The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTC

Fact-check

A6 Established●●●●●● · Record · verdict: holds in part

The git output in the vault carries every time in the claim: author date 2026-10-18T17:26:39+02:00 (15:26:39Z), committer date 2026-10-21T16:06:22+02:00 (14:06:22Z), and Ilija Tovilo's merges 8.2 into 8.3 at 14:12:35Z, 8.3 into 8.4 at 14:27:03Z, 8.4 into 8.5 at 14:30:04Z, plus 389 files, +10689, five authors. 'Entered the public branches at 14:06' reads a committer timestamp as a push time, which git does not record.

Open tickets: Finding-41, Finding-69.

Graded in Run-1, resting on captures up to 2026-10-22 11:22 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-18 15:26 UTCphp/php-src, read from a clone publishes Commit 3584a98bd: Avoid state corruption via bailout (the php2shell fix) and the PHP-7.4 backport 712e60f9e
2. 2026-10-21 14:06 UTCphp-src publishes Release PHP 8.5.12
3. 2026-10-22 08:15 UTCSaved into the evidence vault: php-src
4. 2026-10-22Enters this site as confirmed in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTC
Who says it: php/php-src commit 3584a98bd, read from a clone
Status: confirmed
Topic: timing
Sources: github-php-src-fix-commit-3584a98bd, github-php-src-tag-php-8.5.12