# Fact: The leak started with an anonymous Hacker News post citing a reliable source, wh

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · leak · reported

# The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down

**Who says it:** Alexandre Daubois (PHP security team, personal blog) · **Sources:** [Daubois](../../sources/daubois-blog-php2shell-rumors/index.html)

Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault.

## Fact-check

**A2** Reported●●○○○○ disputed · Event · verdict: **holds in part**

The Hacker News post, its removal and the screenshots spreading are carried by Daubois and corroborated by Huntress, CybelAngel and Equixly (A4). 'Anonymous', 'citing a reliable source' and the screenshot 'credited to Calif.IO' are Daubois alone. Daubois says the screenshot 'leaked alongside the advisory', not that it came down; only the video 'went up and came down'.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [daubois-blog-php2shell-rumors](../../sources/daubois-blog-php2shell-rumors/index.html) | carries | *An anonymous Hacker News post citing a reliable source went up on October 20 and came down, but screenshots of it had already reached* | 5ef17f9886aa93f7 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | partial | *The post was taken down, but not before screenshots made their way around social media.* | a83d744768109a61 |
| [cybelangel-php2shell](../../sources/cybelangel-php2shell/index.html) | partial | *The incident started with a leak. On the morning of 20 October, a since-removed Hacker News post claimed the two flaws* | 4ffc5347bfe22fb4 |
| [equixly-php2shell-what-we-know](../../sources/equixly-php2shell-what-we-know/index.html) | partial | *Sansec cites a leaked screenshot of an exploit tool named PHP2Shell, whose banner claims the tool works against PHP 5.4.0 and later.* | 34bf72d02f14deb9 |
| [thehackernews-php2shell-4days](../../sources/thehackernews-php2shell-4days/index.html) | partial | *details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time* | c1cb63141287484c |

Open tickets: [Contradiction-9](../../factcheck/index.html#Contradiction-9), [Finding-79](../../factcheck/index.html#Finding-79).

Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Daubois publishes [What the PHP2Shell rumors got wrong, from inside the PHP security team](../../sources/daubois-blog-php2shell-rumors/index.html)
- 2026-10-22 08:12 UTCSaved into the evidence vault: Daubois
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisor
And on [every claim](../../claims/index.html#leak-hn).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down
Who says it: Alexandre Daubois (PHP security team, personal blog)
Status: reported
Topic: leak
Sources: daubois-blog-php2shell-rumors
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/leak-hn/index.html