When the fact-check desk finds that another publisher's words say more than the evidence shows, this site asks them, politely and with the evidence, to correct the wording. Each request is published here before any message is sent: what they said, quoted from a dated capture with its hash; what the evidence shows; a wording they can use; and where the request stands. The data is CC BY 4.0 and theirs to use. If we are the ones who are wrong, our page is corrected first.
The requests
One point to one publisher each. The origin of an error is asked first; the outlets that repeated it are told what the origin said. A request that waits on this site fixing the same error first says so.
R-001: Wiz (Wiz Research) drafted origin
The point. The headline says the flaws affect 70% of the Internet; the post's own body says PHP powers 70% of all websites.
What they published.
- blog headline, third-party words:
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
WizChecked in sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt, sha256 e3568b6f88c93f6b.
- blog body, third-party words:
a popular general-purpose scripting language that powers 70% of all websites in the world.
WizChecked in sources/wiz-blog-php2shell/captures/20261022T081047Z/text.txt, sha256 e3568b6f88c93f6b.
- post on X, third-party words:
a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.
Wiz on XChecked in sources/x-wiz-io-php2shell/captures/20261022T081624Z/text.txt, sha256 6c17977662815b0c.
What the evidence shows. The 70% is the usual web-technology survey figure: the share of websites whose server-side language is known that use PHP (Cloudflare links it to W3Techs; Tenable and Imperva name W3Techs, at 69.3% and over 69%). It is a share of websites, not of hosts, traffic or the Internet, and it counts sites that use PHP at all, not installations running an affected version. Every outlet in our evidence vault that carries the figure traces back to this post.
A wording we suggest. PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP, the language behind about 70% of websites whose server-side language is known
Fact-check: K-001, Contradiction-1; claims scale-70pc-internet, scale-70pc-websites. Channel: to find, Wiz's published press or research contact, from its own site; captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70%..."
Hello,
On 21 October 2026 you published: "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet"
(https://www.wiz.io/blog/php2shell-php-rce)
We think this says more than the evidence shows: The headline says the flaws affect 70% of the Internet; the post's own body says PHP powers 70% of all websites.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
A wording that would keep your piece accurate:
"PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP, the language behind about 70% of websites whose server-side language is known"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-22 drafted from contradiction K-001 (fact-check run 1); blocked until this site's own claim stops dropping the survey's population (Finding-33) and stops attributing 'roughly' to Wiz (Finding-102)
- 2026-10-24 unblocked: this site's own wording fixed in data/claims.json and the front page (Finding-33, Finding-102), by desk@php.newsroom on the editor's instruction; the fact-check desk to confirm at its next run. Ready for the editor to send.
R-002: BBC News drafted echo
The point. The live page puts "roughly 70%" in quotation marks as Wiz's estimate; Wiz's own words have no "roughly", and the 70% is a share of websites using PHP, not a measure of how much of the internet is affected.
What they published.
What the evidence shows. The words in quotation marks are not in either capture of Wiz's own words: the blog headline and the X post say '70% of the Internet', the blog body says '70% of all websites in the world'. The figure itself is a survey's share of websites whose server-side language is known that use PHP, not a share of the internet affected. The BBC's own caveat, that it could not verify the figure, is right and is kept in the suggestion.
A wording we suggest. with cyber-security firm Wiz saying the flaws affect "70% of the Internet", a figure that matches surveys of how many websites use PHP rather than a count of vulnerable systems, and that the BBC has been unable to independently verify.
Fact-check: K-001, Contradiction-1, Finding-124; claims scale-70pc-internet. Channel: to find, the BBC's published corrections and complaints route; captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "with cyber-security firm Wiz estimating that "roughly 70%" of the..."
Hello,
On 22 October 2026 you published: "with cyber-security firm Wiz estimating that "roughly 70%" of the internet is affected, though the BBC is unable to independently verify that figure."
