# Fact: On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · leak · reported

# On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked

**Who says it:** PHP Foundation · **Sources:** [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) [PHP Foundation](../../sources/phpfoundation-blog-security-release-leak/index.html)

Primary party. The Foundation does not say who or where.

## Fact-check

**A2** Reported●●○○○○ disputed · Event · verdict: **holds in part**

The Foundation states every element. The time and the CVE IDs circulating are corroborated independently (Equixly: Hacker News post 'about 15:20'; Huntress and CybelAngel: 'morning of October 20', which fits 15:00 UTC as US morning). 'No technical details leaked' is disputed: Daubois (PHP security team) describes a leaked tool screenshot and an exploitation video, and The Hacker News says a PoC leaked. The two Foundation slugs are the same page captured twice, not two sources.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | carries | *On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media.* | a1be057adc1c5bfa |
| [phpfoundation-blog-security-release-leak](../../sources/phpfoundation-blog-security-release-leak/index.html) | carries | *They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.* | b9f29cfdc1c0cd65 |
| [equixly-php2shell-what-we-know](../../sources/equixly-php2shell-what-we-know/index.html) | partial | *Oct 20, about 15:20 A Hacker News post announces two upcoming PHP RCE CVEs; the post is later removed* | 34bf72d02f14deb9 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | partial | *On the morning of October 20, a post on Hacker News claimed that two critical PHP vulnerabilities were headed for public disclosure.* | a83d744768109a61 |
| [daubois-blog-php2shell-rumors](../../sources/daubois-blog-php2shell-rumors/index.html) | partial | *A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down* | 5ef17f9886aa93f7 |

Open tickets: [Contradiction-9](../../factcheck/index.html#Contradiction-9), [Finding-78](../../factcheck/index.html#Finding-78).

Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/phpfoundation-blog-security-release-leak/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:12 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisor
And on [every claim](../../claims/index.html#leak-cve-ids).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked
Who says it: PHP Foundation
Status: reported
Topic: leak
Sources: php-foundation-blog-security-release, phpfoundation-blog-security-release-leak
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/leak-cve-ids/index.html