# Source: The Patch Is the Exploit - by David Lopez-Kurtz

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

David Lopez-Kurtz (Substack): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · other · secondary · captured

# The Patch Is the Exploit - by David Lopez-Kurtz

**David Lopez-Kurtz (Substack)** · [https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit](https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit) · published 2026-10 · added by `claude-story-site` · slug `substack-lopezkurtz-patch-is-the-exploit`

Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding.

## What it says, as the collector read it

#### The Patch Is the Exploit - by David Lopez-Kurtz

Captured by claude-story-site. Status: captured. Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding.

- Opinion piece; one specific checkable claim about the audit summary.

## Claims that cite it

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory findingThe Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself. [fact timeline →](../../facts/quarkslab-redacted/index.html) | Quarkslab's blog; a Substack analysis | reported | **A6** Established●●●●●● | 1/2 | [Quarkslab](../../sources/quarkslab-blog-php-src-audit/index.html) [David Lopez-Kurtz](../../sources/substack-lopezkurtz-patch-is-the-exploit/index.html) |

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T113134Z · HTTP 200 · https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit- `headers.json` 93831a587e5a9a37a455a49bb5bc1a735ffddbaa9462baecf8483bd621dc0d80 3,448 bytes
- `page.html` 77bae2f3d20efe5af0c1bf780b1c2618202d3da7941792444a8fbfed1d4a87f5 224,610 bytes
- `provenance.json` b49aa2b0f632867066da181f78cf57cd3495f0c1c9c7c7634875a04c5f86b5ff 1,023 bytes
- `rendered.html` 5a9958401f0de8caa87154eb38d082ae37fe969fe4928862d4e557f4bac4ba1e 263,845 bytes
- `screenshot.png` 4f94dc2329c6fd545b1a600cccfc7b2ce2db41deb2b8288403a9eec27e63dd56 3,979,940 bytes
- `text.txt` cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330 33,564 bytes
capture 20261025T070559Z · HTTP 200 · https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit- `headers.json` 291a03786f22e9ef3f0fbfcf09b0a35dcb8e7c85a0b9810e8f656c73de87d5e5 3,505 bytes
- `page.html` 36e4a823e30df237f0260fda544fb6e93b88ad7e498b73fec5981bf313269661 226,138 bytes
- `provenance.json` 2ae8be0697b36b3c625f6d55cf48465f7b16d2774caf6f062dd9050f7a7d7f7e 1,798 bytes
- `rendered.html` bab69619a3ab52770596118198b3dd28a8dc00ef00cb13bb268e604859efd40d 263,962 bytes
- `screenshot.jpg` a72392a29cacaabbb3774c72bcb58fec9b366695dbfe21c9296515f2fbbb3f9a 931,783 bytes
- `text.txt` ed681f55311835a718a1de42b7d825e0e266eacdea83474879bd56f7d5d27483 33,564 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/substack-lopezkurtz-patch-is-the-exploit/index.html