How should I check a reported vulnerability's product impact?
Check the exact product, component, version and conditions against a dated primary advisory before accepting an AI answer's impact statement. In the PHP2Shell collection captured on 23 October 2026, 23 of 148 eligible answers were labelled potentially misleading. That finding supports checking the answer; it does not identify which systems are affected today.
What we measured
Measured. The PHP2Shell study method assessed incident answers captured on 23 October 2026 against dated reference evidence and reviewer rules. It retained 148 eligible answers from 150 planned observations, with two exclusions, and labelled 23 potentially misleading. The event counted is an assessed answer, not an affected installation. The study supports scrutiny of a product-impact statement; it supplies no current affected-product list, exploitation finding or remedy for a reader's system.
What this means for you
Reasoned. Begin with identity. Record the product name as deployed, any relevant component and the version evidence available to your team. Then find the primary advisory that actually covers that identity. A similarly named package or a version number quoted without its product scope is not enough to connect an incident to your system.
Keep the advisory's statement and your own assessment in separate fields. The advisory may describe affected conditions, while your team still needs to establish whether those conditions apply. If the product's involvement is unknown, write unknown and identify the missing evidence. Do not turn an absent mention into an unaffected verdict.
Save the advisory URL, revision date and the passage used for the assessment. If it changes later, you can explain what supported the earlier statement. A decision about updating a live system belongs to the responsible technical team using current primary evidence; this answer supplies no affected-version list or repair instruction.
- If you own the product: state the exact scope you have established and the date of that assessment.
- If you review an AI answer: trace its impact claim to the primary source rather than accepting a confident summary.
- If you communicate externally: separate confirmed product facts from checks still in progress.
Also asked as
How should I check a reported vulnerability's product impact?
Related
- PHP2Shell study and classifications
- An AI source standard
- Keep vendor facts scoped
- How timing changes evidence
Next step
Use the Free 10-question check (one engine). No email is needed; runs are limited per network and per day, and by the site's daily allowance. Keep a dated source record beside the answer you are checking.
Where the verified issue is a published fact on your page, Fix one answer, $490.
Our answer-study method, v1.1.
Prepared by the Broadcastwell team.
Page owner: Marcus Reed, AI Specialist. Corrections: hello@broadcastwell.com