Hackers exploram PHP2Shell e invadem órgão governamental europeu

Hackers exploram PHP2Shell e invadem órgão governamental europeu

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page br/news/cybersecbrazil/post-hackers-exploram-php2shell-e-invadem-c3-b3rg-c3-a3o-gov, snapshot 20261028T071103Z. Copied byte for byte; every file's sha256 is in captures/20261028T071103Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Brazilian security-news roundup (CyberSecBrazil, 25 October) that gathers reports around PHP2Shell: Palo Alto Networks Unit 42's account of attackers compromising a European government entity (with signs of agentic AI use), CYFIRMA's report of a suspected North Korea-linked reconnaissance campaign monitoring 216 unpatched servers, Defused Cyber's honeypot probing, Cloudflare's note of millions of exploitation attempts, a lab reproduction by ReliaQuest, a third PHP remote-code-execution flaw flagged by the PHP Foundation (CVE-2026-115560), and a Bitsight count of about 37 million internet-facing PHP systems. The Unit 42 intrusion account is the one Unit 42 withdrew the same day (see cur20-scworld-unit42-retraction), so it is recorded as disputed.

> a identidade dos responsáveis pelo ataque permanece desconhecida

_Curator's translation:_ "the identity of those responsible for the attack remains unknown."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Hackers exploram PHP2Shell e invadem órgão governamental europeu". Selected mechanically, not read by a person.

Capture notes

Language pt. A second-hand roundup. The page carries exploitation mechanics, a request marker string and attacker-channel identifiers; none of it is copied into the notes or claims. Nothing in the page addresses an AI or hides text from a reader.