 'evening of 20 October' or flag the ambiguity.", "severity": "medium", "claims": [ "leak-video" ], "sources": [], "pages": [ "facts/leak-video/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-10", "type": "finding", "status": "open", "title": "chainguard: Lorenc quote attributed to The Register is not in The Register", "description": "The note quotes Lorenc 'via The Register': 'I made the call to get these out early when exploits hit in the wild'. The Register capture has 'so we made the call to ship the fixes under that'. The quoted sentence appears only inside a Reddit comment embedded in the Foundation page ('but I made the call to get these out early when exploits hit in the wild.'), apparently quoting Lorenc elsewhere (likely Hacker News). Use The Register's words or capture the original.", "severity": "medium", "claims": [ "chainguard" ], "sources": [], "pages": [ "facts/chainguard/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-11", "type": "finding", "status": "open", "title": "no-exploitation: Time of the Austin interview is wrong: the post is 08:00 UTC (09:00 BST), not 08:00 BST", "description": "claims.json 'by' says '08:00 BST 22 October'; exploitation.json and timeline.json date it 2026-10-22T07:00Z. The capture's page.html JSON-LD gives the post datePublished 2026-10-22T08:00:23.293Z, and the rendered page (UTC browser) shows 'published at 08:00'. The vault's BBC notes.md is the origin of the BST error (the 07:55Z curl copy showed BST clock times, the Playwright capture shows UTC).", "severity": "medium", "claims": [ "no-exploitation" ], "sources": [], "pages": [ "facts/no-exploitation/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-12", "type": "finding", "status": "open", "title": "no-exploitation: Claim uses the BBC headline's absolute wording, not Austin's hedged words", "description": "Austin said \"Not at the moment... it doesn't look like exploitation has taken off or been widespread\", which allows some exploitation; 'There is no evidence yet that hackers have exploited the flaw' is the BBC's paraphrase. Reword to his words or attribute the headline to the BBC.", "severity": "medium", "claims": [ "no-exploitation" ], "sources": [], "pages": [ "facts/no-exploitation/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-13", "type": "finding", "status": "open", "title": "cisa-none: Claim drops CISA's own time qualifier", "description": "CISA says it 'has not observed exploitation ... as of the time of publication' (Release Date October 21, 2026, no time given). The claim text uses an undated present tense ('CISA has not observed exploitation'); the qualifier is only in the note. Put 'as of 21 October' in the claim itself, since Amazon, Cloudflare, watchTowr and NCSC NZ report exploitation attempts after that.", "severity": "medium", "claims": [ "cisa-none" ], "sources": [], "pages": [ "facts/cisa-none/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-14", "type": "finding", "status": "open", "title": "amazon-honeypot: The note narrows Amazon's sentence to honeypots; Amazon's text does not", "description": "Note: 'Attempts against honeypots, not compromises of victims'; history.json: \"Amazon saying it is 'broadly exploited' against honeypots\"; claims.json no-confirmed-compromise: \"'broadly exploited' against sensors\". Amazon writes 'we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild.' and also 'With PHP2Shell, compromise may predate the advisory.' The honeypot limit is this site's reading. Say instead: Amazon gives no counts and names no victim; its evidence shown is honeypot telemetry.", "severity": "medium", "claims": [ "amazon-honeypot" ], "sources": [], "pages": [ "facts/amazon-honeypot/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-15", "type": "finding", "status": "open", "title": "probing: exploitation.json's Woodward row says Amazon's own post was not found", "description": "exploitation.json row (2026-10-22, Alan Woodward) has status 'reported; Cloudflare's own post confirms attack traffic, Amazon's own post not found' and cites thehackernews-php2shell-4days, while this claim (confirmed) cites aws-security-blog-madpot as Amazon's own confirmation.", "severity": "medium", "claims": [ "probing" ], "sources": [], "pages": [ "facts/probing/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-16", "type": "finding", "status": "open", "title": "latvia-attempts: 'none succeeded' overstates 'no reports of successful attacks so far'", "description": "CERT.LV: 'ta_u l_dz _im nav zi_u par sekm_giem uzbrukumiem' (but so far there are no reports of successful attacks), in the update of 21.10.2026 23:00 (20:00Z). exploitation.json words it correctly; claims.json does not. Reword and date it.", "severity": "medium", "claims": [ "latvia-attempts" ], "sources": [], "pages": [ "facts/latvia-attempts/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-17", "type": "finding", "status": "open", "title": "huntress-none: 'No public exploit code known' is dated before release, not 20:30 UTC on 21 October", "description": "The sentence 'we're not aware of public exploit code as of this writing' sits in the original pre-release section ('The fixes aren't out yet'), i.e. about 20 October. The claim and impact.json put it under 'as of 20:30 UTC on 21 October'. By then Amazon reports PoCs 'within hours' of release, CCCS says a PoC is available, and watchTowr reports PoC code on GitHub. Split the two halves and date each.", "severity": "medium", "claims": [ "huntress-none" ], "sources": [], "pages": [ "facts/huntress-none/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-18", "type": "finding", "status": "open", "title": "watchtowr-itw: Status 'unverified' understates the attempts half; the vault has four outlets quoting watchTowr", "description": "securityweek-first-attempts-sensors, securityweek-exploitation-days-before, darkreading-php2shell-red-alert and tenable-php2shell-faq (in data/sources.json) and therecord-php-warnings (vault only) quote Jake Knott: watchTowr sees in-the-wild exploitation attempts. Cite them and mark that half reported or corroborated.", "severity": "medium", "claims": [ "watchtowr-itw" ], "sources": [], "pages": [ "facts/watchtowr-itw/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-19", "type": "finding", "status": "open", "title": "watchtowr-itw: Claim omits watchTowr's own qualifier: no successful attempt, and sprayed exploits mostly do not work", "description": "Knott: 'Whilst nobody has been successful to date' (SecurityWeek) and 'The exploits being sprayed indiscriminately either don't work at all, test for timing-based differences, or crash the target'. Without this the claim reads as more than attempts.", "severity": "medium", "claims": [ "watchtowr-itw" ], "sources": [], "pages": [ "facts/watchtowr-itw/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-20", "type": "finding", "status": "open", "title": "kev-precedent: Status 'confirmed' outruns the weakest part (A2), and 'last PHP core RCE' is not shown", "description": "The one-day exploitation rests on one party (Akamai). The CVE record calls CVE-2024-4577 'Argument Injection in PHP-CGI' on Windows with certain code pages, a SAPI bug rather than the PHP core; and nothing captured shows it is the most recent PHP RCE (only that it is the most recent PHP entry in KEV). Say 'the last PHP flaw in KEV'.", "severity": "medium", "claims": [ "kev-precedent" ], "sources": [], "pages": [ "facts/kev-precedent/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-21", "type": "finding", "status": "open", "title": "kev-precedent: Honeypot attempts count as 'exploited in the wild' for 2024 but not for php2shell", "description": "Akamai's one-day evidence is exploit attempts against its honeypot network, the same kind of evidence as Amazon's MadPot hits, which the site's notes (amazon-honeypot, history.json) say are 'attempts against honeypots, not compromises'. Apply one standard to both.", "severity": "medium", "claims": [ "kev-precedent" ], "sources": [], "pages": [ "facts/kev-precedent/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-22", "type": "finding", "status": "open", "title": "affected-sites: Cited text capture no longer carries most of the list", "description": "The 08:05:59Z text capture (sha c88b8c5f...) has no mention of Edinburgh council, the BBC, online stores or the University of Geneva. The list is only in raw/page.2026-10-22T0755Z.html (summary bullet \"Among the impacted sites are Wikipedia, Edinburgh council, many online stores and the BBC\") and the Geneva item only in the header image alt text in raw/initial-data.json. The BBC dropped the bullet between 07:55Z and 08:05Z. The assessment should cite the raw file and its sha, and say the bullet was later removed.", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-23", "type": "finding", "status": "open", "title": "affected-sites: Note \"Not captured from any of the named organisations\" is out of date", "description": "The vault holds operator captures: unige.ch returned HTTP 503 with an F5 \"under maintenance\" page at 2026-10-22 08:19:10Z (unige-site) and 08:19:43Z (ch-unige-down); nord.gouv.fr and rhone.gouv.fr served \"Maintenance en cours\" at 08:19:39-40Z; edinburgh.gov.uk was up (HTTP 200, normal homepage) at 08:19:03Z and 08:19:40Z; wikimediastatus.net showed \"All Systems Operational\" at 08:18:50Z. These show down/up state at capture time, not the reason. story.json repeats the out-of-date statement (\"has not been captured from any of those organisations\").", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-24", "type": "finding", "status": "open", "title": "latvia-offline: Note \"the one documented case ... from the agency itself\" is contradicted by other site data and captures", "description": "The claim note and story.json call Latvia the one documented case of government services pulled from the public internet by the agency itself. The site's own nl-offline claim (status confirmed, \"Primary statement\") rests on Rijksoverheid saying NCSC.NL was taken offline \"uit voorzorg\"; EPFL's own homepage (epfl-site, 08:19:13Z) says it \"has temporarily suspended access to some of its websites\"; nord.gouv.fr and rhone.gouv.fr served maintenance pages at 08:19Z on 22 Oct.", "severity": "medium", "claims": [ "latvia-offline" ], "sources": [], "pages": [ "facts/latvia-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-25", "type": "finding", "status": "open", "title": "latvia-offline: \"Pulled from the public internet\" overstates a geo-block", "description": "CERT.LV says access was restricted from abroad, selectively, and that residents accessing from Latvia should not be affected (\"Paredzams, ka iedz_vot_jus, kuri valsts digit_lajiem pakalpojumiem piek__st no Latvijas, _ie ierobe_ojumi neietekm_s\"). The note should say geo-blocked from abroad, not pulled from the public internet.", "severity": "medium", "claims": [ "latvia-offline" ], "sources": [], "pages": [ "facts/latvia-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-26", "type": "finding", "status": "open", "title": "no-confirmed-compromise: Claim text lacks its as-of and scope", "description": "The negative holds only \"in every captured source, as of the latest capture\" (newest checked 2026-10-22T11:33Z). The note says so, but the claim and status \"confirmed\" read as a settled fact about the world. The supporting negatives are old: Huntress as of 20:30Z on 21 Oct, Imperva pre-disclosure only, CERT.LV 20:00Z on 21 Oct, against Amazon's \"broadly exploited in the wild\" and Cloudflare's \"millions\" of attempts. Suggest status \"reported\" or wording \"No named organisation, in any captured source as of , ...