The story as a graph

209 nodes and 281 edges: 70 claims, 68 events and the 71 sources they cite. There is no second graph behind this one: the page, the briefings and the timeline are all drawn from the same rows, so the picture cannot disagree with the text. The JSON is data/graph.json; this page shows the claims-to-sources slice.

claims (70)sources cited (71), with how many claims cite eachTwo critical vulnerabilities, CVE-2026-109618 …The flaws are CVSS 10.0Unauthenticated RCE over HTTP against Apache m…Remote code execution is confirmed on PHP-FPMThe fix removes longjmp() for out-of-memory er…The 8.5.12 fix may be incomplete, or there is …All PHP versions from 5 onwards are affected b…Updating is the only complete mitigation; the …A web application firewall may provide some pr…Pre-authentication RCE was confirmed against W…Roughly 70% of the Internet is affectedPHP is used by almost 70% of websitesSomething like 30 million websites could be af…PHP is exposed on about 2.6 million internet-f…About 6,000 potentially affected resources in …674 products in the NCSC-NL inventory: 206 vul…The flaws were found by researchers using fron…Calif found the flaws first: discovery 1 Augus…OpenAI independently reported the same root ca…Wiz Research independently discovered the firs…The GitHub advisories credit four reporters: l…The out-of-memory issue was found in a 2024 au…Frontier AI found the flaw ahead of attackers,…The most severe flaws ever detected by AIOn 20 October at about 15:00 UTC the two CVE I…The leak started with an anonymous Hacker News…watchTowr confirmed in public that the bugs we…Calif mistakenly published a video around 20:0…Mitigation advice given to a few critical-infr…Chainguard unilaterally broke the embargo on 2…The release moved forward from 22 October 14:0…The flaws were disclosed on 22 October 2026The fixes were released at 14:00 UTC on 21 Oct…The pre-announcement was published at 19:30 UT…There is no evidence yet that hackers have exp…CISA has not observed exploitation; neither CV…Reports of active exploitation existAn exploit attempt hit an Amazon honeypot on 1…Cloudflare observed attack traffic targeting i…Amazon and Cloudflare saw sites being probed f…Automated exploitation attempts were seen in L…Criminals are using AI to 'vibe code' an attac…If an immediate update is not feasible, take t…Organisations that cannot update immediately, …'Where immediate remediation is not feasible, …The UK's NCSC, the NSA and their counterparts …Parts of Wikipedia, Edinburgh council, French …Latvia restricted access from abroad to severa…The risks require immediate patching across Un…Exploit attempts across Cloudflare's network: …No traffic matching the php2shell exploit patt…No exploitation observed on Huntress partner s…watchTowr sees active exploitation attempts an…No named organisation has confirmed a compromi…None of the public proof-of-concept exploits r…Triggering the bug is much easier than turning…The fix was authored on 18 October at 15:26 UT…Both bugs are in the C engine, not in PHP code…Patching the demonstrated paths does not make …Edge protections went live hours before disclo…The Dutch NCSC took its own site offline as a …Finland's state IT provider Valtori restricted…The Wikimedia Foundation took down a number of…Weird Gloop turned off its wiki web servers fo…Edinburgh council's site went offline late on …Oxford City Council: 'a precaution because of …Edinburgh and Oxford councils, the Met Police …Quarkslab's published audit summary lists 27 f…Chainguard's team found the same bugs independ…The last PHP core RCE, CVE-2024-4577, was expl…BBC News (12)PHP Foundation (12)PHP (8)php.net (6)Wiz (6)Calif (5)Cloudflare (5)Daubois (5)PHP (5)Imperva Threat Research (4)Amazon (3)CERT-EU (3)CERT.LV (3)CISA (3)CISA (3)CVE record (3)Fastly (3)php-src (3)Huntress (3)oss-security (3)oss-security (3)THN (3)OpenAI on X (3)Wiz on X (3)CERT-FR (2)php/php-src , read from a clone (2)NSA (2)oss-security (2)php.net (2)PHP Foundation (2)The Register (2)Weird Gloop (2)ACN / CSIRT Italia (1)ACSC (1)Akamai Security Research (1)Akamai Security Research (1)CCCS (1)BACS (1)CISA (1)CNN (1)CVE record (1)CVE record (1)The Cyber Express (1)Dutch IT Leaders (1)Fortinet Community (1)php-src (1)php-src (1)rjmendez, GitHub (1)Helsinki Times (1)Insurance Business (1)JPCERT/CC (1)LBC (1)NCSC UK (1)NCSC-NL (1)NCSC-NL (1)NCSC-NL (1)NCSC New Zealand (1)NSA Cyber on X (1)oss-security (1)Oxford Chronicle (1)Quarkslab (1)Rijksoverheid / NCSC-NL (1)The Scotsman (1)SecurityWeek (1)David Lopez-Kurtz (1)watchTowr (1)watchTowr (1)Matthew Prince , Cloudflare CEO on (1)Feross Aboukhadijeh on X on X (1)Ryan Austin , Calif on X (1)Yle (1)
Every line is one citation. Colour is the claim's status: green confirmed, grey reported, amber disputed or contradicted, red unverified. A source with a filled dot is primary.

How to read it