Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Party
watchTowr
confirmed the CVE numbers in public on 20 October, per Daubois
Claims this site attributes to this party
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release fact timeline → | Daubois; CERT-EU lists a watchTowr X post among public reports | reported | A4 Corroborated●●●●○○ | 1/2 | Daubois CERT-EU |
| watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild watchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. fact timeline → | watchTowr | unverified | A6 Established●●●●●● | 2/2 | watchTowr watchTowr |
Its sources in the vault
- What the PHP2Shell rumors got wrong, from inside the PHP security team Alexandre Daubois (PHP security team / PHP Foundation)
- Security Advisory 2026-018: Critical Vulnerabilities in PHP CERT-EU