\".", "severity": "medium", "claims": [ "no-confirmed-compromise" ], "sources": [], "pages": [ "facts/no-confirmed-compromise/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-27", "type": "finding", "status": "open", "title": "nl-offline: \"Primary statement\" covers only NCSC.NL", "description": "The Rijksoverheid capture names only NCSC.NL; DigiD, MijnOverheid and Overheid.nl are not in it, and dutchitleaders-websites-offline is a Cloudflare challenge (75 chars). Status \"confirmed\" with note \"Primary statement\" overstates three of the four services. Cite tpo-nl-digid-offline and insurancebusiness-uk-councils-met (DigiD, MijnOverheid) and reuters-factbox-websites-offline (Overheid.nl), and mark those parts reported.", "severity": "medium", "claims": [ "nl-offline" ], "sources": [], "pages": [ "facts/nl-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-28", "type": "finding", "status": "open", "title": "nl-offline: \"No signs of active exploitation of those services\" is narrower than any source", "description": "Rijksoverheid says NCSC has not yet seen active misuse in general (13:59 on 21 Oct, before the patch); TPO quotes the minister saying there were \"nog geen signalen\" of active misuse. Neither speaks about those services specifically. Same wording in impact.json.", "severity": "medium", "claims": [ "nl-offline" ], "sources": [], "pages": [ "facts/nl-offline/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-29", "type": "finding", "status": "open", "title": "wikimedia-precaution: CNN does not carry the quoted phrase", "description": "The claim's \"by\" credits CNN, but CNN has only \"precautionary measure\" (told CNN on Thursday). The full phrase is in The Cyber Express, Newsweek (newsweek-php2shell-websites) and the Reuters factbox (reuters-factbox-websites-offline); cite those.", "severity": "medium", "claims": [ "wikimedia-precaution" ], "sources": [], "pages": [ "facts/wikimedia-precaution/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-30", "type": "finding", "status": "open", "title": "oxford: Quote is not in the cited source", "description": "oxfordchronicle-councils-offline (sha 35c84729...) does not contain the quoted words; only the collector's notes.md does. The words are in eadt-minister-budget-no-breach (sha 4c8556b5...), an embedded post signed \"Oxford City Council (@OxfordCity) October 21, 2026\". Cite that and change \"via Oxford Chronicle\"; impact.json also says Oxford Chronicle is \"quoting\" the councils' posts, which it is not.", "severity": "medium", "claims": [ "oxford" ], "sources": [], "pages": [ "facts/oxford/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-31", "type": "finding", "status": "open", "title": "uk-list: OBR is not in either cited source", "description": "Neither lbc-uk-websites-offline nor insurancebusiness-uk-councils-met mentions the Office for Budget Responsibility. It appears only in eadt-minister-budget-no-breach (PA), framing a question to the Scotland Secretary. Add that source or drop the OBR from this claim.", "severity": "medium", "claims": [ "uk-list" ], "sources": [], "pages": [ "facts/uk-list/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-32", "type": "finding", "status": "open", "title": "scale-70pc-websites: Cloudflare does cite its survey: the 70_ links to W3Techs", "description": "The claim note says 'None of the three cites the survey it comes from', numbers.json n-70-websites says 'Neither page names the survey', and a sections.json page says 'None of the pages that use it says how' it was measured. Cloudflare's rendered.html (capture 20261022T081216Z) hyperlinks '70% of websites' to https://w3techs.com/technologies/details/pl-php. The text.txt drops the link, which is likely why it was missed. OpenAI and Wiz do not cite a source.", "severity": "medium", "claims": [ "scale-70pc-websites" ], "sources": [], "pages": [ "facts/scale-70pc-websites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-33", "type": "finding", "status": "open", "title": "scale-70pc-websites: The claim drops the survey's population qualifier", "description": "W3Techs' figure, as relayed by Tenable (69.3%) and Imperva (over 69%), is a share of websites whose server-side language is known, not of all websites. 'used by almost 70% of websites' overstates the population. numbers.json n-70-websites 'measures' describes the population correctly; the claim text should match.", "severity": "medium", "claims": [ "scale-70pc-websites" ], "sources": [], "pages": [ "facts/scale-70pc-websites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-34", "type": "finding", "status": "open", "title": "scale-2.6m-hosts: 'of which' joins two different counters", "description": "The 2.6 million is VulnCheck's count; the 1.57 million unpatched is Censys's, out of the 2.58 million hosts Censys saw on 21 October (SecurityWeek). The same 'of which' framing recurs in questions.json and readings.json. Suggested wording: 'VulnCheck counts about 2.6 million; Censys saw 2.58 million on 21 October, of which 1.57 million were unpatched.'", "severity": "medium", "claims": [ "scale-2.6m-hosts" ], "sources": [], "pages": [ "facts/scale-2.6m-hosts/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-35", "type": "finding", "status": "open", "title": "scale-ncsc-nl: Confirmed: the inventory had 675 rows at cca173c64ec5, not 674; 4 not vulnerable, not 3", "description": "Counting table rows in raw/tree-cca173c64ec5/software/software_list_*.md gives 675 (Fix 46, Investigation 418, Vulnerable 206, Not vuln 4, blank 1). A fresh clone of raw/php2shell-cca173c64ec5.bundle (HEAD cca173c64ec5db92, 2026-10-22T10:40:58+02:00) gives the same 675 and its tree is identical to the vault's tree; the SPDX file software/spdx/PHP_Downstream_Inventory.spdx3.json has 675 software_Package elements and 4 NotAffected VEX relationships. The missing row is iBabs / iBabs bestuursportaal (Not vuln), in software_list_i.md, whose Links cell is empty, which is probably why the export parser skipped it. data/software.json (count 674, Not vuln 3) and raw/software-list-cca173c64ec5.json carry the error. This confirms BRIEF-CORRECTIONS.md v0.4.2.", "severity": "medium", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-36", "type": "finding", "status": "open", "title": "scale-ncsc-nl: Site data disagree on the inventory count", "description": "data/claims.json (scale-ncsc-nl), data/numbers.json n-674 ('674 ... 3 Not vulnerable, 1 without a status'), data/software.json (count 674), questions.json, sections.json and index.md ('reaches 674 products') say 674; data/inventory-history.json self_check says the parser 'also finds 1 row the vault missed: iBabs'. numbers.json n-674 agrees with the claim but both are wrong against the file.", "severity": "medium", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-37", "type": "finding", "status": "open", "title": "scale-ncsc-nl: The claim's status counts do not add up to its total", "description": "206 + 46 + 418 + 3 = 673, not 674. The 674th row is 'The PHP Group / PHP core and Zend Engine', an unversioned anchor with no status. numbers.json n-674 mentions it; the claim does not. Corrected: 675 rows: 206 vulnerable, 46 fixed, 418 under investigation, 4 not vulnerable, 1 PHP-core anchor without a status.", "severity": "medium", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-38", "type": "finding", "status": "open", "title": "disclosure-22oct: The BBC capture does not say the flaws were disclosed on 22 October", "description": "The claim's 'by' is 'BBC framing (UK morning coverage)', but the captured BBC live page (080559Z, and the 07:55Z raw copy) gives no disclosure date; it says details 'leaked online this week' and the patch 'has been rushed out'. Labelling a BBC statement 'contradicted' when the BBC did not make it misattributes. The '22 October' dates in the vault come from the original schedule (Foundation: 'from October 22nd, 14:00 UTC'), Wiz's thread ('Apply the Oct 22 security release') and ACSC's local time ('22 October 2026 at 0100 AEDT').", "severity": "medium", "claims": [ "disclosure-22oct" ], "sources": [], "pages": [ "facts/disclosure-22oct/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-39", "type": "finding", "status": "open", "title": "release-time: Three of the cited sources state a schedule, not a release time", "description": "php.net's pre-announcement and the oss-security relay say 'It is scheduled for ... 