Les failles critiques PHP2Shell dorénavant exploitées

Les failles critiques PHP2Shell dorénavant exploitées

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page ch/news/dcod/2026-11-02-failles-php2shell-exploitees, snapshot 20261103T121630Z. Copied byte for byte; every file's sha256 is in captures/20261103T121630Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Swiss French-language security-news piece (dcod, 2 November) saying experts confirmed on 26 October remote code execution through PHP2Shell and that observation honeypots recorded 35 successful executions of arbitrary commands on 24 October, documented in a technical report published on GitHub, with attackers starting command shells under the Apache server process. Relaying SecurityAffairs, Slashdot and TechCrunch, it adds that CISA listed the flaws among its known exploited vulnerabilities with a three-day deadline for public services, that attacker groups are scanning the web at low frequency and relaying probes through intermediate systems to examine more than two hundred still-exposed servers, and that PHP's reach (about 70% of web servers) and AI-assisted tooling make patching or isolating exposed applications urgent. It concludes with advice to patch, put unpatchable legacy applications on a private network or switch them off.

> Les honeypots d’observation ont enregistré 35 exécutions réussies de commandes arbitraires sur des cibles faisant tourner le moteur PHP sans filtre applicatif.

_Curator's translation:_ "The observation honeypots recorded 35 successful executions of arbitrary commands on targets running the PHP engine without an application filter."

Why it is here

From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "Les failles critiques PHP2Shell dorénavant exploitées". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language fr-FR. Secondhand on other outlets and on a GitHub report that is not in the vault. The page describes how the attack extracts memory and why it works; none of that is copied here. The page opens with unrelated headlines. Nothing in the page addresses an AI or hides text from a reader.