What should a vendor say while an incident is uncertain?
Say what you have confirmed, what remains unknown and when the statement was last checked. Wrong About You labelled 880 of 2,922 statements unverifiable in answers captured on 22 and 23 September 2026. Unknown is an evidence state; it must not become a confident claim that a product is affected, unaffected or fixed.
What we measured
Measured. The uncertainty relevant here is visible in Wrong About You. Its method compared 2,922 vendor statements in 22 and 23 September 2026 answers with vendor pages read on 8 October. It could check 2,042 statements; 880 remained unverifiable. The sample covered 70 vendors, and team review remains in progress. Unverifiable is not a synonym for false or unaffected.
The PHP2Shell review method offers an incident-specific boundary. In its 23 October 2026 collection, 148 of 150 planned answers were eligible after two exclusions, and 23 were labelled potentially misleading. Those dated answer labels do not resolve an incident assessment for another product today. They show why a statement should preserve the scope that the available evidence can establish.
What this means for you
Reasoned. Build the statement around the decision a reader faces. Identify the product or service scope you can support, then link the dated primary source. Describe the part of the assessment that remains unresolved in concrete terms, such as whether a particular component is present. Avoid a broad reassurance that outruns that evidence.
A useful update also says what would change the assessment. That might be a revised primary advisory, confirmed product information or a completed internal check. Do not promise a completion time unless the responsible team has committed to it. Keep an earlier statement available with its date so that a later correction has an understandable history.
The two studies have different purposes. Wrong About You separates checkable product claims from unverifiable ones. PHP2Shell examines dated incident answers. Neither supplies a current technical verdict for your product. They support the communication discipline of keeping uncertainty visible while the underlying facts are established.
- For a vendor: give readers a precise unresolved question rather than an unsupported assurance.
- For a customer: use the dated source and product scope to decide what to ask the vendor next.
- For an agency: have the responsible product owner approve factual language before publishing it.
Also asked as
What should a vendor say while an incident is uncertain?
Related
- Wrong About You classifications
- PHP2Shell answer study
- The AI source standard
- Vendor-fact boundaries
Next step
Use the Free 10-question check (one engine). No email is needed; runs are limited per network and per day, and by the site's daily allowance. Use the check to inspect an answer, not to obtain a technical incident verdict.
To publish one approved factual statement with its receipt, Fix one answer, $490.
Our answer-study method, v1.1.
Prepared by the Broadcastwell team.
Page owner: Marcus Reed, AI Specialist. Corrections: hello@broadcastwell.com