{"about":"Every release commits the graph the build wrote, data/grc-graph.json. For each release whose graph differs from the release before, data/grc-history.json keeps what changed: the nodes and edges added and removed, the edges whose basis changed (inferred to confirmed, say), and the gaps opened and closed. The gaps are computed with today's rules (data/grc-gaps.json) over each release's graph, so two releases are always compared by the same yardstick. Any two releases can then be compared by replaying the changes between them, which the page does in the reader's browser.","releases":[{"version":"0.6.0","against":null,"nodes_added":["briefing:board","briefing:cfo","briefing:ciso","briefing:comms","briefing:cto","briefing:dpo","briefing:engineer","briefing:security","briefing:site-owner","claim:ac-high","claim:affected-sites","claim:ahead-of-attackers","claim:ai-found","claim:amazon-honeypot","claim:cf-millions","claim:chainguard","claim:cisa-none","claim:cloudflare-traffic","claim:cvss-10","claim:disclosure-22oct","claim:edinburgh","claim:fi-offline","claim:fix-bailout","claim:fix-engine","claim:fix-incomplete","claim:four-reporters","claim:huntress-none","claim:imperva-none","claim:kev-precedent","claim:latvia-offline","claim:leak-cve-ids","claim:leak-hn","claim:leak-mitigations","claim:leak-video","claim:leak-watchtowr","claim:lorenc-ai-found","claim:more-paths","claim:most-severe","claim:nl-offline","claim:no-confirmed-compromise","claim:nz-active","claim:offline-allies","claim:offline-cisa","claim:offline-ncsc","claim:offline-nsa","claim:only-update","claim:openai-same-day","claim:oxford","claim:pocs-wrong","claim:probing","claim:quarkslab-2024","claim:quarkslab-redacted","claim:rce-fpm","claim:rce-modphp","claim:release-moved","claim:scale-2.6m-hosts","claim:scale-30m","claim:scale-70pc-internet","claim:scale-70pc-websites","claim:scale-ncsc-nl","claim:two-cves-9.2","claim:uk-list","claim:versions-old","claim:vibe-code","claim:waf","claim:waf-nine-hours","claim:watchtowr-itw","claim:who-first","claim:wikimedia-precaution","claim:wiz-independent","claim:wordpress-drupal","code:file:Zend/zend_alloc.c","code:file:Zend/zend_execute_API.c","code:file:Zend/zend_hash.c","code:file:Zend/zend_string.c","code:file:Zend/zend_types.h","code:file:ext/session/session.c","code:file:main/SAPI.c","code:file:main/main.c","code:file:main/rfc1867.c","control:attack:T1190","control:attack:T1595.002","control:cis:13.10","control:cis:16.4","control:cis:2.2","control:cis:7.4","control:cis:7.7","control:cra:AnnexI.II","control:cra:Art.13","control:cra:Art.14","control:cra:Art.24","control:cyberessentials:FW","control:cyberessentials:SUM","control:dora:Art.10","control:dora:Art.11","control:dora:Art.19","control:dora:Art.28","control:dora:Art.8","control:euaiact:Art.15","control:euaiact:Art.50","control:euaiact:Art.55","control:gdpr:Art.24","control:gdpr:Art.28","control:gdpr:Art.32","control:gdpr:Art.33","control:gdpr:Art.34","control:gdpr:Art.5(1)(f)","control:iso27001:6.1.2","control:iso27001:A.5.14","control:iso27001:A.5.21","control:iso27001:A.5.24","control:iso27001:A.5.29","control:iso27001:A.5.30","control:iso27001:A.5.5","control:iso27001:A.5.7","control:iso27001:A.8.16","control:iso27001:A.8.20","control:iso27001:A.8.25","control:iso27001:A.8.29","control:iso27001:A.8.8","control:iso27001:A.8.9","control:iso29147:29147:coordination","control:iso29147:29147:receipt","control:iso29147:30111:handling","control:iso42001:6.1.2","control:iso42001:6.1.3","control:kev:BOD22-01","control:kev:KEV-entry","control:nis2:Art.12","control:nis2:Art.20","control:nis2:Art.21(2)(c)","control:nis2:Art.21(2)(d)","control:nis2:Art.21(2)(e)","control:nis2:Art.23","control:nist80053:CM-8","control:nist80053:CP-2","control:nist80053:IR-6","control:nist80053:RA-5","control:nist80053:SA-22","control:nist80053:SC-7","control:nist80053:SI-2","control:nist80053:SI-4","control:nistairmf:GOVERN-6.1","control:nistairmf:MANAGE-2.4","control:nistairmf:MEASURE-2.7","control:nistcsf:DE.CM-01","control:nistcsf:GV.RM-01","control:nistcsf:GV.RR-01","control:nistcsf:GV.SC-05","control:nistcsf:GV.SC-07","control:nistcsf:ID.AM-02","control:nistcsf:ID.RA-01","control:nistcsf:ID.RA-02","control:nistcsf:ID.RA-08","control:nistcsf:PR.PS-02","control:nistcsf:RC.RP-01","control:nistcsf:RS.CO-03","control:owasp:A03:2025","control:owasp:A06:2021","control:owasp:LLM01:2025","control:owasp:LLM02:2025","control:owasp:LLM06:2025","control:owasp:LLM09:2025","control:pcidss:12.10.1","control:pcidss:6.3.1","control:pcidss:6.3.3","control:pcidss:6.4.2","control:soc2:CC7.1","control:soc2:CC9.2","control:ssdf:PW.7","control:ssdf:PW.8","control:ssdf:RV.1","control:ssdf:RV.2","control:ssdf:RV.3","control:tlp:TLP:AMBER+STRICT","member:conductor","member:dev","member:dinis","member:grc","member:historian","member:journalist","member:story-site","member:verifier","page:admin/agents/index.html","page:affected/index.html","page:affected/software.html","page:agencies/index.html","page:briefings/comms/index.html","page:briefings/dpo/index.html","page:code/index.html","page:compromise/index.html","page:context/index.html","page:defence/index.html","page:discovery/index.html","page:exploitation/index.html","page:factcheck/index.html","page:flaws/index.html","page:impact/index.html","page:leak/index.html","page:method/index.html","page:numbers/index.html","page:patching/index.html","page:patching/inventory/index.html","page:playbook/index.html","page:review/index.html","page:signals/index.html","page:team/index.html","page:timeline/index.html","page:vaults/index.html","remediation:fix-bounded-parsing","remediation:fix-fallible","remediation:fix-hard-limit","remediation:fix-reset-globals","remediation:fix-soft-limit","remediation:fix-unwind","repo:.github/workflows/pages.yml","repo:admin/build/release.sh","repo:admin/build/security_check.py","repo:admin/build/validate.py","repo:admin/factcheck/fc.py","repo:admin/security/injection-allowlist.json","repo:data/claims.json","risk:r01","risk:r01-1","risk:r01-2","risk:r01-3","risk:r01-4","risk:r01-5","risk:r01-6","risk:r02","risk:r02-1","risk:r02-2","risk:r02-3","risk:r03","risk:r03-1","risk:r03-2","risk:r03-3","risk:r03-4","risk:r04","risk:r04-1","risk:r04-2","risk:r04-3","risk:r05","risk:r06","risk:r06-1","risk:r06-2","risk:r06-3","risk:r07","risk:r08","risk:r08-1","risk:r08-2","risk:r09","risk:r10","risk:r10-1","risk:r10-2","risk:r10-3","source:acn-it-php2shell","source:acsc-alert-php","source:akamai-blog-cve-2024-4577-one-day","source:akamai-blog-php-core-rce","source:aws-security-blog-madpot","source:bbc-live-ckgel5xp2xv9t","source:calif-php2shell","source:cccs-al26-026","source:certeu-sa-2026-018","source:certfr-2026-ale-014","source:certlv-php-preventive","source:ch-bacs-warnung-php","source:cisa-alert-php-20261021","source:cisa-kev-json","source:cloudflare-blog-php2shell-waf","source:cnn-php2shell-websites-shut","source:cve-cve-2024-4577","source:cve-cve-2026-109618","source:cve-cve-2026-109619","source:cyberexpress-php2shell-gov-sites","source:daubois-blog-php2shell-rumors","source:dutchitleaders-websites-offline","source:fastly-blog-php2shell","source:fortinet-fortiweb-php2shell","source:github-ghsa-6wmf-4rv5-p3rp","source:github-ghsa-w8hw-w9fx-j79w","source:github-php-src-branch-7.4-backport","source:github-php-src-fix-commit-3584a98bd","source:github-php-src-tag-php-8.5.12","source:github-rjmendez-phpup-2026","source:helsinkitimes-finland-shutdown","source:huntress-php2shell-rapid-response","source:imperva-blog-php2shell","source:insurancebusiness-uk-councils-met","source:jpcert-at260033","source:lbc-uk-websites-offline","source:ncsc-news-php","source:ncsc-nl-advisories","source:ncsc-nl-php2shell","source:ncsc-nl-php2shell-software-list","source:ncsc-nz-alert-php","source:nsa-press-php-4630238","source:nsa-x-2112903220209098897","source:openwall-oss-security-109619-thread","source:openwall-oss-security-2026-10-20-34","source:openwall-oss-security-2026-10-21-6","source:openwall-oss-security-2026-10-21-7","source:oxfordchronicle-councils-offline","source:php-foundation-blog-security-release","source:php-net-advisory","source:php-net-changelog-8","source:phpfoundation-blog-security-release-leak","source:quarkslab-blog-php-src-audit","source:recordedfuture-php2shell","source:rijksoverheid-ncsc-php-news","source:scotsman-edinburgh-council-offline","source:securityweek-exploitation-days-before","source:securityweek-first-attempts-sensors","source:substack-lopezkurtz-patch-is-the-exploit","source:thehackernews-php2shell-4days","source:theregister-php-blames-chainguard","source:watchtowr-php2shell","source:watchtowr-php2shell-faq","source:weirdgloop-blog-php2shell","source:wiz-blog-php2shell","source:x-eastdakota-php2shell-stats","source:x-feross-chainguard","source:x-lcfr-hax-hash-tweet","source:x-openai-php2shell","source:x-wiz-io-php2shell","source:yle-finland-government-sites-shut","stakeholder:agencies","stakeholder:app-vendors","stakeholder:board","stakeholder:calif","stakeholder:cfo","stakeholder:chainguard","stakeholder:ciso","stakeholder:commerce","stakeholder:comms","stakeholder:councils","stakeholder:critical-infra","stakeholder:cto","stakeholder:data-subjects","stakeholder:distributors","stakeholder:distros","stakeholder:dpo","stakeholder:edge","stakeholder:engineers","stakeholder:eu-agencies","stakeholder:finance","stakeholder:finders","stakeholder:hosting","stakeholder:inventory-suppliers","stakeholder:managed-hosts","stakeholder:media","stakeholder:national-gov","stakeholder:newsroom","stakeholder:newsroom-agents","stakeholder:newsroom-editor","stakeholder:non-profits","stakeholder:openai","stakeholder:operators","stakeholder:org-roles","stakeholder:oss-apps","stakeholder:panels","stakeholder:people","stakeholder:php-fix-authors","stakeholder:php-foundation","stakeholder:php-project","stakeholder:php-security-team","stakeholder:public-sector","stakeholder:quarkslab","stakeholder:readers","stakeholder:security-lead","stakeholder:service-users","stakeholder:shared-hosts","stakeholder:site-owner","stakeholder:threat-intel","stakeholder:uk-ncsc","stakeholder:us-agencies","stakeholder:waf-vendors","stakeholder:wiz","stakeholder:world","story:exposed-is-not-exploited","story:patch-at-the-speed-of-metasploit","story:php2shell-in-perspective","story:where-php2shell-stands","story:why-not-patch-every-version","treatment:r01-1.1","treatment:r01-2.1","treatment:r01-3.1","treatment:r01-3.2","treatment:r01-4.1","treatment:r01-4.2","treatment:r01-5.1","treatment:r01-6.1","treatment:r01.1","treatment:r01.2","treatment:r01.3","treatment:r02-1.1","treatment:r02-2.1","treatment:r02-3.1","treatment:r02.1","treatment:r03-1.1","treatment:r03-2.1","treatment:r03-3.1","treatment:r03-4.1","treatment:r03.1","treatment:r03.2","treatment:r04-1.1","treatment:r04-2.1","treatment:r04-3.1","treatment:r04.1","treatment:r04.2","treatment:r05.1","treatment:r06-1.1","treatment:r06-2.1","treatment:r06-3.1","treatment:r06.1","treatment:r07.1","treatment:r08-1.1","treatment:r08-2.1","treatment:r08.1","treatment:r09.1","treatment:r10-1.1","treatment:r10-2.1","treatment:r10-3.1","treatment:r10.1","treatment:r10.2","vulnerability:cve-109618","vulnerability:cve-109619","weakness:w-agent-reach","weakness:w-ai-dual-use","weakness:w-alloc-bailout","weakness:w-bailout-class","weakness:w-embargo","weakness:w-eol","weakness:w-headline","weakness:w-inventory","weakness:w-maintainer-capacity","weakness:w-signal","weakness:w-stale-globals","weakness:w-status-words","weakness:w-untrusted-text","weakness:w-waf-only"],"nodes_removed":[],"edges_added":[["claim:ac-high cites source:cve-cve-2026-109618","unrecorded"],["claim:ac-high cites source:fastly-blog-php2shell","unrecorded"],["claim:ac-high cites source:imperva-blog-php2shell","unrecorded"],["claim:affected-sites cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:ahead-of-attackers cites source:thehackernews-php2shell-4days","unrecorded"],["claim:ahead-of-attackers cites source:x-openai-php2shell","unrecorded"],["claim:ai-found cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:ai-found cites source:calif-php2shell","unrecorded"],["claim:ai-found cites source:wiz-blog-php2shell","unrecorded"],["claim:ai-found cites source:x-openai-php2shell","unrecorded"],["claim:amazon-honeypot cites source:aws-security-blog-madpot","unrecorded"],["claim:amazon-honeypot cites source:thehackernews-php2shell-4days","unrecorded"],["claim:cf-millions cites source:x-eastdakota-php2shell-stats","unrecorded"],["claim:chainguard cites source:php-foundation-blog-security-release","unrecorded"],["claim:chainguard cites source:theregister-php-blames-chainguard","unrecorded"],["claim:chainguard cites source:x-feross-chainguard","unrecorded"],["claim:cisa-none cites source:cisa-alert-php-20261021","unrecorded"],["claim:cisa-none cites source:cisa-kev-json","unrecorded"],["claim:cisa-none cites source:cve-cve-2026-109618","unrecorded"],["claim:cloudflare-traffic cites source:cloudflare-blog-php2shell-waf","unrecorded"],["claim:cvss-10 cites source:daubois-blog-php2shell-rumors","unrecorded"],["claim:cvss-10 cites source:php-foundation-blog-security-release","unrecorded"],["claim:disclosure-22oct cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:disclosure-22oct cites source:github-php-src-tag-php-8.5.12","unrecorded"],["claim:disclosure-22oct cites source:php-net-advisory","unrecorded"],["claim:edinburgh cites source:scotsman-edinburgh-council-offline","unrecorded"],["claim:fi-offline cites source:helsinkitimes-finland-shutdown","unrecorded"],["claim:fi-offline cites source:yle-finland-government-sites-shut","unrecorded"],["claim:fix-bailout cites source:github-ghsa-w8hw-w9fx-j79w","unrecorded"],["claim:fix-bailout cites source:github-php-src-branch-7.4-backport","unrecorded"],["claim:fix-bailout cites source:php-net-changelog-8","unrecorded"],["claim:fix-engine cites source:github-ghsa-6wmf-4rv5-p3rp","unrecorded"],["claim:fix-engine cites source:github-ghsa-w8hw-w9fx-j79w","unrecorded"],["claim:fix-engine cites source:github-php-src-fix-commit-3584a98bd","unrecorded"],["claim:fix-incomplete cites source:openwall-oss-security-109619-thread","unrecorded"],["claim:four-reporters cites source:daubois-blog-php2shell-rumors","unrecorded"],["claim:four-reporters cites source:github-ghsa-6wmf-4rv5-p3rp","unrecorded"],["claim:four-reporters cites source:github-ghsa-w8hw-w9fx-j79w","unrecorded"],["claim:huntress-none cites source:huntress-php2shell-rapid-response","unrecorded"],["claim:imperva-none cites source:imperva-blog-php2shell","unrecorded"],["claim:kev-precedent cites source:akamai-blog-cve-2024-4577-one-day","unrecorded"],["claim:kev-precedent cites source:cisa-kev-json","unrecorded"],["claim:kev-precedent cites source:cve-cve-2024-4577","unrecorded"],["claim:latvia-offline cites source:certlv-php-preventive","unrecorded"],["claim:leak-cve-ids cites source:php-foundation-blog-security-release","unrecorded"],["claim:leak-cve-ids cites source:phpfoundation-blog-security-release-leak","unrecorded"],["claim:leak-hn cites source:daubois-blog-php2shell-rumors","unrecorded"],["claim:leak-mitigations cites source:php-foundation-blog-security-release","unrecorded"],["claim:leak-video cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:leak-video cites source:calif-php2shell","unrecorded"],["claim:leak-video cites source:php-foundation-blog-security-release","unrecorded"],["claim:leak-video cites source:phpfoundation-blog-security-release-leak","unrecorded"],["claim:leak-watchtowr cites source:certeu-sa-2026-018","unrecorded"],["claim:leak-watchtowr cites source:daubois-blog-php2shell-rumors","unrecorded"],["claim:lorenc-ai-found cites source:theregister-php-blames-chainguard","unrecorded"],["claim:more-paths cites source:fastly-blog-php2shell","unrecorded"],["claim:more-paths cites source:openwall-oss-security-109619-thread","unrecorded"],["claim:most-severe cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:most-severe cites source:wiz-blog-php2shell","unrecorded"],["claim:nl-offline cites source:dutchitleaders-websites-offline","unrecorded"],["claim:nl-offline cites source:rijksoverheid-ncsc-php-news","unrecorded"],["claim:no-confirmed-compromise cites source:aws-security-blog-madpot","unrecorded"],["claim:no-confirmed-compromise cites source:cisa-alert-php-20261021","unrecorded"],["claim:no-confirmed-compromise cites source:cisa-kev-json","unrecorded"],["claim:no-confirmed-compromise cites source:huntress-php2shell-rapid-response","unrecorded"],["claim:no-confirmed-compromise cites source:imperva-blog-php2shell","unrecorded"],["claim:no-confirmed-compromise cites source:recordedfuture-php2shell","unrecorded"],["claim:no-confirmed-compromise cites source:securityweek-exploitation-days-before","unrecorded"],["claim:no-confirmed-compromise cites source:securityweek-first-attempts-sensors","unrecorded"],["claim:no-confirmed-compromise cites source:weirdgloop-blog-php2shell","unrecorded"],["claim:nz-active cites source:ncsc-nz-alert-php","unrecorded"],["claim:offline-allies cites source:acn-it-php2shell","unrecorded"],["claim:offline-allies cites source:acsc-alert-php","unrecorded"],["claim:offline-allies cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:offline-allies cites source:certeu-sa-2026-018","unrecorded"],["claim:offline-allies cites source:jpcert-at260033","unrecorded"],["claim:offline-allies cites source:ncsc-nl-php2shell","unrecorded"],["claim:offline-cisa cites source:cisa-alert-php-20261021","unrecorded"],["claim:offline-ncsc cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:offline-ncsc cites source:cccs-al26-026","unrecorded"],["claim:offline-ncsc cites source:ncsc-news-php","unrecorded"],["claim:offline-nsa cites source:nsa-press-php-4630238","unrecorded"],["claim:offline-nsa cites source:nsa-x-2112903220209098897","unrecorded"],["claim:only-update cites source:github-ghsa-6wmf-4rv5-p3rp","unrecorded"],["claim:only-update cites source:openwall-oss-security-2026-10-21-7","unrecorded"],["claim:only-update cites source:php-net-advisory","unrecorded"],["claim:openai-same-day cites source:github-ghsa-w8hw-w9fx-j79w","unrecorded"],["claim:openai-same-day cites source:php-foundation-blog-security-release","unrecorded"],["claim:oxford cites source:oxfordchronicle-councils-offline","unrecorded"],["claim:pocs-wrong cites source:github-rjmendez-phpup-2026","unrecorded"],["claim:pocs-wrong cites source:huntress-php2shell-rapid-response","unrecorded"],["claim:probing cites source:aws-security-blog-madpot","unrecorded"],["claim:probing cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:probing cites source:cloudflare-blog-php2shell-waf","unrecorded"],["claim:quarkslab-2024 cites source:calif-php2shell","unrecorded"],["claim:quarkslab-2024 cites source:php-foundation-blog-security-release","unrecorded"],["claim:quarkslab-redacted cites source:quarkslab-blog-php-src-audit","unrecorded"],["claim:quarkslab-redacted cites source:substack-lopezkurtz-patch-is-the-exploit","unrecorded"],["claim:rce-fpm cites source:github-ghsa-6wmf-4rv5-p3rp","unrecorded"],["claim:rce-fpm cites source:github-ghsa-w8hw-w9fx-j79w","unrecorded"],["claim:rce-fpm cites source:openwall-oss-security-2026-10-21-6","unrecorded"],["claim:rce-fpm cites source:php-foundation-blog-security-release","unrecorded"],["claim:rce-modphp cites source:github-ghsa-w8hw-w9fx-j79w","unrecorded"],["claim:rce-modphp cites source:openwall-oss-security-2026-10-21-6","unrecorded"],["claim:rce-modphp cites source:php-net-advisory","unrecorded"],["claim:release-moved cites source:openwall-oss-security-2026-10-20-34","unrecorded"],["claim:release-moved cites source:php-foundation-blog-security-release","unrecorded"],["claim:release-moved cites source:php-net-changelog-8","unrecorded"],["claim:release-moved cites source:x-wiz-io-php2shell","unrecorded"],["claim:scale-2.6m-hosts cites source:securityweek-exploitation-days-before","unrecorded"],["claim:scale-2.6m-hosts cites source:thehackernews-php2shell-4days","unrecorded"],["claim:scale-30m cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:scale-70pc-internet cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:scale-70pc-internet cites source:wiz-blog-php2shell","unrecorded"],["claim:scale-70pc-internet cites source:x-wiz-io-php2shell","unrecorded"],["claim:scale-70pc-websites cites source:cloudflare-blog-php2shell-waf","unrecorded"],["claim:scale-70pc-websites cites source:wiz-blog-php2shell","unrecorded"],["claim:scale-70pc-websites cites source:x-openai-php2shell","unrecorded"],["claim:scale-ncsc-nl cites source:ncsc-nl-php2shell-software-list","unrecorded"],["claim:two-cves-9.2 cites source:cve-cve-2026-109618","unrecorded"],["claim:two-cves-9.2 cites source:cve-cve-2026-109619","unrecorded"],["claim:two-cves-9.2 cites source:github-ghsa-6wmf-4rv5-p3rp","unrecorded"],["claim:two-cves-9.2 cites source:github-ghsa-w8hw-w9fx-j79w","unrecorded"],["claim:two-cves-9.2 cites source:php-net-advisory","unrecorded"],["claim:uk-list cites source:insurancebusiness-uk-councils-met","unrecorded"],["claim:uk-list cites source:lbc-uk-websites-offline","unrecorded"],["claim:versions-old cites source:certfr-2026-ale-014","unrecorded"],["claim:versions-old cites source:ncsc-nl-advisories","unrecorded"],["claim:versions-old cites source:openwall-oss-security-109619-thread","unrecorded"],["claim:versions-old cites source:x-wiz-io-php2shell","unrecorded"],["claim:vibe-code cites source:bbc-live-ckgel5xp2xv9t","unrecorded"],["claim:waf cites source:ch-bacs-warnung-php","unrecorded"],["claim:waf cites source:cisa-alert-php-20261021","unrecorded"],["claim:waf cites source:cloudflare-blog-php2shell-waf","unrecorded"],["claim:waf-nine-hours cites source:akamai-blog-php-core-rce","unrecorded"],["claim:waf-nine-hours cites source:cloudflare-blog-php2shell-waf","unrecorded"],["claim:waf-nine-hours cites source:fastly-blog-php2shell","unrecorded"],["claim:waf-nine-hours cites source:fortinet-fortiweb-php2shell","unrecorded"],["claim:waf-nine-hours cites source:imperva-blog-php2shell","unrecorded"],["claim:watchtowr-itw cites source:watchtowr-php2shell","unrecorded"],["claim:watchtowr-itw cites source:watchtowr-php2shell-faq","unrecorded"],["claim:who-first cites source:calif-php2shell","unrecorded"],["claim:who-first cites source:php-foundation-blog-security-release","unrecorded"],["claim:who-first cites source:x-lcfr-hax-hash-tweet","unrecorded"],["claim:wikimedia-precaution cites source:cnn-php2shell-websites-shut","unrecorded"],["claim:wikimedia-precaution cites source:cyberexpress-php2shell-gov-sites","unrecorded"],["claim:wiz-independent cites source:php-foundation-blog-security-release","unrecorded"],["claim:wiz-independent cites source:wiz-blog-php2shell","unrecorded"],["claim:wordpress-drupal cites source:calif-php2shell","unrecorded"],["claim:wordpress-drupal cites source:wiz-blog-php2shell","unrecorded"],["remediation:fix-bounded-parsing realised_in code:file:ext/session/session.c","unrecorded"],["remediation:fix-bounded-parsing realised_in code:file:main/rfc1867.c","unrecorded"],["remediation:fix-fallible realised_in code:file:Zend/zend_hash.c","unrecorded"],["remediation:fix-fallible realised_in code:file:Zend/zend_string.c","unrecorded"],["remediation:fix-fallible realised_in code:file:Zend/zend_types.h","unrecorded"],["remediation:fix-reset-globals realised_in code:file:main/SAPI.c","unrecorded"],["remediation:fix-reset-globals realised_in code:file:main/main.c","unrecorded"],["remediation:fix-soft-limit realised_in code:file:Zend/zend_alloc.c","unrecorded"],["remediation:fix-unwind realised_in code:file:Zend/zend_execute_API.c","unrecorded"],["risk:r01 arises_from weakness:w-alloc-bailout","unrecorded"],["risk:r01 arises_from weakness:w-stale-globals","unrecorded"],["risk:r01 backed_by claim:ac-high","unrecorded"],["risk:r01 backed_by claim:fix-engine","unrecorded"],["risk:r01 backed_by claim:only-update","unrecorded"],["risk:r01 backed_by claim:rce-modphp","unrecorded"],["risk:r01 backed_by claim:two-cves-9.2","unrecorded"],["risk:r01 borne_by stakeholder:people","unrecorded"],["risk:r01 governed_by control:attack:T1190","unrecorded"],["risk:r01 governed_by control:cis:7.7","unrecorded"],["risk:r01 governed_by control:iso27001:A.8.8","unrecorded"],["risk:r01 governed_by control:nis2:Art.21(2)(e)","unrecorded"],["risk:r01 governed_by control:nist80053:SI-2","unrecorded"],["risk:r01 governed_by control:nistcsf:ID.RA-01","unrecorded"],["risk:r01 governed_by control:owasp:A06:2021","unrecorded"],["risk:r01 informed_by stakeholder:agencies","unrecorded"],["risk:r01 owned_by stakeholder:operators","unrecorded"],["risk:r01 protected_by treatment:r01.1","unrecorded"],["risk:r01 protected_by treatment:r01.2","unrecorded"],["risk:r01 protected_by treatment:r01.3","unrecorded"],["risk:r01 shown_on page:flaws/index.html","unrecorded"],["risk:r01 shown_on page:playbook/index.html","unrecorded"],["risk:r01 shown_on page:review/index.html","unrecorded"],["risk:r01 told_in story:patch-at-the-speed-of-metasploit","unrecorded"],["risk:r01 told_in story:where-php2shell-stands","unrecorded"],["risk:r01 tracked_by member:journalist","unrecorded"],["risk:r01 tracked_by member:story-site","unrecorded"],["risk:r01 treated_by stakeholder:edge","unrecorded"],["risk:r01 treated_by stakeholder:hosting","unrecorded"],["risk:r01 treated_by stakeholder:php-project","unrecorded"],["risk:r01-1 arises_from weakness:w-alloc-bailout","unrecorded"],["risk:r01-1 backed_by claim:fix-engine","unrecorded"],["risk:r01-1 backed_by claim:rce-modphp","unrecorded"],["risk:r01-1 borne_by stakeholder:site-owner","unrecorded"],["risk:r01-1 governed_by control:cis:7.4","unrecorded"],["risk:r01-1 governed_by control:cyberessentials:SUM","unrecorded"],["risk:r01-1 governed_by control:iso27001:A.8.8","unrecorded"],["risk:r01-1 governed_by control:pcidss:6.3.3","unrecorded"],["risk:r01-1 owned_by stakeholder:shared-hosts","unrecorded"],["risk:r01-1 part_of risk:r01","unrecorded"],["risk:r01-1 protected_by treatment:r01-1.1","unrecorded"],["risk:r01-1 shown_on page:affected/index.html","unrecorded"],["risk:r01-1 shown_on page:playbook/index.html","unrecorded"],["risk:r01-1 told_in story:why-not-patch-every-version","unrecorded"],["risk:r01-1 tracked_by member:story-site","unrecorded"],["risk:r01-1 treated_by stakeholder:engineers","unrecorded"],["risk:r01-2 arises_from weakness:w-stale-globals","unrecorded"],["risk:r01-2 backed_by claim:rce-fpm","unrecorded"],["risk:r01-2 governed_by control:iso27001:6.1.2","unrecorded"],["risk:r01-2 governed_by control:nistcsf:ID.RA-01","unrecorded"],["risk:r01-2 informed_by stakeholder:php-security-team","unrecorded"],["risk:r01-2 owned_by stakeholder:security-lead","unrecorded"],["risk:r01-2 part_of risk:r01","unrecorded"],["risk:r01-2 protected_by treatment:r01-2.1","unrecorded"],["risk:r01-2 shown_on page:affected/index.html","unrecorded"],["risk:r01-2 shown_on page:factcheck/index.html","unrecorded"],["risk:r01-2 tracked_by member:verifier","unrecorded"],["risk:r01-2 treated_by stakeholder:managed-hosts","unrecorded"],["risk:r01-3 arises_from weakness:w-eol","unrecorded"],["risk:r01-3 backed_by claim:offline-cisa","unrecorded"],["risk:r01-3 backed_by claim:versions-old","unrecorded"],["risk:r01-3 borne_by stakeholder:cfo","unrecorded"],["risk:r01-3 governed_by control:cis:2.2","unrecorded"],["risk:r01-3 governed_by control:cyberessentials:SUM","unrecorded"],["risk:r01-3 governed_by control:nist80053:SA-22","unrecorded"],["risk:r01-3 governed_by control:nistcsf:PR.PS-02","unrecorded"],["risk:r01-3 governed_by control:pcidss:6.3.3","unrecorded"],["risk:r01-3 owned_by stakeholder:cto","unrecorded"],["risk:r01-3 owned_by stakeholder:operators","unrecorded"],["risk:r01-3 part_of risk:r01","unrecorded"],["risk:r01-3 protected_by treatment:r01-3.1","unrecorded"],["risk:r01-3 protected_by treatment:r01-3.2","unrecorded"],["risk:r01-3 shown_on page:patching/index.html","unrecorded"],["risk:r01-3 shown_on page:patching/inventory/index.html","unrecorded"],["risk:r01-3 told_in story:why-not-patch-every-version","unrecorded"],["risk:r01-3 tracked_by member:journalist","unrecorded"],["risk:r01-3 tracked_by member:story-site","unrecorded"],["risk:r01-3 treated_by stakeholder:distros","unrecorded"],["risk:r01-3 treated_by stakeholder:panels","unrecorded"],["risk:r01-4 arises_from weakness:w-bailout-class","unrecorded"],["risk:r01-4 backed_by claim:fix-bailout","unrecorded"],["risk:r01-4 backed_by claim:fix-incomplete","unrecorded"],["risk:r01-4 backed_by claim:more-paths","unrecorded"],["risk:r01-4 borne_by stakeholder:engineers","unrecorded"],["risk:r01-4 borne_by stakeholder:operators","unrecorded"],["risk:r01-4 governed_by control:iso27001:A.8.29","unrecorded"],["risk:r01-4 governed_by control:iso29147:30111:handling","unrecorded"],["risk:r01-4 governed_by control:ssdf:PW.8","unrecorded"],["risk:r01-4 governed_by control:ssdf:RV.3","unrecorded"],["risk:r01-4 informed_by stakeholder:finders","unrecorded"],["risk:r01-4 owned_by stakeholder:php-fix-authors","unrecorded"],["risk:r01-4 part_of risk:r01","unrecorded"],["risk:r01-4 protected_by treatment:r01-4.1","unrecorded"],["risk:r01-4 protected_by treatment:r01-4.2","unrecorded"],["risk:r01-4 shown_on page:code/index.html","unrecorded"],["risk:r01-4 shown_on page:review/index.html","unrecorded"],["risk:r01-4 told_in story:patch-at-the-speed-of-metasploit","unrecorded"],["risk:r01-4 tracked_by member:story-site","unrecorded"],["risk:r01-4 treated_by stakeholder:php-security-team","unrecorded"],["risk:r01-5 arises_from weakness:w-alloc-bailout","unrecorded"],["risk:r01-5 arises_from weakness:w-stale-globals","unrecorded"],["risk:r01-5 backed_by claim:wordpress-drupal","unrecorded"],["risk:r01-5 borne_by stakeholder:commerce","unrecorded"],["risk:r01-5 governed_by control:cis:16.4","unrecorded"],["risk:r01-5 governed_by control:owasp:A06:2021","unrecorded"],["risk:r01-5 governed_by control:pcidss:6.3.1","unrecorded"],["risk:r01-5 informed_by stakeholder:oss-apps","unrecorded"],["risk:r01-5 owned_by stakeholder:site-owner","unrecorded"],["risk:r01-5 part_of risk:r01","unrecorded"],["risk:r01-5 protected_by treatment:r01-5.1","unrecorded"],["risk:r01-5 shown_on page:affected/index.html","unrecorded"],["risk:r01-5 tracked_by member:story-site","unrecorded"],["risk:r01-6 arises_from weakness:w-inventory","unrecorded"],["risk:r01-6 backed_by claim:scale-ncsc-nl","unrecorded"],["risk:r01-6 borne_by stakeholder:operators","unrecorded"],["risk:r01-6 governed_by control:cra:AnnexI.II","unrecorded"],["risk:r01-6 governed_by control:cra:Art.13","unrecorded"],["risk:r01-6 governed_by control:dora:Art.28","unrecorded"],["risk:r01-6 governed_by control:iso27001:A.5.21","unrecorded"],["risk:r01-6 