Skip to content
PHP2Shell: the critical PHP vulnerability and how to patch it
Black Shard
Black Shard

Editorial standards

Every item in the Black Shard Newsroom links its primary sources, labels what is reported or claimed, and logs each correction with a timestamp.

  • Primary sources on every item

    Every news item links at least one primary source: the vendor advisory, the government notice, the regulator release or the court record. Each source shows the date it was retrieved, primary sources first.

    Reporting by other outlets is listed as secondary and never stands alone behind a news item.

  • Reported and claimed facts are labelled

    A fact confirmed by the affected organisation, the vendor or a regulator is stated as fact. A fact carried only by other reporting is attributed to the outlet that reported it.

    A claim with no confirmation, such as a threat actor statement, carries the label Claimed, unconfirmed. The newsroom does not name an organisation that appears only on a leak site.

  • Times are AEST

    Every timestamp is Australian Eastern Standard Time, UTC+10, with no daylight saving. The published date is the day an item went live and never moves. Where the event happened on another day, the item shows its event date as well.

  • Corrections are logged

    A correction or a material update is recorded in the item’s Updates log with its AEST timestamp and a line on what changed. The published date stays as it was.

  • Desk bylines

    Items carry the byline of the desk that filed them: Black Shard Advisories, Threat Intelligence, Research, the Policy Desk or Guides, and Black Shard for company news. Black Shard Pty Ltd publishes every item.

  • Report an error

    Email the item’s address and the error to info@blackshard.com.au. A confirmed error is corrected and logged on the item.

Advisories

Each advisory carries a severity, a status, its CVE or vendor advisory identifier, and one action. IDs run BS-ADV-YYYY-NNNN in publication order.

  • Critical severityCVSS 9.0 or more, or confirmed mass exploitation of internet-facing software.
  • High severityCVSS 7.0 to 8.9, or exploited with prerequisites.
  • Medium severityCVSS 4.0 to 6.9.
  • Low severityCVSS below 4.0.
  • Informational severityGuidance with no CVE.
  • Every CVSS score names its source. Where sources disagree, both scores appear.
  • A KEV listing appears only after the entry in the CISA Known Exploited Vulnerabilities catalogue has been read.
  • Exploitation is stated only when a listed source states it.
  • Status moves from new to updated, resolved or superseded, and each change is logged.

Want this applied to your systems?

Tell us what you run and what you need checked.