14:00 UTC'; CERT-FR says the publisher 'annonce la disponibilit_ des correctifs ... pour le 21 octobre 2026 _ 16h00 heure de Paris (14h00 UTC)'; the Foundation says it 'moved the release ... to October 21st, 14:00 UTC'. None of these observes the release. The 'by' line should read 'scheduled for 14:00 UTC' with Daubois as the one after-the-event statement.", "severity": "medium", "claims": [ "release-time" ], "sources": [], "pages": [ "facts/release-time/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-40", "type": "finding", "status": "open", "title": "preannounce-time: The Foundation's post gives two times for the pre-announcement", "description": "php-foundation-blog-security-release says 'published it at 19:30 UTC' and two paragraphs later 'the leak and pre-announcement around 20:00 UTC'. The note cites only the feed (20:32Z) and oss-security (20:22:51Z) against it; the source's own inconsistency should be shown.", "severity": "medium", "claims": [ "preannounce-time" ], "sources": [], "pages": [ "facts/preannounce-time/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-41", "type": "finding", "status": "open", "title": "fix-authored: Committer time is not the time a commit became public", "description": "3584a98bd's committer date is 2026-10-21T16:06:22+02:00 (14:06:22Z). Git records when the commit object was made, not when it was pushed; and the release tags (13:35:38 UTC, pointing at release commit 136e049 dated 2026-10-19) already shipped the fix before 14:06. Suggested wording: 'committed to the branch at 14:06 UTC'.", "severity": "medium", "claims": [ "fix-authored" ], "sources": [], "pages": [ "facts/fix-authored/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-42", "type": "finding", "status": "open", "title": "offline-ncsc: LBC carried the same NCSC sentence on 21 October, before the NCSC page was modified", "description": "lbc-uk-websites-offline (dated '21 Oct 2026, 15:41', written before the release: 'Full details ... have yet to be published') quotes the NCSC verbatim with the BBC's wording. The NCSC page captured at 08:09Z on 22 Oct has HTTP last-modified 07:30:02 GMT that morning. Two outlets, one of them hours earlier than the BBC, quoting the same sentence suggests an earlier NCSC version said it and was reworded. The note frames it as a BBC misquote whose opening 'matches the Canadian CCCS text'; it should mention LBC and the likely supersession. The quote is not in the NCSC capture, so A3 stands until an earlier NCSC version is captured.", "severity": "medium", "claims": [ "offline-ncsc" ], "sources": [], "pages": [ "facts/offline-ncsc/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-43", "type": "finding", "status": "open", "title": "offline-allies: Italy's ACN does advise taking sites offline; the site says it does not", "description": "acn-it-php2shell text.txt (sha 19fac2ed..., line 70): 'Qualora non fosse possibile applicare tempestivamente gli aggiornamenti di sicurezza, si raccomanda di valutare di porre offline i siti e i servizi web che utilizzano versioni vulnerabili di PHP, sospendendone l'accessibilit_ fino all'avvenuto aggiornamento.' The claim note ('Italy ... give[s] no offline advice'), data/agencies.json (IT: offline 'none', 'Update only') and the collector notes ('NO offline or isolation advice') are all wrong against the same capture. agencies.json's offline_text 'Si raccomanda di aggiornare i prodotti vulnerabili.' is also truncated: the sentence continues 'seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.'", "severity": "high", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-44", "type": "finding", "status": "open", "title": "offline-allies: The BBC capture does not make the claim the site marks 'contradicted'", "description": "BBC (06:30 post): 'The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.' The offline sentence is then attributed to the NCSC only; the NSA appears in a separate post. The site's claim merges these into the BBC saying all four advise offline, and then marks that 'contradicted'. A reader is told the BBC was wrong about something it did not say.", "severity": "high", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-45", "type": "finding", "status": "open", "title": "offline-allies: Australia is not-shown, not contradicted, and the EU part largely holds", "description": "ACSC's page lists other actions and no offline advice, but its body text is stale (pre-patch) and absence on one page is not a contradiction. For 'the EU', CERT-EU advises isolating internet-facing applications from public networks, CERT-FR recommends isolating affected equipment, ACN advises taking sites offline, and CERT.LV says systems that cannot be updated must have internet access restricted. Only NCSC-NL, ENISA's CNW page and JPCERT give no such advice.", "severity": "medium", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-46", "type": "finding", "status": "open", "title": "waf-nine-hours: 'Hours before disclosure' is shown only for Cloudflare, and Fortinet's date is after disclosure", "description": "The lead clause applies to all five vendors, but only Cloudflare states a time before the release. Imperva says protection was verified and monitoring began 'before the announcement' with no time; Akamai and Fastly posts are dated 21 October with no time; Fortinet's FortiWeb article was created 10/22/2026 07:55 AM (timezone not stated) and its signatures are 'in Alert Only mode' by default. Suggested: 'Cloudflare from 03:02 UTC on 21 October; Imperva before the announcement; Akamai and Fastly on 21 October; Fortinet signatures by 22 October.'", "severity": "medium", "claims": [ "waf-nine-hours" ], "sources": [], "pages": [ "facts/waf-nine-hours/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-47", "type": "finding", "status": "open", "title": "waf-nine-hours: The note's 'every vendor says ... patch anyway' is not carried for Fortinet", "description": "Cloudflare ('Customers should patch their PHP repos even with WAF protections'), Akamai ('The most effective defense continues to be the prompt application of vendor patches'), Fastly ('assume active mitigation will only serve as partial protection') and Imperva carry it. The Fortinet KB article gives signature and custom-rule steps and does not call them a stopgap or tell readers to patch.", "severity": "medium", "claims": [ "waf-nine-hours" ], "sources": [], "pages": [ "facts/waf-nine-hours/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-48", "type": "finding", "status": "open", "title": "rce-fpm: Status 'disputed' understates a claim the PHP advisory record carries; the dispute is about which CVE, not whether", "description": "GHSA-6wmf and openwall 2026/10/21/7 (PHP security team, CVE-2026-109619) both say unauthenticated RCE was demonstrated against PHP-FPM. Only the attribution to CVE-2026-109618 is in doubt. Suggest rewording to 'RCE is confirmed on PHP-FPM for CVE-2026-109619 (session upload progress path, needs a suitable application operation); for CVE-2026-109618 the advisory says no complete FPM exploit' and setting the status accordingly. Also cite openwall-oss-security-2026-10-21-7, which is in the manifest but not on this claim; the cited openwall 21/6 is the 109618 post and does not carry the claim.", "severity": "medium", "claims": [ "rce-fpm" ], "sources": [], "pages": [ "facts/rce-fpm/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-49", "type": "finding", "status": "open", "title": "rce-fpm: Glossary short text for PHP-FPM says 'whether a full exploit exists is disputed'", "description": "data/glossary.json (id fpm) short: 'Susceptible; whether a full exploit exists is disputed.' The PHP advisory GHSA-6wmf and oss-security 21/7 say FPM RCE was validated/demonstrated for CVE-2026-109619. The long text is accurate ('for the first flaw'); the short text misleads.", "severity": "medium", "claims": [ "rce-fpm" ], "sources": [], "pages": [ "facts/rce-fpm/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-50", "type": "finding", "status": "open", "title": "versions-old: 'from 5 onwards' is wider than the finder's '_= 5.4', and the 5.x sources look like echoes of the leak", "description": "Wiz (X post and blog) says 5.4 and later. NCSC-NL's text is the pre-patch banner ('vermoedelijk ... in ieder geval vanaf versie 5'), CERT-FR lists 'toutes versions 6.x' (PHP 6 never shipped; Daubois says watchTowr named 5, 6, 7 and 8), and The Hacker News says the HN leak claimed 'from PHP 5 onward'. These trace to one origin (A3 at most). Suggest the claim say '5.4 onwards per Wiz; PHP's backports imply 7.4 onwards'.", "severity": "medium", "claims": [ "versions-old" ], "sources": [], "pages": [ "facts/versions-old/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-51", "type": "finding", "status": "open", "title": "waf: Status 'disputed' understates: the sources agree a WAF is partial protection", "description": "CISA: 'may provide some protection'; BACS: 'alone is not sufficient'; Cloudflare: 'Customers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation.' These are the same position at different emphasis. Suggest 'confirmed' as CISA's advice, with the BACS and Cloudflare caveats in the note.", "severity": "medium", "claims": [ "waf" ], "sources": [], "pages": [ "facts/waf/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-52", "type": "finding", "status": "open", "title": "pocs-wrong: Huntress is cited but does not carry the claim", "description": "The Huntress capture says it had 'not built or reproduced a proof of concept' and was 'not aware of public exploit code as of this writing'; it says nothing about VulnCheck or a 200 response. The 'by' field names Huntress too. Remove it or cite what it actually says.", "severity": "medium", "claims": [ "pocs-wrong" ], "sources": [], "pages": [ "facts/pocs-wrong/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-53", "type": "finding", "status": "open", "title": "ac-high: Status 'confirmed' on a claim whose first half is a reading", "description": "'Triggering the bug is much easier than turning it into code execution' is Imperva's characterisation (verbatim, unquoted on the site). A reading caps at A3. Split the claim: the AC:H record is confirmed; the ease comparison should be shown as Imperva's reading (with Fastly agreeing).", "severity": "medium", "claims": [ "ac-high" ], "sources": [], "pages": [ "facts/ac-high/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-54", "type": "finding", "status": "open", "title": "more-paths: Missing context: the fix removed the OOM bailout itself, not only the demonstrated paths", "description": "The fix commit replaces bailout on OOM with UnwindExit and GHSA-w8hw says 'The patch removes longjmp() for OOM'. Fastly's point still applies to bailout on other fatal conditions (timeouts, uncaught errors), which GHSA-6wmf calls 'conditional', but a reader could take the claim to mean PHP only patched the demonstrated paths. Say which bailouts remain.", "severity": "medium", "claims": [ "more-paths" ], "sources": [], "pages": [ "facts/more-paths/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-55", "type": "finding", "status": "open", "title": "more-paths: Note leans on an unconfirmed report PHP reportedly rejected", "description": "'consistent with the Fediverse report of a third bug' cites the oss-security thread, which is an unnamed second-hand report, and the same thread says Canonical was told by PHP it is 'unrelated and not a real issue'. The thread does not carry Fastly's position and should not be