governed_by control:nis2:Art.21(2)(d)","unrecorded"],["risk:r01-6 governed_by control:nistcsf:GV.SC-07","unrecorded"],["risk:r01-6 governed_by control:owasp:A03:2025","unrecorded"],["risk:r01-6 governed_by control:soc2:CC9.2","unrecorded"],["risk:r01-6 informed_by stakeholder:eu-agencies","unrecorded"],["risk:r01-6 owned_by stakeholder:cto","unrecorded"],["risk:r01-6 owned_by stakeholder:inventory-suppliers","unrecorded"],["risk:r01-6 part_of risk:r01","unrecorded"],["risk:r01-6 protected_by treatment:r01-6.1","unrecorded"],["risk:r01-6 shown_on page:affected/software.html","unrecorded"],["risk:r01-6 shown_on page:patching/inventory/index.html","unrecorded"],["risk:r01-6 told_in story:why-not-patch-every-version","unrecorded"],["risk:r01-6 tracked_by member:story-site","unrecorded"],["risk:r02 arises_from weakness:w-embargo","unrecorded"],["risk:r02 backed_by claim:chainguard","unrecorded"],["risk:r02 backed_by claim:leak-cve-ids","unrecorded"],["risk:r02 backed_by claim:leak-mitigations","unrecorded"],["risk:r02 backed_by claim:leak-video","unrecorded"],["risk:r02 backed_by claim:release-moved","unrecorded"],["risk:r02 borne_by stakeholder:operators","unrecorded"],["risk:r02 borne_by stakeholder:security-lead","unrecorded"],["risk:r02 concerns vulnerability:cve-109618","unrecorded"],["risk:r02 concerns vulnerability:cve-109619","unrecorded"],["risk:r02 governed_by control:iso29147:29147:coordination","unrecorded"],["risk:r02 governed_by control:nis2:Art.12","unrecorded"],["risk:r02 governed_by control:nistcsf:ID.RA-08","unrecorded"],["risk:r02 governed_by control:tlp:TLP:AMBER+STRICT","unrecorded"],["risk:r02 owned_by stakeholder:php-security-team","unrecorded"],["risk:r02 protected_by treatment:r02.1","unrecorded"],["risk:r02 raised_by stakeholder:distributors","unrecorded"],["risk:r02 raised_by stakeholder:finders","unrecorded"],["risk:r02 shown_on page:leak/index.html","unrecorded"],["risk:r02 shown_on page:timeline/index.html","unrecorded"],["risk:r02 told_in story:php2shell-in-perspective","unrecorded"],["risk:r02 told_in story:where-php2shell-stands","unrecorded"],["risk:r02 tracked_by member:historian","unrecorded"],["risk:r02 tracked_by member:story-site","unrecorded"],["risk:r02-1 arises_from weakness:w-embargo","unrecorded"],["risk:r02-1 backed_by claim:leak-cve-ids","unrecorded"],["risk:r02-1 backed_by claim:leak-hn","unrecorded"],["risk:r02-1 backed_by claim:leak-video","unrecorded"],["risk:r02-1 backed_by claim:leak-watchtowr","unrecorded"],["risk:r02-1 governed_by control:iso29147:29147:coordination","unrecorded"],["risk:r02-1 governed_by control:nistcsf:ID.RA-08","unrecorded"],["risk:r02-1 owned_by stakeholder:php-security-team","unrecorded"],["risk:r02-1 part_of risk:r02","unrecorded"],["risk:r02-1 protected_by treatment:r02-1.1","unrecorded"],["risk:r02-1 raised_by stakeholder:calif","unrecorded"],["risk:r02-1 shown_on page:leak/index.html","unrecorded"],["risk:r02-1 told_in story:where-php2shell-stands","unrecorded"],["risk:r02-1 tracked_by member:historian","unrecorded"],["risk:r02-1 treated_by stakeholder:edge","unrecorded"],["risk:r02-2 arises_from weakness:w-embargo","unrecorded"],["risk:r02-2 backed_by claim:leak-mitigations","unrecorded"],["risk:r02-2 borne_by stakeholder:operators","unrecorded"],["risk:r02-2 governed_by control:iso27001:A.5.14","unrecorded"],["risk:r02-2 governed_by control:iso29147:29147:coordination","unrecorded"],["risk:r02-2 governed_by control:tlp:TLP:AMBER+STRICT","unrecorded"],["risk:r02-2 owned_by stakeholder:php-security-team","unrecorded"],["risk:r02-2 part_of risk:r02","unrecorded"],["risk:r02-2 protected_by treatment:r02-2.1","unrecorded"],["risk:r02-2 raised_by stakeholder:critical-infra","unrecorded"],["risk:r02-2 shown_on page:leak/index.html","unrecorded"],["risk:r02-2 tracked_by member:historian","unrecorded"],["risk:r02-3 arises_from weakness:w-embargo","unrecorded"],["risk:r02-3 backed_by claim:chainguard","unrecorded"],["risk:r02-3 backed_by claim:lorenc-ai-found","unrecorded"],["risk:r02-3 governed_by control:cra:Art.13","unrecorded"],["risk:r02-3 governed_by control:iso29147:29147:coordination","unrecorded"],["risk:r02-3 governed_by control:nistcsf:GV.SC-05","unrecorded"],["risk:r02-3 governed_by control:owasp:A03:2025","unrecorded"],["risk:r02-3 owned_by stakeholder:distributors","unrecorded"],["risk:r02-3 part_of risk:r02","unrecorded"],["risk:r02-3 protected_by treatment:r02-3.1","unrecorded"],["risk:r02-3 raised_by stakeholder:chainguard","unrecorded"],["risk:r02-3 regulated_by stakeholder:php-security-team","unrecorded"],["risk:r02-3 shown_on page:leak/index.html","unrecorded"],["risk:r02-3 told_in story:where-php2shell-stands","unrecorded"],["risk:r02-3 tracked_by member:historian","unrecorded"],["risk:r03 arises_from weakness:w-alloc-bailout","unrecorded"],["risk:r03 arises_from weakness:w-signal","unrecorded"],["risk:r03 backed_by claim:amazon-honeypot","unrecorded"],["risk:r03 backed_by claim:cisa-none","unrecorded"],["risk:r03 backed_by claim:cloudflare-traffic","unrecorded"],["risk:r03 backed_by claim:kev-precedent","unrecorded"],["risk:r03 backed_by claim:probing","unrecorded"],["risk:r03 governed_by control:attack:T1595.002","unrecorded"],["risk:r03 governed_by control:iso27001:A.5.7","unrecorded"],["risk:r03 governed_by control:iso27001:A.8.16","unrecorded"],["risk:r03 governed_by control:kev:BOD22-01","unrecorded"],["risk:r03 governed_by control:kev:KEV-entry","unrecorded"],["risk:r03 governed_by control:nist80053:SI-4","unrecorded"],["risk:r03 governed_by control:nistcsf:DE.CM-01","unrecorded"],["risk:r03 informed_by stakeholder:threat-intel","unrecorded"],["risk:r03 owned_by stakeholder:operators","unrecorded"],["risk:r03 protected_by treatment:r03.1","unrecorded"],["risk:r03 protected_by treatment:r03.2","unrecorded"],["risk:r03 regulated_by stakeholder:us-agencies","unrecorded"],["risk:r03 shown_on page:exploitation/index.html","unrecorded"],["risk:r03 shown_on page:signals/index.html","unrecorded"],["risk:r03 told_in story:exposed-is-not-exploited","unrecorded"],["risk:r03 told_in story:patch-at-the-speed-of-metasploit","unrecorded"],["risk:r03 told_in story:php2shell-in-perspective","unrecorded"],["risk:r03 tracked_by member:historian","unrecorded"],["risk:r03 tracked_by member:journalist","unrecorded"],["risk:r03 treated_by stakeholder:security-lead","unrecorded"],["risk:r03-1 arises_from weakness:w-signal","unrecorded"],["risk:r03-1 backed_by claim:amazon-honeypot","unrecorded"],["risk:r03-1 backed_by claim:imperva-none","unrecorded"],["risk:r03-1 governed_by control:iso27001:A.5.7","unrecorded"],["risk:r03-1 governed_by control:nist80053:SI-4","unrecorded"],["risk:r03-1 governed_by control:nistcsf:ID.RA-02","unrecorded"],["risk:r03-1 governed_by control:pcidss:12.10.1","unrecorded"],["risk:r03-1 informed_by stakeholder:threat-intel","unrecorded"],["risk:r03-1 owned_by stakeholder:security-lead","unrecorded"],["risk:r03-1 part_of risk:r03","unrecorded"],["risk:r03-1 protected_by treatment:r03-1.1","unrecorded"],["risk:r03-1 shown_on page:exploitation/index.html","unrecorded"],["risk:r03-1 told_in story:exposed-is-not-exploited","unrecorded"],["risk:r03-1 tracked_by member:journalist","unrecorded"],["risk:r03-2 arises_from weakness:w-waf-only","unrecorded"],["risk:r03-2 backed_by claim:cf-millions","unrecorded"],["risk:r03-2 backed_by claim:cloudflare-traffic","unrecorded"],["risk:r03-2 backed_by claim:probing","unrecorded"],["risk:r03-2 governed_by control:attack:T1595.002","unrecorded"],["risk:r03-2 governed_by control:cis:13.10","unrecorded"],["risk:r03-2 governed_by control:nistcsf:DE.CM-01","unrecorded"],["risk:r03-2 owned_by stakeholder:operators","unrecorded"],["risk:r03-2 part_of risk:r03","unrecorded"],["risk:r03-2 protected_by treatment:r03-2.1","unrecorded"],["risk:r03-2 shown_on page:defence/index.html","unrecorded"],["risk:r03-2 shown_on page:exploitation/index.html","unrecorded"],["risk:r03-2 tracked_by member:journalist","unrecorded"],["risk:r03-2 treated_by stakeholder:waf-vendors","unrecorded"],["risk:r03-3 arises_from weakness:w-signal","unrecorded"],["risk:r03-3 backed_by claim:cisa-none","unrecorded"],["risk:r03-3 backed_by claim:huntress-none","unrecorded"],["risk:r03-3 backed_by claim:no-confirmed-compromise","unrecorded"],["risk:r03-3 backed_by claim:nz-active","unrecorded"],["risk:r03-3 backed_by claim:watchtowr-itw","unrecorded"],["risk:r03-3 governed_by control:kev:KEV-entry","unrecorded"],["risk:r03-3 governed_by control:nistcsf:GV.RR-01","unrecorded"],["risk:r03-3 governed_by control:nistcsf:ID.RA-02","unrecorded"],["risk:r03-3 informed_by stakeholder:threat-intel","unrecorded"],["risk:r03-3 owned_by stakeholder:board","unrecorded"],["risk:r03-3 part_of risk:r03","unrecorded"],["risk:r03-3 protected_by treatment:r03-3.1","unrecorded"],["risk:r03-3 regulated_by stakeholder:us-agencies","unrecorded"],["risk:r03-3 shown_on page:compromise/index.html","unrecorded"],["risk:r03-3 shown_on page:exploitation/index.html","unrecorded"],["risk:r03-3 shown_on page:signals/index.html","unrecorded"],["risk:r03-3 told_in story:exposed-is-not-exploited","unrecorded"],["risk:r03-3 tracked_by member:historian","unrecorded"],["risk:r03-3 tracked_by member:journalist","unrecorded"],["risk:r03-4 arises_from weakness:w-signal","unrecorded"],["risk:r03-4 arises_from weakness:w-waf-only","unrecorded"],["risk:r03-4 backed_by claim:pocs-wrong","unrecorded"],["risk:r03-4 governed_by control:nist80053:RA-5","unrecorded"],["risk:r03-4 governed_by control:nistcsf:ID.RA-01","unrecorded"],["risk:r03-4 governed_by control:soc2:CC7.1","unrecorded"],["risk:r03-4 owned_by stakeholder:security-lead","unrecorded"],["risk:r03-4 part_of risk:r03","unrecorded"],["risk:r03-4 protected_by treatment:r03-4.1","unrecorded"],["risk:r03-4 shown_on page:defence/index.html","unrecorded"],["risk:r03-4 told_in story:patch-at-the-speed-of-metasploit","unrecorded"],["risk:r03-4 tracked_by member:journalist","unrecorded"],["risk:r03-4 treated_by stakeholder:threat-intel","unrecorded"],["risk:r04 arises_from weakness:w-eol","unrecorded"],["risk:r04 arises_from weakness:w-inventory","unrecorded"],["risk:r04 backed_by claim:affected-sites","unrecorded"],["risk:r04 backed_by claim:fi-offline","unrecorded"],["risk:r04 backed_by claim:latvia-offline","unrecorded"],["risk:r04 backed_by claim:nl-offline","unrecorded"],["risk:r04 backed_by claim:offline-cisa","unrecorded"],["risk:r04 backed_by claim:offline-nsa","unrecorded"],["risk:r04 backed_by claim:wikimedia-precaution","unrecorded"],["risk:r04 borne_by stakeholder:service-users","unrecorded"],["risk:r04 concerns vulnerability:cve-109618","unrecorded"],["risk:r04 concerns vulnerability:cve-109619","unrecorded"],["risk:r04 governed_by control:dora:Art.11","unrecorded"],["risk:r04 governed_by control:iso27001:A.5.29","unrecorded"],["risk:r04 governed_by control:iso27001:A.5.30","unrecorded"],["risk:r04 governed_by control:nis2:Art.21(2)(c)","unrecorded"],["risk:r04 governed_by control:nist80053:CP-2","unrecorded"],["risk:r04 governed_by control:nistcsf:RC.RP-01","unrecorded"],["risk:r04 owned_by stakeholder:board","unrecorded"],["risk:r04 owned_by stakeholder:public-sector","unrecorded"],["risk:r04 protected_by treatment:r04.1","unrecorded"],["risk:r04 protected_by treatment:r04.2","unrecorded"],["risk:r04 raised_by stakeholder:agencies","unrecorded"],["risk:r04 shown_on page:agencies/index.html","unrecorded"],["risk:r04 shown_on page:impact/index.html","unrecorded"],["risk:r04 told_in story:php2shell-in-perspective","unrecorded"],["risk:r04 told_in story:where-php2shell-stands","unrecorded"],["risk:r04 tracked_by member:story-site","unrecorded"],["risk:r04 treated_by stakeholder:comms","unrecorded"],["risk:r04-1 arises_from weakness:w-inventory","unrecorded"],["risk:r04-1 backed_by claim:fi-offline","unrecorded"],["risk:r04-1 backed_by claim:latvia-offline","unrecorded"],["risk:r04-1 backed_by claim:nl-offline","unrecorded"],["risk:r04-1 borne_by stakeholder:service-users","unrecorded"],["risk:r04-1 governed_by control:iso27001:A.5.29","unrecorded"],["risk:r04-1 governed_by control:nis2:Art.21(2)(c)","unrecorded"],["risk:r04-1 governed_by control:nistcsf:RC.RP-01","unrecorded"],["risk:r04-1 informed_by stakeholder:eu-agencies","unrecorded"],["risk:r04-1 owned_by stakeholder:national-gov","unrecorded"],["risk:r04-1 part_of risk:r04","unrecorded"],["risk:r04-1 protected_by treatment:r04-1.1","unrecorded"],["risk:r04-1 shown_on page:impact/index.html","unrecorded"],["risk:r04-1 told_in story:php2shell-in-perspective","unrecorded"],["risk:r04-1 tracked_by member:story-site","unrecorded"],["risk:r04-2 arises_from weakness:w-eol","unrecorded"],["risk:r04-2 backed_by claim:edinburgh","unrecorded"],["risk:r04-2 backed_by claim:oxford","unrecorded"],["risk:r04-2 backed_by claim:uk-list","unrecorded"],["risk:r04-2 governed_by control:cyberessentials:SUM","unrecorded"],["risk:r04-2 governed_by control:iso27001:A.5.24","unrecorded"],["risk:r04-2 governed_by control:nistcsf:RS.CO-03","unrecorded"],["risk:r04-2 informed_by stakeholder:uk-ncsc","unrecorded"],["risk:r04-2 owned_by stakeholder:councils","unrecorded"],["risk:r04-2 part_of risk:r04","unrecorded"],["risk:r04-2 protected_by treatment:r04-2.1","unrecorded"],["risk:r04-2 shown_on page:briefings/comms/index.html","unrecorded"],["risk:r04-2 shown_on page:impact/index.html","unrecorded"],["risk:r04-2 tracked_by member:story-site","unrecorded"],["risk:r04-2 treated_by stakeholder:comms","unrecorded"],["risk:r04-3 arises_from weakness:w-headline","unrecorded"],["risk:r04-3 backed_by claim:offline-allies","unrecorded"],["risk:r04-3 backed_by claim:offline-cisa","unrecorded"],["risk:r04-3 backed_by claim:offline-ncsc","unrecorded"],["risk:r04-3 backed_by claim:offline-nsa","unrecorded"],["risk:r04-3 governed_by control:iso27001:A.5.5","unrecorded"],["risk:r04-3 governed_by control:nis2:Art.20","unrecorded"],["risk:r04-3 governed_by control:nistcsf:GV.RR-01","unrecorded"],["risk:r04-3 informed_by stakeholder:media","unrecorded"],["risk:r04-3 owned_by stakeholder:board","unrecorded"],["risk:r04-3 part_of risk:r04","unrecorded"],["risk:r04-3 protected_by treatment:r04-3.1","unrecorded"],["risk:r04-3 raised_by stakeholder:agencies","unrecorded"],["risk:r04-3 shown_on page:agencies/index.html","unrecorded"],["risk:r04-3 told_in story:where-php2shell-stands","unrecorded"],["risk:r04-3 tracked_by member:story-site","unrecorded"],["risk:r04-3 tracked_by member:verifier","unrecorded"],["risk:r05 arises_from weakness:w-waf-only","unrecorded"],["risk:r05 backed_by claim:only-update","unrecorded"],["risk:r05 backed_by claim:waf","unrecorded"],["risk:r05 backed_by claim:waf-nine-hours","unrecorded"],["risk:r05 borne_by stakeholder:commerce","unrecorded"],["risk:r05 concerns vulnerability:cve-109618","unrecorded"],["risk:r05 concerns vulnerability:cve-109619","unrecorded"],["risk:r05 governed_by control:cis:13.10","unrecorded"],["risk:r05 governed_by control:cyberessentials:FW","unrecorded"],["risk:r05 governed_by control:iso27001:A.8.20","unrecorded"],["risk:r05 governed_by control:nist80053:SC-7","unrecorded"],["risk:r05 governed_by control:pcidss:6.4.2","unrecorded"],["risk:r05 informed_by stakeholder:waf-vendors","unrecorded"],["risk:r05 owned_by stakeholder:security-lead","unrecorded"],["risk:r05 protected_by treatment:r05.1","unrecorded"],["risk:r05 shown_on page:defence/index.html","unrecorded"],["risk:r05 told_in story:patch-at-the-speed-of-metasploit","unrecorded"],["risk:r05 tracked_by member:journalist","unrecorded"],["risk:r06 arises_from weakness:w-alloc-bailout","unrecorded"],["risk:r06 arises_from weakness:w-stale-globals","unrecorded"],["risk:r06 backed_by claim:no-confirmed-compromise","unrecorded"],["risk:r06 backed_by claim:rce-modphp","unrecorded"],["risk:r06 borne_by stakeholder:data-subjects","unrecorded"],["risk:r06 governed_by control:cra:Art.14","unrecorded"],["risk:r06 governed_by control:dora:Art.19","unrecorded"],["risk:r06 governed_by control:gdpr:Art.32","unrecorded"],["risk:r06 governed_by control:gdpr:Art.33","unrecorded"],["risk:r06 governed_by control:gdpr:Art.34","unrecorded"],["risk:r06 governed_by control:nis2:Art.23","unrecorded"],["risk:r06 owned_by stakeholder:board","unrecorded"],["risk:r06 owned_by stakeholder:dpo","unrecorded"],["risk:r06 owned_by stakeholder:operators","unrecorded"],["risk:r06 protected_by treatment:r06.1","unrecorded"],["risk:r06 regulated_by stakeholder:eu-agencies","unrecorded"],["risk:r06 shown_on page:compromise/index.html","unrecorded"],["risk:r06 shown_on page:impact/index.html","unrecorded"],["risk:r06 shown_on page:playbook/index.html","unrecorded"],["risk:r06 tracked_by member:story-site","unrecorded"],["risk:r06-1 arises_from weakness:w-alloc-bailout","unrecorded"],["risk:r06-1 backed_by claim:rce-modphp","unrecorded"],["risk:r06-1 borne_by stakeholder:data-subjects","unrecorded"],["risk:r06-1 governed_by control:gdpr:Art.24","unrecorded"],["risk:r06-1 governed_by control:gdpr:Art.28","unrecorded"],["risk:r06-1 governed_by control:gdpr:Art.32","unrecorded"],["risk:r06-1 governed_by control:gdpr:Art.33","unrecorded"],["risk:r06-1 governed_by control:gdpr:Art.34","unrecorded"],["risk:r06-1 governed_by control:gdpr:Art.5(1)(f)","unrecorded"],["risk:r06-1 owned_by stakeholder:dpo","unrecorded"],["risk:r06-1 part_of risk:r06","unrecorded"],["risk:r06-1 protected_by treatment:r06-1.1","unrecorded"],["risk:r06-1 shown_on page:briefings/dpo/index.html","unrecorded"],["risk:r06-1 shown_on page:impact/index.html","unrecorded"],["risk:r06-1 tracked_by member:grc","unrecorded"],["risk:r06-1 tracked_by member:story-site","unrecorded"],["risk:r06-1 treated_by stakeholder:managed-hosts","unrecorded"],["risk:r06-2 arises_from weakness:w-signal","unrecorded"],["risk:r06-2 backed_by claim:nl-offline","unrecorded"],["risk:r06-2 backed_by claim:no-confirmed-compromise","unrecorded"],["risk:r06-2 governed_by control:dora:Art.10","unrecorded"],["risk:r06-2 governed_by control:dora:Art.19","unrecorded"],["risk:r06-2 governed_by control:nis2:Art.20","unrecorded"],["risk:r06-2 governed_by control:nis2:Art.23","unrecorded"],["risk:r06-2 governed_by control:nist80053:IR-6","unrecorded"],["risk:r06-2 owned_by stakeholder:critical-infra","unrecorded"],["risk:r06-2 owned_by stakeholder:finance","unrecorded"],["risk:r06-2 part_of risk:r06","unrecorded"],["risk:r06-2 protected_by treatment:r06-2.1","unrecorded"],["risk:r06-2 regulated_by stakeholder:eu-agencies","unrecorded"],["risk:r06-2 shown_on page:agencies/index.html","unrecorded"],["risk:r06-2 shown_on page:impact/index.html","unrecorded"],["risk:r06-2 tracked_by member:story-site","unrecorded"],["risk:r06-2 treated_by stakeholder:ciso","unrecorded"],["risk:r06-3 arises_from weakness:w-inventory","unrecorded"],["risk:r06-3 arises_from weakness:w-signal","unrecorded"],["risk:r06-3 backed_by claim:cisa-none","unrecorded"],["risk:r06-3 backed_by claim:scale-ncsc-nl","unrecorded"],["risk:r06-3 backed_by claim:watchtowr-itw","unrecorded"],["risk:r06-3 governed_by control:cra:AnnexI.II","unrecorded"],["risk:r06-3 governed_by control:cra:Art.13","unrecorded"],["risk:r06-3 governed_by control:cra:Art.14","unrecorded"],["risk:r06-3 governed_by control:cra:Art.24","unrecorded"],["risk:r06-3 informed_by stakeholder:php-foundation","unrecorded"],["risk:r06-3 owned_by stakeholder:inventory-suppliers","unrecorded"],["risk:r06-3 part_of risk:r06","unrecorded"],["risk:r06-3 protected_by treatment:r06-3.1","unrecorded"],["risk:r06-3 regulated_by stakeholder:eu-agencies","unrecorded"],["risk:r06-3 shown_on page:affected/software.html","unrecorded"],["risk:r06-3 shown_on page:exploitation/index.html","unrecorded"],["risk:r06-3 tracked_by member:story-site","unrecorded"],["risk:r06-3 treated_by stakeholder:engineers","unrecorded"],["risk:r07 arises_from weakness:w-headline","unrecorded"],["risk:r07 backed_by claim:cvss-10","unrecorded"],["risk:r07 backed_by claim:disclosure-22oct","unrecorded"],["risk:r07 backed_by claim:most-severe","unrecorded"],["risk:r07 backed_by claim:scale-30m","unrecorded"],["risk:r07 backed_by claim:scale-70pc-internet","unrecorded"],["risk:r07 backed_by claim:scale-70pc-websites","unrecorded"],["risk:r07 concerns vulnerability:cve-109618","unrecorded"],["risk:r07 concerns vulnerability:cve-109619","unrecorded"],["risk:r07 governed_by control:iso27001:6.1.2","unrecorded"],["risk:r07 governed_by control:nistcsf:GV.RM-01","unrecorded"],["risk:r07 governed_by control:owasp:LLM09:2025","unrecorded"],["risk:r07 owned_by stakeholder:board","unrecorded"],["risk:r07 protected_by treatment:r07.1","unrecorded"],["risk:r07 raised_by stakeholder:media","unrecorded"],["risk:r07 raised_by stakeholder:wiz","unrecorded"],["risk:r07 shown_on page:factcheck/index.html","unrecorded"],["risk:r07 shown_on page:numbers/index.html","unrecorded"],["risk:r07 told_in story:exposed-is-not-exploited","unrecorded"],["risk:r07 told_in story:where-php2shell-stands","unrecorded"],["risk:r07 tracked_by member:journalist","unrecorded"],["risk:r07 tracked_by member:verifier","unrecorded"],["risk:r07 treated_by stakeholder:newsroom","unrecorded"],["risk:r08 arises_from weakness:w-ai-dual-use","unrecorded"],["risk:r08 arises_from weakness:w-maintainer-capacity","unrecorded"],["risk:r08 backed_by claim:ahead-of-attackers","unrecorded"],["risk:r08 backed_by claim:ai-found","unrecorded"],["risk:r08 backed_by claim:lorenc-ai-found","unrecorded"],["risk:r08 backed_by claim:openai-same-day","unrecorded"],["risk:r08 backed_by claim:vibe-code","unrecorded"],["risk:r08 backed_by claim:wiz-independent","unrecorded"],["risk:r08 borne_by stakeholder:ciso","unrecorded"],["risk:r08 borne_by stakeholder:php-project","unrecorded"],["risk:r08 borne_by stakeholder:world","unrecorded"],["risk:r08 concerns vulnerability:cve-109618","unrecorded"],["risk:r08 concerns vulnerability:cve-109619","unrecorded"],["risk:r08 governed_by control:euaiact:Art.55","unrecorded"],["risk:r08 governed_by control:iso42001:6.1.2","unrecorded"],["risk:r08 governed_by control:nistairmf:GOVERN-6.1","unrecorded"],["risk:r08 governed_by control:nistairmf:MEASURE-2.7","unrecorded"],["risk:r08 owned_by stakeholder:openai","unrecorded"],["risk:r08 protected_by treatment:r08.1","unrecorded"],["risk:r08 shown_on page:context/index.html","unrecorded"],["risk:r08 shown_on page:discovery/index.html","unrecorded"],["risk:r08 told_in story:php2shell-in-perspective","unrecorded"],["risk:r08 tracked_by member:historian","unrecorded"],["risk:r08 treated_by stakeholder:finders","unrecorded"],["risk:r08-1 arises_from weakness:w-alloc-bailout","unrecorded"],["risk:r08-1 arises_from weakness:w-maintainer-capacity","unrecorded"],["risk:r08-1 backed_by claim:quarkslab-2024","unrecorded"],["risk:r08-1 backed_by claim:quarkslab-redacted","unrecorded"],["risk:r08-1 governed_by control:cra:Art.24","unrecorded"],["risk:r08-1 governed_by control:iso27001:A.8.25","unrecorded"],["risk:r08-1 governed_by control:ssdf:PW.7","unrecorded"],["risk:r08-1 governed_by control:ssdf:RV.2","unrecorded"],["risk:r08-1 informed_by stakeholder:quarkslab","unrecorded"],["risk:r08-1 owned_by stakeholder:php-project","unrecorded"],["risk:r08-1 part_of risk:r08","unrecorded"],["risk:r08-1 protected_by treatment:r08-1.1","unrecorded"],["risk:r08-1 shown_on page:discovery/index.html","unrecorded"],["risk:r08-1 told_in story:php2shell-in-perspective","unrecorded"],["risk:r08-1 tracked_by member:historian","unrecorded"],["risk:r08-1 treated_by stakeholder:php-foundation","unrecorded"],["risk:r08-2 arises_from weakness:w-maintainer-capacity","unrecorded"],["risk:r08-2 backed_by claim:four-reporters","unrecorded"],["risk:r08-2 backed_by claim:openai-same-day","unrecorded"],["risk:r08-2 backed_by claim:who-first","unrecorded"],["risk:r08-2 backed_by claim:wiz-independent","unrecorded"],["risk:r08-2 borne_by stakeholder:php-security-team","unrecorded"],["risk:r08-2 governed_by control:iso29147:29147:receipt","unrecorded"],["risk:r08-2 governed_by control:nistcsf:ID.RA-08","unrecorded"],["risk:r08-2 governed_by control:ssdf:RV.1","unrecorded"],["risk:r08-2 owned_by stakeholder:php-foundation","unrecorded"],["risk:r08-2 part_of risk:r08","unrecorded"],["risk:r08-2 protected_by treatment:r08-2.1","unrecorded"],["risk:r08-2 raised_by stakeholder:finders","unrecorded"],["risk:r08-2 shown_on page:discovery/index.html","unrecorded"],["risk:r08-2 tracked_by member:historian","unrecorded"],["risk:r09 arises_from weakness:w-inventory","unrecorded"],["risk:r09 backed_by claim:scale-2.6m-hosts","unrecorded"],["risk:r09 backed_by claim:scale-ncsc-nl","unrecorded"],["risk:r09 concerns vulnerability:cve-109618","unrecorded"],["risk:r09 concerns vulnerability:cve-109619","unrecorded"],["risk:r09 governed_by control:cis:16.4","unrecorded"],["risk:r09 governed_by control:cra:AnnexI.II","unrecorded"],["risk:r09 governed_by control:dora:Art.8","unrecorded"],["risk:r09 governed_by control:iso27001:A.8.9","unrecorded"],["risk:r09 governed_by control:nist80053:CM-8","unrecorded"],["risk:r09 governed_by control:nistcsf:ID.AM-02","unrecorded"],["risk:r09 informed_by stakeholder:inventory-suppliers","unrecorded"],["risk:r09 owned_by stakeholder:cto","unrecorded"],["risk:r09 protected_by treatment:r09.1","unrecorded"],["risk:r09 shown_on page:affected/software.html","unrecorded"],["risk:r09 shown_on page:playbook/index.html","unrecorded"],["risk:r09 told_in story:exposed-is-not-exploited","unrecorded"],["risk:r09 tracked_by member:story-site","unrecorded"],["risk:r09 treated_by stakeholder:engineers","unrecorded"],["risk:r10 arises_from weakness:w-agent-reach","unrecorded"],["risk:r10 arises_from weakness:w-status-words","unrecorded"],["risk:r10 arises_from weakness:w-untrusted-text","unrecorded"],["risk:r10 borne_by stakeholder:readers","unrecorded"],["risk:r10 governed_by control:euaiact:Art.50","unrecorded"],["risk:r10 governed_by control:iso42001:6.1.3","unrecorded"],["risk:r10 governed_by control:nistairmf:MANAGE-2.4","unrecorded"],["risk:r10 governed_by control:owasp:LLM06:2025","unrecorded"],["risk:r10 owned_by stakeholder:newsroom-editor","unrecorded"],["risk:r10 protected_by treatment:r10.1","unrecorded"],["risk:r10 protected_by treatment:r10.2","unrecorded"],["risk:r10 shown_on page:admin/agents/index.html","unrecorded"],["risk:r10 shown_on page:team/index.html","unrecorded"],["risk:r10 tracked_by member:conductor","unrecorded"],["risk:r10 tracked_by member:dev","unrecorded"],["risk:r10 treated_by stakeholder:newsroom-agents","unrecorded"],["risk:r10-1 arises_from weakness:w-untrusted-text","unrecorded"],["risk:r10-1 governed_by control:euaiact:Art.15","unrecorded"],["risk:r10-1 governed_by control:nistairmf:MEASURE-2.7","unrecorded"],["risk:r10-1 governed_by control:owasp:LLM01:2025","unrecorded"],["risk:r10-1 owned_by stakeholder:newsroom-editor","unrecorded"],["risk:r10-1 part_of risk:r10","unrecorded"],["risk:r10-1 protected_by treatment:r10-1.1","unrecorded"],["risk:r10-1 shown_on page:admin/agents/index.html","unrecorded"],["risk:r10-1 tracked_by member:dev","unrecorded"],["risk:r10-1 treated_by stakeholder:newsroom-agents","unrecorded"],["risk:r10-2 arises_from weakness:w-agent-reach","unrecorded"],["risk:r10-2 borne_by stakeholder:readers","unrecorded"],["risk:r10-2 governed_by control:gdpr:Art.32","unrecorded"],["risk:r10-2 governed_by control:iso27001:A.5.14","unrecorded"],["risk:r10-2 governed_by control:owasp:LLM02:2025","unrecorded"],["risk:r10-2 owned_by stakeholder:newsroom-editor","unrecorded"],["risk:r10-2 part_of risk:r10","unrecorded"],["risk:r10-2 protected_by treatment:r10-2.1","unrecorded"],["risk:r10-2 shown_on page:vaults/index.html","unrecorded"],["risk:r10-2 tracked_by member:dev","unrecorded"],["risk:r10-2 treated_by stakeholder:newsroom-agents","unrecorded"],["risk:r10-3 arises_from weakness:w-status-words","unrecorded"],["risk:r10-3 borne_by stakeholder:readers","unrecorded"],["risk:r10-3 governed_by control:euaiact:Art.50","unrecorded"],["risk:r10-3 governed_by control:owasp:LLM09:2025","unrecorded"],["risk:r10-3 owned_by stakeholder:newsroom-editor","unrecorded"],["risk:r10-3 part_of risk:r10","unrecorded"],["risk:r10-3 protected_by treatment:r10-3.1","unrecorded"],["risk:r10-3 raised_by stakeholder:newsroom-agents","unrecorded"],["risk:r10-3 shown_on page:factcheck/index.html","unrecorded"],["risk:r10-3 shown_on page:method/index.html","unrecorded"],["risk:r10-3 tracked_by member:story-site","unrecorded"],["risk:r10-3 tracked_by member:verifier","unrecorded"],["stakeholder:agencies part_of stakeholder:world","unrecorded"],["stakeholder:app-vendors part_of stakeholder:world","unrecorded"],["stakeholder:board briefed_by briefing:board","unrecorded"],["stakeholder:board part_of stakeholder:org-roles","unrecorded"],["stakeholder:calif part_of stakeholder:finders","unrecorded"],["stakeholder:cfo briefed_by briefing:cfo","unrecorded"],["stakeholder:cfo part_of stakeholder:org-roles","unrecorded"],["stakeholder:chainguard part_of stakeholder:distributors","unrecorded"],["stakeholder:ciso briefed_by briefing:ciso","unrecorded"],["stakeholder:ciso part_of stakeholder:org-roles","unrecorded"],["stakeholder:commerce part_of stakeholder:operators","unrecorded"],["stakeholder:comms briefed_by briefing:comms","unrecorded"],["stakeholder:comms part_of stakeholder:org-roles","unrecorded"],["stakeholder:councils part_of stakeholder:public-sector","unrecorded"],["stakeholder:critical-infra part_of stakeholder:operators","unrecorded"],["stakeholder:cto briefed_by briefing:cto","unrecorded"],["stakeholder:cto part_of stakeholder:org-roles","unrecorded"],["stakeholder:data-subjects part_of stakeholder:people","unrecorded"],["stakeholder:distributors part_of stakeholder:world","unrecorded"],["stakeholder:distros part_of stakeholder:distributors","unrecorded"],["stakeholder:dpo briefed_by briefing:dpo","unrecorded"],["stakeholder:dpo part_of stakeholder:org-roles","unrecorded"],["stakeholder:edge part_of stakeholder:world","unrecorded"],["stakeholder:engineers briefed_by briefing:engineer","unrecorded"],["stakeholder:engineers part_of stakeholder:org-roles","unrecorded"],["stakeholder:eu-agencies part_of stakeholder:agencies","unrecorded"],["stakeholder:finance part_of stakeholder:operators","unrecorded"],["stakeholder:finders part_of stakeholder:world","unrecorded"],["stakeholder:hosting part_of stakeholder:world","unrecorded"],["stakeholder:inventory-suppliers part_of stakeholder:app-vendors","unrecorded"],["stakeholder:managed-hosts part_of stakeholder:hosting","unrecorded"],["stakeholder:media part_of stakeholder:world","unrecorded"],["stakeholder:national-gov part_of stakeholder:public-sector","unrecorded"],["stakeholder:newsroom part_of