diff --git a/CVE-CHANNEL.md b/CVE-CHANNEL.md
index b92e596..06711e4 100644
--- a/CVE-CHANNEL.md
+++ b/CVE-CHANNEL.md
@@ -31,21 +31,27 @@ it, so the stamp is what makes a publish take effect.
     "enabled": true,
     "priority": 1,
     "rules": [{
-      "id": "CVE-2026-109618-01",
-      "name": "PHP upload-progress field present",
-      "pattern": "^php_session_upload_progress$",
-      "targets": ["param_names"],
+      "id": "CVE-2025-31161-01",
+      "name": "CrushFTP authentication bypass via crafted Authorization header",
+      "pattern": "(?i)AWS4-HMAC-SHA256.*Credential=[^/]*/",
+      "targets": ["headers"],
       "action": "block",
       "severity": "critical",
       "category": "cve",
-      "cve": "CVE-2026-109618, CVE-2026-109619",
+      "cve": "CVE-2025-31161",
       "enabled": true,
-      "references": ["https://nvd.nist.gov/vuln/detail/CVE-2026-109618"]
+      "references": ["https://nvd.nist.gov/vuln/detail/CVE-2025-31161"]
     }]
   }]
 }
 ```
 
+That example is deliberately NOT the PHP upload-progress rule, which this
+document used to show. That CVE is patched in compiled code, so the guard below
+refuses it — the one example a reader was most likely to copy was the one
+example that could not be published. Anything already patched in code belongs
+in code; see the end of this page.
+
 `source` must be `edgeguard-cve`. That is the source the channel owns and the
 only one it may clear, which is also what makes a rule **withdrawable**: remove
 it, bump the stamp, and it stops being enforced everywhere within the hour.