cited as support.", "severity": "medium", "claims": [ "more-paths" ], "sources": [], "pages": [ "facts/more-paths/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-56", "type": "finding", "status": "open", "title": "ac-high: 2 smaller precision and sourcing points", "description": "Fastly quote drops the quotation marks around 'safe': Capture: 'most deployments may be _safe_ from RCE.' The site drops the scare quotes, which changes the tone: Fastly is hedging the word. | Imperva phrase used without attribution in the claim text: The claim's first clause is Imperva's sentence word for word; it should be quoted and attributed.", "severity": "low", "claims": [ "ac-high" ], "sources": [], "pages": [ "facts/ac-high/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-57", "type": "finding", "status": "open", "title": "affected-sites: 1 smaller precision and sourcing point", "description": "\"Online shops\" rests on the BBC alone and is vague: No capture names an online shop taken offline; the BBC capture otherwise mentions online shops only as platforms PHP powers. The University of Geneva item comes from an EPA photo alt text, not reporting text.", "severity": "low", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-58", "type": "finding", "status": "open", "title": "ahead-of-attackers: 1 smaller precision and sourcing point", "description": "Amazon's 17 October attempt is second-hand: The 17 October MadPot attempt is known only from CJ Moses 'in a post shared with The Hacker News'; no Amazon post is captured.", "severity": "low", "claims": [ "ahead-of-attackers" ], "sources": [], "pages": [ "facts/ahead-of-attackers/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-59", "type": "finding", "status": "open", "title": "ai-found: 2 smaller precision and sourcing points", "description": "'frontier' is not Calif's word: Calif writes 'No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery' and refers to an 'LLM companion'. 'Frontier AI' is Wiz's and OpenAI's language, not Calif's. | Calif's model is named only second-hand: That Calif used GPT-5.6 Sol rests on OpenAI's blocked blog (openai-blog-coordinated-disclosure text.txt is 0 bytes) and press relays (cybernews, wikipedia). Calif's own page names no model.", "severity": "low", "claims": [ "ai-found" ], "sources": [], "pages": [ "facts/ai-found/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-60", "type": "finding", "status": "open", "title": "amazon-honeypot: 2 smaller precision and sourcing points", "description": "'from multiple actors' is stated as fact; Amazon says 'suggesting': Amazon: 'The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors.' Use 'probably from multiple actors'. | Only one capture of Amazon's post, 21 hours after its date: The post is dated 21 Oct with no time; the single capture is 11:17Z on 22 Oct. The Hacker News (captured 08:13Z) already reports 'broad exploitation in the wild', so the sentence existed by then, but whether it was in the first version cannot be shown.", "severity": "low", "claims": [ "amazon-honeypot" ], "sources": [], "pages": [ "facts/amazon-honeypot/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-61", "type": "finding", "status": "open", "title": "cf-millions: 1 smaller precision and sourcing point", "description": "Name the missing method, and set against Imperva's pre-disclosure zero: Thousands of attempts in the 10 hours before announcement (Cloudflare) and no matching traffic in pre-disclosure monitoring (Imperva, claim imperva-none) are different populations and probably different signatures; the site should say so where both appear.", "severity": "low", "claims": [ "cf-millions" ], "sources": [], "pages": [ "facts/cf-millions/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-62", "type": "finding", "status": "open", "title": "chainguard: 1 smaller precision and sourcing point", "description": "Notification timing differs between relays: The Register: Lorenc 'notified the PHP coordinated disclosure channel about his plans' (before). Feross: 'he notified the group right after making the call'. Feross's post ID 2113043398664015878 decodes to 2026-10-21T23:02:59Z, so the source's published '2026-10-22' is off by a day in UTC.", "severity": "low", "claims": [ "chainguard" ], "sources": [], "pages": [ "facts/chainguard/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-63", "type": "finding", "status": "open", "title": "cisa-none: 1 smaller precision and sourcing point", "description": "KEV fetch time is 08:16Z, and the catalog version is from 14:04Z on 21 Oct: The note says fetched 2026-10-22T08:15Z; the saved response headers say date Thu, 22 Oct 2026 08:16:01 GMT. The catalog itself (last-modified 21 Oct 14:04:39 GMT) predates the alert's likely release and is only 16 minutes after CVE publication (13:48Z), so 'not in KEV' is a check at 08:16Z on 22 Oct of a catalog last changed 14:04Z on 21 Oct. Re-check KEV on each run.", "severity": "low", "claims": [ "cisa-none" ], "sources": [], "pages": [ "facts/cisa-none/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-64", "type": "finding", "status": "open", "title": "cloudflare-traffic: 1 smaller precision and sourcing point", "description": "Timing 'after the leak' and exploitation.json's '2026-10-20 to 21' are inferred: Cloudflare does not date the traffic; its sentence ties it to the leak only by 'while'. Volumes do exist from the same party (claim cf-millions, Prince on X), so 'no volumes' is true only of this post; cross-link.", "severity": "low", "claims": [ "cloudflare-traffic" ], "sources": [], "pages": [ "facts/cloudflare-traffic/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-65", "type": "finding", "status": "open", "title": "cvss-10: 1 smaller precision and sourcing point", "description": "CVE records are the refuting primary but are not cited on this claim: The refutation rests on the PHP Foundation blog and Daubois; the CVE records cve-cve-2026-109618 and cve-cve-2026-109619 (CVSS 4.0 9.2) are the authoritative refutation and could be cited. The vault's own claim file (claude-story-site.json) records this claim as 'disputed' while the site says 'contradicted'; the site's word is the better fit.", "severity": "low", "claims": [ "cvss-10" ], "sources": [], "pages": [ "facts/cvss-10/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-66", "type": "finding", "status": "open", "title": "disclosure-22oct: 1 smaller precision and sourcing point", "description": "CVE records named in the note are not cited: The note gives CVE record times 13:48Z and 13:54Z; they are carried by cve-cve-2026-109618 and cve-cve-2026-109619 raw/cveawg-api.json (datePublished), which the claim does not cite.", "severity": "low", "claims": [ "disclosure-22oct" ], "sources": [], "pages": [ "facts/disclosure-22oct/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-67", "type": "finding", "status": "open", "title": "edinburgh: 2 smaller precision and sourcing points", "description": "\"Late on 21 October\" is looser than the source: The Scotsman says the site went down \"late on Wednesday afternoon\"; the Edinburgh Evening News version was published 17:24 BST with the site already down, so the outage began before about 16:24Z. \"Late on 21 October\" suggests the evening. | Site was back by 08:19Z on 22 Oct: The council's own homepage returned HTTP 200 with normal content at 08:19:03Z (edinburgh-council-site) and 08:19:40Z (uk-edinburgh-council). impact.json says \"Website offline\" with no end; the down period itself has no operator capture.", "severity": "low", "claims": [ "edinburgh" ], "sources": [], "pages": [ "facts/edinburgh/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-68", "type": "finding", "status": "open", "title": "fi-offline: 2 smaller precision and sourcing points", "description": "Two start times in the same sources: Helsinki Times gives 12:45 for restricting traffic but also says Naumanen told STT \"the shutdown process had begun shortly after 1 pm\"; Yle says the same. The timeline row (09:45Z, confidence \"inferred\") should note that 12:45 is the restriction start per Helsinki Times only. | Yle and Helsinki Times are not fully independent: Yle's piece is bylined \"Yle News / STT\" and Helsinki Times also relies on STT for Naumanen; only Helsinki Times carries 12:45. The Valtori site capture (fi-valtori) failed (\"Target page, context or browser has been closed\"), so there is no operator capture.", "severity": "low", "claims": [ "fi-offline" ], "sources": [], "pages": [ "facts/fi-offline/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-69", "type": "finding", "status": "open", "title": "fix-authored: 2 smaller precision and sourcing points", "description": "Other sources name different fix commits: Daubois's blog gives 'final commit 01a40e89fbfc authored 2026-10-18'; the collector notes record that rjmendez's repository names 82f8f31b16a. The authored day agrees (18 October), but the hashes are not reconciled with 3584a98bd (possibly the PR head or a per-branch cherry-pick). | raw/commit-3584a98bd.NEWS.diff is an empty file: Its SHA256SUMS entry is e3b0c442...b855, the hash of zero bytes. The NEWS entry (a34a205c2) appears only in the merge-path listing. The cited github-php-src-tag-php-8.5.12 capture carries none of the fix's times.", "severity": "low", "claims": [ "fix-authored" ], "sources": [], "pages": [ "facts/fix-authored/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-70", "type": "finding", "status": "open", "title": "fix-bailout: 1 smaller precision and sourcing point", "description": "ChangeLog dates the four releases 22 Oct 2026, a day after the release: php-net-changelog-8 lists 'Version 8.5.12 / 22 Oct 2026' (and the same for 8.4.27, 8.3.36, 8.2.35) although php.net and the Foundation say they shipped 21 Oct. Not a problem for this claim, but any page that dates the fix from the ChangeLog would be a day off.", "severity": "low", "claims": [ "fix-bailout" ], "sources": [], "pages": [ "facts/fix-bailout/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-71", "type": "finding", "status": "open", "title": "fix-engine: 3 smaller precision and sourcing points", "description": "'globals that survive a failed request' is narrower than the advisory: GHSA-6wmf: besides a fatal error, 'A warning or other nonfatal diagnostic can also repopulate error state after that state was already cleared during shutdown'. Stale state can survive a request that did not fail. | Three different fix-commit hashes across sources: The vault reads 3584a98bd (Arnaud Le Blanc, authored 