# Every source: 454 pages, 515 captures, 3019 hashes > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. The manifest of the php2shell evidence vault: every captured source with its publisher, kind, publication time, capture times, HTTP status and the SHA-256 of every captured file. # Every source, every capture, every hash In plain English Every web page this site relied on, with the time it was saved and a fingerprint proving it has not been altered since. 454 sources, 89 of them primary, 515 dated captures and 3019 hashed files, from the evidence vault at commit `94352a55fbaa`. 15 sources could not be read because the site blocked an automated browser; the block, with the challenge page's hash, is the record. The captures are third-party pages held privately and are not republished; this page links to the originals and lists the SHA-256 of every captured file, so that anyone the vault is later opened to can check that the bytes are the ones the agents saw, at the minute they saw them. | Kind | Sources | |---|---| | news | 313 | | government | 31 | | vendor | 27 | | advisory | 25 | | cve | 14 | | researcher | 11 | | other | 10 | | code | 9 | | social | 9 | | news-live | 3 | | forum | 2 | Each capture holds `page.html` (as served), `rendered.html` (after scripts ran), `text.txt`, `screenshot.png`, `headers.json` and `provenance.json`. A `raw/` folder holds anything fetched another way, with its own checksum file. The manifest this page is built from is [data/sources.json](https://data.php.oct.2026.newsroom.sgit.ai/v/0.1.19/sources.json). ### [Failles PHP : pourquoi c'est un vrai casse-tête pour l'Internet mondial](01net-actualites-failles-php-pourquoi-cest-vra/index.html) [original ↗](https://www.01net.com/actualites/failles-php-pourquoi-cest-vrai-casse-tete-internet-mondial.html) **01net** · news · secondary · captured · published 2026-10-22T10:30:00+00:00 · added by `curator@php.newsroom` · `01net-actualites-failles-php-pourquoi-cest-vra` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). 01net (French): the PHP2Shell flaws are a headache for the whole Internet because PHP is everywhere and often invisible, so organisations struggle to... capture 20261023T160435Z · HTTP 200 · https://www.01net.com/actualites/failles-php-pourquoi-cest-vrai-casse-tete-internet-mondial.html- `headers.json` 751abf832477b03c4bfcd1d054188cc75e3a6fd0b238fc77ee45aa53bc73ce06 1,381 bytes - `page.html` 408b1e9061a8b08b046d491e76e90bd01fff7fd6008cf3601d1eaf2d3362633d 132,625 bytes - `provenance.json` 3913ff9cb0fa41223487d0b244cd3b06286553a4baefa7c9d0e2ce4735a4ac5b 1,771 bytes - `rendered.html` 61263962972ed5f38ea25dc58f03bff7fa255fa74a3c08a465c7aa96357ad2f3 197,029 bytes - `screenshot.jpg` d7be83112edf82a8d3b2b9a7c3827184c35c5b87780ef3b54627031c16ca6bc4 626,923 bytes - `text.txt` 7f962c4324c29bcf638323ac398a6f0acfffe054c449b2dfe19b6cf946add33b 7,602 bytes ### [Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes](20-minuten-20min-fr-suisse-romande/index.html) [original ↗](https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792) **20 minutes / 20 Minuten** · news · secondary · captured · published 2026-10-22T06:25:10.292Z · added by `curator@php.newsroom` · `20-minuten-20min-fr-suisse-romande` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 4 new items in fr: 20 Minutes reports that French-speaking Switzerland was heavily affected: the universities of Geneva and Fribourg, EPFL and the canton of Basel-Stadt took services offline, and several Romandy communes were disrupted. La capture 20261022T181608Z · HTTP 200 · https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792- `headers.json` 9aef40669d0201d439c47909509365a37137d09199d8c388612cab0f3a29c553 1,029 bytes - `page.html` 358331e9dc87d8f08acab4bbaeb6774b1d19fe55e7824c522206baffe72d33c9 306,879 bytes - `provenance.json` 58151440f0c86b5e464fbde2d27cd829a27cc49575fd2c108baeb74dae50c3a1 1,744 bytes - `rendered.html` 338f5ad40d6bf3467a1a4513b54a58819dbd98e8874a971bf1bb5d2a226c879d 476,953 bytes - `text.txt` d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65 8,032 bytes ### [Faille de sécurité: Panne mondiale des sites web: la Suisse romande touchée - 20 minutes](20min-fr-suisse-romande/index.html) [original ↗](https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792) **20min.ch** · news · secondary · captured · published not stated · added by `collector-news` · `20min-fr-suisse-romande` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081421Z · HTTP 200 · https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792- `headers.json` ec6caf4135da86719aa40d4ab03f56d65f84c1393a323affb9b5f566075a2e33 1,030 bytes - `page.html` c122c6a713574ec43e9c27b9bdd9afe662a2f25cfd14112bb4c399a34fe6aeb6 306,897 bytes - `provenance.json` a8bd1322043249d1ceb3331e4025987411e7ae56db3c8d5db4199e90f81ae86c 1,146 bytes - `rendered.html` 18773701ad81c36911a593f2d4138ca96ea9955371f3e7022556ab7340ced316 500,134 bytes - `screenshot.png` c6d13f3785d57ca5b3405690794daba119f9a746779960b2867a560f25784a42 1,280,191 bytes - `text.txt` 97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4 8,850 bytes ### [Alerta de PHP: por qué gobiernos, hospitales y colegios desconectan sus webs](20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit/index.html) [original ↗](https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html) **20Minutos** · news · secondary · captured · published 2026-10-22T09:57:42+02:00 · added by `curator@php.newsroom` · `20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 8 new items in es: 20minutos explains why European governments, hospitals and schools disconnected their sites. It cites an EU joint statement, a warning from BSI vice-president Thomas Caspers, and a detailed (EFE-sourced) list of Belgian capture 20261022T181608Z · HTTP 200 · https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html- `headers.json` 3b530c0136bed295474acf950e476f09ae9c7b5dbb85b3d66293e016854e77f2 674 bytes - `page.html` a42a8667a49876b3b4ae75f6ac8b985200cd0871f5443e3d7b149b3e1da82eed 236,595 bytes - `provenance.json` 1ab349bdf6ba1f266a1e5536cfc5a32f60bc80cb0bd8afe85e0a6c9fc6e4ac8b 1,866 bytes - `rendered.html` 6d72d1dd7ea4a27f9b093a48a5f7e1cc75d88573091f6b58513efe7a8c678e91 390,108 bytes - `screenshot.jpg` 95c9fa8ba98b9927fb742e0496de6c33e0da29f10fc10fe63ebc5addaf21305a 662,231 bytes - `text.txt` 96ea536b04fe59c76df5ae9fc13efbf08dc59d6eeb8232b7d4c22a85becff632 10,690 bytes ### [كيف لعب الـAI دوراً حاسماً في اكتشاف ثغرة "PHP" تهدد 70% من مواقع العالم؟ - موقع 24](24-article-969853-ai-php-70/index.html) [original ↗](https://24.ae/article/969853/كيف-لعب-الـAI-دوراً-حاسماً-في-اكتشاف-ثغرة-PHP-تهدد-70-من-مواقع-العالم-) **موقع 24** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `24-article-969853-ai-php-70` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Site 24 (Arabic, UAE): how AI played a decisive role in finding the PHP flaw said to threaten 70% of the world's sites. It says the researchers, thank... capture 20261023T160435Z · HTTP 200 · https://24.ae/article/969853/%D9%83%D9%8A%D9%81-%D9%84%D8%B9%D8%A8-%D8%A7%D9%84%D9%80AI-%D8%AF%D9%88%D8%B1%D8%A7%D9%8B-%D8%AD%D8%A7%D8%B3%D9%85%D8%A7%D9%8B-%D9%81%D9%8A-%D8%A7%D9%83%D8%AA%D8%B4%D8%A7%D9%81-%D8%AB%D8%BA%D8%B1%D8%A9-PHP-%D8%AA%D9%87%D8%AF%D8%AF-70-%D9%85%D9%86-%D9%85%D9%88%D8%A7%D9%82%D8%B9-%D8%A7%D9%84%D8%B9%D8%A7%D9%84%D9%85-- `headers.json` c0a664d8f3d750e83ce55ea219e9d7c2bc662e183efddb6ac865e1ff8a902b9f 872 bytes - `page.html` 13ee2265f6d28fa811963290a095b98c61d5b719fcd5fefc543f262c382cab4d 110,206 bytes - `provenance.json` e8643a9455e78bc8801bb3e773f693c62f3351216092d28efebe1dec29fa5afd 2,041 bytes - `rendered.html` e393fbc613b2df7027eb42d8af47bc3957e0049bf6e6877fd5a437f560dab304 147,075 bytes - `screenshot.jpg` 868e008ced044f1a418460626a80ecde20a9ccb2b2fdfe0c25d5c0bbd0ceadae 543,735 bytes - `text.txt` b00b4ee3ceb08beabe4387d853d6715bb89202536a3ad1a038d737e35cd83bec 18,164 bytes ### [«PHP2Shell»: qui est affecté par la faille en Suisse](24heures-php2shell-qui-est-affecte-par-la-faille/index.html) [original ↗](https://www.24heures.ch/php2shell-qui-est-affecte-par-la-faille-en-suisse-196968803007) **24 Heures** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `24heures-php2shell-qui-est-affecte-par-la-faille` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). 24 Heures (French, Switzerland), 22 October: who is actually affected by PHP2Shell. Critical PHP flaws forced the EPFL and other institutions to suspe... capture 20261023T160435Z · HTTP 200 · https://www.24heures.ch/php2shell-qui-est-affecte-par-la-faille-en-suisse-196968803007- `headers.json` a098465a772cdbccc0fa1111e6a85f02e956e643baaf8d439ad2721faefac8dc 567 bytes - `page.html` 6e359c13024a6847fd506739b658a84828446b64efbd428002db7e7aa0cd3d24 327,391 bytes - `provenance.json` 9797b6bfb56fd9a61b220292942a3a3219065acf0e7d57cf1fbf1d8c69154b9f 1,745 bytes - `rendered.html` d226ed76c93ef2040647949efcfbd56a0fe41a0080c51f91bb0a5744a193104d 416,857 bytes - `screenshot.jpg` a2b4f370dc3da4706e167da6eb314db3471064d055541aed3416f4e61dff3574 648,655 bytes - `text.txt` 5a3e765f34731b2628ce57ef7c16d6fbf9b65c05a88a3e17fb46c9199c4db11c 9,385 bytes ### [PHP 보안 취약점 비상, AI 발견 PHP2Shell 워드프레스 서버 패치 - 투데이즈.kr](2days-22-10-07-109016-it-program/index.html) [original ↗](https://2days.kr/22/10/07/109016/it/program/) **2days.kr** · news · secondary · captured · published 2026-10-22T07:46:43+09:00 · added by `curator@php.newsroom` · `2days-22-10-07-109016-it-program` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). 