stakeholder:media","unrecorded"],["stakeholder:newsroom-agents part_of stakeholder:newsroom","unrecorded"],["stakeholder:newsroom-editor part_of stakeholder:newsroom","unrecorded"],["stakeholder:newsroom-editor tracked_by member:dinis","unrecorded"],["stakeholder:non-profits part_of stakeholder:operators","unrecorded"],["stakeholder:openai part_of stakeholder:finders","unrecorded"],["stakeholder:operators part_of stakeholder:world","unrecorded"],["stakeholder:org-roles part_of stakeholder:operators","unrecorded"],["stakeholder:oss-apps part_of stakeholder:app-vendors","unrecorded"],["stakeholder:panels part_of stakeholder:distributors","unrecorded"],["stakeholder:people part_of stakeholder:world","unrecorded"],["stakeholder:php-fix-authors part_of stakeholder:php-project","unrecorded"],["stakeholder:php-foundation part_of stakeholder:php-project","unrecorded"],["stakeholder:php-project part_of stakeholder:world","unrecorded"],["stakeholder:php-security-team part_of stakeholder:php-project","unrecorded"],["stakeholder:public-sector part_of stakeholder:operators","unrecorded"],["stakeholder:quarkslab part_of stakeholder:finders","unrecorded"],["stakeholder:readers part_of stakeholder:newsroom","unrecorded"],["stakeholder:security-lead briefed_by briefing:security","unrecorded"],["stakeholder:security-lead part_of stakeholder:org-roles","unrecorded"],["stakeholder:service-users part_of stakeholder:people","unrecorded"],["stakeholder:shared-hosts part_of stakeholder:hosting","unrecorded"],["stakeholder:site-owner briefed_by briefing:site-owner","unrecorded"],["stakeholder:site-owner part_of stakeholder:org-roles","unrecorded"],["stakeholder:threat-intel part_of stakeholder:edge","unrecorded"],["stakeholder:uk-ncsc part_of stakeholder:agencies","unrecorded"],["stakeholder:us-agencies part_of stakeholder:agencies","unrecorded"],["stakeholder:waf-vendors part_of stakeholder:edge","unrecorded"],["stakeholder:wiz part_of stakeholder:finders","unrecorded"],["vulnerability:cve-109618 fixed_by remediation:fix-fallible","unrecorded"],["vulnerability:cve-109618 fixed_by remediation:fix-hard-limit","unrecorded"],["vulnerability:cve-109618 fixed_by remediation:fix-soft-limit","unrecorded"],["vulnerability:cve-109618 fixed_by remediation:fix-unwind","unrecorded"],["vulnerability:cve-109619 fixed_by remediation:fix-bounded-parsing","unrecorded"],["vulnerability:cve-109619 fixed_by remediation:fix-reset-globals","unrecorded"],["weakness:w-agent-reach located_in repo:.github/workflows/pages.yml","unrecorded"],["weakness:w-agent-reach located_in repo:admin/build/release.sh","unrecorded"],["weakness:w-agent-reach located_in repo:admin/build/security_check.py","unrecorded"],["weakness:w-agent-reach located_in repo:admin/build/validate.py","unrecorded"],["weakness:w-alloc-bailout arises_from vulnerability:cve-109618","unrecorded"],["weakness:w-bailout-class arises_from vulnerability:cve-109618","unrecorded"],["weakness:w-bailout-class arises_from vulnerability:cve-109619","unrecorded"],["weakness:w-eol arises_from vulnerability:cve-109618","unrecorded"],["weakness:w-eol arises_from vulnerability:cve-109619","unrecorded"],["weakness:w-stale-globals arises_from vulnerability:cve-109619","unrecorded"],["weakness:w-status-words located_in repo:admin/factcheck/fc.py","unrecorded"],["weakness:w-status-words located_in repo:data/claims.json","unrecorded"],["weakness:w-untrusted-text located_in repo:admin/build/security_check.py","unrecorded"],["weakness:w-untrusted-text located_in repo:admin/security/injection-allowlist.json","unrecorded"]],"edges_removed":[],"basis_changed":[],"basis_recorded":[],"gaps_opened":{"control-no-test":["control:attack:T1190","control:attack:T1595.002","control:cis:13.10","control:cis:16.4","control:cis:2.2","control:cis:7.4","control:cis:7.7","control:cra:AnnexI.II","control:cra:Art.13","control:cra:Art.14","control:cra:Art.24","control:cyberessentials:FW","control:cyberessentials:SUM","control:dora:Art.10","control:dora:Art.11","control:dora:Art.19","control:dora:Art.28","control:dora:Art.8","control:euaiact:Art.15","control:euaiact:Art.50","control:euaiact:Art.55","control:gdpr:Art.24","control:gdpr:Art.28","control:gdpr:Art.32","control:gdpr:Art.33","control:gdpr:Art.34","control:gdpr:Art.5(1)(f)","control:iso27001:6.1.2","control:iso27001:A.5.14","control:iso27001:A.5.21","control:iso27001:A.5.24","control:iso27001:A.5.29","control:iso27001:A.5.30","control:iso27001:A.5.5","control:iso27001:A.5.7","control:iso27001:A.8.16","control:iso27001:A.8.20","control:iso27001:A.8.25","control:iso27001:A.8.29","control:iso27001:A.8.8","control:iso27001:A.8.9","control:iso29147:29147:coordination","control:iso29147:29147:receipt","control:iso29147:30111:handling","control:iso42001:6.1.2","control:iso42001:6.1.3","control:kev:BOD22-01","control:kev:KEV-entry","control:nis2:Art.12","control:nis2:Art.20","control:nis2:Art.21(2)(c)","control:nis2:Art.21(2)(d)","control:nis2:Art.21(2)(e)","control:nis2:Art.23","control:nist80053:CM-8","control:nist80053:CP-2","control:nist80053:IR-6","control:nist80053:RA-5","control:nist80053:SA-22","control:nist80053:SC-7","control:nist80053:SI-2","control:nist80053:SI-4","control:nistairmf:GOVERN-6.1","control:nistairmf:MANAGE-2.4","control:nistairmf:MEASURE-2.7","control:nistcsf:DE.CM-01","control:nistcsf:GV.RM-01","control:nistcsf:GV.RR-01","control:nistcsf:GV.SC-05","control:nistcsf:GV.SC-07","control:nistcsf:ID.AM-02","control:nistcsf:ID.RA-01","control:nistcsf:ID.RA-02","control:nistcsf:ID.RA-08","control:nistcsf:PR.PS-02","control:nistcsf:RC.RP-01","control:nistcsf:RS.CO-03","control:owasp:A03:2025","control:owasp:A06:2021","control:owasp:LLM01:2025","control:owasp:LLM02:2025","control:owasp:LLM06:2025","control:owasp:LLM09:2025","control:pcidss:12.10.1","control:pcidss:6.3.1","control:pcidss:6.3.3","control:pcidss:6.4.2","control:soc2:CC7.1","control:soc2:CC9.2","control:ssdf:PW.7","control:ssdf:PW.8","control:ssdf:RV.1","control:ssdf:RV.2","control:ssdf:RV.3","control:tlp:TLP:AMBER+STRICT"],"code-no-owner":["code:file:Zend/zend_alloc.c","code:file:Zend/zend_execute_API.c","code:file:Zend/zend_hash.c","code:file:Zend/zend_string.c","code:file:Zend/zend_types.h","code:file:ext/session/session.c","code:file:main/SAPI.c","code:file:main/main.c","code:file:main/rfc1867.c","repo:.github/workflows/pages.yml","repo:admin/build/release.sh","repo:admin/build/security_check.py","repo:admin/build/validate.py","repo:admin/factcheck/fc.py","repo:admin/security/injection-allowlist.json","repo:data/claims.json"],"code-no-test":["code:file:Zend/zend_alloc.c","code:file:Zend/zend_execute_API.c","code:file:Zend/zend_hash.c","code:file:Zend/zend_string.c","code:file:Zend/zend_types.h","code:file:ext/session/session.c","code:file:main/SAPI.c","code:file:main/main.c","code:file:main/rfc1867.c","repo:.github/workflows/pages.yml","repo:admin/build/release.sh","repo:admin/build/security_check.py","repo:admin/build/validate.py","repo:admin/factcheck/fc.py","repo:admin/security/injection-allowlist.json","repo:data/claims.json"],"risk-no-story":["risk:r01-2","risk:r01-5","risk:r02-2","risk:r03-2","risk:r04-2","risk:r06","risk:r06-1","risk:r06-2","risk:r06-3","risk:r08-2","risk:r10","risk:r10-1","risk:r10-2","risk:r10-3"],"vulnerability-no-test":["vulnerability:cve-109618","vulnerability:cve-109619"]},"gaps_closed":{},"totals":{"nodes":442,"edges":839,"gaps":{"control-no-test":95,"code-no-owner":16,"code-no-test":16,"risk-no-story":14,"risk-no-treatment":0,"risk-no-owner":0,"vulnerability-no-test":2,"edges-inferred":0},"basis":{"unrecorded":839}}},{"version":"0.10.13","against":"0.10.12","nodes_added":["remediation:fix-commit","test:Zend/tests/bug40770.phpt","test:Zend/tests/bug54268.phpt","test:Zend/tests/bug76846.phpt","test:Zend/tests/fibers/get-return-after-bailout.phpt","test:Zend/tests/gh11189.phpt","test:Zend/tests/gh11189_1.phpt","test:Zend/tests/oom_SplFixedArray___unserialize.phpt","test:Zend/tests/oom_SplFixedArray___wakeup.phpt","test:Zend/tests/oom_SplFixedArray_copy_ctor.phpt","test:Zend/tests/oom_SplFixedArray_fromArray_001.phpt","test:Zend/tests/oom_SplFixedArray_fromArray_002.phpt","test:Zend/tests/oom_after_main_script.phpt","test:Zend/tests/oom_array_fill_001.phpt","test:Zend/tests/oom_array_fill_002.phpt","test:Zend/tests/oom_array_fill_003.phpt","test:Zend/tests/oom_array_fill_004.phpt","test:Zend/tests/oom_array_pad_001.phpt","test:Zend/tests/oom_array_pad_002.phpt","test:Zend/tests/oom_array_pad_003.phpt","test:Zend/tests/oom_array_pad_004.phpt","test:Zend/tests/oom_array_pad_005.phpt","test:Zend/tests/oom_array_pad_006.phpt","test:Zend/tests/oom_array_pad_007.phpt","test:Zend/tests/oom_array_pad_008.phpt","test:Zend/tests/oom_call_function.phpt","test:Zend/tests/oom_call_function_002.phpt","test:Zend/tests/oom_call_function_003.phpt","test:Zend/tests/oom_debug_backtrace.phpt","test:Zend/tests/oom_debug_backtrace_args.phpt","test:Zend/tests/oom_debug_backtrace_named_args.phpt","test:Zend/tests/oom_error_get_last.phpt","test:Zend/tests/oom_exception_trace.phpt","test:Zend/tests/oom_hard_limit_exceeded.phpt","test:Zend/tests/oom_hard_limit_exceeded_during_complilation.phpt","test:Zend/tests/oom_interrupt.phpt","test:Zend/tests/oom_interrupt_unfinished_call_frame.phpt","test:Zend/tests/oom_interrupt_unfinished_call_frame_fiber.phpt","test:Zend/tests/oom_json_decode_001.phpt","test:Zend/tests/oom_json_decode_002.phpt","test:Zend/tests/oom_json_decode_003.phpt","test:Zend/tests/oom_json_decode_004.phpt","test:Zend/tests/oom_json_decode_005.phpt","test:Zend/tests/oom_json_decode_006.phpt","test:Zend/tests/oom_json_decode_007.phpt","test:Zend/tests/oom_pending_at_shutdown.phpt","test:Zend/tests/oom_range_001.phpt","test:Zend/tests/oom_range_002.phpt","test:Zend/tests/oom_range_003.phpt","test:Zend/tests/oom_range_004.phpt","test:Zend/tests/oom_request_parsing.phpt","test:Zend/tests/oom_soft_limit_exceeded.phpt","test:Zend/tests/oom_soft_limit_exceeded_fcall.phpt","test:Zend/tests/oom_soft_limit_in_callback.phpt","test:Zend/tests/oom_str_repeat.phpt","test:Zend/tests/oom_unserialize_001.phpt","test:Zend/tests/oom_unserialize_002.phpt","test:Zend/tests/oom_unserialize_003.phpt","test:Zend/tests/oom_unserialize_004.phpt","test:Zend/tests/oom_unserialize_005.phpt","test:Zend/tests/oom_unserialize_006.phpt","test:Zend/tests/oom_unserialize_007.phpt","test:Zend/tests/oom_unserialize_008.phpt","test:Zend/tests/oom_unserialize_009.phpt","test:Zend/tests/oom_unserialize_011.phpt","test:Zend/tests/oom_unserialize_012.phpt","test:Zend/tests/oom_unserialize_013.phpt","test:Zend/tests/oom_unserialize_014.phpt","test:Zend/tests/oom_unserialize_015.phpt","test:Zend/tests/oom_unserialize_016.phpt","test:Zend/tests/singleton_array.phpt","test:ext/bz2/tests/oom_bzcompress.phpt","test:ext/bz2/tests/oom_bzdecompress.phpt","test:ext/bz2/tests/oom_bzip2_decompress_filter.phpt","test:ext/curl/tests/oom_curl_exec.phpt","test:ext/curl/tests/oom_curl_multi_exec.phpt","test:ext/date/tests/oom_date_create.phpt","test:ext/date/tests/oom_date_create_immutable.phpt","test:ext/date/tests/oom_date_interval_create_from_date_string.phpt","test:ext/date/tests/oom_date_modify.phpt","test:ext/date/tests/oom_date_parse.phpt","test:ext/date/tests/oom_dateinterval_construct.phpt","test:ext/date/tests/oom_dateinterval_createfromdatestring.phpt","test:ext/date/tests/oom_dateperiod_construct.phpt","test:ext/date/tests/oom_datetime_construct.phpt","test:ext/date/tests/oom_datetime_modify.phpt","test:ext/date/tests/oom_datetimeimmutable_construct.phpt","test:ext/date/tests/oom_datetimeimmutable_modify.phpt","test:ext/date/tests/oom_strtotime.phpt","test:ext/dom/tests/oom_xpath.phpt","test:ext/exif/tests/oom_exif_numeric_metadata.phpt","test:ext/exif/tests/oom_exif_read_data_tags.phpt","test:ext/exif/tests/oom_exif_scan_jpeg_header.phpt","test:ext/exif/tests/oom_exif_thumbnail_large_file_001.phpt","test:ext/exif/tests/oom_exif_thumbnail_large_file_002.phpt","test:ext/exif/tests/oom_exif_thumbnail_tiff.phpt","test:ext/fileinfo/tests/oom_cdf_sector_chain.phpt","test:ext/filter/tests/oom_filter_default_encoded.phpt","test:ext/filter/tests/oom_filter_input.phpt","test:ext/filter/tests/oom_filter_input_array.phpt","test:ext/filter/tests/oom_filter_var.phpt","test:ext/filter/tests/oom_filter_var_array.phpt","test:ext/filter/tests/oom_filter_var_full_special_chars.phpt","test:ext/gd/tests/oom_imagecreatefrombmp.phpt","test:ext/gd/tests/oom_imagecreatefromgd2.phpt","test:ext/gd/tests/oom_imagecreatefromgd2_chunkbuf.phpt","test:ext/gd/tests/oom_imagecreatefromgd2_compbuf.phpt","test:ext/gd/tests/oom_imagecreatefromgd2part.phpt","test:ext/gd/tests/oom_imagecreatefromgd2part_chunkbuf.phpt","test:ext/gd/tests/oom_imagecreatefromgd2part_compbuf.phpt","test:ext/gd/tests/oom_imagecreatefromgif.phpt","test:ext/gd/tests/oom_imagecreatefrompng.phpt","test:ext/gd/tests/oom_imagecreatefromstring.phpt","test:ext/gd/tests/oom_imagecreatefromtga.phpt","test:ext/gd/tests/oom_imagecreatefromwbmp.phpt","test:ext/gd/tests/oom_imagecreatefromxbm.phpt","test:ext/gd/tests/oom_imagepalettetotruecolor.phpt","test:ext/iconv/tests/oom_iconv.phpt","test:ext/iconv/tests/oom_iconv_mime_decode.phpt","test:ext/iconv/tests/oom_iconv_mime_decode_headers.phpt","test:ext/iconv/tests/oom_iconv_mime_encode.phpt","test:ext/iconv/tests/oom_iconv_mime_encode_line_length.phpt","test:ext/iconv/tests/oom_iconv_stream_filter.phpt","test:ext/imap/tests/oom_imap_mime_header_decode.phpt","test:ext/intl/tests/oom_normalizer_normalize.phpt","test:ext/intl/tests/oom_normalizer_normalize_func.phpt","test:ext/intl/tests/oom_uconverter_convert.phpt","test:ext/intl/tests/oom_uconverter_transcode.phpt","test:ext/json/tests/json_decode_oom_utf8_substitute.phpt","test:ext/json/tests/json_encode_oom_escape.phpt","test:ext/json/tests/json_encode_oom_partial_output.phpt","test:ext/json/tests/json_encode_oom_pretty_print.phpt","test:ext/json/tests/json_encode_oom_string_prealloc.phpt","test:ext/mbstring/tests/oom_buf_growth.phpt","test:ext/mbstring/tests/oom_mb_convert_case.phpt","test:ext/mbstring/tests/oom_mb_convert_encoding.phpt","test:ext/mbstring/tests/oom_mb_convert_variables.phpt","test:ext/mbstring/tests/oom_mb_convert_variables_many.phpt","test:ext/mbstring/tests/oom_mb_decode_mimeheader.phpt","test:ext/mbstring/tests/oom_mb_encode_mimeheader.phpt","test:ext/mbstring/tests/oom_mb_encode_numericentity.phpt","test:ext/mbstring/tests/oom_mb_ereg_replace.phpt","test:ext/mbstring/tests/oom_mb_eregi_replace.phpt","test:ext/mbstring/tests/oom_mb_parse_str.phpt","test:ext/mbstring/tests/oom_mb_split.phpt","test:ext/mbstring/tests/oom_mb_str_split.phpt","test:ext/mbstring/tests/oom_mb_str_split_filter.phpt","test:ext/mbstring/tests/oom_mb_str_split_fixed_width.phpt","test:ext/mbstring/tests/oom_mb_str_split_length.phpt","test:ext/mbstring/tests/oom_mb_strcut_filter.phpt","test:ext/mbstring/tests/oom_mb_strcut_length.phpt","test:ext/mbstring/tests/oom_mb_strimwidth.phpt","test:ext/mbstring/tests/oom_mb_strtoupper.phpt","test:ext/mbstring/tests/oom_mb_substr_count.phpt","test:ext/mbstring/tests/oom_mb_substr_length.phpt","test:ext/pcre/tests/oom_preg_filter.phpt","test:ext/pcre/tests/oom_preg_match_all.phpt","test:ext/pcre/tests/oom_preg_match_captures.phpt","test:ext/pcre/tests/oom_preg_replace.phpt","test:ext/pcre/tests/oom_preg_replace_callback.phpt","test:ext/pcre/tests/oom_preg_replace_callback_array.phpt","test:ext/pcre/tests/oom_preg_split.phpt","test:ext/session/tests/rfc1867_incomplete_class_reserved_props.phpt","test:ext/session/tests/rfc1867_no_user_code.phpt","test:ext/session/tests/rfc1867_sid_invalid.phpt","test:ext/simplexml/tests/oom_array_cast.phpt","test:ext/simplexml/tests/oom_json_encode.phpt","test:ext/simplexml/tests/oom_xpath.phpt","test:ext/soap/tests/oom_soapclient_call.phpt","test:ext/soap/tests/oom_soapclient_dorequest_chunked.phpt","test:ext/soap/tests/oom_soapclient_dorequest_close.phpt","test:ext/soap/tests/oom_soapclient_dorequest_content_length.phpt","test:ext/soap/tests/oom_soapclient_response_headers.phpt","test:ext/soap/tests/oom_soapclient_soapcall.phpt","test:ext/soap/tests/oom_soapserver_handle_array.phpt","test:ext/soap/tests/oom_soapserver_handle_headers.phpt","test:ext/soap/tests/oom_soapserver_handle_parameters.phpt","test:ext/standard/tests/GHSA-96wq-48vp-hh57.phpt","test:ext/standard/tests/array/oom_array_chunk.phpt","test:ext/standard/tests/array/oom_array_map_zip.phpt","test:ext/standard/tests/file/fread_oom_chunk_size.phpt","test:ext/standard/tests/file/fread_oom_filter_chunk_size.phpt","test:ext/standard/tests/file/fread_oom_length.phpt","test:ext/standard/tests/file/oom_file.phpt","test:ext/standard/tests/file/oom_file_get_contents.phpt","test:ext/standard/tests/image/oom_getimagesize_cws.phpt","test:ext/standard/tests/image/oom_getimagesize_xbm.phpt","test:ext/standard/tests/image/oom_getimagesizefromstring_cws.phpt","test:ext/standard/tests/serialize/incomplete_class_raw_payload_markers.phpt","test:ext/standard/tests/streams/bug61115-1.phpt","test:ext/standard/tests/streams/oom_stream_copy_to_stream_memory.phpt","test:ext/standard/tests/streams/oom_stream_get_contents.phpt","test:ext/standard/tests/streams/stream_get_line_oom_chunk_size.phpt","test:ext/standard/tests/strings/chunk_split_variation3.phpt","test:ext/standard/tests/strings/oom_explode.phpt","test:ext/standard/tests/strings/oom_implode.phpt","test:ext/standard/tests/strings/oom_levenshtein.phpt","test:ext/standard/tests/strings/oom_nl2br.phpt","test:ext/standard/tests/strings/oom_setcookie_value.phpt","test:ext/standard/tests/strings/oom_str_getcsv.phpt","test:ext/standard/tests/strings/oom_str_ireplace.phpt","test:ext/standard/tests/strings/oom_str_replace.phpt","test:ext/standard/tests/strings/oom_str_split.phpt","test:ext/standard/tests/strings/oom_str_word_count.phpt","test:ext/standard/tests/strings/oom_strtr.phpt","test:ext/standard/tests/strings/oom_substr_replace.phpt","test:ext/standard/tests/strings/oom_unpack.phpt","test:ext/standard/tests/strings/str_pad_variation1.phpt","test:ext/standard/tests/strings/wordwrap_memory_limit_002.phpt","test:ext/standard/tests/strings/wordwrap_memory_limit_003.phpt","test:ext/standard/tests/strings/wordwrap_memory_limit_004.phpt","test:ext/tokenizer/tests/token_get_all_TOKEN_PARSE_oom_feedback.phpt","test:ext/xml/tests/oom_xml_parse_attributes.phpt","test:ext/xml/tests/oom_xml_parse_into_struct.phpt","test:ext/xml/tests/oom_xml_parse_ns.phpt","test:ext/xmlreader/tests/oom_xmlreader_getattribute.phpt","test:ext/xmlreader/tests/oom_xmlreader_getattributeno.phpt","test:ext/xmlreader/tests/oom_xmlreader_getattributens.phpt","test:ext/xmlreader/tests/oom_xmlreader_lookupnamespace.phpt","test:ext/xmlreader/tests/oom_xmlreader_readinnerxml.phpt","test:ext/xmlreader/tests/oom_xmlreader_readouterxml.phpt","test:ext/xmlreader/tests/oom_xmlreader_readstring.phpt","test:ext/zend_test/test.c","test:ext/zend_test/test.stub.php","test:ext/zend_test/test_arginfo.h","test:ext/zend_test/tests/observer_bug81430_2.phpt","test:ext/zend_test/tests/observer_bug81435.phpt","test:ext/zend_test/tests/observer_error_01.phpt","test:ext/zend_test/tests/observer_fiber_functions_03.phpt","test:ext/zend_test/tests/zend_test_handle_post_data.phpt","test:ext/zlib/tests/oom_deflate_add.phpt","test:ext/zlib/tests/oom_gzcompress.phpt","test:ext/zlib/tests/oom_gzdecode.phpt","test:ext/zlib/tests/oom_gzfile.phpt","test:ext/zlib/tests/oom_gzgets.phpt","test:ext/zlib/tests/oom_gzpassthru.phpt","test:ext/zlib/tests/oom_inflate_add.phpt","test:ext/zlib/tests/oom_readgzfile.phpt","test:ext/zlib/tests/oom_zlib_inflate_filter.phpt","test:run-tests.php","test:sapi/cli/tests/oom_request_parsing_next_request.phpt","test:sapi/cli/tests/oom_shutdown_function_next_request.phpt","test:sapi/fpm/tests/bug77023-pm-dynamic-blocking-sigquit.phpt","test:tests/basic/GHSA-2cv3-554h-jpmh_multipart.phpt","test:tests/basic/GHSA-2cv3-554h-jpmh_urlencoded.phpt","test:tests/basic/GHSA-f883-x959-3vr9_001.phpt","test:tests/basic/GHSA-f883-x959-3vr9_002.phpt","test:tests/basic/GHSA-f883-x959-3vr9_003.phpt","test:tests/basic/GHSA-f883-x959-3vr9_004.phpt","test:tests/basic/GHSA-f883-x959-3vr9_005.phpt","test:tests/basic/GHSA-f883-x959-3vr9_006.phpt","test:tests/basic/GHSA-f883-x959-3vr9_007.phpt","test:tests/basic/GHSA-f883-x959-3vr9_008.phpt","test:tests/basic/GHSA-f883-x959-3vr9_009.phpt","test:tests/basic/GHSA-f883-x959-3vr9_010.phpt","test:tests/basic/GHSA-f883-x959-3vr9_011.phpt","test:tests/basic/oom_rfc1867_array_upload_name.phpt","test:tests/basic/oom_rfc1867_early_report.phpt","test:tests/basic/oom_rfc1867_field_name.phpt","test:tests/basic/oom_rfc1867_files.phpt","test:tests/basic/oom_rfc1867_files_registration.phpt","test:tests/basic/oom_rfc1867_files_registration_full_path.phpt","test:tests/basic/oom_rfc1867_form_value.phpt","test:tests/basic/oom_rfc1867_header_continuation.phpt","test:tests/basic/oom_rfc1867_header_count.phpt","test:tests/basic/oom_rfc1867_long_header_line.phpt","test:tests/basic/oom_rfc1867_mb_encoding.phpt","test:tests/basic/oom_rfc1867_post_vars.phpt","test:tests/basic/oom_rfc1867_upload_progress.phpt","test:tests/output/gh15179.phpt","test:tests/output/oom_in_internal_output_handler.phpt"],"nodes_removed":[],"edges_added":[["test:Zend/tests/bug40770.phpt tests remediation:fix-commit","code"],["test:Zend/tests/bug54268.phpt tests remediation:fix-commit","code"],["test:Zend/tests/bug76846.phpt tests remediation:fix-commit","code"],["test:Zend/tests/fibers/get-return-after-bailout.phpt tests remediation:fix-commit","code"],["test:Zend/tests/gh11189.phpt tests remediation:fix-commit","code"],["test:Zend/tests/gh11189_1.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_SplFixedArray___unserialize.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_SplFixedArray___unserialize.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_SplFixedArray___wakeup.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_SplFixedArray___wakeup.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_SplFixedArray_copy_ctor.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_SplFixedArray_copy_ctor.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_SplFixedArray_fromArray_001.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_SplFixedArray_fromArray_001.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_SplFixedArray_fromArray_002.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_SplFixedArray_fromArray_002.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_after_main_script.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_after_main_script.phpt tests remediation:fix-unwind","inferred"],["test:Zend/tests/oom_array_fill_001.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_fill_001.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_fill_002.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_fill_002.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_fill_003.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_fill_003.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_fill_004.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_fill_004.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_001.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_001.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_002.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_002.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_003.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_003.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_004.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_004.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_005.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_005.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_006.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_006.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_007.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_007.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_array_pad_008.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_array_pad_008.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_call_function.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_call_function.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_call_function_002.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_call_function_002.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_call_function_003.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_call_function_003.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_debug_backtrace.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_debug_backtrace.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_debug_backtrace_args.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_debug_backtrace_args.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_debug_backtrace_named_args.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_debug_backtrace_named_args.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_error_get_last.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_error_get_last.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_exception_trace.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_exception_trace.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_hard_limit_exceeded.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_hard_limit_exceeded.phpt tests remediation:fix-hard-limit","inferred"],["test:Zend/tests/oom_hard_limit_exceeded_during_complilation.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_hard_limit_exceeded_during_complilation.phpt tests remediation:fix-hard-limit","inferred"],["test:Zend/tests/oom_interrupt.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_interrupt.phpt tests remediation:fix-unwind","inferred"],["test:Zend/tests/oom_interrupt_unfinished_call_frame.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_interrupt_unfinished_call_frame.phpt tests remediation:fix-unwind","inferred"],["test:Zend/tests/oom_interrupt_unfinished_call_frame_fiber.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_interrupt_unfinished_call_frame_fiber.phpt tests remediation:fix-unwind","inferred"],["test:Zend/tests/oom_json_decode_001.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_json_decode_001.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_json_decode_002.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_json_decode_002.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_json_decode_003.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_json_decode_003.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_json_decode_004.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_json_decode_004.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_json_decode_005.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_json_decode_005.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_json_decode_006.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_json_decode_006.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_json_decode_007.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_json_decode_007.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_pending_at_shutdown.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_pending_at_shutdown.phpt tests remediation:fix-unwind","inferred"],["test:Zend/tests/oom_range_001.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_range_001.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_range_002.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_range_002.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_range_003.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_range_003.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_range_004.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_range_004.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_request_parsing.phpt tests remediation:fix-bounded-parsing","inferred"],["test:Zend/tests/oom_request_parsing.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_soft_limit_exceeded.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_soft_limit_exceeded.phpt tests remediation:fix-soft-limit","inferred"],["test:Zend/tests/oom_soft_limit_exceeded_fcall.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_soft_limit_exceeded_fcall.phpt tests remediation:fix-soft-limit","inferred"],["test:Zend/tests/oom_soft_limit_in_callback.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_soft_limit_in_callback.phpt tests remediation:fix-soft-limit","inferred"],["test:Zend/tests/oom_str_repeat.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_str_repeat.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_001.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_001.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_002.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_002.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_003.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_003.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_004.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_004.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_005.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_005.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_006.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_006.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_007.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_007.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_008.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_008.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_009.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_009.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_011.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_011.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_012.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_012.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_013.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_013.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_014.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_014.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_015.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_015.