# Fact: Quarkslab's published audit summary lists 27 findings, two redacted because thei

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · discovery · reported

# Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding

**Who says it:** Quarkslab's blog; a Substack analysis · **Sources:** [Quarkslab](../../sources/quarkslab-blog-php-src-audit/index.html) [David Lopez-Kurtz](../../sources/substack-lopezkurtz-patch-is-the-exploit/index.html)

The Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself.

## Fact-check

**A6** Established●●●●●● · Count · verdict: **holds** · the status word understates the evidence

Counted from the captured Quarkslab page: 2 high, 6 medium, 9 low and 10 informative issues (27 rows), with HIGH-1 and MED-2 redacted and the stated reason 'Fixes are complex and in progress.' No row describes an out-of-memory finding. The Substack piece says the same. The Foundation note is carried.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [quarkslab-blog-php-src-audit](../../sources/quarkslab-blog-php-src-audit/index.html) | carries | *two security issues currently redacted while PHP maintainers are actively working on the fixes. Details will be provided after fixes are applied* | cd5ccdaf99da0be1 |
| [substack-lopezkurtz-patch-is-the-exploit](../../sources/substack-lopezkurtz-patch-is-the-exploit/index.html) | carries | *lists 27 findings, two of them redacted because their fixes were “complex and in progress”; it does not describe an out-of-memory finding.* | cb3714dc12f96c96 |
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | carries | *While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem* | a1be057adc1c5bfa |

Open tickets: [Finding-95](../../factcheck/index.html#Finding-95).

Graded in Run-1, resting on captures up to 2026-10-22 11:31 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2025-04-10Quarkslab publishes [Security audit of PHP-SRC - Quarkslab's blog](../../sources/quarkslab-blog-php-src-audit/index.html)
- 2026-10-22 11:30 UTCSaved into the evidence vault: Quarkslab
- 2026-10-22 11:31 UTCSaved into the evidence vault: David Lopez-Kurtz
- 2026-10-22Enters this site as reported in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisorRRileyCommunications team
And on [every claim](../../claims/index.html#quarkslab-redacted).

## Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · reported
```
Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding
Who says it: Quarkslab's blog; a Substack analysis
Status: reported
Topic: discovery
Sources: quarkslab-blog-php-src-audit, substack-lopezkurtz-patch-is-the-exploit
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/quarkslab-redacted/index.html