2026-10-18T17:26:39+02:00); Daubois gives 'final commit 01a40e89fbfc authored 2026-10-18'; rjmendez gives 82f8f31b16a. Probably per-branch commits, but nothing in the vault reconciles them. Daubois also says 'The fix touches 390 files' where the site counts 389. | github-php-src-fix-commit-3584a98bd has no captures/ entry, and its NEWS.diff is empty: fc.py extract reports no text capture for this source; the evidence is raw/ git output with SHA256SUMS. raw/commit-3584a98bd.NEWS.diff has sha256 e3b0c442...b855, the hash of an empty file.", "severity": "low", "claims": [ "fix-engine" ], "sources": [], "pages": [ "facts/fix-engine/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-72", "type": "finding", "status": "open", "title": "fix-incomplete: 1 smaller precision and sourcing point", "description": "Note's quote drops the inner quotation marks and spans a line break: The capture (21/23) reads: was told that it's \"unrelated and not a real issue\". The site writes 'was told that it's unrelated and not a real issue', merging Rainbolt's words with the words he attributes to PHP. Restore the inner quotes so the reader sees which words are PHP's (as relayed).", "severity": "low", "claims": [ "fix-incomplete" ], "sources": [], "pages": [ "facts/fix-incomplete/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-73", "type": "finding", "status": "open", "title": "four-reporters: 2 smaller precision and sourcing points", "description": "CVE records credit three parties, not four: The cve.org records (CNA: PHP Group) credit 'Ryan at Calif.io', 'Wiz' and 'OpenAI' (finder on 109618, reporter on 109619) and omit tomash-areion. The site could say the advisories credit four and the CVE records three. | Affiliations are inferred: The advisories give handles only. The bracketed affiliations are reasonable but come from other pages; tomash-areion's affiliation is unknown. The note's 'appears nowhere else on this beat' should except Daubois, who repeats the advisory credits.", "severity": "low", "claims": [ "four-reporters" ], "sources": [], "pages": [ "facts/four-reporters/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-74", "type": "finding", "status": "open", "title": "gov-patch-required: 1 smaller precision and sourcing point", "description": "Status 'reported' understates a statement carried by NSA's own release; the wording should keep it NSA's: The claim drops 'are serious enough to' and, read without its 'by' line, sounds like a mandate. Suggested: 'NSA says the risks are serious enough to require immediate patching across US Government departments and agencies' with status confirmed (that NSA said it).", "severity": "low", "claims": [ "gov-patch-required" ], "sources": [], "pages": [ "facts/gov-patch-required/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-75", "type": "finding", "status": "open", "title": "imperva-none: 1 smaller precision and sourcing point", "description": "Population and window should be in the claim: Imperva's negative is about its customer traffic and 'the monitored' patterns, over an undated window ending at disclosure. Cloudflare (thousands of attempts before announcement) and Amazon (17 Oct and 02:00Z attempts) saw pre-disclosure activity elsewhere; say 'Imperva customer traffic' to avoid an apparent contradiction.", "severity": "low", "claims": [ "imperva-none" ], "sources": [], "pages": [ "facts/imperva-none/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-76", "type": "finding", "status": "open", "title": "kev-precedent: 1 smaller precision and sourcing point", "description": "'after one day' is about 18 hours, and the catalog checked is the 14:04Z 21 Oct version: CVE-2026-109618 published 2026-10-21T13:48Z; KEV fetched 2026-10-22T08:16Z (catalog last-modified 21 Oct 14:04Z). Say 'not in KEV at 08:16 UTC on 22 October'.", "severity": "low", "claims": [ "kev-precedent" ], "sources": [], "pages": [ "facts/kev-precedent/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-77", "type": "finding", "status": "open", "title": "latvia-offline: 1 smaller precision and sourcing point", "description": "Translations and UTC conversion are the site's own: The source is in Latvian; \"restored by 20:00 UTC\" is the site's conversion of the 23:00 local update stamp. Correct, but should be marked as this site's conversion. The latvija.gov.lv capture from outside Latvia failed with net::ERR_CERT_COMMON_NAME_INVALID at 08:19:39Z on 22 Oct, consistent with, but not proof of, the foreign-access restriction.", "severity": "low", "claims": [ "latvia-offline" ], "sources": [], "pages": [ "facts/latvia-offline/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-78", "type": "finding", "status": "open", "title": "leak-cve-ids: 1 smaller precision and sourcing point", "description": "Duplicate slugs for one page: php-foundation-blog-security-release and phpfoundation-blog-security-release-leak are the same URL captured 3 minutes apart (only the embedded Reddit vote counts differ). Citing both suggests two sources.", "severity": "low", "claims": [ "leak-cve-ids" ], "sources": [], "pages": [ "facts/leak-cve-ids/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-79", "type": "finding", "status": "open", "title": "leak-hn: 3 smaller precision and sourcing points", "description": "Screenshot 'came down' not carried: Daubois: 'A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down the same way.' Only the video is said to have come down. Also Daubois writes 'Calif.IO', not 'Calif.io'. | Note's quote of The Hacker News is not verbatim: The capture reads 'a proof-of-concept (PoC) exploit leaked ahead of time'; the note drops '(PoC)'. The Foundation's phrase is capitalised 'No technical details leaked.' in the source. | Uncited corroboration available: Huntress, CybelAngel and Equixly (all in the manifest) independently describe the removed Hacker News post; citing them would lift this above a single personal blog.", "severity": "low", "claims": [ "leak-hn" ], "sources": [], "pages": [ "facts/leak-hn/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-80", "type": "finding", "status": "open", "title": "leak-video: 1 smaller precision and sourcing point", "description": "Calif has not acknowledged the video in any capture: Calif's page embeds two demo videos and its timeline omits any leak. The deleted video is not in the vault.", "severity": "low", "claims": [ "leak-video" ], "sources": [], "pages": [ "facts/leak-video/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-81", "type": "finding", "status": "open", "title": "leak-watchtowr: 1 smaller precision and sourcing point", "description": "watchTowr's post is not captured: CERT-EU gives the URL (x.com/watchtowrcyber/status/2112611507749982605, decoded 2026-10-20T18:26:48Z) but the vault has no capture; watchtowr-php2shell and watchtowr-php2shell-faq are 403. CybelAngel and Huntress carry it and are not cited.", "severity": "low", "claims": [ "leak-watchtowr" ], "sources": [], "pages": [ "facts/leak-watchtowr/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-82", "type": "finding", "status": "open", "title": "lorenc-ai-found: 1 smaller precision and sourcing point", "description": "Should read as Lorenc's claim: The claim text states the finding as fact; the evidence is Lorenc's account as paraphrased by The Register ('independently found' is the reporter's wording). Prefix with 'Lorenc says'. 'Independently' also sits oddly with having been told by a researcher that 'something was coming in PHP'.", "severity": "low", "claims": [ "lorenc-ai-found" ], "sources": [], "pages": [ "facts/lorenc-ai-found/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-83", "type": "finding", "status": "open", "title": "most-severe: 1 smaller precision and sourcing point", "description": "OpenAI's wording differs between X post and press: The note's OpenAI quote matches the X post ('vulnerabilities'); the BBC and The Hacker News quote 'one of the most impactful security issues in recent memory', presumably from the blocked blog.", "severity": "low", "claims": [ "most-severe" ], "sources": [], "pages": [ "facts/most-severe/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-84", "type": "finding", "status": "open", "title": "nl-offline: 2 smaller precision and sourcing points", "description": "The phrasing mirrors Insurance Business, which does not list Overheid.nl: The claim's structure (\"took its own site offline as a precaution, as did ...\") matches Insurance Business, whose list is DigiD, MijnOverheid, the House of Representatives, Port of Rotterdam, KNVB and hospitals. Overheid.nl comes from Reuters (RTE, factbox; Mashable and Wikipedia cite Reuters), one origin. | Restoration not recorded: ncsc.nl (08:19:19Z) and overheid.nl (08:19:27Z) both returned HTTP 200 with normal content on 22 Oct; BBC says the Dutch cyber agency \"is now running again\". impact.json gives no end time.", "severity": "low", "claims": [ "nl-offline" ], "sources": [], "pages": [ "facts/nl-offline/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-85", "type": "finding", "status": "open", "title": "no-confirmed-compromise: 2 smaller precision and sourcing points", "description": "CISA KEV snapshot predates the patch release: The KEV file was fetched 08:16Z on 22 Oct but its catalogVersion 2026.10.21 was released 14:04:39Z on 21 Oct, minutes after the 14:00Z PHP release, so the absence of CVE-2026-109618/109619 says little. KEV also records exploitation, not a named victim. There is no text capture: the evidence is raw/known_exploited_vulnerabilities.20261022T0816Z.json (sha ef8fffed...). | Timeline says CERT.LV saw attempts \"none successful\": timeline.json (20:00Z event) says \"automated attempts seen, none successful\"; CERT.LV says only that there are no reports of successful attacks so far (\"l_dz _im nav zi_u par sekm_giem uzbrukumiem\"). Same nuance as this claim: absence of reports, not a finding of none.", "severity": "low", "claims": [ "no-confirmed-compromise" ], "sources": [], "pages": [ "facts/no-confirmed-compromise/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-86", "type": "finding", "status": "open", "title": "nz-active: 2 smaller precision and sourcing points", "description": "'The only agency saying so' needs a precise qualifier: Note (and agencies.json) say NCSC NZ is the only agency saying so. True for 'active exploitation', but CERT.LV, a national CERT, says automated exploitation attempts were already detected in Latvia (21 Oct, 23:00 local). Say 'the only agency to report active exploitation; CERT.LV reports