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/oom_unserialize_016.phpt tests remediation:fix-commit","code"],["test:Zend/tests/oom_unserialize_016.phpt tests remediation:fix-fallible","inferred"],["test:Zend/tests/singleton_array.phpt tests remediation:fix-commit","code"],["test:ext/bz2/tests/oom_bzcompress.phpt tests remediation:fix-commit","code"],["test:ext/bz2/tests/oom_bzcompress.phpt tests remediation:fix-fallible","inferred"],["test:ext/bz2/tests/oom_bzdecompress.phpt tests remediation:fix-commit","code"],["test:ext/bz2/tests/oom_bzdecompress.phpt tests remediation:fix-fallible","inferred"],["test:ext/bz2/tests/oom_bzip2_decompress_filter.phpt tests remediation:fix-commit","code"],["test:ext/bz2/tests/oom_bzip2_decompress_filter.phpt tests remediation:fix-fallible","inferred"],["test:ext/curl/tests/oom_curl_exec.phpt tests remediation:fix-commit","code"],["test:ext/curl/tests/oom_curl_exec.phpt tests remediation:fix-fallible","inferred"],["test:ext/curl/tests/oom_curl_multi_exec.phpt tests remediation:fix-commit","code"],["test:ext/curl/tests/oom_curl_multi_exec.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_date_create.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_date_create.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_date_create_immutable.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_date_create_immutable.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_date_interval_create_from_date_string.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_date_interval_create_from_date_string.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_date_modify.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_date_modify.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_date_parse.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_date_parse.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_dateinterval_construct.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_dateinterval_construct.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_dateinterval_createfromdatestring.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_dateinterval_createfromdatestring.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_dateperiod_construct.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_dateperiod_construct.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_datetime_construct.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_datetime_construct.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_datetime_modify.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_datetime_modify.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_datetimeimmutable_construct.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_datetimeimmutable_construct.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_datetimeimmutable_modify.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_datetimeimmutable_modify.phpt tests remediation:fix-fallible","inferred"],["test:ext/date/tests/oom_strtotime.phpt tests remediation:fix-commit","code"],["test:ext/date/tests/oom_strtotime.phpt tests remediation:fix-fallible","inferred"],["test:ext/dom/tests/oom_xpath.phpt tests remediation:fix-commit","code"],["test:ext/dom/tests/oom_xpath.phpt tests remediation:fix-fallible","inferred"],["test:ext/exif/tests/oom_exif_numeric_metadata.phpt tests remediation:fix-commit","code"],["test:ext/exif/tests/oom_exif_numeric_metadata.phpt tests remediation:fix-fallible","inferred"],["test:ext/exif/tests/oom_exif_read_data_tags.phpt tests remediation:fix-commit","code"],["test:ext/exif/tests/oom_exif_read_data_tags.phpt tests remediation:fix-fallible","inferred"],["test:ext/exif/tests/oom_exif_scan_jpeg_header.phpt tests remediation:fix-commit","code"],["test:ext/exif/tests/oom_exif_scan_jpeg_header.phpt tests remediation:fix-fallible","inferred"],["test:ext/exif/tests/oom_exif_thumbnail_large_file_001.phpt tests remediation:fix-commit","code"],["test:ext/exif/tests/oom_exif_thumbnail_large_file_001.phpt tests remediation:fix-fallible","inferred"],["test:ext/exif/tests/oom_exif_thumbnail_large_file_002.phpt tests remediation:fix-commit","code"],["test:ext/exif/tests/oom_exif_thumbnail_large_file_002.phpt tests remediation:fix-fallible","inferred"],["test:ext/exif/tests/oom_exif_thumbnail_tiff.phpt tests remediation:fix-commit","code"],["test:ext/exif/tests/oom_exif_thumbnail_tiff.phpt tests remediation:fix-fallible","inferred"],["test:ext/fileinfo/tests/oom_cdf_sector_chain.phpt tests remediation:fix-commit","code"],["test:ext/fileinfo/tests/oom_cdf_sector_chain.phpt tests remediation:fix-fallible","inferred"],["test:ext/filter/tests/oom_filter_default_encoded.phpt tests remediation:fix-commit","code"],["test:ext/filter/tests/oom_filter_default_encoded.phpt tests remediation:fix-fallible","inferred"],["test:ext/filter/tests/oom_filter_input.phpt tests remediation:fix-commit","code"],["test:ext/filter/tests/oom_filter_input.phpt tests remediation:fix-fallible","inferred"],["test:ext/filter/tests/oom_filter_input_array.phpt tests remediation:fix-commit","code"],["test:ext/filter/tests/oom_filter_input_array.phpt tests remediation:fix-fallible","inferred"],["test:ext/filter/tests/oom_filter_var.phpt tests remediation:fix-commit","code"],["test:ext/filter/tests/oom_filter_var.phpt tests remediation:fix-fallible","inferred"],["test:ext/filter/tests/oom_filter_var_array.phpt tests remediation:fix-commit","code"],["test:ext/filter/tests/oom_filter_var_array.phpt tests remediation:fix-fallible","inferred"],["test:ext/filter/tests/oom_filter_var_full_special_chars.phpt tests remediation:fix-commit","code"],["test:ext/filter/tests/oom_filter_var_full_special_chars.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefrombmp.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefrombmp.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromgd2.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromgd2.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromgd2_chunkbuf.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromgd2_chunkbuf.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromgd2_compbuf.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromgd2_compbuf.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromgd2part.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromgd2part.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromgd2part_chunkbuf.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromgd2part_chunkbuf.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromgd2part_compbuf.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromgd2part_compbuf.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromgif.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromgif.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefrompng.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefrompng.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromstring.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromstring.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromtga.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromtga.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromwbmp.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromwbmp.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagecreatefromxbm.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagecreatefromxbm.phpt tests remediation:fix-fallible","inferred"],["test:ext/gd/tests/oom_imagepalettetotruecolor.phpt tests remediation:fix-commit","code"],["test:ext/gd/tests/oom_imagepalettetotruecolor.phpt tests remediation:fix-fallible","inferred"],["test:ext/iconv/tests/oom_iconv.phpt tests remediation:fix-commit","code"],["test:ext/iconv/tests/oom_iconv.phpt tests remediation:fix-fallible","inferred"],["test:ext/iconv/tests/oom_iconv_mime_decode.phpt tests remediation:fix-commit","code"],["test:ext/iconv/tests/oom_iconv_mime_decode.phpt tests remediation:fix-fallible","inferred"],["test:ext/iconv/tests/oom_iconv_mime_decode_headers.phpt tests remediation:fix-commit","code"],["test:ext/iconv/tests/oom_iconv_mime_decode_headers.phpt tests remediation:fix-fallible","inferred"],["test:ext/iconv/tests/oom_iconv_mime_encode.phpt tests remediation:fix-commit","code"],["test:ext/iconv/tests/oom_iconv_mime_encode.phpt tests remediation:fix-fallible","inferred"],["test:ext/iconv/tests/oom_iconv_mime_encode_line_length.phpt tests remediation:fix-commit","code"],["test:ext/iconv/tests/oom_iconv_mime_encode_line_length.phpt tests remediation:fix-fallible","inferred"],["test:ext/iconv/tests/oom_iconv_stream_filter.phpt tests remediation:fix-commit","code"],["test:ext/iconv/tests/oom_iconv_stream_filter.phpt tests remediation:fix-fallible","inferred"],["test:ext/imap/tests/oom_imap_mime_header_decode.phpt tests remediation:fix-commit","code"],["test:ext/imap/tests/oom_imap_mime_header_decode.phpt tests remediation:fix-fallible","inferred"],["test:ext/intl/tests/oom_normalizer_normalize.phpt tests remediation:fix-commit","code"],["test:ext/intl/tests/oom_normalizer_normalize.phpt tests remediation:fix-fallible","inferred"],["test:ext/intl/tests/oom_normalizer_normalize_func.phpt tests remediation:fix-commit","code"],["test:ext/intl/tests/oom_normalizer_normalize_func.phpt tests remediation:fix-fallible","inferred"],["test:ext/intl/tests/oom_uconverter_convert.phpt tests remediation:fix-commit","code"],["test:ext/intl/tests/oom_uconverter_convert.phpt tests remediation:fix-fallible","inferred"],["test:ext/intl/tests/oom_uconverter_transcode.phpt tests remediation:fix-commit","code"],["test:ext/intl/tests/oom_uconverter_transcode.phpt tests remediation:fix-fallible","inferred"],["test:ext/json/tests/json_decode_oom_utf8_substitute.phpt tests remediation:fix-commit","code"],["test:ext/json/tests/json_decode_oom_utf8_substitute.phpt tests remediation:fix-fallible","inferred"],["test:ext/json/tests/json_encode_oom_escape.phpt tests remediation:fix-commit","code"],["test:ext/json/tests/json_encode_oom_escape.phpt tests remediation:fix-fallible","inferred"],["test:ext/json/tests/json_encode_oom_partial_output.phpt tests remediation:fix-commit","code"],["test:ext/json/tests/json_encode_oom_partial_output.phpt tests remediation:fix-fallible","inferred"],["test:ext/json/tests/json_encode_oom_pretty_print.phpt tests remediation:fix-commit","code"],["test:ext/json/tests/json_encode_oom_pretty_print.phpt tests remediation:fix-fallible","inferred"],["test:ext/json/tests/json_encode_oom_string_prealloc.phpt tests remediation:fix-commit","code"],["test:ext/json/tests/json_encode_oom_string_prealloc.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_buf_growth.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_buf_growth.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_convert_case.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_convert_case.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_convert_encoding.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_convert_encoding.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_convert_variables.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_convert_variables.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_convert_variables_many.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_convert_variables_many.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_decode_mimeheader.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_decode_mimeheader.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_encode_mimeheader.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_encode_mimeheader.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_encode_numericentity.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_encode_numericentity.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_ereg_replace.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_ereg_replace.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_eregi_replace.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_eregi_replace.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_parse_str.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_parse_str.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_split.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_split.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_str_split.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_str_split.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_str_split_filter.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_str_split_filter.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_str_split_fixed_width.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_str_split_fixed_width.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_str_split_length.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_str_split_length.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_strcut_filter.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_strcut_filter.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_strcut_length.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_strcut_length.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_strimwidth.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_strimwidth.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_strtoupper.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_strtoupper.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_substr_count.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_substr_count.phpt tests remediation:fix-fallible","inferred"],["test:ext/mbstring/tests/oom_mb_substr_length.phpt tests remediation:fix-commit","code"],["test:ext/mbstring/tests/oom_mb_substr_length.phpt tests remediation:fix-fallible","inferred"],["test:ext/pcre/tests/oom_preg_filter.phpt tests remediation:fix-commit","code"],["test:ext/pcre/tests/oom_preg_filter.phpt tests remediation:fix-fallible","inferred"],["test:ext/pcre/tests/oom_preg_match_all.phpt tests remediation:fix-commit","code"],["test:ext/pcre/tests/oom_preg_match_all.phpt tests remediation:fix-fallible","inferred"],["test:ext/pcre/tests/oom_preg_match_captures.phpt tests remediation:fix-commit","code"],["test:ext/pcre/tests/oom_preg_match_captures.phpt tests remediation:fix-fallible","inferred"],["test:ext/pcre/tests/oom_preg_replace.phpt tests remediation:fix-commit","code"],["test:ext/pcre/tests/oom_preg_replace.phpt tests remediation:fix-fallible","inferred"],["test:ext/pcre/tests/oom_preg_replace_callback.phpt tests remediation:fix-commit","code"],["test:ext/pcre/tests/oom_preg_replace_callback.phpt tests remediation:fix-fallible","inferred"],["test:ext/pcre/tests/oom_preg_replace_callback_array.phpt tests remediation:fix-commit","code"],["test:ext/pcre/tests/oom_preg_replace_callback_array.phpt tests remediation:fix-fallible","inferred"],["test:ext/pcre/tests/oom_preg_split.phpt tests remediation:fix-commit","code"],["test:ext/pcre/tests/oom_preg_split.phpt tests remediation:fix-fallible","inferred"],["test:ext/session/tests/rfc1867_incomplete_class_reserved_props.phpt tests remediation:fix-bounded-parsing","inferred"],["test:ext/session/tests/rfc1867_incomplete_class_reserved_props.phpt tests remediation:fix-commit","code"],["test:ext/session/tests/rfc1867_no_user_code.phpt tests remediation:fix-bounded-parsing","inferred"],["test:ext/session/tests/rfc1867_no_user_code.phpt tests remediation:fix-commit","code"],["test:ext/session/tests/rfc1867_sid_invalid.phpt tests remediation:fix-bounded-parsing","inferred"],["test:ext/session/tests/rfc1867_sid_invalid.phpt tests remediation:fix-commit","code"],["test:ext/simplexml/tests/oom_array_cast.phpt tests remediation:fix-commit","code"],["test:ext/simplexml/tests/oom_array_cast.phpt tests remediation:fix-fallible","inferred"],["test:ext/simplexml/tests/oom_json_encode.phpt tests remediation:fix-commit","code"],["test:ext/simplexml/tests/oom_json_encode.phpt tests remediation:fix-fallible","inferred"],["test:ext/simplexml/tests/oom_xpath.phpt tests remediation:fix-commit","code"],["test:ext/simplexml/tests/oom_xpath.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapclient_call.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapclient_call.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapclient_dorequest_chunked.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapclient_dorequest_chunked.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapclient_dorequest_close.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapclient_dorequest_close.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapclient_dorequest_content_length.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapclient_dorequest_content_length.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapclient_response_headers.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapclient_response_headers.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapclient_soapcall.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapclient_soapcall.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapserver_handle_array.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapserver_handle_array.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapserver_handle_headers.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapserver_handle_headers.phpt tests remediation:fix-fallible","inferred"],["test:ext/soap/tests/oom_soapserver_handle_parameters.phpt tests remediation:fix-commit","code"],["test:ext/soap/tests/oom_soapserver_handle_parameters.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/GHSA-96wq-48vp-hh57.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/array/oom_array_chunk.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/array/oom_array_chunk.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/array/oom_array_map_zip.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/array/oom_array_map_zip.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/file/fread_oom_chunk_size.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/file/fread_oom_chunk_size.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/file/fread_oom_filter_chunk_size.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/file/fread_oom_filter_chunk_size.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/file/fread_oom_length.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/file/fread_oom_length.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/file/oom_file.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/file/oom_file.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/file/oom_file_get_contents.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/file/oom_file_get_contents.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/image/oom_getimagesize_cws.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/image/oom_getimagesize_cws.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/image/oom_getimagesize_xbm.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/image/oom_getimagesize_xbm.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/image/oom_getimagesizefromstring_cws.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/image/oom_getimagesizefromstring_cws.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/serialize/incomplete_class_raw_payload_markers.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/streams/bug61115-1.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/streams/oom_stream_copy_to_stream_memory.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/streams/oom_stream_copy_to_stream_memory.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/streams/oom_stream_get_contents.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/streams/oom_stream_get_contents.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/streams/stream_get_line_oom_chunk_size.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/streams/stream_get_line_oom_chunk_size.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/chunk_split_variation3.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_explode.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_explode.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_implode.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_implode.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_levenshtein.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_levenshtein.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_nl2br.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_nl2br.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_setcookie_value.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_setcookie_value.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_str_getcsv.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_str_getcsv.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_str_ireplace.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_str_ireplace.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_str_replace.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_str_replace.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_str_split.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_str_split.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_str_word_count.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_str_word_count.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_strtr.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_strtr.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_substr_replace.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_substr_replace.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/oom_unpack.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/oom_unpack.phpt tests remediation:fix-fallible","inferred"],["test:ext/standard/tests/strings/str_pad_variation1.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/wordwrap_memory_limit_002.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/wordwrap_memory_limit_003.phpt tests remediation:fix-commit","code"],["test:ext/standard/tests/strings/wordwrap_memory_limit_004.phpt tests remediation:fix-commit","code"],["test:ext/tokenizer/tests/token_get_all_TOKEN_PARSE_oom_feedback.phpt tests remediation:fix-commit","code"],["test:ext/tokenizer/tests/token_get_all_TOKEN_PARSE_oom_feedback.phpt tests remediation:fix-fallible","inferred"],["test:ext/xml/tests/oom_xml_parse_attributes.phpt tests remediation:fix-commit","code"],["test:ext/xml/tests/oom_xml_parse_attributes.phpt tests remediation:fix-fallible","inferred"],["test:ext/xml/tests/oom_xml_parse_into_struct.phpt tests remediation:fix-commit","code"],["test:ext/xml/tests/oom_xml_parse_into_struct.phpt tests remediation:fix-fallible","inferred"],["test:ext/xml/tests/oom_xml_parse_ns.phpt tests remediation:fix-commit","code"],["test:ext/xml/tests/oom_xml_parse_ns.phpt tests remediation:fix-fallible","inferred"],["test:ext/xmlreader/tests/oom_xmlreader_getattribute.phpt tests remediation:fix-commit","code"],["test:ext/xmlreader/tests/oom_xmlreader_getattribute.phpt tests remediation:fix-fallible","inferred"],["test:ext/xmlreader/tests/oom_xmlreader_getattributeno.phpt tests remediation:fix-commit","code"],["test:ext/xmlreader/tests/oom_xmlreader_getattributeno.phpt tests remediation:fix-fallible","inferred"],["test:ext/xmlreader/tests/oom_xmlreader_getattributens.phpt tests remediation:fix-commit","code"],["test:ext/xmlreader/tests/oom_xmlreader_getattributens.phpt tests remediation:fix-fallible","inferred"],["test:ext/xmlreader/tests/oom_xmlreader_lookupnamespace.phpt tests remediation:fix-commit","code"],["test:ext/xmlreader/tests/oom_xmlreader_lookupnamespace.phpt tests remediation:fix-fallible","inferred"],["test:ext/xmlreader/tests/oom_xmlreader_readinnerxml.phpt tests remediation:fix-commit","code"],["test:ext/xmlreader/tests/oom_xmlreader_readinnerxml.phpt tests remediation:fix-fallible","inferred"],["test:ext/xmlreader/tests/oom_xmlreader_readouterxml.phpt tests remediation:fix-commit","code"],["test:ext/xmlreader/tests/oom_xmlreader_readouterxml.phpt tests remediation:fix-fallible","inferred"],["test:ext/xmlreader/tests/oom_xmlreader_readstring.phpt tests remediation:fix-commit","code"],["test:ext/xmlreader/tests/oom_xmlreader_readstring.phpt tests remediation:fix-fallible","inferred"],["test:ext/zend_test/test.c tests remediation:fix-commit","code"],["test:ext/zend_test/test.stub.php tests remediation:fix-commit","code"],["test:ext/zend_test/test_arginfo.h tests remediation:fix-commit","code"],["test:ext/zend_test/tests/observer_bug81430_2.phpt tests remediation:fix-commit","code"],["test:ext/zend_test/tests/observer_bug81435.phpt tests remediation:fix-commit","code"],["test:ext/zend_test/tests/observer_error_01.phpt tests remediation:fix-commit","code"],["test:ext/zend_test/tests/observer_fiber_functions_03.phpt tests remediation:fix-commit","code"],["test:ext/zend_test/tests/zend_test_handle_post_data.phpt tests remediation:fix-bounded-parsing","inferred"],["test:ext/zend_test/tests/zend_test_handle_post_data.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_deflate_add.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_deflate_add.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_gzcompress.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_gzcompress.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_gzdecode.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_gzdecode.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_gzfile.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_gzfile.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_gzgets.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_gzgets.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_gzpassthru.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_gzpassthru.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_inflate_add.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_inflate_add.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_readgzfile.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_readgzfile.phpt tests remediation:fix-fallible","inferred"],["test:ext/zlib/tests/oom_zlib_inflate_filter.phpt tests remediation:fix-commit","code"],["test:ext/zlib/tests/oom_zlib_inflate_filter.phpt tests remediation:fix-fallible","inferred"],["test:run-tests.php tests remediation:fix-commit","code"],["test:sapi/cli/tests/oom_request_parsing_next_request.phpt tests remediation:fix-bounded-parsing","inferred"],["test:sapi/cli/tests/oom_request_parsing_next_request.phpt tests remediation:fix-commit","code"],["test:sapi/cli/tests/oom_shutdown_function_next_request.phpt tests remediation:fix-commit","code"],["test:sapi/cli/tests/oom_shutdown_function_next_request.phpt tests remediation:fix-fallible","inferred"],["test:sapi/fpm/tests/bug77023-pm-dynamic-blocking-sigquit.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-2cv3-554h-jpmh_multipart.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-2cv3-554h-jpmh_urlencoded.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_001.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_002.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_003.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_004.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_005.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_006.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_007.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_008.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_009.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_010.phpt tests remediation:fix-commit","code"],["test:tests/basic/GHSA-f883-x959-3vr9_011.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_array_upload_name.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_array_upload_name.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_early_report.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_early_report.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_field_name.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_field_name.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_files.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_files.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_files_registration.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_files_registration.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_files_registration_full_path.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_files_registration_full_path.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_form_value.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_form_value.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_header_continuation.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_header_continuation.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_header_count.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_header_count.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_long_header_line.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_long_header_line.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_mb_encoding.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_mb_encoding.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_post_vars.