Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · timing · contradicted
The flaws were disclosed on 22 October 2026
Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z.
Fact-check
refuted measures differently · Event · verdict: refuted
The primary records date the disclosure to 21 October UTC: GHSA published 13:34:25Z, tags 13:35:38 UTC, CVE records 13:48:34Z and 13:54:43Z, GitHub release 14:06:46Z, php.net '21 Oct 2026'. '22 October' is only right in Australian or Japanese local time (ACSC: 0100 AEDT on 22 October). The BBC capture never states a disclosure date, so the attribution to the BBC is not carried.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| bbc-live-ckgel5xp2xv9t | absent | Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement | c88b8c5f4c6bc07d |
| php-net-advisory | carries | It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. | df0b1bba3deae282 |
| github-php-src-tag-php-8.5.12 | carries | datetime="2026-10-21T14:06:46Z" | 330630ed887249f6 |
| github-ghsa-w8hw-w9fx-j79w | carries | datetime="2026-10-21T13:34:25Z" | 79647ef8c491692c |
| github-php-src-tags | carries | datetime="2026-10-21 13:35:38 UTC" | ca0a96e8466a3479 |
| cve-cve-2026-109618 | carries | "datePublished":"2026-10-21T13:48:34.845Z" | f856138e139c216e |
| acsc-alert-php | partial | with full details publicly announced on Thursday 22 October 2026 at 0100 AEDT. | 9370af142ded6de9 |
| x-wiz-io-php2shell | partial | Apply the Oct 22 security release immediately | 6c17977662815b0c |
Open tickets: Finding-38, Finding-66.
Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21php.net publishes Security advisory: Critical remote code execution vulnerabilities, update now
- 2026-10-21 14:06 UTCphp-src publishes Release PHP 8.5.12
- 2026-10-22 06:16 UTCBBC News publishes PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:09 UTCSaved into the evidence vault: php.net
- 2026-10-22 08:15 UTCSaved into the evidence vault: php-src
- 2026-10-22Enters this site as contradicted in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · contradicted
The flaws were disclosed on 22 October 2026 Who says it: BBC framing (UK morning coverage) Status: contradicted Topic: timing Sources: bbc-live-ckgel5xp2xv9t, php-net-advisory, github-php-src-tag-php-8.5.12