{
 "about": "A review of the English Wikipedia article PHP2Shell, done the way a Wikipedia reviewer would, against this site's evidence: every finding names the statement, the policy or guideline it rests on, the captures in this site's evidence vault that bear on it, and a change in the shape Wikipedia asks for (specific, uncontroversial, necessary, sensible). Authored by the ontologist at the editor's request; the fact-check desk's grades are cited where they exist. Nothing here is posted to Wikipedia: Wikipedia's guideline of March 2026 prohibits content, comments and edit requests written by a language model, so these findings are for a human to read, check and, where they agree, put to the article's talk page in their own words, with a disclosed conflict of interest and the independent sources named, never citing this site.",
 "kept_by": "ontologist",
 "reviewed": "2026-10-25",
 "revision": 1381884195,
 "method": "The article's statements (admin/build/wikitext.py) set against the claims of this site that cite the same captured pages, the fact-check desk's grades (data/factcheck.json), the contradiction ledger and the timeline. A statement is matched by its opening words, so the finding survives a rewording elsewhere in the sentence.",
 "policies": {
  "WP:V": "Verifiability: a reliable source that directly supports the material; the burden is on the editor who adds it",
  "WP:BURDEN": "Unsourced material may be tagged {{citation needed}} or removed",
  "WP:SOURCESDIFFER": "When reliable sources disagree, attribute in the text: 'X says A, while Y says B'",
  "WP:NPOV": "Do not state seriously contested assertions as facts; indicate the relative prominence of views",
  "WP:DUE": "Represent viewpoints in proportion to their prominence in reliable sources",
  "MOS:WEASEL": "'it is estimated', 'was credited': unsupported attributions; say who",
  "WP:PRIMARY": "A primary source may be used for a straightforward, descriptive statement of fact anyone can verify",
  "WP:RSBREAKING": "Breaking-news reports are primary and often wrong; replace them with better-researched sources as they appear",
  "WP:SYNTH": "Do not join A and B to imply a conclusion C that neither source states",
  "WP:INTEGRITY": "The citation must directly support the material it sits beside"
 },
 "findings": [
  {"id": "R-01", "section": "lead", "starts": "The vulnerabilities are estimated to affect nearly 70% of websites", "kind": "correction", "strength": "high",
   "policy": ["WP:V", "WP:BURDEN", "MOS:WEASEL", "WP:NPOV"],
   "finding": "Uncited, and it states as a count of affected sites what is a usage share: W3Techs measures the share of websites with a known server-side language that use PHP (69.3% when the story broke); a patched site is not affected. The figure's one origin is Wiz, whose own post turned 'powers 70% of websites' into '70% of the Internet'; every outlet carrying it restates Wiz. The article's own Impact section already states the measure correctly and cites it.",
   "evidence": {"claims": ["scale-70pc-internet", "scale-70pc-websites"], "contradictions": ["K-001", "K-012"], "sources": ["wiz-blog-php2shell", "x-wiz-io-php2shell", "cloudflare-blog-php2shell-waf", "x-openai-php2shell"], "desk": "scale-70pc-internet: unverified; K-001 explained as one origin restated"},
   "change": "Replace with the Impact section's wording and citation: 'PHP is used by about 69% of websites whose server-side language is known (W3Techs)'; drop 'estimated to affect'. Reference: W3Techs' PHP usage page (not yet captured here, board 288)."},
  {"id": "R-02", "section": "discovery", "starts": "The vulnerabilities were independently discovered by two parties", "kind": "correction", "strength": "high",
   "policy": ["WP:V", "WP:PRIMARY", "WP:DUE"],
   "finding": "The primary record credits four reporters, not two: the GitHub security advisories name lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion. The PHP Foundation's account says OpenAI reported the same root cause on 11 August, and Chainguard's CEO has said his team found the bugs independently with an AI harness. 'Two parties' is the account of two newspapers, against the project's own credits.",
   "evidence": {"claims": ["four-reporters", "who-first", "openai-same-day", "lorenc-ai-found"], "sources": ["github-ghsa-w8hw-w9fx-j79w", "github-ghsa-6wmf-4rv5-p3rp", "php-foundation-blog-security-release", "theregister-php-blames-chainguard"], "desk": "four-reporters: holds, A6; who-first: holds in part, A3; openai-same-day: holds, A2, disputed"},
