# Source: Security Notice - Statement on PHP2Shell Use-After-Free Vulnerabilities (CVE-2026-109619, CVE-2026-109618) - Huawei

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Huawei PSIRT: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# Security Notice - Statement on PHP2Shell Use-After-Free Vulnerabilities (CVE-2026-109619, CVE-2026-109618) - Huawei

**Huawei PSIRT** · [https://www.huawei.com/en/psirt/security-notices/2026/huawei-sn-sopsuafvcc-02583971](https://www.huawei.com/en/psirt/security-notices/2026/huawei-sn-sopsuafvcc-02583971) · published 2026-10-22 · added by `breaking@php.newsroom (curator's role)` · slug `huawei-sn-02583971`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Huawei PSIRT security notice (Initial Release Date 2026-10-22).

## What it says, as the collector read it

#### Security Notice - Statement on PHP2Shell Use-After-Free Vulnerabilities (CVE-2026-109619, CVE-2026-109618) - Huawei

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `cn/security-vendor/huawei/huawei-sn-02583971`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

Huawei PSIRT security notice (Initial Release Date 2026-10-22).

> Huawei has launched an immediate investigation. The investigation is still ongoing.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Huawei PSIRT security notice (22 Oct): investigation of CVE-2026-109618/109619 launched and ongoing; notice based on current findings.

Supports: vendor response: products affected / not affected (investigation ongoing); board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:13:50Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://www.huawei.com/en/psirt/security-notices/2026/huawei-sn-sopsuafvcc-02583971- `headers.json` 40c7811266f8d10c8833e10b19593d3d4f77d19a8ef2dc3158965a344affebb1 566 bytes
- `page.html` aab8136c6c89efea813914f9e94df8fd7e1834669de52d95d7857b760e8dd0ea 96,674 bytes
- `provenance.json` 09b722f4c912de0246787b59eeb0160288adde10ba65672cc8778c85e38e01fe 1,716 bytes
- `rendered.html` c1296f73c40fd7d23784c7e4cfd901f9e3204a5b5435d3f443ea30f77ad4aa8c 104,305 bytes
- `screenshot.jpg` 3df95cce407fd7446e3987088b749dd5d750f31eeb243439595bd1c6f5410774 110,155 bytes
- `text.txt` 61aa5a62386f0b91b2b9e96672a028d3c7c26becb8a7df7392ee0fda834bf7a5 1,612 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/huawei-sn-02583971/index.html