PHP news for October 2026, led by the month's big story: two critical security flaws in PHP (CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell). The current situation in plain words, the core facts with their evidence, what to do, and a briefing for every kind of reader. https://php.oct.2026.newsroom.sgit.ai/ 2026-10-22T00:00:00Z Dinis Cruz https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.7.02026-10-22T00:00:00Z

power users, start here (/collaborators/): a generic onboarding for the people the editor nudges in his WhatsApp group and by email, the latest ask with its messages, and join and feedback forms encrypted to a private vault; runs (/team/runs/): every schedule the agents run, the quiet hours, and every recorded run with the article it should leave

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.6.02026-10-22T00:00:00Z

GRC: a new section, /grc/, with fractal risk registers for php2shell (34 risks assigned to 53 stakeholders, each joined to its weakness, CVE, fix, code, stories and roles, mapped to 95 controls in 20 frameworks including GDPR, NIS2, the Cyber Resilience Act, DORA, the EU AI Act, ISO 27001 and NIST), and the data protection officer added to the readers with a briefing on exposure, the GDPR 72-hour clock and what to document

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.102026-10-22T00:00:00Z

the telemetry vault-in-vault turned around: the application moves to a versioned vault of its own (5wnsr5h8, v0.1.1, eight pages), the telemetry vault imports it and drains its own lane from the browser (40 events drained that way, 275 from 176 sessions now), and the dashboard vault i4diy82d is superseded

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.92026-10-22T00:00:00Z

no named organisation has said it was compromised through php2shell: claim no-confirmed-compromise reworded with its time (20:50 UTC, 22 October) and moved from confirmed to reported, the plain-English lines that said nobody had confirmed a break-in corrected, and a page of its own (/compromise/) mapping the evidence behind the statement: what was searched, 33 statements by kind with their sources or source-watch snapshots, the layers from attempts to a named compromise, a timeline, and what would change it

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.82026-10-22T00:00:00Z

factcheck run 2: the PHP security team answered the 'incomplete fix' report publicly at 09:11 UTC on 22 October (unrelated crash bug, nothing to do with the RCE), so the front page's 'not answered publicly yet' is out of date; contradiction K-011 and five pieces of outside evidence; KEV still lists neither CVE; no claim changed and no run-1 ticket can close yet; the desk now publishes to dev on the editor's instruction

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.72026-10-22T00:00:00Z

the telemetry dashboard: a new private vault (i4diy82d) holding a vault app over the telemetry vault, which is linked inside it read-only (vault-in-vault), so the app always draws the latest drain; listed on /vaults/

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.62026-10-22T00:00:00Z

who reads this site: the telemetry lane drained again, 235 anonymous events from 161 sessions on 22 October; the subscriptions lane drained, nothing waiting

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.52026-10-22T00:00:00Z

two more branches carried in: security@php.newsroom's first pass (the security requirements, security_check.py in the gate and in release.sh, hardened build, workflows and drains, the rules of engagement for keys, the root pinned in CLAUDE.md; /admin/keys/ waits for data/keys.json) and the fact-check desk's run 1 (all 70 claims graded against the vault, 10 contradictions, /factcheck/)

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.42026-10-22T00:00:00Z

Ask, on every page: a pane on the right where you talk to the site with your own OpenRouter key; the model calls the site's read-only tools itself (search, items, pages, what is new to you, your notes, the situation), every call shown, every fact cited to an item; it can only propose marking items read or adding a note, and does nothing without your Allow; the tools are also published as window.__tools for any agent in your browser; your key, your reading record, notes, feeds and chats are kept in your vault, the same one the phone app opens

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.32026-10-22T00:00:00Z

guidance for every agent, AGENTS.md and /admin/agents/: push to your own branch after every step that builds and take in dev often, dev@php.newsroom carries branches into dev and releases; quality from coding.sgit.ai, non-functional requirements from nfrs.sgit.ai, and the security requirements (no secret in any repository, secrets sealed to pki.sgit.ai keys, readers' data in their browser or their own vault, untrusted input shown as text, a model given data not instructions)

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.22026-10-22T00:00:00Z

two branches carried into dev: researcher@ and cyber@php.newsroom join with the cyber desk's first piece, 'Patch at the speed of Metasploit' (board items renumbered 076 to 079 after the conductor's); and the fact-check desk as pushed, its model, contradiction ledger and /factcheck/, run 1 in progress

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.12026-10-22T00:00:00Z

the team: every member, human and agent, with a page (role, what they own, tasks, what they shipped), Vicky joins as project manager and the conductor as conductor and comms; the team coordinates through three private vaults, the conductor vault with an append lane, the issues vault (Issues-FS-lite, the board moved into it) and the mail vault (Email-FS-lite); /team/channels/ and the run

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.5.02026-10-22T00:00:00Z

Now, the phone app (/now/): what you need to know for one, five, ten or thirty minutes against what you read before; a deterministic mode from the data and an agentic one where Sonnet writes your briefing and answers in a chat and Gemini draws an infographic, with your OpenRouter key kept in your own vault; the newsroom's vault library vendored for it