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_post_vars.phpt tests remediation:fix-fallible","inferred"],["test:tests/basic/oom_rfc1867_upload_progress.phpt tests remediation:fix-commit","code"],["test:tests/basic/oom_rfc1867_upload_progress.phpt tests remediation:fix-fallible","inferred"],["test:tests/output/gh15179.phpt tests remediation:fix-commit","code"],["test:tests/output/oom_in_internal_output_handler.phpt tests remediation:fix-commit","code"],["test:tests/output/oom_in_internal_output_handler.phpt tests remediation:fix-fallible","inferred"],["vulnerability:cve-109618 fixed_by remediation:fix-commit","code"],["vulnerability:cve-109619 fixed_by remediation:fix-commit","code"]],"edges_removed":[],"basis_changed":[],"basis_recorded":[["claim:ac-high cites source:cve-cve-2026-109618","source"],["claim:ac-high cites source:fastly-blog-php2shell","source"],["claim:ac-high cites source:imperva-blog-php2shell","source"],["claim:affected-sites cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:ahead-of-attackers cites source:thehackernews-php2shell-4days","source"],["claim:ahead-of-attackers cites source:x-openai-php2shell","source"],["claim:ai-found cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:ai-found cites source:calif-php2shell","source"],["claim:ai-found cites source:wiz-blog-php2shell","source"],["claim:ai-found cites source:x-openai-php2shell","source"],["claim:amazon-honeypot cites source:aws-security-blog-madpot","source"],["claim:amazon-honeypot cites source:thehackernews-php2shell-4days","source"],["claim:cf-millions cites source:x-eastdakota-php2shell-stats","source"],["claim:chainguard cites source:php-foundation-blog-security-release","source"],["claim:chainguard cites source:theregister-php-blames-chainguard","source"],["claim:chainguard cites source:x-feross-chainguard","source"],["claim:cisa-none cites source:cisa-alert-php-20261021","source"],["claim:cisa-none cites source:cisa-kev-json","source"],["claim:cisa-none cites source:cve-cve-2026-109618","source"],["claim:cloudflare-traffic cites source:cloudflare-blog-php2shell-waf","source"],["claim:cvss-10 cites source:daubois-blog-php2shell-rumors","source"],["claim:cvss-10 cites source:php-foundation-blog-security-release","source"],["claim:disclosure-22oct cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:disclosure-22oct cites source:github-php-src-tag-php-8.5.12","source"],["claim:disclosure-22oct cites source:php-net-advisory","source"],["claim:edinburgh cites source:scotsman-edinburgh-council-offline","source"],["claim:fi-offline cites source:helsinkitimes-finland-shutdown","source"],["claim:fi-offline cites source:yle-finland-government-sites-shut","source"],["claim:fix-bailout cites source:github-ghsa-w8hw-w9fx-j79w","source"],["claim:fix-bailout cites source:github-php-src-branch-7.4-backport","source"],["claim:fix-bailout cites source:php-net-changelog-8","source"],["claim:fix-engine cites source:github-ghsa-6wmf-4rv5-p3rp","source"],["claim:fix-engine cites source:github-ghsa-w8hw-w9fx-j79w","source"],["claim:fix-engine cites source:github-php-src-fix-commit-3584a98bd","source"],["claim:fix-incomplete cites source:openwall-oss-security-109619-thread","source"],["claim:four-reporters cites source:daubois-blog-php2shell-rumors","source"],["claim:four-reporters cites source:github-ghsa-6wmf-4rv5-p3rp","source"],["claim:four-reporters cites source:github-ghsa-w8hw-w9fx-j79w","source"],["claim:huntress-none cites source:huntress-php2shell-rapid-response","source"],["claim:imperva-none cites source:imperva-blog-php2shell","source"],["claim:kev-precedent cites source:akamai-blog-cve-2024-4577-one-day","source"],["claim:kev-precedent cites source:cisa-kev-json","source"],["claim:kev-precedent cites source:cve-cve-2024-4577","source"],["claim:latvia-offline cites source:certlv-php-preventive","source"],["claim:leak-cve-ids cites source:php-foundation-blog-security-release","source"],["claim:leak-cve-ids cites source:phpfoundation-blog-security-release-leak","source"],["claim:leak-hn cites source:daubois-blog-php2shell-rumors","source"],["claim:leak-mitigations cites source:php-foundation-blog-security-release","source"],["claim:leak-video cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:leak-video cites source:calif-php2shell","source"],["claim:leak-video cites source:php-foundation-blog-security-release","source"],["claim:leak-video cites source:phpfoundation-blog-security-release-leak","source"],["claim:leak-watchtowr cites source:certeu-sa-2026-018","source"],["claim:leak-watchtowr cites source:daubois-blog-php2shell-rumors","source"],["claim:lorenc-ai-found cites source:theregister-php-blames-chainguard","source"],["claim:more-paths cites source:fastly-blog-php2shell","source"],["claim:more-paths cites source:openwall-oss-security-109619-thread","source"],["claim:most-severe cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:most-severe cites source:wiz-blog-php2shell","source"],["claim:nl-offline cites source:dutchitleaders-websites-offline","source"],["claim:nl-offline cites source:rijksoverheid-ncsc-php-news","source"],["claim:no-confirmed-compromise cites source:aws-security-blog-madpot","source"],["claim:no-confirmed-compromise cites source:cisa-alert-php-20261021","source"],["claim:no-confirmed-compromise cites source:cisa-kev-json","source"],["claim:no-confirmed-compromise cites source:huntress-php2shell-rapid-response","source"],["claim:no-confirmed-compromise cites source:imperva-blog-php2shell","source"],["claim:no-confirmed-compromise cites source:recordedfuture-php2shell","source"],["claim:no-confirmed-compromise cites source:securityweek-exploitation-days-before","source"],["claim:no-confirmed-compromise cites source:securityweek-first-attempts-sensors","source"],["claim:no-confirmed-compromise cites source:weirdgloop-blog-php2shell","source"],["claim:nz-active cites source:ncsc-nz-alert-php","source"],["claim:offline-allies cites source:acn-it-php2shell","source"],["claim:offline-allies cites source:acsc-alert-php","source"],["claim:offline-allies cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:offline-allies cites source:certeu-sa-2026-018","source"],["claim:offline-allies cites source:jpcert-at260033","source"],["claim:offline-allies cites source:ncsc-nl-php2shell","source"],["claim:offline-cisa cites source:cisa-alert-php-20261021","source"],["claim:offline-ncsc cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:offline-ncsc cites source:cccs-al26-026","source"],["claim:offline-ncsc cites source:ncsc-news-php","source"],["claim:offline-nsa cites source:nsa-press-php-4630238","source"],["claim:offline-nsa cites source:nsa-x-2112903220209098897","source"],["claim:only-update cites source:github-ghsa-6wmf-4rv5-p3rp","source"],["claim:only-update cites source:openwall-oss-security-2026-10-21-7","source"],["claim:only-update cites source:php-net-advisory","source"],["claim:openai-same-day cites source:github-ghsa-w8hw-w9fx-j79w","source"],["claim:openai-same-day cites source:php-foundation-blog-security-release","source"],["claim:oxford cites source:oxfordchronicle-councils-offline","source"],["claim:pocs-wrong cites source:github-rjmendez-phpup-2026","source"],["claim:pocs-wrong cites source:huntress-php2shell-rapid-response","source"],["claim:probing cites source:aws-security-blog-madpot","source"],["claim:probing cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:probing cites source:cloudflare-blog-php2shell-waf","source"],["claim:quarkslab-2024 cites source:calif-php2shell","source"],["claim:quarkslab-2024 cites source:php-foundation-blog-security-release","source"],["claim:quarkslab-redacted cites source:quarkslab-blog-php-src-audit","source"],["claim:quarkslab-redacted cites source:substack-lopezkurtz-patch-is-the-exploit","source"],["claim:rce-fpm cites source:github-ghsa-6wmf-4rv5-p3rp","source"],["claim:rce-fpm cites source:github-ghsa-w8hw-w9fx-j79w","source"],["claim:rce-fpm cites source:openwall-oss-security-2026-10-21-6","source"],["claim:rce-fpm cites source:php-foundation-blog-security-release","source"],["claim:rce-modphp cites source:github-ghsa-w8hw-w9fx-j79w","source"],["claim:rce-modphp cites source:openwall-oss-security-2026-10-21-6","source"],["claim:rce-modphp cites source:php-net-advisory","source"],["claim:release-moved cites source:openwall-oss-security-2026-10-20-34","source"],["claim:release-moved cites source:php-foundation-blog-security-release","source"],["claim:release-moved cites source:php-net-changelog-8","source"],["claim:release-moved cites source:x-wiz-io-php2shell","source"],["claim:scale-2.6m-hosts cites source:securityweek-exploitation-days-before","source"],["claim:scale-2.6m-hosts cites source:thehackernews-php2shell-4days","source"],["claim:scale-30m cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:scale-70pc-internet cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:scale-70pc-internet cites source:wiz-blog-php2shell","source"],["claim:scale-70pc-internet cites source:x-wiz-io-php2shell","source"],["claim:scale-70pc-websites cites source:cloudflare-blog-php2shell-waf","source"],["claim:scale-70pc-websites cites source:wiz-blog-php2shell","source"],["claim:scale-70pc-websites cites source:x-openai-php2shell","source"],["claim:scale-ncsc-nl cites source:ncsc-nl-php2shell-software-list","source"],["claim:two-cves-9.2 cites source:cve-cve-2026-109618","source"],["claim:two-cves-9.2 cites source:cve-cve-2026-109619","source"],["claim:two-cves-9.2 cites source:github-ghsa-6wmf-4rv5-p3rp","source"],["claim:two-cves-9.2 cites source:github-ghsa-w8hw-w9fx-j79w","source"],["claim:two-cves-9.2 cites source:php-net-advisory","source"],["claim:uk-list cites source:insurancebusiness-uk-councils-met","source"],["claim:uk-list cites source:lbc-uk-websites-offline","source"],["claim:versions-old cites source:certfr-2026-ale-014","source"],["claim:versions-old cites source:ncsc-nl-advisories","source"],["claim:versions-old cites source:openwall-oss-security-109619-thread","source"],["claim:versions-old cites source:x-wiz-io-php2shell","source"],["claim:vibe-code cites source:bbc-live-ckgel5xp2xv9t","source"],["claim:waf cites source:ch-bacs-warnung-php","source"],["claim:waf cites source:cisa-alert-php-20261021","source"],["claim:waf cites source:cloudflare-blog-php2shell-waf","source"],["claim:waf-nine-hours cites source:akamai-blog-php-core-rce","source"],["claim:waf-nine-hours cites source:cloudflare-blog-php2shell-waf","source"],["claim:waf-nine-hours cites source:fastly-blog-php2shell","source"],["claim:waf-nine-hours cites source:fortinet-fortiweb-php2shell","source"],["claim:waf-nine-hours cites source:imperva-blog-php2shell","source"],["claim:watchtowr-itw cites source:watchtowr-php2shell","source"],["claim:watchtowr-itw cites source:watchtowr-php2shell-faq","source"],["claim:who-first cites source:calif-php2shell","source"],["claim:who-first cites source:php-foundation-blog-security-release","source"],["claim:who-first cites source:x-lcfr-hax-hash-tweet","source"],["claim:wikimedia-precaution cites source:cnn-php2shell-websites-shut","source"],["claim:wikimedia-precaution cites source:cyberexpress-php2shell-gov-sites","source"],["claim:wiz-independent cites source:php-foundation-blog-security-release","source"],["claim:wiz-independent cites source:wiz-blog-php2shell","source"],["claim:wordpress-drupal cites source:calif-php2shell","source"],["claim:wordpress-drupal cites source:wiz-blog-php2shell","source"],["remediation:fix-bounded-parsing realised_in code:file:ext/session/session.c","code"],["remediation:fix-bounded-parsing realised_in code:file:main/rfc1867.c","code"],["remediation:fix-fallible realised_in code:file:Zend/zend_hash.c","code"],["remediation:fix-fallible realised_in code:file:Zend/zend_string.c","code"],["remediation:fix-fallible realised_in code:file:Zend/zend_types.h","code"],["remediation:fix-reset-globals realised_in code:file:main/SAPI.c","code"],["remediation:fix-reset-globals realised_in code:file:main/main.c","code"],["remediation:fix-soft-limit realised_in code:file:Zend/zend_alloc.c","code"],["remediation:fix-unwind realised_in code:file:Zend/zend_execute_API.c","code"],["risk:r01 arises_from weakness:w-alloc-bailout","inferred"],["risk:r01 arises_from weakness:w-stale-globals","inferred"],["risk:r01 backed_by claim:ac-high","source"],["risk:r01 backed_by claim:fix-engine","source"],["risk:r01 backed_by claim:only-update","source"],["risk:r01 backed_by claim:rce-modphp","source"],["risk:r01 backed_by claim:two-cves-9.2","source"],["risk:r01 borne_by stakeholder:people","inferred"],["risk:r01 governed_by control:attack:T1190","inferred"],["risk:r01 governed_by control:cis:7.7","inferred"],["risk:r01 governed_by control:iso27001:A.8.8","inferred"],["risk:r01 governed_by control:nis2:Art.21(2)(e)","inferred"],["risk:r01 governed_by control:nist80053:SI-2","inferred"],["risk:r01 governed_by control:nistcsf:ID.RA-01","inferred"],["risk:r01 governed_by control:owasp:A06:2021","inferred"],["risk:r01 informed_by stakeholder:agencies","inferred"],["risk:r01 owned_by stakeholder:operators","inferred"],["risk:r01 protected_by treatment:r01.1","inferred"],["risk:r01 protected_by treatment:r01.2","inferred"],["risk:r01 protected_by treatment:r01.3","inferred"],["risk:r01 shown_on page:flaws/index.html","inferred"],["risk:r01 shown_on page:playbook/index.html","inferred"],["risk:r01 shown_on page:review/index.html","inferred"],["risk:r01 told_in story:patch-at-the-speed-of-metasploit","inferred"],["risk:r01 told_in story:where-php2shell-stands","inferred"],["risk:r01 tracked_by member:journalist","inferred"],["risk:r01 tracked_by member:story-site","inferred"],["risk:r01 treated_by stakeholder:edge","inferred"],["risk:r01 treated_by stakeholder:hosting","inferred"],["risk:r01 treated_by stakeholder:php-project","inferred"],["risk:r01-1 arises_from weakness:w-alloc-bailout","inferred"],["risk:r01-1 backed_by claim:fix-engine","source"],["risk:r01-1 backed_by claim:rce-modphp","source"],["risk:r01-1 borne_by stakeholder:site-owner","inferred"],["risk:r01-1 governed_by control:cis:7.4","inferred"],["risk:r01-1 governed_by control:cyberessentials:SUM","inferred"],["risk:r01-1 governed_by control:iso27001:A.8.8","inferred"],["risk:r01-1 governed_by control:pcidss:6.3.3","inferred"],["risk:r01-1 owned_by stakeholder:shared-hosts","inferred"],["risk:r01-1 part_of risk:r01","inferred"],["risk:r01-1 protected_by treatment:r01-1.1","inferred"],["risk:r01-1 shown_on page:affected/index.html","inferred"],["risk:r01-1 shown_on page:playbook/index.html","inferred"],["risk:r01-1 told_in story:why-not-patch-every-version","inferred"],["risk:r01-1 tracked_by member:story-site","inferred"],["risk:r01-1 treated_by stakeholder:engineers","inferred"],["risk:r01-2 arises_from weakness:w-stale-globals","inferred"],["risk:r01-2 backed_by claim:rce-fpm","source"],["risk:r01-2 governed_by control:iso27001:6.1.2","inferred"],["risk:r01-2 governed_by control:nistcsf:ID.RA-01","inferred"],["risk:r01-2 informed_by stakeholder:php-security-team","inferred"],["risk:r01-2 owned_by stakeholder:security-lead","inferred"],["risk:r01-2 part_of risk:r01","inferred"],["risk:r01-2 protected_by treatment:r01-2.1","inferred"],["risk:r01-2 shown_on page:affected/index.html","inferred"],["risk:r01-2 shown_on page:factcheck/index.html","inferred"],["risk:r01-2 tracked_by member:verifier","inferred"],["risk:r01-2 treated_by stakeholder:managed-hosts","inferred"],["risk:r01-3 arises_from weakness:w-eol","inferred"],["risk:r01-3 backed_by claim:offline-cisa","source"],["risk:r01-3 backed_by claim:versions-old","source"],["risk:r01-3 borne_by stakeholder:cfo","inferred"],["risk:r01-3 governed_by control:cis:2.2","inferred"],["risk:r01-3 governed_by control:cyberessentials:SUM","inferred"],["risk:r01-3 governed_by control:nist80053:SA-22","inferred"],["risk:r01-3 governed_by control:nistcsf:PR.PS-02","inferred"],["risk:r01-3 governed_by control:pcidss:6.3.3","inferred"],["risk:r01-3 owned_by stakeholder:cto","inferred"],["risk:r01-3 owned_by stakeholder:operators","inferred"],["risk:r01-3 part_of risk:r01","inferred"],["risk:r01-3 protected_by treatment:r01-3.1","inferred"],["risk:r01-3 protected_by treatment:r01-3.2","inferred"],["risk:r01-3 shown_on page:patching/index.html","inferred"],["risk:r01-3 shown_on page:patching/inventory/index.html","inferred"],["risk:r01-3 told_in story:why-not-patch-every-version","inferred"],["risk:r01-3 tracked_by member:journalist","inferred"],["risk:r01-3 tracked_by member:story-site","inferred"],["risk:r01-3 treated_by stakeholder:distros","inferred"],["risk:r01-3 treated_by stakeholder:panels","inferred"],["risk:r01-4 arises_from weakness:w-bailout-class","inferred"],["risk:r01-4 backed_by claim:fix-bailout","source"],["risk:r01-4 backed_by claim:fix-incomplete","source"],["risk:r01-4 backed_by claim:more-paths","source"],["risk:r01-4 borne_by stakeholder:engineers","inferred"],["risk:r01-4 borne_by stakeholder:operators","inferred"],["risk:r01-4 governed_by control:iso27001:A.8.29","inferred"],["risk:r01-4 governed_by control:iso29147:30111:handling","inferred"],["risk:r01-4 governed_by control:ssdf:PW.8","inferred"],["risk:r01-4 governed_by control:ssdf:RV.3","inferred"],["risk:r01-4 informed_by stakeholder:finders","inferred"],["risk:r01-4 owned_by stakeholder:php-fix-authors","inferred"],["risk:r01-4 part_of risk:r01","inferred"],["risk:r01-4 protected_by treatment:r01-4.1","inferred"],["risk:r01-4 protected_by treatment:r01-4.2","inferred"],["risk:r01-4 shown_on page:code/index.html","inferred"],["risk:r01-4 shown_on page:review/index.html","inferred"],["risk:r01-4 told_in story:patch-at-the-speed-of-metasploit","inferred"],["risk:r01-4 tracked_by member:story-site","inferred"],["risk:r01-4 treated_by stakeholder:php-security-team","inferred"],["risk:r01-5 arises_from weakness:w-alloc-bailout","inferred"],["risk:r01-5 arises_from weakness:w-stale-globals","inferred"],["risk:r01-5 backed_by claim:wordpress-drupal","source"],["risk:r01-5 borne_by stakeholder:commerce","inferred"],["risk:r01-5 governed_by control:cis:16.4","inferred"],["risk:r01-5 governed_by control:owasp:A06:2021","inferred"],["risk:r01-5 governed_by control:pcidss:6.3.1","inferred"],["risk:r01-5 informed_by stakeholder:oss-apps","inferred"],["risk:r01-5 owned_by stakeholder:site-owner","inferred"],["risk:r01-5 part_of risk:r01","inferred"],["risk:r01-5 protected_by treatment:r01-5.1","inferred"],["risk:r01-5 shown_on page:affected/index.html","inferred"],["risk:r01-5 tracked_by member:story-site","inferred"],["risk:r01-6 arises_from weakness:w-inventory","inferred"],["risk:r01-6 backed_by claim:scale-ncsc-nl","source"],["risk:r01-6 borne_by stakeholder:operators","inferred"],["risk:r01-6 governed_by control:cra:AnnexI.II","inferred"],["risk:r01-6 governed_by control:cra:Art.13","inferred"],["risk:r01-6 governed_by control:dora:Art.28","inferred"],["risk:r01-6 governed_by control:iso27001:A.5.21","inferred"],["risk:r01-6 governed_by control:nis2:Art.21(2)(d)","inferred"],["risk:r01-6 governed_by control:nistcsf:GV.SC-07","inferred"],["risk:r01-6 governed_by control:owasp:A03:2025","inferred"],["risk:r01-6 governed_by control:soc2:CC9.2","inferred"],["risk:r01-6 informed_by stakeholder:eu-agencies","inferred"],["risk:r01-6 owned_by stakeholder:cto","inferred"],["risk:r01-6 owned_by stakeholder:inventory-suppliers","inferred"],["risk:r01-6 part_of risk:r01","inferred"],["risk:r01-6 protected_by treatment:r01-6.1","inferred"],["risk:r01-6 shown_on page:affected/software.html","inferred"],["risk:r01-6 shown_on page:patching/inventory/index.html","inferred"],["risk:r01-6 told_in story:why-not-patch-every-version","inferred"],["risk:r01-6 tracked_by member:story-site","inferred"],["risk:r02 arises_from weakness:w-embargo","inferred"],["risk:r02 backed_by claim:chainguard","source"],["risk:r02 backed_by claim:leak-cve-ids","source"],["risk:r02 backed_by claim:leak-mitigations","source"],["risk:r02 backed_by claim:leak-video","source"],["risk:r02 backed_by claim:release-moved","source"],["risk:r02 borne_by stakeholder:operators","inferred"],["risk:r02 borne_by stakeholder:security-lead","inferred"],["risk:r02 concerns vulnerability:cve-109618","inferred"],["risk:r02 concerns vulnerability:cve-109619","inferred"],["risk:r02 governed_by control:iso29147:29147:coordination","inferred"],["risk:r02 governed_by control:nis2:Art.12","inferred"],["risk:r02 governed_by control:nistcsf:ID.RA-08","inferred"],["risk:r02 governed_by control:tlp:TLP:AMBER+STRICT","inferred"],["risk:r02 owned_by stakeholder:php-security-team","inferred"],["risk:r02 protected_by treatment:r02.1","inferred"],["risk:r02 raised_by stakeholder:distributors","inferred"],["risk:r02 raised_by stakeholder:finders","inferred"],["risk:r02 shown_on page:leak/index.html","inferred"],["risk:r02 shown_on page:timeline/index.html","inferred"],["risk:r02 told_in story:php2shell-in-perspective","inferred"],["risk:r02 told_in story:where-php2shell-stands","inferred"],["risk:r02 tracked_by member:historian","inferred"],["risk:r02 tracked_by member:story-site","inferred"],["risk:r02-1 arises_from weakness:w-embargo","inferred"],["risk:r02-1 backed_by claim:leak-cve-ids","source"],["risk:r02-1 backed_by claim:leak-hn","source"],["risk:r02-1 backed_by claim:leak-video","source"],["risk:r02-1 backed_by claim:leak-watchtowr","source"],["risk:r02-1 governed_by control:iso29147:29147:coordination","inferred"],["risk:r02-1 governed_by control:nistcsf:ID.RA-08","inferred"],["risk:r02-1 owned_by stakeholder:php-security-team","inferred"],["risk:r02-1 part_of risk:r02","inferred"],["risk:r02-1 protected_by treatment:r02-1.1","inferred"],["risk:r02-1 raised_by stakeholder:calif","inferred"],["risk:r02-1 shown_on page:leak/index.html","inferred"],["risk:r02-1 told_in story:where-php2shell-stands","inferred"],["risk:r02-1 tracked_by member:historian","inferred"],["risk:r02-1 treated_by stakeholder:edge","inferred"],["risk:r02-2 arises_from weakness:w-embargo","inferred"],["risk:r02-2 backed_by claim:leak-mitigations","source"],["risk:r02-2 borne_by stakeholder:operators","inferred"],["risk:r02-2 governed_by control:iso27001:A.5.14","inferred"],["risk:r02-2 governed_by control:iso29147:29147:coordination","inferred"],["risk:r02-2 governed_by control:tlp:TLP:AMBER+STRICT","inferred"],["risk:r02-2 owned_by stakeholder:php-security-team","inferred"],["risk:r02-2 part_of risk:r02","inferred"],["risk:r02-2 protected_by treatment:r02-2.1","inferred"],["risk:r02-2 raised_by stakeholder:critical-infra","inferred"],["risk:r02-2 shown_on page:leak/index.html","inferred"],["risk:r02-2 tracked_by member:historian","inferred"],["risk:r02-3 arises_from weakness:w-embargo","inferred"],["risk:r02-3 backed_by claim:chainguard","source"],["risk:r02-3 backed_by claim:lorenc-ai-found","source"],["risk:r02-3 governed_by control:cra:Art.13","inferred"],["risk:r02-3 governed_by control:iso29147:29147:coordination","inferred"],["risk:r02-3 governed_by control:nistcsf:GV.SC-05","inferred"],["risk:r02-3 governed_by control:owasp:A03:2025","inferred"],["risk:r02-3 owned_by stakeholder:distributors","inferred"],["risk:r02-3 part_of risk:r02","inferred"],["risk:r02-3 protected_by treatment:r02-3.1","inferred"],["risk:r02-3 raised_by stakeholder:chainguard","inferred"],["risk:r02-3 regulated_by stakeholder:php-security-team","inferred"],["risk:r02-3 shown_on page:leak/index.html","inferred"],["risk:r02-3 told_in story:where-php2shell-stands","inferred"],["risk:r02-3 tracked_by member:historian","inferred"],["risk:r03 arises_from weakness:w-alloc-bailout","inferred"],["risk:r03 arises_from weakness:w-signal","inferred"],["risk:r03 backed_by claim:amazon-honeypot","source"],["risk:r03 backed_by claim:cisa-none","source"],["risk:r03 backed_by claim:cloudflare-traffic","source"],["risk:r03 backed_by claim:kev-precedent","source"],["risk:r03 backed_by claim:probing","source"],["risk:r03 governed_by control:attack:T1595.002","inferred"],["risk:r03 governed_by control:iso27001:A.5.7","inferred"],["risk:r03 governed_by control:iso27001:A.8.16","inferred"],["risk:r03 governed_by control:kev:BOD22-01","inferred"],["risk:r03 governed_by control:kev:KEV-entry","inferred"],["risk:r03 governed_by control:nist80053:SI-4","inferred"],["risk:r03 governed_by control:nistcsf:DE.CM-01","inferred"],["risk:r03 informed_by stakeholder:threat-intel","inferred"],["risk:r03 owned_by stakeholder:operators","inferred"],["risk:r03 protected_by treatment:r03.1","inferred"],["risk:r03 protected_by treatment:r03.2","inferred"],["risk:r03 regulated_by stakeholder:us-agencies","inferred"],["risk:r03 shown_on page:exploitation/index.html","inferred"],["risk:r03 shown_on page:signals/index.html","inferred"],["risk:r03 told_in story:exposed-is-not-exploited","inferred"],["risk:r03 told_in story:patch-at-the-speed-of-metasploit","inferred"],["risk:r03 told_in story:php2shell-in-perspective","inferred"],["risk:r03 tracked_by member:historian","inferred"],["risk:r03 tracked_by member:journalist","inferred"],["risk:r03 treated_by stakeholder:security-lead","inferred"],["risk:r03-1 arises_from weakness:w-signal","inferred"],["risk:r03-1 backed_by claim:amazon-honeypot","source"],["risk:r03-1 backed_by claim:imperva-none","source"],["risk:r03-1 governed_by control:iso27001:A.5.7","inferred"],["risk:r03-1 governed_by control:nist80053:SI-4","inferred"],["risk:r03-1 governed_by control:nistcsf:ID.RA-02","inferred"],["risk:r03-1 governed_by control:pcidss:12.10.1","inferred"],["risk:r03-1 informed_by stakeholder:threat-intel","inferred"],["risk:r03-1 owned_by stakeholder:security-lead","inferred"],["risk:r03-1 part_of risk:r03","inferred"],["risk:r03-1 protected_by treatment:r03-1.1","inferred"],["risk:r03-1 shown_on page:exploitation/index.html","inferred"],["risk:r03-1 told_in story:exposed-is-not-exploited","inferred"],["risk:r03-1 tracked_by member:journalist","inferred"],["risk:r03-2 arises_from weakness:w-waf-only","inferred"],["risk:r03-2 backed_by claim:cf-millions","source"],["risk:r03-2 backed_by claim:cloudflare-traffic","source"],["risk:r03-2 backed_by claim:probing","source"],["risk:r03-2 governed_by control:attack:T1595.002","inferred"],["risk:r03-2 governed_by control:cis:13.10","inferred"],["risk:r03-2 governed_by control:nistcsf:DE.CM-01","inferred"],["risk:r03-2 owned_by stakeholder:operators","inferred"],["risk:r03-2 part_of risk:r03","inferred"],["risk:r03-2 protected_by treatment:r03-2.1","inferred"],["risk:r03-2 shown_on page:defence/index.html","inferred"],["risk:r03-2 shown_on page:exploitation/index.html","inferred"],["risk:r03-2 tracked_by member:journalist","inferred"],["risk:r03-2 treated_by stakeholder:waf-vendors","inferred"],["risk:r03-3 arises_from weakness:w-signal","inferred"],["risk:r03-3 backed_by claim:cisa-none","source"],["risk:r03-3 backed_by claim:huntress-none","source"],["risk:r03-3 backed_by claim:no-confirmed-compromise","source"],["risk:r03-3 backed_by claim:nz-active","source"],["risk:r03-3 backed_by claim:watchtowr-itw","source"],["risk:r03-3 governed_by control:kev:KEV-entry","inferred"],["risk:r03-3 governed_by control:nistcsf:GV.RR-01","inferred"],["risk:r03-3 governed_by control:nistcsf:ID.RA-02","inferred"],["risk:r03-3 informed_by stakeholder:threat-intel","inferred"],["risk:r03-3 owned_by stakeholder:board","inferred"],["risk:r03-3 part_of risk:r03","inferred"],["risk:r03-3 protected_by treatment:r03-3.1","inferred"],["risk:r03-3 regulated_by stakeholder:us-agencies","inferred"],["risk:r03-3 shown_on page:compromise/index.html","inferred"],["risk:r03-3 shown_on page:exploitation/index.html","inferred"],["risk:r03-3 shown_on page:signals/index.html","inferred"],["risk:r03-3 told_in story:exposed-is-not-exploited","inferred"],["risk:r03-3 tracked_by member:historian","inferred"],["risk:r03-3 tracked_by member:journalist","inferred"],["risk:r03-4 arises_from weakness:w-signal","inferred"],["risk:r03-4 arises_from weakness:w-waf-only","inferred"],["risk:r03-4 backed_by claim:pocs-wrong","source"],["risk:r03-4 governed_by control:nist80053:RA-5","inferred"],["risk:r03-4 governed_by control:nistcsf:ID.RA-01","inferred"],["risk:r03-4 governed_by control:soc2:CC7.1","inferred"],["risk:r03-4 owned_by stakeholder:security-lead","inferred"],["risk:r03-4 part_of risk:r03","inferred"],["risk:r03-4 protected_by treatment:r03-4.1","inferred"],["risk:r03-4 shown_on page:defence/index.html","inferred"],["risk:r03-4 told_in story:patch-at-the-speed-of-metasploit","inferred"],["risk:r03-4 tracked_by member:journalist","inferred"],["risk:r03-4 treated_by stakeholder:threat-intel","inferred"],["risk:r04 arises_from weakness:w-eol","inferred"],["risk:r04 arises_from weakness:w-inventory","inferred"],["risk:r04 backed_by claim:affected-sites","source"],["risk:r04 backed_by claim:fi-offline","source"],["risk:r04 backed_by claim:latvia-offline","source"],["risk:r04 backed_by claim:nl-offline","source"],["risk:r04 backed_by claim:offline-cisa","source"],["risk:r04 backed_by claim:offline-nsa","source"],["risk:r04 backed_by claim:wikimedia-precaution","source"],["risk:r04 borne_by stakeholder:service-users","inferred"],["risk:r04 concerns vulnerability:cve-109618","inferred"],["risk:r04 concerns vulnerability:cve-109619","inferred"],["risk:r04 governed_by control:dora:Art.11","inferred"],["risk:r04 governed_by control:iso27001:A.5.29","inferred"],["risk:r04 governed_by control:iso27001:A.5.30","inferred"],["risk:r04 governed_by control:nis2:Art.21(2)(c)","inferred"],["risk:r04 governed_by control:nist80053:CP-2","inferred"],["risk:r04 governed_by control:nistcsf:RC.RP-01","inferred"],["risk:r04 owned_by stakeholder:board","inferred"],["risk:r04 owned_by stakeholder:public-sector","inferred"],["risk:r04 protected_by treatment:r04.1","inferred"],["risk:r04 protected_by treatment:r04.2","inferred"],["risk:r04 raised_by stakeholder:agencies","inferred"],["risk:r04 shown_on page:agencies/index.html","inferred"],["risk:r04 shown_on page:impact/index.html","inferred"],["risk:r04 told_in story:php2shell-in-perspective","inferred"],["risk:r04 told_in story:where-php2shell-stands","inferred"],["risk:r04 tracked_by member:story-site","inferred"],["risk:r04 treated_by stakeholder:comms","inferred"],["risk:r04-1 arises_from weakness:w-inventory","inferred"],["risk:r04-1 backed_by claim:fi-offline","source"],["risk:r04-1 backed_by claim:latvia-offline","source"],["risk:r04-1 backed_by claim:nl-offline","source"],["risk:r04-1 borne_by stakeholder:service-users","inferred"],["risk:r04-1 governed_by control:iso27001:A.5.29","inferred"],["risk:r04-1 governed_by control:nis2:Art.21(2)(c)","inferred"],["risk:r04-1 governed_by control:nistcsf:RC.RP-01","inferred"],["risk:r04-1 informed_by stakeholder:eu-agencies","inferred"],["risk:r04-1 owned_by stakeholder:national-gov","inferred"],["risk:r04-1 part_of risk:r04","inferred"],["risk:r04-1 protected_by treatment:r04-1.1","inferred"],["risk:r04-1 shown_on page:impact/index.html","inferred"],["risk:r04-1 told_in story:php2shell-in-perspective","inferred"],["risk:r04-1 tracked_by member:story-site","inferred"],["risk:r04-2 arises_from weakness:w-eol","inferred"],["risk:r04-2 backed_by claim:edinburgh","source"],["risk:r04-2 backed_by claim:oxford","source"],["risk:r04-2 backed_by claim:uk-list","source"],["risk:r04-2 governed_by control:cyberessentials:SUM","inferred"],["risk:r04-2 governed_by control:iso27001:A.5.24","inferred"],["risk:r04-2 governed_by control:nistcsf:RS.CO-03","inferred"],["risk:r04-2 informed_by stakeholder:uk-ncsc","inferred"],["risk:r04-2 owned_by stakeholder:councils","inferred"],["risk:r04-2 part_of risk:r04","inferred"],["risk:r04-2 protected_by treatment:r04-2.1","inferred"],["risk:r04-2 shown_on page:briefings/comms/index.html","inferred"],["risk:r04-2 shown_on page:impact/index.html","inferred"],["risk:r04-2 tracked_by member:story-site","inferred"],["risk:r04-2 treated_by stakeholder:comms","inferred"],["risk:r04-3 arises_from weakness:w-headline","inferred"],["risk:r04-3 backed_by claim:offline-allies","source"],["risk:r04-3 backed_by claim:offline-cisa","source"],["risk:r04-3 backed_by claim:offline-ncsc","source"],["risk:r04-3 backed_by claim:offline-nsa","source"],["risk:r04-3 governed_by control:iso27001:A.5.5","inferred"],["risk:r04-3 governed_by control:nis2:Art.20","inferred"],["risk:r04-3 governed_by control:nistcsf:GV.RR-01","inferred"],["risk:r04-3 informed_by stakeholder:media","inferred"],["risk:r04-3 owned_by stakeholder:board","inferred"],["risk:r04-3 part_of risk:r04","inferred"],["risk:r04-3 protected_by treatment:r04-3.1","inferred"],["risk:r04-3 raised_by stakeholder:agencies","inferred"],["risk:r04-3 shown_on page:agencies/index.html","inferred"],["risk:r04-3 told_in story:where-php2shell-stands","inferred"],["risk:r04-3 tracked_by