A NEW CASE FILE EVERY WEEK

PATCH GAP

Security incidents, rebuilt from the receipts.

Leaks, breaches and disclosure fights, reconstructed minute by minute from primary sources. Then the one thing to change in your own systems on Monday.

Subscribe on YouTube Open Case File #1

The name

Every incident lives in a gap.

The gap between a bug and its fix is where leaks, embargoes and zero-days happen. The gap between the fix and your update is where the patch is out and your server still doesn't have it. Every Case File is about one of them. Sometimes both.

THE GAP BEFORE THE FIX
THE GAP AFTER IT
  1. The bug shipsNobody knows yet.
  2. Someone finds itA researcher. Or someone else.
  3. The fix shipsAdvisory out, versions bumped.
  4. You updateEventually.

Case File #01 · php2shell Coming soon

Who had the PHP exploit 4 days early?

Four days before PHP's critical php2shell bugs went public, an Amazon honeypot logged an attempt to exploit them, from an anonymized address. Every known leak came later. So who had it first?

identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026,
aws.amazon.com · 21 OCT 2026
  1. Who had it first?
  2. The short version
  3. Who knew, and since when
  4. Three leaks and a maybe
  5. Nobody has explained October 17th
  6. Could someone find it alone?
  7. What it changes
Subscribe to catch it

The method

Every claim gets a stamp.

Before anything reaches the screen it's checked against its source, and the stamp says how sure we are. The receipt stays on screen while we say it.

Confirmed. The vendor, the victim or the researcher said it, in writing, and the source is on screen.

Unconfirmed. What nobody has shown yet. We say so, and we say what would settle it.

Disputed. Two accounts that don't match. You hear both, from the people who said them.

False. The viral version that the sources don't back up.

Primary sourcesAdvisories, postmortems and write-ups, linked in every description.
Times in UTCTimelines rebuilt minute by minute, every timestamp checked.
Corrections, pinnedStories move. Updates go in the pinned comment, dated.
One thing to fixEvery Case File ends with what to change in your own systems.

We show how it broke. Never how to break it.

Season 1

The first ten case files.

Supply-chain attacks, AI-lab incidents, breaches and disclosure fights, all from 2026. Each file opens when its episode does.

01
Disclosure

php2shell

The PHP bug that leaked before its patch.

OPEN
02
Supply chainSEALED
03
AI labSEALED
04
BreachSEALED
05
DisclosureSEALED
06
Supply chainSEALED
07
BreachSEALED
08
AI labSEALED
09
Disclosure + breachSEALED
10
DisclosureSEALED

The sidekick

Your rubber duck, on call.

Every developer has explained a bug to a rubber duck. Ours wears a headset, carries a badge and has read every postmortem. It doesn't present. It reacts. The evidence does the talking.

So who had it first?
ON CALLDEADPAN ONLY

MIND THE GAP.

A new Case File every week. Security incidents, rebuilt from the receipts.

Subscribe to @PatchGap