Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Wikipedia, as a graph / PHP2Shell
Wikipedia's PHP2Shell article, as a graph
The English Wikipedia article PHP2Shell, read as a fractal semantic graph: 39 statements in 5 sections, 43 references, 364 revisions by 173 named editors since 2026-10-21 07:50:01 UTC, and its Wikidata item. 16 of its 42 references are captured in this site's evidence vault, where 12 of them are also cited by this site's claims: that is where the article's facts and this site's meet. Latest revision read: 1381798757, 2026-10-24 21:41:44 UTC.
The interactive graph needs JavaScript. The same nodes are on every statement, every reference and every edit; the graph is graph.json.
Facts and the words around them
Wikipedia's own rule is that an article states facts and attributes opinions. Read by wording, never by whether a sentence holds, the 39 statements fall into five classes; 35 carry a reference and 17 rest on a page this site has captured. Every statement, with its evidence.
| Class | What it means | Statements |
|---|---|---|
| record | a number, a date, a version or an identifier, stated plainly | 9 |
| stated | a plain statement in the article's own voice | 15 |
| attributed | says a named party said, reported, estimated or believes it | 7 |
| quote | carries someone's words in quotation marks | 3 |
| hedged | may, could, reportedly, is believed, estimated to: the article being careful | 5 |
Statements with no reference (4)
- PHP is a popular programming language that many website and web application codebases are built upon.
- The vulnerabilities are estimated to affect nearly 70% of websites.
- Volunteer maintainer Ondřej Surý, who was given advance access to the fixes by the PHP project, prepared installable packages for old versio
- The potential impacts of the vulnerability were widespread.
Where the article and this site meet
12 references are pages this site's claims also cite. A statement there and a claim here that rest on the same captured page meet at that page: there is no “same as” edge, the shared evidence is the join. Every reference.
- Wiz: cited by 0 statements there and by wordpress-drupal, scale-70pc-internet, scale-70pc-websites, ai-found, wiz-independent, most-severe here
- CVE record: cited by 1 statement there and by two-cves-9.2, cisa-none, ac-high here
- CVE record: cited by 1 statement there and by two-cves-9.2 here
- php.net: cited by 1 statement there and by two-cves-9.2, rce-modphp, only-update, disclosure-22oct, release-time, preannounce-time here
- php.net: cited by 5 statements there and by two-cves-9.2, rce-modphp, only-update, disclosure-22oct, release-time, preannounce-time here
- PHP Foundation: cited by 1 statement there and by leak-cve-ids, leak-video here
- PHP: cited by 1 statement there and by two-cves-9.2, rce-modphp, rce-fpm, fix-bailout, openai-same-day, four-reporters, release-time, fix-engine here
- PHP: cited by 1 statement there and by two-cves-9.2, rce-fpm, only-update, four-reporters, fix-engine here
- Amazon: cited by 1 statement there and by amazon-honeypot, probing, no-confirmed-compromise here
- watchTowr: cited by 1 statement there and by watchtowr-itw here
- Huntress: cited by 1 statement there and by huntress-none, no-confirmed-compromise, pocs-wrong here
- NCSC UK: cited by 1 statement there and by offline-ncsc here
Contradictions this site records on that shared evidence (8)
- K-001: How much of the web: 70% of websites, or 70% of the Internet? (explained)
- K-002: Is php2shell being exploited? (explained)
- K-003: Which PHP versions are affected? (explained)
- K-007: How severe: CVSS 10.0, 9.2 or 9.8? (explained)
- K-008: Which flaw was shown to give code execution on PHP-FPM? (open)
- K-009: Did any technical detail leak on 20 October? (explained)
- K-010: When was the release planned, and when did it ship? (open)
- K-012: What does W3Techs say: 69.3% or 75%? (explained)
What changed since this site captured it
This site's evidence vault captured the article at 20261023T160435Z, when it was at revision 1381598302. Since then: 6 statements added, 3 removed, 3 reworded, 2 references added and 2 removed, over 38 revisions. Every edit.
41 of the 364 revisions were reverts or were reverted; 72 were marked minor; 1 were anonymous. The article is now 29,830 bytes.
The Wikidata item
Wikidata, the structured sister of Wikipedia, holds item Q141801185, “2026 security vulnerability in PHP”, with links to the article in 27 languages. Its claims, as fetched (DBpedia, the older extraction, is built from periodic dumps and had no entry for the article when this was built):
| Property | Id | Value |
|---|---|---|
| facet of | P1269 | computer security |
| has effect | P1542 | arbitrary code execution |
| uses | P2283 | PHP |
| instance of | P31 | named vulnerability |
| Common Vulnerabilities and Exposures ID | P3587 | CVE-2026-109618; CVE-2026-109619 |
| has use | P366 | arbitrary code execution |
| time of discovery or invention | P575 | +2026-08-01T00:00:00Z |
| discoverer or inventor | P61 | Wiz, Inc.; OpenAI; Calif |
| announcement date | P6949 | +2026-10-20T00:00:00Z |
| significant event | P793 | code patching |
| official website | P856 | https://www.php2shell.com/ |
| described at URL | P973 | https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp |
What links here
198 other articles link to this one, which is how a reader of Wikipedia arrives: from PHP, 2026, the lists of security incidents, the pages of the companies named. The list is in links-in.json.
Towards a measure of trust
The editor's working view is that Wikipedia is a trusted source, and that this should be shown rather than assumed: by how often its statements are later corrected, against how often other publications are. This page does not compute a score; it keeps the counts a proof would start from, and the fact-check desk grades statements, not pages. For this article: 35 of 39 statements cited (89%); 16 of 42 references captured here, 12 of those primary sources; 41 reverts in 364 revisions; 8 of this site's contradictions touch evidence the article also cites.
The text is Wikipedia's, CC BY-SA 4.0, by its contributors; the revision ids are the attribution, and this site's pages and data that carry it are under the same licence. It is republished so it can be read as a graph, diffed and followed to its evidence; nothing here is Wikipedia's view, and nothing on Wikipedia is this site's.