# Critic gate · security subscriptions + php2shell page (Oct 22, 2026, ~3:00 PM PT)

Verdict: FIX on both packs. No prices, turnaround times or promises approved (D1 to D11 are json's). Copy only, no graphics, so no tilts to report.

## Passes
- Sophos: no "confirmed exploit" or Mirai claim on either page. Correction is cited only as a source. PASS.
- Clinton: title "Deputy Chief Information Security Officer at Anthropic" is right. Quote matches the X post (id 2113325263157395456) word for word, which I checked myself. PASS on attribution.
- Pills and buttons: all caps, no "!", no prices, no vendor names. PASS.
- Guarantees: the only promise language is the two "no one can honestly promise" FAQs. PASS.
- php2shell FAQ vs FAQPage JSON-LD: all 19 questions and answers match word for word. PASS.
- Tone is calm and plain overall. "A sign isn't proof" lines are good.

## Fixes: security-subscriptions
1. PAGE-COPY s3 small line: "Extra work is $225 an hour" is a live price outside the D list. Make it {DECISION} or add it to D3.
2. PAGE-COPY s5 step 6: "first report within the first month" is a promise. Add it to D2 or D5 or cut the time.
3. PAGE-COPY s6 Clinton block: recommend CUT (D11). The quote is accurate, but "a lot worse before they get better" and "ask for help right now" is fear and urgency on a sales page, and quoting an Anthropic executive next to our plans reads like an endorsement. If json keeps it: drop the OfficeChai link, because the README dates that article Oct 23 (tomorrow), and keep it out of the hero.
4. PAGE-COPY s2 pill "THIS WEEK": it goes stale in days and reads a bit like a news alert. Use "OCTOBER 2026".
5. FAQ "security plugin": "Wordfence says updating and restarting PHP is essential" is only verified secondhand. Either confirm it on Wordfence's own page in a browser, or write it as "Wordfence's help pages describe its firewall as running inside WordPress", with no quote.
6. EMAIL-TEMPLATES t3: "A few clients have asked whether we can keep doing this every month" is an invented claim unless json confirms it's true. Default: "If you'd like us to keep doing this every month, we've put it into three plans:".
7. README files table says "decisions D1 to D9", but the list runs to D11. Fix the label.

## Fixes: php2shell-service-page
8. FAQ "Is my WordPress site affected" and "Is the CVE-2026-109618 patch out?" still list only the four fixed releases. Add the 8.1/8.0/7.4 build-date line so they agree with the correction. Update the JSON-LD to match.
9. FAQ "Do I need to take my site offline?": "or if they run PHP 8.1 or older" now conflicts with the patched builds. Scope it: "CISA's Oct 21 alert, published before the 8.1, 8.0 and 7.4 patches, advises..."
10. s6 step 6: "or keep us on a care plan" contradicts the changelog, since care plans have no PHP. Use "or keep us on a security plan".
11. Tier name "PHP 8.1 or older: patch now, then upgrade or move": drop "now", because it's urgency in a heading. Update the matching JSON-LD Offer name too.
12. Firewall FAQ: same Wordfence sourcing note as fix 5.
13. Optional checklist "PROPOSED ~$9": not approved; it's json's call.

## Before launch (unchanged)
Recheck KEV, host builds and the Sophos page the same day. Browser-check the Plesk and Wordfence links. Stripe objects stay in test mode only. I did not load any Stripe links.

## Re-gate, ~3:00 PM PT: PASS on copy
I checked all 13 fixes in the files. The FAQ and JSON-LD match 19 of 19. The fix 9 wording and the Wordfence paraphrase are OK.
Small follow-up, not blocking: AEO-SNIPPETS 24 and 30 should add the line about 8.1, 8.0 and 7.4 builds dated Oct 21 or later.
Still open: json's D1 to D12 (Critic recommends cutting the D11 section), json's sign-off, the launch-day rechecks, and Stripe in test mode only. This pass approves no numbers.