JoshRob297 · Nov 10, 2026 · Nov 10, 2026
diff --git a/README.es.md b/README.es.md
@@ -3,7 +3,7 @@
 # php2shell — Verificación Independiente y Auditoría de Límites de Explotación
 ### CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560
 
-[![Release](https://img.shields.io/badge/Release-v1.11.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.11.0)
+[![Release](https://img.shields.io/badge/Release-v1.12.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.12.0)
 [![Target](https://img.shields.io/badge/Objetivos_PHP-8.2_·_8.3_·_8.4_·_8.5-334155?style=flat-square)](#)
 [![CVSS](https://img.shields.io/badge/CVSS_v4.0-9.2_CRÍTICO-b91c1c?style=flat-square)](#)
 [![ASLR](https://img.shields.io/badge/ASLR-Ventana_Cookie_1.88_MB-d97706?style=flat-square)](#)
@@ -159,6 +159,28 @@ cd lab && python3 -m pytest tests/ exploit/tests/ -q   # 147 passed, 4 skipped
 
 ---
 
+## Trabajo relacionado
+
+Este informe no vuelve a derivar la causa raíz: mide lo que afirman otros textos y dice qué se
+reprodujo. El trabajo de causa raíz es suyo:
+
+- **Wiz** (codescubridor) — la causa raíz y los tres vectores multipart que producen el OOM.
+- **CrowdStrike** — el detalle de contabilidad: `_zend_hash_str_add_or_update_i` incrementa el
+  contador de entradas antes de que `zend_string_init()` pueda fallar, y el arreglo de buckets
+  viene de un `emalloc` sin inicializar. Además separa tres fallos bajo las dos CVE.
+- **Keysight** — recorrido de la cadena de llamadas con capturas de paquete, desde el cuerpo
+  multipart hasta `nNumUsed` incrementado antes de la asignación.
+- **mekhalleh/php2shell-advisory** — el bug de orden con líneas de código (`main/main.c:1873`
+  antes de `1874`), el arreglo (`php_basic_early_rinit()`) y una plantilla pasiva de Nuclei.
+- **Exaforce** — por qué el encuadre temprano de "use-after-free en session upload progress" era
+  un disparador y no la causa raíz.
+- **9bie** — la técnica de ASLR solo por HTTP que este informe mide; **ikow** — el conjunto de
+  cinco cadenas revisado en `POCS.es.md`.
+
+Lo que añade este repositorio, y la razón para leerlo en segundo lugar: conteos por celda con
+controles en 8.4.21/8.4.26/8.4.27/8.5.12, la matriz de portabilidad, los claims retirados y las
+condiciones en que cada número se sostiene o no.
+
 ## Contenido del Repositorio
 
 | Documento / Recurso | Descripción |

diff --git a/README.md b/README.md
@@ -3,7 +3,7 @@
 # php2shell — Independent Verification & Exploitation Boundary Audit
 ### CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560
 
-[![Release](https://img.shields.io/badge/Release-v1.11.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.11.0)
+[![Release](https://img.shields.io/badge/Release-v1.12.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.12.0)
 [![Target](https://img.shields.io/badge/PHP_Targets-8.2_·_8.3_·_8.4_·_8.5-334155?style=flat-square)](#)
 [![CVSS](https://img.shields.io/badge/CVSS_v4.0-9.2_CRITICAL-b91c1c?style=flat-square)](#)
 [![ASLR](https://img.shields.io/badge/ASLR-Cookie_Window_1.88_MB-d97706?style=flat-square)](#)
@@ -19,7 +19,7 @@ Contact: Telegram [@JocesLab](https://t.me/JocesLab) · email [joshrob.sec@proto
 ---
 </div>
 
-- **Status**: public release v1.11.0, 2026-11-09 (portability matrix and disclosure timeline published, patch-state check against php.net and php-src, plus the v1.0.0→latest pointer; official stock distribution image calibration, FastCGI stdout isolation proofs, SAPI architecture disambiguation, measured ASLR scope per read size, per-run 9bie transcripts, and the published measurement harness).
+- **Status**: public release v1.12.0, 2026-11-09 (portability matrix and disclosure timeline published, patch-state check against php.net and php-src, plus the v1.0.0→latest pointer; official stock distribution image calibration, FastCGI stdout isolation proofs, SAPI architecture disambiguation, measured ASLR scope per read size, per-run 9bie transcripts, and the published measurement harness).
 - **Scope**: PHP 8.4.x and adjacent branches (8.2, 8.3, 8.5), official PHP container images, public proof-of-concept code, and independent lab reproduction.
 - **Application scope**: a Nextcloud 33.0.x test deployment (PHP 8.4.21, Apache `mod_php` prefork) was used to validate the exposed configuration and patch level. The RCE proof was obtained on the official `php:8.4.26-apache` image. The bug is in PHP request startup, not Nextcloud code.
 - **Artifacts**: `PORTABILITY.md` (the measured matrix of what gates the chain), `TIMELINE.md` (disclosure timeline with sources), formal typography PDF releases (`REPORT.pdf` and `RESUMEN.pdf`), reproducible lab instrumentation (`tooling/labkit/` and `tooling/docker-compose.yml`), non-destructive diagnostic tooling (`tooling/checker/`), offline reachability calculators, and detection rules.
@@ -158,6 +158,28 @@ cd lab && python3 -m pytest tests/ exploit/tests/ -q   # 147 passed, 4 skipped
 
