Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R07

R07: Decisions made on numbers that measure something else

Because '70% of the Internet', 'CVSS 10' and '30 million websites' were repeated without their source, boards and readers sized the risk on figures that are unverified, contradicted or measure a different thing, resulting in priorities set by headline rather than by exposure.

Rating 12 high · Likelihood 4 Likely · Impact 3 Significant · Kind Governance · Acceptance not recorded

Basis. The claims are graded unverified, contradicted or reported on this site; they led the coverage most readers saw.

The path

Told inWhere php2shell standsWhere php2shell stan…Exposed is not exploitedExposed is not explo…Acted on byBoard and executivesBoard and executivesFact-check deskFact-check deskJournalistJournalistCarried byThe press (source)The press (source)Wiz Research (source)Wiz Research (source…Board and executives (owner)Board and executives…This newsroom (treater)This newsroom (treat…RiskR07 Decisions made on numbers that measure something elseR07 Decisions made o…Arises fromNumbers and ratings repeated without their sourceNumbers and ratings …VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
The presssourceCarried the figures.6 risks
Wiz ResearchsourceThe 70% headline.1 risk
Board and executivesownerDecides on what it reads, and owns the question of what a figure measures.5 risks
This newsroomtreaterGrades every figure and shows what each measures.5 risks

What it arises from

The evidence

ClaimStatusFact-checkSources
Roughly 70% of the Internet is affectedunverifiedA1 Weak signalWiz Wiz on X BBC News
PHP is used by almost 70% of websitesreportedA2 ReportedCloudflare OpenAI on X Wiz
The flaws are CVSS 10.0contradictedrefutedPHP Foundation Daubois
Something like 30 million websites could be affectedreportedA2 ReportedBBC News
The most severe flaws ever detected by AIreportedA2 ReportedBBC News Wiz
The flaws were disclosed on 22 October 2026contradictedrefutedBBC News php.net php-src

Treatments

TreatmentStatusWhere
Every number with what it counts and its sourcein placeThe numbers: 70%, 30 million, 2.6 million, 6,000, 674

The standards that govern it

FrameworkControlWhat it asksFamily
NIST CSF 2.0GV.RM-01Risk management objectives are established and agreed by stakeholdersFrameworks and control catalogues
ISO/IEC 270016.1.2Information security risk assessment: identify risks and their ownersManagement-system standards
OWASP Top 10sLLM09:2025MisinformationPractice and technique

The stories that tell it

On this site: The numbers: 70%, 30 million, 2.6 million, 6,000, 674 · Fact-check: how sure can you be of each claim