CISA, PHP2Shell Güvenlik Açıklarının Saldırılarda Kullanıldığını Doğruladı - ÇözümPark

CISA, PHP2Shell Güvenlik Açıklarının Saldırılarda Kullanıldığını Doğruladı - ÇözümPark

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page tr/news/cozumpark/cisa-php2shell-guvenlik-aciklarinin-saldirilarda-kullanildig, snapshot 20261028T171512Z. Copied byte for byte; every file's sha256 is in captures/20261028T171512Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Turkish IT-news piece (ÇözümPark, 28 October) on CISA confirming that the two PHP2Shell flaws are exploited and adding them to its Known Exploited Vulnerabilities catalog on Monday (26 October), with federal civilian agencies told to secure their systems by Thursday (29 October) under Binding Operational Directive 26-04. It says the details leaked before the patches, that the PHP security team said none of the circulating proof-of-concept samples worked, that Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack saw broad exploitation attempts before disclosure which they classed as failed, that Amazon said attackers began targeting the flaws four days before the patches, and that Perplexity's detection lead confirmed exploitation in real attacks over the weekend, on honeypots. It adds that CISA has not shared the scale of the attacks, gives VirusTotal's estimates (about 70% of sites on PHP, more than 5.1 million internet-facing PHP servers) and notes mitigations shared on 23 October for a further, not yet patched flaw, CVE-2026-115560.

> CISA, PHP2Shell açıklarını pazartesi günü KEV kataloğuna ekledi ve Federal Sivil Yürütme Organı kurumlarına sistemlerini perşembe gününe kadar güvence altına alma talimatı verdi.

_Curator's translation:_ "CISA added the PHP2Shell flaws to the KEV catalog on Monday and instructed Federal Civilian Executive Branch agencies to secure their systems by Thursday."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "CISA, PHP2Shell Güvenlik Açıklarının Saldırılarda Kullanıldığını Doğruladı - ÇözümPark". Selected mechanically, not read by a person.

Capture notes

Language tr. Secondhand on CISA, the PHP security team and several vendors. The page describes the further flaw's configuration conditions and a honeypot's PHP version; none of the conditions are copied here. The page's weekday-only dates are read as Monday 26 and Thursday 29 October, consistent with other outlets. Nothing in the page addresses an AI or hides text from a reader.