# Wikipedia's PHP2Shell article, as a graph > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. The English Wikipedia article on PHP2Shell read as a fractal semantic graph: 40 statements classed as facts, attributions and quotes, 45 references and which are captured here, 370 revisions, and where it meets this site's claims. [Wikipedia, as a graph](../index.html) / PHP2Shell # Wikipedia's PHP2Shell article, as a graph The English Wikipedia article [PHP2Shell](https://en.wikipedia.org/wiki/PHP2Shell), read as a fractal semantic graph: 40 statements in 5 sections, 45 references, 370 revisions by 178 named editors since 2026-10-21 07:50:01 UTC, and its Wikidata item. 21 of its 44 references are captured in this site's evidence vault, where 13 of them are also cited by this site's claims: that is where the article's facts and this site's meet. Latest revision read: `1381884195`, 2026-10-25 11:39:32 UTC. 40statements 37cited 45references 21captured here 370revisions 178editors 27languages The interactive graph needs JavaScript. The same nodes are on [every statement](statements/index.html), [every reference](references/index.html) and [every edit](history/index.html); the graph is [graph.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.19/wikipedia/php2shell/graph.json). ## Facts and the words around them Wikipedia's own rule is that an article states facts and attributes opinions. Read by wording, never by whether a sentence holds, the 40 statements fall into five classes; 37 carry a reference and 24 rest on a page this site has captured. [Every statement, with its evidence](statements/index.html). | Class | What it means | Statements | |---|---|---| | record | a number, a date, a version or an identifier, stated plainly | 9 | | stated | a plain statement in the article's own voice | 16 | | attributed | says a named party said, reported, estimated or believes it | 7 | | quote | carries someone's words in quotation marks | 3 | | hedged | may, could, reportedly, is believed, estimated to: the article being careful | 5 | ### Statements with no reference (3) - [PHP is a popular programming language that many website and web application codebases are built upon.](statements/index.html#530960f0f7) - [The vulnerabilities are estimated to affect nearly 70% of websites.](statements/index.html#ba1abad6d6) - [The potential impacts of the vulnerability were widespread.](statements/index.html#d05e02d372) ## Where the article and this site meet 13 references are pages this site's claims also cite. A statement there and a claim here that rest on the same captured page meet at that page: there is no “same as” edge, the shared evidence is the join. [Every reference](references/index.html). - [Wiz](../../sources/wiz-blog-php2shell/index.html): cited by 0 statements there and by [wordpress-drupal](../../facts/wordpress-drupal/index.html), [scale-70pc-internet](../../facts/scale-70pc-internet/index.html), [scale-70pc-websites](../../facts/scale-70pc-websites/index.html), [ai-found](../../facts/ai-found/index.html), [wiz-independent](../../facts/wiz-independent/index.html), [most-severe](../../facts/most-severe/index.html) here - [CVE record](../../sources/cve-cve-2026-109618/index.html): cited by 1 statement there and by [two-cves-9.2](../../facts/two-cves-9.2/index.html), [cisa-none](../../facts/cisa-none/index.html), [ac-high](../../facts/ac-high/index.html) here - [CVE record](../../sources/cve-cve-2026-109619/index.html): cited by 1 statement there and by [two-cves-9.2](../../facts/two-cves-9.2/index.html) here - [php.net](../../sources/php-net-advisory/index.html): cited by 1 statement there and by [two-cves-9.2](../../facts/two-cves-9.2/index.html), [rce-modphp](../../facts/rce-modphp/index.html), [only-update](../../facts/only-update/index.html), [disclosure-22oct](../../facts/disclosure-22oct/index.html), [release-time](../../facts/release-time/index.html), [preannounce-time](../../facts/preannounce-time/index.html) here - [php.net](../../sources/php-net-advisory/index.html): cited by 5 statements there and by [two-cves-9.2](../../facts/two-cves-9.2/index.html), [rce-modphp](../../facts/rce-modphp/index.html), [only-update](../../facts/only-update/index.html), [disclosure-22oct](../../facts/disclosure-22oct/index.html), [release-time](../../facts/release-time/index.html), [preannounce-time](../../facts/preannounce-time/index.html) here - [Recorded Future](../../sources/recordedfuture-php2shell/index.html): cited by 1 statement there and by [no-confirmed-compromise](../../facts/no-confirmed-compromise/index.html) here - [PHP Foundation](../../sources/phpfoundation-blog-security-release-leak/index.html): cited by 1 statement there and by [leak-cve-ids](../../facts/leak-cve-ids/index.html), [leak-video](../../facts/leak-video/index.html) here - [PHP](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html): cited by 1 statement there and by [two-cves-9.2](../../facts/two-cves-9.2/index.html), [rce-modphp](../../facts/rce-modphp/index.html), [rce-fpm](../../facts/rce-fpm/index.html), [fix-bailout](../../facts/fix-bailout/index.html), [openai-same-day](../../facts/openai-same-day/index.html), [four-reporters](../../facts/four-reporters/index.html), [release-time](../../facts/release-time/index.html), [fix-engine](../../facts/fix-engine/index.html) here - [PHP](../../sources/github-ghsa-6wmf-4rv5-p3rp/index.html): cited by 1 statement there and by [two-cves-9.2](../../facts/two-cves-9.2/index.html), [rce-fpm](../../facts/rce-fpm/index.html), [only-update](../../facts/only-update/index.html), [four-reporters](../../facts/four-reporters/index.html), [fix-engine](../../facts/fix-engine/index.html) here - [Amazon](../../sources/aws-security-blog-madpot/index.html): cited by 1 statement there and by [amazon-honeypot](../../facts/amazon-honeypot/index.html), [probing](../../facts/probing/index.html), [no-confirmed-compromise](../../facts/no-confirmed-compromise/index.html) here - [watchTowr](../../sources/watchtowr-php2shell-faq/index.html): cited by 1 statement there and by [watchtowr-itw](../../facts/watchtowr-itw/index.html) here - [Huntress](../../sources/huntress-php2shell-rapid-response/index.html): cited by 1 statement there and by [huntress-none](../../facts/huntress-none/index.html), [no-confirmed-compromise](../../facts/no-confirmed-compromise/index.html), [pocs-wrong](../../facts/pocs-wrong/index.html) here - [NCSC UK](../../sources/ncsc-news-php/index.html): cited by 1 statement there and by [offline-ncsc](../../facts/offline-ncsc/index.html) here ### Contradictions this site records on that shared evidence (8) - [K-001](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-001): How much of the web: 70% of websites, or 70% of the Internet? (explained) - [K-002](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-002): Is php2shell being exploited? (explained) - [K-003](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-003): Which PHP versions are affected? (explained) - [K-007](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-007): How severe: CVSS 10.0, 9.2 or 9.8? (explained) - [K-008](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-008): Which flaw was shown to give code execution on PHP-FPM? (open) - [K-009](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-009): Did any technical detail leak on 20 October? (explained) - [K-010](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-010): When was the release planned, and when did it ship? (open) - [K-012](https://php.oct.2026.newsroom.sgit.ai/factcheck/#K-012): What does W3Techs say: 69.3% or 75%? (explained) ## What changed since this site captured it This site's evidence vault captured the article at `20261023T160435Z`, when it was at revision `1381598302`. Since then: **7** statements added, **3** removed, **3** reworded, **4** references added and **2** removed, over 44 revisions. [Every edit](history/index.html). 41 of the 370 revisions were reverts or were reverted; 72 were marked minor; 1 were anonymous. The article is now 30,364 bytes. ## The Wikidata item Wikidata, the structured sister of Wikipedia, holds item [Q141801185](https://www.wikidata.org/wiki/Q141801185), “2026 security vulnerability in PHP”, with links to the article in 27 languages. Its claims, as fetched (DBpedia, the older extraction, is built from periodic dumps and had no entry for the article when this was built): | Property | Id | Value | |---|---|---| | facet of | `P1269` | computer security | | has effect | `P1542` | arbitrary code execution | | uses | `P2283` | PHP | | instance of | `P31` | named vulnerability | | Common Vulnerabilities and Exposures ID | `P3587` | CVE-2026-109618; CVE-2026-109619 | | has use | `P366` | arbitrary code execution | | time of discovery or invention | `P575` | +2026-08-01T00:00:00Z | | discoverer or inventor | `P61` | Wiz, Inc.; OpenAI; Calif | | announcement date | `P6949` | +2026-10-20T00:00:00Z | | significant event | `P793` | code patching | | official website | `P856` | https://www.php2shell.com/ | | described at URL | `P973` | https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp | ## The article over time, and its talk page [The evolution](evolution/index.html): every statement ever written as a bar from the edit that added it to the edit that removed it, the size and references over time, and the Wikidata item's own history. [The talk page](talk/index.html): what the editors discuss, including the edit requests outside parties made with a disclosed conflict of interest. [A reviewer's reading](review/index.html): the article against this site's captures, finding by finding, for a person to take to the talk page. ## What links here 198 other articles link to this one, which is how a reader of Wikipedia arrives: from *PHP*, *2026*, the lists of security incidents, the pages of the companies named. The list is in [links-in.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.19/wikipedia/php2shell/links-in.json). ## Towards a measure of trust The editor's working view is that Wikipedia is a trusted source, and that this should be shown rather than assumed: by how often its statements are later corrected, against how often other publications are. This page does not compute a score; it keeps the counts a proof would start from, and the fact-check desk grades statements, not pages. For this article: 37 of 40 statements cited (92%); 21 of 44 references captured here, 12 of those primary sources; 41 reverts in 370 revisions; 8 of this site's contradictions touch evidence the article also cites. The text is Wikipedia's, [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/), by its contributors; the revision ids are the attribution, and this site's pages and data that carry it are under the same licence: this page uses material from the Wikipedia article “PHP2Shell” ([link](https://en.wikipedia.org/wiki/PHP2Shell)), released under the [Creative Commons Attribution-Share-Alike License 4.0](https://creativecommons.org/licenses/by-sa/4.0/). It is republished so it can be read as a graph, diffed and followed to its evidence; nothing here is Wikipedia's view, and nothing on Wikipedia is this site's. --- site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/wikipedia/php2shell/index.html