Wikipedia's PHP2Shell article, read as one of its reviewers would

The article should change (2)

1. R-01 · lead · correction · WP:V WP:BURDEN MOS:WEASEL WP:NPOV

   The vulnerabilities are estimated to affect nearly 70% of websites. hedged

   Uncited, and it states as a count of affected sites what is a usage share: W3Techs measures the share of websites with a known server-side language that use PHP (69.3% when the story broke); a patched site is not affected. The figure's one origin is Wiz, whose own post turned 'powers 70% of websites' into '70% of the Internet'; every outlet carrying it restates Wiz. The article's own Impact section already states the measure correctly and cites it.

   This site's claims: scale-70pc-internet unverified, scale-70pc-websites reported

   Contradictions: K-001: How much of the web: 70% of websites, or 70% of the Internet? (explained), K-012: What does W3Techs say: 69.3% or 75%? (explained)

   Captured pages: Wiz Wiz on X Cloudflare OpenAI on X

   The fact-check desk: scale-70pc-internet: unverified; K-001 explained as one origin restated

   Change proposed: Replace with the Impact section's wording and citation: 'PHP is used by about 69% of websites whose server-side language is known (W3Techs)'; drop 'estimated to affect'. Reference: W3Techs' PHP usage page (not yet captured here, board 288).

2. R-02 · discovery · correction · WP:V WP:PRIMARY WP:DUE

   The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud. quote

   The primary record credits four reporters, not two: the GitHub security advisories name lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion. The PHP Foundation's account says OpenAI reported the same root cause on 11 August, and Chainguard's CEO has said his team found the bugs independently with an AI harness. 'Two parties' is the account of two newspapers, against the project's own credits.

   This site's claims: four-reporters confirmed, who-first confirmed, openai-same-day reported, lorenc-ai-found reported

   Captured pages: PHP PHP PHP Foundation The Register

   The fact-check desk: four-reporters: holds, A6; who-first: holds in part, A3; openai-same-day: holds, A2, disputed

   Change proposed: Say the advisories credit four reporters (name them as the advisories do), that Calif reported first (11 August, per the Foundation), and that OpenAI and Wiz reported independently; cite the two GitHub advisories as the primary record for the credits, and the Foundation's post for the dates.

The article should attribute or qualify (6)

1. R-03 · discovery · correction · WP:V WP:SOURCESDIFFER

   A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized. hedged

   The PHP Foundation attributes the 2024 finding of the out-of-memory issue to a security audit by Quarkslab, funded through OSTIF and the Sovereign Tech Agency, and says exploitation was not thought feasible then; Quarkslab's published summary lists 27 findings with two redacted. 'A PHP core developer' is The Next Web's paraphrase. The two accounts can both be given, attributed.

   This site's claims: quarkslab-2024 confirmed, quarkslab-redacted reported

   Captured pages: PHP Foundation Quarkslab

   The fact-check desk: quarkslab-2024: holds in part, A2; quarkslab-redacted: holds, A6

   Change proposed: Attribute: 'According to the PHP Foundation, the out-of-memory issue was found in a 2024 security audit by Quarkslab, funded by OSTIF and the Sovereign Tech Agency, and left unfixed because an exploit was not thought feasible'; cite the Foundation's post and Quarkslab's summary.

2. R-04 · discovery · correction · WP:V WP:DUE WP:RSBREAKING

   The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers, while security firm watchTowr rated it a full 10.0. record

   The official scores are 9.2 (CVSS 4.0, by the PHP security team as the CVE numbering authority) and 9.8 (CVSS 3.1, by NIST, which disagrees on one input: attack complexity). The 10.0 was the figure that circulated in the leak on 20 October, before publication, which Alexandre Daubois of the PHP security team describes as wrong; presenting it as watchTowr's rating gives a leaked, retracted number the standing of an assessment.

   This site's claims: cvss-10 contradicted, two-cves-9.2 confirmed, ac-high confirmed

   Contradictions: K-007: How severe: CVSS 10.0, 9.2 or 9.8? (explained)

   Captured pages: CVE record CVE record NVD Daubois

   The fact-check desk: cvss-10: refuted, A0; two-cves-9.2: holds, A6; K-007 explained

   Change proposed: State the two official scores with their scales and scorers ('9.2 under CVSS 4.0 by the PHP security team; 9.8 under CVSS 3.1 by NIST, which rated the attack complexity low') and, if the leak is mentioned, that a score of 10.0 circulated before publication and was wrong; cite the CVE records and NVD.

3. R-05 · lead · attribution · WP:SOURCESDIFFER WP:V

   PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619) concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE) by a potential malicious user to gain remote control of the website host. record

   'PHP versions 5.4–8.5' is one framing (Wiz, Cloudflare). The CVE records list only the supported branches 8.2 to 8.5; the PHP project published source patches for 7.4 to 8.1; CERT-FR lists 5.x, 6.x, 7.x, 8.0 and 8.1 as affected; NCSC-NL's inventory tracks 674 products. Affected, supported and patched are three lists, and a talk-page thread asks exactly this ('Is PHP 5.3 affected or excluded?').

