# Source: Tags · php/php-src

php/php-src on GitHub: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · code · primary · captured

# Tags · php/php-src

**php/php-src on GitHub** · [https://github.com/php/php-src/tags](https://github.com/php/php-src/tags) · published not stated · added by `collector-primary` · slug `github-php-src-tags`

Tags php-8.5.12, php-8.4.27, php-8.3.36, php-8.2.35 all show 'Verified' and tag dates of 2026-10-21 13:35:38 UTC; php-8.6.0RC4 at 14:57:44 UTC. php-8.5.12RC1 and php-8.4.27RC1 tags also exist.

## What it says, as the collector read it

#### php-src tags list: notes

- Captured 08:15Z. php-8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 are "Verified" (signed). Tag timestamps 2026-10-21 13:35:38 UTC. Underlying commits 19 Oct (14:00Z-17:04Z).

- RC tags php-8.5.12RC1 and php-8.4.27RC1 exist. Normal release practice; were they published before the embargo lifted? Not checked.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| The fixes were released at 14:00 UTC on 21 OctoberCERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. | php.net pre-announcement; Daubois; CERT-FR (16:00 Paris) | disputed | 7/8 | [oss-security](../../sources/openwall-oss-security-2026-10-20-34/index.html) [Daubois](../../sources/daubois-blog-php2shell-rumors/index.html) [CERT-FR](../../sources/certfr-2026-ale-014/index.html) [CERT-EU](../../sources/certeu-sa-2026-018/index.html) [php-src](../../sources/github-php-src-tags/index.html) [PHP](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html) [php-src](../../sources/github-php-src-tag-php-8.5.12/index.html) [php.net](../../sources/php-net-advisory/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-19 14:00 UTC | Release commits for 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are made under embargo (14:00 to 17:04 UTC). | stated |
| 2026-10-21 13:35:38 UTC | Signed tags php-8.5.12, php-8.4.27, php-8.3.36 and php-8.2.35 are created. | stated |

## The bytes
capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/tags- `headers.json` c1e8341353ae8ccbb1b8406734139fd6ade271a8ecb16de19cc396443719b543 5,449 bytes
- `page.html` 9dd05842513d6ae6569812a9aad0f4abef35733b14f8515c3b86b3d1fac53d49 279,656 bytes
- `provenance.json` fb3a77d83afa6bbbffbf5b0dba33cf24208559ef6dafc50b4fe37998fd225316 928 bytes
- `rendered.html` ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9 281,310 bytes
- `screenshot.png` 9208f3cecdd6dd08a577e0172d3a114ac84322533de8e95591e5b0694b085eda 125,085 bytes
- `text.txt` 850531b6512cfe4d37a2bb6b7fdcd37ec9cbb42ed6ceea172d081be054e28c61 924 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/github-php-src-tags/index.html