The SGit Newsroom · 2026 · October

October 2026: the stories of the month

One site per story, built from captured evidence. This month has one so far, and it is the one that took government websites offline across Europe: two critical flaws in the PHP engine, found with AI help, leaked two days early, patched on 21 October. The newsroom's own daily coverage is on newsroom.sgit.ai; this page is the index of what became a story.

The stories

Developing since 21 October developing

php2shell: the two PHP flaws of October 2026, tracked as evidence

CVE-2026-109618 and CVE-2026-109619: what is established, who said what and when, the code of the fix read from php-src, the numbers that do not add up, sixteen agencies compared, what was taken offline and what was compromised, detection and defence, and a briefing for every role from the board to the developer. Every claim carries a status and its sources; every source is captured and hashed.

  • The front page what is established, what is not
  • The timeline from the 2024 audit to the latest capture
  • The code the fix commit, read from the repository
  • Impact taken offline versus compromised
  • Briefings board, CISO, CTO, CFO, AppSec, developer, media, journalist, researcher, analyst
  • Every source every capture, every hash

The newsroom's daily coverage live

The newsroom's PHP flaws section

The section where the story started on the morning of 22 October, with the newsroom's reading of the BBC's live page. The story site supersedes its claims and keeps its evidence.

Also this month live

The Industry Wire

The newsroom's daily wire: the sources it reads and how it reads them. Stories that outgrow the wire get a site here.

Where this sits

The month sits between the year and the stories. A story that is still a wire item lives on the newsroom; a story that needs its own evidence vault, its own claims table and its own briefings gets a site, and this page is where it is listed.

Up

Down

How this site works

The same method as the year site: one JSON file, one script, no clock, a gate before every release, and a release that is not done until the live site serves it.