member:story-site","inferred"],["risk:r04-3 tracked_by member:verifier","inferred"],["risk:r05 arises_from weakness:w-waf-only","inferred"],["risk:r05 backed_by claim:only-update","source"],["risk:r05 backed_by claim:waf","source"],["risk:r05 backed_by claim:waf-nine-hours","source"],["risk:r05 borne_by stakeholder:commerce","inferred"],["risk:r05 concerns vulnerability:cve-109618","inferred"],["risk:r05 concerns vulnerability:cve-109619","inferred"],["risk:r05 governed_by control:cis:13.10","inferred"],["risk:r05 governed_by control:cyberessentials:FW","inferred"],["risk:r05 governed_by control:iso27001:A.8.20","inferred"],["risk:r05 governed_by control:nist80053:SC-7","inferred"],["risk:r05 governed_by control:pcidss:6.4.2","inferred"],["risk:r05 informed_by stakeholder:waf-vendors","inferred"],["risk:r05 owned_by stakeholder:security-lead","inferred"],["risk:r05 protected_by treatment:r05.1","inferred"],["risk:r05 shown_on page:defence/index.html","inferred"],["risk:r05 told_in story:patch-at-the-speed-of-metasploit","inferred"],["risk:r05 tracked_by member:journalist","inferred"],["risk:r06 arises_from weakness:w-alloc-bailout","inferred"],["risk:r06 arises_from weakness:w-stale-globals","inferred"],["risk:r06 backed_by claim:no-confirmed-compromise","source"],["risk:r06 backed_by claim:rce-modphp","source"],["risk:r06 borne_by stakeholder:data-subjects","inferred"],["risk:r06 governed_by control:cra:Art.14","inferred"],["risk:r06 governed_by control:dora:Art.19","inferred"],["risk:r06 governed_by control:gdpr:Art.32","inferred"],["risk:r06 governed_by control:gdpr:Art.33","inferred"],["risk:r06 governed_by control:gdpr:Art.34","inferred"],["risk:r06 governed_by control:nis2:Art.23","inferred"],["risk:r06 owned_by stakeholder:board","inferred"],["risk:r06 owned_by stakeholder:dpo","inferred"],["risk:r06 owned_by stakeholder:operators","inferred"],["risk:r06 protected_by treatment:r06.1","inferred"],["risk:r06 regulated_by stakeholder:eu-agencies","inferred"],["risk:r06 shown_on page:compromise/index.html","inferred"],["risk:r06 shown_on page:impact/index.html","inferred"],["risk:r06 shown_on page:playbook/index.html","inferred"],["risk:r06 tracked_by member:story-site","inferred"],["risk:r06-1 arises_from weakness:w-alloc-bailout","inferred"],["risk:r06-1 backed_by claim:rce-modphp","source"],["risk:r06-1 borne_by stakeholder:data-subjects","inferred"],["risk:r06-1 governed_by control:gdpr:Art.24","inferred"],["risk:r06-1 governed_by control:gdpr:Art.28","inferred"],["risk:r06-1 governed_by control:gdpr:Art.32","inferred"],["risk:r06-1 governed_by control:gdpr:Art.33","inferred"],["risk:r06-1 governed_by control:gdpr:Art.34","inferred"],["risk:r06-1 governed_by control:gdpr:Art.5(1)(f)","inferred"],["risk:r06-1 owned_by stakeholder:dpo","inferred"],["risk:r06-1 part_of risk:r06","inferred"],["risk:r06-1 protected_by treatment:r06-1.1","inferred"],["risk:r06-1 shown_on page:briefings/dpo/index.html","inferred"],["risk:r06-1 shown_on page:impact/index.html","inferred"],["risk:r06-1 tracked_by member:grc","inferred"],["risk:r06-1 tracked_by member:story-site","inferred"],["risk:r06-1 treated_by stakeholder:managed-hosts","inferred"],["risk:r06-2 arises_from weakness:w-signal","inferred"],["risk:r06-2 backed_by claim:nl-offline","source"],["risk:r06-2 backed_by claim:no-confirmed-compromise","source"],["risk:r06-2 governed_by control:dora:Art.10","inferred"],["risk:r06-2 governed_by control:dora:Art.19","inferred"],["risk:r06-2 governed_by control:nis2:Art.20","inferred"],["risk:r06-2 governed_by control:nis2:Art.23","inferred"],["risk:r06-2 governed_by control:nist80053:IR-6","inferred"],["risk:r06-2 owned_by stakeholder:critical-infra","inferred"],["risk:r06-2 owned_by stakeholder:finance","inferred"],["risk:r06-2 part_of risk:r06","inferred"],["risk:r06-2 protected_by treatment:r06-2.1","inferred"],["risk:r06-2 regulated_by stakeholder:eu-agencies","inferred"],["risk:r06-2 shown_on page:agencies/index.html","inferred"],["risk:r06-2 shown_on page:impact/index.html","inferred"],["risk:r06-2 tracked_by member:story-site","inferred"],["risk:r06-2 treated_by stakeholder:ciso","inferred"],["risk:r06-3 arises_from weakness:w-inventory","inferred"],["risk:r06-3 arises_from weakness:w-signal","inferred"],["risk:r06-3 backed_by claim:cisa-none","source"],["risk:r06-3 backed_by claim:scale-ncsc-nl","source"],["risk:r06-3 backed_by claim:watchtowr-itw","source"],["risk:r06-3 governed_by control:cra:AnnexI.II","inferred"],["risk:r06-3 governed_by control:cra:Art.13","inferred"],["risk:r06-3 governed_by control:cra:Art.14","inferred"],["risk:r06-3 governed_by control:cra:Art.24","inferred"],["risk:r06-3 informed_by stakeholder:php-foundation","inferred"],["risk:r06-3 owned_by stakeholder:inventory-suppliers","inferred"],["risk:r06-3 part_of risk:r06","inferred"],["risk:r06-3 protected_by treatment:r06-3.1","inferred"],["risk:r06-3 regulated_by stakeholder:eu-agencies","inferred"],["risk:r06-3 shown_on page:affected/software.html","inferred"],["risk:r06-3 shown_on page:exploitation/index.html","inferred"],["risk:r06-3 tracked_by member:story-site","inferred"],["risk:r06-3 treated_by stakeholder:engineers","inferred"],["risk:r07 arises_from weakness:w-headline","inferred"],["risk:r07 backed_by claim:cvss-10","source"],["risk:r07 backed_by claim:disclosure-22oct","source"],["risk:r07 backed_by claim:most-severe","source"],["risk:r07 backed_by claim:scale-30m","source"],["risk:r07 backed_by claim:scale-70pc-internet","source"],["risk:r07 backed_by claim:scale-70pc-websites","source"],["risk:r07 concerns vulnerability:cve-109618","inferred"],["risk:r07 concerns vulnerability:cve-109619","inferred"],["risk:r07 governed_by control:iso27001:6.1.2","inferred"],["risk:r07 governed_by control:nistcsf:GV.RM-01","inferred"],["risk:r07 governed_by control:owasp:LLM09:2025","inferred"],["risk:r07 owned_by stakeholder:board","inferred"],["risk:r07 protected_by treatment:r07.1","inferred"],["risk:r07 raised_by stakeholder:media","inferred"],["risk:r07 raised_by stakeholder:wiz","inferred"],["risk:r07 shown_on page:factcheck/index.html","inferred"],["risk:r07 shown_on page:numbers/index.html","inferred"],["risk:r07 told_in story:exposed-is-not-exploited","inferred"],["risk:r07 told_in story:where-php2shell-stands","inferred"],["risk:r07 tracked_by member:journalist","inferred"],["risk:r07 tracked_by member:verifier","inferred"],["risk:r07 treated_by stakeholder:newsroom","inferred"],["risk:r08 arises_from weakness:w-ai-dual-use","inferred"],["risk:r08 arises_from weakness:w-maintainer-capacity","inferred"],["risk:r08 backed_by claim:ahead-of-attackers","source"],["risk:r08 backed_by claim:ai-found","source"],["risk:r08 backed_by claim:lorenc-ai-found","source"],["risk:r08 backed_by claim:openai-same-day","source"],["risk:r08 backed_by claim:vibe-code","source"],["risk:r08 backed_by claim:wiz-independent","source"],["risk:r08 borne_by stakeholder:ciso","inferred"],["risk:r08 borne_by stakeholder:php-project","inferred"],["risk:r08 borne_by stakeholder:world","inferred"],["risk:r08 concerns vulnerability:cve-109618","inferred"],["risk:r08 concerns vulnerability:cve-109619","inferred"],["risk:r08 governed_by control:euaiact:Art.55","inferred"],["risk:r08 governed_by control:iso42001:6.1.2","inferred"],["risk:r08 governed_by control:nistairmf:GOVERN-6.1","inferred"],["risk:r08 governed_by control:nistairmf:MEASURE-2.7","inferred"],["risk:r08 owned_by stakeholder:openai","inferred"],["risk:r08 protected_by treatment:r08.1","inferred"],["risk:r08 shown_on page:context/index.html","inferred"],["risk:r08 shown_on page:discovery/index.html","inferred"],["risk:r08 told_in story:php2shell-in-perspective","inferred"],["risk:r08 tracked_by member:historian","inferred"],["risk:r08 treated_by stakeholder:finders","inferred"],["risk:r08-1 arises_from weakness:w-alloc-bailout","inferred"],["risk:r08-1 arises_from weakness:w-maintainer-capacity","inferred"],["risk:r08-1 backed_by claim:quarkslab-2024","source"],["risk:r08-1 backed_by claim:quarkslab-redacted","source"],["risk:r08-1 governed_by control:cra:Art.24","inferred"],["risk:r08-1 governed_by control:iso27001:A.8.25","inferred"],["risk:r08-1 governed_by control:ssdf:PW.7","inferred"],["risk:r08-1 governed_by control:ssdf:RV.2","inferred"],["risk:r08-1 informed_by stakeholder:quarkslab","inferred"],["risk:r08-1 owned_by stakeholder:php-project","inferred"],["risk:r08-1 part_of risk:r08","inferred"],["risk:r08-1 protected_by treatment:r08-1.1","inferred"],["risk:r08-1 shown_on page:discovery/index.html","inferred"],["risk:r08-1 told_in story:php2shell-in-perspective","inferred"],["risk:r08-1 tracked_by member:historian","inferred"],["risk:r08-1 treated_by stakeholder:php-foundation","inferred"],["risk:r08-2 arises_from weakness:w-maintainer-capacity","inferred"],["risk:r08-2 backed_by claim:four-reporters","source"],["risk:r08-2 backed_by claim:openai-same-day","source"],["risk:r08-2 backed_by claim:who-first","source"],["risk:r08-2 backed_by claim:wiz-independent","source"],["risk:r08-2 borne_by stakeholder:php-security-team","inferred"],["risk:r08-2 governed_by control:iso29147:29147:receipt","inferred"],["risk:r08-2 governed_by control:nistcsf:ID.RA-08","inferred"],["risk:r08-2 governed_by control:ssdf:RV.1","inferred"],["risk:r08-2 owned_by stakeholder:php-foundation","inferred"],["risk:r08-2 part_of risk:r08","inferred"],["risk:r08-2 protected_by treatment:r08-2.1","inferred"],["risk:r08-2 raised_by stakeholder:finders","inferred"],["risk:r08-2 shown_on page:discovery/index.html","inferred"],["risk:r08-2 tracked_by member:historian","inferred"],["risk:r09 arises_from weakness:w-inventory","inferred"],["risk:r09 backed_by claim:scale-2.6m-hosts","source"],["risk:r09 backed_by claim:scale-ncsc-nl","source"],["risk:r09 concerns vulnerability:cve-109618","inferred"],["risk:r09 concerns vulnerability:cve-109619","inferred"],["risk:r09 governed_by control:cis:16.4","inferred"],["risk:r09 governed_by control:cra:AnnexI.II","inferred"],["risk:r09 governed_by control:dora:Art.8","inferred"],["risk:r09 governed_by control:iso27001:A.8.9","inferred"],["risk:r09 governed_by control:nist80053:CM-8","inferred"],["risk:r09 governed_by control:nistcsf:ID.AM-02","inferred"],["risk:r09 informed_by stakeholder:inventory-suppliers","inferred"],["risk:r09 owned_by stakeholder:cto","inferred"],["risk:r09 protected_by treatment:r09.1","inferred"],["risk:r09 shown_on page:affected/software.html","inferred"],["risk:r09 shown_on page:playbook/index.html","inferred"],["risk:r09 told_in story:exposed-is-not-exploited","inferred"],["risk:r09 tracked_by member:story-site","inferred"],["risk:r09 treated_by stakeholder:engineers","inferred"],["risk:r10 arises_from weakness:w-agent-reach","inferred"],["risk:r10 arises_from weakness:w-status-words","inferred"],["risk:r10 arises_from weakness:w-untrusted-text","inferred"],["risk:r10 borne_by stakeholder:readers","inferred"],["risk:r10 governed_by control:euaiact:Art.50","inferred"],["risk:r10 governed_by control:iso42001:6.1.3","inferred"],["risk:r10 governed_by control:nistairmf:MANAGE-2.4","inferred"],["risk:r10 governed_by control:owasp:LLM06:2025","inferred"],["risk:r10 owned_by stakeholder:newsroom-editor","inferred"],["risk:r10 protected_by treatment:r10.1","inferred"],["risk:r10 protected_by treatment:r10.2","inferred"],["risk:r10 shown_on page:admin/agents/index.html","inferred"],["risk:r10 shown_on page:team/index.html","inferred"],["risk:r10 tracked_by member:conductor","inferred"],["risk:r10 tracked_by member:dev","inferred"],["risk:r10 treated_by stakeholder:newsroom-agents","inferred"],["risk:r10-1 arises_from weakness:w-untrusted-text","inferred"],["risk:r10-1 governed_by control:euaiact:Art.15","inferred"],["risk:r10-1 governed_by control:nistairmf:MEASURE-2.7","inferred"],["risk:r10-1 governed_by control:owasp:LLM01:2025","inferred"],["risk:r10-1 owned_by stakeholder:newsroom-editor","inferred"],["risk:r10-1 part_of risk:r10","inferred"],["risk:r10-1 protected_by treatment:r10-1.1","inferred"],["risk:r10-1 shown_on page:admin/agents/index.html","inferred"],["risk:r10-1 tracked_by member:dev","inferred"],["risk:r10-1 treated_by stakeholder:newsroom-agents","inferred"],["risk:r10-2 arises_from weakness:w-agent-reach","inferred"],["risk:r10-2 borne_by stakeholder:readers","inferred"],["risk:r10-2 governed_by control:gdpr:Art.32","inferred"],["risk:r10-2 governed_by control:iso27001:A.5.14","inferred"],["risk:r10-2 governed_by control:owasp:LLM02:2025","inferred"],["risk:r10-2 owned_by stakeholder:newsroom-editor","inferred"],["risk:r10-2 part_of risk:r10","inferred"],["risk:r10-2 protected_by treatment:r10-2.1","inferred"],["risk:r10-2 shown_on page:vaults/index.html","inferred"],["risk:r10-2 tracked_by member:dev","inferred"],["risk:r10-2 treated_by stakeholder:newsroom-agents","inferred"],["risk:r10-3 arises_from weakness:w-status-words","inferred"],["risk:r10-3 borne_by stakeholder:readers","inferred"],["risk:r10-3 governed_by control:euaiact:Art.50","inferred"],["risk:r10-3 governed_by control:owasp:LLM09:2025","inferred"],["risk:r10-3 owned_by stakeholder:newsroom-editor","inferred"],["risk:r10-3 part_of risk:r10","inferred"],["risk:r10-3 protected_by treatment:r10-3.1","inferred"],["risk:r10-3 raised_by stakeholder:newsroom-agents","inferred"],["risk:r10-3 shown_on page:factcheck/index.html","inferred"],["risk:r10-3 shown_on page:method/index.html","inferred"],["risk:r10-3 tracked_by member:story-site","inferred"],["risk:r10-3 tracked_by member:verifier","inferred"],["stakeholder:agencies part_of stakeholder:world","inferred"],["stakeholder:app-vendors part_of stakeholder:world","inferred"],["stakeholder:board briefed_by briefing:board","inferred"],["stakeholder:board part_of stakeholder:org-roles","inferred"],["stakeholder:calif part_of stakeholder:finders","inferred"],["stakeholder:cfo briefed_by briefing:cfo","inferred"],["stakeholder:cfo part_of stakeholder:org-roles","inferred"],["stakeholder:chainguard part_of stakeholder:distributors","inferred"],["stakeholder:ciso briefed_by briefing:ciso","inferred"],["stakeholder:ciso part_of stakeholder:org-roles","inferred"],["stakeholder:commerce part_of stakeholder:operators","inferred"],["stakeholder:comms briefed_by briefing:comms","inferred"],["stakeholder:comms part_of stakeholder:org-roles","inferred"],["stakeholder:councils part_of stakeholder:public-sector","inferred"],["stakeholder:critical-infra part_of stakeholder:operators","inferred"],["stakeholder:cto briefed_by briefing:cto","inferred"],["stakeholder:cto part_of stakeholder:org-roles","inferred"],["stakeholder:data-subjects part_of stakeholder:people","inferred"],["stakeholder:distributors part_of stakeholder:world","inferred"],["stakeholder:distros part_of stakeholder:distributors","inferred"],["stakeholder:dpo briefed_by briefing:dpo","inferred"],["stakeholder:dpo part_of stakeholder:org-roles","inferred"],["stakeholder:edge part_of stakeholder:world","inferred"],["stakeholder:engineers briefed_by briefing:engineer","inferred"],["stakeholder:engineers part_of stakeholder:org-roles","inferred"],["stakeholder:eu-agencies part_of stakeholder:agencies","inferred"],["stakeholder:finance part_of stakeholder:operators","inferred"],["stakeholder:finders part_of stakeholder:world","inferred"],["stakeholder:hosting part_of stakeholder:world","inferred"],["stakeholder:inventory-suppliers part_of stakeholder:app-vendors","inferred"],["stakeholder:managed-hosts part_of stakeholder:hosting","inferred"],["stakeholder:media part_of stakeholder:world","inferred"],["stakeholder:national-gov part_of stakeholder:public-sector","inferred"],["stakeholder:newsroom part_of stakeholder:media","inferred"],["stakeholder:newsroom-agents part_of stakeholder:newsroom","inferred"],["stakeholder:newsroom-editor part_of stakeholder:newsroom","inferred"],["stakeholder:newsroom-editor tracked_by member:dinis","inferred"],["stakeholder:non-profits part_of stakeholder:operators","inferred"],["stakeholder:openai part_of stakeholder:finders","inferred"],["stakeholder:operators part_of stakeholder:world","inferred"],["stakeholder:org-roles part_of stakeholder:operators","inferred"],["stakeholder:oss-apps part_of stakeholder:app-vendors","inferred"],["stakeholder:panels part_of stakeholder:distributors","inferred"],["stakeholder:people part_of stakeholder:world","inferred"],["stakeholder:php-fix-authors part_of stakeholder:php-project","inferred"],["stakeholder:php-foundation part_of stakeholder:php-project","inferred"],["stakeholder:php-project part_of stakeholder:world","inferred"],["stakeholder:php-security-team part_of stakeholder:php-project","inferred"],["stakeholder:public-sector part_of stakeholder:operators","inferred"],["stakeholder:quarkslab part_of stakeholder:finders","inferred"],["stakeholder:readers part_of stakeholder:newsroom","inferred"],["stakeholder:security-lead briefed_by briefing:security","inferred"],["stakeholder:security-lead part_of stakeholder:org-roles","inferred"],["stakeholder:service-users part_of stakeholder:people","inferred"],["stakeholder:shared-hosts part_of stakeholder:hosting","inferred"],["stakeholder:site-owner briefed_by briefing:site-owner","inferred"],["stakeholder:site-owner part_of stakeholder:org-roles","inferred"],["stakeholder:threat-intel part_of stakeholder:edge","inferred"],["stakeholder:uk-ncsc part_of stakeholder:agencies","inferred"],["stakeholder:us-agencies part_of stakeholder:agencies","inferred"],["stakeholder:waf-vendors part_of stakeholder:edge","inferred"],["stakeholder:wiz part_of stakeholder:finders","inferred"],["vulnerability:cve-109618 fixed_by remediation:fix-fallible","code"],["vulnerability:cve-109618 fixed_by remediation:fix-hard-limit","code"],["vulnerability:cve-109618 fixed_by remediation:fix-soft-limit","code"],["vulnerability:cve-109618 fixed_by remediation:fix-unwind","code"],["vulnerability:cve-109619 fixed_by remediation:fix-bounded-parsing","code"],["vulnerability:cve-109619 fixed_by remediation:fix-reset-globals","code"],["weakness:w-agent-reach located_in repo:.github/workflows/pages.yml","inferred"],["weakness:w-agent-reach located_in repo:admin/build/release.sh","inferred"],["weakness:w-agent-reach located_in repo:admin/build/security_check.py","inferred"],["weakness:w-agent-reach located_in repo:admin/build/validate.py","inferred"],["weakness:w-alloc-bailout arises_from vulnerability:cve-109618","inferred"],["weakness:w-bailout-class arises_from vulnerability:cve-109618","inferred"],["weakness:w-bailout-class arises_from vulnerability:cve-109619","inferred"],["weakness:w-eol arises_from vulnerability:cve-109618","inferred"],["weakness:w-eol arises_from vulnerability:cve-109619","inferred"],["weakness:w-stale-globals arises_from vulnerability:cve-109619","inferred"],["weakness:w-status-words located_in repo:admin/factcheck/fc.py","inferred"],["weakness:w-status-words located_in repo:data/claims.json","inferred"],["weakness:w-untrusted-text located_in repo:admin/build/security_check.py","inferred"],["weakness:w-untrusted-text located_in repo:admin/security/injection-allowlist.json","inferred"]],"gaps_opened":{},"gaps_closed":{"code-no-test":["code:file:Zend/zend_alloc.c","code:file:Zend/zend_execute_API.c","code:file:Zend/zend_hash.c","code:file:Zend/zend_string.c","code:file:Zend/zend_types.h","code:file:ext/session/session.c","code:file:main/rfc1867.c"],"vulnerability-no-test":["vulnerability:cve-109618","vulnerability:cve-109619"]},"totals":{"nodes":713,"edges":1343,"gaps":{"control-no-test":95,"code-no-owner":16,"code-no-test":9,"risk-no-story":14,"risk-no-treatment":0,"risk-no-owner":0,"vulnerability-no-test":0,"edges-inferred":815},"basis":{"code":287,"inferred":815,"source":241}}},{"version":"0.12.1","against":"0.12.0","nodes_added":["source:impress-watch-valtec","source:itsocial-cybersecurite-cybersecurite-articles-php","source:lupa-cvut-cyber-attack","source:paperjam-article-php2shell-des-milliers-de-sites","source:pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw","source:sankei-dmm-service-halt","source:the-verge-php2shell-websites-down","source:yahoo-jp-gmo-fx-login-leak"],"nodes_removed":[],"edges_added":[["claim:no-confirmed-compromise cites source:impress-watch-valtec","source"],["claim:no-confirmed-compromise cites source:itsocial-cybersecurite-cybersecurite-articles-php","source"],["claim:no-confirmed-compromise cites source:lupa-cvut-cyber-attack","source"],["claim:no-confirmed-compromise cites source:paperjam-article-php2shell-des-milliers-de-sites","source"],["claim:no-confirmed-compromise cites source:pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw","source"],["claim:no-confirmed-compromise cites source:sankei-dmm-service-halt","source"],["claim:no-confirmed-compromise cites source:the-verge-php2shell-websites-down","source"],["claim:no-confirmed-compromise cites source:yahoo-jp-gmo-fx-login-leak","source"]],"edges_removed":[],"basis_changed":[],"basis_recorded":[],"gaps_opened":{},"gaps_closed":{},"totals":{"nodes":721,"edges":1351,"gaps":{"control-no-test":95,"code-no-owner":16,"code-no-test":9,"risk-no-story":14,"risk-no-treatment":0,"risk-no-owner":0,"vulnerability-no-test":0,"edges-inferred":815},"basis":{"code":287,"inferred":815,"source":249}}},{"version":"0.13.0","against":"0.12.1","nodes_added":["source:tpo-nl-digid-offline"],"nodes_removed":["source:dutchitleaders-websites-offline"],"edges_added":[["claim:nl-offline cites source:tpo-nl-digid-offline","source"]],"edges_removed":["claim:nl-offline cites source:dutchitleaders-websites-offline"],"basis_changed":[],"basis_recorded":[],"gaps_opened":{},"gaps_closed":{},"totals":{"nodes":721,"edges":1351,"gaps":{"control-no-test":95,"code-no-owner":16,"code-no-test":9,"risk-no-story":14,"risk-no-treatment":0,"risk-no-owner":0,"vulnerability-no-test":0,"edges-inferred":815},"basis":{"code":287,"inferred":815,"source":249}}},{"version":"0.14.30","against":"0.14.29","nodes_added":["source:americanbanker-news-banks-dodge-early-damage-from-php2s","source:cybersecuritynews-critical-php2shell-exploit-code","source:the-next-web-php2shell-no-confirmed-breaches"],"nodes_removed":[],"edges_added":[["claim:no-confirmed-compromise cites source:americanbanker-news-banks-dodge-early-damage-from-php2s","source"],["claim:no-confirmed-compromise cites source:cybersecuritynews-critical-php2shell-exploit-code","source"],["claim:no-confirmed-compromise cites source:the-next-web-php2shell-no-confirmed-breaches","source"]],"edges_removed":[],"basis_changed":[],"basis_recorded":[],"gaps_opened":{},"gaps_closed":{},"totals":{"nodes":724,"edges":1354,"gaps":{"control-no-test":95,"code-no-owner":16,"code-no-test":9,"risk-no-story":14,"risk-no-treatment":0,"risk-no-owner":0,"vulnerability-no-test":0,"edges-inferred":815},"basis":{"code":287,"inferred":815,"source":252}}},{"version":"0.15.19","against":"0.15.18","nodes_added":["source:diepresse-41383717-die-php-sicherheitsluecke-ist-a","source:voix-business-cards-rainforest-ip-activity-an"],"nodes_removed":[],"edges_added":[["claim:no-confirmed-compromise cites source:diepresse-41383717-die-php-sicherheitsluecke-ist-a","source"],["claim:no-confirmed-compromise cites source:voix-business-cards-rainforest-ip-activity-an","source"]],"edges_removed":[],"basis_changed":[],"basis_recorded":[],"gaps_opened":{},"gaps_closed":{},"totals":{"nodes":726,"edges":1356,"gaps":{"control-no-test":95,"code-no-owner":16,"code-no-test":9,"risk-no-story":14,"risk-no-treatment":0,"risk-no-owner":0,"vulnerability-no-test":0,"edges-inferred":815},"basis":{"code":287,"inferred":815,"source":254}}}],"labels":{"briefing:board":["briefing","Board member or executive"],"briefing:cfo":["briefing","CFO"],"briefing:ciso":["briefing","CISO"],"briefing:comms":["briefing","Media and communications team"],"briefing:cto":["briefing","CTO"],"briefing:dpo":["briefing","Data protection officer"],"briefing:engineer":["briefing","PHP or platform engineer"],"briefing:security":["briefing","Security lead"],"briefing:site-owner":["briefing","Website owner"],"claim:ac-high":["claim","Triggering the bug is much easier than turning it into code execution; the CVSS vector say"],"claim:affected-sites":["claim","Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, "],"claim:ahead-of-attackers":["claim","Frontier AI found the flaw ahead of attackers, giving defenders time to prepare"],"claim:ai-found":["claim","The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet init"],"claim:amazon-honeypot":["claim","An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; pro"],"claim:cf-millions":["claim","Exploit attempts across Cloudflare's network: thousands in the ten hours before announceme"],"claim:chainguard":["claim","Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built i"],"claim:cisa-none":["claim","CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities "],"claim:cloudflare-traffic":["claim","Cloudflare observed attack traffic targeting its customers after the leak, with attackers "],"claim:cvss-10":["claim","The flaws are CVSS 10.0"],"claim:disclosure-22oct":["claim","The flaws were disclosed on 22 October 2026"],"claim:edinburgh":["claim","Edinburgh council's site went offline late on 21 October; the council called it 'essential"],"claim:fi-offline":["claim","Finland's state IT provider Valtori restricted public traffic to government web services f"],"claim:fix-bailout":["claim","The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the "],"claim:fix-engine":["claim","Both bugs are in the C engine, not in PHP code: the allocator's longjmp-based bailout on o"],"claim:fix-incomplete":["claim","The 8.5.12 fix may be incomplete, or there is a third, different bug"],"claim:four-reporters":["claim","The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-"],"claim:huntress-none":["claim","No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no pub"],"claim:imperva-none":["claim","No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosur"],"claim:kev-precedent":["claim","The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure a"],"claim:latvia-offline":["claim","Latvia restricted access from abroad to several state digital resources, possibly until 26"],"claim:leak-cve-ids":["claim","On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social me"],"claim:leak-hn":["claim","The leak started with an anonymous Hacker News post citing a reliable source, which came d"],"claim:leak-mitigations":["claim","Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on"],"claim:leak-video":["claim","Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of con"],"claim:leak-watchtowr":["claim","watchTowr confirmed in public that the bugs were real and posted both CVE numbers before t"],"claim:lorenc-ai-found":["claim","Chainguard's team found the same bugs independently with an AI harness and a frontier mode"],"claim:more-paths":["claim","Patching the demonstrated paths does not make the bailout mechanism safe; more paths shoul"],"claim:most-severe":["claim","The most severe flaws ever detected by AI"],"claim:nl-offline":["claim","The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet;"],"claim:no-confirmed-compromise":["claim","As of 16:05 UTC on 24 October, no named organisation has said it was compromised through p"],"claim:nz-active":["claim","Reports of active exploitation exist"],"claim:offline-allies":["claim","The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking system"],"claim:offline-cisa":["claim","Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PH"],"claim:offline-ncsc":["claim","'Where immediate remediation is not feasible, organisations should consider taking the sys"],"claim:offline-nsa":["claim","If an immediate update is not feasible, take the system offline until it can be fully miti"],"claim:only-update":["claim","Updating is the only complete mitigation; the configuration measures reduce exposure to sp"],"claim:openai-same-day":["claim","OpenAI independently reported the same root cause on 11 August, with further vectors on 18"],"claim:oxford":["claim","Oxford City Council: 'a precaution because of a worldwide issue with the underlying techno"],"claim:pocs-wrong":["claim","None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechani"],"claim:probing":["claim","Amazon and Cloudflare saw sites being probed for the flaw"],"claim:quarkslab-2024":["claim","The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and t"],"claim:quarkslab-redacted":["claim","Quarkslab's published audit summary lists 27 findings, two redacted because their fixes we"],"claim:rce-fpm":["claim","Remote code execution is confirmed on PHP-FPM"],"claim:rce-modphp":["claim","Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any app"],"claim:release-moved":["claim","The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the"],"claim:scale-2.6m-hosts":["claim","VulnCheck counts about 2.6 million internet-facing hosts exposing PHP; Censys, of the 2.58"],"claim:scale-30m":["claim","Something like 30 million websites could be affected"],"claim:scale-70pc-internet":["claim","70% of the Internet is affected"],"claim:scale-70pc-websites":["claim","PHP is used by almost 70% of websites whose server-side language is known"],"claim:scale-ncsc-nl":["claim","674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, "],"claim:two-cves-9.2":["claim","Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fix"],"claim:uk-list":["claim","Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility wer"],"claim:versions-old":["claim","All PHP versions from 5 onwards are affected by at least one of the flaws"],"claim:vibe-code":["claim","Criminals are using AI to 'vibe code' an attack method"],"claim:waf":["claim","A web application firewall may provide some protection until systems are patched"],"claim:waf-nine-hours":["claim","Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akam"],"claim:watchtowr-itw":["claim","watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild"],"claim:who-first":["claim","Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 1"],"claim:wikimedia-precaution":["claim","The Wikimedia Foundation took down a number of systems 'as a precautionary measure until t"],"claim:wiz-independent":["claim","Wiz Research independently discovered the first flaw on 19 August and reported on 24 Augus"],"claim:wordpress-drupal":["claim","In researchers' own tests, pre-authentication RCE was confirmed against WordPress, Drupal,"],"code:file:Zend/zend_alloc.c":["code","Zend/zend_alloc.c"],"code:file:Zend/zend_execute_API.c":["code","Zend/zend_execute_API.c"],"code:file:Zend/zend_hash.c":["code","Zend/zend_hash.c"],"code:file:Zend/zend_string.c":["code","Zend/zend_string.c"],"code:file:Zend/zend_types.h":["code","Zend/zend_types.h"],"code:file:ext/session/session.c":["code","ext/session/session.c"],"code:file:main/SAPI.c":["code","main/SAPI.c"],"code:file:main/main.c":["code","main/main.c"],"code:file:main/rfc1867.c":["code","main/rfc1867.c"],"control:attack:T1190":["control","MITRE