Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · leak · reported
On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked
Primary party. The Foundation does not say who or where.
Fact-check
A2 Reported●●○○○○ disputed · Event · verdict: holds in part
The Foundation states every element. The time and the CVE IDs circulating are corroborated independently (Equixly: Hacker News post 'about 15:20'; Huntress and CybelAngel: 'morning of October 20', which fits 15:00 UTC as US morning). 'No technical details leaked' is disputed: Daubois (PHP security team) describes a leaked tool screenshot and an exploitation video, and The Hacker News says a PoC leaked. The two Foundation slugs are the same page captured twice, not two sources.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| php-foundation-blog-security-release | carries | On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. | a1be057adc1c5bfa |
| phpfoundation-blog-security-release-leak | carries | They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. | b9f29cfdc1c0cd65 |
| equixly-php2shell-what-we-know | partial | Oct 20, about 15:20 A Hacker News post announces two upcoming PHP RCE CVEs; the post is later removed | 34bf72d02f14deb9 |
| huntress-php2shell-rapid-response | partial | On the morning of October 20, a post on Hacker News claimed that two critical PHP vulnerabilities were headed for public disclosure. | a83d744768109a61 |
| daubois-blog-php2shell-rumors | partial | A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down | 5ef17f9886aa93f7 |
Open tickets: Contradiction-9, Finding-78.
Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
- 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:12 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked Who says it: PHP Foundation Status: reported Topic: leak Sources: php-foundation-blog-security-release, phpfoundation-blog-security-release-leak