   "change": "Say the advisories credit four reporters (name them as the advisories do), that Calif reported first (11 August, per the Foundation), and that OpenAI and Wiz reported independently; cite the two GitHub advisories as the primary record for the credits, and the Foundation's post for the dates."},
  {"id": "R-03", "section": "discovery", "starts": "A PHP core developer discovered the out-of-memory error", "kind": "correction", "strength": "medium",
   "policy": ["WP:V", "WP:SOURCESDIFFER"],
   "finding": "The PHP Foundation attributes the 2024 finding of the out-of-memory issue to a security audit by Quarkslab, funded through OSTIF and the Sovereign Tech Agency, and says exploitation was not thought feasible then; Quarkslab's published summary lists 27 findings with two redacted. 'A PHP core developer' is The Next Web's paraphrase. The two accounts can both be given, attributed.",
   "evidence": {"claims": ["quarkslab-2024", "quarkslab-redacted"], "sources": ["php-foundation-blog-security-release", "quarkslab-blog-php-src-audit"], "desk": "quarkslab-2024: holds in part, A2; quarkslab-redacted: holds, A6"},
   "change": "Attribute: 'According to the PHP Foundation, the out-of-memory issue was found in a 2024 security audit by Quarkslab, funded by OSTIF and the Sovereign Tech Agency, and left unfixed because an exploit was not thought feasible'; cite the Foundation's post and Quarkslab's summary."},
  {"id": "R-04", "section": "discovery", "starts": "The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0", "kind": "correction", "strength": "medium",
   "policy": ["WP:V", "WP:DUE", "WP:RSBREAKING"],
   "finding": "The official scores are 9.2 (CVSS 4.0, by the PHP security team as the CVE numbering authority) and 9.8 (CVSS 3.1, by NIST, which disagrees on one input: attack complexity). The 10.0 was the figure that circulated in the leak on 20 October, before publication, which Alexandre Daubois of the PHP security team describes as wrong; presenting it as watchTowr's rating gives a leaked, retracted number the standing of an assessment.",
   "evidence": {"claims": ["cvss-10", "two-cves-9.2", "ac-high"], "contradictions": ["K-007"], "sources": ["cve-cve-2026-109618", "cve-cve-2026-109619", "nvd-cve-2026-109618", "daubois-blog-php2shell-rumors"], "desk": "cvss-10: refuted, A0; two-cves-9.2: holds, A6; K-007 explained"},
   "change": "State the two official scores with their scales and scorers ('9.2 under CVSS 4.0 by the PHP security team; 9.8 under CVSS 3.1 by NIST, which rated the attack complexity low') and, if the leak is mentioned, that a score of 10.0 circulated before publication and was wrong; cite the CVE records and NVD."},
  {"id": "R-05", "section": "lead", "starts": "PHP2Shell is a pair of high-impact computer vulnerabilities", "kind": "attribution", "strength": "medium",
   "policy": ["WP:SOURCESDIFFER", "WP:V"],
   "finding": "'PHP versions 5.4–8.5' is one framing (Wiz, Cloudflare). The CVE records list only the supported branches 8.2 to 8.5; the PHP project published source patches for 7.4 to 8.1; CERT-FR lists 5.x, 6.x, 7.x, 8.0 and 8.1 as affected; NCSC-NL's inventory tracks 674 products. Affected, supported and patched are three lists, and a talk-page thread asks exactly this ('Is PHP 5.3 affected or excluded?').",
   "evidence": {"claims": ["versions-old", "two-cves-9.2", "scale-ncsc-nl"], "contradictions": ["K-003"], "sources": ["cve-cve-2026-109618", "certfr-2026-ale-014", "php-net-advisory", "cloudflare-blog-php2shell-waf", "ncsc-nl-php2shell"], "desk": "versions-old: holds in part, A3, disputed; K-003 explained"},
   "change": "Qualify the range: 'affecting supported PHP versions 8.2 to 8.5 (with source patches for 7.4 to 8.1); Wiz and Cloudflare report versions as early as 5.4 are affected'; cite the CVE records for the supported list and CERT-FR for the older branches. This also answers the talk-page question."},
  {"id": "R-06", "section": "patches", "starts": "Proof-of-concept exploits, write-ups, and partial mitigations started circulating", "kind": "attribution", "strength": "medium",
   "policy": ["WP:NPOV", "WP:SYNTH", "WP:SOURCESDIFFER"],
