{
 "about": "The corrections this site has asked other publishers to make, kept by liaison@php.newsroom (brief: admin/content/briefs/2026-10-22__brief__the-corrections-liaison.md; desk: admin/liaison/README.md). Every request starts from a fact-check finding or contradiction in data/factcheck.json, quotes the publisher only from a capture in the evidence vault, and is on this site before any message is sent. The editor sends each request personally, from the email drafted under it (the editor's decision, 24 October 2026); no agent writes to a publisher.",
 "kept_by": "liaison",
 "statuses": [
  {
   "id": "drafted",
   "means": "Written from a fact-check record; not yet read by the editor"
  },
  {
   "id": "blocked",
   "means": "Waits on something named in blocked_by: usually an open finding against this site's own wording on the same point"
  },
  {
   "id": "approved",
   "means": "The editor has read it and said it may go; not sent"
  },
  {
   "id": "sent",
   "means": "The mail agent sent it to the publisher's corrections channel; the log has the time"
  },
  {
   "id": "acknowledged",
   "means": "The publisher replied without a change yet"
  },
  {
   "id": "corrected",
   "means": "The publisher changed the text; a new capture shows it"
  },
  {
   "id": "declined",
   "means": "The publisher answered and kept the text; their reason is recorded"
  },
  {
   "id": "no-reply",
   "means": "Fourteen days after sending, no answer; nothing more is sent"
  }
 ],
 "requests": [
  {
   "id": "R-001",
   "publisher": "Wiz (Wiz Research)",
   "actor": "wiz",
   "role": "origin",
   "point": "The headline says the flaws affect 70% of the Internet; the post's own body says PHP powers 70% of all websites.",
   "said": [
    {
     "source": "wiz-blog-php2shell",
     "where": "blog headline",
     "words": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet",
     "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt",
     "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea",
     "quote_checked": true
    },
    {
     "source": "wiz-blog-php2shell",
     "where": "blog body",
     "words": "a popular general-purpose scripting language that powers 70% of all websites in the world.",
     "file": "sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt",
     "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea",
     "quote_checked": true
    },
    {
     "source": "x-wiz-io-php2shell",
     "where": "post on X",
     "words": "a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.",
     "file": "sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt",
     "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809",
     "quote_checked": true
    }
   ],
   "evidence": "The 70% is the usual web-technology survey figure: the share of websites whose server-side language is known that use PHP (Cloudflare links it to W3Techs; Tenable and Imperva name W3Techs, at 69.3% and over 69%). It is a share of websites, not of hosts, traffic or the Internet, and it counts sites that use PHP at all, not installations running an affected version. Every outlet in our evidence vault that carries the figure traces back to this post.",
   "suggested": "PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP, the language behind about 70% of websites whose server-side language is known",
   "factcheck": {
    "contradiction": "K-001",
    "claims": [
     "scale-70pc-internet",
     "scale-70pc-websites"
    ],
    "tickets": [
     "Contradiction-1"
    ]
   },
   "channel": {
    "kind": "to find",
    "note": "Wiz's published press or research contact, from its own site; captured before use"
   },
   "blocked_by": [],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-22",
     "event": "drafted from contradiction K-001 (fact-check run 1); blocked until this site's own claim stops dropping the survey's population (Finding-33) and stops attributing 'roughly' to Wiz (Finding-102)"
    },
    {
     "at": "2026-10-24",
     "event": "unblocked: this site's own wording fixed in data/claims.json and the front page (Finding-33, Finding-102), by desk@php.newsroom on the editor's instruction; the fact-check desk to confirm at its next run. Ready for the editor to send."