ATT&CK T1190: Exploit public-facing application"],"control:attack:T1595.002":["control","MITRE ATT&CK T1595.002: Active scanning: vulnerability scanning"],"control:cis:13.10":["control","CIS Controls 13.10: Perform application layer filtering"],"control:cis:16.4":["control","CIS Controls 16.4: Establish and manage an inventory of third-party software components"],"control:cis:2.2":["control","CIS Controls 2.2: Ensure authorised software is currently supported"],"control:cis:7.4":["control","CIS Controls 7.4: Perform automated application patch management"],"control:cis:7.7":["control","CIS Controls 7.7: Remediate detected vulnerabilities"],"control:cra:AnnexI.II":["control","Cyber Resilience Act AnnexI.II: Vulnerability handling requirements: identify components, remedy without delay, publish fixed vulnerabilities, coordinated disclosure"],"control:cra:Art.13":["control","Cyber Resilience Act Art.13: Obligations of manufacturers, including due diligence on integrated third-party and open-source components"],"control:cra:Art.14":["control","Cyber Resilience Act Art.14: Reporting an actively exploited vulnerability: early warning within 24 hours to the CSIRT and ENISA"],"control:cra:Art.24":["control","Cyber Resilience Act Art.24: Obligations of open-source software stewards"],"control:cyberessentials:FW":["control","Cyber Essentials FW: Firewalls: boundary protection for internet-facing services"],"control:cyberessentials:SUM":["control","Cyber Essentials SUM: Security update management: high and critical updates within 14 days of release; unsupported software removed"],"control:dora:Art.10":["control","DORA Art.10: Detection of anomalous activities"],"control:dora:Art.11":["control","DORA Art.11: Response and recovery, including ICT business continuity"],"control:dora:Art.19":["control","DORA Art.19: Reporting major ICT-related incidents"],"control:dora:Art.28":["control","DORA Art.28: Managing ICT third-party risk"],"control:dora:Art.8":["control","DORA Art.8: Identification of ICT assets, their dependencies and the risks to them"],"control:euaiact:Art.15":["control","EU AI Act Art.15: Accuracy, robustness and cybersecurity of high-risk AI systems"],"control:euaiact:Art.50":["control","EU AI Act Art.50: Transparency: content generated by AI is disclosed as such"],"control:euaiact:Art.55":["control","EU AI Act Art.55: Providers of general-purpose models with systemic risk: evaluate, mitigate systemic risks, report serious incidents, protect cybersecurity"],"control:gdpr:Art.24":["control","GDPR Art.24: Responsibility of the controller: measures appropriate to the risk"],"control:gdpr:Art.28":["control","GDPR Art.28: Processors: the controller uses only processors that give sufficient guarantees"],"control:gdpr:Art.32":["control","GDPR Art.32: Security of processing, including a process for regularly testing and evaluating it"],"control:gdpr:Art.33":["control","GDPR Art.33: Notifying a personal data breach to the supervisory authority within 72 hours"],"control:gdpr:Art.34":["control","GDPR Art.34: Communicating a high-risk personal data breach to the people affected"],"control:gdpr:Art.5(1)(f)":["control","GDPR Art.5(1)(f): Integrity and confidentiality: personal data processed with appropriate security"],"control:iso27001:6.1.2":["control","ISO/IEC 27001 6.1.2: Information security risk assessment: identify risks and their owners"],"control:iso27001:A.5.14":["control","ISO/IEC 27001 A.5.14: Information transfer, including under agreed classification"],"control:iso27001:A.5.21":["control","ISO/IEC 27001 A.5.21: Managing information security in the ICT supply chain"],"control:iso27001:A.5.24":["control","ISO/IEC 27001 A.5.24: Incident management planning and preparation"],"control:iso27001:A.5.29":["control","ISO/IEC 27001 A.5.29: Information security during disruption"],"control:iso27001:A.5.30":["control","ISO/IEC 27001 A.5.30: ICT readiness for business continuity"],"control:iso27001:A.5.5":["control","ISO/IEC 27001 A.5.5: Contact with authorities"],"control:iso27001:A.5.7":["control","ISO/IEC 27001 A.5.7: Threat intelligence"],"control:iso27001:A.8.16":["control","ISO/IEC 27001 A.8.16: Monitoring activities"],"control:iso27001:A.8.20":["control","ISO/IEC 27001 A.8.20: Network security"],"control:iso27001:A.8.25":["control","ISO/IEC 27001 A.8.25: Secure development life cycle"],"control:iso27001:A.8.29":["control","ISO/IEC 27001 A.8.29: Security testing in development and acceptance"],"control:iso27001:A.8.8":["control","ISO/IEC 27001 A.8.8: Management of technical vulnerabilities"],"control:iso27001:A.8.9":["control","ISO/IEC 27001 A.8.9: Configuration management"],"control:iso29147:29147:coordination":["control","ISO/IEC 29147 and 30111 29147:coordination: Coordinating disclosure with other vendors and parties under embargo"],"control:iso29147:29147:receipt":["control","ISO/IEC 29147 and 30111 29147:receipt: Receiving vulnerability reports and acknowledging the finder"],"control:iso29147:30111:handling":["control","ISO/IEC 29147 and 30111 30111:handling: Investigating, remediating and releasing the fix, and learning from it"],"control:iso42001:6.1.2":["control","ISO/IEC 42001 6.1.2: AI risk assessment"],"control:iso42001:6.1.3":["control","ISO/IEC 42001 6.1.3: AI risk treatment"],"control:kev:BOD22-01":["control","CISA KEV and BOD 22-01 BOD22-01: Federal agencies remediate catalogued vulnerabilities by the due date set"],"control:kev:KEV-entry":["control","CISA KEV and BOD 22-01 KEV-entry: A CVE enters the catalogue on reliable evidence of active exploitation"],"control:nis2:Art.12":["control","NIS2 Art.12: Coordinated vulnerability disclosure and the European vulnerability database"],"control:nis2:Art.20":["control","NIS2 Art.20: Governance: management bodies approve and oversee the risk-management measures and can be held liable"],"control:nis2:Art.21(2)(c)":["control","NIS2 Art.21(2)(c): Business continuity, backup management, disaster recovery and crisis management"],"control:nis2:Art.21(2)(d)":["control","NIS2 Art.21(2)(d): Supply chain security, including the security of each direct supplier"],"control:nis2:Art.21(2)(e)":["control","NIS2 Art.21(2)(e): Security in acquisition, development and maintenance, including vulnerability handling and disclosure"],"control:nis2:Art.23":["control","NIS2 Art.23: Reporting significant incidents: early warning in 24 hours, notification in 72 hours, final report in a month"],"control:nist80053:CM-8":["control","NIST SP 800-53 CM-8: System component inventory"],"control:nist80053:CP-2":["control","NIST SP 800-53 CP-2: Contingency plan"],"control:nist80053:IR-6":["control","NIST SP 800-53 IR-6: Incident reporting"],"control:nist80053:RA-5":["control","NIST SP 800-53 RA-5: Vulnerability monitoring and scanning"],"control:nist80053:SA-22":["control","NIST SP 800-53 SA-22: Unsupported system components"],"control:nist80053:SC-7":["control","NIST SP 800-53 SC-7: Boundary protection"],"control:nist80053:SI-2":["control","NIST SP 800-53 SI-2: Flaw remediation"],"control:nist80053:SI-4":["control","NIST SP 800-53 SI-4: System monitoring"],"control:nistairmf:GOVERN-6.1":["control","NIST AI RMF GOVERN-6.1: Policies address AI risks from third-party entities"],"control:nistairmf:MANAGE-2.4":["control","NIST AI RMF MANAGE-2.4: Mechanisms exist, with assigned responsibility, to supersede, disengage or deactivate an AI system"],"control:nistairmf:MEASURE-2.7":["control","NIST AI RMF MEASURE-2.7: AI system security and resilience are evaluated and documented"],"control:nistcsf:DE.CM-01":["control","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events"],"control:nistcsf:GV.RM-01":["control","NIST CSF 2.0 GV.RM-01: Risk management objectives are established and agreed by stakeholders"],"control:nistcsf:GV.RR-01":["control","NIST CSF 2.0 GV.RR-01: Leadership is responsible and accountable for cybersecurity risk"],"control:nistcsf:GV.SC-05":["control","NIST CSF 2.0 GV.SC-05: Supply chain requirements are established and integrated into contracts"],"control:nistcsf:GV.SC-07":["control","NIST CSF 2.0 GV.SC-07: Supplier risks are understood, recorded, prioritised, assessed, responded to and monitored"],"control:nistcsf:ID.AM-02":["control","NIST CSF 2.0 ID.AM-02: Inventories of software, services and systems are maintained"],"control:nistcsf:ID.RA-01":["control","NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated and recorded"],"control:nistcsf:ID.RA-02":["control","NIST CSF 2.0 ID.RA-02: Threat intelligence is received from information sharing forums and sources"],"control:nistcsf:ID.RA-08":["control","NIST CSF 2.0 ID.RA-08: Processes for receiving, analysing and responding to vulnerability disclosures are established"],"control:nistcsf:PR.PS-02":["control","NIST CSF 2.0 PR.PS-02: Software is maintained, replaced and removed commensurate with risk"],"control:nistcsf:RC.RP-01":["control","NIST CSF 2.0 RC.RP-01: The recovery portion of the incident response plan is executed"],"control:nistcsf:RS.CO-03":["control","NIST CSF 2.0 RS.CO-03: Information is shared with designated internal and external stakeholders"],"control:owasp:A03:2025":["control","OWASP Top 10s A03:2025: Software supply chain failures"],"control:owasp:A06:2021":["control","OWASP Top 10s A06:2021: Vulnerable and outdated components"],"control:owasp:LLM01:2025":["control","OWASP Top 10s LLM01:2025: Prompt injection"],"control:owasp:LLM02:2025":["control","OWASP Top 10s LLM02:2025: Sensitive information disclosure"],"control:owasp:LLM06:2025":["control","OWASP Top 10s LLM06:2025: Excessive agency"],"control:owasp:LLM09:2025":["control","OWASP Top 10s LLM09:2025: Misinformation"],"control:pcidss:12.10.1":["control","PCI DSS 12.10.1: An incident response plan exists and is ready to be activated"],"control:pcidss:6.3.1":["control","PCI DSS 6.3.1: Security vulnerabilities are identified, risk-ranked and managed"],"control:pcidss:6.3.3":["control","PCI DSS 6.3.3: Critical security patches are installed within one month of release"],"control:pcidss:6.4.2":["control","PCI DSS 6.4.2: An automated technical solution that detects and prevents web attacks protects public-facing web applications"],"control:soc2:CC7.1":["control","SOC 2 CC7.1: Detection and monitoring procedures identify new vulnerabilities and configuration changes"],"control:soc2:CC9.2":["control","SOC 2 CC9.2: Risks from vendors and business partners are assessed and managed"],"control:ssdf:PW.7":["control","NIST SSDF PW.7: Review and analyse human-readable code to find vulnerabilities"],"control:ssdf:PW.8":["control","NIST SSDF PW.8: Test executable code to find vulnerabilities"],"control:ssdf:RV.1":["control","NIST SSDF RV.1: Identify and confirm vulnerabilities on an ongoing basis"],"control:ssdf:RV.2":["control","NIST SSDF RV.2: Assess, prioritise and remediate vulnerabilities"],"control:ssdf:RV.3":["control","NIST SSDF RV.3: Analyse vulnerabilities to identify their root causes"],"control:tlp:TLP:AMBER+STRICT":["control","FIRST TLP 2.0 TLP:AMBER+STRICT: Limited disclosure: recipients share only within their organisation"],"member:conductor":["member","Conductor"],"member:dev":["member","dev@php.newsroom"],"member:dinis":["member","Dinis Cruz"],"member:grc":["member","GRC desk"],"member:historian":["member","Historian"],"member:journalist":["member","Journalist"],"member:story-site":["member","Story site agent"],"member:verifier":["member","Fact-check desk"],"page:admin/agents/index.html":["page","Guidance for agents"],"page:affected/index.html":["page","Affected systems"],"page:affected/software.html":["page","Software inventory"],"page:agencies/index.html":["page","The agencies"],"page:briefings/comms/index.html":["page","Your briefing"],"page:briefings/dpo/index.html":["page","Your briefing"],"page:code/index.html":["page","The code"],"page:compromise/index.html":["page","No named compromise: the evidence"],"page:context/index.html":["page","In context: 2008 to 2026"],"page:defence/index.html":["page","Detection and defence"],"page:discovery/index.html":["page","Who found it"],"page:exploitation/index.html":["page","Exploitation signals"],"page:factcheck/index.html":["page","Fact-check: how sure we are"],"page:flaws/index.html":["page","The two flaws"],"page:impact/index.html":["page","Impact: offline vs compromised"],"page:leak/index.html":["page","How disclosure broke"],"page:method/index.html":["page","The method"],"page:numbers/index.html":["page","The numbers"],"page:patching/index.html":["page","Patching: who gets a fix"],"page:patching/inventory/index.html":["page","The inventory, hour by hour"],"page:playbook/index.html":["page","If you run PHP"],"page:review/index.html":["page","The fix, mapped to the code"],"page:signals/index.html":["page","The second stories: signals"],"page:team/index.html":["page","The team"],"page:timeline/index.html":["page","Timeline"],"page:vaults/index.html":["page","Every vault behind this site"],"remediation:fix-bounded-parsing":["remediation","Bounded, deduplicated request parsing"],"remediation:fix-commit":["remediation","The fix commit 3584a98bd"],"remediation:fix-fallible":["remediation","Allocations that may fail instead of abort"],"remediation:fix-hard-limit":["remediation","A hard limit that ends the process cleanly"],"remediation:fix-reset-globals":["remediation","Request globals reset so nothing survives a failure"],"remediation:fix-soft-limit":["remediation","A soft memory limit that no longer jumps"],"remediation:fix-unwind":["remediation","An orderly unwind at the next safe point"],"repo:.github/workflows/pages.yml":["code",".github/workflows/pages.yml"],"repo:admin/build/release.sh":["code","admin/build/release.sh"],"repo:admin/build/security_check.py":["code","admin/build/security_check.py"],"repo:admin/build/validate.py":["code","admin/build/validate.py"],"repo:admin/factcheck/fc.py":["code","admin/factcheck/fc.py"],"repo:admin/security/injection-allowlist.json":["code","admin/security/injection-allowlist.json"],"repo:data/claims.json":["code","data/claims.json"],"risk:r01":["risk","Remote code execution on internet-facing PHP servers"],"risk:r01-1":["risk","Default Apache mod_php installations exploited before application code runs"],"risk:r01-2":["risk","PHP-FPM deployments wrongly treated as safe or as certainly vulnerable"],"risk:r01-3":["risk","Versions the PHP project no longer fixes stay vulnerable"],"risk:r01-4":["risk","The fix is incomplete, or a third flaw follows"],"risk:r01-5":["risk","Popular applications compromised before authentication"],"risk:r01-6":["risk","Products that embed PHP stay vulnerable while their suppliers investigate"],"risk:r02":["risk","The coordinated disclosure broke before the fix was ready"],"risk:r02-1":["risk","The CVE IDs and the proof-of-concept video circulated before release"],"risk:r02-2":["risk","Early mitigation advice to a few providers leaked"],"risk:r02-3":["risk","Patched builds published before the embargo lifted"],"risk:r03":["risk","Exploitation outpaces patching"],"risk:r03-1":["risk","Attempts before disclosure"],"risk:r03-2":["risk","Mass scanning and mutated payloads after the leak"],"risk:r03-3":["risk","Exploited in the wild without anyone being able to show it"],"risk:r03-4":["risk","Detections built on a proof of concept with the wrong mechanism"],"risk:r04":["risk","Services lost to precautionary shutdowns"],"risk:r04-1":["risk","National government services offline"],"risk:r04-2":["risk","Councils and police offline without saying why"],"risk:r04-3":["risk","The agencies' advice disagrees"],"risk:r05":["risk","A web application firewall taken for a patch"],"risk:r06":["risk","A compromise becomes a reportable breach"],"risk:r06-1":["risk","Personal data taken from a compromised PHP application"],"risk:r06-2":["risk","Essential and financial entities miss their reporting clocks"],"risk:r06-3":["risk","Manufacturers under the Cyber Resilience Act owe a 24-hour report"],"risk:r07":["risk","Decisions made on numbers that measure something else"],"risk:r08":["risk","Frontier AI finds critical flaws faster than maintainers can fix them"],"risk:r08-1":["risk","A known bug left unexploited, then unfixed, for two years"],"risk:r08-2":["risk","Several finders, one small team"],"risk:r09":["risk","Not knowing where PHP runs"],"risk:r10":["risk","This newsroom's own agents are steered, leak or mislead"],"risk:r10-1":["risk","Prompt injection through captured material"],"risk:r10-2":["risk","A vault key or token published"],"risk:r10-3":["risk","A status word stronger than its evidence"],"source:acn-it-php2shell":["source","ACN / CSIRT Italia"],"source:acsc-alert-php":["source","ASD's ACSC (Australia)"],"source:akamai-blog-cve-2024-4577-one-day":["source","Akamai Security Research"],"source:akamai-blog-php-core-rce":["source","Akamai Security Research"],"source:americanbanker-news-banks-dodge-early-damage-from-php2s":["source","American Banker"],"source:aws-security-blog-madpot":["source","Amazon (CJ Moses, AWS Security Blog)"],"source:bbc-live-ckgel5xp2xv9t":["source","BBC News"],"source:calif-php2shell":["source","Calif (Calif Research)"],"source:cccs-al26-026":["source","Canadian Centre for Cyber Security (CCCS)"],"source:certeu-sa-2026-018":["source","CERT-EU"],"source:certfr-2026-ale-014":["source","CERT-FR (ANSSI)"],"source:certlv-php-preventive":["source","CERT.LV (Latvia)"],"source:ch-bacs-warnung-php":["source","Swiss Federal Office for Cyber Security (BACS / NCSC)"],"source:cisa-alert-php-20261021":["source","US Cybersecurity and Infrastructure Security Agency (CISA)"],"source:cisa-kev-json":["source","CISA"],"source:cloudflare-blog-php2shell-waf":["source","Cloudflare"],"source:cnn-php2shell-websites-shut":["source","CNN"],"source:cve-cve-2024-4577":["source","CVE Program (cveawg API)"],"source:cve-cve-2026-109618":["source","CVE Program (CNA: PHP Group)"],"source:cve-cve-2026-109619":["source","CVE Program (CNA: PHP Group)"],"source:cyberexpress-php2shell-gov-sites":["source","The Cyber Express"],"source:cybersecuritynews-critical-php2shell-exploit-code":["source","Cyber Security News"],"source:daubois-blog-php2shell-rumors":["source","Alexandre Daubois (PHP security team / PHP Foundation)"],"source:diepresse-41383717-die-php-sicherheitsluecke-ist-a":["source","Die Presse"],"source:dutchitleaders-websites-offline":["source","Dutch IT Leaders"],"source:fastly-blog-php2shell":["source","Fastly"],"source:fortinet-fortiweb-php2shell":["source","Fortinet Community (FortiWeb knowledge base)"],"source:github-ghsa-6wmf-4rv5-p3rp":["source","PHP (php/php-src GitHub security advisory, published by bukka)"],"source:github-ghsa-w8hw-w9fx-j79w":["source","PHP (php/php-src GitHub security advisory, published by bukka)"],"source:github-php-src-branch-7.4-backport":["source","php/php-src on GitHub"],"source:github-php-src-fix-commit-3584a98bd":["source","php/php-src (git), read from a clone"],"source:github-php-src-tag-php-8.5.12":["source","php/php-src on GitHub (release by adoy)"],"source:github-rjmendez-phpup-2026":["source","rjmendez, GitHub"],"source:helsinkitimes-finland-shutdown":["source","Helsinki Times"],"source:huntress-php2shell-rapid-response":["source","Huntress"],"source:imperva-blog-php2shell":["source","Imperva Threat Research (Nadav Avital, Bar Menachem)"],"source:impress-watch-valtec":["source","INTERNET Watch (Impress)"],"source:insurancebusiness-uk-councils-met":["source","Insurance Business (Matthew Sellers)"],"source:itsocial-cybersecurite-cybersecurite-articles-php":["source","IT Social"],"source:jpcert-at260033":["source","JPCERT/CC (Japan)"],"source:lbc-uk-websites-offline":["source","LBC"],"source:lupa-cvut-cyber-attack":["source","Lupa.cz"],"source:ncsc-news-php":["source","UK National Cyber Security Centre (NCSC)"],"source:ncsc-nl-advisories":["source","NCSC-NL"],"source:ncsc-nl-php2shell":["source","NCSC-NL (Netherlands National Cyber Security Centre)"],"source:ncsc-nl-php2shell-software-list":["source","NCSC-NL (Netherlands National Cyber Security Centre)"],"source:ncsc-nz-alert-php":["source","NCSC New Zealand"],"source:nsa-press-php-4630238":["source","US National Security Agency (NSA)"],"source:nsa-x-2112903220209098897":["source","NSA Cybersecurity (@NSACyber)"],"source:openwall-oss-security-109619-thread":["source","oss-security list (replies: Aaron Rainbolt, Yves-Alexis Perez/Debian, Christian Fischer/Greenbone)"],"source:openwall-oss-security-2026-10-20-34":["source","oss-security list (Alan Coopersmith, Oracle)"],"source:openwall-oss-security-2026-10-21-6":["source","oss-security list (Jakub Zelenka, PHP security team)"],"source:openwall-oss-security-2026-10-21-7":["source","oss-security list (Jakub Zelenka, PHP security team)"],"source:oxfordchronicle-councils-offline":["source","Oxford Chronicle"],"source:paperjam-article-php2shell-des-milliers-de-sites":["source","Paperjam"],"source:pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw":["source","PCMag"],"source:php-foundation-blog-security-release":["source","The PHP Foundation"],"source:php-net-advisory":["source","PHP Group (php.net)"],"source:php-net-changelog-8":["source","PHP Group (php.net)"],"source:phpfoundation-blog-security-release-leak":["source","The PHP Foundation"],"source:quarkslab-blog-php-src-audit":["source","Quarkslab"],"source:recordedfuture-php2shell":["source","Recorded Future"],"source:rijksoverheid-ncsc-php-news":["source","Rijksoverheid (Dutch government) / NCSC-NL"],"source:sankei-dmm-service-halt":["source","産経ニュース"],"source:scotsman-edinburgh-council-offline":["source","The Scotsman (Jack Davies)"],"source:securityweek-exploitation-days-before":["source","SecurityWeek"],"source:securityweek-first-attempts-sensors":["source","SecurityWeek"],"source:substack-lopezkurtz-patch-is-the-exploit":["source","David Lopez-Kurtz (Substack)"],"source:the-next-web-php2shell-no-confirmed-breaches":["source","The Next Web"],"source:the-verge-php2shell-websites-down":["source","The Verge"],"source:thehackernews-php2shell-4days":["source","The Hacker News (Ravie Lakshmanan)"],"source:theregister-php-blames-chainguard":["source","The Register"],"source:tpo-nl-digid-offline":["source","TPO.nl"],"source:voix-business-cards-rainforest-ip-activity-an":["source","voix"],"source:watchtowr-php2shell":["source","watchTowr"],"source:watchtowr-php2shell-faq":["source","watchTowr"],"source:weirdgloop-blog-php2shell":["source","Weird Gloop (cookmeplox)"],"source:wiz-blog-php2shell":["source","Wiz (Wiz Research)"],"source:x-eastdakota-php2shell-stats":["source","Matthew Prince (@eastdakota), Cloudflare CEO"],"source:x-feross-chainguard":["source","Feross Aboukhadijeh (@feross) on X"],"source:x-lcfr-hax-hash-tweet":["source","Ryan Austin (@lcfr_hax), Calif"],"source:x-openai-php2shell":["source","OpenAI (@OpenAI)"],"source:x-wiz-io-php2shell":["source","Wiz (@wiz_io)"],"source:yahoo-jp-gmo-fx-login-leak":["source","Yahoo! News Japan (J-CAST)"],"source:yle-finland-government-sites-shut":["source","Yle (Finnish public broadcaster)"],"stakeholder:agencies":["stakeholder","Agencies and CERTs"],"stakeholder:app-vendors":["stakeholder","Software built on PHP"],"stakeholder:board":["role","Board and executives"],"stakeholder:calif":["stakeholder","Calif"],"stakeholder:cfo":["role","CFO"],"stakeholder:chainguard":["stakeholder","Chainguard"],"stakeholder:ciso":["role","CISO"],"stakeholder:commerce":["stakeholder","Online shops and payments"],"stakeholder:comms":["role","Communications team"],"stakeholder:councils":["stakeholder","Local councils"],"stakeholder:critical-infra":["stakeholder","Critical infrastructure providers"],"stakeholder:cto":["role","CTO"],"stakeholder:data-subjects":["stakeholder","People whose data is held in PHP applications"],"stakeholder:distributors":["stakeholder","Distributors and packagers"],"stakeholder:distros":["stakeholder","Linux distributions and image builders"],"stakeholder:dpo":["role","Data protection officer"],"stakeholder:edge":["stakeholder","Edge, WAF and detection vendors"],"stakeholder:engineers":["role","Platform engineers and developers"],"stakeholder:eu-agencies":["stakeholder","EU and member-state CERTs"],"stakeholder:finance":["stakeholder","Banks, insurers and financial entities"],"stakeholder:finders":["stakeholder","The finders"],"stakeholder:hosting":["stakeholder","Hosting and cloud providers"],"stakeholder:inventory-suppliers":["stakeholder","Suppliers in the NCSC-NL inventory"],"stakeholder:managed-hosts":["stakeholder","Managed PHP platforms"],"stakeholder:media":["stakeholder","The press"],"stakeholder:national-gov":["stakeholder","National governments"],"stakeholder:newsroom":["stakeholder","This newsroom"],"stakeholder:newsroom-agents":["stakeholder","The newsroom's agents"],"stakeholder:newsroom-editor":["role","The editor"],"stakeholder:non-profits":["stakeholder","Wikis, universities and non-profits"],"stakeholder:openai":["stakeholder","OpenAI (Patch the Planet)"],"stakeholder:operators":["stakeholder","Organisations running PHP"],"stakeholder:org-roles":["stakeholder","Inside any one organisation"],"stakeholder:oss-apps":["stakeholder","Open-source PHP applications"],"stakeholder:panels":["stakeholder","Hosting panels and paid long-term support"],"stakeholder:people":["stakeholder","People who use PHP services"],"stakeholder:php-fix-authors":["stakeholder","The fix authors"],"stakeholder:php-foundation":["stakeholder","The PHP Foundation"],"stakeholder:php-project":["stakeholder","The PHP project"],"stakeholder:php-security-team":["stakeholder","The PHP security team"],"stakeholder:public-sector":["stakeholder","Governments and public services"],"stakeholder:quarkslab":["stakeholder","Quarkslab and OSTIF"],"stakeholder:readers":["stakeholder","This site's readers"],"stakeholder:security-lead":["role","Security lead and AppSec"],"stakeholder:service-users":["stakeholder","People who need a service that went offline"],"stakeholder:shared-hosts":["stakeholder","Shared and self-service hosting"],"stakeholder:site-owner":["role","Website owner"],"stakeholder:threat-intel":["stakeholder","Threat intelligence and detection"],"stakeholder:uk-ncsc":["stakeholder","UK NCSC"],"stakeholder:us-agencies":["stakeholder","US: CISA and the NSA"],"stakeholder:waf-vendors":["stakeholder","WAF vendors"],"stakeholder:wiz":["stakeholder","Wiz Research"],"stakeholder:world":["stakeholder","Everyone with PHP in the path"],"story:exposed-is-not-exploited":["story","Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit"],"story:patch-at-the-speed-of-metasploit":["story","Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third"],"story:php2shell-in-perspective":["story","php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof"],"story:where-php2shell-stands":["story","Where php2shell stands: many sites dark, millions of attempts, no confirmed breach"],"story:why-not-patch-every-version":["story","Why can't every version of PHP just be