Home / Articles / PHP October 2026, day three: where the story and the newsroom covering it stood at 23:30 UTC on 23 October, the scheduled agents running, the observability built in a day, and what waits on me

PHP October 2026, day three: where the story and the newsroom covering it stood at 23:30 UTC on 23 October, the scheduled agents running, the observability built in a day, and what waits on me

By Dinis Cruz · 2026-10-24 · article v1.0.0 · newsroom v0.13.58 · php2shelldailyagentsschedulesobservabilityevidencearticle

Abstract: The first of what I want to be a daily post on the php2shell story and the newsroom covering it, taken at 23:30 UTC on 23 October, when the conductor agent read every one of the team's twenty sessions. On the story, the line that matters held: no named organisation has said it was compromised through php2shell, CISA's catalogue of exploited flaws still listed neither CVE, and the Dutch NCSC's inventory showed 109 of 751 products fixed. On the newsroom, the day's 84 commits moved the work from sessions I start by hand to agents woken on a schedule: the scheduled curator promoted 33 captures into the evidence vault, now at 260 sources, and the scheduled source watch moved into a pack-mode vault that clones in 95 seconds instead of 13 minutes and 47 seconds. The site also learned to watch itself: a telemetry app where every chart is a filter, a risk graph you can explore one step at a time, a Sherpa that answers readers' feedback, and four mockups for a redesign. And the honest part: 15 of the 20 agents were waiting on a decision from me.

In short

• The story held. No named organisation compromised through php2shell; neither CVE in CISA's catalogue; 109 of 751 products fixed.
• The agents run on a schedule now. The scheduled curator promoted 33 captures; the evidence vault reached 260 sources.
• The source watch moved to pack mode. A fresh clone in 95 seconds instead of 13 minutes and 47 seconds.
• The site watches itself. Telemetry where every chart is a filter, and journeys drawn as a Sankey.
• The risk graph became a tool. 713 nodes and 1,418 edges, explored one step at a time, with its gaps computed.
• Readers have a Sherpa. Feedback answered point by point, and a redesign out for review.
• The bottleneck is me. 15 of the 20 agents were waiting on my decisions.

Why this hour

I want one of these a day, a fixed snapshot rather than a running commentary, so that anyone can go back and see where things stood. For 23 October the best moment is 23:30 UTC, when the conductor agent refreshed the team's status page, reading all twenty agent sessions, the repository and the scheduled tasks without asking any agent. Everything below is as of that snapshot unless it says otherwise; a few things that landed in the hour after are marked as such.

The story

The journalist agent's state of affairs is a versioned page, so the day can be read as a delta. Version 1, at 14:11 UTC, from the evidence vault and the source watch:

• Compromises named: 0. Three candidates open (ČVUT, which stopped an attack it links to worldwide PHP attempts; GMO's FX VPS, with the cause not stated; DMM, with PHP not confirmed) and one ruled out (Valtec, which corrected itself).
• CISA's catalogue of known exploited vulnerabilities: neither CVE listed, unchanged since the evening of 22 October.
• NVD: CVSS 3.1 9.8, beside the CNA's CVSS 4.0 9.2.
• Public repositories mentioning the flaws: 735, up from 586 the evening before; a count of search results, not of working exploits.
• The Dutch NCSC's inventory: 109 of 751 products fixed, 389 still under investigation.

Version 2 followed just after midnight, from an evidence vault of 295 sources, with six of the curator's new claims held back as worded and the reason given. The line that matters most held all day: no named organisation said it was broken into through php2shell.

The agents run on a schedule

Yesterday I wrote about this workflow as almost working. By the end of the day it was further along than that article said, and I should correct it here: I read the schedule vault, which the agents had not yet adopted, and the agents were already running without it.

• The scheduled curator, on Sonnet, with its key from the QR handshake, woke at its five times and promoted 33 captures from the source watch's queue: the evidence vault reached 260 sources, with 28 new claims, six of them disputed. 164 queue rows were still waiting, at about 18 a wake.
• The scheduled source watch became active at 07:00, 09:30, 12:00, 14:30 and 17:00 London time. Its evening pass was on its third attempt at 23:23 UTC, after two container restarts lost the first two, which is exactly the failure I described.
• Just after midnight, the schedules themselves moved out of the schedule vault and into the repository: each scheduled agent now has a card with its objective, its wake times and its wake prompt word for word, and a run record for every wake.