   This site's claims: versions-old disputed, two-cves-9.2 confirmed, scale-ncsc-nl confirmed

   Contradictions: K-003: Which PHP versions are affected? (explained)

   Captured pages: CVE record CERT-FR php.net Cloudflare NCSC-NL

   The fact-check desk: versions-old: holds in part, A3, disputed; K-003 explained

   Change proposed: Qualify the range: 'affecting supported PHP versions 8.2 to 8.5 (with source patches for 7.4 to 8.1); Wiz and Cloudflare report versions as early as 5.4 are affected'; cite the CVE records for the supported list and CERT-FR for the older branches. This also answers the talk-page question.

4. R-06 · patches · attribution · WP:NPOV WP:SYNTH WP:SOURCESDIFFER

   Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed. stated

   That Chainguard's early images 'allowed attackers to determine what code had been changed' is the PHP Foundation's account; Chainguard's CEO accepts the time and denies leaking, and proof-of-concept material was already circulating from the leaked video on 20 October, before the images. Stated in Wikipedia's voice, a contested causal claim reads as fact.

   This site's claims: chainguard disputed, leak-video reported, lorenc-ai-found reported

   Captured pages: PHP Foundation Feross Aboukhadijeh on X on X The Register

   The fact-check desk: chainguard: holds in part, A3, disputed

   Change proposed: Attribute both sides: 'The PHP Foundation said Chainguard's publication of patched images at 07:41 UTC, before the coordinated release, let others see what had changed; Chainguard's chief executive, Dan Lorenc, accepted the timing and denied leaking.' Cite the Foundation's post and The Register.

5. R-07 · patches · missing · WP:DUE WP:V

   The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums, in a post on X (formerly Twitter) by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif. stated

   The article does not say that the release itself was brought forward by a day because of the leak, from 22 October 14:00 UTC to 21 October 14:00 UTC, which the Foundation states and the pre-announcement implies; the sequence on 20 October (CVE ids circulating from about 15:00 UTC, the pre-announcement at 19:30 UTC, the video at about 20:00 UTC) is also available from captures.

   This site's claims: release-moved confirmed, preannounce-time disputed, leak-cve-ids reported, leak-video reported

   Captured pages: PHP Foundation php.net oss-security

   The fact-check desk: release-moved: holds, A4; preannounce-time: holds, A2, disputed

   Change proposed: Add: 'The release, planned for 22 October, was brought forward to 21 October 14:00 UTC after the leak'; cite the Foundation's post.

6. R-08 · impact · attribution · WP:SOURCESDIFFER WP:INTEGRITY

   Following advice from CERT-EU and the British National Cyber Security Centre (NCSC), many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry. stated

   The agencies' advice differed and the sentence folds it into one: the UK NCSC said to 'consider taking the system offline' where immediate remediation is not feasible; CERT-EU advised isolating internet-facing applications; the NSA and CISA said take systems offline if you cannot update. The fact-check desk found the BBC's own line attributes the offline advice to the NCSC alone. Which organisations acted on which advice is mostly not stated by the sources.

   This site's claims: offline-ncsc disputed, offline-allies contradicted, offline-nsa confirmed, offline-cisa confirmed, nl-offline reported, fi-offline reported

   Captured pages: NCSC UK CERT-EU NSA CISA valtori.fi

   The fact-check desk: offline-allies: holds in part, A1, contradicted as worded on this site; offline-ncsc: holds in part, A3

   Change proposed: Quote each agency's advice in its own words with its own citation (the four captures above carry them), and say organisations 'took sites offline as a precaution' without implying a single instruction.

Housekeeping (4)

1. R-09 · patches · check · WP:RSBREAKING WP:V

   Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure. record

   Amazon has revised the sentence of its post that this rests on; the fact-check desk marks the site's own claim 'superseded' and is waiting for the revised page to be captured. The attempt was from an anonymisation network against Amazon's own sensors, which Amazon's post says; 'four days before public disclosure' is Amazon's framing.

   This site's claims: amazon-honeypot reported, probing confirmed

   Contradictions: K-002: Is php2shell being exploited? (explained)

   Captured pages: Amazon

   The fact-check desk: amazon-honeypot: holds in part, A2, superseded

   Change proposed: Re-check the sentence against Amazon's current post and date it ('as Amazon reported on 22 October'); no change proposed until the revised page is read.

2. R-10 · impact · style · WP:BURDEN MOS:WEASEL

   The potential impacts of the vulnerability were widespread. stated

   Uncited and vague; the section's own cited sentences carry the point.

