Who says what: every version

# Who says what: every party and its claims

27 parties in the php2shell story, each with the claims this site attributes to it and the sources behind them.

# Who says what

27 parties whose words this site quotes: maintainers, researchers, agencies, vendors, operators and reporters. Each has a page with the claims it makes, the sources those claims come from, and its own small graph. The count is of claims this site attributes to the party; a party with many claims and few primary sources is one whose word is being taken.

| Party | Role in the story | Claims | Sources |
|---|---|---|---|
| The PHP Group / php.net | maintainer, CVE numbering authority | 5 | php.net php.net php-src |
| The PHP Foundation | funds core developers; published the account of discovery and the leak | 0 | PHP Foundation |
| Jakub Zelenka (bukka), PHP security team | published both GitHub advisories and the oss-security announcements | 4 | PHP oss-security |
| Alexandre Daubois, PHP security team (personal blog) | inside account of the rumours and the leak | 4 | Daubois |
| Calif (Ryan Austin, @lcfr_hax; Michal Zalewski) | first reporter; published the write-up with demo videos | 5 | Calif Ryan Austin , Calif on X |
| OpenAI (Patch the Planet, Codex Security, Amy Burnett) | reported the same root cause on 11 August; ran the coordination coalition | 3 | OpenAI on X OpenAI OpenAI forum |
| Wiz Research | independent discovery 19 August; the '70% of the Internet' headline | 0 | Wiz Wiz on X |
| Quarkslab, OSTIF | 2024 audit that first surfaced the OOM issue | 1 | PHP Foundation Calif |
| Cloudflare | WAF rules live 9 hours early; saw attack traffic | 3 | Cloudflare |
| Amazon (CJ Moses) | honeypot evidence of a pre-disclosure attempt | 1 | THN |
| Chainguard | published patched images before the embargo lifted, per the Foundation | 1 | PHP Foundation Techzine |
| watchTowr | confirmed the CVE numbers in public on 20 October, per Daubois | 2 | Daubois CERT-EU |
| National agencies (NSA, CISA, NCSC UK, CERT-EU, CERT-FR, CCCS, ACSC, NCSC NZ, NCSC-NL, ACN, BACS, CERT.LV, JPCERT) | advisories; see the agency table | 11 | NSA CISA NCSC UK |
| BBC News (live page; Kieran Kelly, Imogen James) | the coverage most readers saw on the morning of 22 October | 0 | BBC News |
| Alan Woodward, Surrey Centre for Cyber Security | commentator quoted by the BBC: 30 million websites; probing seen by Amazon and Cloudflare | 2 | BBC News |
| The Hacker News (Ravie Lakshmanan) | carried Amazon's honeypot account and VulnCheck's host count | 1 | THN |
| Dan Lorenc, Chainguard | shipped patched images early; says exploits were in the wild and denies leaking | 2 | The Register Feross Aboukhadijeh on X on X |
| Matthew Prince, Cloudflare CEO | the attempt counts | 1 | Matthew Prince , Cloudflare CEO on |
| Imperva Threat Research | had the details under embargo; saw nothing before disclosure | 1 | Imperva Threat Research |
| Fastly | the most candid vendor on exploitability and on what a WAF cannot do | 2 | Fastly |
| Akamai | rule 3000991; the 2024 precedent | 1 | Akamai Security Research Akamai Security Research |
| Huntress | no exploitation seen on partner systems | 2 | Huntress |
| Weird Gloop (cookmeplox) | the one operator with a measured outage | 1 | Weird Gloop |
| The Dutch government and NCSC-NL | took its own site offline | 3 | Rijksoverheid / NCSC-NL NCSC-NL |
| Valtori and NCSC-FI | Finland's precautionary shutdown | 1 | Yle Helsinki Times |
| Community detection authors (darkfibr, rjmendez, Lexsah, Blevene) | the rules, and the correction of the leaked PoC's mechanism | 1 | darkfibr , GitHub rjmendez, GitHub Lexsah, GitHub Blevene |
| Arnaud Le Blanc and the PHP fix authors | wrote the fix | 0 | php/php-src , read from a clone |