Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Fact · leak · confirmed

The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak

Who says it: PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release') · Sources: PHP Foundation oss-security Wiz on X php.net

The php.net ChangeLog still dates all four releases 22 October. Wiz's X thread still says 22 October.

Fact-check

A4 Corroborated measures differently status overstated · Event · verdict: holds · the status word overstates the evidence

The new time (21 October 14:00 UTC) is in the php.net pre-announcement relayed to oss-security (record). That the original date was 22 October is carried by the Foundation and indirectly by Wiz's thread and the php.net ChangeLog; that the move was because of the leak, by the Foundation and Daubois. The original hour '14:00 UTC' rests on the Foundation alone (echoed by The Hacker News), while watchTowr (via Daubois, Huntress, CybelAngel) put the embargo at Thursday 11am ET, which is 15:00 UTC.

Capture checkedResultWhat it sayssha256 of the text read
php-foundation-blog-security-releasecarriesIt also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.a1be057adc1c5bfa
openwall-oss-security-2026-10-20-34partial> It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.57b273733e7d5fe6
x-wiz-io-php2shellpartialPatch: Apply the Oct 22 security release immediately (the only complete remediation).6c17977662815b0c
php-net-changelog-8partial22 Oct 2026e39f8d2cb60ee8a5
huntress-php2shell-rapid-responsepartialThe team scheduled that release for Wednesday, October 21 at 14:00 UTC, a day earlier than the original embargoa83d744768109a61
cybelangel-php2shellpartialThe disclosure was originally under embargo until Thursday 22 October at 11:00 ET; after the leak, PHP scheduled its release for 21 October4ffc5347bfe22fb4
thehackernews-php2shell-4dayspartialOriginally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTCc1cb63141287484c

Open tickets: Contradiction-10, Finding-98.

Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on the fact-check page.

This fact over time

  1. 2026-10-20 20:22 UTCoss-security publishes Upcoming Critical PHP Security Release
  2. 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
  3. 2026-10-21 13:32 UTCWiz on X publishes Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet
  4. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
  5. 2026-10-22 08:14 UTCSaved into the evidence vault: oss-security
  6. 2026-10-22 08:15 UTCSaved into the evidence vault: php.net
  7. 2026-10-22 08:16 UTCSaved into the evidence vault: Wiz on X
  8. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Today's PHP Security Release, and How We're Strengthening …Upcoming Critical PHP Security ReleaseWiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the…PHP 8 ChangeLogfact release-moved

Where this fact appears

In the briefings for:

RowanJournalistAshSecurity researcherBlakeAnalyst or policy advisor

And on every claim.

Every version of this fact

v1 · site v0.1.0 · 22 October 2026 · confirmed
The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak
Who says it: PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release')
Status: confirmed
Topic: leak
Sources: php-foundation-blog-security-release, openwall-oss-security-2026-10-20-34, x-wiz-io-php2shell, php-net-changelog-8