Home / Articles / The false positives are the next incident / Versions / v1.1.0
The false positives are the next incident: what changed in v1.1.0
From v1.0.0 (2026-10-23, e50452d9f) to v1.1.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 4 changed in place, 54 unchanged. About 0 words added and 90 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot qn-grossman-post.webp | images/ | Jeremiah Grossman's LinkedIn post:post "The false-positives foron php2shell fromfalse makeshiftpositives, scannersas is what's going to be apocalyptic." 32 reactions, 8 comments and 1 repost when the screenshot was takencaptured on 23 October 2026. | screenshot
11 unchanged paragraphs, under In short {#in-short}, The post, and my reply {#the-post}
!shot qn-twelve.webp | images/ | The twelve pieces of evidence in the scanner-noise angle, captured 12:38 to 12:40 UTC on 23 October 2026: scanner method, a false positive, a false negative, a claim to test, a bulk notification, volume, two detection limits, coverage, scanner templates and two scanner releases.2026. | concept
6 unchanged paragraphs, under Why a version check gets it wrong {#version-strings}
!shot qn-two-checks.webp | images/ | Two ways a scanner decides,decides on the same patched Ubuntu server: reading the version stringstring, gives a false positive;or trying to produce the fault gives the right answer.fault. | diagram
16 unchanged paragraphs, under The noise is already in bulk {#bulk}, Detection rules fail in both directions {#detection}, A quiet signal under a loud alarm {#signal}
!shot qn-signal-noise.webp | images/ | Lots of alarms, no named victim: theThe compromise map's layers on 22 October at 20:50 UTC (millions of attempts, 3 vendors reporting exploitation, 1 named organisation attacked, 0 saying php2shell was the way in) next to the scanner noise by 12:38 UTC on 23 October (53 templated issues, 62 false-positive issues, 10 nuclei-templates issues).October. | comparison
19 unchanged paragraphs, under What to do with a scanner's answer {#what-to-do}, What would settle it {#lab}, What this does not claim {#limits}…