Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · leak · reported
Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs'
Calif's own page does not mention a leak or a deleted video; it embeds two demo videos. Whether one of them is the deleted video is unknown.
Fact-check
A3 Echoed●●●○○○ · Event · verdict: holds in part
The Foundation states it and the quoted phrase is verbatim; BBC, The Register, The Record and Feross echo the Foundation (one origin, A3). Daubois separately mentions a short exploitation video that went up and came down, without naming Calif. The time is uncertain: the Foundation's 'As a result of the leak and pre-announcement around 20:00 UTC' can attach '20:00 UTC' to the pre-announcement, which it puts at 19:30.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| php-foundation-blog-security-release | carries | As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published | a1be057adc1c5bfa |
| phpfoundation-blog-security-release-leak | carries | The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st. | b9f29cfdc1c0cd65 |
| bbc-live-ckgel5xp2xv9t | partial | According to PHP, researchers at Calif then "mistakenly published a video" showing some basic details of how the flaws could be used | c88b8c5f4c6bc07d |
| calif-php2shell | absent | nothing that carries it | 23afef81971778f9 |
| daubois-blog-php2shell-rumors | partial | a short exploitation video went up and came down the same way. | 5ef17f9886aa93f7 |
Open tickets: Contradiction-9, Finding-80, Finding-9.
Graded in Run-1, resting on captures up to 2026-10-22 11:32 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
- 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
- 2026-10-21Calif publishes php2shell by Calif Research — A tale of two PHP remote vulnerabilities
- 2026-10-22 06:16 UTCBBC News publishes PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
- 2026-10-22 08:12 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs' Who says it: PHP Foundation Status: reported Topic: leak Sources: php-foundation-blog-security-release, phpfoundation-blog-security-release-leak, bbc-live-ckgel5xp2xv9t, calif-php2shell