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.72026-10-22T00:00:00Z

the editor's critical brief on scheduled capture: the sources that move are checked on a schedule, captured raw, turned into timestamped JSON and analysed on every change; contradictions between reports are recorded as first-class records, seeded with seven from the coverage review; meaning through connectivity, with every fact and stat on a spectrum of evidence; board items 057 to 063

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.62026-10-22T00:00:00Z

synthetic readers: synthetic@php.newsroom runs six test readers (board member, CTO, project manager, security lead, developer, designer) through the live site in a real browser, each with its own device, path and private vault holding every request, page, screenshot and review; /admin/synthetic/ shows the first run's verdicts, scores and requested changes; hourly and after each deploy via .github/workflows/synthetic.yml once its secrets are set

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.52026-10-22T00:00:00Z

the coverage vault: 24 pages from other outlets captured with screenshots, page text and hashes into a new private vault (dcsmxese), listed on /vaults/ without its key, and the review of how they present the story and what this site should learn, in admin/content/reviews/

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.42026-10-22T00:00:00Z

subscriptions: /subscribe/ takes an address, what to follow and how often, encrypts it in the reader's browser to the new private subscriptions vault (wgeiqabu) and posts it to that vault's write-only lane; the agent at agent@diniscruz.ai confirms each address before sending anything; the vault is listed on /vaults/, its drain script is admin/build/subscriptions_drain.py, and its keys and the telemetry vault's are sealed to the editor's key

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.32026-10-22T00:00:00Z

The second stories: the NCSC-NL inventory read hour by hour from its public history (38 versions, 61 fixed, 216 vulnerable, 440 under investigation at 15:28 UTC on 22 October; 185 of the vulnerable are applications that inherit PHP's flaw; firewalls and gateways among the affected), /signals/ with the ladder from exposed to exploited, four signal families and the time of each barrier, and the story 'Exposed is not exploited' by the journalist and the historian; a correction: the inventory had 675 rows at the captured commit, not 674

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.22026-10-22T00:00:00Z

the delta since your last visit: every item on the site (facts, sections, briefings, stories, questions, sources, dated events) is marked new, changed or read in your browser; mark a page or everything read and the read items fade or hide, so the next visit shows only what changed; decisions and notes per item; your desk at /you/; five RSS feeds (everything, for you, research, stories, about the site) at /feeds/; a feed viewer at /reader/ for this site's feeds, the CVE records, NVD, OSV, CISA KEV, GitHub, Hacker News and Mastodon, and feeds you add

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.12026-10-22T00:00:00Z

Research and Stories: the menu in three zones (for you, research, stories) with an origin strip on every page saying whether it is research, external material, a story (house, guest, interview) or about the site; Stories as its own section; /patching/, which versions of PHP get a fix and from whom, every downstream row checked against the NCSC-NL inventory; the story 'Why can't every version of PHP just be patched?'; /status.json for other sites, with its admin page; the editor's brief published; four stray screenshots committed in v0.2.10 removed

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.4.02026-10-22T00:00:00Z

the design branch merged into dev: the site is PHP October 2026 with a jargon-free front page, fifteen readers with plain answers and reading paths, a glossary on every page, every section and fact versioned with history and diffs, what's new with a feed, the editor's interview, and sitemap.xml and robots.txt for search engines; everything dev shipped since v0.2.2 is kept

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.3.22026-10-22T00:00:00Z

every section versioned and every fact given a timeline: each briefing, front-page section and story page records the release that wrote it, with its history and a diff of every change; a page per fact, from publication to this site; what's new, release by release, with a feed; the fact pipeline; the editor interviewed in his own words; a sitemap, robots.txt and structured data for search engines From the editor: what's new must be visible, every section must say which release wrote it, a version must move only when what its reader sees changes, and every fact needs a timeline.

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.3.12026-10-22T00:00:00Z

the site is renamed PHP October 2026, PHP news for the month rather than one nickname, and its front page is now jargon-free and about the current situation: right now, at a glance, the core facts each with its status and evidence, what nobody knows yet and the latest; the technical front page moved to the specialist summary From the editor: the site should be named for PHP in October, not for the incident, so that it can carry whatever PHP news the month brings; and the first page must be readable by anyone.

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.3.02026-10-22T00:00:00Z

the first reader-first pass: fifteen named readers mapped by job and technical depth, a briefing for each opening with a thirty-second plain answer and a reading path, three new briefings (curious reader, website owner, project manager), a plain-English explainer, a glossary of 40 terms linked and hover-defined on first use on every page, every CVE ID linked, a plain-English line on every technical page, a reader bar that keeps your place, and a front page that leads with where things stand and who you are Designed from the question the editor asked: who is reading, and what does the first screen do for them? The evidence is unchanged; every new sentence of fact cites the vault.