(https://www.bbc.co.uk/news/live/ckgel5xp2xv9t)
We think this says more than the evidence shows: The live page puts "roughly 70%" in quotation marks as Wiz's estimate; Wiz's own words have no "roughly", and the 70% is a share of websites using PHP, not a measure of how much of the internet is affected.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-002
A wording that would keep your piece accurate:
"with cyber-security firm Wiz saying the flaws affect "70% of the Internet", a figure that matches surveys of how many websites use PHP rather than a count of vulnerable systems, and that the BBC has been unable to independently verify."
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-22 drafted from contradiction K-001 and Finding-124; waits for the origin (R-001) to be asked first, and for this site's own claim to stop repeating the BBC's 'roughly' (Finding-102)
- 2026-10-24 this site's 'roughly' fixed (Finding-102); ready, to send after R-001
R-003: CNN Business drafted echo
The point. The headline says the flaw affects 70% of the internet; the article's own body gives the figure as the share of websites PHP powers.
What they published.
- headline, third-party words:
Websites shut down globally after AI finds a critical flaw affecting 70% of the internet
CNNChecked in sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt, sha256 ee49fc4265ae1c7c.
- body, third-party words:
a programming language that powers 70% of all websites in the world
CNNChecked in sources/cnn-php2shell-websites-shut/captures/20261022T112616Z/text.txt, sha256 ee49fc4265ae1c7c.
What the evidence shows. The same survey figure as R-001, restated from Wiz: a share of websites that use PHP, not a share of the internet affected. CNN's own body gives it correctly: PHP 'powers 70% of all websites in the world'.
A wording we suggest. Websites shut down globally after AI finds a critical flaw in PHP, the language behind about 70% of websites
Fact-check: K-001, Contradiction-1; claims scale-70pc-internet. Channel: to find, CNN's published corrections route; captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "Websites shut down globally after AI finds a critical flaw..."
Hello,
On 21 October 2026 you published: "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet"
(https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl)
We think this says more than the evidence shows: The headline says the flaw affects 70% of the internet; the article's own body gives the figure as the share of websites PHP powers.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-003
A wording that would keep your piece accurate:
"Websites shut down globally after AI finds a critical flaw in PHP, the language behind about 70% of websites"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-22 drafted from contradiction K-001; the headline and body still to be checked in the 11:26 UTC capture
- 2026-10-24 headline and body checked character for character in the 11:26 UTC capture by desk@php.newsroom; ready, to send after R-001
R-004: Amazon Web Services (AWS Security Blog) drafted origin
The point. The post says PHP2Shell "is now being broadly exploited in the wild"; the same post says it is unclear whether any of the attempts it saw would have succeeded. Readers, and WIRED's headline, take "exploited" to mean successful attacks.
What they published.
- post, third-party words:
PHP2Shell is now being broadly exploited in the wild.
AmazonChecked in sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt, sha256 94315ded6e1175f2.
- post, earlier, third-party words:
Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.
AmazonChecked in sources/aws-security-blog-madpot/captures/20261022T111755Z/text.txt, sha256 94315ded6e1175f2.
What the evidence shows. AWS's sensors saw exploitation attempts, before and after the release; its own post leaves open whether any succeeded. The PHP Foundation told WIRED it knows of no successful remote code execution, CISA had not observed exploitation, and no named organisation has said it was compromised (this site's /compromise/ page). This is a request to clarify a word, not to change a finding.
A wording we suggest. PHP2Shell exploitation attempts are now widespread in the wild; whether any have succeeded against real systems is not yet known.
Fact-check: K-002; claims amazon-honeypot, no-confirmed-compromise. Channel: to find, the AWS Security Blog's published contact, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "PHP2Shell is now being broadly exploited in the wild."
Hello,
On 21 October 2026 you published: "PHP2Shell is now being broadly exploited in the wild."
(https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/)
We think this says more than the evidence shows: The post says PHP2Shell "is now being broadly exploited in the wild"; the same post says it is unclear whether any of the attempts it saw would have succeeded. Readers, and WIRED's headline, take "exploited" to mean successful attacks.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-004
A wording that would keep your piece accurate:
"PHP2Shell exploitation attempts are now widespread in the wild; whether any have succeeded against real systems is not yet known."
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom: the word 'exploited' in WIRED's headline is AWS's, so AWS is asked first
R-005: WIRED drafted echo
The point. The headline says hackers exploited the flaws; the article's own sources (AWS, the PHP Foundation) describe attempts and know of no successful attack.
