Interview: the editor: every version

# The editor, interviewed: Dinis Cruz on why this site exists

Dinis Cruz, the editor of PHP October 2026, on why he started tracking the PHP flaws, the 70% figure, what remote code execution does and does not mean, pulling the plug, and why every section of the site is versioned. In his own words.

About · interview

# The editor, interviewed: Dinis Cruz on why this site exists

Dinis Cruz has worked in application security for a long time and runs the SGit Newsroom. He started this site on the morning of 22 October 2026 with two voice memos and kept steering it through the day. The questions below are the ones a reader would ask; the answers are his.

How this was made: the questions are written by the agent that builds the site; every answer is the editor's own words, quoted verbatim from his voice memos and voice notes of 22 October as transcribed, including the hesitations. Nothing was paraphrased. A live interview is pending, and its questions are at the foot of the page.

### Why cover this story at all?

Okay, so there's a big vulnerability flying around at the moment, and I would like to use this as a good case study for what we can do in the newsroom. But it's also a good way to explore other ways to visualise and to map a lot of this stuff.
Voice memo 1, 22 October 2026, transcribed by otter.ai, 0:00
### What made you doubt the coverage?

the BBC has that 70% of the internet is impacted, which is a crazy statement. Which then you look at the source, and the source says 70% of websites are impacted, and they look at it. Say 70% of websites that we can measure the language are impacted. Now, I've been in security and technology for a long time, and I and I could I don't buy that 70% of websites out there, especially some sort of websites that matter, that have a huge amount of information, are a impacted. B don't have other ways to protect this, right?
Voice memo 2, 22 October 2026, transcribed by otter.ai
### Is this about catching journalists out?

it's not about naming and shaming a lot of this stuff, but it's also about you know making sure that the data is actually correct, right, and the statement is actually correct, and also figuring out good ways to find sources and then follow the rabbit holes, and also in a way help journalists, right?
Voice memo 1, 22 October 2026, transcribed by otter.ai
### Remote code execution sounds like game over. Is it?

this does remote code execution on on a website, right? But it doesn't mean that the website is compromised. Well, everything is compromised from day one, right? But what means it means that that website is compromised. But it depends what you're going to do with it, right? Depends what's on either side. Depends what credential exists on that website.
Voice memo 1, 22 October 2026, transcribed by otter.ai, 5:04
### Can an attack like this be seen?

So you now have remote code execution, but then what signals do you have? Like you know, and this is important, right? It's important to understand that a zero day like this is not invisibility cloak, right? So we have to be objective, right?
Voice memo 1, 22 October 2026, transcribed by otter.ai, 5:04
### Should organisations take websites offline?

putting a website offline is an option, but should be like at the end of a long sequence of events, right? But also, it should be one of those things where companies should be able to do it very quickly, right? Like you know, this is the whole pull the plug, right? You know, like how fast can you pull the plug of a system, right?
Voice memo 2, 22 October 2026, transcribed by otter.ai
### What do you want to know now, a day in?

one of the things that I really want to know is that, like, what's new? Like, what's the latest? What's going on? Because I think some websites are starting to be attacked, some websites are starting to be compromised, which is bound to happen, right? So we need to also capture that information, and we need to capture that flow of the what's actually going on.
Voice note to the design agent, 22 October 2026, transcribed, afternoon
### Who is this site for?

if I'm an exec, if I'm a person, a project manager, then I don't know who that is, right? And so it's very important that we map the persona. It's very important that we map who the persona is, who's reading this, and then literally modify the website and modify the whole UI for that particular persona.
Voice note to the design agent, 22 October 2026, transcribed, midday
### Why call it PHP October and not php2shell?

this is about PHP news in October. It just happened to be that there's a massive security incident here, and maybe in the future we just move to the next month, we just track all this stuff, right?
Voice note to the design agent, 22 October 2026, transcribed, afternoon
### Why version every section of the site?

every major section, needs to now be version controlled, and we need to track it, and that means that every time that information changes, like the update that we run there, especially because some of that is going to be programmatically written, right? We should have the date and the version, and also which version of the website was that created.
Voice note to the design agent, 22 October 2026, transcribed, afternoon

## Not yet answered

The questions for the next round, in the editor's own time:
- If a named organisation confirms a compromise tomorrow, what should change on this site, and how fast?
- Which single number would you put in front of a board this week?
- What would change your mind about the 70% figure?
- Three teams found the same bug class with AI help within weeks. What does that mean for the next one?
- How fast should an organisation be able to pull the plug on one website, and how would you test it?