# Fact: Calif mistakenly published a video around 20:00 UTC on 20 October showing its pr

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs' Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · leak · reported

# Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs'

**Who says it:** PHP Foundation · **Sources:** [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) [PHP Foundation](../../sources/phpfoundation-blog-security-release-leak/index.html) [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html) [Calif](../../sources/calif-php2shell/index.html)

Calif's own page does not mention a leak or a deleted video; it embeds two demo videos. Whether one of them is the deleted video is unknown.

## Fact-check

**A3** Echoed●●●○○○ · Event · verdict: **holds in part**

The Foundation states it and the quoted phrase is verbatim; BBC, The Register, The Record and Feross echo the Foundation (one origin, A3). Daubois separately mentions a short exploitation video that went up and came down, without naming Calif. The time is uncertain: the Foundation's 'As a result of the leak and pre-announcement around 20:00 UTC' can attach '20:00 UTC' to the pre-announcement, which it puts at 19:30.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | carries | *As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published* | a1be057adc1c5bfa |
| [phpfoundation-blog-security-release-leak](../../sources/phpfoundation-blog-security-release-leak/index.html) | carries | *The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.* | b9f29cfdc1c0cd65 |
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | partial | *According to PHP, researchers at Calif then "mistakenly published a video" showing some basic details of how the flaws could be used* | c88b8c5f4c6bc07d |
| [calif-php2shell](../../sources/calif-php2shell/index.html) | absent | *nothing that carries it* | 23afef81971778f9 |
| [daubois-blog-php2shell-rumors](../../sources/daubois-blog-php2shell-rumors/index.html) | partial | *a short exploitation video went up and came down the same way.* | 5ef17f9886aa93f7 |

Open tickets: [Contradiction-9](../../factcheck/index.html#Contradiction-9), [Finding-80](../../factcheck/index.html#Finding-80), [Finding-9](../../factcheck/index.html#Finding-9).

Graded in Run-1, resting on captures up to 2026-10-22 11:32 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/phpfoundation-blog-security-release-leak/index.html)
- 2026-10-21Calif publishes [php2shell by Calif Research — A tale of two PHP remote vulnerabilities](../../sources/calif-php2shell/index.html)
- 2026-10-22 06:16 UTCBBC News publishes [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](../../sources/bbc-live-ckgel5xp2xv9t/index.html)
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
- 2026-10-22 08:12 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisor
And on [every claim](../../claims/index.html#leak-video).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs'
Who says it: PHP Foundation
Status: reported
Topic: leak
Sources: php-foundation-blog-security-release, phpfoundation-blog-security-release-leak, bbc-live-ckgel5xp2xv9t, calif-php2shell
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/leak-video/index.html