PHP2Shell: как одна дыра в PHP напугала полмира — и что это значит для нас — EADaily, 27 октября 2026 — Технологии, Новости России

PHP2Shell: как одна дыра в PHP напугала полмира — и что это значит для нас — EADaily, 27 октября 2026 — Технологии, Новости России

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page eg/news/eadaily/ru-news-2026-10-27-php2shell-kak-odna-dyra-v-php-napugala-po, snapshot 20261027T094306Z. Copied byte for byte; every file's sha256 is in captures/20261027T094306Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

EADaily (Russia, Russian), 27 October, by Alan Pukhaev: 'PHP2Shell: how one hole in PHP scared half the world'. A broad explainer that mixes sourced and unsourced statements. It says the Netherlands switched off DigiD, the government portal, the parliament site, the Port of Rotterdam and some hospital and transport services as a precaution, Japan paused its tax service for hours and then Finance Ministry and big-company sites (Nomura, MUFG, ANA), and that the BreachForums and Dread forums closed on 21 October out of fear for their own servers (no source given). It describes Russia's National Coordination Centre for Computer Incidents under the FSB sending, on 22 October through GosSOPKA, a directive to critical-infrastructure owners: update to a fixed version, consider temporarily restricting external access up to switching off if they cannot, then run antivirus checks and review logs and report suspicious activity. It gives W3Techs' 90.8% PHP share of Russian-language sites (69.3% worldwide), Bi.Zone's estimate of about 50,000 potentially vulnerable PHP web applications in the Russian segment, and Kazakhstan's KZ-CERT warning of 22 October (update, interim measures, log monitoring), noting KZ-CERT reported no confirmed mass compromises. It says a story circulating that an autonomous AI agent breached a European ministry in two hours and that Lazarus was behind it has no confirmation in reliable sources and should be treated as a version, not a fact; and that a Polites News scan of 15 Kazakh state sites found two (ortcom.kz, bolashak.gov.kz) openly showing PHP 7.4.33. The data-exfiltration paragraphs describe what an attacker could take from memory, in general terms.

> Однако эта конкретная история в авторитетных источниках прямого подтверждения не нашла.

_Curator's translation:_ "However, this particular story has found no direct confirmation in authoritative sources."

Why it is here

From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: как одна дыра в PHP напугала полмира — и что это значит для нас — EADaily, 27 октября 2026 — Технологии, Новости России". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language ru. Nothing in the article text addresses an AI or hides text from a reader; the page ends with the site's unrelated news feed. The article itself says it is a follow-up to an earlier text of the author's.