attempts'. | Cannot tell whether the sentence was in the 9:15am original or the 10:20am update: The capture (08:17Z, 22 Oct) shows the page after its 10:20am NZDT update; only the platforms paragraph is marked as updated, so the sentence is probably original, but one capture cannot show it.", "severity": "low", "claims": [ "nz-active" ], "sources": [], "pages": [ "facts/nz-active/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-87", "type": "finding", "status": "open", "title": "offline-allies: 1 smaller precision and sourcing point", "description": "acn-it-php2shell is flagged primary=false: It is the Italian national cyber agency's own alert (AL07/261021/CSIRT-ITA) on acn.gov.it, which makes it a primary source for Italy's advice.", "severity": "low", "claims": [ "offline-allies" ], "sources": [], "pages": [ "facts/offline-allies/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-88", "type": "finding", "status": "open", "title": "offline-cisa: 1 smaller precision and sourcing point", "description": "The paraphrase drops 'until they can be patched or updated': CISA's advice is time-bound ('offline until they can be patched or updated'). Without it, the claim reads as permanent removal.", "severity": "low", "claims": [ "offline-cisa" ], "sources": [], "pages": [ "facts/offline-cisa/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-89", "type": "finding", "status": "open", "title": "offline-ncsc: 1 smaller precision and sourcing point", "description": "CyberExpress is a copy of the BBC paragraph, not a third witness: cyberexpress-php2shell-gov-sites reproduces the BBC's sentence about the NCSC and its EU and Australian counterparts almost word for word, with US spelling ('organizations').", "severity": "low", "claims": [ "offline-ncsc" ], "sources": [], "pages": [ "facts/offline-ncsc/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-90", "type": "finding", "status": "open", "title": "openai-same-day: 1 smaller precision and sourcing point", "description": "OpenAI's own framing differs from 'independently, same day': Cybernews relays OpenAI: 'Calif used GPT-5.6 Sol to investigate the flaw. OpenAI's own researcher subsequently identified additional flaws'. The Foundation says OpenAI independently reported the same root cause on 11 August. Both may be true (same root cause on day one, more vectors on 18 September), but the site should show OpenAI's own framing.", "severity": "low", "claims": [ "openai-same-day" ], "sources": [], "pages": [ "facts/openai-same-day/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-91", "type": "finding", "status": "open", "title": "pocs-wrong: 2 smaller precision and sourcing points", "description": "Note overstates The Hacker News: THN says 'the public exploit code going around has not been shown to work', not that it has the wrong mechanism. | Fastly implies existing PoCs can yield code execution: Fastly: 'the existing PoCs require knowledge of the specific, running PHP binary and address space layout on the server for an attack to yield code execution on x86_64'. This reads as PoCs that work given layout knowledge, in tension with 'none has the correct mechanism' unless the populations differ (researcher PoCs vs leaked public ones). The note should say which.", "severity": "low", "claims": [ "pocs-wrong" ], "sources": [], "pages": [ "facts/pocs-wrong/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-92", "type": "finding", "status": "open", "title": "preannounce-time: 1 smaller precision and sourcing point", "description": "The feed's 20:32Z is not a competing publication time: Alan Coopersmith's oss-security message quoting the php.net archive URL is dated 20:22:51Z, ten minutes before the feed's 2026-10-20T20:32:00+00:00>, so the feed timestamp is an authoring or rebuild time. The dispute is between 19:30 and 'around 20:00', both earlier than 20:22:51Z.", "severity": "low", "claims": [ "preannounce-time" ], "sources": [], "pages": [ "facts/preannounce-time/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-93", "type": "finding", "status": "open", "title": "probing: 1 smaller precision and sourcing point", "description": "'Both companies have since said so' gets the order wrong: Both posts are dated 21 October; Woodward spoke on Radio 4 at 06:44 UTC on 22 October (post datePublished 06:44:49Z). The companies said it first.", "severity": "low", "claims": [ "probing" ], "sources": [], "pages": [ "facts/probing/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-94", "type": "finding", "status": "open", "title": "quarkslab-2024: 1 smaller precision and sourcing point", "description": "Note: Cloudflare is not alone in listing Quarkslab: The note says 'Cloudflare lists Quarkslab among the 2026 disclosers; nobody else does'. Imperva's capture (in the manifest) also says 'Reported by: Calif, Wiz, OpenAI, and Quarkslab.'", "severity": "low", "claims": [ "quarkslab-2024" ], "sources": [], "pages": [ "facts/quarkslab-2024/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-95", "type": "finding", "status": "open", "title": "quarkslab-redacted: 1 smaller precision and sourcing point", "description": "Status 'reported' understates a counted record: The count is checkable on Quarkslab's own page (A6). Status could be 'confirmed'. Note that 'does not describe' cannot rule out that a redacted item (HIGH-1, CVE-2024-8928, or MED-2) relates to the OOM issue.", "severity": "low", "claims": [ "quarkslab-redacted" ], "sources": [], "pages": [ "facts/quarkslab-redacted/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-96", "type": "finding", "status": "open", "title": "rce-fpm: 1 smaller precision and sourcing point", "description": "Claim omits that the validated FPM path is application-dependent: GHSA-6wmf: 'It works with a normal dynamic FPM pool, although it depends on a suitable application operation.' The bare claim reads as if FPM is exploitable as generically as mod_php.", "severity": "low", "claims": [ "rce-fpm" ], "sources": [], "pages": [ "facts/rce-fpm/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-97", "type": "finding", "status": "open", "title": "rce-modphp: 1 smaller precision and sourcing point", "description": "'default settings' is broader than the advisory's wording, and the claim does not name the CVE: GHSA-w8hw says 'default PHP input and memory limits and normal prefork configurations with multiple workers', and adds that 'Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout'. The before-application-code path is CVE-2026-109618 specifically; naming it would stop readers transferring it to CVE-2026-109619, whose confirmed mod_php case needs fatal_error_backtraces (PHP 8.5).", "severity": "low", "claims": [ "rce-modphp" ], "sources": [], "pages": [ "facts/rce-modphp/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-98", "type": "finding", "status": "open", "title": "release-moved: 1 smaller precision and sourcing point", "description": "Release actually shipped before 14:00 UTC; story.json says 'at 14:00 UTC': The schedule was 14:00 UTC, but the GHSAs show 13:34Z, Wiz posted at 13:32:25Z (decoded), CERT-EU says '13:30 UTC' and CybelAngel 'about 13:35 UTC'. story.json's lead says 'On 21 October 2026 at 14:00 UTC the PHP project released fixes'. The claim (schedule moved) is right; the lead sentence is not.", "severity": "low", "claims": [ "release-moved" ], "sources": [], "pages": [ "facts/release-moved/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-99", "type": "finding", "status": "open", "title": "release-time: 1 smaller precision and sourcing point", "description": "CERT-EU's 13:30 UTC matches no captured artifact: The earliest public artifacts are GHSA-6wmf at 13:34:13Z and GHSA-w8hw at 13:34:25Z, tags at 13:35:38 UTC. CERT-EU's 13:30 may be a rounding; its own publication time '15:20:18' has no timezone.", "severity": "low", "claims": [ "release-time" ], "sources": [], "pages": [ "facts/release-time/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-100", "type": "finding", "status": "open", "title": "scale-2.6m-hosts: 1 smaller precision and sourcing point", "description": "No scanner's own publication is captured; methods are not stated: VulnCheck, Censys, VirusTotal and Unit 42 figures all come through news outlets. numbers.json n-censys 'measures' ('Hosts whose HTTP response announces a PHP version below the fixed one') is a reasonable inference but no capture states Censys's method. gist-silascutler-censys-query holds only a Censys search URL.", "severity": "low", "claims": [ "scale-2.6m-hosts" ], "sources": [], "pages": [ "facts/scale-2.6m-hosts/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-101", "type": "finding", "status": "open", "title": "scale-30m: 1 smaller precision and sourcing point", "description": "Only one outlet, no basis, no original audio: No other vault capture repeats the 30 million figure. The BBC summary paraphrases it as 'around 30 million websites ... one expert tells the BBC'. Woodward's own words are from a Radio 4 interview that is not captured.", "severity": "low", "claims": [ "scale-30m" ], "sources": [], "pages": [ "facts/scale-30m/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-102", "type": "finding", "status": "open", "title": "scale-70pc-internet: 1 smaller precision and sourcing point", "description": "The BBC's quoted Wiz words 'roughly 70%' are not in either Wiz capture: The BBC puts \"roughly 70%\" in quotation marks as Wiz's estimate. Wiz's blog says 'affecting 70% of the Internet' (headline) and 'powers 70% of all websites in the world' (body); the X post says 'impacting 70% of the Internet'. The word 'roughly' is the BBC's. The claim text adopts 'Roughly' and attributes it to Wiz; it should either drop 'Roughly' or attribute the hedge to the BBC.", "severity": "low", "claims": [ "scale-70pc-internet" ], "sources": [], "pages": [ "facts/scale-70pc-internet/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-103", "type": "finding", "status": "open", "title": "scale-70pc-websites: 1 smaller precision and sourcing point", "description": "Outlets disagree on the W3Techs figure: about 69-70% versus about 75%: Tenable (69.3%), Imperva (over 69%) and Insurance Business (around 70%, 'W3Techs (August 2026)') against Reuters via RTE and ABC Australia ('roughly 75%' / 'about 75 per cent' of websites whose programming language can be identified). RTE and ABC are vault captures outside the site manifest. The difference may be a date or a different W3Techs measure; capturing W3Techs would settle it.", "severity": "low", "claims": [ "scale-70pc-websites" ], "sources": [], "pages": [ "facts/scale-70pc-websites/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-104", "type": "finding", "status": "open", "title": "scale-latvia: 1 smaller precision and sourcing point", "description": "Quoted 'potentially' is the site's translation, and 'public sector' renders 'valsts sektor_' (state sector): The note puts 'potentially' in quotation marks, but the capture is Latvian ('potenci_li'). Quoting a translation should be marked as a translation. 