What they published.
- headline, third-party words:
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
WIREDChecked in sources/wired-exploited-days-before-patched/captures/20261023T012042Z/text.txt, sha256 d43b99af65d563dd.
- body, quoting the PHP Foundation, third-party words:
to our knowledge, there has been no successful attempt at remote code execution.
WIREDChecked in sources/wired-exploited-days-before-patched/captures/20261023T012042Z/text.txt, sha256 d43b99af65d563dd.
What the evidence shows. The body is careful: AWS 'logged attempts', and the PHP Foundation knows of 'no successful attempt at remote code execution'. Only the headline says exploited, following AWS's own wording (R-004).
A wording we suggest. Hackers Tried to Exploit the PHP Vulnerabilities Days Before They Were Patched
Fact-check: K-002; claims amazon-honeypot, no-confirmed-compromise. Channel: to find, WIRED's published corrections address, captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "Hackers Exploited the PHP Vulnerabilities Days Before They Were..."
Hello,
On 21 October 2026 you published: "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched"
(https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/)
We think this says more than the evidence shows: The headline says hackers exploited the flaws; the article's own sources (AWS, the PHP Foundation) describe attempts and know of no successful attack.
The wording starts with Amazon Web Services (AWS Security Blog), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-004
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-005
A wording that would keep your piece accurate:
"Hackers Tried to Exploit the PHP Vulnerabilities Days Before They Were Patched"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quotes checked; to send after R-004
R-006: BankInfoSecurity (ISMG) drafted origin
The point. The headline says attackers exploit the flaws and that systems are under attack; on 21 October no source had shown a successful attack, and none has since.
What they published.
What the evidence shows. What was seen were attempts: CISA had not observed exploitation, the PHP Foundation knows of no successful remote code execution, and neither CVE is in CISA's catalogue of known exploited vulnerabilities as of this site's latest check.
A wording we suggest. Attackers Target Leaked Zero-Day Flaws in Widely Used PHP
Fact-check: K-002; claims no-confirmed-compromise. Channel: to find, ISMG's published corrections route, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP"
Hello,
On 21 October 2026 you published: "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP"
(https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161)
We think this says more than the evidence shows: The headline says attackers exploit the flaws and that systems are under attack; on 21 October no source had shown a successful attack, and none has since.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-006
A wording that would keep your piece accurate:
"Attackers Target Leaked Zero-Day Flaws in Widely Used PHP"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked
R-007: The Hacker News blocked origin
The point. The article says a proof-of-concept exploit leaked ahead of the release; the PHP Foundation says no technical details leaked.
What they published.
What the evidence shows. The PHP Foundation's post says no technical details leaked; no saved copy shows a leaked exploit. The fact-check desk holds this as an open contradiction (K-009), so the request waits until the desk settles it.
A wording we suggest. details about the CVE identifiers leaked ahead of time
Fact-check: K-009. Channel: to find, The Hacker News's published contact, captured before use.
Waiting on.
Log.
- 2026-10-24 drafted by desk@php.newsroom; blocked while K-009 is open
R-008: Fortune drafted echo
The point. The headline says the flaw could take down 70% of the internet; the 70% is the share of websites that use PHP, not a share of the internet that could go down.
What they published.
What the evidence shows. As R-001: the 70% is the usual survey figure for websites whose server-side language is known, restated from Wiz's headline. Nobody has measured how many sites are vulnerable, and the flaws let an attacker run code on a server, not take the internet down.
A wording we suggest. AI tools discovered a vulnerability in PHP, the language behind about 70% of websites
Fact-check: K-001; claims scale-70pc-internet, scale-70pc-websites. Channel: to find, Fortune's published corrections route, captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "AI tools discovered the PHP vulnerability that could take down 70%..."
Hello,
On 21 October 2026 you published: "AI tools discovered the PHP vulnerability that could take down 70% of the internet"
(https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/)
We think this says more than the evidence shows: The headline says the flaw could take down 70% of the internet; the 70% is the share of websites that use PHP, not a share of the internet that could go down.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-008
A wording that would keep your piece accurate:
"AI tools discovered a vulnerability in PHP, the language behind about 70% of websites"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; to send after R-001
R-009: Clarín (English edition) drafted echo
The point. The headline says the flaw threatens 70% of the internet; the 70% is the share of websites that use PHP.