   Change proposed: Remove, or tag {{citation needed}}.

3. R-11 · analysis · style · MOS:WEASEL

   Czech volunteer Ondřej Surý was credited with playing a crucial role in automating the necessary patches. stated

   'Was credited' by whom: the cited piece is The Atlantic's.

   Change proposed: 'The Atlantic credited Ondřej Surý with ...' (attributed in text).

4. R-12 · lead · style · WP:BURDEN

   PHP is a popular programming language that many website and web application codebases are built upon. stated

   Uncited; the Impact section's W3Techs sentence supports it.

   Change proposed: Cite the same W3Techs reference, or let the wikilink to PHP carry it.

Holds against this site's evidence (3)

1. R-13 · patches · confirmation · WP:V

   Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC, 26 minutes before the announced release time, with the PHP website updated shortly thereafter. cPanel and CloudLinux released backports in their ecosystems. record

   This site's timeline, read from the captured advisories and tags, gives 13:34:13 UTC and 13:34:25 UTC for the two advisories, the signed tags at 13:35:38 UTC, the planned release 14:00 UTC: the sentence holds exactly.

   This site's claims: release-time disputed

   Captured pages: PHP PHP php-src

   The fact-check desk: release-time: holds in part, A2, disputed (on the planned time, not the advisories' time)

   Change proposed: None.

2. R-14 · patches · confirmation · WP:NPOV WP:SOURCESDIFFER

   Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network, while the US Cybersecurity and Infrastructure Security Agency said it had not observed exploitation as of the same day. attributed

   Both sides attributed in the text with their own sources: the model of how this site's contradiction K-002 reads (attempts against sensors versus observed exploitation of real systems).

   This site's claims: watchtowr-itw unverified, cisa-none confirmed

   Contradictions: K-002: Is php2shell being exploited? (explained)

   Captured pages: watchTowr CISA

   The fact-check desk: watchtowr-itw: holds, A6; cisa-none: holds, A6

   Change proposed: None; CISA's KEV catalogue still lists neither CVE, which could be added with a date.

3. R-15 · impact · confirmation · WP:V

   Approximately 69% of websites whose server-side programming language is known by W3Techs use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress.<ref name="Collier2026" details="Citing "></ref> PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications. stated

   The measure stated as W3Techs states it: the share of websites with a known server-side language. This is the sentence the lead should use (R-01).

   Contradictions: K-001: How much of the web: 70% of websites, or 70% of the Internet? (explained), K-012: What does W3Techs say: 69.3% or 75%? (explained)

   Change proposed: None.

Questions on the talk page, answered from the captures (3)

1. Is PHP 5.3 affected or excluded?

   Affected, supported and patched are three lists (K-003): the CVE records list 8.2 to 8.5; source patches cover 7.4 to 8.1; CERT-FR names 5.x, 6.x, 7.x, 8.0 and 8.1; Cloudflare and Wiz say 'as early as 5.4'. No captured source states 5.3 either way.

   Captured pages: CVE record CERT-FR php.net Cloudflare

2. Is the attack still ongoing?

   Exploitation attempts are reported in the millions (Cloudflare, Amazon, ELLIO, CERT.LV); as of 16:05 UTC on 24 October no named organisation has said it was compromised through php2shell, and neither CVE is in CISA's KEV catalogue (data/compromise.json, 33 rows).

   Captured pages: Cloudflare Amazon CISA CERT.LV

3. Diagram explaining the attack

   The code-review map of the fix (the flaws, the design of the patch, the files changed) is drawn by a script from the fix commit's diff, under CC BY 4.0; a human could offer it, since Wikipedia's rule on original images excludes images wholly generated by AI but not drawings built by code from a published diff. Any upload and its licensing would be the human contributor's.

   Captured pages: php/php-src, read from a clone

What this site holds that the article does not say (8)

Claims of this site, each with its own captures and the fact-check desk's status, on matters the article does not cover. Whether any belongs in the article is for its editors: Wikipedia weighs what reliable secondary sources have covered, not what a primary capture shows.

• cisa-none: CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog confirmed
• scale-ncsc-nl: 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable confirmed
• latvia-offline: Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTC confirmed
• scale-latvia: About 6,000 potentially affected resources in Latvia, a few hundred in the public sector reported
• release-moved: The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak confirmed
• waf-nine-hours: Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 October confirmed
• kev-precedent: The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one day reported
• quarkslab-2024: The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixed confirmed

The policies and guidelines named

Each in Wikipedia's own words, shortened; the links go to the policy pages.

What this review cannot see

26 of the article's 42 references are not captured in the vault (board 288); findings above rest only on captured pages. The review is of one revision; the article changes several times a day, and a finding is matched to its statement by its opening words, so a finding whose statement has since been reworded is marked as such above rather than dropped. The next pass of this site's ontologist re-reads the article against the same findings.