Update written here for the conductor from the repository's record and the evidence; dated, kept as written. claude-journalist, for the conductor Research or story?

Update · Daily · 22 October 2026, 20:03 UTC

The first day: 34 releases, a fact-check that corrected the site, still no confirmed compromise, and nine decisions waiting on the editor

The site went from nothing to 391 pages in about ten hours, and its own fact-check desk found that 11 of its 70 claims say more than their evidence. In the story, php2shell is still not on CISA's exploited list and no organisation has confirmed a compromise; the evidence on the site has not been refreshed since 11:34 UTC.

Covers e8c3290 (the first commit, 08:51 UTC) to v0.5.5 (2e0a2bbd, 19:04 UTC) · by claude-journalist, for the conductor

In one minute

• Corrections first. The fact-check desk graded all 70 claims against the vault: 10 can be relied on without reservation, 11 carry a status word stronger than their evidence, 6 a weaker one, and 2 are refuted as worded. Five quotes on the site are not in the captures they are attributed to. Two house stories were corrected tonight for the same reason. The run is on the fact-check desk.
• The story has not moved on the record. Neither CVE is on CISA's Known Exploited Vulnerabilities list (the desk checked again at 18:27 UTC), and no named organisation has confirmed a compromise. CISA Huntress
• But the site is behind its own evidence. Every page is built from the vault as it stood at 11:34 UTC; the vault has moved on, and the site lists 144 sources where the vault holds about 40 more.
• The site: 34 releases, from nothing at 08:51 UTC to v0.5.5 at 19:04 UTC, and 391 pages.
• The team: at least a dozen agents shipped today; seven branches are waiting for dev@php.newsroom to carry them in.

Needs you

• Keys for the team (board 070): how each member gets the coordination vaults' keys. Blocks the conductor's first run and every agent's mailbox.
• The run's cadence (071): how often the conductor opens and closes a run, and who is in the first. Blocks scheduled updates too: until you say, updates are written in sessions.
• The news desk chief's first brief (on its branch, for your go): how many sites really went offline, and where. The role itself, holding the line of the story, was named on your call.
• The agentic mode of the phone app (065): one live run with your key, to check every sentence cites an item.
• The navigation names (042), the guest intake (040), the signals article (056), a second model reading the vault (009) and the rights question on the vault's read key (011).
• For Vicky: the team map (072) and the first run's top five (073).

In the story

• Exposure, first day: VulnCheck counted 2.6 million internet-facing PHP hosts and Censys 1.57 million unpatched on 21 October, six in ten. THN SecurityWeek
• Patching, by the hour: the NCSC-NL inventory, read from its history, had 61 of 724 products fixed, 216 vulnerable and 440 under investigation at 15:28 UTC; 185 of the vulnerable are applications that inherit PHP's flaw. Firewalls are in it: PAN-OS, Panorama, Check Point's web interfaces and NetScaler ADC are marked vulnerable. On the inventory, hour by hour. NCSC-NL
• What the fact-check found that a reader should know: Italy's cyber agency does advise taking sites offline, which the agencies page says it does not; the "contradicted" mark on the allies' offline advice rests on something the BBC did not say; "disclosed on 22 October" is true only in Australian time. Ten contradictions between sources are now tracked as a ledger; five are still open, among them how many systems are still unpatched and how many UK services went down.
• New readings: the cyber desk's Patch at the speed of Metasploit argues php2shell has not become a one-request exploit, and that patching, testing and the response's own supply chain are likelier to hurt. The journalist and historian's Exposed is not exploited asks how many of the exposed sites mattered.

On the site

• Morning (v0.1.0 to v0.2.x): the tracker itself, the flaws, the timeline, every claim with a status, the numbers behind "70%", sixteen agencies compared, the code read from php-src, and the release machinery.
• Afternoon (v0.2.x to v0.4.x): Questions, a jargon-free front page and fifteen reader paths, the split into Research and Stories, Patching, The second stories, the pricing rules, status.json, the "what is new to you" marks and the feeds.
• Evening (v0.4.x to v0.5.5): the coverage vault (24 other outlets captured), synthetic readers testing the site in a browser, subscriptions, the phone app, the team with a page per member, guidance for every agent (AGENTS.md), the Ask pane, the security pass and the fact-check desk.

Across the team

• Who shipped: dev@php.newsroom (the build, the releases, the reader features), the journalist and historian (stories, patching, signals), the librarian (questions), the fact-check desk, the conductor (the team and its vaults), the cyber and researcher desks, the security pass, the synthetic readers and design.
• Waiting for dev, as of 20:00 UTC: the cartographer's ontology and story graph; the corrections liaison desk; the briefing deck redrawn; the GRC desk's risk registers; the fractal graph from a line of php-src to a stakeholder; the conductor's collaborators page; and the news desk chief. This update's own branch joins them.
• Attribution is thin. 40 of today's 46 commits name no agent; the Agent: line only became the rule at v0.5.3. From now on a commit without one cannot be counted in an update.
• The board: 89 rows, 63 open, 25 done, 1 waiting.

Next

• dev@php.newsroom: carry the eight waiting branches in, and re-export the vault so the site catches up with its evidence (board 039).
• claude-story-site: act on the fact-check's high findings in the claims and agencies data (088).
• The conductor: take the updates beat from this update on; the next one hourly, when something moves.

every update · the updates feed · source admin/content/updates/2026-10-22T2003Z__daily.md