When the fact-check desk finds that another publisher's words say more than the evidence shows, this site asks them, politely and with the evidence, to correct the wording. Each request is published here before any message is sent: what they said, quoted from a dated capture with its hash; what the evidence shows; a wording they can use; and where the request stands. The data is CC BY 4.0 and theirs to use. If we are the ones who are wrong, our page is corrected first.
The requests
One point to one publisher each. The origin of an error is asked first; the outlets that repeated it are told what the origin said. A request that waits on this site fixing the same error first says so.
R-001: Wiz (Wiz Research) drafted origin
The point. The headline says the flaws affect 70% of the Internet; the post's own body says PHP powers 70% of all websites.
What they published.
- blog headline, third-party words:
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
WizChecked in sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt, sha256 e3568b6f88c93f6b.
- blog body, third-party words:
a popular general-purpose scripting language that powers 70% of all websites in the world.
WizChecked in sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt, sha256 e3568b6f88c93f6b.
- post on X, third-party words:
a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.
Wiz on XChecked in sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt, sha256 6c17977662815b0c.
What the evidence shows. The 70% is the usual web-technology survey figure: the share of websites whose server-side language is known that use PHP (Cloudflare links it to W3Techs; Tenable and Imperva name W3Techs, at 69.3% and over 69%). It is a share of websites, not of hosts, traffic or the Internet, and it counts sites that use PHP at all, not installations running an affected version. Every outlet in our evidence vault that carries the figure traces back to this post.
A wording we suggest. PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP, the language behind about 70% of websites whose server-side language is known
Fact-check: K-001, Contradiction-1; claims scale-70pc-internet, scale-70pc-websites. Channel: to find, Wiz's published press or research contact, from its own site; captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70%..."
Hello,
On 21 October 2026 you published: "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet"
(https://www.wiz.io/blog/php2shell-php-rce)
We think this says more than the evidence shows: The headline says the flaws affect 70% of the Internet; the post's own body says PHP powers 70% of all websites.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
A wording that would keep your piece accurate:
"PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP, the language behind about 70% of websites whose server-side language is known"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-22 drafted from contradiction K-001 (fact-check run 1); blocked until this site's own claim stops dropping the survey's population (Finding-33) and stops attributing 'roughly' to Wiz (Finding-102)
- 2026-10-24 unblocked: this site's own wording fixed in data/claims.json and the front page (Finding-33, Finding-102), by desk@php.newsroom on the editor's instruction; the fact-check desk to confirm at its next run. Ready for the editor to send.
R-002: BBC News drafted echo
The point. The live page puts "roughly 70%" in quotation marks as Wiz's estimate; Wiz's own words have no "roughly", and the 70% is a share of websites using PHP, not a measure of how much of the internet is affected.
What they published.
What the evidence shows. The words in quotation marks are not in either capture of Wiz's own words: the blog headline and the X post say '70% of the Internet', the blog body says '70% of all websites in the world'. The figure itself is a survey's share of websites whose server-side language is known that use PHP, not a share of the internet affected. The BBC's own caveat, that it could not verify the figure, is right and is kept in the suggestion.
A wording we suggest. with cyber-security firm Wiz saying the flaws affect "70% of the Internet", a figure that matches surveys of how many websites use PHP rather than a count of vulnerable systems, and that the BBC has been unable to independently verify.
Fact-check: K-001, Contradiction-1, Finding-124; claims scale-70pc-internet. Channel: to find, the BBC's published corrections and complaints route; captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "with cyber-security firm Wiz estimating that "roughly 70%" of the..."
Hello,
On 22 October 2026 you published: "with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure."
(https://www.bbc.co.uk/news/live/ckgel5xp2xv9t)
We think this says more than the evidence shows: The live page puts "roughly 70%" in quotation marks as Wiz's estimate; Wiz's own words have no "roughly", and the 70% is a share of websites using PHP, not a measure of how much of the internet is affected.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-002
A wording that would keep your piece accurate:
"with cyber-security firm Wiz saying the flaws affect "70% of the Internet", a figure that matches surveys of how many websites use PHP rather than a count of vulnerable systems, and that the BBC has been unable to independently verify."
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-22 drafted from contradiction K-001 and Finding-124; waits for the origin (R-001) to be asked first, and for this site's own claim to stop repeating the BBC's 'roughly' (Finding-102)
- 2026-10-24 this site's 'roughly' fixed (Finding-102); ready, to send after R-001
R-003: CNN Business drafted echo
The point. The headline says the flaw affects 70% of the internet; the article's own body gives the figure as the share of websites PHP powers.
What they published.
- headline, third-party words:
Websites shut down globally after AI finds a critical flaw affecting 70% of the internet
CNNChecked in sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt, sha256 ee49fc4265ae1c7c.
