Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

From a line of code to a stakeholder

One graph for the whole story. At the bottom, the 359 changed hunks of the php2shell fix, each a line range in php-src; above them the functions and files they sit in, the parts of the fix, the two flaws; then the claims and events that talk about them and the sources those cite; then the story arcs those claims carry, the risks the arcs describe, and at the top the fifteen kinds of reader who face those risks. 895 nodes, 1230 edges. Every node opens into its own neighbourhood: walk it, from the top or from a line.

The layers

LayerNodesWhere it comes from
Stakeholders16the fifteen readers in data/personas.json
Risks9authored in data/arcs.json, each resting on claims
Story arcs7authored in data/arcs.json, each carrying risks and resting on claims and events
Claims and events138data/claims.json and data/timeline.json, each with a status or a date
Sources91the captured, hashed sources the claims and events cite
The flaws2the two CVEs, from data/review.json
The fix7the commit and what it does, from data/review.json
Areas and files73php-src areas and files the fix changed, from review/code/files.json
Functions193the C functions the fix changed, from the diff
Lines359every changed hunk, with its line range in php-src

The top three layers and the joins from a claim to a flaw or a part of the fix are written by the librarian in data/arcs.json; everything else is derived by the build from files the site already publishes. The assembled graph is data/fractal.json.

What is joined, and what is not

Five threads, top to bottom

Each is the shortest path down the ladder from one reader to a changed line, computed by the build. Click any rung.

Board member or executive, down to a line

  1. Stakeholders Board member or executive
  2. Risks What the server holds is taken
  3. Story arcs The bug is in the engine, not in your code
  4. Claims and events In researchers' own tests, pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS reported
  5. The flaws CVE-2026-109618: RCE via OOM corruption
  6. The fix A soft memory limit that no longer jumps
  7. Areas and files Zend/zend_alloc.c
  8. Lines zend_alloc.c:1149-1153

Walk it from the top · walk it up from the line

Developer, down to a line

  1. Stakeholders Developer
  2. Risks Your version gets no fix
  3. Story arcs The bug is in the engine, not in your code
  4. Claims and events Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safe confirmed
  5. The flaws CVE-2026-109619: RCE via stale global state
  6. The fix Bounded, deduplicated request parsing
  7. Areas and files ext/session/session.c
  8. Functions PHP_GINIT_FUNCTION()
  9. Lines session.c:2804

Walk it from the top · walk it up from the line

Curious reader, down to a line

  1. Stakeholders Curious reader
  2. Risks What the server holds is taken
  3. Story arcs The bug is in the engine, not in your code
  4. Claims and events In researchers' own tests, pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS reported
  5. The flaws CVE-2026-109618: RCE via OOM corruption
  6. The fix Allocations that may fail instead of abort
  7. Areas and files Zend/zend_hash.c
  8. Lines zend_hash.c:1095-1099

Walk it from the top · walk it up from the line

The edges

EdgeCount
changed at359
cites293
changes193
rests on124
dated by67
faces44
contains37
about36
touches36
told in18
realised in9
closed by8
introduces6

Edges are read top down: a stakeholder faces a risk, a risk is told in an arc and rests on claims, a claim cites sources and is about a flaw or a part of the fix, a flaw is closed by the fix, which is realised in files, which change functions, which are changed at lines. The navigator walks them both ways.

The fix-only version of this graph is the fix mapped to the code; the citation graph alone is as a graph. This answers the second memo's ask for the semantic fractal graph; what it still lacks is on corrections.