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.152026-10-22T00:00:00Z

who reads this site: the telemetry lane drained again, 120 anonymous events from 74 sessions on 22 October, counts by country, region, referrer, page and screen on the telemetry page

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.142026-10-22T00:00:00Z

the source watch's page opens with a screenshot of the vault in the official UI, read-only with the published key, that opens the real one in a new tab; board item 038 records what the first open costs in the browser (2,678 objects decrypted before the tree shows)

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.132026-10-22T00:00:00Z

the vaults: a Vaults section listing every vault behind the site (the evidence vault and the source watch with their read keys, the private telemetry vault with its write-only lane); the source watch (oq9gflln) published the way sgit.ai publishes vaults, with its key, a link that opens it in a new tab, the official UI embedded and its features (raw and analysis trees, country to page taxonomy, access classes, licence tiers, graphs at four altitudes, runs, tips, tools) from data/source-watch.json; the evidence vault page embeds its app too

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.122026-10-22T00:00:00Z

deploys from several agents: the Pages workflow queues deploys instead of cancelling the one in flight, and release.sh takes in what other agents released before it bumps and again if its push loses a race; /status/ shows each newsroom site's deploy runs from GitHub's public API with no credential, beside the version each serves, and every page notes when a newer release is live

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.112026-10-22T00:00:00Z

the release check reads the live version correctly: v0.2.9's pattern matched the v in class="ver" and read a blank version, so it reported every release unverified; now tested against the live site for older, equal and newer versions

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.102026-10-22T00:00:00Z

pricing by content type and freshness: every content page metered (only the meter's own pages are not), price = max(1p, round(base x freshness)) with tiers picked in the reader's browser, the formula and rules of engagement on the billing page; second readings: Perplexity's notes published in full and credited, compared with the vault point by point; the newsroom's review of the site published as received, with a triage and fourteen board items; briefing titles and table word-wrapping fixed

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.92026-10-22T00:00:00Z

the release check now accepts this version or later, because several agents release to dev and one can land on top of another inside the polling window (v0.2.8 landed on v0.2.7 and the old exact check called a live release unverified)

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.82026-10-22T00:00:00Z

the articles layer and the evidence, derived, authored split: a journalist's state-of-affairs report and a historian's perspective, both written against v0.2.5 (the librarian's questions shipped alongside as v0.2.6, the dev agent's key as v0.2.7); /layers/ classifying every data file, checked by the gate; the menu split into story, articles, analysis and evidence; a front page and navigation review; the front page's 'six briefings' corrected to the computed twelve

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.72026-10-22T00:00:00Z

dev@php.newsroom's public key from pki.sgit.ai on the roles page (record sha256:8025e2a4470e73f0, key link and QR), the brief for handing the editor the telemetry vault key sealed to his key, and board item 013

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.62026-10-22T00:00:00Z

the librarian joins (librarian@php.newsroom): /questions/, the questions readers ask with a short answer to paste back, the sourced answer and the pages that carry it, starting from a reader's 'can anything be done, or do we wait for updates?'; a catalogue of every page; articles readers saw that the vault has not captured, listed as seen, not cited

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.52026-10-22T00:00:00Z

the review layer: the php2shell fix mapped to the php-src code as layered graphs (the flaws, what the fix does, the files and functions it changed, derived from the diff), a static map at /review/ and a no-library navigator at /review/ui/, after the secrets.sgit.ai review pages

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.42026-10-22T00:00:00Z

five themes (Newsprint, Night, Paper, Blueprint, Ember) with a picker in the bar, vendored from newsroom.sgit.ai; all colour moved to theme tokens; the reading-meter ratings card dropped for the quiet balance

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.32026-10-22T00:00:00Z

the admin section (board, roles, briefs, the evidence vault opened with its public read key, who reads this site), anonymous telemetry over an append lane into a separate vault with its drain script and first report, and the page meter in quiet mode

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.22026-10-22T00:00:00Z

the build, gate and release scripts are now committed: the repository's Python .gitignore template had ignored admin/build/, which is why the first Pages run could not find the gate

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.12026-10-22T00:00:00Z

a Pages deploy workflow that runs the gate on every push to dev, and breadcrumbs up to October 2026, the year and the newsroom

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.2.02026-10-22T00:00:00Z

the code read from php-src, php2shell in context against ten earlier flaws, an impact ledger of offline versus compromised, detection and defence from six WAF vendors and three rule sets, six more briefings, a page per source and per party with its own graph, 86 new sources

https://php.oct.2026.newsroom.sgit.ai/whatsnew/index.html#v0.1.02026-10-22T00:00:00Z

The site exists: a story front, the two flaws, the timeline, every claim with a status, the numbers that do not add up, the agencies compared, the affected versions and software, the exploitation signals, a playbook, six briefings, every source with its hashes, the graph, the method, the team, the billing model and this history. First release, built from the evidence vault at commit 379e3d7f172a (61 sources, 62 captures, 390 hashed files).