# R07: Decisions made on numbers that measure something else > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. Because '70% of the Internet', 'CVSS 10' and '30 million websites' were repeated without their source, boards and readers sized the risk on figures that are unverified, contradicted or measure a different thing, resulting in priorities set by headline rather than by exposure. [Risks](../index.html) / R07 # R07: Decisions made on numbers that measure something else Because '70% of the Internet', 'CVSS 10' and '30 million websites' were repeated without their source, boards and readers sized the risk on figures that are unverified, contradicted or measure a different thing, resulting in priorities set by headline rather than by exposure. **Rating** **12** high · **Likelihood** 4 Likely · **Impact** 3 Significant · **Kind** Governance · **Acceptance** not recorded **Basis.** The claims are graded unverified, contradicted or reported on this site; they led the coverage most readers saw. ## The path The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it. ## Who carries it One risk, assigned to every stakeholder that carries part of it, with the part each plays. | Stakeholder | Part | Why | Its register | |---|---|---|---| | [The press](../../../grc/stakeholders/media/index.html) | **source** | Carried the figures. | 6 risks | | [Wiz Research](../../../grc/stakeholders/wiz/index.html) | **source** | The 70% headline. | 1 risk | | [Board and executives](../../../grc/stakeholders/board/index.html) | **owner** | Decides on what it reads, and owns the question of what a figure measures. | 5 risks | | [This newsroom](../../../grc/stakeholders/newsroom/index.html) | **treater** | Grades every figure and shows what each measures. | 5 risks | ## What it arises from - **Numbers and ratings repeated without their source.** 70% of the Internet, CVSS 10, 30 million sites: figures that measure different things, carried from post to post until they read as fact. ## The evidence | Claim | Status | Fact-check | Sources | |---|---|---|---| | [Roughly 70% of the Internet is affected](../../../facts/scale-70pc-internet/index.html) | unverified | **A1** Weak signal●○○○○○ | [Wiz](../../../sources/wiz-blog-php2shell/index.html) [Wiz on X](../../../sources/x-wiz-io-php2shell/index.html) [BBC News](../../../sources/bbc-live-ckgel5xp2xv9t/index.html) | | [PHP is used by almost 70% of websites](../../../facts/scale-70pc-websites/index.html) | reported | **A2** Reported●●○○○○ | [Cloudflare](../../../sources/cloudflare-blog-php2shell-waf/index.html) [OpenAI on X](../../../sources/x-openai-php2shell/index.html) [Wiz](../../../sources/wiz-blog-php2shell/index.html) | | [The flaws are CVSS 10.0](../../../facts/cvss-10/index.html) | contradicted | refuted | [PHP Foundation](../../../sources/php-foundation-blog-security-release/index.html) [Daubois](../../../sources/daubois-blog-php2shell-rumors/index.html) | | [Something like 30 million websites could be affected](../../../facts/scale-30m/index.html) | reported | **A2** Reported●●○○○○ | [BBC News](../../../sources/bbc-live-ckgel5xp2xv9t/index.html) | | [The most severe flaws ever detected by AI](../../../facts/most-severe/index.html) | reported | **A2** Reported●●○○○○ | [BBC News](../../../sources/bbc-live-ckgel5xp2xv9t/index.html) [Wiz](../../../sources/wiz-blog-php2shell/index.html) | | [The flaws were disclosed on 22 October 2026](../../../facts/disclosure-22oct/index.html) | contradicted | refuted | [BBC News](../../../sources/bbc-live-ckgel5xp2xv9t/index.html) [php.net](../../../sources/php-net-advisory/index.html) [php-src](../../../sources/github-php-src-tag-php-8.5.12/index.html) | ## Treatments | Treatment | Status | Where | |---|---|---| | Every number with what it counts and its source | in place | [The numbers: 70%, 30 million, 2.6 million, 6,000, 674](../../../numbers/index.html) | ## The standards that govern it | Framework | Control | What it asks | Family | |---|---|---|---| | [NIST CSF 2.0](../../frameworks/nistcsf/index.html) | [GV.RM-01](../../frameworks/nistcsf/index.html#c-gv-rm-01) | Risk management objectives are established and agreed by stakeholders | Frameworks and control catalogues | | [ISO/IEC 27001](../../frameworks/iso27001/index.html) | [6.1.2](../../frameworks/iso27001/index.html#c-6-1-2) | Information security risk assessment: identify risks and their owners | Management-system standards | | [OWASP Top 10s](../../frameworks/owasp/index.html) | [LLM09:2025](../../frameworks/owasp/index.html#c-llm09-2025) | Misinformation | Practice and technique | ## The stories that tell it - [Where php2shell stands: many sites dark, millions of attempts, no confirmed breach](../../../articles/where-php2shell-stands/index.html) - [Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit](../../../articles/exposed-is-not-exploited/index.html) On this site: [The numbers: 70%, 30 million, 2.6 million, 6,000, 674](../../../numbers/index.html) · [Fact-check: how sure can you be of each claim](../../../factcheck/index.html) --- site v0.8.1 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/risks/r07/index.html