2days.kr (Korean), 22 October: a headline piece on the PHP security vulnerability emergency, the AI-discovered PHP2Shell, and patching WordPress serve... capture 20261023T160435Z · HTTP 200 · https://2days.kr/22/10/07/109016/it/program/- `headers.json` 666ebb2161e3dd02d36462d363c099b25f3410e5078c967df6ca4af594a98be9 522 bytes - `page.html` 2fb757e100676d202897bf9557c9006973055ce3936dff59e0c763276531d59e 394,514 bytes - `provenance.json` d1923ac61c00a9bee2cc0c8a60dc8e9dd5e1a091ec650c2ed2d07446f89ebf1f 1,609 bytes - `rendered.html` c6b4b3820dc377f2d7d619fc9f4db39f23ab3f3bc7d45f1d312b49e874ec0c81 517,739 bytes - `screenshot.jpg` 5ceaaa4bba350a2843f88aa800cf8807eca9789a5bf25af2697ed6ab3d7bb52d 592,971 bytes - `text.txt` 53241401e8e04d5dbcbc8d63265e5147ef32a96d35e89b6009cf2fc31f7efc9d 15,297 bytes ### [PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities](aa-en-science-technology-php-security-crisi/index.html) [original ↗](https://www.aa.com.tr/en/science-technology/php-security-crisis-prompts-websites-worldwide-to-push-updates-for-critical-vulnerabilities/4097614) **Anadolu Ajansı** · news · secondary · captured · published 2026-10-22T18:59:20.067 · added by `curator@php.newsroom` · `aa-en-science-technology-php-security-crisi` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Anadolu Agency (English), 22 October: the PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities. The PHP2Shell r... capture 20261025T120459Z · HTTP 200 · https://www.aa.com.tr/en/science-technology/php-security-crisis-prompts-websites-worldwide-to-push-updates-for-critical-vulnerabilities/4097614- `headers.json` e834d71b803615b52d3404d84d03e2051ad6113d764181ecd2a842cef9df3946 4,338 bytes - `page.html` e714e5101b4f667459f4f2ae0d3ad209e0afbd989b96d83772e12d2d00cca7dd 307,051 bytes - `provenance.json` bbd12ca6fe32cf4cb8ce8be64361a0a55cb185f5601d5e8407a291cb332045b9 1,878 bytes - `rendered.html` 2074b6f14e6b4868f149dee38532674873075245fb18c49d5c1e23aaae9a2b13 266,399 bytes - `screenshot.jpg` 63d5f214d40065cd4421250f95b9830911bfa038498237800047ff2db353f69c 271,563 bytes - `text.txt` 12d252dc05d720eb4be42c63a7f99de7240f7db3b52b27bd840cd386d18a01bb 3,552 bytes ### [Australian government sites among those exposed to 'critical' PHP software flaw - ABC News](abc-au-gov-sites-exposed/index.html) [original ↗](https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812) **abc.net.au** · news · secondary · captured · published not stated · added by `collector-news` · `abc-au-gov-sites-exposed` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081518Z · HTTP 200 · https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812- `headers.json` 7eb1bee622cf88c19ad0c31a199ac5c5fa98f148909ca4ffda4aeef8ee212c8e 980 bytes - `page.html` 506809c0c2a4827c59244c5f032fedc30ff94c21df141cc94f292f2aeb920e41 355,918 bytes - `provenance.json` c69347feb600272b4099bc58e7e72cb706de4d81fb734b5ebf4f1f0c1ef88666 1,080 bytes - `rendered.html` 142b8b27452f3beaf38f835213c9448696b78ff4c6232ec416384dcdb6ddd8c5 373,382 bytes - `screenshot.png` dd71e33143d109e44b4c5fb22a80f0d797c698d1cf4260e20d5d40edc3ffc378 2,393,273 bytes - `text.txt` 84937c7c5b87e7c94cf87f2aed94f82ebbf2824d6dea9841cd50e39111d2cb48 9,085 bytes ### [Federal politics: No government websites hacked after global security flaw found — as it happened - ABC News](abc-au-politics-live/index.html) [original ↗](https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950) **abc.net.au** · news · secondary · captured · published not stated · added by `collector-news` · `abc-au-politics-live` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081530Z · HTTP 200 · https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950- `headers.json` 78001e770a86a878a5ebbf2ed9724c2eeaf6f9a29dcdbbc821df7c4043fbe78c 956 bytes - `page.html` e91a707c8b974b1afe24cd6863a6b4e860bb4facdf86456630dde038f9ae025d 911,394 bytes - `provenance.json` 7f0e05f09575c7515b8f03d9afa0bb0948122701de5fd040cf69b20506ce3839 1,116 bytes - `rendered.html` ac5782fe9d12a17ebc032bb0cd75e0b92b2074fd68a151cea865e274104429c6 1,003,403 bytes - `screenshot.png` 92b44e296ddf641d1d22a62d5bbb43fa39efd8bf9c2bbb3120a6aa976cf28fb3 4,591,087 bytes - `text.txt` a86331d9b7a21f78af1750d3daf6ebbb696253e1216649e973e34262313040b1 43,063 bytes ### [PHP2Shell: sanate vulnerabilità critiche in PHP (AL07/261021/CSIRT-ITA)](acn-it-php2shell/index.html) [original ↗](https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php) **ACN / CSIRT Italia** · advisory · secondary · captured · published 2026-10-21 · added by `collector-gov` · `acn-it-php2shell` Alert AL07/261021/CSIRT-ITA, published 21-10-2026. CVSS v4.0 9.2 each (Use After Free). Mitigation: only 'aggiornare i prodotti vulnerabili' (update); it gives no offline advice. capture 20261022T081354Z · HTTP 200 · https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php- `headers.json` c44211ff9b8440ef6922919056abed0873179324fdf7db7ddf969c8d1dd6bd15 732 bytes - `page.html` 6ab511ebb1dd7a3d6235d88dc71a02c8ecefec27283538cec68a134d33d67440 118,598 bytes - `provenance.json` b832861c53d09b3d98083bc23e3c4578748f1f8173e2ea7c23bd8c9dfa6f1c8b 1,038 bytes - `rendered.html` 91c9550654c551eeacb33e829fe2246a7307efbcf7cd00d4cf10f5a44413cf07 131,205 bytes - `screenshot.png` 94246ab38f323d629edf5c1820908d804f7f45f61bc276e7c77e756aa549fc65 687,162 bytes - `text.txt` 19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6 6,137 bytes ### [Critical vulnerabilities in PHP](acsc-alert-php/index.html) [original ↗](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php) **ASD's ACSC (Australia)** · advisory · primary · captured · published 2026-10-21 (Published); Last reviewed 2026-10-22 · added by `collector-gov` · `acsc-alert-php` Alert Status: Critical. Published 21 Oct 2026, last reviewed 22 Oct 2026. 'Recent update': identify PHP, review php.net, apply updates and mitigations, monitor. NO offline advice. 'not aware of successful active exploitation within Australia'. Says full details were announced 'Thursday 22 October 2026 at 0100 AEDT' (=21 Oct 14:00Z). The body text is stale (pre-patch). capture 20261022T081658Z · HTTP 200 · https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php- `headers.json` 3f7c0fe9c702d22193630225a56b0991c08fc52fb05ef53f26ea0f611b798b4e 1,985 bytes - `page.html` 650742fe93abb6dec911f58d21b7cd6d8d82c2d4a7b89eb9745e9a9857bc0c72 1,541,271 bytes - `provenance.json` 37ce725a8459c6db87ef8d7e3abd3cf92d350bab9e4228852c7d07dd08d65a6f 985 bytes - `rendered.html` 731eef8ce851ccf1650bc66cf3bb8658569c3de13b3a8084c14761658743e931 1,557,700 bytes - `screenshot.png` 39318847477c383a130dbafc83210dc27ed7ccae88107979ed124e372d67da9d 345,966 bytes - `text.txt` 9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56 6,299 bytes ### [cyber.gov.au home](acsc-home/index.html) [original ↗](https://www.cyber.gov.au/) **ASD's ACSC** · government · secondary · captured · published not stated · added by `collector-gov` · `acsc-home` Home at 08:16Z: the PHP alert teaser is dated 22 Oct 2026 with the stale pre-disclosure blurb. capture 20261022T081604Z · HTTP 200 · https://www.cyber.gov.au/- `headers.json` 3d448cbb053930039edd6bcb6779264beb2fa8c4c073bc5084ca3a5b0c369a5f 1,937 bytes - `page.html` bd81a8f884e1cbe1f2ae88c146b6198346568f2324677adce3198b5578db19c3 1,854,064 bytes - `provenance.json` 992e9c6ce0b26d2edb42343e569ac2634e532a277a5e804ec657ed66acda47a9 879 bytes - `rendered.html` e22b8af8cb588bdf894c62c53337db8940108a269e2f517f1d6ffa1886d8d904 1,889,870 bytes - `screenshot.png` 3f7acad6a96208dca53692a35f83a89e3b21e8266fcd183892673c6e4b3b39b0 723,009 bytes - `text.txt` b7198501ad800f9312359edf414e81c46b1b35f7d0fae787ff629a8f029ad0b9 13,389 bytes ### [PHP2Shell: allerta NSA, aggiornamenti urgenti siti web - Actainfo](actainfo-news-php2shell-vulnerabilita-php-allerta/index.html) [original ↗](https://www.actainfo.it/news/php2shell-vulnerabilita-php-allerta-nsa/) **actainfo** · news · secondary · captured · published 2026-10-23T10:57:22+00:00 · added by `curator@php.newsroom` · `actainfo-news-php2shell-vulnerabilita-php-allerta` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Actainfo (Italian), 23 October: PHP2Shell, NSA alert, urgent website updates. On 21 October 2026 the US NSA published an advisory on the vulnerabiliti... capture 20261025T093507Z · HTTP 200 · https://www.actainfo.it/news/php2shell-vulnerabilita-php-allerta-nsa/- `headers.json` bf9d8f1d4ac4796532e432c43178eddd691035edb91eef84a7d89fa084e5118a 576 bytes - `page.html` 598e104bba47d62cf9411ebfc901fe9e7b9940e1c6f5c25f0d644447a96e570d 175,943 bytes - `provenance.json` 2f654ebd1e1a7f4fcf42dfed4eeff8141911545165f0e9cd368b39371830d08f 1,685 bytes - `rendered.html` 932ef002b633cca784937cc0acf982daba804202c59224b3a03e1e245f85d6ac 180,594 bytes - `screenshot.jpg` 660674662717a7db269d4d4cf2340f14735134b31f0debe03e502f547eb91777 803,875 bytes - `text.txt` 0dc76adb26d5b438f7b78faa9e2ad069dbcca30c663ead7950b7527c93412f3d 8,952 bytes ### [Failles critiques dans PHP : des sites coupés en urgence dans le monde entier, dont ceux des préfectures en France](actu17-prefectures/index.html) [original ↗](https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html) **actu17.fr** · news · secondary · captured · published not stated · added by `collector-news` · `actu17-prefectures` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081432Z · HTTP 200 · https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html- `headers.json` 51ca3518271f6b77dfd5502a1084de33fcdcc75aa21d76280fd7b10227be55d2 910 bytes - `page.html` e4744fede4d347f630287801ecbdbefc7a21ab25a961f5bb12a06dcc959c3585 37,354 bytes - `provenance.json` 2faf46b7a81953effd2d1256c51fe7dae806b2c5671339fc78ae35e43432c07e 1,228 bytes - `rendered.html` a31b9a050ff5cf246e67672d2863411d61d66aa22c7b054dafc0ec617050cec2 637,675 bytes - `screenshot.png` 8a46e45f9c1b73734d153216ebbff665fd9ea8d86befee39b20ea269d2a41b64 10,462,799 bytes - `text.txt` 84edb7f59b55a5ce64bf9458671e49987b9e48e0e8388039de616a4c8c1e534d 16,675 bytes capture 20261023T160435Z · HTTP 200 · https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html- `headers.json` ff08af6368a1938907d64264b50c26f9ec768e5cf3f8c8a72c869153ee89dabe 919 bytes - `page.html` 12d76736b5a61df0f780f8c16abfbc13f5250c76bc90be48999aabedaca7a576 37,430 bytes - `provenance.json` 5e7ed4bee317997ff444c2822619c1a56be8a387f4f5f3117355f586ad2eef65 1,914 bytes - `rendered.html` 22d20d4a76c1c6dbba5542ff54a5129fbf7b558132cf589ad89b1a98f7112dee 282,481 bytes - `screenshot.jpg` c7fb452c9b364c96f7c9095fe4291a6cc5725c61bb22f8ac64e8501da1cc16f9 727,672 bytes - `text.txt` 346a32b44db2a9745dafe50e004627c4c52846c76c906e2e23f2e38779046e3b 8,936 bytes ### [PHP flaws: France's ANSSI orders sites offline](actuia-anssi-sites-offline/index.html) [original ↗](https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/) **ActuIA** · news · secondary · captured · published 2026-10-22 · added by `claude-story-site` · `actuia-anssi-sites-offline` Secondary: 'France's ANSSI orders sites offline'; compare CERT-FR's own wording (isolate, then migrate). capture 20261022T112454Z · HTTP 200 · https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/- `headers.json` ee48005ae8388bf72bebfeea8f3d95100abf6faae001e3c235a5506d2f6dc21e 473 bytes - `page.html` ff30fd43654cd08a1f693e8d4d915c41820729be9a1991d5f4e462d1d0bb22f4 