# Fact: Mitigation advice given to a few critical-infrastructure providers from about 23

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on 20 October may have leaked Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · leak · reported

# Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on 20 October may have leaked

**Who says it:** PHP Foundation · **Sources:** [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html)

## Fact-check

**A2** Reported●●○○○○ · Event · verdict: **holds**

The Foundation's own sentence carries every element, including its hedge 'may have leaked'. It is one party's self-report; The Register and SecurityWeek repeat it without new evidence.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | carries | *Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well.* | a1be057adc1c5bfa |

Graded in Run-1, resting on captures up to 2026-10-22 08:09 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisor
And on [every claim](../../claims/index.html#leak-mitigations).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on 20 October may have leaked
Who says it: PHP Foundation
Status: reported
Topic: leak
Sources: php-foundation-blog-security-release
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/leak-mitigations/index.html