The PHP desk

The admin page for the PHP flaws story of October 2026 as this newsroom covers it: the work and who did it, the roles of the people and agents on the story, and the evidence vault, which anyone can now open read-only. The facts themselves live on the story’s own site; how the coverage started is in Capture first; the design of this page is its brief.

The work

One row per piece of work, from admin/content/php-oct-2026/work.json. Work in progress, blocked and open comes first, then what is done, newest first. Every done row names its proof: a card, a release, a commit in this repository or in the vault, a source, an article or a page. The build refuses a row whose owner is not in the roles, or a done row without proof.

By owner

• newsroom.dev 1 blocked, 11 done
• claude-story-site 5 open, 1 done
• collector-primary 1 done
• collector-researchers 1 done
• collector-gov 1 done
• collector-news 1 done
• claude-vault-app 1 done
• newsroom.writer 1 done

The move to the story’s own site

The facts live on php.oct.2026.newsroom.sgit.ai (v0.2.4, data as of 2026-10-22T11:34Z). /php-flaws/ retires into a pointer when these pass; 2 of 5 did when last checked, 2026-10-22T13:51Z.

• ✓ The site answers at its own domain HTTP 200
• ○ The site publishes /status.json for this newsroom to read HTTP 404
• ○ Every source the section lists is on the site 144 of 184; missing 20min-fr-suisse-romande, abc-au-gov-sites-exposed, abc-au-politics-live, actu17-prefectures, bleepingcomputer-php2shell
• ✓ The newsroom's front page links to the site the Developing strip, from admin/content/front/developing.json
• ○ The section is replaced by a page that points to the site the last step, done here once the checks above pass

The roles

Everyone who has worked on the story, from admin/content/php-oct-2026/roles.json: what each is responsible for, what each may and may not change, where each works, and the record that shows it. Drawn from the git logs and the vault’s commit messages. The editorial responsibility is always Dinis’s.

The evidence vault, open to everyone

Every source the story rests on, captured as its publisher served it: the raw page, the rendered page, its text, a full-page screenshot and the headers, each file hashed at capture. The vault is public and read-only since 2026-10-22, by the editor’s decision. The key below can read every file and every commit and cannot write. Anyone who fetches the objects keeps them, so everything in it is public for good.

sgit_public_read_6451da6ba1c6201d35b0832d570097327552564c12c8e9a550fc2ed1150769f8:3ytzxm3g

pip install sgit-ai
sgit clone sgit_public_read_6451da6ba1c6201d35b0832d570097327552564c12c8e9a550fc2ed1150769f8:3ytzxm3g

Browse it here

The vault, read live in this page with the key above: the manifest first, then each source’s notes, its captures, a thumbnail of each, and the full screenshot or the text when asked for. Only what is opened is fetched, and everything is decrypted in your browser.

The scan before the key

On 2026-10-22, at vault head 0f97fe36ab4d, all 1839 files, captures included, were searched for: sgit vault and read keys; this vault's passphrase; the sgit access token; GitHub, AWS, OpenAI and Slack token shapes; private keys; bearer headers; the editor's email address; the capture environment's paths. Found: no secret and no personal data. Noted:

• one OpenAI-shaped string: an advertising sync parameter inside a captured French news page (a false positive)
• 93 set-cookie headers: anonymous cookies the sites gave the capture browser
• 9 Wikipedia captures whose headers echo the capture environment's outbound address (x-client-ip, a cloud egress address, not a person's)

None: captures are never edited, so these stay as served; the scan is recorded in the vault's README.

What is in it

At vault head 326d5001d7b2: 1839 files, 536.0 MB; 184 sources, 177 captures, 855 files hashed at capture, 61 claims and 67 timeline events in per-agent files, and the vault’s own app.

The latest commits on the head’s line

• 326d5001d7b2 newsroom.dev: README: name the scanned head
• 292f563656ab newsroom.dev: README: the vault is public read-only; the scan before the key
• 0f97fe36ab4d claude-vault-app: the vault's own app v0.1.0 (index.html, .vault/app.json, app/: reduced screenshots, manifest, versions), README section, notes
• e96281b64dd0 claude-newsroom-lead: rebuild index
• f72ad76c99c9 Merge current into local
• d5549bc61fd2 collector-gov: nine site captures (down pages), rows by claude-newsroom-lead
• 634de193e2ac Merge current into local
• be782bff89bf collector-gov: KEV, ACSC, CCCS, NCSC-NZ, JPCERT, BACS, NCSC-NL portal
• 0406c9954fe4 collector-gov: CERT-EU, ENISA CNW, CISA alert, CERT-FR, CERT.LV, ACN; CCN/CNCS blocked
• 973cccc43414 collector-gov: NCSC UK alert, NSA X posts + press release, NCSC-NL php2shell
• 1988169025cd collector-gov: NCSC UK alert, NSA X posts + press release, NCSC-NL php2shell
• 4dd942654566 claude-newsroom-lead: per-agent claims and timeline files; seed both from the BBC live page

The protocol every writer follows is the vault’s README.md; the hashes of every capture are also listed on the section’s sources page.

Not on this page

• Visitor logging with an append lane is the story site’s own work, by the editor’s decision; it is row w-22 above.
• Writing from the page. The page reads; the work and the roles change by commit.