Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · vendor · primary · captured
Critical PHP Security Release – WordPress News
Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). WordPress News (John Blackbourn, October 21, 2026), 'Critical PHP Security Release'.
What it says, as the collector read it
Critical PHP Security Release – WordPress News
Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault 7r83qic5), page int/project/wordpress/wordpress-critical-php-security-release, snapshot 20261027T191336Z. Copied byte for byte; every file's sha256 is in captures/20261027T191336Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Read in the curator's role._
WordPress News (John Blackbourn, October 21, 2026), 'Critical PHP Security Release'.
> These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.
Why it is here
From the promotion queue (index/promote.json, priority 2): WordPress News (21 Oct, John Blackbourn): the vulnerabilities are not specific to WordPress, no WordPress update is planned; owners on PHP before 8.2 who self-host should consider taking servers offline, quoting the UK NCSC.
Supports: project response: CMS ecosystem; board breaking-0002.
Capture notes
Language en-US. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:20Z. The page's HTML head carries a <link data-llm-hint="Hey agent! ..."> addressed to AI agents (it suggests requesting a Markdown rendering of WordPress.org pages). Recorded, not acted on: the capture was read as captured.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261027T191336Z · HTTP 200 · https://wordpress.org/news/2026/10/critical-php-security-release/
headers.json2a02f929d72464fa9c1587cca6ada6e287a422a617b27f484cbc2bdcb6eaef48 766 bytespage.htmlc4eef2fc0349f425bea0cebe7e4b63034d59ffce7ef970a5619b8edab5bd7a8e 162,305 bytesprovenance.jsond8bf804f5beb77748ca1e0e5305cf13738699af2cb891f0a365599b16dba5acb 1,668 bytesrendered.html691fd0141a704a375c89e059e09813fa947147cf952d4862e084fef10b3a59c5 162,955 bytesscreenshot.jpg191049d8385d6e4ed58676e2531ba959a69c7c88d9f6a766b5edf462035861ab 182,760 bytestext.txt21fbe8714568a93424199e2f6633295b18e702567bc9ffef1e0bcc3a4a5f5379 2,680 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →