# The evidence behind four days: what changed in v1.2.0, sgit.ai > The changes to the article "The evidence behind four days" in v1.2.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [The evidence behind four days](../../the-evidence-behind-four-days.md) / [Versions](../the-evidence-behind-four-days.md) / v1.2.0 # The evidence behind four days: what changed in v1.2.0 From v1.1.0 (2026-10-27, `019ddf902`) to v1.2.0 (2026-10-27, `4cb930e25`), paragraph by paragraph. **Prompted by review.** This version answers Claude Fable (Anthropic)’s review of the text published in newsroom v0.13.104 (7 findings fixed). 1 paragraph added, 0 removed, 9 changed in place, 57 unchanged. About 262 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [← v1.1.0](v1.1.0.md) · [all versions](../the-evidence-behind-four-days.md) · [v1.3.0 →](v1.3.0.md) 1 unchanged paragraph Summary: Four days after php2shell went public, Jeremiah Grossman, CEO of Root Evidence, posted on LinkedIn that the evidence does not support the wave of AI-enabled breaches many were bracing for, that the exploits are environment-specific, that in the same four days over a thousand CVEs were published and almost none were exploited, and that the rule is the old one: patch what adversaries exploit. This is the data behind each claim, re-counted from public sources and from the PHP story site's evidence, with every number traceable to a query or a captured source. Most of it holds. The post's timestamp is the CVE record's to the second; NVD counts 1,394 CVEs in the same window, not 1,448; none references Exploit-DB or Metasploit; VulnCheck published 25 old bugs with 2017 to 2025 IDs on 22 October; CISA had listed one, the Arista flaw. Two things changed after the post: CISA added both php2shell CVEs to its catalogue on 26 October, and their EPSS scores went from about0.060.1and 0.12 to above 0.999 the day before. As of 09:43 UTC on 27 October, no named organisation had said it was compromised through php2shell. The yearly numbers are consistent with the post's wider point, but cannot test it: CVE publications more than doubled this year, while additions to CISA's catalogue rose by 30%. Corrected on 27 October after a review by ChatGPT, which the editor asked for; the changes are listed at the end. 17 unchanged paragraphs, under In short {#in-short}, The post {#post}, Claim by claim {#claims} | Claim in the post | What the data says | Verdict | | --- | --- | --- | | Public at 13:48:34 UTC on 21 October | The CVE record for CVE-2026-109618: published 2026-10-21T13:48:34.845Z | Exact | | 1,448 CVEs in four days | NVD: 1,394 in the same window, 12 of them rejected | Close; not reconciled | | No exploit code in Metasploit or Exploit-DB | None of the 1,394 NVD records references either | Holds, as far as NVD shows | | VulnCheck: 25 on its KEV, 24 old bugs given IDs on 22 October, years 2017 to 2025 | NVD: VulnCheck, as a CNA, published 25 CVEs with 2017 to 2025 IDs, all on 22 October | TheClose,countnotmatches;the same: 25 old-ID CVEs in NVD against the post's 24 old of 25 on the KEV; KEV membership and when the IDs were assigned not checked | | CISA added one: Arista VeloCloud Orchestrator | CVE-2026-114625, published 22 October, listed 23 October; the other listing that day, a Collabora flaw, was published on 14 October | Exact at the time; three now | | Censys: 32 million PHP services on an affected version | Censys's dashboard is quoted at 36.7 million services on 22 October, by Fortinet | Not reproduced | | Honeypots caught plenty of attempts | Amazon's MadPot, ELLIO's sensors, Chainguard's honeypots, Cloudflare's "millions" | Holds | | No mass compromise; nothing confirmed | No named organisation has said it was compromised through php2shell, at 09:43 UTC on 27 October | Holds, as a time-bounded absence | | Exploits built for specific environments | The public chains are tuned to one build, raced, or have the wrong mechanism | Holds | 10 unchanged paragraphs, under No wave, and nothing confirmed {#record}, Exploits built for specific environments {#specific} Honeypots did catch plenty: Amazon's MadPot saw an attempt four days before disclosure, ELLIO's sensors and Chainguard's honeypots logged hits from the first morning, Chainguard's honeypots by 22 October (as reported second-hand), and Cloudflare's CEO counted "millions" of attempts. [The site's exploitation timeline](https://php.oct.2026.newsroom.sgit.ai/exploitation/index.html) lists each with its source. ## The other 1,3931,392 {#window} 1 unchanged paragraph NVD counts 1,394 CVEs published between 13:48:34 UTC on 21 October and the same time on 25 October. The difference from the post's 1,448 is small, and not reconciled. Two possible causes: NVD's publication time is not always the CVE record's, and counts move as records are added, rejected or re-dated. Only comparing the two lists of IDs would settle it, and we do not have the post's list. Of the 1,394, NVD had fully analysed 3;3 when we counted on the morning of 27 October (30 by 15:44 UTC the same day); 12 were rejected; most were waiting. They came mostly on weekdays: 494 and 497 on 22 and 23 October, 39 on the Sunday. None references Exploit-DB or Metasploit, which says what NVD's references hold, not what exists elsewhere. FIRST's EPSS, which models the probability of exploitation activity in the next 30 days, scored 1,383 of them on 26 October: 1,361 below 0.01, 19 between 0.01 and 0.1, one Brotli decoder flaw at 0.36, and the two php2shell CVEs at 0.99997 and 0.99981. That is a forecast: a low score means the model does not expect exploitation, not that none was seen. VulnCheck, acting as a CVE authority, published 25 CVEs with ID years from 2017 to 2025, all on 22 October, which matchesis close to the countpost's numbers (it says 25 on VulnCheck's KEV, 24 of them old) and matches the pattern Jeremiah describes. But an ID's year does not show when it was assigned, and we have not read VulnCheck's KEV, so whether these are the 25 on it is not checked. 