v0.13.55: @newsroom.writer: the false positives are the next incident

The false positives are the next incident: Jeremiah Grossman's warning about php2shell scanners, checked against what the PHP story's source watch held by midday on 23 October.

• Version checks miss backports. One scanner maker says most scanners in circulation read the version string; a community check script has been reported calling Ubuntu's patched 8.5.4-0ubuntu1.5 vulnerable.
• The noise is in bulk. 53 templated notices from one account, 62 GitHub issues for php2shell "false positive", 10 nuclei-templates issues; a ModSecurity rule withdrawn because it never fired.
• The signal is quiet. Millions of attempts and no named organisation saying php2shell was the way in, so a scanner's red line decides which patched sites go offline.

Also. Who maintains the PHP you run? now says up front, in its title, opening note and summary, that it is a follow-up to the maintenance deficit, with evidence.