116,023 bytes - `provenance.json` e9c5fc723d72d43ad18613c74102fa5d72fc2799e91e0f81c2cfbfd51a52d794 1,090 bytes - `rendered.html` 74e68194027420a7a98f41f234f8da46f93ff0e5c77fec86c07d115f15365688 122,914 bytes - `screenshot.png` f934a67b32d8386b43d01a1a9baece42d7406c36ed9bec407ef19f9a26d73475 1,673,964 bytes - `text.txt` 8f399970329ffcead878dced88dbb206b9677895965091d0efb60334becc9f9a 10,744 bytes capture 20261023T080331Z · HTTP 200 · https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/- `headers.json` 2e67366960549dd0c8d6f5b46152a23c84be7952bc81edb5881bd28cf1edfdf6 545 bytes - `page.html` 4e706e01786613c1617993f9a6021c067d3b342ea36247611bd0ed68103158de 116,430 bytes - `provenance.json` c6ebc049ea166eda01e5d0d19d2882489a9649afe8adfdc97b7fb80ba8f18dc9 1,812 bytes - `rendered.html` 61b5414da65b86014b4957ead0a8a777498dc78d1c83acac4576860692df8a57 123,339 bytes - `screenshot.jpg` 9317ff24b17d932099ad6308dfa0c7bea69e531f1e8420eb6b634af3505d481f 631,317 bytes - `text.txt` d8e16086232ef31ed906359127734021cef7e4809b320813548c7d85927b9323 10,731 bytes ### [«الأمـن السيــبـرانــي» يدعو إلى تحديث «PHP» لمعالجة ثغرتين أمنيتين](addustour-articles-1598648/index.html) [original ↗](https://www.addustour.com/articles/1598648) **جريدة الدستور** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `addustour-articles-1598648` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Addustour (Arabic): a national cyber security centre recommends that national institutions using affected PHP versions give priority to fixing CVE-202... capture 20261023T232528Z · HTTP 200 · https://www.addustour.com/articles/1598648- `headers.json` 37e76206a07cafa8d3e8428fbe243ad9aa5178e6be1a49cb3ad37db8056b4fed 1,229 bytes - `page.html` 5360a2d02e4a90b00c7c1d8732011052fde48e08a56834ee3cb85d128d46cd34 179,845 bytes - `provenance.json` 25f342479806d5adb91ec94d953f4d8e8312e913588283de1e6db19020b1a219 1,612 bytes - `rendered.html` a67d2c5ac0ef9bb660330ab0c81c936770f76b23811f28ef324325ce41da1dc0 295,980 bytes - `screenshot.jpg` 87cffb9dc3b324680962ad21b8c1ce87d84ad5e0aa9cea1db071fe4231f613a8 546,569 bytes - `text.txt` ace3332a472a3d8b7bb12d71ab52e23bda54a30023018adcc43004900cee65db 11,321 bytes ### [Offline door PHP kwetsbaarheden: Welke Nederlandse websites waren uit de lucht?](agconnect-maatschappij-security-welke-nederlandse-websites-w/index.html) [original ↗](https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht) **AG Connect** · news · secondary · captured · published 2026-10-21T20:55:05+02:00 · added by `curator@php.newsroom` · `agconnect-maatschappij-security-welke-nederlandse-websites-w` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 7 new items in nl: AG Connect lists Dutch websites that went offline: at least 13 of 25 safety regions, the Schiphol app, the Port of Rotterdam, Odido's BEN and Simpel brands, many political parties, the Tweede Kamer and MijnOverheid, seve capture 20261022T181608Z · HTTP 200 · https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht- `headers.json` 7225010355dbfcd01a55cf7b99ee6c5b8037357178f53cb5a187bece7cf79015 598 bytes - `page.html` 367f64895fae9a5747832edea3af9968270b22166991f49a61cdd221e2c32202 72,981 bytes - `provenance.json` c89b09ab27440860478f4dc92f031ca378a261db0a49b3fcd4fb422648ba8f2d 1,790 bytes - `rendered.html` 787bd9fd2c74a4ae3dfce48d3c514034b797b7b86c06a673320fa807bd327859 146,785 bytes - `screenshot.jpg` 4836abeb16e1d3583a117a35296b477e61bab178c52c88a797244b502ec60af4 500,736 bytes - `text.txt` 505809e89b530fe70249289f22bf5d7aa6c94100d0656851754fb9a469552cbc 6,233 bytes ### [PHP2Shell: l’AI scopre falle critiche in PHP, attacchi già iniziati - AI4Business](ai4business-intelligenza-artificiale-php2shell-lai-s/index.html) [original ↗](https://www.ai4business.it/intelligenza-artificiale/php2shell-lai-scopre-falle-critiche-in-php-attacchi-gia-iniziati/) **AI4Business** · news · secondary · captured · published 2026-10-22T07:28:03+00:00 · added by `curator@php.newsroom` · `ai4business-intelligenza-artificiale-php2shell-lai-s` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). AI4Business (Italian): an AI helped discover two flaws at the core of PHP, grouped as PHP2Shell, that under certain conditions allow commands to run o... capture 20261023T160435Z · HTTP 200 · https://www.ai4business.it/intelligenza-artificiale/php2shell-lai-scopre-falle-critiche-in-php-attacchi-gia-iniziati/- `headers.json` d244724ce6c259e7d3fd6c5a9e8abdad182ea766d490ea5a67d9c7f467d9a271 1,169 bytes - `page.html` 2c4bd4710209c64635ab97a9ca3494049e9d33e591b62417d0a684975dc9ee3b 264,597 bytes - `provenance.json` b20ffd2513cc96195a1710a1c49d2659a7fe607d2acf68d5ca6134cb54f29b6c 1,842 bytes - `rendered.html` b4c3d69d770f102980a11b96bc951e18ebca46761238e4c23b400a48f7d9b612 285,290 bytes - `screenshot.jpg` e98aa24fd252e12f87473d0d2cf3b7262640cde76ac3855d0af6b15f00f389ca 769,857 bytes - `text.txt` 0a757e69b13b1d9d4abb3f75ab2ceffd5627a758332d38335e6eb0e587c8248e 16,805 bytes ### ['PHP2Shell' 취약점에 "딥시크가 원격 패치" 주장 확산…근거는 확인 안 돼 - AI매터스](aimatters-news-report-56697/index.html) [original ↗](https://aimatters.co.kr/news-report/56697/) **AI Matters** · news · secondary · captured · published 2026-10-23T13:30:39+09:00 · added by `curator@php.newsroom` · `aimatters-news-report-56697` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). AI Matters (Korean), 23 October: a claim has spread on X that someone is running a large number of AI agents based on China's DeepSeek model, a 'swarm... capture 20261024T133450Z · HTTP 200 · https://aimatters.co.kr/news-report/56697/?ckattempt=1- `headers.json` a84d7e20383176795f7c35dc6a749f4aba349b84776e824eb81b75d73a9d4b69 275 bytes - `provenance.json` 994b954bf89ef57a3f8d97ee7c537ba1d66063dd8905306fd94b33d069a83d63 1,533 bytes - `rendered.html` d428517e028b7487122f5da7dec71ce839407ee0e81fee5937bccb2fea27a61e 336,779 bytes - `screenshot.jpg` 5926a1a6f6b97506f4f930402886e81ab1246e8980ff0ec98122d75b01682ad7 333,645 bytes - `text.txt` 2b72bd0b8d42ca31c873e0af226e523220c7dc285d4bd22504726fd1d77227b1 6,208 bytes ### [ثلاثة أحرف هزّت الإنترنت.. ما قصة ثغرات PHP التي تهدد المواقع حول العالم؟ | البوابة التقنية](aitnews-2026-10-23-d8-ab-d9-84-d8-a7-d8-ab-d8-a9/index.html) [original ↗](https://aitnews.com/2026/10/23/%D8%AB%D9%84%D8%A7%D8%AB%D8%A9-%D8%A3%D8%AD%D8%B1%D9%81-%D9%87%D8%B2%D9%91%D8%AA-%D8%A7%D9%84%D8%A5%D9%86%D8%AA%D8%B1%D9%86%D8%AA-%D9%85%D8%A7-%D9%82%D8%B5%D8%A9-%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-php/) **البوابة التقنية** · news · secondary · captured · published 2026-10-23T00:15:43+00:00 · added by `curator@php.newsroom` · `aitnews-2026-10-23-d8-ab-d9-84-d8-a7-d8-ab-d8-a9` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Tech Portal (Arabic), 23 October: 'three letters that shook the internet', on the PHP flaws threatening sites worldwide. It describes CVE-2026-109618... capture 20261023T080331Z · HTTP 200 · https://aitnews.com/2026/10/23/%D8%AB%D9%84%D8%A7%D8%AB%D8%A9-%D8%A3%D8%AD%D8%B1%D9%81-%D9%87%D8%B2%D9%91%D8%AA-%D8%A7%D9%84%D8%A5%D9%86%D8%AA%D8%B1%D9%86%D8%AA-%D9%85%D8%A7-%D9%82%D8%B5%D8%A9-%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-php/- `headers.json` e33cbe95faad2c2c19ea87384dcd960f8490d5a19a6fc39a3a85fe9128538e38 1,007 bytes - `page.html` 4e7eb6500dc66a74c7198cf6488a3e83645db0660289bcd45cb74b82b81dd212 129,231 bytes - `provenance.json` 2dcded91540541b62a0f69d396b4fc721c2911a278a98de26acb953cfcae70da 2,128 bytes - `rendered.html` 4aff09be6b8e8863071d64ddc2447ec77d6eeca33b575319e05d806c2f5424da 125,811 bytes - `screenshot.jpg` d6bd507f85840779ba36e83cf940ac4b6e63820946fe33bc76491c7c4e5ecd19 682,538 bytes - `text.txt` f056b20036373674bfac4acc8e04626db7344e0b8b8bf2c85e05a163ef80b280 14,759 bytes ### [PHP2Shell: Millions of Attacks, 1.5M Servers Unpatched on Day One | AI Weekly](aiweekly-issues-php2shell-millions-of-attacks-15m/index.html) [original ↗](https://aiweekly.co/issues/php2shell-millions-of-attacks-15m-servers-unpatched-on-day) **aiweekly** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `aiweekly-issues-php2shell-millions-of-attacks-15m` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). AI Weekly, 23 October: a newsletter issue headlined 'Millions of attacks, 1.5M servers unpatched on day one'. It says AI models helped researchers fin... capture 20261023T232528Z · HTTP 200 · https://aiweekly.co/issues/php2shell-millions-of-attacks-15m-servers-unpatched-on-day- `headers.json` 5ee7bc3395bc1d4d4f8319696754e7e8953ec008b5fb23a243dd9c96b2ed2718 1,367 bytes - `page.html` 4526e16bcc1f6bb429531e76c96f879d5d5d00c401daddd0031b81215f1ef34a 37,612 bytes - `provenance.json` e00231f484ec68cd9bf3f1b88c3c883b704293f0e01c79e1db2c38a76d686bc1 1,761 bytes - `rendered.html` d7ab9352c9d403885c5c6e8bc5741ac67b52f747415c6eca612ce43e5cdeb141 40,286 bytes - `screenshot.jpg` 44503def2e28201fa2883694f435d879fcf3c3f87d25ade162d45add06c764be 729,453 bytes - `text.txt` fbdf38d39137fee6021cee2d3bcdb0b06458887a217cc51ecd4c67a9455c6a23 14,314 bytes ### [CVE-2024-4577 Exploits in the Wild One Day After Disclosure](akamai-blog-cve-2024-4577-one-day/index.html) [original ↗](https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure) **Akamai Security Research** · vendor · primary · captured · published 2024 · added by `claude-story-site` · `akamai-blog-cve-2024-4577-one-day` Historical: exploits of the previous PHP core RCE, CVE-2024-4577, seen in the wild one day after disclosure. capture 20261022T112501Z · HTTP 200 · https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure- `headers.json` b8600b926f54d0c326ae453a4aa45ee026728ff7329884997710f9d1e5f541cb 5,460 bytes - `page.html` 10bed4c03e0d208afa3e6d6d67c8d2250149138bb4d63e87605d1e28079a5171 279,021 bytes - `provenance.json` 67c5b82965151100b965313d300e89e4bd9ca9ce8520a47fa8ba174bd637833b 1,084 bytes - `rendered.html` 3aea0cbcf996a4c4d7b0dfe721b61fee812595d5df395a7b8eb1317ca7c0fa8f 478,692 bytes - `screenshot.png` 5fed6383355ce8c109b539a7e534592d29b584d533df10d4b2228cd9c2431475 2,944,679 bytes - `text.txt` f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567 23,021 bytes ### [Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai](akamai-blog-php-core-rce/index.html) [original ↗](https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core) **Akamai Security Research** · vendor · primary · captured · published 2026-10-21 · added by `claude-story-site` · `akamai-blog-php-core-rce` Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence. capture 20261022T112525Z · HTTP 200 · https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core- `headers.json` 3ed908175f73e8f392f99df0845982f172ad44c49cb12692c16c1fcf7849d28d 5,850 bytes - `page.html` 8f9e02a272dd67f8a2770e849f8f8118fc34e45f1cd056fd56e4b5a7f9bae592 213,450 bytes - `provenance.json` c335fab9c5745922bf97664aa64c00fa23b563ae875eeb2c95316f70f3ae758d 1,103 bytes - `rendered.html` 0400fefe0ed144f5140e8077e5e6d9b401d41cad7ef0b66825c4dec6663f4b33 415,118 bytes - `screenshot.png` 5757611708b507626fda25038e770bb96adb831e42b474d6c5229c30ba0a3a98 609,040 bytes - `text.txt` 2a001600cd450bc582ed42e8355951626ef8ae60e5c4afe233629dbeeaacba5b 5,509 bytes ### [ثغرة في PHP تفتح الباب أمام موجة هجمات سيبرانية...](alghad-section-225-d8-aa-d9-83-d9-86-d9-88-d9-8/index.html) [original ↗](https://alghad.com/Section-225/%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7/%D8%AB%D8%BA%D8%B1%D8%A9-%D9%81%D9%8A-PHP-%D8%AA%D9%81%D8%AA%D8%AD-%D8%A7%D9%84%D8%A8%D8%A7%D8%A8-%D8%A3%D9%85%D8%A7%D9%85-%D9%85%D9%88%D8%AC%D8%A9-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-2100790) **الغد** · news · secondary · captured · published 2026-10-24T13:01:37 · added by `curator@php.newsroom` · `alghad-section-225-d8-aa-d9-83-d9-86-d9-88-d9-8` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Al-Ghad (Arabic), 24 October: a PHP flaw opens the door to a wave of cyberattacks. The flaw, known as PHP2Shell, may let attackers take control of sit... capture 20261024T160544Z · HTTP 200 · https://alghad.com/Section-225/%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7/%D8%AB%D8%BA%D8%B1%D8%A9-%D9%81%D9%8A-PHP-%D8%AA%D9%81%D8%AA%D8%AD-%D8%A7%D9%84%D8%A8%D8%A7%D8%A8-%D8%A3%D9%85%D8%A7%D9%85-%D9%85%D9%88%D8%AC%D8%A9-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-2100790- `headers.json` 113fc1ac24be9268dbf658cb06485cf7f8da0dda7075c6f6998d5941d4aa8391 1,070 bytes - `page.html` 17cd7cdd84cb7a82160c7394458a8ca4f8050fb75bf3003744cb460ce093f653 150,043 bytes - `provenance.json` 215e96aaf5df6d164124c3b53029d9276e7ad733cdf2a04c2b2c119c60ff975d 2,234 bytes - `rendered.html` a45b8f5ca1c76b29b11d84fb30b8f67b65f5f99685d9a0a3d89d7580429f974a 230,008 bytes - `screenshot.jpg` daaa43153f2f71a6650e964c60c7cf3dbb4d29e30cc5c9c29a3c92a4c47e4ad0 396,690 bytes - `text.txt` 679a2220aeebc2f7412f5d56f561b010d65793b3cef5dce86d832c2c40cf9ebd 8,445 bytes ### [Banks dodge early damage from PHP2Shell flaws | American Banker](americanbanker-news-banks-dodge-early-damage-from-php2s/index.html) [original ↗](https://www.americanbanker.com/news/banks-dodge-early-damage-from-php2shell-flaws) **American Banker** · news · secondary · captured · published 2026-10-23T16:18:33.586 · added by `curator@php.newsroom` · `americanbanker-news-banks-dodge-early-damage-from-php2s` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). American Banker, 23 October: banks have so far dodged early damage from PHP2Shell. Attackers have fired millions of attempts at the flaws, but no U.S.... capture 20261024T083755Z · HTTP 200 · https://www.americanbanker.com/news/banks-dodge-early-damage-from-php2shell-flaws- `headers.json` 15e6ea894fadba01472595414bd8a115f59040b12b137c0fd07e14f140604fdb 787 bytes - `page.html` 84e2320fb1caf71e1794a48815b4503235af44dbfbc87ac3df6e9572159e544e 298,544 bytes - `provenance.json` d367fa9ba378380e772e440a1a4314eac8ce06b25646be09f313fce10e7c36fc 1,737 bytes - `rendered.html` 17f8b9cf5fd801d15dbca340216bf2a1255da22e3a96ddedd829a58955444065 839,767 bytes - `screenshot.jpg` 348a95ae92e965152778a86d8791213071bfe7200a2c343634c0f7583ba69faa 271,555 bytes - `text.txt` 2b6aa63f39e73b0ee1344ecc0362be26ac765764c3dac7b04da934c8ea3e6b3f 3,839 bytes ### [Changpeng Zhao Warns Crypto Users Amid New PHP2Shell Threats](analyticsinsight-news-changpeng-zhao-warns-crypto-users-a/index.html) [original ↗](https://www.analyticsinsight.net/news/changpeng-zhao-warns-crypto-users-amid-new-php2shell-threats) **Analytics Insight** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `analyticsinsight-news-changpeng-zhao-warns-crypto-users-a` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Analytics Insight: reports that Changpeng Zhao, a crypto-industry figure, warned internet users on 22 October to be careful when visiting websites aft... capture 20261023T080331Z · HTTP 200 · https://www.analyticsinsight.net/news/changpeng-zhao-warns-crypto-users-amid-new-php2shell-threats- `headers.json` d0cf3a2f6ff0f4347125ab1ec8faec5b29a6edb234474a9ce40b94ff9a9fb3f5 1,220 bytes - `page.html` 25936687f5568100b08ad53ae29d18211496e51913933ce75b708b1cdad76813 1,011,934 bytes - `provenance.json` 6ebb25bf1f68f6dab96c21abe759cfcc75989a91439d7f2bb43194e50dca6aeb 1,646 bytes - `text.txt` a1cb6f490bf50653944d5a23223b537266ac80df0c159430448183187313385e 15,821 bytes ### [Perú y otros países advierten de vulnerabilidad en PHP: estos son los riesgos de seguridad | Agencia Andina](andina-agencia-noticia-peru-y-otros-paises-advi/index.html) [original ↗](https://andina.pe/agencia/noticia-peru-y-otros-paises-advierten-vulnerabilidad-php-estos-son-los-riesgos-seguridad-1096953.aspx) **Agencia Andina** · news · secondary · captured · published 2026-10-22T00:00:00.0000000 · added by `curator@php.newsroom` · `andina-agencia-noticia-peru-y-otros-paises-advi` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Agencia Andina (Peru's state news agency, Spanish): Peru and other countries warn of the PHP vulnerability. It quotes Peru's Centro Nacional de Seguri... capture 20261023T160435Z · HTTP 200 · https://andina.pe/agencia/noticia-peru-y-otros-paises-advierten-vulnerabilidad-php-estos-son-los-riesgos-seguridad-1096953.aspx- `headers.json` 0ed85079e5b5808b8b44a1c7e26eec5fa10956d269b8ef1c2faaa8b44bb0ee39 311 bytes - `page.html` 7ca9aa7a56c542f9b4354c98ef5c591a9303c42e6c902c00d2d2e4270d7194ce 203,589 bytes - `provenance.json` 2db5a9c751c668cc78862e95e85d44febfe1fb29472350c8212d6eec8d72a2b5 1,784 bytes - `rendered.html` 65bbcfc988d0bddfa5967b9607f9c26a1c807c86d1cb52307dafdda0fcb5f9c9 222,929 bytes - `text.txt` c5a17380affd5daba963dad02f154c020d703e0c9eed5b824deaa08f11526528 9,905 bytes ### [Finding, Prioritizing, and Patching PHP2Shell Exposure | Arctic Wolf](arcticwolf-php2shell-exposure/index.html) [original ↗](https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/) **Arctic Wolf Labs** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `arcticwolf-php2shell-exposure` Vendor guidance on finding and patching exposure. capture 20261022T112342Z · HTTP 200 · https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/- `headers.json` cb2dc7b843210683b8616d4f651fe7942a43433cea11e494ec0adb084f793b82 1,052 bytes - `page.html` 62b3d068fbefbb9b312c2418b4a38ef788132d55782e1e41244e77c0bad59726 351,404 bytes - `provenance.json` 015cfc5316cc7077049a8aee5da1a198699d54f7244e62ab8f7bf89b9e5ac590 1,123 bytes - `rendered.html` 1f059cea13ae6b9fa434e23a67c3e8ec05c47fa9af94ac9c5a476013862adb78 1,342,610 bytes - `screenshot.png` 0f1c79ead2d73038424318bb8efbe497717653cc82a2b3763f24ce7a95386336 1,555,808 bytes - `text.txt` ef2210c0fd1c35032d70283c91ab44c01c091342c21c9ac55571b12b45f8f75b 10,879 bytes capture 20261023T160435Z · HTTP 200 · https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/- `headers.json` 440350905beb9a972cf206015579a9460d7122dec3ca256f53e2239cc0586df0 1,123 bytes - `page.html` 19a9957b4d8769c87fa61b221753ea52107ae4c94e8dd82d4ef5872a37ed9081 352,468 bytes - `provenance.json` 135feb75d38e7b71b6f62d88fb1596ae37e5f3fc99be68d008edf434a803f58d 1,726 bytes - `text.txt` 1f0d3416e0d6ed95dc5aa64628a10b3319e6dde70da44b12c6251b5a3f626c24 11,183 bytes ### [PHP2Shell: vulnerabilidad en PHP amenaza empresas con IA](areacucuta-php2shell-log4shell-a-la-velocidad-de-la/index.html) [original ↗](https://www.areacucuta.com/php2shell-log4shell-a-la-velocidad-de-la-ia-y-la-perspectiva-de-un-ciso/) **areacucuta.com** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `areacucuta-php2shell-log4shell-a-la-velocidad-de-la` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). areacucuta.com (Spanish), a perspective piece 'PHP2Shell: Log4Shell at the speed of AI, and a CISO's view', five years after Log4Shell. It cites Check... capture 20261023T160435Z · HTTP 200 · https://www.areacucuta.com/php2shell-log4shell-a-la-velocidad-de-la-ia-y-la-perspectiva-de-un-ciso/- `headers.json` c49168790d202ef5b7ffaada2cfbd2f795c03f07d51db02afa325a8dafe74ac5 1,325 bytes - `page.html` 2593c2b0bb9f033b4f411e857d8b5a4e667e7864f6a5324ff2c0b3aeb5613c4a 212,056 bytes - `provenance.json` 4cc302c86440656bec4b25bc63644813b579dea822020511fac18d74c15d9658 1,775 bytes - `rendered.html` e717ab7ac7c1f715134612a9d475fcb8e024ecb1017f5d131b5e00be01f1ada6 244,614 bytes - `screenshot.jpg` ca3f350a123e24f2754ffb9a719437f215e9981bec9cf2c961c88b0e0b0c1acc 555,750 bytes - `text.txt` 9320567484319cee421e5ee72d2fc11b08bdadf63742d6b33ef6118760b1ddec 8,032 bytes ### [Just a moment...](armis-php2shell-find-patch/index.html) [original ↗](https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/) **Armis** · vendor · secondary · blocked · published 2026-10-21 · added by `claude-story-site` · `armis-php2shell-find-patch` Vendor guidance on finding and patching. capture 20261022T112544Z · HTTP 403 · https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/- `headers.json` beaea17cfe605c6045c7491c7d444b6fc828d614e9fbacea1cc080a269cc4c31 1,990 bytes - `page.html` f8ff0c9e277962b98d66e9cf2027f78e3bfbc4d17999419d62b105822a78c6ba 6,399 bytes - `provenance.json` 0cdaf4cb11738a799892b7d79d673ed08c085634e8be431b89fd732adde39e19 1,026 bytes - `rendered.html` 64996869be46fe0ae90238d579e23c2599e4293e9f0c15e82d322efe96fde39b 28,992 bytes - `screenshot.png` 4da50c06b7082cecc3965a33e2fcf67ce4919b97b0730000f14723d2e5ec0321 38,997 bytes - `text.txt` d15eed6dfa57239bfe3d8333949627f35d8011042027db230828460dbf2b4ff3 261 bytes capture 20261023T160435Z · HTTP 200 · https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/- `headers.json` baca22884fe7c035a79dd418a0722363020765d167e128558a474b6053e5a7ef 1,141 bytes - `page.html` 085b997a04b1225c51e9d615bdb4104c6da4a3804d465322633390618711a2f4 144,286 bytes - `provenance.json` 910e25517ade6ab5036a505a197e6487980dd277c89e987fe1105e276544b3d7 1,821 bytes - `rendered.html` e9950fdf7a9df47cee2ac27e207c454b8e1451e7e9b65ad077a77eecdceaff2e 146,994 bytes - `screenshot.jpg` 98efbad718ce3475cb75f1e4b4d8b5747681c4d7af0f0c4e36d61254d75680d2 842,746 bytes - `text.txt` 311436ec35cbb50a61009ad36bbf4117b0abe67052880e335107d6a324fddc54 11,660 bytes ### [PHP warns it plans to release 2 emergency patches imminently - Ars Technica](arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th/index.html) [original ↗](https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/) **Ars Technica** · news · secondary · captured · published 2026-10-20 (updated 2026-10-21 14:55 per the page) · added by `curator@php.newsroom` · `arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Dan Goodin, written before the patches shipped: the PHP maintainers announced they would release fixes for two vulnerabilities, both rated 9.2 out of 10, after... capture 20261023T080331Z · HTTP 200 · https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/- `headers.json` d82ea6774aa7fd97afe368204d1ff2f0d13b71cf17ea85a45d9d417a6bea65aa 823 bytes - `page.html` fde5092a336040720599fc85f6c66de19b5a880374ac4b784df6e3749f4200af 146,413 bytes - `provenance.json` 9191e7b89ed24206ef5a45384b0ab5d65cf98a006a5d1542053335ab6992e237 1,776 bytes - `rendered.html` 1b7902197bf923479314e247b3146c50b55279e6357d0fb040417de3d58257ea 567,868 bytes - `text.txt` 96a800209bd0263f7de25263d9e594d65ca1b53c449993784a99f193831e21ab 5,244 bytes capture 20261023T160435Z · HTTP 200 · https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/- `headers.json` 13840bbc0aa9682890b32ae4962783eed7c6e38bf68bb9ed5e781ae99afd5e47 823 bytes - `page.html` ca33b2d1ef96e80928e8e8ab4f631c94358fb7eee7b800a248aa6a44fe254232 146,512 bytes - `provenance.json` aa85e34dad75bad9917f13c1a251df25f9127086a141bbe8fcc7e95a320e7d1d 2,010 bytes - `rendered.html` 742a140357e3dc19cd4484b5493dff5e2e287fa0ce5c1bb2bce09354c116cffc 565,322 bytes - `screenshot.jpg` aeba250f9d891ef1e07f41c11603009f03bec97db93382a9c946379c8e710d14 342,851 bytes - `text.txt` 62681a6a40fd9b229aefd4e838524abff4492b4da3b487a115d2d9b606fbabcc 5,250 bytes ### [「キャンつく」「ヨミトル」PHP重大脆弱性（php2shell）への対応完了のお知らせ | 朝日新聞デジタルマガジン＆[and]](asahi-and-pressrelease-16986349/index.html) [original ↗](https://www.asahi.com/and/pressrelease/16986349) **朝日新聞デジタル** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `asahi-and-pressrelease-16986349` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Asahi Shimbun Digital Magazine &[and] (Japanese), a PR TIMES press release of 22 October: the company that runs a campaign tool and a diagnostics clou... capture 20261023T160435Z · HTTP 200 · https://www.asahi.com/and/pressrelease/16986349- `headers.json` 99e8fe64b3f75bb1625bad50d01c521d0fe56b0a5636ea71b4af9c4fc5df0b5b 1,847 bytes - `page.html` 4c8bfb4f812fcd6ac7edf66ef201a9cf8efd7e70b13a8cc36ca2ec28cb68382c 158,942 bytes - `provenance.json` bdebff9f5f5b543f8610120c5bc4cc22b66968e6b14c15c8557444ad522de74c 1,667 bytes - `rendered.html` 387271e8e2f31d969844024e018a41e1242d4d10b0a7cd21dd3a011731ef264e 159,217 bytes - `screenshot.jpg` a68db1225703f0ad548d2186219e6596989d71c9b235c51569a25eb0ac947346 375,533 bytes - `text.txt` ac30b9c51cb8453e5918872a32d12ff394b985b485eef6b870ba5443d3887d9c 7,433 bytes ### [Singapore firms urged to act urgently over critical PHP vulnerabilities, Singapore News - AsiaOne](asiaone-singapore-php-vulnerability-singapore-cy/index.html) [original ↗](https://www.asiaone.com/singapore/php-vulnerability-singapore-cyber-security-advisory) **AsiaOne.com** · news · secondary · captured · published 2026-10-22T17:30:00+08:00 · added by `curator@php.newsroom` · `asiaone-singapore-php-vulnerability-singapore-cy` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). AsiaOne (Singapore): Singapore firms are urged to act urgently over the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collect... capture 20261023T160435Z · HTTP 200 · https://www.asiaone.com/singapore/php-vulnerability-singapore-cyber-security-advisory- `headers.json` 6f220277a9007cf6c922a3f2c954bfed8fce86e956369ab36769acf26d5a5be6 1,687 bytes - `page.html` 9ee5fb6de889d4124aa283abaf4fb775a6eb662aaf3b9eaa43365580ccafc30e 45,762 bytes - `provenance.json` 74ba964c0b375631467201c326762194f84f9ea6713948928fe081f20b49f220 1,778 bytes - `rendered.html` 2542d7286b42e012202211d6f8005cbec91a40998bf02772cf1751e8118e6442 74,356 bytes - `screenshot.jpg` 603dd37e588ee37cad2d419b504527cfcc21b59af88e2cd144e1afea5afbcbaf 303,547 bytes - `text.txt` 59d25b11948335424a559975e074f1370e9d3b3e0ecb134cc4c1532b852ebecd 3,639 bytes ### [Synology製品における「PHP2Shell」脆弱性の影響について | 株式会社アスク](ask-corp-news-2026-10-synology-php2shell-vulnerab/index.html) [original ↗](https://www.ask-corp.jp/news/2026/10/synology-php2shell-vulnerabilities.html) **株式会社アスク** · news · secondary · captured · published 2026-10-23T12:14:16+09:00 · added by `curator@php.newsroom` · `ask-corp-news-2026-10-synology-php2shell-vulnerab` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ASK Corporation (Japanese distributor of Synology), 23 October: Synology's PSIRT investigated and found the impact is limited to systems running certa... capture 20261023T160435Z · HTTP 200 · https://www.ask-corp.jp/news/2026/10/synology-php2shell-vulnerabilities.html- `headers.json` f7efa40eced7de094e1454d75d903089f8edc6283538b1bb1bb167a7e7e9f96d 513 bytes - `page.html` 36e585132825e6f74d0c7dc8949cc4939fcaa561e6040f042c7284224c180609 32,059 bytes - `provenance.json` 1fb451ccb51d0aab506320c5326cf44cf08b624947042521b72fde2e91aaa87e 1,745 bytes - `rendered.html` 1c8e49b4f6e8a2fc19fac8fb79c8da79cbf34c504a78cb01c6afb81a7b9a50af 36,453 bytes - `screenshot.jpg` 06a6815944d0dfb8ab21e9f3785a6c539ffaebb2a1d99b6d7cd2ed9fe3ede788 290,684 bytes - `text.txt` 6522b5d445b74558fd46281774222b2a0bc0cba617fbd4017dce5a6556577011 6,428 bytes ### [Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog](aws-security-blog-madpot/index.html) [original ↗](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) **Amazon (CJ Moses, AWS Security Blog)** · vendor · primary · captured · published 2026-10-21 · added by `claude-story-site` · `aws-security-blog-madpot` Primary account of the 17 October honeypot attempt and the 02:00 UTC proof-of-concept attempts; 'PHP2Shell is now being broadly exploited in the wild'. capture 20261022T111755Z · HTTP 200 · https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/- `headers.json` cd2b6b91c536e98366aa450fc499555f4c46f1fc50e52b619d41fdd8156f7621 961 bytes - `page.html` 94afa0f2233266fa0310186f90425778563bae6747ca3cf284d7d176d5339c8b 1,407,726 bytes - `provenance.json` 0d0fa2b45ba63031f0e80fc3fdf09aaa336dc7d1bb31664221072c5be8924343 1,223 bytes - `rendered.html` 5e11969294ad2dba28416a6f535b5e0674e071861c00efcd5c7b6dbecd42ee92 1,473,573 bytes - `screenshot.png` 838da55574a9351f12a7a7ef936be739360c2221877d6e744c1ec445ad70a84a 688,402 bytes - `text.txt` 94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d 8,561 bytes capture 20261023T160435Z · HTTP 200 · https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/- `headers.json` e0ce26cc23e02ee712c46b0459d730662b9f6c4eb58a7fa0d6e89aa359d4b13c 1,032 bytes - `page.html` 97b8d87ec2bdc87224e2b4fda3e8e9a8e88cbff80a3f648357313cd537435b1a 1,407,737 bytes - `provenance.json` e0642397fc34af1b1f8f3fe7b3c5bd2cb39ab9f1163b292c8f1312d7db92abf5 1,920 bytes - `rendered.html` cdeee247d98d602a20e40fbea16608d42d2d3169c6c20fd0084f69ddbfe64565 1,465,446 bytes - `screenshot.jpg` cec27caf9be0f02f4189524eff01ba6bbbd4258ca6554bc7eb5ef6b49a0cae60 379,262 bytes - `text.txt` 4108b2850c48a8f2141f05996ef7e7ed115a0a0f80ce697b3d237b8d13e7c764 7,474 bytes ### [Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP](bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a/index.html) [original ↗](https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161) **BankInfoSecurity** · news · secondary · captured · published 2026-10-21 · added by `curator@php.newsroom` · `bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Mathew J. Schwartz: attackers were exploiting one or more zero-days in PHP after details leaked before the patches; the PHP Foundation planned updates later Wed... capture 20261023T080331Z · HTTP 200 · https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161- `headers.json` e39137f0640ff139d6bfd1f49a013c591568caf7d6b8592dce82b72ed4238e04 1,611 bytes - `page.html` 540fb442ed0aa87627a2a85b0dbd67554aded52034a2dd61e9123f5a477fbafb 414,138 bytes - `provenance.json` c20c777fabfab04476c89396c87628a54de16b76a5ddf80679c05d08bb7dc590 1,814 bytes - `rendered.html` e97a0f0bcea1546dfcc583f8e31481483debe5f7a3588e29947804f43a3aa210 438,185 bytes - `screenshot.jpg` f269193f2b88e4b9015f672ab938acb410ca32e6c08b3330c17f95edba423a42 688,403 bytes - `text.txt` c0242ed45a367f748a8e597436b19a84a00c9199c5e0300ff98dfc94e55c43c3 10,226 bytes capture 20261023T160435Z · HTTP 200 · https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161- `headers.json` 78a379eab1d52f97aa107cf2d29673c0e05a8f228910f5f69a9379903491ee7c 1,604 bytes - `page.html` 71c0a7fda1e587a37c8b41f949c378b929d51f59ede6992fed2b94b2aecf2e72 414,177 bytes - `provenance.json` 52ed617ae2be1da48c62f371047c0730425e0ce222934467489b58273ceec711 1,814 bytes - `text.txt` 83102b4d722e0f3676a26b94f152f680c4c325f5fc5caa8949ab9f9cf7ca1032 10,156 bytes ### [Lỗ hổng PHP do AI phát hiện gây tạm ngưng nhiều website trên thế giới](baogialai-lo-hong-php-do-ai-phat-hien-khien-nhieu/index.html) [original ↗](https://baogialai.com.vn/lo-hong-php-do-ai-phat-hien-khien-nhieu-website-tren-the-gioi-tam-ngung-hoat-dong-post602798.html) **Báo Gia Lai điện tử** · news · secondary · captured · published 2026-10-22T14:57:50+07:00 · added by `curator@php.newsroom` · `baogialai-lo-hong-php-do-ai-phat-hien-khien-nhieu` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bao Gia Lai (Vietnamese), 22 October: a PHP flaw found by AI caused many websites worldwide to be suspended temporarily. It says the flaws, together c... capture 20261023T160435Z · HTTP 200 · https://baogialai.com.vn/lo-hong-php-do-ai-phat-hien-khien-nhieu-website-tren-the-gioi-tam-ngung-hoat-dong-post602798.html- `headers.json` 2950f37d5f1a2436d9bc84b066135aaf07119b8d3842f58c02f9dd9196edb98e 339 bytes - `page.html` e394109ce5480af71e08e1f062bbe2dc5b4b0c3fa6cf1c9c6a3d75dffbcbb102 222,148 bytes - `provenance.json` 7210424cf75dea3fdfd8c6ee6b09697fc5b34bb1b243a0a2f8efb0fcfa03e4e6 1,699 bytes - `text.txt` 4334d90d02918c0d014abc9aa6940db9a3c3c5debafedf926caec5a03be6f8ad 19,859 bytes ### [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](bbc-live-ckgel5xp2xv9t/index.html) [original ↗](https://www.bbc.co.uk/news/live/ckgel5xp2xv9t) **BBC News** · news-live · secondary · captured · published 2026-10-22T06:16:24Z · added by `claude-newsroom-lead` · `bbc-live-ckgel5xp2xv9t` Live page; bbc.co.uk redirects to bbc.com. raw/ holds a curl copy at 07:55Z and its __INITIAL_DATA__. Captures 080453Z and 080526Z have no raw body (the tool's first fallback was blocked by egress); 080559Z is complete. Edited by Kieran Kelly and Imogen James. capture 20261022T080453Z · HTTP 200 · https://www.bbc.com/news/live/ckgel5xp2xv9t- `headers.json` 6f92f9cc2df7e178c6a5480cde0a0d07eaa057374c17573ed0539cd2ec5e4f76 5,640 bytes - `page.html` dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981 24 bytes - `provenance.json` de7ccc50e0cd85c96d0c814a87e22d61df580452ccc7cc08bec00fe2acb36000 1,094 bytes - `rendered.html` e9ae7f01673df9b32a99007f255c2106bc6f4179841891af83732ce54cac1bde 500,416 bytes - `screenshot.png` a466ce380b452e0a851e07db1d769f1ccb1b41391a8bf001b5febe1a6b0a8352 2,737,568 bytes - `text.txt` df1dbe6b553a8c004f6d950a1d606138f2795062d3225feaa37043d24343bc99 14,389 bytes capture 20261022T080526Z · HTTP 200 · https://www.bbc.com/news/live/ckgel5xp2xv9t- `headers.json` d63c60c458f9e0144dfc1ec7336b7e7eb13ac35383008623841bf01030b99175 5,690 bytes - `page.html` dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981 24 bytes - `provenance.json` b0b6c73c98d7b9af8e3cea8a007eb2212d89e38f80d8fdcb1c99b32cac545a18 1,094 bytes - `rendered.html` b42a90b0ed17266eac83cb8bc81fc6e2321285b3b3dd01c15aed55411ec51255 511,866 bytes - `screenshot.png` 65eb8a2dd5d93f8ef2399b62dd91d4bae200c41997a77ccae9b9388d33c505bf 3,587,122 bytes - `text.txt` 9ae96265aa96cff67f4da71f5ed410376023b17283d83b617eab7e98d2602738 14,501 bytes capture 20261022T080559Z · HTTP 200 · https://www.bbc.com/news/live/ckgel5xp2xv9t- `headers.json` adef455045234df0fcb6936e0b86ce89d83c6b68719892c1e08bc498d0704517 5,647 bytes - `page.html` 50bc0fc20681b834b1a40742cf921b27ceb5356d5ab38b417c7e53513016eefd 501,921 bytes - `provenance.json` b62c78eb8ac92bd2d3d7bbd6749e8f0c24519b5d2edac76d107af558eaf78d2f 1,092 bytes - `rendered.html` 8ae9c4bca9c7ff8b5037ffa58536c2b75c45efdee1f851d583a80ac5cd05ff5c 501,515 bytes - `screenshot.png` f3cf0359a5f9aec2edf5dfa6cd060f55f94aa3c64b90f7e260edec02180a434c 2,685,632 bytes - `text.txt` c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d 14,389 bytes raw, 2 files with SHA256SUMS- `initial-data.json` ee7445a58187bcd67df827007a8100941993a24dc3e7eea7e8a45f723a9e3305 - `page.2026-10-22T0755Z.html` fe32274b64ee109a7e37fc4c26e37e793dc22481a6122888782c393e01102488 ### [Критична уязвимост в PHP спря правителствени сайтове в Европа - Bgonair](bgonair-a-5-science-434196-kritichna-uyazvimost/index.html) [original ↗](https://www.bgonair.bg/a/5-science/434196-kritichna-uyazvimost-v-php-sprya-pravitelstveni-saytove-v-evropa) **Bgonair** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `bgonair-a-5-science-434196-kritichna-uyazvimost` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bgonair (Bulgarian): a critical PHP vulnerability stopped government sites in Europe. The flaws are known together as PHP2Shell and carry a risk of re... capture 20261023T160435Z · HTTP 200 · https://www.bgonair.bg/a/5-science/434196-kritichna-uyazvimost-v-php-sprya-pravitelstveni-saytove-v-evropa- `headers.json` c4e820be49379950d863108a87aa3dfbad2f5a528d2f8c64e750992a1ee01516 850 bytes - `page.html` e650b289ccfa05e9947462d5c16e5abcecc3e58f33aab9d332cbdca6378925d8 108,183 bytes - `provenance.json` 132fe38523f9c1cf7f2b415f8be03529e1428394d0134daf5ff9f3820a6580f8 1,845 bytes - `rendered.html` e92638364e7962f93780d238e7f94a2e71fcf4cc76dd57ab6e88119a2ec9208e 115,826 bytes - `screenshot.jpg` 4a0c93662dbb23e0e33ce0170f8ee2823265a7ca0e4c661f0d83e482f70a35f9 510,187 bytes - `text.txt` 516d8149a92b149276cba7b183d204955b6e9a52ac0594ae57c267ee8f7f55b3 12,463 bytes ### [PHP2Shell: Wer offline ist, wer gepatcht hat und was zu tun ist - Bitpage.de](bitpage-php2shell-php-sicherheitsluecke-webseite/index.html) [original ↗](https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/) **Bitpage.de** · news · secondary · captured · published 2026-10-22T06:21:47+00:00 · added by `curator@php.newsroom` · `bitpage-php2shell-php-sicherheitsluecke-webseite` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Bitpage.de (German): a situation report from the evening of Wednesday 21 October, updated on Thursday and Friday morning, on why half of Europe switch... capture 20261023T160435Z · HTTP 200 · https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/- `headers.json` 98241adeba9a7cc8fa85d770ca82323b08a5f43eb3e4548c02455dcac256367f 789 bytes - `page.html` d842d79b8094876b9a5081dfe5ea816a4fa8cc09bf32b0f05350216716e07201 374,328 bytes - `provenance.json` 4ec337fd7770c0a1ab6012864a9c19014bbd895be8d1f9ffc4ab98a57e9ff6ef 1,556 bytes - `text.txt` 50d84bde38c55c1772d88500502e6aa7a1e20d4691519ca18654499441ad8786 59,785 bytes ### [Amazon says PHP2Shell exploitation began 4 days before patches](bleepingcomputer-amazon-4-days-before/index.html) [original ↗](https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/) **BleepingComputer** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `bleepingcomputer-amazon-4-days-before` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "unclear how man... capture 20261023T012042Z · HTTP 200 · https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/- `headers.json` 668fb6eaa9fed6428617810fa613ea89128912ab5a69ca9b6b07745619eca389 1,034 bytes - `page.html` e0b6621a06d202fe071370cdaabe66d71c2f5140fa24ed84944ee545eadc0c0c 90,448 bytes - `provenance.json` 4b9107ed9dfda71ba900872536cb9a543352733b8b9cf058ac39652728d7ff33 1,732 bytes - `rendered.html` af0f5bafbd31cd2f15782a44bb16120c0356bcb9d0b4b1023880e8c5fa904d4e 150,348 bytes - `screenshot.jpg` cd8f6c7adbf3fd996cf0fa8b8fc6045875dc12132019c0dcf9440db26e55862d 518,677 bytes - `text.txt` 2978662261ce3880962943cd129485066fab46e3bc7a181762dbe83479aa8997 5,970 bytes ### [PHP ships emergency patches for critical PHP2Shell flaws](bleepingcomputer-php2shell/index.html) [original ↗](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/) **bleepingcomputer.com** · news · secondary · captured · published not stated · added by `collector-news` · `bleepingcomputer-php2shell` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081018Z · HTTP 200 · https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/- `headers.json` 9204c9d3cedc821d3f1fe3b9b829b20b9fce7eaddb285be33ddc3ce09bc61974 1,034 bytes - `page.html` e6f9f8d5119ac7742807418bf305184e2b93a11051d35241184ba320a7e80651 91,998 bytes - `provenance.json` 79d14d3581b9b39dcd1feb8a7848a6c6f3a697a6b91f615cb747919d14f16c43 1,100 bytes - `rendered.html` 5357928e9e81ec6b27c56d8bd9c89953bdfdac5cd5f098d3ffdb2943bf6c0e3f 170,279 bytes - `screenshot.png` 7bface94f50938d69eff243e48acb16f1cdcb1f94fd50644f07d7dc744d8cf6d 1,525,231 bytes - `text.txt` ad35f92f5f9bf98f235b92c8180ba7ba15b7a222bf882cb8b3d074e060f862b1 7,078 bytes capture 20261023T160435Z · HTTP 200 · https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/- `headers.json` ad0cf71daaecac8875fd26ec93ab203967a0a77fe49b543d82f649c3b1babf5d 1,034 bytes - `page.html` 83b2007c154fba517b5d5426fd4c9d3eb80e9cc5b3079fa1d4d5bdf95294e291 91,775 bytes - `provenance.json` f2c73943812b4f87f5ab8daaf2ec6b497c5242a6086dd590111a8ba7ead8fc22 1,702 bytes - `text.txt` 63f09a43ab70aab1b5d441ee1227ec138415c4ef7386b36ecd6093f50da20bd8 7,101 bytes ### [PHP warns admins of two critical flaws, emergency patches coming tomorrow](bleepingcomputer-wikipedia-ref-12--flaws-emergency-patche/index.html) [original ↗](https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/) **BleepingComputer** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `bleepingcomputer-wikipedia-ref-12--flaws-emergency-patche` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). BleepingComputer, written before the patches (updated 21 October with a link to its newer article): PHP warns admins of two critical flaws with emerge... capture 20261025T114552Z · HTTP 200 · https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/- `headers.json` ca863dbfec9805bdc59cdd994438b05448b73a74158d405cf19a657965e6b2ae 1,034 bytes - `page.html` d0de273c85bf93f86a708f1a69f3b9e8748c845615daf26e6bdde9e65adb85d3 94,411 bytes - `provenance.json` bc46428b2ef9e4f0a919b707f1b95ea7737ad40fe0deec8182ad68a727379174 1,857 bytes - `rendered.html` 1e4b558ff00a6e867733bf569f7fb2f8a5321d84dfd6e09d1eec77aa2f4a1f49 213,001 bytes - `screenshot.jpg` 0e577c60bdce9fc2fe64f87fd4bd5b60079dd704fc49ca0c7c76cdd39c172f93 634,029 bytes - `text.txt` 067232e02619cba94e53ac7052dc4154a3664cebd75d222e9cf2c40a462328cb 8,606 bytes ### [OpenAI 開源 php2shell 版本檢查器：Codex 技能一鍵比對 PHP 版本，但「OK」不代表真安全 | 動區動趨-最具影響力的區塊鏈新聞媒體](blocktempo-openai-php2shell-checker-codex-skill/index.html) [original ↗](https://www.blocktempo.com/openai-php2shell-checker-codex-skill/) **動區動趨** · news · secondary · captured · published 2026-10-22T22:23:10+08:00 · added by `curator@php.newsroom` · `blocktempo-openai-php2shell-checker-codex-skill` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). BlockTempo (Traditional Chinese), 22 October: OpenAI open-sourced php2shell-checker on GitHub, usable as a Codex skill or a one-line Node.js command,... capture 20261023T080331Z · HTTP 200 · https://www.blocktempo.com/openai-php2shell-checker-codex-skill/- `headers.json` 5d90c2ead37f4999ffa4a5f9613a43acb62df36efbf7d8460adfed364e924e27 1,163 bytes - `page.html` 101375f18a72db5b11795bc27f0cd811b4ad3c7eeb37eef183978ed0933d3d6c 174,106 bytes - `provenance.json` fce73b61529ea1b6601ae704aa48616e326a31e3910aeb69bf152151cf5a467d 1,762 bytes - `rendered.html` 27f56a099582f6d6a0af220eadfdddb2bad38dcbefe56ff653b8b85bf43ef7d1 178,800 bytes - `screenshot.jpg` 2325cb8183bec12e1e140fd91d437f79b2ff617ac2b2b3482e1c79ea1dac7290 313,690 bytes - `text.txt` 8db46ec6b3d92fce1d4d9124253dc2736a1a8f9d96980bea7312f27ccf228d39 10,324 bytes ### [Failles critiques dans PHP : quelles versions mettre à jour et comment protéger ses serveurs](blogdumoderateur-failles-critiques-php-versions-mettre-a/index.html) [original ↗](https://www.blogdumoderateur.com/failles-critiques-php-versions-mettre-a-jour-comment-proteger-serveurs/) **BDM** · news · secondary · captured · published 2026-10-22T11:32:58+02:00 · added by `curator@php.newsroom` · `blogdumoderateur-failles-critiques-php-versions-mettre-a` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Blog du Modérateur (French): which PHP versions to update and how to protect servers. CVE-2026-109618 and CVE-2026-109619 are rated 9.2 out of 10 on C... capture 20261023T160435Z · HTTP 200 · https://www.blogdumoderateur.com/failles-critiques-php-versions-mettre-a-jour-comment-proteger-serveurs/- `headers.json` c0639e4130945a6225ea17ddc77a70beaabd3cdf20f5a2e8f6bda4e3c4462435 1,510 bytes - `page.html` b36c8dcb951e96c43153ea0818c9130f4292135cc952df25f823f7530109e8ff 203,825 bytes - `provenance.json` b5bafe2dc90a211bd286e7453991e0ddf9fcb42dd22519e32557d7411cc0f7fb 1,692 bytes - `text.txt` 795b299b2ea070a2915cafe3d2c86387b6ce281a3932d3cbbc183fa4cca9b2d0 8,926 bytes ### [Bloomberg - Are you a robot?](bloomberg-governments-offline/index.html) [original ↗](https://www.bloomberg.com/news/articles/2026-10-21/governments-take-websites-offline-after-php-security-warnings) **Bloomberg** · news · secondary · blocked · published 2026-10-21 · added by `claude-story-site` · `bloomberg-governments-offline` European governments take websites offline; may be paywalled, see capture status. capture 20261022T112602Z · HTTP 403 · https://www.bloomberg.com/news/articles/2026-10-21/governments-take-websites-offline-after-php-security-warnings- `headers.json` ebbf488d8ec3cb9e82e0b2850092794fa151b40e36e5527483c925bd8bc043c2 1,744 bytes - `page.html` 42ba14394a9bbfcfd2d92ca9d569ec69f03944659af408f36f57faea50e788d2 13,856 bytes - `provenance.json` 3c8c1301b67db2b3dbe016f7c0f83861dc5a27d0a02c693c16b232b3a0f0bc56 1,091 bytes - `rendered.html` cf863d12c016944da5fa0f4a5d5a6b20441810b9d390e4cd795477677e22219c 15,882 bytes - `screenshot.png` 381a9b176a6f0b8aa7805f9ddb22a7cd17826528afa7a41b24b0015b1c3a355e 78,255 bytes - `text.txt` a66e04101bddd06c4cc5019d69b57bd2db4ff7d0a6ecdfe0fbd4d6fc5e05b303 665 bytes ### [PHP2Shell: Wie Ondřej Surý das Internet rettete](bluewin-de-digital-php-sicherheitsluecke-ondrej/index.html) [original ↗](https://www.bluewin.ch/de/digital/php-sicherheitsluecke-ondrej-sury-rettet-internet-li.3646381) **blue News** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `bluewin-de-digital-php-sicherheitsluecke-ondrej` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). blue News (German, Switzerland): 'PHP2Shell: how Ondrej Sury saved the internet'. It says two PHP flaws threaten a large share of all websites; that p... capture 20261024T133450Z · HTTP 200 · https://www.bluewin.ch/de/digital/php-sicherheitsluecke-ondrej-sury-rettet-internet-li.3646381- `headers.json` 511c9b18e843f308ea9ca719a7dbd0b04614f751c128b5b2084ff050ad81cb29 1,189 bytes - `page.html` 68b7183d54075fbee5604bfc206f159019e362d1f77c833768293bc690bcd014 1,038,518 bytes - `provenance.json` 4758638831a21849710be5f228400230a3bbc37ed19b876b9703f855442b0dc9 1,747 bytes - `rendered.html` 01e568d5870a64b8fa57f931694da6096eead2ce92ac6a8174ed9cca94218c9c 1,040,805 bytes - `screenshot.jpg` 6ca53852b85d0f1a5401c65feaa43d9917ea53f3a465e8a850de98376f733095 513,241 bytes - `text.txt` f9a3771421acf48c94eb3e31e3b071739cb4418c9708dba568ff5ab7f7291e8b 7,294 bytes ### [[PHP 파장] “개인정보 유출 우려... DB 접근권한 최소화 시급” capture 20261023T160435Z · HTTP 200 · https://www.boannews.com/news/articleView.html?idxno=146663- `headers.json` ffe49f69fbfe2f700a70ca3c87bf90eeaa4b74a29b07551b11dde6ced6b4f4fb 354 bytes - `page.html` 7f52efe4c89e57ed6b9a9da9b28bdd8edb209953580e4de96716ee24e55ffc2b 143,504 bytes - `provenance.json` 9471e7a25d4c72a8993f49ff00041b1d7addb1394ee32cf68faaf542a897a121 1,680 bytes - `rendered.html` f17e26947dcbfc0b3f49b2e4e80bf92cacd5035f0054e5828fb981404b7b971d 144,749 bytes - `screenshot.jpg` 8b9498eb4d92025b9079f482f521ce3dce005ac62bd2eb2fb3eb0a3143afc46d 619,854 bytes - `text.txt` 992d0cbd7b31e0d69b4c9ec0f11ff0643f2eed68140c2062ca76eda87be5e1be 9,427 bytes ### [php2shell: PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619Borns IT- und Windows-Blog](borncity-blog-2026-10-21-php2shell-php-schwachste/index.html) [original ↗](https://borncity.com/blog/2026/10/21/php2shell-php-schwachstellen-cve-2026-109618-und-cve-2026-109619/) **BornCity** · news · secondary · captured · published 2026-10-21T13:20:52+00:00 · added by `curator@php.newsroom` · `borncity-blog-2026-10-21-php2shell-php-schwachste` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Born's IT and Windows blog (German), 21 October: two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, became public. The PHP maintai... capture 20261023T160435Z · HTTP 200 · https://borncity.com/blog/2026/10/21/php2shell-php-schwachstellen-cve-2026-109618-und-cve-2026-109619/- `headers.json` e5590d010f043055660e961be0a483504d7a4ed93480c36a288ca3f595ffbc6e 794 bytes - `page.html` 625aa0a420a0a900dfba6aad62794bd507aa5e6807aee58a816a4314d5539606 355,141 bytes - `provenance.json` c710138a52c85dedbb612a3dc83558a915acec7e9fb87c601bd687f9c55e3d54 1,811 bytes - `rendered.html` ea2064e3b443f7b73db67225a5b4a7047364619c3c600d923e4c3b23a2c4e3e8 364,116 bytes - `screenshot.jpg` 597e71c72aa7ca054f0eaaacb05839f2cb45cc1795d5f0377bbf145dfa050fac 650,886 bytes - `text.txt` ac019c2d35b1f126f0a4b19cc896409cde99b37682e90df4cff859aeb76b3ac5 65,743 bytes ### [Des sites gouvernementaux hors service sur fond de failles dans PHP, un correctif critique attendu - 21/10/2026 à 16:44 - Boursorama](boursorama-reuters-sites-gouv/index.html) [original ↗](https://www.boursorama.com/bourse/actualites/des-sites-gouvernementaux-hors-service-sur-fond-de-failles-dans-php-un-correctif-critique-attendu-70b6b2c5823e9cf3e5dd17efb767a981) **boursorama.com** · news · secondary · captured · published not stated · added by `collector-news` · `boursorama-reuters-sites-gouv` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081500Z · HTTP 200 · https://www.boursorama.com/bourse/actualites/des-sites-gouvernementaux-hors-service-sur-fond-de-failles-dans-php-un-correctif-critique-attendu-70b6b2c5823e9cf3e5dd17efb767a981- `headers.json` 4cfefb7acbde24b1c20a1ba8333fc6bf7b3f9306ff39e4b0f2e46bd4d1d16dc0 713 bytes - `page.html` a3ff1c1936dbdc9e95bfd9f790a2d8efca4f5142ae1ca227ac2fb0328f04163e 945,994 bytes - `provenance.json` cdb64045594736d1dfb6ffca73b7d9bd3a24f19eead44272bed34cfca44b1bb1 1,322 bytes - `rendered.html` fa0c4547e744675c7372948ee9a090d77cad1b8539e4fc859472aac46d96024d 1,003,767 bytes - `screenshot.png` 08778bfe5be98ae08aedcdf07c1abddac7bab7bc05be669ae0f808932a489685 966,367 bytes - `text.txt` cc4667b91c744182995cf31ded0e703d9cfd3ea1f87983a11b665ae840d784d1 11,528 bytes ### [PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COM](broadcom-security-php2shell/index.html) [original ↗](https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619) **Broadcom (Symantec) Security** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `broadcom-security-php2shell` Vendor explainer. capture 20261022T112608Z · HTTP 200 · https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619- `headers.json` 90e7e97292b84a9655eb632719cd295101372dea8bfbbea1c37cac21f29c6083 2,018 bytes - `page.html` ee4999fb83f9cd38b29e33384e6cd904f855429326277bbcaaaa0b5796879cf8 329,468 bytes - `provenance.json` c676441507e6939f7a352231caebe725dfa363ad55108ae190166cc7123411b0 1,093 bytes - `rendered.html` 087b78f1dbe37ce2b31dc124b10b31a4009ac15969a40407f65afddb1dff30b7 431,453 bytes - `screenshot.png` a4a4f3fec342e365df75bcdd5a2b61bac1edb4a1417b9a1200702734cd579cff 2,841,458 bytes - `text.txt` ade5eb86aa233a2122f483429993bf21453456fc608ee191949dacc2f7e3a260 13,607 bytes ### [Akute Warnung: PHP-Schwachstelle gefährdet Krypto-Dienste](btc-echo-news-krypto-boersen-akut-bedroht-kritisc/index.html) [original ↗](https://www.btc-echo.de/news/krypto-boersen-akut-bedroht-kritische-php-luecke-239718/) **BTC-ECHO** · news · secondary · captured · published 2026-10-22T16:05:00+00:00 · added by `curator@php.newsroom` · `btc-echo-news-krypto-boersen-akut-bedroht-kritisc` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). BTC-ECHO (German), 22 October: a critical PHP flaw puts crypto-infrastructure operators on alert after the emergency patches for CVE-2026-109618 and C... capture 20261023T160435Z · HTTP 200 · https://www.btc-echo.de/news/krypto-boersen-akut-bedroht-kritische-php-luecke-239718/- `headers.json` f243d20f6550d7beecd6da503c41ae09c37ce8265a1538f7945a4f069bc6890a 1,856 bytes - `page.html` 6283db83b9e79dee0d153c22d7ed0a06d9a407930aa06d45494d388e8a63e7f9 329,819 bytes - `provenance.json` 3bf9ebb27a9da7b9ae56c25e5dd9c43caef6ccd4ee7615ca87d8dd2c4e9230d9 1,744 bytes - `rendered.html` c5b3888525e8b9b45851bbfb4113e5570e1d95618271aaa0e31a9a90d5e41d49 354,811 bytes - `screenshot.jpg` 80970b46fbcbef6561fc9b3fa5f7e8b3a7b897180cff883c6790c4d350b433d2 380,870 bytes - `text.txt` 823b6258aff1919cf186d59298248a87a39e5fff07ba0a612f82b929afc3398b 5,998 bytes ### [[object Object]](bursadabugun-haber-php-nedir-php2shell-guvenlik-acigi/index.html) [original ↗](https://www.bursadabugun.com/haber/php-nedir-php2shell-guvenlik-acigi-ne-anlama-geliyor-1958356.html) **Bursada Bugün** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `bursadabugun-haber-php-nedir-php2shell-guvenlik-acigi` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bursada Bugun (Turkish), 22 October: what PHP is and what PHP2Shell means. It says the Presidency's Cybersecurity Directorate announced that national-... capture 20261023T160435Z · HTTP 200 · https://www.bursadabugun.com/haber/php-nedir-php2shell-guvenlik-acigi-ne-anlama-geliyor-1958356.html- `headers.json` 698c87dca3995e343baf7fa6b6bed84295f4dfc5aab4a93756012d06dbaf81ea 923 bytes - `page.html` 47baefd10b77a0242c7fcbc252911468ad6099b6d40d1393432b576e6d0c2c57 65,282 bytes - `provenance.json` aabca441b13cf7c5a465e69c1ca1f6b37ca58bbee433d269da10ce9f709b918c 1,743 bytes - `rendered.html` fa088ce88148ce62d73fab8cf54c0e9041ffe4e723ee004388c433d9169bde12 114,948 bytes - `screenshot.jpg` 7f5a6bc419cc255ed27bc2a333b1ad65e04a2ed38c9150cf6561754f8cbbbc1e 967,814 bytes - `text.txt` 3edab98a39d927f9952e0de3b21bd1e55475fd673858003e9449e48626e15946 15,392 bytes ### [PHP’deki kritik güvenlik açığı alarmı! Dünya genelinde çok sayıda site erişime kapatıldı - Bursa Hakimiyet](bursahakimiyet-teknoloji-php-deki-kritik-guvenlik-acigi-alar/index.html) [original ↗](https://www.bursahakimiyet.com.tr/teknoloji/php-deki-kritik-guvenlik-acigi-alarmi-dunya-genelinde-cok-sayida-site-erisime-kapatildi-1734665) **Bursa