- body, third-party words:
a programming language that powers 70% of all websites in the world
CNNChecked in sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt, sha256 ee49fc4265ae1c7c.
What the evidence shows. The same survey figure as R-001, restated from Wiz: a share of websites that use PHP, not a share of the internet affected. CNN's own body gives it correctly: PHP 'powers 70% of all websites in the world'.
A wording we suggest. Websites shut down globally after AI finds a critical flaw in PHP, the language behind about 70% of websites
Fact-check: K-001, Contradiction-1; claims scale-70pc-internet. Channel: to find, CNN's published corrections route; captured before use.
Waiting on.
- R-001
- Evidence-13: a fresh capture of CNN's page before sending
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "Websites shut down globally after AI finds a critical flaw..."
Hello,
On 21 October 2026 you published: "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet"
(https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl)
We think this says more than the evidence shows: The headline says the flaw affects 70% of the internet; the article's own body gives the figure as the share of websites PHP powers.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-003
A wording that would keep your piece accurate:
"Websites shut down globally after AI finds a critical flaw in PHP, the language behind about 70% of websites"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-22 drafted from contradiction K-001; the headline and body still to be checked in the 11:26 UTC capture
- 2026-10-24 headline and body checked character for character in the 11:26 UTC capture by desk@php.newsroom; ready, to send after R-001
- 2026-10-24 the fact-check desk's outside check (Evidence-13) finds CNN reworded its 70% lines twice without a note (18:26 UTC, 22 October); the headline still says 'internet'. Re-capture and re-check both quotes before this goes.
R-004: Amazon Web Services (AWS Security Blog) blocked origin
The point. The post says PHP2Shell "is now being broadly exploited in the wild"; the same post says it is unclear whether any of the attempts it saw would have succeeded. Readers, and WIRED's headline, take "exploited" to mean successful attacks.
What they published.
- post, third-party words:
PHP2Shell is now being broadly exploited in the wild.
AmazonChecked in sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt, sha256 94315ded6e1175f2.
- post, earlier, third-party words:
Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.
AmazonChecked in sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt, sha256 94315ded6e1175f2.
What the evidence shows. AWS's sensors saw exploitation attempts, before and after the release; its own post leaves open whether any succeeded. The PHP Foundation told WIRED it knows of no successful remote code execution, CISA had not observed exploitation, and no named organisation has said it was compromised (this site's /compromise/ page). This is a request to clarify a word, not to change a finding.
A wording we suggest. PHP2Shell exploitation attempts are now widespread in the wild; whether any have succeeded against real systems is not yet known.
Fact-check: K-002; claims amazon-honeypot, no-confirmed-compromise. Channel: to find, the AWS Security Blog's published contact, captured before use.
Waiting on.
- Evidence-12: a capture of the AWS post as it now reads
Log.
- 2026-10-24 drafted by desk@php.newsroom: the word 'exploited' in WIRED's headline is AWS's, so AWS is asked first
- 2026-10-24 not to be sent: the fact-check desk's outside check (Evidence-12) finds AWS reworded the sentence on 22 October at 21:25 UTC, without a note, to 'now seeing broad exploitation attempts in the wild'. Once a capture shows it, this request closes as corrected without being asked, and pages quoting AWS carry both wordings with their times.
R-005: WIRED drafted echo
The point. The headline says hackers exploited the flaws; the article's own sources describe attempts and know of no successful attack.
What they published.
- headline, third-party words:
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
WIREDChecked in sources/wired-exploited-days-before-patched/captures/20261023T012042Z/text.txt, sha256 d43b99af65d563dd.
- body, quoting the PHP Foundation, third-party words:
to our knowledge, there has been no successful attempt at remote code execution.
WIREDChecked in sources/wired-exploited-days-before-patched/captures/20261023T012042Z/text.txt, sha256 d43b99af65d563dd.
What the evidence shows. The body is careful: AWS 'logged attempts', and the PHP Foundation knows of 'no successful attempt at remote code execution'. Only the headline says exploited, a word that came from AWS's post at the time.
A wording we suggest. Hackers Tried to Exploit the PHP Vulnerabilities Days Before They Were Patched
Fact-check: K-002; claims amazon-honeypot, no-confirmed-compromise. Channel: to find, WIRED's published corrections address, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "Hackers Exploited the PHP Vulnerabilities Days Before They Were..."
