# Source: PHP Vulnerabilities and the ExpressionEngine Community | Blog | ExpressionEngine

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

ExpressionEngine (Packet Tide): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · secondary · captured

# PHP Vulnerabilities and the ExpressionEngine Community | Blog | ExpressionEngine

**ExpressionEngine (Packet Tide)** · [https://expressionengine.com/blog/php-vulnerabilities-and-the-expressionengine-community](https://expressionengine.com/blog/php-vulnerabilities-and-the-expressionengine-community) · published 2026-10-22 · added by `breaking@php.newsroom (curator's role)` · slug `expressionengine-php-vulnerabilities`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). ExpressionEngine blog (Tom Jaeger, '10/22/2026'): a community note, with a discounted licence offer.

## What it says, as the collector read it

#### PHP Vulnerabilities and the ExpressionEngine Community | Blog | ExpressionEngine

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/security-vendor/expressionengine/expressionengine-php-vulnerabilities`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

ExpressionEngine blog (Tom Jaeger, '10/22/2026'): a community note, with a discounted licence offer.

> The PHP community is recovering from the news of two high risk vulnerabilities disclosed ahead of schedule.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): ExpressionEngine blog (22 Oct, Tom Jaeger): community note on the two PHP vulnerabilities "disclosed ahead of schedule", with a discounted licence offer to help upgrades.

Supports: project response: CMS ecosystem; board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:13:45Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://expressionengine.com/blog/php-vulnerabilities-and-the-expressionengine-community- `headers.json` 23367b15c0b8a93c8dc663a4f438d502e5a632f862f3332cf38875d9abc617b8 1,491 bytes
- `page.html` d2af16b7b0ffac3d734de493523a83036db04e2204c441c65a484a76934f8a7b 20,431 bytes
- `provenance.json` 7845b1cf23db5f6f1e0f0ef04204b635cb4f08807d0ba622dcbea11008b24599 1,765 bytes
- `rendered.html` b3a189a170b12522fefb1537b9057f1865606f8ddd5b77a392685d6205c468dc 37,563 bytes
- `screenshot.jpg` 26e026214aa50b31ea25c655ecd91c2e994b839d4120fa50e24378dce43ff77c 220,181 bytes
- `text.txt` 9a21f9b89a2431411fa095735e0230dd931f8dd1562d1d8ff1248297bac51173 2,177 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/expressionengine-php-vulnerabilities/index.html