# Fact: The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC beca

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak Who says it, its status (confirmed), its sources, and its timeline from publication to this site.

Fact · leak · confirmed

# The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak

**Who says it:** PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release') · **Sources:** [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) [oss-security](../../sources/openwall-oss-security-2026-10-20-34/index.html) [Wiz on X](../../sources/x-wiz-io-php2shell/index.html) [php.net](../../sources/php-net-changelog-8/index.html)

The php.net ChangeLog still dates all four releases 22 October. Wiz's X thread still says 22 October.

## Fact-check

**A4** Corroborated●●●●○○ measures differently status overstated · Event · verdict: **holds** · the status word overstates the evidence

The new time (21 October 14:00 UTC) is in the php.net pre-announcement relayed to oss-security (record). That the original date was 22 October is carried by the Foundation and indirectly by Wiz's thread and the php.net ChangeLog; that the move was because of the leak, by the Foundation and Daubois. The original hour '14:00 UTC' rests on the Foundation alone (echoed by The Hacker News), while watchTowr (via Daubois, Huntress, CybelAngel) put the embargo at Thursday 11am ET, which is 15:00 UTC.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | carries | *It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.* | a1be057adc1c5bfa |
| [openwall-oss-security-2026-10-20-34](../../sources/openwall-oss-security-2026-10-20-34/index.html) | partial | *> It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.* | 57b273733e7d5fe6 |
| [x-wiz-io-php2shell](../../sources/x-wiz-io-php2shell/index.html) | partial | *Patch: Apply the Oct 22 security release immediately (the only complete remediation).* | 6c17977662815b0c |
| [php-net-changelog-8](../../sources/php-net-changelog-8/index.html) | partial | *22 Oct 2026* | e39f8d2cb60ee8a5 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | partial | *The team scheduled that release for Wednesday, October 21 at 14:00 UTC, a day earlier than the original embargo* | a83d744768109a61 |
| [cybelangel-php2shell](../../sources/cybelangel-php2shell/index.html) | partial | *The disclosure was originally under embargo until Thursday 22 October at 11:00 ET; after the leak, PHP scheduled its release for 21 October* | 4ffc5347bfe22fb4 |
| [thehackernews-php2shell-4days](../../sources/thehackernews-php2shell-4days/index.html) | partial | *Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC* | c1cb63141287484c |

Open tickets: [Contradiction-10](../../factcheck/index.html#Contradiction-10), [Finding-98](../../factcheck/index.html#Finding-98).

Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-20 20:22 UTCoss-security publishes [Upcoming Critical PHP Security Release](../../sources/openwall-oss-security-2026-10-20-34/index.html)
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-21 13:32 UTCWiz on X publishes [Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet](../../sources/x-wiz-io-php2shell/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 08:14 UTCSaved into the evidence vault: oss-security
- 2026-10-22 08:15 UTCSaved into the evidence vault: php.net
- 2026-10-22 08:16 UTCSaved into the evidence vault: Wiz on X
- 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisor
And on [every claim](../../claims/index.html#release-moved).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · confirmed
```
The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak
Who says it: PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release')
Status: confirmed
Topic: leak
Sources: php-foundation-blog-security-release, openwall-oss-security-2026-10-20-34, x-wiz-io-php2shell, php-net-changelog-8
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/release-moved/index.html