# Fact: The flaws were disclosed on 22 October 2026

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The flaws were disclosed on 22 October 2026 Who says it, its status (contradicted), its sources, and its timeline from publication to this site.

Fact · timing · contradicted

# The flaws were disclosed on 22 October 2026

**Who says it:** BBC framing (UK morning coverage) · **Sources:** [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html) [php.net](../../sources/php-net-advisory/index.html) [php-src](../../sources/github-php-src-tag-php-8.5.12/index.html)

Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z.

## Fact-check

refuted measures differently · Event · verdict: **refuted**

The primary records date the disclosure to 21 October UTC: GHSA published 13:34:25Z, tags 13:35:38 UTC, CVE records 13:48:34Z and 13:54:43Z, GitHub release 14:06:46Z, php.net '21 Oct 2026'. '22 October' is only right in Australian or Japanese local time (ACSC: 0100 AEDT on 22 October). The BBC capture never states a disclosure date, so the attribution to the BBC is not carried.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | absent | *Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement* | c88b8c5f4c6bc07d |
| [php-net-advisory](../../sources/php-net-advisory/index.html) | carries | *It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.* | df0b1bba3deae282 |
| [github-php-src-tag-php-8.5.12](../../sources/github-php-src-tag-php-8.5.12/index.html) | carries | *datetime="2026-10-21T14:06:46Z"* | 330630ed887249f6 |
| [github-ghsa-w8hw-w9fx-j79w](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html) | carries | *datetime="2026-10-21T13:34:25Z"* | 79647ef8c491692c |
| [github-php-src-tags](../../sources/github-php-src-tags/index.html) | carries | *datetime="2026-10-21 13:35:38 UTC"* | ca0a96e8466a3479 |
| [cve-cve-2026-109618](../../sources/cve-cve-2026-109618/index.html) | carries | *"datePublished":"2026-10-21T13:48:34.845Z"* | f856138e139c216e |
| [acsc-alert-php](../../sources/acsc-alert-php/index.html) | partial | *with full details publicly announced on Thursday 22 October 2026 at 0100 AEDT.* | 9370af142ded6de9 |
| [x-wiz-io-php2shell](../../sources/x-wiz-io-php2shell/index.html) | partial | *Apply the Oct 22 security release immediately* | 6c17977662815b0c |

Open tickets: [Finding-38](../../factcheck/index.html#Finding-38), [Finding-66](../../factcheck/index.html#Finding-66).

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21php.net publishes [Security advisory: Critical remote code execution vulnerabilities, update now](../../sources/php-net-advisory/index.html)
- 2026-10-21 14:06 UTCphp-src publishes [Release PHP 8.5.12](../../sources/github-php-src-tag-php-8.5.12/index.html)
- 2026-10-22 06:16 UTCBBC News publishes [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](../../sources/bbc-live-ckgel5xp2xv9t/index.html)
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:09 UTCSaved into the evidence vault: php.net
- 2026-10-22 08:15 UTCSaved into the evidence vault: php-src
- 2026-10-22Enters this site as contradicted in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
TTaylorProject or programme managerRRowanJournalistBBlakeAnalyst or policy advisorAAveryCTO
And on [every claim](../../claims/index.html#disclosure-22oct).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · contradicted
```
The flaws were disclosed on 22 October 2026
Who says it: BBC framing (UK morning coverage)
Status: contradicted
Topic: timing
Sources: bbc-live-ckgel5xp2xv9t, php-net-advisory, github-php-src-tag-php-8.5.12
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/disclosure-22oct/index.html