Pack mode

The source watch had grown to the point where it hurt: over a gigabyte, slow to clone and slow to pull. The researcher measured pack mode, the same vault stored as packs rather than as individual objects: a fresh clone in 95 seconds against 13 minutes and 47 seconds, the whole history pushed in 96 seconds, and the normal vault's object listing now timing out on the server. With two writers on the pack vault, a pull of the scheduled session's commit took 176 seconds and a one-file correction was pushed in 77. The watch moved into its pack-mode copy, 7r83qic5, and the scheduled curator followed it. The curator's first session advised against moving the evidence vault yet: a pack vault does not open in the browser, and the site's vault pages need that.

The site watches itself

In a day and a half the dev desk built the observability I had been asking for. Every session on the site is now a reader, the editor, a power user or team member, a synthetic reader, or a crawler, declared by the browser where it can be and inferred before that. The telemetry app, v0.4.0 by the evening, makes every chart and every cell a filter, colours by any breakdown, and draws journeys as a Sankey and as a page network. Its stats are in a public vault, 0cfkdcvh, updated at every drain. The first thing it showed was uncomfortable and useful: the front page leaks. In the journeys, 134 sessions ended after their first page.

The risk graph as a tool

A collaborator's ideas (CI-002) turned the risk graph from a picture into a tool. Every edge now says how it is known: read from a capture, read from the fix commit, or inferred by an agent, and the inferred ones are drawn dashed and can be hidden. The fix commit's 270 tests are nodes. You can start from one thing, a CVE, a risk, a file, a test, and follow it one step at a time, or climb from a file to the risks and controls above it. And a gaps page is computed at every build. On 23 October it said: no control is joined to code or a test, no code has an owner, and 14 risks have no story. That is the kind of honest gap list I want every system to have.

Readers, collaborators and a redesign

A new agent joined: the Sherpa, which walks with the reader. It answers readers' feedback point by point (UF-001 to UF-003 on 23 October, with two interface bugs reproduced), keeps a friction log of what gets in readers' way, with who can fix each, and sets collaborators' ideas against what the site already does. The designer put a redesign out for review: two dials, who you are and how much of the site you see (Focus, Standard, Everything), and four mockups built from the live data. No reader page has changed yet; the picks are mine.

Security, as it went

Two things worth recording. The conductor made explicit that a vault's key is the whole boundary: whoever holds it can drain that vault's lane, so the keys each agent holds are listed, by ID and kind only, on the vaults page. And about an hour after the snapshot, a second security pass found and fixed a stored cross-site scripting flaw in the Ask pane, where a captured page's title could have broken out of a citation and run script; it now renders the model's answer as DOM nodes.

What waits on me

The status page is blunt about it: 20 agents, 2 working, 2 blocked, 15 waiting on the editor, 10 branches waiting to be carried into dev, and $588 spent across the sessions so far. The decisions at the top of its list: a go for the scheduled curator to re-export the evidence vault into the site (227 sources on the site against 260 in the vault), which vault type the two schedules use, the design picks, two blocked agents whose sessions cannot push, a security review of two branches, and two sealed keys from 22 October to open before they expire. That list is the real lesson of the day. The agents are fast; the decisions are mine, and that is where the time goes.

What this does not claim

• A snapshot, not a verdict. As of 23:30 UTC on 23 October, from the status page and the day's commits.
• The story's numbers are the journalist's version 1. Version 2 came after the snapshot.
• Costs are each session's running total at its latest message, as the status page reports them.
• Telemetry groups are partly inferred. Declared by the browser from 23 October, inferred before.
• No compromise named is time-bounded. One statement from one organisation would end it.

Where this comes from

The PHP story site's repository and its 84 commits on 23 October, read at release v0.10.18 for the status snapshot and up to v0.11.3 for what came just after; its pages on team status, the state of affairs, pack mode, the vaults and the Sherpa; its screenshots, under its Apache-2.0 licence. Related: almost working, PHP October 2026, at 8pm, the false positives are the next incident. Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine.

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles