Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · leak · reported
The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down
Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault.
Fact-check
A2 Reported●●○○○○ disputed · Event · verdict: holds in part
The Hacker News post, its removal and the screenshots spreading are carried by Daubois and corroborated by Huntress, CybelAngel and Equixly (A4). 'Anonymous', 'citing a reliable source' and the screenshot 'credited to Calif.IO' are Daubois alone. Daubois says the screenshot 'leaked alongside the advisory', not that it came down; only the video 'went up and came down'.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| daubois-blog-php2shell-rumors | carries | An anonymous Hacker News post citing a reliable source went up on October 20 and came down, but screenshots of it had already reached | 5ef17f9886aa93f7 |
| huntress-php2shell-rapid-response | partial | The post was taken down, but not before screenshots made their way around social media. | a83d744768109a61 |
| cybelangel-php2shell | partial | The incident started with a leak. On the morning of 20 October, a since-removed Hacker News post claimed the two flaws | 4ffc5347bfe22fb4 |
| equixly-php2shell-what-we-know | partial | Sansec cites a leaked screenshot of an exploit tool named PHP2Shell, whose banner claims the tool works against PHP 5.4.0 and later. | 34bf72d02f14deb9 |
| thehackernews-php2shell-4days | partial | details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time | c1cb63141287484c |
Open tickets: Contradiction-9, Finding-79.
Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Daubois publishes What the PHP2Shell rumors got wrong, from inside the PHP security team
- 2026-10-22 08:12 UTCSaved into the evidence vault: Daubois
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Who says it: Alexandre Daubois (PHP security team, personal blog) Status: reported Topic: leak Sources: daubois-blog-php2shell-rumors