# The false positives are the next incident: what changed in v1.1.0, sgit.ai > The changes to the article "The false positives are the next incident" in v1.1.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [The false positives are the next incident](../../the-false-positives-are-the-next-incident.md) / [Versions](../the-false-positives-are-the-next-incident.md) / v1.1.0 # The false positives are the next incident: what changed in v1.1.0 From v1.0.0 (2026-10-23, `e50452d9f`) to v1.1.0 (2026-10-27, `db67c5ce1`), paragraph by paragraph. 0 paragraphs added, 0 removed, 4 changed in place, 54 unchanged. About 0 words added and 90 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [all versions](../the-false-positives-are-the-next-incident.md) 2 unchanged paragraphs !shot qn-grossman-post.webp | images/ | Jeremiah Grossman's LinkedIn post:post"The false-positives foron php2shell fromfalsemakeshiftpositives,scannersasis what's going to be apocalyptic." 32 reactions, 8 comments and 1 repost when the screenshot was takencaptured on 23 October 2026. | screenshot 11 unchanged paragraphs, under In short {#in-short}, The post, and my reply {#the-post} !shot qn-twelve.webp | images/ | The twelve pieces of evidence in the scanner-noise angle, captured 12:38 to 12:40 UTC on 23 October 2026: scanner method, a false positive, a false negative, a claim to test, a bulk notification, volume, two detection limits, coverage, scanner templates and two scanner releases.2026. | concept 6 unchanged paragraphs, under Why a version check gets it wrong {#version-strings} !shot qn-two-checks.webp | images/ | Two ways a scanner decides,decides on the same patched Ubuntu server: reading the version stringstring,gives a false positive;or trying to produce the fault gives the right answer.fault. | diagram 16 unchanged paragraphs, under The noise is already in bulk {#bulk}, Detection rules fail in both directions {#detection}, A quiet signal under a loud alarm {#signal} !shot qn-signal-noise.webp | images/ | Lots of alarms, no named victim: theThe compromise map's layers on 22 October at 20:50 UTC (millions of attempts, 3 vendors reporting exploitation, 1 named organisation attacked, 0 saying php2shell was the way in) next to the scanner noise by 12:38 UTC on 23 October (53 templated issues, 62 false-positive issues, 10 nuclei-templates issues).October. | comparison 19 unchanged paragraphs, under What to do with a scanner's answer {#what-to-do}, What would settle it {#lab}, What this does not claim {#limits}… [all versions](../the-false-positives-are-the-next-incident.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/the-false-positives-are-the-next-incident/v1.1.0.html)*