'valsts sektor_' is 'state sector'; 'public sector' is a fair gloss but not exact. numbers.json n-6000-lv also says this is 'the only one that says potentially', yet NCSC-NL's inventory title says 'potentially affected' too.", "severity": "low", "claims": [ "scale-latvia" ], "sources": [], "pages": [ "facts/scale-latvia/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-105", "type": "finding", "status": "open", "title": "scale-ncsc-nl: 1 smaller precision and sourcing point", "description": "The cited capture carries no counts: ncsc-nl-php2shell-software-list text.txt (sha 83f3aa60...) is the index page with letter links only. The counts rest on files under sources/ncsc-nl-php2shell/raw/, a source the claim does not cite (numbers.json n-674 does). The tree files are not listed in raw/SHA256SUMS; this desk verified them against the bundle, which is.", "severity": "low", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "facts/scale-ncsc-nl/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-106", "type": "finding", "status": "open", "title": "uk-list: 1 smaller precision and sourcing point", "description": "LBC and Insurance Business likely share an origin: The Bristol, Lambeth and Barnet sentence is almost word for word in both, and neither names its source for the list. Treat them as one origin. LBC was published 15:41 BST on 21 Oct, before the fix shipped.", "severity": "low", "claims": [ "uk-list" ], "sources": [], "pages": [ "facts/uk-list/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-107", "type": "finding", "status": "open", "title": "versions-old: 1 smaller precision and sourcing point", "description": "openwall-oss-security-109619-thread supports only 7.4+, not 5.x: The Greenbone reply carries 'at least versions down to 7.4'; it is cited as if it supports the 5.x statement.", "severity": "low", "claims": [ "versions-old" ], "sources": [], "pages": [ "facts/versions-old/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-108", "type": "finding", "status": "open", "title": "vibe-code: 1 smaller precision and sourcing point", "description": "The unnamed 'researchers' may be watchTowr; capture The Record and cite it: therecord-php-warnings (in the vault, not in data/sources.json) has watchTowr's Knott on AI-vibecoded PoC tools seen in the wild. Citing it would name a party; it still would not show the tool authors are criminals rather than researchers posting PoCs.", "severity": "low", "claims": [ "vibe-code" ], "sources": [], "pages": [ "facts/vibe-code/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-109", "type": "finding", "status": "open", "title": "waf: 1 smaller precision and sourcing point", "description": "Note says Cloudflare's rules 'blocked the traffic it saw'; the capture does not say that: Cloudflare says it 'successfully deployed multiple mitigations' and 'observed attack traffic targeting our customers', and that attackers mutated payloads to bypass. It does not state that all observed traffic was blocked.", "severity": "low", "claims": [ "waf" ], "sources": [], "pages": [ "facts/waf/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-110", "type": "finding", "status": "open", "title": "waf-nine-hours: 2 smaller precision and sourcing points", "description": "Cloudflare's 'about 9 hours ahead' does not match its own 03:02 UTC: From 03:02 UTC to the first public artifacts (13:34Z) or the scheduled 14:00 UTC is about 10.5 to 11 hours. The claim id says nine hours; the claim text does not. | Vendors differ on pre-disclosure attack traffic: Cloudflare says it 'observed attack traffic targeting our customers' before the release; Imperva says that during pre-disclosure monitoring it 'observed no traffic matching the monitored PHP2Shell exploit patterns'. Different networks and patterns, so this is probably measures-differently, but the site should not cite either as general.", "severity": "low", "claims": [ "waf-nine-hours" ], "sources": [], "pages": [ "facts/waf-nine-hours/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-111", "type": "finding", "status": "open", "title": "watchtowr-itw: 1 smaller precision and sourcing point", "description": "'Lists the flaws as exploited in the wild' rests only on search summaries: No capture shows a watchTowr listing; Equixly's pre-advisory page says the opposite at that time. Drop that half until a capture of watchTowr's page carries it.", "severity": "low", "claims": [ "watchtowr-itw" ], "sources": [], "pages": [ "facts/watchtowr-itw/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-112", "type": "finding", "status": "open", "title": "weirdgloop-13h: 2 smaller precision and sourcing points", "description": "94% is the operator's unaudited figure: No method is given for the 94% (it is \"about\" and credited to caching). Mark it as Weird Gloop's own figure. numbers.json carries it as a plain value \"94%\". | \"From cache\" and \"page views\" are paraphrase: The blog says \"about 94% of wiki pageviews serving correctly, even with no database or PHP running\" and credits \"very aggressive caching\"; it does not say all of them were served from cache. Also, impact.json's quote uses a straight apostrophe where the capture has U+2019 (\"we_ve\"): typographic only.", "severity": "low", "claims": [ "weirdgloop-13h" ], "sources": [], "pages": [ "facts/weirdgloop-13h/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-113", "type": "finding", "status": "open", "title": "who-first: 2 smaller precision and sourcing points", "description": "'the flaws' (plural) not shown: Calif reported its first bug on 11 August and 'the second bug' on 21 August; Wiz reported on 24 August and is listed first in the credits of GHSA-6wmf-4rv5-p3rp. Nothing captured shows which party first found CVE-2026-109619. | Hash pre-image unpublished: The tweet carries only a hex string. Its date is verified by the post ID decode (2026-08-05T15:54:24Z, matching the displayed '15:54 _ 5 Aug 2026'), but what it commits to cannot be checked.", "severity": "low", "claims": [ "who-first" ], "sources": [], "pages": [ "facts/who-first/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-114", "type": "finding", "status": "open", "title": "wikimedia-precaution: 2 smaller precision and sourcing points", "description": "\"other\" dropped from the paraphrase: The statement says \"a number of other systems\", after saying all Foundation-supported and volunteer-run PHP systems are affected; Mashable describes them as \"supporting tools\". The claim's \"a number of systems\" loses that nuance. | Restoration not recorded: wikimediastatus.net at 08:18:50Z on 22 Oct shows \"All Systems Operational\" (reading and editing). Insider Paper (via Mashable) says the status page had listed \"Emergency Maintenance\" on 21 Oct.", "severity": "low", "claims": [ "wikimedia-precaution" ], "sources": [], "pages": [ "facts/wikimedia-precaution/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-115", "type": "finding", "status": "open", "title": "wiz-independent: 2 smaller precision and sourcing points", "description": "Note's quote of the Wiz X post is not verbatim: The note quotes 'Wiz Research uncovers'; the capture reads '@wiz_io Research uncovers'. The note also says 'no credit to Calif or OpenAI': true of the lead post, but the same thread says 'Kudos to @GeminiApp, @php_net Core, @OpenAI, @calif_io'. Post ID 2112899813264277528 decodes to 2026-10-21T13:32:25Z, matching the displayed time. | 'the first flaw' is ambiguous: Wiz's 'the first PHP vulnerability' is Wiz's own first finding. Read on the site, 'the first flaw' can suggest Wiz found CVE-2026-109618 first, which the Calif and Foundation captures contradict. Use 'its first flaw'.", "severity": "low", "claims": [ "wiz-independent" ], "sources": [], "pages": [ "facts/wiz-independent/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-116", "type": "finding", "status": "open", "title": "wordpress-drupal: 2 smaller precision and sourcing points", "description": "'by' says Wiz for WordPress and Drupal; Wiz also confirms Joomla: Wiz's blog: 'achieved unauthenticated remote code execution on WordPress, Drupal and Joomla'. Joomla therefore also has two parties. | Eight of the eleven applications rest on Calif alone, and its demo video is not captured: MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS appear only in Calif's list; Calif gives versions (e.g. WordPress 7.1.2, Drupal 11.4.3) the claim omits.", "severity": "low", "claims": [ "wordpress-drupal" ], "sources": [], "pages": [ "facts/wordpress-drupal/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-117", "type": "finding", "status": "open", "title": "The site is 40 sources behind the evidence vault, and the missing ones change what it can say", "description": "The vault head is 31ccc515c29f with 184 source folders; data/sources.json has 144, exported at 200d08971937 (11:35 UTC), which is an ancestor of the head through the 12:06 UTC merge of the collectors' branches. The 40 not exported are 35 captures and 5 failed fetches, mostly by collector-news: Reuters (via RTE, Boursorama and a factbox), The Record, Global News, ABC Australia, BleepingComputer, Tagesspiegel/dpa, and captures of operators' own sites (UNIGE and EPFL, two French prefectures, ANTS, Edinburgh council, NCSC.nl, Overheid.nl, Wikimedia status). The impact checker used them: several operators the site does not list were down, and several it lists as down were back up by 08:19 UTC. Board 039 has asked for this re-export since v0.2; it is still not done. Every page footer names vault 200d08971937 as if it were the vault.", "severity": "high", "claims": [], "sources": [], "pages": [ "sources/index.html", "impact/index.html", "admin/vault/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-118", "type": "finding", "status": "open", "title": "data_vault.json lists five writing agents; the vault has a sixth, collector-news", "description": "collector-news wrote most of the 40 unexported sources (their source.json says added_by collector-news). The site's agent list and team page do not know