Wikipedia's PHP2Shell article, as a graph

Facts and the words around them

Wikipedia's own rule is that an article states facts and attributes opinions. Read by wording, never by whether a sentence holds, the 40 statements fall into five classes; 37 carry a reference and 24 rest on a page this site has captured. Every statement, with its evidence.

Statements with no reference (3)

• PHP is a popular programming language that many website and web application codebases are built upon.
• The vulnerabilities are estimated to affect nearly 70% of websites.
• The potential impacts of the vulnerability were widespread.

Where the article and this site meet

13 references are pages this site's claims also cite. A statement there and a claim here that rest on the same captured page meet at that page: there is no “same as” edge, the shared evidence is the join. Every reference.

• Wiz: cited by 0 statements there and by wordpress-drupal, scale-70pc-internet, scale-70pc-websites, ai-found, wiz-independent, most-severe here
• CVE record: cited by 1 statement there and by two-cves-9.2, cisa-none, ac-high here
• CVE record: cited by 1 statement there and by two-cves-9.2 here
• php.net: cited by 1 statement there and by two-cves-9.2, rce-modphp, only-update, disclosure-22oct, release-time, preannounce-time here
• php.net: cited by 5 statements there and by two-cves-9.2, rce-modphp, only-update, disclosure-22oct, release-time, preannounce-time here
• Recorded Future: cited by 1 statement there and by no-confirmed-compromise here
• PHP Foundation: cited by 1 statement there and by leak-cve-ids, leak-video here
• PHP: cited by 1 statement there and by two-cves-9.2, rce-modphp, rce-fpm, fix-bailout, openai-same-day, four-reporters, release-time, fix-engine here
• PHP: cited by 1 statement there and by two-cves-9.2, rce-fpm, only-update, four-reporters, fix-engine here
• Amazon: cited by 1 statement there and by amazon-honeypot, probing, no-confirmed-compromise here
• watchTowr: cited by 1 statement there and by watchtowr-itw here
• Huntress: cited by 1 statement there and by huntress-none, no-confirmed-compromise, pocs-wrong here
• NCSC UK: cited by 1 statement there and by offline-ncsc here

Contradictions this site records on that shared evidence (8)

• K-001: How much of the web: 70% of websites, or 70% of the Internet? (explained)
• K-002: Is php2shell being exploited? (explained)
• K-003: Which PHP versions are affected? (explained)
• K-007: How severe: CVSS 10.0, 9.2 or 9.8? (explained)
• K-008: Which flaw was shown to give code execution on PHP-FPM? (open)
• K-009: Did any technical detail leak on 20 October? (explained)
• K-010: When was the release planned, and when did it ship? (open)
• K-012: What does W3Techs say: 69.3% or 75%? (explained)

What changed since this site captured it

This site's evidence vault captured the article at 20261023T160435Z, when it was at revision 1381598302. Since then: 7 statements added, 3 removed, 3 reworded, 4 references added and 2 removed, over 44 revisions. Every edit.

41 of the 370 revisions were reverts or were reverted; 72 were marked minor; 1 were anonymous. The article is now 30,364 bytes.

The Wikidata item

Wikidata, the structured sister of Wikipedia, holds item Q141801185, “2026 security vulnerability in PHP”, with links to the article in 27 languages. Its claims, as fetched (DBpedia, the older extraction, is built from periodic dumps and had no entry for the article when this was built):

The article over time, and its talk page

The evolution: every statement ever written as a bar from the edit that added it to the edit that removed it, the size and references over time, and the Wikidata item's own history. The talk page: what the editors discuss, including the edit requests outside parties made with a disclosed conflict of interest. A reviewer's reading: the article against this site's captures, finding by finding, for a person to take to the talk page.

What links here

198 other articles link to this one, which is how a reader of Wikipedia arrives: from PHP, 2026, the lists of security incidents, the pages of the companies named. The list is in links-in.json.

Towards a measure of trust

The editor's working view is that Wikipedia is a trusted source, and that this should be shown rather than assumed: by how often its statements are later corrected, against how often other publications are. This page does not compute a score; it keeps the counts a proof would start from, and the fact-check desk grades statements, not pages. For this article: 37 of 40 statements cited (92%); 21 of 44 references captured here, 12 of those primary sources; 41 reverts in 370 revisions; 8 of this site's contradictions touch evidence the article also cites.

The text is Wikipedia's, CC BY-SA 4.0, by its contributors; the revision ids are the attribution, and this site's pages and data that carry it are under the same licence: this page uses material from the Wikipedia article “PHP2Shell” (link), released under the Creative Commons Attribution-Share-Alike License 4.0. It is republished so it can be read as a graph, diffed and followed to its evidence; nothing here is Wikipedia's view, and nothing on Wikipedia is this site's.