# Source: PHP2Shell : une première cyberattaque réussie fait craindre une vague d’intrusions

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

fr.cnet: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell : une première cyberattaque réussie fait craindre une vague d’intrusions

**fr.cnet** · [https://fr.cnet.com/cybersecurite/6121/php2shell-une-premiere-cyberattaque-reussie-fait-craindre-une-vague-dintrusions](https://fr.cnet.com/cybersecurite/6121/php2shell-une-premiere-cyberattaque-reussie-fait-craindre-une-vague-dintrusions) · published 2026-10-27T09:37:48+00:00 · added by `curator@php.newsroom` · slug `fr-cnet-cybersecurite-6121-php2shell-une-premier`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261027T121358Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). CNET France (French), 27 October: 'PHP2Shell: a first successful cyberattack raises fears of a wave of intrusions'. It relays that Perplexity's Adel K...

## What it says, as the collector read it

#### PHP2Shell : une première cyberattaque réussie fait craindre une vague d’intrusions

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/fr-cnet/cybersecurite-6121-php2shell-une-premiere-cyberattaque-reuss`, snapshot `20261027T121358Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T121358Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

CNET France (French), 27 October: 'PHP2Shell: a first successful cyberattack raises fears of a wave of intrusions'. It relays that Perplexity's Adel Karimi identified an intrusion on a honeypot in which the attacker extracted about 800 kilobytes of internal data before taking control of the server in a fraction of a second, that Expel's Marcus Hutchins confirmed it as the first proof of successful exploitation in a real attack, that Cloudflare counted millions of attempts and Amazon saw activity four days before the patches. It adds a second incident, the StealMyBitcoin.com challenge, saying that about 20 hours after launch a participant exploited the flaws 'to steal the cryptocurrency'. It then relays Cyfirma's report of a reconnaissance campaign attributed to the North Korean group Lazarus, using 21 already-compromised servers to probe 216 potentially vulnerable targets (government, banks, airports) in the US, Japan, South Korea and the EU, with Cyfirma's CEO quoted via The Hacker News on its slow pace, and mentions a third, unpatched flaw reported by the PHP Foundation.

> Les chercheurs de Cyfirma ont également signalé une campagne de reconnaissance attribuée au groupe Lazarus, associé à la Corée du Nord.

_Curator's translation:_ "Cyfirma's researchers have also reported a reconnaissance campaign attributed to the Lazarus group, associated with North Korea."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell : une première cyberattaque réussie fait craindre une vague d’intrusions". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `fr`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T121358Z · HTTP 200 · https://fr.cnet.com/cybersecurite/6121/php2shell-une-premiere-cyberattaque-reussie-fait-craindre-une-vague-dintrusions- `headers.json` 4263ce1293df862a5ecb4fbd7d65b38c8466aaa64d66e8a6881a7abc9233698a 814 bytes
- `page.html` 27657d44895265f20806c2a74c7945f4276266ea6c1fd805f71710a8074e6ed2 432,516 bytes
- `provenance.json` 8b9983b561fd0dae8a0706124f30776dfa41070d9e262a9ee63ae66fdc54f8df 1,833 bytes
- `rendered.html` 391d8aaf40a1a8255ae74e5ff823e156a7eee6e619192299a510055a8baf2216 437,338 bytes
- `screenshot.jpg` e42ebd86f0f791d98ab57b59371a4a57607afc80553ed6494b300fbf1202134f 465,228 bytes
- `text.txt` 98d416c5f793192f01cac662f33637c7a0e2c41808c3b07892de816ed686cd09 5,198 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/fr-cnet-cybersecurite-6121-php2shell-une-premier/index.html