   "finding": "That Chainguard's early images 'allowed attackers to determine what code had been changed' is the PHP Foundation's account; Chainguard's CEO accepts the time and denies leaking, and proof-of-concept material was already circulating from the leaked video on 20 October, before the images. Stated in Wikipedia's voice, a contested causal claim reads as fact.",
   "evidence": {"claims": ["chainguard", "leak-video", "lorenc-ai-found"], "sources": ["php-foundation-blog-security-release", "x-feross-chainguard", "theregister-php-blames-chainguard"], "desk": "chainguard: holds in part, A3, disputed"},
   "change": "Attribute both sides: 'The PHP Foundation said Chainguard's publication of patched images at 07:41 UTC, before the coordinated release, let others see what had changed; Chainguard's chief executive, Dan Lorenc, accepted the timing and denied leaking.' Cite the Foundation's post and The Register."},
  {"id": "R-07", "section": "patches", "starts": "The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked", "kind": "missing", "strength": "medium",
   "policy": ["WP:DUE", "WP:V"],
   "finding": "The article does not say that the release itself was brought forward by a day because of the leak, from 22 October 14:00 UTC to 21 October 14:00 UTC, which the Foundation states and the pre-announcement implies; the sequence on 20 October (CVE ids circulating from about 15:00 UTC, the pre-announcement at 19:30 UTC, the video at about 20:00 UTC) is also available from captures.",
   "evidence": {"claims": ["release-moved", "preannounce-time", "leak-cve-ids", "leak-video"], "sources": ["php-foundation-blog-security-release", "php-net-advisory", "openwall-oss-security-2026-10-20-34"], "desk": "release-moved: holds, A4; preannounce-time: holds, A2, disputed"},
   "change": "Add: 'The release, planned for 22 October, was brought forward to 21 October 14:00 UTC after the leak'; cite the Foundation's post."},
  {"id": "R-08", "section": "impact", "starts": "Following advice from CERT-EU and the British National Cyber Security Centre", "kind": "attribution", "strength": "medium",
   "policy": ["WP:SOURCESDIFFER", "WP:INTEGRITY"],
   "finding": "The agencies' advice differed and the sentence folds it into one: the UK NCSC said to 'consider taking the system offline' where immediate remediation is not feasible; CERT-EU advised isolating internet-facing applications; the NSA and CISA said take systems offline if you cannot update. The fact-check desk found the BBC's own line attributes the offline advice to the NCSC alone. Which organisations acted on which advice is mostly not stated by the sources.",
   "evidence": {"claims": ["offline-ncsc", "offline-allies", "offline-nsa", "offline-cisa", "nl-offline", "fi-offline"], "sources": ["ncsc-news-php", "certeu-sa-2026-018", "nsa-press-php-4630238", "cisa-alert-php-20261021", "fi-valtori"], "desk": "offline-allies: holds in part, A1, contradicted as worded on this site; offline-ncsc: holds in part, A3"},
   "change": "Quote each agency's advice in its own words with its own citation (the four captures above carry them), and say organisations 'took sites offline as a precaution' without implying a single instruction."},
  {"id": "R-09", "section": "patches", "starts": "Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October", "kind": "check", "strength": "low",
   "policy": ["WP:RSBREAKING", "WP:V"],
   "finding": "Amazon has revised the sentence of its post that this rests on; the fact-check desk marks the site's own claim 'superseded' and is waiting for the revised page to be captured. The attempt was from an anonymisation network against Amazon's own sensors, which Amazon's post says; 'four days before public disclosure' is Amazon's framing.",
   "evidence": {"claims": ["amazon-honeypot", "probing"], "contradictions": ["K-002"], "sources": ["aws-security-blog-madpot"], "desk": "amazon-honeypot: holds in part, A2, superseded"},
   "change": "Re-check the sentence against Amazon's current post and date it ('as Amazon reported on 22 October'); no change proposed until the revised page is read."},
  {"id": "R-10", "section": "impact", "starts": "The potential impacts of the vulnerability were widespread", "kind": "style", "strength": "low",
   "policy": ["WP:BURDEN", "MOS:WEASEL"],
   "finding": "Uncited and vague; the section's own cited sentences carry the point.", "evidence": {}, "change": "Remove, or tag {{citation needed}}."},