What they published.
What the evidence shows. As R-001: a survey's share of websites using PHP, restated from Wiz, not a measure of what is threatened.
A wording we suggest. How AI uncovered a 14-year-old flaw in PHP, the language behind about 70% of websites
Fact-check: K-001; claims scale-70pc-internet. Channel: to find, Clarín's published corrections route, captured before use.
Waiting on.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "How AI uncovered a massive 14-year-old flaw threatening 70% of the..."
Hello,
On 22 October 2026 you published: "How AI uncovered a massive 14-year-old flaw threatening 70% of the internet"
(https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html)
We think this says more than the evidence shows: The headline says the flaw threatens 70% of the internet; the 70% is the share of websites that use PHP.
The wording starts with Wiz (Wiz Research), which we have asked separately: https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-001
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-009
A wording that would keep your piece accurate:
"How AI uncovered a 14-year-old flaw in PHP, the language behind about 70% of websites"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; to send after R-001
R-010: Le Temps drafted origin
The point. The headline says millions of sites were taken offline; no source counts more than a few dozen sites and a handful of government platforms.
What they published.
What the evidence shows. This site holds ten reports of sites taken offline, some a single site and some a whole government's platform, and a community tracker lists about fifty sites that went dark and came back. Millions of sites run PHP; nothing shows millions were switched off.
A wording we suggest. des sites, dont des portails publics, sont débranchés par précaution à cause de failles majeures au cœur de PHP
Fact-check: K-006. Channel: to find, Le Temps's published corrections route, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "des millions de sites sont débranchés en urgence à cause de..."
Hello,
You published: "des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP"
(https://letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php)
We think this says more than the evidence shows: The headline says millions of sites were taken offline; no source counts more than a few dozen sites and a handful of government platforms.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-010
A wording that would keep your piece accurate:
"des sites, dont des portails publics, sont débranchés par précaution à cause de failles majeures au cœur de PHP"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; the request is in English, the suggested wording in French
R-011: TechTarget Japan (ITmedia) drafted echo
The point. The article says more than 22 million servers were put at risk, as a fact; the figure is one company's estimate of systems that could be vulnerable, with no published method.
What they published.
What the evidence shows. The 22.6 million is Palo Alto Networks Unit 42's count of systems that 'could be vulnerable', as relayed by Insurance Business; its method is not published. Censys, which does publish its method, counted 1.57 million unpatched hosts among the 1.58 million whose version it could read.
A wording we suggest. Palo Alto Networks Unit 42の推計では、最大2260万件のシステムが脆弱な可能性がある（算出方法は非公開）。
Fact-check: none; claims scale-2.6m-hosts. Channel: to find, ITmedia's published corrections route, captured before use.
The email to send (the editor sends it, from the editor's own address, to the channel above)
Subject: A suggested correction: "2200万台以上のサーバが危険にさらされた"
Hello,
On 23 October 2026 you published: "2200万台以上のサーバが危険にさらされた"
(https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/)
We think this says more than the evidence shows: The article says more than 22 million servers were put at risk, as a fact; the figure is one company's estimate of systems that could be vulnerable, with no published method.
The evidence, with the saved copies we checked and their hashes, is here:
https://php.oct.2026.newsroom.sgit.ai/outreach/index.html#R-011
A wording that would keep your piece accurate:
"Palo Alto Networks Unit 42の推計では、最大2260万件のシステムが脆弱な可能性がある（算出方法は非公開）。"
The data is CC BY 4.0; use any of it with a credit to php.oct.2026.newsroom.sgit.ai. If we have this wrong, tell us and we will correct our page.
Dinis Cruz
Editor, PHP October 2026 (php.oct.2026.newsroom.sgit.ai)
Log.
- 2026-10-24 drafted by desk@php.newsroom, quote checked; the suggested wording in Japanese is the desk's translation, for a native reader to check before sending