    }
   ]
  },
  {
   "id": "R-002",
   "publisher": "BBC News",
   "actor": "bbc",
   "role": "echo",
   "point": "The live page puts \"roughly 70%\" in quotation marks as Wiz's estimate; Wiz's own words have no \"roughly\", and the 70% is a share of websites using PHP, not a measure of how much of the internet is affected.",
   "said": [
    {
     "source": "bbc-live-ckgel5xp2xv9t",
     "where": "live page entry",
     "words": "with cyber-security firm Wiz estimating that \"roughly 70%\" of the internet is affected, though the BBC is unable to independently verify that figure.",
     "file": "sources/bbc-live-ckgel5xp2xv9t/captures/20261022T080559Z/text.txt",
     "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d",
     "quote_checked": true
    }
   ],
   "evidence": "The words in quotation marks are not in either capture of Wiz's own words: the blog headline and the X post say '70% of the Internet', the blog body says '70% of all websites in the world'. The figure itself is a survey's share of websites whose server-side language is known that use PHP, not a share of the internet affected. The BBC's own caveat, that it could not verify the figure, is right and is kept in the suggestion.",
   "suggested": "with cyber-security firm Wiz saying the flaws affect \"70% of the Internet\", a figure that matches surveys of how many websites use PHP rather than a count of vulnerable systems, and that the BBC has been unable to independently verify.",
   "factcheck": {
    "contradiction": "K-001",
    "claims": [
     "scale-70pc-internet"
    ],
    "tickets": [
     "Contradiction-1",
     "Finding-124"
    ]
   },
   "channel": {
    "kind": "to find",
    "note": "the BBC's published corrections and complaints route; captured before use"
   },
   "blocked_by": [
    "R-001"
   ],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-22",
     "event": "drafted from contradiction K-001 and Finding-124; waits for the origin (R-001) to be asked first, and for this site's own claim to stop repeating the BBC's 'roughly' (Finding-102)"
    },
    {
     "at": "2026-10-24",
     "event": "this site's 'roughly' fixed (Finding-102); ready, to send after R-001"
    }
   ],
   "origin": "R-001"
  },
  {
   "id": "R-003",
   "publisher": "CNN Business",
   "actor": null,
   "role": "echo",
   "point": "The headline says the flaw affects 70% of the internet; the article's own body gives the figure as the share of websites PHP powers.",
   "said": [
    {
     "source": "cnn-php2shell-websites-shut",
     "where": "headline",
     "words": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet",
     "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt",
     "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533",
     "quote_checked": true
    },
    {
     "source": "cnn-php2shell-websites-shut",
     "where": "body",
     "words": "a programming language that powers 70% of all websites in the world",
     "file": "sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt",
     "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533",
     "quote_checked": true
    }
   ],
   "evidence": "The same survey figure as R-001, restated from Wiz: a share of websites that use PHP, not a share of the internet affected. CNN's own body gives it correctly: PHP 'powers 70% of all websites in the world'.",
   "suggested": "Websites shut down globally after AI finds a critical flaw in PHP, the language behind about 70% of websites",
   "factcheck": {
    "contradiction": "K-001",
    "claims": [
     "scale-70pc-internet"
    ],
    "tickets": [
     "Contradiction-1"
    ]
   },
   "channel": {
    "kind": "to find",
    "note": "CNN's published corrections route; captured before use"
   },
   "blocked_by": [
    "R-001"
   ],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-22",
     "event": "drafted from contradiction K-001; the headline and body still to be checked in the 11:26 UTC capture"
    },
    {
     "at": "2026-10-24",
     "event": "headline and body checked character for character in the 11:26 UTC capture by desk@php.newsroom; ready, to send after R-001"
    }
   ],
   "origin": "R-001"
  },
  {
   "id": "R-004",
   "publisher": "Amazon Web Services (AWS Security Blog)",
   "actor": null,
   "role": "origin",
