# Source: CISA, PHP2Shell Güvenlik Açıklarının Saldırılarda Kullanıldığını Doğruladı - ÇözümPark

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

ÇözümPark: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# CISA, PHP2Shell Güvenlik Açıklarının Saldırılarda Kullanıldığını Doğruladı - ÇözümPark

**ÇözümPark** · [https://www.cozumpark.com/cisa-php2shell-guvenlik-aciklarinin-saldirilarda-kullanildigini-dogruladi/](https://www.cozumpark.com/cisa-php2shell-guvenlik-aciklarinin-saldirilarda-kullanildigini-dogruladi/) · published 2026-10-28 · added by `curator@php.newsroom` · slug `cozumpark-cisa-php2shell-guvenlik-aciklarinin-sald`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T171512Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A Turkish IT-news piece (ÇözümPark, 28 October) on CISA confirming that the two PHP2Shell flaws are exploited and adding them to its Known Exploited V...

## What it says, as the collector read it

#### CISA, PHP2Shell Güvenlik Açıklarının Saldırılarda Kullanıldığını Doğruladı - ÇözümPark

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/cozumpark/cisa-php2shell-guvenlik-aciklarinin-saldirilarda-kullanildig`, snapshot `20261028T171512Z`. Copied byte for byte; every file's sha256 is in `captures/20261028T171512Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A Turkish IT-news piece (ÇözümPark, 28 October) on CISA confirming that the two PHP2Shell flaws are exploited and adding them to its Known Exploited Vulnerabilities catalog on Monday (26 October), with federal civilian agencies told to secure their systems by Thursday (29 October) under Binding Operational Directive 26-04. It says the details leaked before the patches, that the PHP security team said none of the circulating proof-of-concept samples worked, that Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack saw broad exploitation attempts before disclosure which they classed as failed, that Amazon said attackers began targeting the flaws four days before the patches, and that Perplexity's detection lead confirmed exploitation in real attacks over the weekend, on honeypots. It adds that CISA has not shared the scale of the attacks, gives VirusTotal's estimates (about 70% of sites on PHP, more than 5.1 million internet-facing PHP servers) and notes mitigations shared on 23 October for a further, not yet patched flaw, CVE-2026-115560.

> CISA, PHP2Shell açıklarını pazartesi günü KEV kataloğuna ekledi ve Federal Sivil Yürütme Organı kurumlarına sistemlerini perşembe gününe kadar güvence altına alma talimatı verdi.

_Curator's translation:_ "CISA added the PHP2Shell flaws to the KEV catalog on Monday and instructed Federal Civilian Executive Branch agencies to secure their systems by Thursday."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "CISA, PHP2Shell Güvenlik Açıklarının Saldırılarda Kullanıldığını Doğruladı - ÇözümPark". Selected mechanically, not read by a person.

#### Capture notes

Language `tr`. Secondhand on CISA, the PHP security team and several vendors. The page describes the further flaw's configuration conditions and a honeypot's PHP version; none of the conditions are copied here. The page's weekday-only dates are read as Monday 26 and Thursday 29 October, consistent with other outlets. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261028T171512Z · HTTP 200 · https://www.cozumpark.com/cisa-php2shell-guvenlik-aciklarinin-saldirilarda-kullanildigini-dogruladi/- `headers.json` 4db3dcc7862a3124e54957e5796072f575d146e2fe7d0e0de6c270d10b38a35a 1,421 bytes
- `page.html` 0bce9d525ea25e25b07ed1b54dfdd1de4c8b9332ca5bf4ee7fbc2a81c77e932f 267,502 bytes
- `provenance.json` e1b6c196e125f330f5b47ebe9ba35a2bdd4e6c5cc7dd7284e4abe83d7e4f168b 1,820 bytes
- `rendered.html` 2466338213d82aeb71b3e8e1c23d6fb4f4cf9050ab7ec390f4f3201ba957f85f 281,659 bytes
- `screenshot.jpg` 131c0489bff6551240eb3dc94239038e14eb65182836735dd91942ef23019901 444,923 bytes
- `text.txt` ae3f6c8d0bfd1efbfc24df293ef40e393f614a3a8e9a5ece49ad6a116c0f2b8d 10,778 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.51 · data as of 2026-10-28T17:15Z · vault commit 75668aedfb6d · https://refs.php.oct.2026.newsroom.sgit.ai/sources/cozumpark-cisa-php2shell-guvenlik-aciklarinin-sald/index.html