Hello,
On 21 October 2026 you published: "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched"
(https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/)
We think this says more than the evidence shows: The headline says hackers exploited the flaws; the article's own sources describe attempts and know of no successful attack.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-005
A wording that would keep your piece accurate:
"Hackers Tried to Exploit the PHP Vulnerabilities Days Before They Were Patched"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quotes checked; to send after R-004
- 2026-10-24 no longer waits on R-004: AWS has since reworded its own sentence (fact-check Evidence-12), so the request rests on WIRED's own body alone; ready to send
R-006: BankInfoSecurity (ISMG) drafted origin
The point. The headline says attackers exploit the flaws and that systems are under attack; on 21 October no source had shown a successful attack, and none has since.
What they published.
What the evidence shows. What was seen were attempts: CISA had not observed exploitation, the PHP Foundation knows of no successful remote code execution, and neither CVE is in CISA's catalogue of known exploited vulnerabilities as of this site's latest check.
A wording we suggest. Attackers Target Leaked Zero-Day Flaws in Widely Used PHP
Fact-check: K-002; claims no-confirmed-compromise. Channel: to find, ISMG's published corrections route, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP"
Hello,
On 21 October 2026 you published: "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP"
(https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161)
We think this says more than the evidence shows: The headline says attackers exploit the flaws and that systems are under attack; on 21 October no source had shown a successful attack, and none has since.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-006
A wording that would keep your piece accurate:
"Attackers Target Leaked Zero-Day Flaws in Widely Used PHP"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked
R-007: The Hacker News drafted origin
The point. The article says a proof-of-concept exploit leaked ahead of time; what circulated before the release was a screenshot of an exploit tool and a short demonstration video, and no saved source shows exploit code.
What they published.
What the evidence shows. The fact-check desk settled this by time (K-009, run 3): the PHP Foundation's 'no technical details leaked' describes the CVE identifiers circulating from about 15:00 UTC on 20 October; Calif's demonstration video went up that evening, and a screenshot of the tool's banner circulated (Daubois, Sansec via Equixly). A video and a banner show that an exploit exists, not how it works.
A wording we suggest. details about the CVE identifiers leaked ahead of time, and a video demonstrating an exploit circulated
Fact-check: K-009. Channel: to find, The Hacker News's published contact, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "details about the CVE identifiers and a proof-of-concept (PoC)..."
Hello,
On 22 October 2026 you published: "details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time"
(https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html)
We think this says more than the evidence shows: The article says a proof-of-concept exploit leaked ahead of time; what circulated before the release was a screenshot of an exploit tool and a short demonstration video, and no saved source shows exploit code.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-007
A wording that would keep your piece accurate:
"details about the CVE identifiers leaked ahead of time, and a video demonstrating an exploit circulated"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom; blocked while K-009 is open
- 2026-10-24 unblocked: K-009 explained by the fact-check desk's run 3; the point and suggestion reworded to match its reading; ready to send
R-008: Fortune drafted echo
The point. The headline says the flaw could take down 70% of the internet; the 70% is the share of websites that use PHP, not a share of the internet that could go down.
What they published.
What the evidence shows. As R-001: the 70% is the usual survey figure for websites whose server-side language is known, restated from Wiz's headline. Nobody has measured how many sites are vulnerable, and the flaws let an attacker run code on a server, not take the internet down.
A wording we suggest. AI tools discovered a vulnerability in PHP, the language behind about 70% of websites
Fact-check: K-001; claims scale-70pc-internet, scale-70pc-websites. Channel: to find, Fortune's published corrections route, captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "AI tools discovered the PHP vulnerability that could take down 70%..."
Hello,
On 21 October 2026 you published: "AI tools discovered the PHP vulnerability that could take down 70% of the internet"
(https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/)
We think this says more than the evidence shows: The headline says the flaw could take down 70% of the internet; the 70% is the share of websites that use PHP, not a share of the internet that could go down.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-008
A wording that would keep your piece accurate:
"AI tools discovered a vulnerability in PHP, the language behind about 70% of websites"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; to send after R-001
R-009: Clarín (English edition) drafted echo
The point. The headline says the flaw threatens 70% of the internet; the 70% is the share of websites that use PHP.
What they published.
What the evidence shows. As R-001: a survey's share of websites using PHP, restated from Wiz, not a measure of what is threatened.
A wording we suggest. How AI uncovered a 14-year-old flaw in PHP, the language behind about 70% of websites
Fact-check: K-001; claims scale-70pc-internet. Channel: to find, Clarín's published corrections route, captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "How AI uncovered a massive 14-year-old flaw threatening 70% of the..."
Hello,
On 22 October 2026 you published: "How AI uncovered a massive 14-year-old flaw threatening 70% of the internet"
(https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html)
We think this says more than the evidence shows: The headline says the flaw threatens 70% of the internet; the 70% is the share of websites that use PHP.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-009
A wording that would keep your piece accurate:
"How AI uncovered a 14-year-old flaw in PHP, the language behind about 70% of websites"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; to send after R-001
R-010: Le Temps drafted origin
The point. The headline says millions of sites were taken offline; no source counts more than a few dozen sites and a handful of government platforms.
