Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
What You Need to Know About the PHP2Shell Vulnerabilities | HackerNoon
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T071103Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). A long plain-language explainer on HackerNoon about PHP2Shell, written without payloads or step-by-step detail. It gives the patched versions (8.5.12,...
What it says, as the collector read it
What You Need to Know About the PHP2Shell Vulnerabilities | HackerNoon
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page gb/news/hackernoon/what-you-need-to-know-about-the-php2shell-vulnerabilities, snapshot 20261028T071103Z. Copied byte for byte; every file's sha256 is in captures/20261028T071103Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
A long plain-language explainer on HackerNoon about PHP2Shell, written without payloads or step-by-step detail. It gives the patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), notes that PHP 8.1 and older no longer get updates from the PHP project and that php.net says there is no complete mitigation, relays Wiz's estimate that about 70% of websites run PHP (which the BBC said it could not independently verify), and sets out a UTC disclosure timeline: CVE ids circulating from about 15:00 UTC on 20 October with a wrong release time and a CVSS of 10.0, a pre-announcement at 19:30 UTC, release brought forward from 22 to 21 October at 14:00 UTC, a mistakenly published proof-of-concept video, and Chainguard's publication of built images with the fix at 07:41 UTC on 21 October, more than six hours before the coordinated release, which the PHP Foundation describes as breaking the embargo (disputed by Chainguard's leadership). It adds that Amazon's honeypots logged an exploitation attempt as early as 17 October, and describes the outages operators chose as precaution.
> PHP 8.1 and older no longer get updates from the PHP project itself.
Why it is here
From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "What You Need to Know About the PHP2Shell Vulnerabilities | HackerNoon". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.
Capture notes
Language en. The capture shows no publication date, so none is recorded; the text speaks of the events of 21 October. The explainer describes how the flaws work only in analogy; none of that is copied into the notes. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261028T071103Z · HTTP 200 · https://hackernoon.com/what-you-need-to-know-about-the-php2shell-vulnerabilities
headers.json2849b11da99e56980676b9ae0913384a10c1ab6ec3ccb192054fc547c025fe71 751 bytespage.html052fd580a0e8572ae143cfc96a4e975acccce332beb8ad63854152a9bdb1f459 206,736 bytesprovenance.json47392a733a0123fd6aad70287f82f6523da60715a599b9934f03035de98a15ef 1,744 bytesrendered.htmlc946c09f8ccb38b73dbcf654246a13c133552131acd84ae96daba6d8428c4622 359,116 bytesscreenshot.jpg592247f756807b1164ffe087ab9990b25badc93cb5f6fa7f7b3cad25fe4ee5ce 873,307 bytestext.txte4b740be8cac9ecc15260280810dbae519626eefaeb999a108fe11b27505b83a 21,764 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →