Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
PHP2Shellの悪用によるRCE成功例を研究者が報告 | Codebook｜Security News
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261027T094306Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Codebook, Security News (Japan, Japanese), 27 October, a Silobreaker daily cyber alert summarising BleepingComputer of 26 October: Perplexity's Adel K...
What it says, as the collector read it
PHP2Shellの悪用によるRCE成功例を研究者が報告 | Codebook｜Security News
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page cz/news/codebook-machinarecord/threatreport-silobreaker-cyber-alert-48256, snapshot 20261027T094306Z. Copied byte for byte; every file's sha256 is in captures/20261027T094306Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Codebook, Security News (Japan, Japanese), 27 October, a Silobreaker daily cyber alert summarising BleepingComputer of 26 October: Perplexity's Adel Karimi reported successful remote code execution on his honeypots against Apache mod_php with PHP 8.4.26, from two different source addresses and a total of 35 shell processes on three honeypots, with the two activities possibly by different actors; he cautioned it shows the attack works in a deliberately favourable single-worker setup, not reliability elsewhere; Expel's Marcus Hutchins called it by far the best-quality evidence of PHP2Shell exploitation in real attacks. It adds that on 23 October the PHP team shared mitigations for another remote-code-execution flaw, CVE-2026-115560, which has no patch yet and applies only to unusual configuration and application-code combinations, with session.upload_progress.enabled set to 0 recommended. Duplicates the BleepingComputer report held by other items.
> ただ、「今回の証拠は、攻撃が成立しやすいよう意図的に構成された、ワーカープロセスが1つのmod_php環境で一連の攻撃が成立したことを示している。
_Curator's translation:_ "'This evidence shows that the sequence of attacks succeeded in a mod_php environment deliberately set up to make an attack easy, with a single worker process.'"
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shellの悪用によるRCE成功例を研究者が報告 | Codebook｜Security News". Selected mechanically, not read by a person.
Capture notes
Language ja. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261027T094306Z · HTTP 200 · https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/48256/
headers.json15728bfec405dc4f3eacd384b26b6e3ee96d6e0029707b0eaf536b7a30bb1f6b 1,879 bytespage.htmla2640ecb6c9e8aea86b9250298d9452565351f9b8d6399e5363da269e3968307 97,264 bytesprovenance.json5e30a8c85acf20beefd89c3930a2aa465628e0136318598af81a7478234085df 1,763 bytesrendered.html9832c46b07ac3600d0e78e8177d3fb757b95e1a6fce1087ef064057f2ceb28fb 109,495 bytesscreenshot.jpg1b275d93f998ec92ca8b69a3387eace21ce2bafa065d3cb20a4c36b0112e1296 570,593 bytestext.txtd9f8c30afa670000b0989a36a53fa46b1a902693d409b8b6e17d38d344172575 9,711 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →