# Fact: The fix was authored on 18 October at 15:26 UTC and entered the public branches 

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTC Who says it, its status (confirmed), its sources, and its timeline from publication to this site.

Fact · timing · confirmed

# The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTC

**Who says it:** php/php-src commit 3584a98bd, read from a clone · **Sources:** [php/php-src, read from a clone](../../sources/github-php-src-fix-commit-3584a98bd/index.html) [php-src](../../sources/github-php-src-tag-php-8.5.12/index.html)

Counted from the repository, not from a page. Five authors; 389 files; 10,689 insertions.

## Fact-check

**A6** Established●●●●●● · Record · verdict: **holds in part**

The git output in the vault carries every time in the claim: author date 2026-10-18T17:26:39+02:00 (15:26:39Z), committer date 2026-10-21T16:06:22+02:00 (14:06:22Z), and Ilija Tovilo's merges 8.2 into 8.3 at 14:12:35Z, 8.3 into 8.4 at 14:27:03Z, 8.4 into 8.5 at 14:30:04Z, plus 389 files, +10689, five authors. 'Entered the public branches at 14:06' reads a committer timestamp as a push time, which git does not record.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [github-php-src-fix-commit-3584a98bd](../../sources/github-php-src-fix-commit-3584a98bd/index.html) | carries | *author: Arnaud Le Blanc  2026-10-18T17:26:39+02:00* | 0d696e59634f83a4 |
| [github-php-src-fix-commit-3584a98bd](../../sources/github-php-src-fix-commit-3584a98bd/index.html) | carries | *389 files changed, 10689 insertions(+), 976 deletions(-)* | 0d696e59634f83a4 |
| [github-php-src-fix-commit-3584a98bd](../../sources/github-php-src-fix-commit-3584a98bd/index.html) | carries | *c1a5f468d09fc4afc5d738872d5b1d4e87ff1e39 2026-10-21T16:12:35+02:00 2026-10-21T16:12:35+02:00 Ilija Tovilo Merge branch 'PHP-8.2' into PHP-8.3* | 81c3025511c2f474 |
| [github-php-src-tag-php-8.5.12](../../sources/github-php-src-tag-php-8.5.12/index.html) | absent | *The PHP development team announces the immediate availability of PHP 8.5.12.* | 3fa0b4ca147ee066 |
| [daubois-blog-php2shell-rumors](../../sources/daubois-blog-php2shell-rumors/index.html) | partial | *Fix PR opened: 2026-09-25, final commit 01a40e89fbfc authored 2026-10-18* | 5ef17f9886aa93f7 |

Open tickets: [Finding-41](../../factcheck/index.html#Finding-41), [Finding-69](../../factcheck/index.html#Finding-69).

Graded in Run-1, resting on captures up to 2026-10-22 11:22 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-18 15:26 UTCphp/php-src, read from a clone publishes [Commit 3584a98bd: Avoid state corruption via bailout (the php2shell fix) and the PHP-7.4 backport 712e60f9e](../../sources/github-php-src-fix-commit-3584a98bd/index.html)
- 2026-10-21 14:06 UTCphp-src publishes [Release PHP 8.5.12](../../sources/github-php-src-tag-php-8.5.12/index.html)
- 2026-10-22 08:15 UTCSaved into the evidence vault: php-src
- 2026-10-22Enters this site as confirmed in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
TTaylorProject or programme managerRRowanJournalistBBlakeAnalyst or policy advisorAAveryCTO
And on [every claim](../../claims/index.html#fix-authored).

## Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · confirmed
```
The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTC
Who says it: php/php-src commit 3584a98bd, read from a clone
Status: confirmed
Topic: timing
Sources: github-php-src-fix-commit-3584a98bd, github-php-src-tag-php-8.5.12
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/fix-authored/index.html