patched?"],"test:Zend/tests/bug40770.phpt":["test","Zend/tests/bug40770.phpt"],"test:Zend/tests/bug54268.phpt":["test","Zend/tests/bug54268.phpt"],"test:Zend/tests/bug76846.phpt":["test","Zend/tests/bug76846.phpt"],"test:Zend/tests/fibers/get-return-after-bailout.phpt":["test","Zend/tests/fibers/get-return-after-bailout.phpt"],"test:Zend/tests/gh11189.phpt":["test","Zend/tests/gh11189.phpt"],"test:Zend/tests/gh11189_1.phpt":["test","Zend/tests/gh11189_1.phpt"],"test:Zend/tests/oom_SplFixedArray___unserialize.phpt":["test","Zend/tests/oom_SplFixedArray___unserialize.phpt"],"test:Zend/tests/oom_SplFixedArray___wakeup.phpt":["test","Zend/tests/oom_SplFixedArray___wakeup.phpt"],"test:Zend/tests/oom_SplFixedArray_copy_ctor.phpt":["test","Zend/tests/oom_SplFixedArray_copy_ctor.phpt"],"test:Zend/tests/oom_SplFixedArray_fromArray_001.phpt":["test","Zend/tests/oom_SplFixedArray_fromArray_001.phpt"],"test:Zend/tests/oom_SplFixedArray_fromArray_002.phpt":["test","Zend/tests/oom_SplFixedArray_fromArray_002.phpt"],"test:Zend/tests/oom_after_main_script.phpt":["test","Zend/tests/oom_after_main_script.phpt"],"test:Zend/tests/oom_array_fill_001.phpt":["test","Zend/tests/oom_array_fill_001.phpt"],"test:Zend/tests/oom_array_fill_002.phpt":["test","Zend/tests/oom_array_fill_002.phpt"],"test:Zend/tests/oom_array_fill_003.phpt":["test","Zend/tests/oom_array_fill_003.phpt"],"test:Zend/tests/oom_array_fill_004.phpt":["test","Zend/tests/oom_array_fill_004.phpt"],"test:Zend/tests/oom_array_pad_001.phpt":["test","Zend/tests/oom_array_pad_001.phpt"],"test:Zend/tests/oom_array_pad_002.phpt":["test","Zend/tests/oom_array_pad_002.phpt"],"test:Zend/tests/oom_array_pad_003.phpt":["test","Zend/tests/oom_array_pad_003.phpt"],"test:Zend/tests/oom_array_pad_004.phpt":["test","Zend/tests/oom_array_pad_004.phpt"],"test:Zend/tests/oom_array_pad_005.phpt":["test","Zend/tests/oom_array_pad_005.phpt"],"test:Zend/tests/oom_array_pad_006.phpt":["test","Zend/tests/oom_array_pad_006.phpt"],"test:Zend/tests/oom_array_pad_007.phpt":["test","Zend/tests/oom_array_pad_007.phpt"],"test:Zend/tests/oom_array_pad_008.phpt":["test","Zend/tests/oom_array_pad_008.phpt"],"test:Zend/tests/oom_call_function.phpt":["test","Zend/tests/oom_call_function.phpt"],"test:Zend/tests/oom_call_function_002.phpt":["test","Zend/tests/oom_call_function_002.phpt"],"test:Zend/tests/oom_call_function_003.phpt":["test","Zend/tests/oom_call_function_003.phpt"],"test:Zend/tests/oom_debug_backtrace.phpt":["test","Zend/tests/oom_debug_backtrace.phpt"],"test:Zend/tests/oom_debug_backtrace_args.phpt":["test","Zend/tests/oom_debug_backtrace_args.phpt"],"test:Zend/tests/oom_debug_backtrace_named_args.phpt":["test","Zend/tests/oom_debug_backtrace_named_args.phpt"],"test:Zend/tests/oom_error_get_last.phpt":["test","Zend/tests/oom_error_get_last.phpt"],"test:Zend/tests/oom_exception_trace.phpt":["test","Zend/tests/oom_exception_trace.phpt"],"test:Zend/tests/oom_hard_limit_exceeded.phpt":["test","Zend/tests/oom_hard_limit_exceeded.phpt"],"test:Zend/tests/oom_hard_limit_exceeded_during_complilation.phpt":["test","Zend/tests/oom_hard_limit_exceeded_during_complilation.phpt"],"test:Zend/tests/oom_interrupt.phpt":["test","Zend/tests/oom_interrupt.phpt"],"test:Zend/tests/oom_interrupt_unfinished_call_frame.phpt":["test","Zend/tests/oom_interrupt_unfinished_call_frame.phpt"],"test:Zend/tests/oom_interrupt_unfinished_call_frame_fiber.phpt":["test","Zend/tests/oom_interrupt_unfinished_call_frame_fiber.phpt"],"test:Zend/tests/oom_json_decode_001.phpt":["test","Zend/tests/oom_json_decode_001.phpt"],"test:Zend/tests/oom_json_decode_002.phpt":["test","Zend/tests/oom_json_decode_002.phpt"],"test:Zend/tests/oom_json_decode_003.phpt":["test","Zend/tests/oom_json_decode_003.phpt"],"test:Zend/tests/oom_json_decode_004.phpt":["test","Zend/tests/oom_json_decode_004.phpt"],"test:Zend/tests/oom_json_decode_005.phpt":["test","Zend/tests/oom_json_decode_005.phpt"],"test:Zend/tests/oom_json_decode_006.phpt":["test","Zend/tests/oom_json_decode_006.phpt"],"test:Zend/tests/oom_json_decode_007.phpt":["test","Zend/tests/oom_json_decode_007.phpt"],"test:Zend/tests/oom_pending_at_shutdown.phpt":["test","Zend/tests/oom_pending_at_shutdown.phpt"],"test:Zend/tests/oom_range_001.phpt":["test","Zend/tests/oom_range_001.phpt"],"test:Zend/tests/oom_range_002.phpt":["test","Zend/tests/oom_range_002.phpt"],"test:Zend/tests/oom_range_003.phpt":["test","Zend/tests/oom_range_003.phpt"],"test:Zend/tests/oom_range_004.phpt":["test","Zend/tests/oom_range_004.phpt"],"test:Zend/tests/oom_request_parsing.phpt":["test","Zend/tests/oom_request_parsing.phpt"],"test:Zend/tests/oom_soft_limit_exceeded.phpt":["test","Zend/tests/oom_soft_limit_exceeded.phpt"],"test:Zend/tests/oom_soft_limit_exceeded_fcall.phpt":["test","Zend/tests/oom_soft_limit_exceeded_fcall.phpt"],"test:Zend/tests/oom_soft_limit_in_callback.phpt":["test","Zend/tests/oom_soft_limit_in_callback.phpt"],"test:Zend/tests/oom_str_repeat.phpt":["test","Zend/tests/oom_str_repeat.phpt"],"test:Zend/tests/oom_unserialize_001.phpt":["test","Zend/tests/oom_unserialize_001.phpt"],"test:Zend/tests/oom_unserialize_002.phpt":["test","Zend/tests/oom_unserialize_002.phpt"],"test:Zend/tests/oom_unserialize_003.phpt":["test","Zend/tests/oom_unserialize_003.phpt"],"test:Zend/tests/oom_unserialize_004.phpt":["test","Zend/tests/oom_unserialize_004.phpt"],"test:Zend/tests/oom_unserialize_005.phpt":["test","Zend/tests/oom_unserialize_005.phpt"],"test:Zend/tests/oom_unserialize_006.phpt":["test","Zend/tests/oom_unserialize_006.phpt"],"test:Zend/tests/oom_unserialize_007.phpt":["test","Zend/tests/oom_unserialize_007.phpt"],"test:Zend/tests/oom_unserialize_008.phpt":["test","Zend/tests/oom_unserialize_008.phpt"],"test:Zend/tests/oom_unserialize_009.phpt":["test","Zend/tests/oom_unserialize_009.phpt"],"test:Zend/tests/oom_unserialize_011.phpt":["test","Zend/tests/oom_unserialize_011.phpt"],"test:Zend/tests/oom_unserialize_012.phpt":["test","Zend/tests/oom_unserialize_012.phpt"],"test:Zend/tests/oom_unserialize_013.phpt":["test","Zend/tests/oom_unserialize_013.phpt"],"test:Zend/tests/oom_unserialize_014.phpt":["test","Zend/tests/oom_unserialize_014.phpt"],"test:Zend/tests/oom_unserialize_015.phpt":["test","Zend/tests/oom_unserialize_015.phpt"],"test:Zend/tests/oom_unserialize_016.phpt":["test","Zend/tests/oom_unserialize_016.phpt"],"test:Zend/tests/singleton_array.phpt":["test","Zend/tests/singleton_array.phpt"],"test:ext/bz2/tests/oom_bzcompress.phpt":["test","ext/bz2/tests/oom_bzcompress.phpt"],"test:ext/bz2/tests/oom_bzdecompress.phpt":["test","ext/bz2/tests/oom_bzdecompress.phpt"],"test:ext/bz2/tests/oom_bzip2_decompress_filter.phpt":["test","ext/bz2/tests/oom_bzip2_decompress_filter.phpt"],"test:ext/curl/tests/oom_curl_exec.phpt":["test","ext/curl/tests/oom_curl_exec.phpt"],"test:ext/curl/tests/oom_curl_multi_exec.phpt":["test","ext/curl/tests/oom_curl_multi_exec.phpt"],"test:ext/date/tests/oom_date_create.phpt":["test","ext/date/tests/oom_date_create.phpt"],"test:ext/date/tests/oom_date_create_immutable.phpt":["test","ext/date/tests/oom_date_create_immutable.phpt"],"test:ext/date/tests/oom_date_interval_create_from_date_string.phpt":["test","ext/date/tests/oom_date_interval_create_from_date_string.phpt"],"test:ext/date/tests/oom_date_modify.phpt":["test","ext/date/tests/oom_date_modify.phpt"],"test:ext/date/tests/oom_date_parse.phpt":["test","ext/date/tests/oom_date_parse.phpt"],"test:ext/date/tests/oom_dateinterval_construct.phpt":["test","ext/date/tests/oom_dateinterval_construct.phpt"],"test:ext/date/tests/oom_dateinterval_createfromdatestring.phpt":["test","ext/date/tests/oom_dateinterval_createfromdatestring.phpt"],"test:ext/date/tests/oom_dateperiod_construct.phpt":["test","ext/date/tests/oom_dateperiod_construct.phpt"],"test:ext/date/tests/oom_datetime_construct.phpt":["test","ext/date/tests/oom_datetime_construct.phpt"],"test:ext/date/tests/oom_datetime_modify.phpt":["test","ext/date/tests/oom_datetime_modify.phpt"],"test:ext/date/tests/oom_datetimeimmutable_construct.phpt":["test","ext/date/tests/oom_datetimeimmutable_construct.phpt"],"test:ext/date/tests/oom_datetimeimmutable_modify.phpt":["test","ext/date/tests/oom_datetimeimmutable_modify.phpt"],"test:ext/date/tests/oom_strtotime.phpt":["test","ext/date/tests/oom_strtotime.phpt"],"test:ext/dom/tests/oom_xpath.phpt":["test","ext/dom/tests/oom_xpath.phpt"],"test:ext/exif/tests/oom_exif_numeric_metadata.phpt":["test","ext/exif/tests/oom_exif_numeric_metadata.phpt"],"test:ext/exif/tests/oom_exif_read_data_tags.phpt":["test","ext/exif/tests/oom_exif_read_data_tags.phpt"],"test:ext/exif/tests/oom_exif_scan_jpeg_header.phpt":["test","ext/exif/tests/oom_exif_scan_jpeg_header.phpt"],"test:ext/exif/tests/oom_exif_thumbnail_large_file_001.phpt":["test","ext/exif/tests/oom_exif_thumbnail_large_file_001.phpt"],"test:ext/exif/tests/oom_exif_thumbnail_large_file_002.phpt":["test","ext/exif/tests/oom_exif_thumbnail_large_file_002.phpt"],"test:ext/exif/tests/oom_exif_thumbnail_tiff.phpt":["test","ext/exif/tests/oom_exif_thumbnail_tiff.phpt"],"test:ext/fileinfo/tests/oom_cdf_sector_chain.phpt":["test","ext/fileinfo/tests/oom_cdf_sector_chain.phpt"],"test:ext/filter/tests/oom_filter_default_encoded.phpt":["test","ext/filter/tests/oom_filter_default_encoded.phpt"],"test:ext/filter/tests/oom_filter_input.phpt":["test","ext/filter/tests/oom_filter_input.phpt"],"test:ext/filter/tests/oom_filter_input_array.phpt":["test","ext/filter/tests/oom_filter_input_array.phpt"],"test:ext/filter/tests/oom_filter_var.phpt":["test","ext/filter/tests/oom_filter_var.phpt"],"test:ext/filter/tests/oom_filter_var_array.phpt":["test","ext/filter/tests/oom_filter_var_array.phpt"],"test:ext/filter/tests/oom_filter_var_full_special_chars.phpt":["test","ext/filter/tests/oom_filter_var_full_special_chars.phpt"],"test:ext/gd/tests/oom_imagecreatefrombmp.phpt":["test","ext/gd/tests/oom_imagecreatefrombmp.phpt"],"test:ext/gd/tests/oom_imagecreatefromgd2.phpt":["test","ext/gd/tests/oom_imagecreatefromgd2.phpt"],"test:ext/gd/tests/oom_imagecreatefromgd2_chunkbuf.phpt":["test","ext/gd/tests/oom_imagecreatefromgd2_chunkbuf.phpt"],"test:ext/gd/tests/oom_imagecreatefromgd2_compbuf.phpt":["test","ext/gd/tests/oom_imagecreatefromgd2_compbuf.phpt"],"test:ext/gd/tests/oom_imagecreatefromgd2part.phpt":["test","ext/gd/tests/oom_imagecreatefromgd2part.phpt"],"test:ext/gd/tests/oom_imagecreatefromgd2part_chunkbuf.phpt":["test","ext/gd/tests/oom_imagecreatefromgd2part_chunkbuf.phpt"],"test:ext/gd/tests/oom_imagecreatefromgd2part_compbuf.phpt":["test","ext/gd/tests/oom_imagecreatefromgd2part_compbuf.phpt"],"test:ext/gd/tests/oom_imagecreatefromgif.phpt":["test","ext/gd/tests/oom_imagecreatefromgif.phpt"],"test:ext/gd/tests/oom_imagecreatefrompng.phpt":["test","ext/gd/tests/oom_imagecreatefrompng.phpt"],"test:ext/gd/tests/oom_imagecreatefromstring.phpt":["test","ext/gd/tests/oom_imagecreatefromstring.phpt"],"test:ext/gd/tests/oom_imagecreatefromtga.phpt":["test","ext/gd/tests/oom_imagecreatefromtga.phpt"],"test:ext/gd/tests/oom_imagecreatefromwbmp.phpt":["test","ext/gd/tests/oom_imagecreatefromwbmp.phpt"],"test:ext/gd/tests/oom_imagecreatefromxbm.phpt":["test","ext/gd/tests/oom_imagecreatefromxbm.phpt"],"test:ext/gd/tests/oom_imagepalettetotruecolor.phpt":["test","ext/gd/tests/oom_imagepalettetotruecolor.phpt"],"test:ext/iconv/tests/oom_iconv.phpt":["test","ext/iconv/tests/oom_iconv.phpt"],"test:ext/iconv/tests/oom_iconv_mime_decode.phpt":["test","ext/iconv/tests/oom_iconv_mime_decode.phpt"],"test:ext/iconv/tests/oom_iconv_mime_decode_headers.phpt":["test","ext/iconv/tests/oom_iconv_mime_decode_headers.phpt"],"test:ext/iconv/tests/oom_iconv_mime_encode.phpt":["test","ext/iconv/tests/oom_iconv_mime_encode.phpt"],"test:ext/iconv/tests/oom_iconv_mime_encode_line_length.phpt":["test","ext/iconv/tests/oom_iconv_mime_encode_line_length.phpt"],"test:ext/iconv/tests/oom_iconv_stream_filter.phpt":["test","ext/iconv/tests/oom_iconv_stream_filter.phpt"],"test:ext/imap/tests/oom_imap_mime_header_decode.phpt":["test","ext/imap/tests/oom_imap_mime_header_decode.phpt"],"test:ext/intl/tests/oom_normalizer_normalize.phpt":["test","ext/intl/tests/oom_normalizer_normalize.phpt"],"test:ext/intl/tests/oom_normalizer_normalize_func.phpt":["test","ext/intl/tests/oom_normalizer_normalize_func.phpt"],"test:ext/intl/tests/oom_uconverter_convert.phpt":["test","ext/intl/tests/oom_uconverter_convert.phpt"],"test:ext/intl/tests/oom_uconverter_transcode.phpt":["test","ext/intl/tests/oom_uconverter_transcode.phpt"],"test:ext/json/tests/json_decode_oom_utf8_substitute.phpt":["test","ext/json/tests/json_decode_oom_utf8_substitute.phpt"],"test:ext/json/tests/json_encode_oom_escape.phpt":["test","ext/json/tests/json_encode_oom_escape.phpt"],"test:ext/json/tests/json_encode_oom_partial_output.phpt":["test","ext/json/tests/json_encode_oom_partial_output.phpt"],"test:ext/json/tests/json_encode_oom_pretty_print.phpt":["test","ext/json/tests/json_encode_oom_pretty_print.phpt"],"test:ext/json/tests/json_encode_oom_string_prealloc.phpt":["test","ext/json/tests/json_encode_oom_string_prealloc.phpt"],"test:ext/mbstring/tests/oom_buf_growth.phpt":["test","ext/mbstring/tests/oom_buf_growth.phpt"],"test:ext/mbstring/tests/oom_mb_convert_case.phpt":["test","ext/mbstring/tests/oom_mb_convert_case.phpt"],"test:ext/mbstring/tests/oom_mb_convert_encoding.phpt":["test","ext/mbstring/tests/oom_mb_convert_encoding.phpt"],"test:ext/mbstring/tests/oom_mb_convert_variables.phpt":["test","ext/mbstring/tests/oom_mb_convert_variables.phpt"],"test:ext/mbstring/tests/oom_mb_convert_variables_many.phpt":["test","ext/mbstring/tests/oom_mb_convert_variables_many.phpt"],"test:ext/mbstring/tests/oom_mb_decode_mimeheader.phpt":["test","ext/mbstring/tests/oom_mb_decode_mimeheader.phpt"],"test:ext/mbstring/tests/oom_mb_encode_mimeheader.phpt":["test","ext/mbstring/tests/oom_mb_encode_mimeheader.phpt"],"test:ext/mbstring/tests/oom_mb_encode_numericentity.phpt":["test","ext/mbstring/tests/oom_mb_encode_numericentity.phpt"],"test:ext/mbstring/tests/oom_mb_ereg_replace.phpt":["test","ext/mbstring/tests/oom_mb_ereg_replace.phpt"],"test:ext/mbstring/tests/oom_mb_eregi_replace.phpt":["test","ext/mbstring/tests/oom_mb_eregi_replace.phpt"],"test:ext/mbstring/tests/oom_mb_parse_str.phpt":["test","ext/mbstring/tests/oom_mb_parse_str.phpt"],"test:ext/mbstring/tests/oom_mb_split.phpt":["test","ext/mbstring/tests/oom_mb_split.phpt"],"test:ext/mbstring/tests/oom_mb_str_split.phpt":["test","ext/mbstring/tests/oom_mb_str_split.phpt"],"test:ext/mbstring/tests/oom_mb_str_split_filter.phpt":["test","ext/mbstring/tests/oom_mb_str_split_filter.phpt"],"test:ext/mbstring/tests/oom_mb_str_split_fixed_width.phpt":["test","ext/mbstring/tests/oom_mb_str_split_fixed_width.phpt"],"test:ext/mbstring/tests/oom_mb_str_split_length.phpt":["test","ext/mbstring/tests/oom_mb_str_split_length.phpt"],"test:ext/mbstring/tests/oom_mb_strcut_filter.phpt":["test","ext/mbstring/tests/oom_mb_strcut_filter.phpt"],"test:ext/mbstring/tests/oom_mb_strcut_length.phpt":["test","ext/mbstring/tests/oom_mb_strcut_length.phpt"],"test:ext/mbstring/tests/oom_mb_strimwidth.phpt":["test","ext/mbstring/tests/oom_mb_strimwidth.phpt"],"test:ext/mbstring/tests/oom_mb_strtoupper.phpt":["test","ext/mbstring/tests/oom_mb_strtoupper.phpt"],"test:ext/mbstring/tests/oom_mb_substr_count.phpt":["test","ext/mbstring/tests/oom_mb_substr_count.phpt"],"test:ext/mbstring/tests/oom_mb_substr_length.phpt":["test","ext/mbstring/tests/oom_mb_substr_length.phpt"],"test:ext/pcre/tests/oom_preg_filter.phpt":["test","ext/pcre/tests/oom_preg_filter.phpt"],"test:ext/pcre/tests/oom_preg_match_all.phpt":["test","ext/pcre/tests/oom_preg_match_all.phpt"],"test:ext/pcre/tests/oom_preg_match_captures.phpt":["test","ext/pcre/tests/oom_preg_match_captures.phpt"],"test:ext/pcre/tests/oom_preg_replace.phpt":["test","ext/pcre/tests/oom_preg_replace.phpt"],"test:ext/pcre/tests/oom_preg_replace_callback.phpt":["test","ext/pcre/tests/oom_preg_replace_callback.phpt"],"test:ext/pcre/tests/oom_preg_replace_callback_array.phpt":["test","ext/pcre/tests/oom_preg_replace_callback_array.phpt"],"test:ext/pcre/tests/oom_preg_split.phpt":["test","ext/pcre/tests/oom_preg_split.phpt"],"test:ext/session/tests/rfc1867_incomplete_class_reserved_props.phpt":["test","ext/session/tests/rfc1867_incomplete_class_reserved_props.phpt"],"test:ext/session/tests/rfc1867_no_user_code.phpt":["test","ext/session/tests/rfc1867_no_user_code.phpt"],"test:ext/session/tests/rfc1867_sid_invalid.phpt":["test","ext/session/tests/rfc1867_sid_invalid.phpt"],"test:ext/simplexml/tests/oom_array_cast.phpt":["test","ext/simplexml/tests/oom_array_cast.phpt"],"test:ext/simplexml/tests/oom_json_encode.phpt":["test","ext/simplexml/tests/oom_json_encode.phpt"],"test:ext/simplexml/tests/oom_xpath.phpt":["test","ext/simplexml/tests/oom_xpath.phpt"],"test:ext/soap/tests/oom_soapclient_call.phpt":["test","ext/soap/tests/oom_soapclient_call.phpt"],"test:ext/soap/tests/oom_soapclient_dorequest_chunked.phpt":["test","ext/soap/tests/oom_soapclient_dorequest_chunked.phpt"],"test:ext/soap/tests/oom_soapclient_dorequest_close.phpt":["test","ext/soap/tests/oom_soapclient_dorequest_close.phpt"],"test:ext/soap/tests/oom_soapclient_dorequest_content_length.phpt":["test","ext/soap/tests/oom_soapclient_dorequest_content_length.phpt"],"test:ext/soap/tests/oom_soapclient_response_headers.phpt":["test","ext/soap/tests/oom_soapclient_response_headers.phpt"],"test:ext/soap/tests/oom_soapclient_soapcall.phpt":["test","ext/soap/tests/oom_soapclient_soapcall.phpt"],"test:ext/soap/tests/oom_soapserver_handle_array.phpt":["test","ext/soap/tests/oom_soapserver_handle_array.phpt"],"test:ext/soap/tests/oom_soapserver_handle_headers.phpt":["test","ext/soap/tests/oom_soapserver_handle_headers.phpt"],"test:ext/soap/tests/oom_soapserver_handle_parameters.phpt":["test","ext/soap/tests/oom_soapserver_handle_parameters.phpt"],"test:ext/standard/tests/GHSA-96wq-48vp-hh57.phpt":["test","ext/standard/tests/GHSA-96wq-48vp-hh57.phpt"],"test:ext/standard/tests/array/oom_array_chunk.phpt":["test","ext/standard/tests/array/oom_array_chunk.phpt"],"test:ext/standard/tests/array/oom_array_map_zip.phpt":["test","ext/standard/tests/array/oom_array_map_zip.phpt"],"test:ext/standard/tests/file/fread_oom_chunk_size.phpt":["test","ext/standard/tests/file/fread_oom_chunk_size.phpt"],"test:ext/standard/tests/file/fread_oom_filter_chunk_size.phpt":["test","ext/standard/tests/file/fread_oom_filter_chunk_size.phpt"],"test:ext/standard/tests/file/fread_oom_length.phpt":["test","ext/standard/tests/file/fread_oom_length.phpt"],"test:ext/standard/tests/file/oom_file.phpt":["test","ext/standard/tests/file/oom_file.phpt"],"test:ext/standard/tests/file/oom_file_get_contents.phpt":["test","ext/standard/tests/file/oom_file_get_contents.phpt"],"test:ext/standard/tests/image/oom_getimagesize_cws.phpt":["test","ext/standard/tests/image/oom_getimagesize_cws.phpt"],"test:ext/standard/tests/image/oom_getimagesize_xbm.phpt":["test","ext/standard/tests/image/oom_getimagesize_xbm.phpt"],"test:ext/standard/tests/image/oom_getimagesizefromstring_cws.phpt":["test","ext/standard/tests/image/oom_getimagesizefromstring_cws.phpt"],"test:ext/standard/tests/serialize/incomplete_class_raw_payload_markers.phpt":["test","ext/standard/tests/serialize/incomplete_class_raw_payload_markers.phpt"],"test:ext/standard/tests/streams/bug61115-1.phpt":["test","ext/standard/tests/streams/bug61115-1.phpt"],"test:ext/standard/tests/streams/oom_stream_copy_to_stream_memory.phpt":["test","ext/standard/tests/streams/oom_stream_copy_to_stream_memory.phpt"],"test:ext/standard/tests/streams/oom_stream_get_contents.phpt":["test","ext/standard/tests/streams/oom_stream_get_contents.phpt"],"test:ext/standard/tests/streams/stream_get_line_oom_chunk_size.phpt":["test","ext/standard/tests/streams/stream_get_line_oom_chunk_size.phpt"],"test:ext/standard/tests/strings/chunk_split_variation3.phpt":["test","ext/standard/tests/strings/chunk_split_variation3.phpt"],"test:ext/standard/tests/strings/oom_explode.phpt":["test","ext/standard/tests/strings/oom_explode.phpt"],"test:ext/standard/tests/strings/oom_implode.phpt":["test","ext/standard/tests/strings/oom_implode.phpt"],"test:ext/standard/tests/strings/oom_levenshtein.phpt":["test","ext/standard/tests/strings/oom_levenshtein.phpt"],"test:ext/standard/tests/strings/oom_nl2br.phpt":["test","ext/standard/tests/strings/oom_nl2br.phpt"],"test:ext/standard/tests/strings/oom_setcookie_value.phpt":["test","ext/standard/tests/strings/oom_setcookie_value.phpt"],"test:ext/standard/tests/strings/oom_str_getcsv.phpt":["test","ext/standard/tests/strings/oom_str_getcsv.phpt"],"test:ext/standard/tests/strings/oom_str_ireplace.phpt":["test","ext/standard/tests/strings/oom_str_ireplace.phpt"],"test:ext/standard/tests/strings/oom_str_replace.phpt":["test","ext/standard/tests/strings/oom_str_replace.phpt"],"test:ext/standard/tests/strings/oom_str_split.phpt":["test","ext/standard/tests/strings/oom_str_split.phpt"],"test:ext/standard/tests/strings/oom_str_word_count.phpt":["test","ext/standard/tests/strings/oom_str_word_count.phpt"],"test:ext/standard/tests/strings/oom_strtr.phpt":["test","ext/standard/tests/strings/oom_strtr.phpt"],"test:ext/standard/tests/strings/oom_substr_replace.phpt":["test","ext/standard/tests/strings/oom_substr_replace.phpt"],"test:ext/standard/tests/strings/oom_unpack.phpt":["test","ext/standard/tests/strings/oom_unpack.phpt"],"test:ext/standard/tests/strings/str_pad_variation1.phpt":["test","ext/standard/tests/strings/str_pad_variation1.phpt"],"test:ext/standard/tests/strings/wordwrap_memory_limit_002.phpt":["test","ext/standard/tests/strings/wordwrap_memory_limit_002.phpt"],"test:ext/standard/tests/strings/wordwrap_memory_limit_003.phpt":["test","ext/standard/tests/strings/wordwrap_memory_limit_003.phpt"],"test:ext/standard/tests/strings/wordwrap_memory_limit_004.phpt":["test","ext/standard/tests/strings/wordwrap_memory_limit_004.phpt"],"test:ext/tokenizer/tests/token_get_all_TOKEN_PARSE_oom_feedback.phpt":["test","ext/tokenizer/tests/token_get_all_TOKEN_PARSE_oom_feedback.phpt"],"test:ext/xml/tests/oom_xml_parse_attributes.phpt":["test","ext/xml/tests/oom_xml_parse_attributes.phpt"],"test:ext/xml/tests/oom_xml_parse_into_struct.phpt":["test","ext/xml/tests/oom_xml_parse_into_struct.phpt"],"test:ext/xml/tests/oom_xml_parse_ns.phpt":["test","ext/xml/tests/oom_xml_parse_ns.phpt"],"test:ext/xmlreader/tests/oom_xmlreader_getattribute.phpt":["test","ext/xmlreader/tests/oom_xmlreader_getattribute.phpt"],"test:ext/xmlreader/tests/oom_xmlreader_getattributeno.phpt":["test","ext/xmlreader/tests/oom_xmlreader_getattributeno.phpt"],"test:ext/xmlreader/tests/oom_xmlreader_getattributens.phpt":["test","ext/xmlreader/tests/oom_xmlreader_getattributens.phpt"],"test:ext/xmlreader/tests/oom_xmlreader_lookupnamespace.phpt":["test","ext/xmlreader/tests/oom_xmlreader_lookupnamespace.phpt"],"test:ext/xmlreader/tests/oom_xmlreader_readinnerxml.phpt":["test","ext/xmlreader/tests/oom_xmlreader_readinnerxml.phpt"],"test:ext/xmlreader/tests/oom_xmlreader_readouterxml.phpt":["test","ext/xmlreader/tests/oom_xmlreader_readouterxml.phpt"],"test:ext/xmlreader/tests/oom_xmlreader_readstring.phpt":["test","ext/xmlreader/tests/oom_xmlreader_readstring.phpt"],"test:ext/zend_test/test.c":["test","ext/zend_test/test.c (harness)"],"test:ext/zend_test/test.stub.php":["test","ext/zend_test/test.stub.php (harness)"],"test:ext/zend_test/test_arginfo.h":["test","ext/zend_test/test_arginfo.h (harness)"],"test:ext/zend_test/tests/observer_bug81430_2.phpt":["test","ext/zend_test/tests/observer_bug81430_2.phpt"],"test:ext/zend_test/tests/observer_bug81435.phpt":["test","ext/zend_test/tests/observer_bug81435.phpt"],"test:ext/zend_test/tests/observer_error_01.phpt":["test","ext/zend_test/tests/observer_error_01.phpt"],"test:ext/zend_test/tests/observer_fiber_functions_03.phpt":["test","ext/zend_test/tests/observer_fiber_functions_03.phpt"],"test:ext/zend_test/tests/zend_test_handle_post_data.phpt":["test","ext/zend_test/tests/zend_test_handle_post_data.phpt"],"test:ext/zlib/tests/oom_deflate_add.phpt":["test","ext/zlib/tests/oom_deflate_add.phpt"],"test:ext/zlib/tests/oom_gzcompress.phpt":["test","ext/zlib/tests/oom_gzcompress.phpt"],"test:ext/zlib/tests/oom_gzdecode.phpt":["test","ext/zlib/tests/oom_gzdecode.phpt"],"test:ext/zlib/tests/oom_gzfile.phpt":["test","ext/zlib/tests/oom_gzfile.phpt"],"test:ext/zlib/tests/oom_gzgets.phpt":["test","ext/zlib/tests/oom_gzgets.phpt"],"test:ext/zlib/tests/oom_gzpassthru.phpt":["test","ext/zlib/tests/oom_gzpassthru.phpt"],"test:ext/zlib/tests/oom_inflate_add.phpt":["test","ext/zlib/tests/oom_inflate_add.phpt"],"test:ext/zlib/tests/oom_readgzfile.phpt":["test","ext/zlib/tests/oom_readgzfile.phpt"],"test:ext/zlib/tests/oom_zlib_inflate_filter.phpt":["test","ext/zlib/tests/oom_zlib_inflate_filter.phpt"],"test:run-tests.php":["test","run-tests.php (harness)"],"test:sapi/cli/tests/oom_request_parsing_next_request.phpt":["test","sapi/cli/tests/oom_request_parsing_next_request.phpt"],"test:sapi/cli/tests/oom_shutdown_function_next_request.phpt":["test","sapi/cli/tests/oom_shutdown_function_next_request.phpt"],"test:sapi/fpm/tests/bug77023-pm-dynamic-blocking-sigquit.phpt":["test","sapi/fpm/tests/bug77023-pm-dynamic-blocking-sigquit.phpt"],"test:tests/basic/GHSA-2cv3-554h-jpmh_multipart.phpt":["test","tests/basic/GHSA-2cv3-554h-jpmh_multipart.phpt"],"test:tests/basic/GHSA-2cv3-554h-jpmh_urlencoded.phpt":["test","tests/basic/GHSA-2cv3-554h-jpmh_urlencoded.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_001.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_001.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_002.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_002.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_003.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_003.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_004.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_004.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_005.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_005.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_006.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_006.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_007.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_007.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_008.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_008.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_009.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_009.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_010.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_010.phpt"],"test:tests/basic/GHSA-f883-x959-3vr9_011.phpt":["test","tests/basic/GHSA-f883-x959-3vr9_011.phpt"],"test:tests/basic/oom_rfc1867_array_upload_name.phpt":["test","tests/basic/oom_rfc1867_array_upload_name.phpt"],"test:tests/basic/oom_rfc1867_early_report.phpt":["test","tests/basic/oom_rfc1867_early_report.phpt"],"test:tests/basic/oom_rfc1867_field_name.phpt":["test","tests/basic/oom_rfc1867_field_name.phpt"],"test:tests/basic/oom_rfc1867_files.phpt":["test","tests/basic/oom_rfc1867_files.phpt"],"test:tests/basic/oom_rfc1867_files_registration.phpt":["test","tests/basic/oom_rfc1867_files_registration.phpt"],"test:tests/basic/oom_rfc1867_files_registration_full_path.phpt":["test","tests/basic/oom_rfc1867_files_registration_full_path.phpt"],"test:tests/basic/oom_rfc1867_form_value.phpt":["test","tests/basic/oom_rfc1867_form_value.phpt"],"test:tests/basic/oom_rfc1867_header_continuation.phpt":["test","tests/basic/oom_rfc1867_header_continuation.phpt"],"test:tests/basic/oom_rfc1867_header_count.phpt":["test","tests/basic/oom_rfc1867_header_count.phpt"],"test:tests/basic/oom_rfc1867_long_header_line.phpt":["test","tests/basic/oom_rfc1867_long_header_line.phpt"],"test:tests/basic/oom_rfc1867_mb_encoding.phpt":["test","tests/basic/oom_rfc1867_mb_encoding.phpt"],"test:tests/basic/oom_rfc1867_post_vars.phpt":["test","tests/basic/oom_rfc1867_post_vars.phpt"],"test:tests/basic/oom_rfc1867_upload_progress.phpt":["test","tests/basic/oom_rfc1867_upload_progress.phpt"],"test:tests/output/gh15179.phpt":["test","tests/output/gh15179.phpt"],"test:tests/output/oom_in_internal_output_handler.phpt":["test","tests/output/oom_in_internal_output_handler.phpt"],"treatment:r01-1.1":["treatment","Update PHP; the configuration measures reduce exposure and do not make an installation safe"],"treatment:r01-2.1":["treatment","Treat FPM as affected and update it on the same schedule"],"treatment:r01-3.1":["treatment","Distribution backports and paid support for retired versions"],"treatment:r01-3.2":["treatment","Upgrade to a supported branch"],"treatment:r01-4.1":["treatment","The fix replaces the longjmp bailout with a delayed soft limit and a clean hard exit"],"treatment:r01-4.2":["treatment","Keep detection and filters after patching"],"treatment:r01-5.1":["treatment","Update PHP under the application"],"treatment:r01-6.1":["treatment","The NCSC-NL inventory, tracked hour by hour"],"treatment:r01.1":["treatment","Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35"],"treatment:r01.2":["treatment","Take the system offline where an update is not possible (CISA, NSA)"],"treatment:r01.3":["treatment","Edge filters while the update is rolled out"],"treatment:r02-1.1":["treatment","Edge rules live before disclosure"],"treatment:r02-2.1":["treatment","Share early advice under TLP:AMBER+STRICT and record who received it"],"treatment:r02-3.1":["treatment","Embargo terms that cover built artefacts, not only advisories"],"treatment:r02.1":["treatment","Move the release forward once the leak was confirmed"],"treatment:r03-1.1":["treatment","Hunt back to 17 October, not to the release"],"treatment:r03-2.1":["treatment","Edge rules from every major vendor"],"treatment:r03-3.1":["treatment","Rate on exposure and precedent, not only on confirmed exploitation"],"treatment:r03-4.1":["treatment","Check versions, not scanner verdicts"],"treatment:r03.1":["treatment","Patch within days, not the 14-day Cyber Essentials window"],"treatment:r03.2":["treatment","Watch the signals ladder for the move from exposed to exploited"],"treatment:r04-1.1":["treatment","Restrict access by geography instead of switching off"],"treatment:r04-2.1":["treatment","A holding statement prepared before the outage"],"treatment:r04-3.1":["treatment","The agencies table, advice side by side"],"treatment:r04.1":["treatment","Serve from cache while the origin is patched"],"treatment:r04.2":["treatment","A continuity plan that names which services may go dark"],"treatment:r05.1":["treatment","Filter and patch, never filter instead of patch"],"treatment:r06-1.1":["treatment","Security of processing kept current, tested and evaluated"],"treatment:r06-2.1":["treatment","Classify a precautionary shutdown against the reporting thresholds on the day"],"treatment:r06-3.1":["treatment","A documented decision on whether and when the exploitation test is met"],"treatment:r06.1":["treatment","A breach-assessment step in the incident plan, started at the first sign of compromise"],"treatment:r07.1":["treatment","Every number with what it counts and its source"],"treatment:r08-1.1":["treatment","Publicly funded audits (OSTIF, Sovereign Tech Agency)"],"treatment:r08-2.1":["treatment","A coalition that pooled reports for one fix"],"treatment:r08.1":["treatment","Coordinated reporting by the model providers (Patch the Planet)"],"treatment:r09.1":["treatment","A software inventory with component versions (SBOM)"],"treatment:r10-1.1":["treatment","Untrusted input fenced, flagged and never followed; the gate's injection check"],"treatment:r10-2.1":["treatment","Credential-shape and vault-file checks in the gate and on the staged diff"],"treatment:r10-3.1":["treatment","An independent fact-check desk grading every claim"],"treatment:r10.1":["treatment","The security requirements, the gate and the release tripwire"],"treatment:r10.2":["treatment","Rulesets on dev and main restricting the gate's own files"],"vulnerability:cve-109618":["vulnerability","CVE-2026-109618: RCE via OOM corruption"],"vulnerability:cve-109619":["vulnerability","CVE-2026-109619: RCE via stale global state"],"weakness:w-agent-reach":["weakness","Agents that read the open web and can publish"],"weakness:w-ai-dual-use":["weakness","Frontier models that find memory-safety bugs in widely used C"],"weakness:w-alloc-bailout":["weakness","The allocator's longjmp-based bailout on out-of-memory"],"weakness:w-bailout-class":["weakness","Bailout as a class of bug"],"weakness:w-embargo":["weakness","One embargo shared by many parties"],"weakness:w-eol":["weakness","PHP versions the project no longer fixes"],"weakness:w-headline":["weakness","Numbers and ratings repeated without their source"],"weakness:w-inventory":["weakness","Not knowing where PHP runs"],"weakness:w-maintainer-capacity":["weakness","A small, thinly funded maintainer team at the base of the web"],"weakness:w-signal":["weakness","Exploitation that cannot yet be seen"],"weakness:w-stale-globals":["weakness","Request globals that survive a failed request"],"weakness:w-status-words":["weakness","A status word chosen by the agent that wrote the claim"],"weakness:w-untrusted-text":["weakness","Third-party text inside the agents' context"],"weakness:w-waf-only":["weakness","A filter in front of an unpatched engine"]},"unchanged":["0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.10.8","0.10.9","0.10.10","0.10.11","0.10.12","0.10.14","0.10.15","0.10.16","0.10.17","0.10.18","0.10.19","0.10.20","0.10.21","0.10.22","0.10.23","0.10.24","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.12.0","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.14.5","0.14.6","0.14.7","0.14.8","0.14.9","0.14.10","0.14.11","0.14.12","0.14.13","0.14.14","0.14.15","0.14.16","0.14.17","0.14.18","0.14.19","0.14.20","0.14.22","0.14.24","0.14.26","0.14.29","0.14.31","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.15.10","0.15.11","0.15.12","0.15.13","0.15.14","0.15.15","0.15.16","0.15.17","0.15.18","0.15.20","0.15.21","0.16.0","0.16.1","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.18.0"]}