# October 2026: the stories of the month

The SGit Newsroom's October 2026: the stories big enough to get a site of their own, led by the two PHP flaws disclosed on 21 October, with links up to the year and the newsroom and down to each story.

The SGit Newsroom · 2026 · October

# October 2026: the stories of the month

One site per story, built from captured evidence. This month has one so far, and it is the one that took government websites offline across Europe: two critical flaws in the PHP engine, found with AI help, leaked two days early, patched on 21 October. The newsroom's own daily coverage is on [newsroom.sgit.ai](https://newsroom.sgit.ai/); this page is the index of what became a story.

## The stories

Developing since 21 October developing

### php2shell: the two PHP flaws of October 2026, tracked as evidence

CVE-2026-109618 and CVE-2026-109619: what is established, who said what and when, the code of the fix read from php-src, the numbers that do not add up, sixteen agencies compared, what was taken offline and what was compromised, detection and defence, and a briefing for every role from the board to the developer. Every claim carries a status and its sources; every source is captured and hashed.
- [The front page](https://php.oct.2026.newsroom.sgit.ai/) what is established, what is not
- [The timeline](https://php.oct.2026.newsroom.sgit.ai/timeline/index.html) from the 2024 audit to the latest capture
- [The code](https://php.oct.2026.newsroom.sgit.ai/code/index.html) the fix commit, read from the repository
- [Impact](https://php.oct.2026.newsroom.sgit.ai/impact/index.html) taken offline versus compromised
- [Briefings](https://php.oct.2026.newsroom.sgit.ai/briefings/board/index.html) board, CISO, CTO, CFO, AppSec, developer, media, journalist, researcher, analyst
- [Every source](https://php.oct.2026.newsroom.sgit.ai/sources/index.html) every capture, every hash

The newsroom's daily coverage live

### The newsroom's PHP flaws section

The section where the story started on the morning of 22 October, with the newsroom's reading of the BBC's live page. The story site supersedes its claims and keeps its evidence.

Also this month live

### The Industry Wire

The newsroom's daily wire: the sources it reads and how it reads them. Stories that outgrow the wire get a site here.

## Where this sits

The month sits between the year and the stories. A story that is still a wire item lives on the newsroom; a story that needs its own evidence vault, its own claims table and its own briefings gets a site, and this page is where it is listed.

### Up
- [newsroom.sgit.ai](https://newsroom.sgit.ai/): the SGit Newsroom
- [2026.newsroom.sgit.ai](https://2026.newsroom.sgit.ai/): the year, month by month

### Down
- [php2shell](https://php.oct.2026.newsroom.sgit.ai/): the two PHP flaws of October 2026, tracked as evidence

## How this site works

The same method as the year site: one JSON file, one script, no clock, a gate before every release, and a release that is not done until the live site serves it.

---
site v0.0.2 · https://oct.2026.newsroom.sgit.ai/index.html