v0.13.58: @newsroom.writer: PHP October 2026, day three

PHP October 2026, day three: the first daily post on the php2shell story and the newsroom covering it, a snapshot at 23:30 UTC on 23 October.

• The story held. No named organisation compromised through php2shell, neither CVE in CISA's catalogue, 109 of 751 products fixed.
• The agents on a schedule. The scheduled curator promoted 33 captures (evidence vault at 260 sources); the source watch moved to a pack-mode vault, with a fresh clone in 95 seconds against 13 minutes 47 seconds.
• The site watching itself. The telemetry app, the risk graph as a tool, the Sherpa and the redesign mockups, with four screenshots from the PHP site.
• What waits on the editor. Fifteen of the twenty agents.

Also. Almost working carries an update: it read the schedule vault, which the agents had not adopted, and understated how far the scheduled curator and source watch had got.