   "point": "The post says PHP2Shell \"is now being broadly exploited in the wild\"; the same post says it is unclear whether any of the attempts it saw would have succeeded. Readers, and WIRED's headline, take \"exploited\" to mean successful attacks.",
   "said": [
    {
     "source": "aws-security-blog-madpot",
     "where": "post",
     "words": "PHP2Shell is now being broadly exploited in the wild.",
     "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt",
     "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d",
     "quote_checked": true
    },
    {
     "source": "aws-security-blog-madpot",
     "where": "post, earlier",
     "words": "Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.",
     "file": "sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt",
     "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d",
     "quote_checked": true
    }
   ],
   "evidence": "AWS's sensors saw exploitation attempts, before and after the release; its own post leaves open whether any succeeded. The PHP Foundation told WIRED it knows of no successful remote code execution, CISA had not observed exploitation, and no named organisation has said it was compromised (this site's /compromise/ page). This is a request to clarify a word, not to change a finding.",
   "suggested": "PHP2Shell exploitation attempts are now widespread in the wild; whether any have succeeded against real systems is not yet known.",
   "factcheck": {
    "contradiction": "K-002",
    "claims": [
     "amazon-honeypot",
     "no-confirmed-compromise"
    ],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "the AWS Security Blog's published contact, captured before use"
   },
   "blocked_by": [],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom: the word 'exploited' in WIRED's headline is AWS's, so AWS is asked first"
    }
   ]
  },
  {
   "id": "R-005",
   "publisher": "WIRED",
   "actor": null,
   "role": "echo",
   "origin": "R-004",
   "point": "The headline says hackers exploited the flaws; the article's own sources (AWS, the PHP Foundation) describe attempts and know of no successful attack.",
   "said": [
    {
     "source": "wired-exploited-days-before-patched",
     "where": "headline",
     "words": "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched",
     "file": "sources/wired-exploited-days-before-patched/captures/20261023T012042Z/text.txt",
     "sha256": "d43b99af65d563ddd047c20c80d5318813eda28abd497763f91dd0a6ab8427cd",
     "quote_checked": true
    },
    {
     "source": "wired-exploited-days-before-patched",
     "where": "body, quoting the PHP Foundation",
     "words": "to our knowledge, there has been no successful attempt at remote code execution.",
     "file": "sources/wired-exploited-days-before-patched/captures/20261023T012042Z/text.txt",
     "sha256": "d43b99af65d563ddd047c20c80d5318813eda28abd497763f91dd0a6ab8427cd",
     "quote_checked": true
    }
   ],
   "evidence": "The body is careful: AWS 'logged attempts', and the PHP Foundation knows of 'no successful attempt at remote code execution'. Only the headline says exploited, following AWS's own wording (R-004).",
   "suggested": "Hackers Tried to Exploit the PHP Vulnerabilities Days Before They Were Patched",
   "factcheck": {
    "contradiction": "K-002",
    "claims": [
     "amazon-honeypot",
     "no-confirmed-compromise"
    ],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "WIRED's published corrections address, captured before use"
   },
   "blocked_by": [
    "R-004"
   ],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom, quotes checked; to send after R-004"
    }
   ],
   "date": "21 October 2026"
  },
  {
   "id": "R-006",
   "publisher": "BankInfoSecurity (ISMG)",
   "actor": null,
   "role": "origin",
   "point": "The headline says attackers exploit the flaws and that systems are under attack; on 21 October no source had shown a successful attack, and none has since.",
   "said": [
    {
     "source": "bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a",
     "where": "headline",
     "words": "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP",
     "file": "sources/bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a/captures/20261023T080331Z/text.txt",
     "sha256": "c0242ed45a367f748a8e597436b19a84a00c9199c5e0300ff98dfc94e55c43c3",
     "quote_checked": true
    }
   ],
   "evidence": "What was seen were attempts: CISA had not observed exploitation, the PHP Foundation knows of no successful remote code execution, and neither CVE is in CISA's catalogue of known exploited vulnerabilities as of this site's latest check.",