it exists.", "severity": "low", "claims": [], "sources": [], "pages": [ "team/index.html", "admin/vault/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-119", "type": "finding", "status": "open", "title": "Front page: 'Websites on PHP 8.1 or older have no ready-made fix' is contradicted by the source it cites", "description": "data/plain.json, facts. The php.net advisory (php-net-advisory, cited) says: 'Some distributions and LTS vendors provide backported fixes, so contact your vendor for details'. The PHP project itself ships no release for 8.1 and older, and its minimal source backports for 7.4 to 8.1 are not packages; but distributions and LTS vendors do ship ready-made packages. Say: 'PHP itself has no release for 8.1 or older; your Linux distribution or LTS vendor may have one'.", "severity": "medium", "claims": [], "sources": [ "php-net-advisory" ], "pages": [ "index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-120", "type": "finding", "status": "open", "title": "Front page 'latest' still says the NCSC-NL list 'reaches 674 products'", "description": "BRIEF-CORRECTIONS.md (v0.4.2) records 675 rows at cca173c64ec5 (iBabs dropped by the vault's export). The front page's latest strip, from data/plain.json, still says 674. The correction says the data/software.json counts stay until the export is fixed (board 052); plain.json is hand-written and could carry 675 now.", "severity": "low", "claims": [ "scale-ncsc-nl" ], "sources": [], "pages": [ "index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-121", "type": "finding", "status": "open", "title": "NVD's CVSS 3.1 score of 9.8 is in the vault and nowhere on the site", "description": "The vault's raw NVD API captures (nvd-cve-2026-109618 and nvd-cve-2026-109619, raw/nvd-api-2.0.json) carry NIST's own CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) beside the vendor's CVSS 4.0 9.2; a fetch of the NVD API at 18:27 UTC on 22 October shows the same. No claim, number, glossary entry or page mentions 9.8. A reader or a scanner using CVSS 3.1 sees 9.8 and finds no explanation here. See K-007.", "severity": "medium", "claims": [], "sources": [ "nvd-cve-2026-109618", "nvd-cve-2026-109619" ], "pages": [ "flaws/index.html", "numbers/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Contradiction-7" } ] }, { "label": "Finding-122", "type": "finding", "status": "open", "title": "Front page 'Has anyone been hacked?' gives Amazon's honeypot hit but not Amazon's 'broadly exploited in the wild'", "description": "data/plain.json cards and facts say Amazon reports 'a decoy server was hit four days before the announcement'. Amazon's own post, in the vault (aws-security-blog-madpot), also says 'PHP2Shell is now being broadly exploited in the wild.' The front page is the most-read page and understates the strongest exploitation statement by a named party; it should carry Amazon's words and say what they rest on (its sensors) beside 'no confirmed break-in'. The coverage review flagged this; it is not yet done.", "severity": "medium", "claims": [ "amazon-honeypot" ], "sources": [ "aws-security-blog-madpot" ], "pages": [ "index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Contradiction-2" } ] }, { "label": "Finding-123", "type": "finding", "status": "open", "title": "The scheduled-capture brief attributes the Censys count to The Hacker News; the vault has it from SecurityWeek", "description": "admin/content/briefs/2026-10-22__brief__scheduled-capture-json-and-analysis.md, contradiction table: '1.57 million of about 2.6 million hosts unpatched on 21 October (Censys via The Hacker News)'. No Hacker News capture in the vault carries 1.57 million; securityweek-exploitation-days-before does, with a different denominator (K-004). The brief is the editor's and is not edited; this is a note for whoever builds on it.", "severity": "low", "claims": [], "sources": [], "pages": [ "admin/briefs/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Finding-124", "type": "finding", "status": "open", "title": "The BBC's 'roughly 70_' is not Wiz's wording", "description": "The BBC live page (bbc-live-ckgel5xp2xv9t, 08:05 UTC capture) puts 'roughly 70%' in quotation marks as Wiz's estimate. Wiz's blog and X post say '70% of all websites' and '70% of the Internet'; neither says 'roughly'. Anything on the site that quotes the BBC's phrase as Wiz's would be a quote of a quote.", "severity": "low", "claims": [ "scale-70pc-internet" ], "sources": [ "bbc-live-ckgel5xp2xv9t", "wiz-blog-php2shell" ], "pages": [], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [ { "verb": "relates-to", "to": "Contradiction-1" } ] }, { "label": "Finding-125", "type": "finding", "status": "open", "title": "Front page: 'the PHP project has not answered it publicly yet' has been out of date since 09:11 UTC on 22 October", "description": "data/plain.json, unknown: 'Whether the fix is complete. A report on 21 October suggested it may not be; the PHP project has not answered it publicly yet.' PHP's security team answered on oss-security at 09:11 UTC (2026/10/22/15): an unrelated crash bug of minimal impact, nothing to do with the RCE. It was true of the vault's capture, which stops before the reply; it is not true of the world. Capture the reply, then close or reword the question, and re-grade fix-incomplete (whose note says 'Nothing from PHP on the list at capture').", "severity": "high", "claims": [ "fix-incomplete" ], "sources": [], "pages": [ "index.html", "code/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-2", "links": [ { "verb": "relates-to", "to": "Contradiction-11" } ] }, { "label": "Gap-1", "type": "gap", "status": "open", "title": "affected-sites: Operators shown offline in the vault but absent from impact.json", "description": "EPFL own homepage at 08:19:13Z: \"Some EPFL websites are unavailable\" after a security alert (epfl-site). Canada: \"Some Government of Canada websites have been temporarily taken offline as a precaution\" (globalnews-ottawa-sites, AI Minister Evan Solomon). Australia: government sites including the ACSC pulled offline (abc-au-gov-sites-exposed, abc-au-politics-live; cyber.gov.au capture failed ERR_ABORTED). Switzerland: universities of Geneva and Fribourg, EPFL, Basel-Stadt canton (20min-fr-suisse-romande, letemps-php-sites-debranches). Germany: Laender, hospitals, universities still offline Thursday (tagesspiegel-dpa-noch-offline). Czech government site offline 17:00 GMT and Internet Archive (reuters-factbox-websites-offline). None of these are rows in impact.json.", "severity": "medium", "claims": [ "affected-sites" ], "sources": [], "pages": [ "facts/affected-sites/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Gap-2", "type": "gap", "status": "open", "title": "fix-incomplete: The Fediverse posts (fedi.katze.sh__elise) are not captured; the thread has no text capture", "description": "The source openwall-oss-security-109619-thread has only raw/ curl copies (no captures/ entry, no text.txt, no manifest sha for a text file). The origin posts 117479383739450605 and 117478655339557825 are not in the vault, so the claim rests on a relay of an unnamed person.", "severity": "medium", "claims": [ "fix-incomplete" ], "sources": [], "pages": [ "facts/fix-incomplete/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] }, { "label": "Gap-3", "type": "gap", "status": "open", "title": "pocs-wrong: VulnCheck's review is not captured; the claim rests on a relay", "description": "Only rjmendez's README reports VulnCheck's finding. None of the five vault captures that mention VulnCheck carries a PoC-mechanism review.", "severity": "medium", "claims": [ "pocs-wrong" ], "sources": [], "pages": [ "facts/pocs-wrong/index.html", "claims/index.html" ], "url": "", "retrieved_at": "", "sha256": "", "excerpt": "", "run": "Run-1", "links": [] } ], "runs": [ { "id": "Run-1", "site_version": "0.4.7", "vault_commit": "31ccc515c29f", "site_export_commit": "200d08971937", "started": "2026-10-22T18:14Z", "finished": "2026-10-22T18:55Z", "checked": "all 70 claims against the evidence vault (mode 1); the front page's plain-English facts; 10 contradictions; mode 2: CISA KEV, the CVE and NVD records, php.net releases, the NCSC-NL repository, the BBC live page, The Next Web, the PHPocalypse Tracker", "opened": "3 high, 56 medium and 65 low findings; 3 evidence gaps; 10 contradictions; 6 new evidence", "audit": "Every excerpt recorded (one per capture checked) was re-found verbatim in its capture file by fc.py check, and every capture's sha256 matched the manifest: 0 mismatches.", "summary": "First run. 10 of 70 claims can be relied on without reservation; 11 carry a status word stronger than their evidence, 6 a weaker one; 2 are refuted as worded (the CVSS 10.0 and 'disclosed on 22 October', which is true only in Australian time). Five quotes on the site are not in the captures they are attributed to. Highest: Italy's ACN does advise taking sites offline, which the agencies table says it does not; the 'contradicted' mark on the allies' offline advice rests on something the BBC did not say; and the site is 40 sources behind the vault. KEV still lists neither CVE at 18:27 UTC.", "note": "Checked against the claims as they stood at site v0.4.7; data/claims.json is unchanged in dev up to v0.5.3." }, { "id": "Run-2", "site_version": "0.5.7", "vault_commit": "31ccc515c29f", "site_export_commit": "200d08971937", "started": "2026-10-22T20:52Z", "finished": "2026-10-22T21:10Z", "checked": "fc.py changed (no claim changed since run 1, no source or agencies, exploitation, impact or front-page data changed, vault head unchanged); every open ticket against the current data (none fixed); mode 2: CISA KEV, the CVE and NVD records, php.net releases, the NCSC-NL repository head, the PHPocalypse Tracker, and the five oss-security posts newly referenced by the CVE-2026-109619 record", "opened": "1 high finding; 1 contradiction (K-011); 5 new evidence (1 high); 0 tickets closed", "audit": "fc.py check: 0 failures; every recorded excerpt re-found verbatim, every hash matching.", "summary": "Nothing on the site changed and none of run 1's 143 tickets can close yet. The world moved: the PHP security team answered the 'incomplete fix' report publicly at 09:11 UTC on 22 October (an unrelated crash bug, 'nothing to do with the RCE'), so the front page's 'PHP has not answered it publicly yet' is out of date; capture the reply (Evidence-7). KEV still lists neither CVE; no PHP release after 21 October; NVD now 'Analyzed'; the PHPocalypse Tracker has one site still dark." } ] }