# Source: Les failles critiques PHP2Shell dorénavant exploitées

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

dcod: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Les failles critiques PHP2Shell dorénavant exploitées

**dcod** · [https://dcod.ch/2026/11/02/failles-php2shell-exploitees/](https://dcod.ch/2026/11/02/failles-php2shell-exploitees/) · published 2026-11-02 · added by `curator@php.newsroom` · slug `dcod-2026-11-02-failles-php2shell-exploitees`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261103T121630Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). A Swiss French-language security-news piece (dcod, 2 November) saying experts confirmed on 26 October remote code execution through PHP2Shell and that...

## What it says, as the collector read it

#### Les failles critiques PHP2Shell dorénavant exploitées

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/dcod/2026-11-02-failles-php2shell-exploitees`, snapshot `20261103T121630Z`. Copied byte for byte; every file's sha256 is in `captures/20261103T121630Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A Swiss French-language security-news piece (dcod, 2 November) saying experts confirmed on 26 October remote code execution through PHP2Shell and that observation honeypots recorded 35 successful executions of arbitrary commands on 24 October, documented in a technical report published on GitHub, with attackers starting command shells under the Apache server process. Relaying SecurityAffairs, Slashdot and TechCrunch, it adds that CISA listed the flaws among its known exploited vulnerabilities with a three-day deadline for public services, that attacker groups are scanning the web at low frequency and relaying probes through intermediate systems to examine more than two hundred still-exposed servers, and that PHP's reach (about 70% of web servers) and AI-assisted tooling make patching or isolating exposed applications urgent. It concludes with advice to patch, put unpatchable legacy applications on a private network or switch them off.

> Les honeypots d’observation ont enregistré 35 exécutions réussies de commandes arbitraires sur des cibles faisant tourner le moteur PHP sans filtre applicatif.

_Curator's translation:_ "The observation honeypots recorded 35 successful executions of arbitrary commands on targets running the PHP engine without an application filter."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "Les failles critiques PHP2Shell dorénavant exploitées". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `fr-FR`. Secondhand on other outlets and on a GitHub report that is not in the vault. The page describes how the attack extracts memory and why it works; none of that is copied here. The page opens with unrelated headlines. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261103T121630Z · HTTP 200 · https://dcod.ch/2026/11/02/failles-php2shell-exploitees/- `headers.json` e9226e0119d19d8c6270d4002ea6a984e5e955b6c1a0035f293e12f4a592d17e 892 bytes
- `page.html` 82a08323f3aca30201c1c20b466b228a90d345db566ccb91364f2068137347a6 215,334 bytes
- `provenance.json` 78fc7353184c202cf06c5c3311891bf14b6094f0a0f5a518774a9d119c8bc51f 1,626 bytes
- `rendered.html` 8594b734e174b8f0209f409b6624b8f158a8067926e3e14940657b0e5f5475c6 222,325 bytes
- `screenshot.jpg` 66a8a7787e081ce037eac6c679b5d2748346e7ae2471c7baf7c6a91e3773b54f 737,164 bytes
- `text.txt` 9c3dca1a08f21a2a21701d35412db4bb6ff9d7a79e04ea53437c005249880a10 10,513 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.58 · data as of 2026-11-03T12:16Z · vault commit a8e4e3dc5490 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/dcod-2026-11-02-failles-php2shell-exploitees/index.html