What they published.
What the evidence shows. This site holds ten reports of sites taken offline, some a single site and some a whole government's platform, and a community tracker lists about fifty sites that went dark and came back. Millions of sites run PHP; nothing shows millions were switched off.
A wording we suggest. des sites, dont des portails publics, sont débranchés par précaution à cause de failles majeures au cœur de PHP
Fact-check: K-006. Channel: to find, Le Temps's published corrections route, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "des millions de sites sont débranchés en urgence à cause de..."
Hello,
You published: "des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP"
(https://letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php)
We think this says more than the evidence shows: The headline says millions of sites were taken offline; no source counts more than a few dozen sites and a handful of government platforms.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-010
A wording that would keep your piece accurate:
"des sites, dont des portails publics, sont débranchés par précaution à cause de failles majeures au cœur de PHP"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; the request is in English, the suggested wording in French
R-011: TechTarget Japan (ITmedia) drafted echo
The point. The article says more than 22 million servers were put at risk, as a fact; the figure is one company's estimate of systems that could be vulnerable, with no published method.
What they published.
What the evidence shows. The 22.6 million is Palo Alto Networks Unit 42's count of systems that 'could be vulnerable', as relayed by Insurance Business; its method is not published. Censys, which does publish its method, counted 1.57 million unpatched hosts among the 1.58 million whose version it could read.
A wording we suggest. Palo Alto Networks Unit 42の推計では、最大2260万件のシステムが脆弱な可能性がある（算出方法は非公開）。
Fact-check: none; claims scale-2.6m-hosts. Channel: to find, ITmedia's published corrections route, captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "2200万台以上のサーバが危険にさらされた"
Hello,
On 23 October 2026 you published: "2200万台以上のサーバが危険にさらされた"
(https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/)
We think this says more than the evidence shows: The article says more than 22 million servers were put at risk, as a fact; the figure is one company's estimate of systems that could be vulnerable, with no published method.
The wording starts with TechTarget (SearchSecurity), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-012
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-011
A wording that would keep your piece accurate:
"Palo Alto Networks Unit 42の推計では、最大2260万件のシステムが脆弱な可能性がある（算出方法は非公開）。"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; the suggested wording in Japanese is the desk's translation, for a native reader to check before sending
- 2026-10-24 the English original by the same author is now captured (R-012); this translation waits for it
R-012: TechTarget (SearchSecurity) drafted origin
The point. The headline and standfirst state 22 million vulnerable servers as a fact; the article's own body gives it as Palo Alto Networks' count of instances potentially vulnerable.
What they published.
- headline, third-party words:
PHP2Shell: 22M exposed servers at risk as emergency patches released
TechTargetChecked in sources/techtarget-cybersecurity-news-366652444-php2shell-2/captures/20261023T232528Z/text.txt, sha256 9c9a0459deeccb0d.
- standfirst, third-party words:
across 22 million vulnerable servers
TechTargetChecked in sources/techtarget-cybersecurity-news-366652444-php2shell-2/captures/20261023T232528Z/text.txt, sha256 9c9a0459deeccb0d.
- body, third-party words:
Palo Alto Networks said Wednesday it had identified more than 22.6 million exposed instances potentially vulnerable to the PHP2Shell flaws.
TechTargetChecked in sources/techtarget-cybersecurity-news-366652444-php2shell-2/captures/20261023T232528Z/text.txt, sha256 9c9a0459deeccb0d.
What the evidence shows. The body is right: Palo Alto Networks' Unit 42 counted instances that are potentially vulnerable, and has not published its method. The headline and standfirst drop both the attribution and the 'potentially'. Censys, which publishes its method, counted 1.57 million unpatched hosts among the 1.58 million whose PHP version it could read. TechTarget Japan's translation carries the same figure as a fact (R-011).
A wording we suggest. PHP2Shell: Palo Alto counts 22M exposed instances potentially at risk as emergency patches released
Fact-check: none; claims scale-2.6m-hosts. Channel: to find, TechTarget's published corrections route, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "PHP2Shell: 22M exposed servers at risk as emergency patches released"
Hello,
On 21 October 2026 you published: "PHP2Shell: 22M exposed servers at risk as emergency patches released"
(https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released)
We think this says more than the evidence shows: The headline and standfirst state 22 million vulnerable servers as a fact; the article's own body gives it as Palo Alto Networks' count of instances potentially vulnerable.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-012
A wording that would keep your piece accurate:
"PHP2Shell: Palo Alto counts 22M exposed instances potentially at risk as emergency patches released"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom at the 16:20 wake from a capture promoted today; it is the English original of TechTarget Japan's article (R-011, same author)