# Source: What You Need to Know About the PHP2Shell Vulnerabilities | HackerNoon

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

HackerNoon: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# What You Need to Know About the PHP2Shell Vulnerabilities | HackerNoon

**HackerNoon** · [https://hackernoon.com/what-you-need-to-know-about-the-php2shell-vulnerabilities](https://hackernoon.com/what-you-need-to-know-about-the-php2shell-vulnerabilities) · published not stated in the capture · added by `curator@php.newsroom` · slug `hackernoon-what-you-need-to-know-about-the-php2shel`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T071103Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). A long plain-language explainer on HackerNoon about PHP2Shell, written without payloads or step-by-step detail. It gives the patched versions (8.5.12,...

## What it says, as the collector read it

#### What You Need to Know About the PHP2Shell Vulnerabilities | HackerNoon

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/hackernoon/what-you-need-to-know-about-the-php2shell-vulnerabilities`, snapshot `20261028T071103Z`. Copied byte for byte; every file's sha256 is in `captures/20261028T071103Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A long plain-language explainer on HackerNoon about PHP2Shell, written without payloads or step-by-step detail. It gives the patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), notes that PHP 8.1 and older no longer get updates from the PHP project and that php.net says there is no complete mitigation, relays Wiz's estimate that about 70% of websites run PHP (which the BBC said it could not independently verify), and sets out a UTC disclosure timeline: CVE ids circulating from about 15:00 UTC on 20 October with a wrong release time and a CVSS of 10.0, a pre-announcement at 19:30 UTC, release brought forward from 22 to 21 October at 14:00 UTC, a mistakenly published proof-of-concept video, and Chainguard's publication of built images with the fix at 07:41 UTC on 21 October, more than six hours before the coordinated release, which the PHP Foundation describes as breaking the embargo (disputed by Chainguard's leadership). It adds that Amazon's honeypots logged an exploitation attempt as early as 17 October, and describes the outages operators chose as precaution.

> PHP 8.1 and older no longer get updates from the PHP project itself.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "What You Need to Know About the PHP2Shell Vulnerabilities | HackerNoon". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `en`. The capture shows no publication date, so none is recorded; the text speaks of the events of 21 October. The explainer describes how the flaws work only in analogy; none of that is copied into the notes. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261028T071103Z · HTTP 200 · https://hackernoon.com/what-you-need-to-know-about-the-php2shell-vulnerabilities- `headers.json` 2849b11da99e56980676b9ae0913384a10c1ab6ec3ccb192054fc547c025fe71 751 bytes
- `page.html` 052fd580a0e8572ae143cfc96a4e975acccce332beb8ad63854152a9bdb1f459 206,736 bytes
- `provenance.json` 47392a733a0123fd6aad70287f82f6523da60715a599b9934f03035de98a15ef 1,744 bytes
- `rendered.html` c946c09f8ccb38b73dbcf654246a13c133552131acd84ae96daba6d8428c4622 359,116 bytes
- `screenshot.jpg` 592247f756807b1164ffe087ab9990b25badc93cb5f6fa7f7b3cad25fe4ee5ce 873,307 bytes
- `text.txt` e4b740be8cac9ecc15260280810dbae519626eefaeb999a108fe11b27505b83a 21,764 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.51 · data as of 2026-10-28T17:15Z · vault commit 75668aedfb6d · https://refs.php.oct.2026.newsroom.sgit.ai/sources/hackernoon-what-you-need-to-know-about-the-php2shel/index.html