   "suggested": "Attackers Target Leaked Zero-Day Flaws in Widely Used PHP",
   "factcheck": {
    "contradiction": "K-002",
    "claims": [
     "no-confirmed-compromise"
    ],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "ISMG's published corrections route, captured before use"
   },
   "blocked_by": [],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom, quote checked"
    }
   ],
   "date": "21 October 2026"
  },
  {
   "id": "R-007",
   "publisher": "The Hacker News",
   "actor": null,
   "role": "origin",
   "point": "The article says a proof-of-concept exploit leaked ahead of the release; the PHP Foundation says no technical details leaked.",
   "said": [
    {
     "source": "thehackernews-php2shell-4days",
     "where": "body",
     "words": "details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time",
     "file": "sources/thehackernews-php2shell-4days/captures/20261022T081320Z/text.txt",
     "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4",
     "quote_checked": true
    }
   ],
   "evidence": "The PHP Foundation's post says no technical details leaked; no saved copy shows a leaked exploit. The fact-check desk holds this as an open contradiction (K-009), so the request waits until the desk settles it.",
   "suggested": "details about the CVE identifiers leaked ahead of time",
   "factcheck": {
    "contradiction": "K-009",
    "claims": [],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "The Hacker News's published contact, captured before use"
   },
   "blocked_by": [
    "K-009"
   ],
   "status": "blocked",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom; blocked while K-009 is open"
    }
   ]
  },
  {
   "id": "R-008",
   "publisher": "Fortune",
   "actor": null,
   "role": "echo",
   "origin": "R-001",
   "point": "The headline says the flaw could take down 70% of the internet; the 70% is the share of websites that use PHP, not a share of the internet that could go down.",
   "said": [
    {
     "source": "fortune-ai-tools-php-vulnerability",
     "where": "headline",
     "words": "AI tools discovered the PHP vulnerability that could take down 70% of the internet",
     "file": "sources/fortune-ai-tools-php-vulnerability/captures/20261023T012042Z/text.txt",
     "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808",
     "quote_checked": true
    }
   ],
   "evidence": "As R-001: the 70% is the usual survey figure for websites whose server-side language is known, restated from Wiz's headline. Nobody has measured how many sites are vulnerable, and the flaws let an attacker run code on a server, not take the internet down.",
   "suggested": "AI tools discovered a vulnerability in PHP, the language behind about 70% of websites",
   "factcheck": {
    "contradiction": "K-001",
    "claims": [
     "scale-70pc-internet",
     "scale-70pc-websites"
    ],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "Fortune's published corrections route, captured before use"
   },
   "blocked_by": [
    "R-001"
   ],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom, quote checked; to send after R-001"
    }
   ],
   "date": "21 October 2026"
  },
  {
   "id": "R-009",
   "publisher": "Clarín (English edition)",
   "actor": null,
   "role": "echo",
   "origin": "R-001",
   "point": "The headline says the flaw threatens 70% of the internet; the 70% is the share of websites that use PHP.",
   "said": [
    {
     "source": "clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv",
     "where": "headline",
     "words": "How AI uncovered a massive 14-year-old flaw threatening 70% of the internet",
     "file": "sources/clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/captures/20261023T080331Z/text.txt",
     "sha256": "c11dd717273bac9546aaf433f103637af20d579a0fb1ba06943929d81a70e82d",
     "quote_checked": true
    }
   ],
   "evidence": "As R-001: a survey's share of websites using PHP, restated from Wiz, not a measure of what is threatened.",
   "suggested": "How AI uncovered a 14-year-old flaw in PHP, the language behind about 70% of websites",
   "factcheck": {
    "contradiction": "K-001",
    "claims": [
     "scale-70pc-internet"
    ],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "Clarín's published corrections route, captured before use"
   },
   "blocked_by": [
    "R-001"
   ],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom, quote checked; to send after R-001"
    }
   ]
  },
  {
   "id": "R-010",
   "publisher": "Le Temps",
   "actor": null,
   "role": "origin",
   "point": "The headline says millions of sites were taken offline; no source counts more than a few dozen sites and a handful of government platforms.",
   "said": [
    {
     "source": "letemps-php-sites-debranches",
     "where": "headline",
     "words": "des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP",
     "file": "sources/letemps-php-sites-debranches/captures/20261022T081413Z/text.txt",
     "sha256": "4330f33c3b6763a95df44d21cfc602ec5f9bfd9df6141e863545c6a9a276cf4e",
     "quote_checked": true
    }
   ],
   "evidence": "This site holds ten reports of sites taken offline, some a single site and some a whole government's platform, and a community tracker lists about fifty sites that went dark and came back. Millions of sites run PHP; nothing shows millions were switched off.",
   "suggested": "des sites, dont des portails publics, sont débranchés par précaution à cause de failles majeures au cœur de PHP",
   "factcheck": {
    "contradiction": "K-006",
    "claims": [],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "Le Temps's published corrections route, captured before use"
   },
   "blocked_by": [],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom, quote checked; the request is in English, the suggested wording in French"
    }
   ]
  },
  {
   "id": "R-011",
   "publisher": "TechTarget Japan (ITmedia)",
   "actor": null,
   "role": "echo",
   "point": "The article says more than 22 million servers were put at risk, as a fact; the figure is one company's estimate of systems that could be vulnerable, with no published method.",
   "said": [
    {
     "source": "techtarget-itmedia-tt-article-2610-23-2000002526",
     "where": "summary",
     "words": "2200万台以上のサーバが危険にさらされた",
     "file": "sources/techtarget-itmedia-tt-article-2610-23-2000002526/captures/20261023T160435Z/text.txt",
     "sha256": "14c421632d9592d8a6b0b2bef1f45af7363175b91bd978cc453d73de9b51dbdb",
     "quote_checked": true
    }
   ],
   "evidence": "The 22.6 million is Palo Alto Networks Unit 42's count of systems that 'could be vulnerable', as relayed by Insurance Business; its method is not published. Censys, which does publish its method, counted 1.57 million unpatched hosts among the 1.58 million whose version it could read.",
   "suggested": "Palo Alto Networks Unit 42の推計では、最大2260万件のシステムが脆弱な可能性がある（算出方法は非公開）。",
   "factcheck": {
    "claims": [
     "scale-2.6m-hosts"
    ],
    "tickets": []
   },
   "channel": {
    "kind": "to find",
    "note": "ITmedia's published corrections route, captured before use"
   },
   "blocked_by": [],
   "status": "drafted",
   "log": [
    {
     "at": "2026-10-24",
     "event": "drafted by desk@php.newsroom, quote checked; the suggested wording in Japanese is the desk's translation, for a native reader to check before sending"
    }
   ],
   "date": "23 October 2026"
  }
 ],
 "quotes": {
  "about": "Where other publishers quote or cite this site. Empty until a collector captures the first one: a quote is listed only with the capture that carries it, never from a search result or a tip.",
  "items": []
 },
 "sender": "Dinis Cruz\nEditor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)",
 "not_asked": [
  {
   "publisher": "CRN",
   "source": "crn-news-security-2026-5-things-to-know-about-critical-php-vulne",
   "words": "With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated",
   "why": "CRN quotes Wiz's own words, attributed to Wiz. The request goes to Wiz (R-001)."
  },
  {
   "publisher": "Security.NL",
   "source": "securitynl-misbruik-gemeld",
   "words": "Misbruik van PHP2Shell-lek gemeld",
   "why": "The headline reports what security firms reported (watchTowr: 'exploitation in the wild'), and the body says plainly that it is unclear whether the attacks succeeded."
  },
  {
   "publisher": "Help Net Security",
   "source": "helpnetsecurity-2026-10-22-php2shell-scanner-tool",
   "words": "with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento",
   "why": "The researchers did confirm code execution against these applications in their own tests; 'exploitation' is ambiguous rather than wrong, and this site's own claim used the same words until 24 October."
  }
 ]
}