13 unchanged paragraphs, under What changed after the post {#changed}, Attention is not exploitation {#attention}, Is AI driving it? {#ai}… The post's 32 million is Censys's count of services, not servers or organisations. Censys's dashboard was quoted at 36.7 million services on 22 October,October. If both figures are the same measure, the count went down. That could be patching, but also scan coverage, services going offline, fingerprints or the method changing; and, as Fortinet notes, "version-based estimates may include installations already patched through vendor backports". We could not read the dashboard ourselves, so the trend is a question, not a finding. What the record does show is how far apart the published figures are: from 1.57 million unpatched hosts to "almost 70% of websites", because each counts a different thing, and a version string is not the same as an exploitable server. 12 unchanged paragraphs, under What we asked the PHP team for {#asked}, What this does not claim {#limits}, Reviewed, and corrected {#review} The editor asked ChatGPT to review this article on 27 October, and pasted its review to me. Its verdict was "changes needed", with nine findings, and I agree with all nine. The record is at the end of this page and on [the reviews page](https://newsroom.sgit.ai/reviews/index.html), with what was done about each. In short: 2 unchanged paragraphs Then a fresh look. Claude Fable, from another vendor than ChatGPT and not the model that wrote this article, reviewed the corrected text the same afternoon. Its verdict was "approve with changes": all nine of ChatGPT's fixes hold, and every quote of Jeremiah's post matches the screenshot. It re-ran the counts from NVD, CISA, EPSS and the CVE records and got the same numbers, and found seven smaller points, all now fixed: VulnCheck's 25 old-ID CVEs are close to the post's "24 of those 25 are old bugs", not the same; the links to the PHP story site's data at version 0.1.77 had expired, and now point to the files by their hash; the section heading should read 1,392, since both php2shell CVEs are among the 1,394; NVD's count of fully analysed records had moved from 3 to 30 during the day; the summary's "about 0.1" is now 0.06 and 0.12, as in the body; a missing full stop; and Chainguard's honeypots are dated as reported. Both reviews, and the answer to every finding, are at the end of this page. 1 unchanged paragraph, under Where this comes from {#sources} Jeremiah Grossman's LinkedIn post on php2shell, written four days after the disclosure, as shared with me on 27 October 2026. Public data read on 27 October 2026: [NVD's CVE API 2.0](https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-21T13:48:34.000&pubEndDate=2026-10-25T13:48:34.000&resultsPerPage=1) for the window and for yearly totals; [CISA's KEV catalogue](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), version 2026.10.26; [FIRST's EPSS API](https://api.first.org/data/v1/epss?cve=CVE-2026-109618,CVE-2026-109619,CVE-2026-114625&scope=time-series); [the CVE record for CVE-2026-109618](https://cveawg.mitre.org/api/cve/CVE-2026-109618); [Fortinet's post](https://www.fortinet.com/blog/industry-trends/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch) for Censys's 22 October figure; [Wiz Research's post on PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce) of 21 October for its account of AI-assisted exploit development. The PHP story site's data at version 0.1.77:0.1.77[compromise.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/compromise.json),(its[exploitation.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/exploitation.json),[manifest](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/manifest.json);[claims.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/claims.json),the[numbers.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/numbers.json)files below are linked by their hash, since the site serves plain paths only for its five newest versions): [compromise.json](https://data.php.oct.2026.newsroom.sgit.ai/blobs/7582d4c6168e59f1ad58d609737538bb0c0709b4c27461f2c4adc73ecf708352), [exploitation.json](https://data.php.oct.2026.newsroom.sgit.ai/blobs/b51ff8179b0b75f5e8ef2916484a28c9a0d707d8542594f6b0c844fa44b54914), [claims.json](https://data.php.oct.2026.newsroom.sgit.ai/blobs/4305a8e70e42a8296e8c84d27e5fba7e155de9630f032d6152d099386e5b32b6), [numbers.json](https://data.php.oct.2026.newsroom.sgit.ai/blobs/31ba0a4f36a6a3a74a461a4818c542cd675f248980e8dc92ef4195431a826efb) and [pulse.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.77/pulse.json),[pulse.json](https://data.php.oct.2026.newsroom.sgit.ai/blobs/bfdcfa48d580729af74bc0f50e4fa9fd9ce5fbf6e613f03e9129d3dcd7b8a6bd), each pointing to its captured sources on [the references site](https://refs.php.oct.2026.newsroom.sgit.ai/sources/index.html). This article's own data: [the dataset](https://newsroom.sgit.ai/articles/data/the-evidence-behind-four-days__dataset.json). Related: [what the bitcoin bounty actually proves](https://newsroom.sgit.ai/articles/what-the-bitcoin-bounty-actually-proves.html), [PHP October 2026, update 4](https://newsroom.sgit.ai/articles/php-daily-2026-10-26.html), [the side stories of php2shell](https://newsroom.sgit.ai/articles/the-side-stories-of-php2shell.html), [patch for breakfast](https://newsroom.sgit.ai/articles/patch-for-breakfast.html). Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine. [← v1.1.0](v1.1.0.md) · [all versions](../the-evidence-behind-four-days.md) · [v1.3.0 →](v1.3.0.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/the-evidence-behind-four-days/v1.2.0.html)*