 ---
 
+## Related work
+
+This report does not re-derive the root cause. It measures what other write-ups claim, and says
+what reproduced. The root-cause work is theirs:
+
+- **Wiz** (co-discoverer) — root cause and the three multipart vectors that land the OOM.
+- **CrowdStrike** — the bookkeeping detail: `_zend_hash_str_add_or_update_i` increments the entry
+  count before `zend_string_init()` can fail, and the bucket array comes from an uninitialized
+  `emalloc`. Also tracks three distinct flaws under the two CVEs.
+- **Keysight** — a call-chain walkthrough with packet captures, from the multipart body down to
+  `nNumUsed` being incremented ahead of the allocation.
+- **mekhalleh/php2shell-advisory** — the ordering bug with source lines (`main/main.c:1873`
+  before `1874`), the fix (`php_basic_early_rinit()`), and a passive Nuclei template.
+- **Exaforce** — why the early "session upload-progress use-after-free" framing was a trigger and
+  not the root cause.
+- **9bie** — the HTTP-only ASLR technique this report measures; **ikow** — the five-chain PoC set
+  reviewed in `POCS.md`.
+
+What this repository adds, and the reason to read it second: per-cell counts with controls across
+8.4.21/8.4.26/8.4.27/8.5.12, the portability matrix, the retracted claims, and the conditions
+under which each number holds or does not.
+
 ## Repository contents
 
 | Document / Asset | Description |

diff --git a/TIMELINE.es.md b/TIMELINE.es.md
@@ -33,6 +33,9 @@ contra esta línea de tiempo.
 | 2026-10-24 | **Lab:** el leak de cookie no existe en FPM (A mata al worker, exit 70); en `mod_php` el leak y la primitiva de `BG(unserialize)` colgante son mutuamente excluyentes — la ruta Off + ASLR on queda cerrada por ambas vías | este proyecto |
 | 2026-10-24 | **Lab:** bypass de `post_max_size` con chunked confirmado (claim de chain D de ikow): chunked 30 MB parsea completo, chunked 70 MB hace OOM en request startup con 128M/8M | este proyecto |
 | 2026-11-09 | La última estable sigue siendo 8.4.27 / 8.5.12; 8.4.28 y 8.5.13 son solo RC1; CVE-2026-115560 sigue sin fix estable | php.net, php-src |
+| 2026-10-26 | **CISA agrega ambas CVE a KEV**, fecha límite federal 29 oct | CISA |
+| 2026-10-27 | La prensa confirma explotación y el plazo de tres días para agencias | The Register |
+| 2026-10-28 | KEV agrega CVE-2026-46300 (kernel Linux), documentada como encadenable con este par para llegar a root | CISA |
 
 ## Notas
 

diff --git a/TIMELINE.md b/TIMELINE.md
@@ -32,6 +32,9 @@ the order of events checkable: several claims in circulation only make sense aga
 | 2026-10-24 | **Lab:** the cookie leak does not exist on FPM (A kills the worker, exit 70); on `mod_php` the leak and the dangling `BG(unserialize)` primitive are mutually exclusive — the Off + ASLR-on route is closed on both paths | this project |
 | 2026-10-24 | **Lab:** `post_max_size` bypass with chunked confirmed (ikow's chain D claim): 30 MB chunked parses whole, 70 MB chunked OOMs during request startup at 128M/8M | this project |
 | 2026-11-09 | Latest stable is still 8.4.27 / 8.5.12; 8.4.28 and 8.5.13 are RC1 only; CVE-2026-115560 still has no stable fix | php.net, php-src |
+| 2026-10-26 | **CISA adds both CVEs to KEV**, federal due date 29 Oct | CISA |
+| 2026-10-27 | Press confirms exploitation and the three-day deadline for agencies | The Register |
+| 2026-10-28 | KEV adds CVE-2026-46300 (Linux kernel), documented as chainable with this pair to reach root | CISA |
 
 ## Notes