On October 21 the PHP project rushed out fixes for two critical flaws, called PHP2Shell, after details leaked early. A BBC column called PHP “the cyber equivalent of an unexploded bomb”. No outlet reports a confirmed breach. Kleinman’s headline makes PHP a bomb. Her own column, below it, keeps the record: in its fourth paragraph PHP2Shell is “a cyber event that hasn’t happened yet”, in its fifth “There has been no painful attack”, and in its fourteenth “there are no reports that anyone or anything has succeeded in using the flaws to attack a site.” The page is fairer than its title. The bomb is the hard word for a plain thing: a software flaw with a published fix. The tell is a threat with a vivid picture and no count. The habit it rides: one possible failure written as the whole, so the harm that might come outweighs the patches that already shipped. The figure every outlet repeats, “millions of attempts”, counts tries. None of the BBC, Register or TechRadar pages gives a number of sites confirmed breached. AWS says exploitation began 4 days before disclosure, and the column warns that hit companies may not know yet. The count is open, and the headline fills the gap with a blast. The fear lands on a reader who, by TechRadar’s account, has nothing to do: browsing needs no action, and the task belongs to site owners on old versions. The numbers that carry the story come from Cloudflare, Palo Alto Networks, Amazon and Kaspersky, companies whose own figures become the news. TechRadar’s calmer page carries an affiliate-commission notice. Calm or alarmed, the click is counted the same.