  {"id": "R-11", "section": "analysis", "starts": "Czech volunteer Ondřej Surý was credited with playing a crucial role", "kind": "style", "strength": "low",
   "policy": ["MOS:WEASEL"], "finding": "'Was credited' by whom: the cited piece is The Atlantic's.", "evidence": {}, "change": "'The Atlantic credited Ondřej Surý with ...' (attributed in text)."},
  {"id": "R-12", "section": "lead", "starts": "PHP is a popular programming language", "kind": "style", "strength": "low",
   "policy": ["WP:BURDEN"], "finding": "Uncited; the Impact section's W3Techs sentence supports it.", "evidence": {}, "change": "Cite the same W3Techs reference, or let the wikilink to PHP carry it."},
  {"id": "R-13", "section": "patches", "starts": "Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC", "kind": "confirmation", "strength": "confirmed",
   "policy": ["WP:V"], "finding": "This site's timeline, read from the captured advisories and tags, gives 13:34:13 UTC and 13:34:25 UTC for the two advisories, the signed tags at 13:35:38 UTC, the planned release 14:00 UTC: the sentence holds exactly.",
   "evidence": {"claims": ["release-time"], "sources": ["github-ghsa-w8hw-w9fx-j79w", "github-ghsa-6wmf-4rv5-p3rp", "github-php-src-tags"], "desk": "release-time: holds in part, A2, disputed (on the planned time, not the advisories' time)"}, "change": "None."},
  {"id": "R-14", "section": "patches", "starts": "Security firm watchTowr said it had observed exploitation in the wild by 21 October", "kind": "confirmation", "strength": "confirmed",
   "policy": ["WP:NPOV", "WP:SOURCESDIFFER"], "finding": "Both sides attributed in the text with their own sources: the model of how this site's contradiction K-002 reads (attempts against sensors versus observed exploitation of real systems).",
   "evidence": {"claims": ["watchtowr-itw", "cisa-none"], "contradictions": ["K-002"], "sources": ["watchtowr-php2shell-faq", "cisa-alert-php-20261021"], "desk": "watchtowr-itw: holds, A6; cisa-none: holds, A6"}, "change": "None; CISA's KEV catalogue still lists neither CVE, which could be added with a date."},
  {"id": "R-15", "section": "impact", "starts": "Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP", "kind": "confirmation", "strength": "confirmed",
   "policy": ["WP:V"], "finding": "The measure stated as W3Techs states it: the share of websites with a known server-side language. This is the sentence the lead should use (R-01).", "evidence": {"contradictions": ["K-001", "K-012"]}, "change": "None."}
 ],
 "talk": [
  {"thread": "clarification-on-affected-versions-is-ph", "question": "Is PHP 5.3 affected or excluded?", "what_this_site_holds": "Affected, supported and patched are three lists (K-003): the CVE records list 8.2 to 8.5; source patches cover 7.4 to 8.1; CERT-FR names 5.x, 6.x, 7.x, 8.0 and 8.1; Cloudflare and Wiz say 'as early as 5.4'. No captured source states 5.3 either way.", "sources": ["cve-cve-2026-109618", "certfr-2026-ale-014", "php-net-advisory", "cloudflare-blog-php2shell-waf"]},
  {"thread": "is-the-attack-still-ongoing", "question": "Is the attack still ongoing?", "what_this_site_holds": "Exploitation attempts are reported in the millions (Cloudflare, Amazon, ELLIO, CERT.LV); as of 16:05 UTC on 24 October no named organisation has said it was compromised through php2shell, and neither CVE is in CISA's KEV catalogue (data/compromise.json, 33 rows).", "sources": ["cloudflare-blog-php2shell-waf", "aws-security-blog-madpot", "cisa-kev-json", "certlv-php-preventive"]},
  {"thread": "diagram-explaining-the-attack", "question": "A diagram explaining the attack", "what_this_site_holds": "The code-review map of the fix (the flaws, the design of the patch, the files changed) is drawn by a script from the fix commit's diff, under CC BY 4.0; a human could offer it, since Wikipedia's rule on original images excludes images wholly generated by AI but not drawings built by code from a published diff. Any upload and its licensing would be the human contributor's.", "sources": ["github-php-src-fix-commit-3584a98bd"]}
 ],
 "missing_from_the_article": ["cisa-none", "scale-ncsc-nl", "latvia-offline", "scale-latvia", "release-moved", "waf-nine-hours", "kev-precedent", "quarkslab-2024"],
 "not_held_here": "26 of the article's 42 references are not captured in the vault (board 288); findings above rest only on captured pages."
}