Hakimiyet** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `bursahakimiyet-teknoloji-php-deki-kritik-guvenlik-acigi-alar` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in tr: Bursa Hakimiyet compiles international reactions. The FBI advised taking sites offline; Japan's health ministry suspended a long-term-care information site (Kyodo); Denmark's agency urged updates; and Norway's NSM warned capture 20261022T181608Z · HTTP 200 · https://www.bursahakimiyet.com.tr/teknoloji/php-deki-kritik-guvenlik-acigi-alarmi-dunya-genelinde-cok-sayida-site-erisime-kapatildi-1734665- `headers.json` ee7c2ff55056fdd5205bf22839c6a4098141ab77bd076586a41dbec94a2c9e3c 1,277 bytes - `page.html` b22e098c612d6edf368f9e35c9526317bcc77a9fa8bf6e4eaf97c00948734cf5 145,833 bytes - `provenance.json` d15e81672ea2ad1fe040471edb81e47ccbac2188eabd5caed2f38ba4a72a8c78 1,935 bytes - `rendered.html` e1ec6baba97ee252baf342aa63560981ae22c58f9904352e9cdbdd50d4cd1a39 207,604 bytes - `screenshot.jpg` 685610fa48aa5a89720ed16794fe8c20e973f4defd0758e712e8a7e5b7e65a85 710,490 bytes - `text.txt` 123ba1f9630dac63b317075915e88355e1da3a67680aae5df46d9db571a4ed32 9,715 bytes ### [الذكاء الاصطناعي يكشف ثغرة خطيرة في PHP تهدد ملايين المواقع على الإنترنت](cairo24-2516354/index.html) [original ↗](https://www.cairo24.com/2516354) **القاهرة 24** · news · secondary · captured · published 2026-10-22T17:15:51Z · added by `curator@php.newsroom` · `cairo24-2516354` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cairo 24 (Arabic, Egypt), 22 October: AI reveals a serious PHP flaw threatening millions of sites. It relays the BBC: PHP runs about 70% of the world'... capture 20261023T160435Z · HTTP 200 · https://www.cairo24.com/2516354- `headers.json` f3d765797c5b6c0f4da708195842472d8da1fe6ad1dcfa0cb42d1e71c8364afc 1,032 bytes - `page.html` 3d715c61fd4250387e2008a6b79852dfa4d3166258f6b7b807750921940af7c5 95,292 bytes - `provenance.json` 99cfd00ac82f0287c6f5f7a2cd361714753ada8cb8515e048e458db94b5efbc3 1,565 bytes - `rendered.html` f2e3353df52d219d26a9f8a7420849aa96fddc3fb63e8cc6b6c4e3e0c79d7e40 386,981 bytes - `screenshot.jpg` 2ad6853557ce9cfe8c7e6dece44ca133b0d44db5375c6f511348f6234db6b1cb 378,266 bytes - `text.txt` 4e5ce91906555051fcf2bf5b78b64b4d4341ba8476421daed2d27851d358e980 6,692 bytes ### [php2shell by Calif Research — A tale of two PHP remote vulnerabilities](calif-php2shell/index.html) [original ↗](https://calif.io/php2shell/) **Calif (Calif Research)** · researcher · primary · captured · published 2026-10-21 · added by `collector-researchers` · `calif-php2shell` Calif's own write-up by Ryan Austin (@lcfr_hax). Page has no machine timestamp; story panel dated 'Oct 21, 2026'. Embeds two YouTube exploit demo videos (pfWZrdzvooc 'php2shell exploit demonstration', cE4h79AWbT4 'Exploiting Nginx with PHP-FPM'); videos NOT downloaded. Its timeline omits the leaked/deleted video. capture 20261022T081033Z · HTTP 200 · https://calif.io/php2shell/- `headers.json` 1fc0b2864079499b5911e31166e216c1c753a83da9a65d38086609e84372794e 759 bytes - `page.html` 9f3df4d68b9d185563f9b5eec4b1e910f296389f54e02b4f6a25fef2573662a3 68,302 bytes - `provenance.json` c800836bfdf2759a20495415eb65bff17d26b8d9127d0695f7be27870b1dc67b 906 bytes - `rendered.html` 24e345e4514f5240f94df7537536a5ed14ba6e440cffffae74f8c38c7c8e5644 68,280 bytes - `screenshot.png` 38990c6ce9af5828a86614d9dff808d621097986d5288e8136bda70412b3ac63 20,097,747 bytes - `text.txt` 23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4 23,876 bytes capture 20261024T133450Z · HTTP 200 · https://calif.io/php2shell/- `headers.json` 4a8ab067dd4e49688e657fdfd0c51aec0e51a8a6aebf16f0dd8bcf9b6e2d0dc1 738 bytes - `page.html` 2b77deb5169ba2a3872ea2045454735893bcc915a4f2f4eb2132ec415b62f7cb 69,595 bytes - `provenance.json` a3e7faae2faf08834fc17c711b74edc2c6b6ef4983321a0e8fdbc7f161e5a095 1,438 bytes - `text.txt` effb0fa357b68ea97d847a69a42809262dd6c84accfe18cfc4113ec58e5c849b 23,899 bytes ### [Falhas no PHP chegam ao Brasil e fazem Anatel e tribunais suspenderem sistemas - Canaltech](canaltech-seguranca-falhas-no-php-chegam-ao-brasil-e-fazem-a/index.html) [original ↗](https://canaltech.com.br/seguranca/falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tribunais-suspenderem-sistemas/) **Canaltech** · news · secondary · captured · published 2026-10-21T15:48:39.000-03:00 · added by `curator@php.newsroom` · `canaltech-seguranca-falhas-no-php-chegam-ao-brasil-e-fazem-a` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in pt: Canaltech reports that the PHP flaws reached Brazil. Anatel took its SEI electronic-process system offline, federal courts TRF1, TRF4 (Justiça Federal da 4ª Região) and TRF6 suspended external access or deadlines, and th capture 20261022T181608Z · HTTP 200 · https://canaltech.com.br/seguranca/falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tribunais-suspenderem-sistemas/- `headers.json` 368957ca4ad660d4b59134fb78844bc19e9a466fb04d090e559ba419cc17b29d 623 bytes - `page.html` 2d85fe534c28b399f20a6f9953c176ee1ea036a0dbae60b62b0a9a9fec1cc26f 103,764 bytes - `provenance.json` e044551b114d050bbeb624642a1b11e328fe9aecb95bffd46ed7dc93f3558b52 1,845 bytes - `rendered.html` 3a2788a5c93a734f8d4a540d043eaa4c3c4f07c3b21170ddae43f8b8a8c271cf 424,150 bytes - `screenshot.jpg` 99e5531aeb8dddfbf3fbc93d4fa3605d074a31ed132ab4e9476ceb77618f0edb 493,674 bytes - `text.txt` 974a10fda0668457316ff8ce01e2236748efd7a86c13dbd9a585ed0cea380e77 5,982 bytes ### [AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619](cccs-al26-026/index.html) [original ↗](https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619) **Canadian Centre for Cyber Security (CCCS)** · advisory · primary · captured · published 2026-10-21 · added by `collector-gov` · `cccs-al26-026` Date: October 21, 2026; Date modified 2026-10-21. 'Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.' PoC available; no active exploitation identified. Also AV26-1070 (PHP security advisory), same date. capture 20261022T081700Z · HTTP 200 · https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619- `headers.json` 0db6dd151e1887553a32a56de4d1f6a133645e87d6dbee931f362e8a21a370f3 583 bytes - `page.html` 171c897e4a6fde98e73f9d1e221188dae6d0c04b49e8b6a242fba591739a11c9 39,250 bytes - `provenance.json` 9759aec757d5df865a795a86bf304ffdcc697988c45f47adcc0159a6771a4fa1 1,195 bytes - `rendered.html` d6536d39602e9709a1afb05fb61fad1b88b57a5d1b839a7f5de58c7f3588300c 149,258 bytes - `screenshot.png` 9df75da37b7ed8ceb13b241f71f041d29c9f33055750a65070c6c785bbe9cdd2 538,343 bytes - `text.txt` 9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2 5,403 bytes ### [Alerts and advisories - Canadian Centre for Cyber Security](cccs-alerts/index.html) [original ↗](https://www.cyber.gc.ca/en/alerts-advisories) **CCCS** · government · secondary · captured · published not stated · added by `collector-gov` · `cccs-alerts` Listing page at 08:16Z: AL26-026 and AV26-1070 (PHP), both 2026-10-21. capture 20261022T081604Z · HTTP 200 · https://www.cyber.gc.ca/en/alerts-advisories- `headers.json` 43f213e29f0be568c8c4a231d0404fc7c33db33ea4b6d75c538f505a2a139b88 586 bytes - `page.html` b7e604271809b8579356f2e76d4be26c44d1aa9a92893b73efa23358036ba52e 21,909,500 bytes - `provenance.json` bcff9a25cb070bd8554c2d407548464544b8792a9046b93a670f29e70dc5c6ad 1,026 bytes - `rendered.html` b15a0c243be41ff42e41fd4f94617f75373bce255f915cc57cded297c97ef6a4 50,788,748 bytes - `screenshot.png` 9029e12095ac74977c8777919e317ffd20cc42da26e60903f1964abddab3774d 494,360 bytes - `text.txt` c226b8df2f21a14934c6c79d53fae9685707e4adcca0fcf2d7b6143e296b2000 3,812 bytes ### [CCN-CERT AL 11/26: Actualización inmediata de vulnerabilidad crítica en PHP](ccn-cert-al-11-26/index.html) [original ↗](https://www.ccn-cert.cni.es/es/seguridad-al-dia/alertas-ccn-cert/13200-ccn-cert-al-11-26-actualizacion-inmediata-de-vulnerabilidad-critica-en-php.html) **CCN-CERT (Spain)** · advisory · primary · blocked · published not stated · added by `collector-gov` · `ccn-cert-al-11-26` HTTP 403 bot challenge ('Voight-Kampff Browser Test') to both Playwright and curl; WebFetch also got 403. The URL and title come from ENISA CNW-2026-04. The challenge body is saved in raw/. capture 20261022T081353Z · HTTP 403 · https://www.ccn-cert.cni.es/es/seguridad-al-dia/alertas-ccn-cert/13200-ccn-cert-al-11-26-actualizacion-inmediata-de-vulnerabilidad-critica-en-php.html error: page.title: Execution context was destroyed, most likely because of a navigation- `provenance.json` 3499d3985dcda97902ce1e89dd5edffba4a20b56ba01cab266db1e9fc7f50c36 780 bytes raw, 2 files with SHA256SUMS- `curl-body.20261022T0814Z.html` a3de1982de0d6d2967b7ac55d2787011ba4fdd8707f4a8e9e25e1b50b345d9f7 - `curl-headers.20261022T0814Z.txt` a397cde2f98a7851bb54672621f25f4834926a0250ea5140f65c91110b53d3f8 ### [[핫이슈] PHP 취약점에 전 세계 비상…한국 정부·기업도 긴급 대응](ceomagazine-ko-kr-articles-35216/index.html) [original ↗](https://www.ceomagazine.co.kr/ko-kr/articles/35216) **CEONEWS** · news · secondary · captured · published 2026-10-22T11:22:00+09:00 · added by `curator@php.newsroom` · `ceomagazine-ko-kr-articles-35216` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CEONEWS (Korean), 22 October: worldwide emergency over the PHP flaws, with Korean government and companies responding urgently. It names the two CVEs,... capture 20261023T160435Z · HTTP 200 · https://www.ceomagazine.co.kr/ko-kr/articles/35216- `headers.json` c779eb54fe59848876b5b790632ea484d4267b0af8488774083ad9979103cf70 1,385 bytes - `page.html` e31478992a4049cc40eefb315965619fcf898a73d5137999d9eb869ca8ca1f8f 188,060 bytes - `provenance.json` b86df8f701e328106223bb30e30d39f7714d80c167732064faa86dba7568ca1e 1,462 bytes - `text.txt` 6728c9b31ace994541c817a8bde30579b95ed84a8cd4a5e3d6c4aee4ac5fcdf3 19,547 bytes ### [Security Advisory 2026-018: Critical Vulnerabilities in PHP](certeu-sa-2026-018/index.html) [original ↗](https://cert.europa.eu/publications/security-advisories/2026-018/) **CERT-EU** · advisory · primary · captured · published 2026-10-21 15:20:18 (as stated; timezone not given) · added by `collector-gov` · `certeu-sa-2026-018` v1.0 and v1.1 both 21/10/2026. States the PHP fixes were released '21 October 2026 at 13:30 UTC'. CVSS 9.2 each. Advice: 'patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.' Notes PoCs are circulating. capture 20261022T081329Z · HTTP 200 · https://cert.europa.eu/publications/security-advisories/2026-018/- `headers.json` 035d980d7924b86c61cd912c5ae8e55b5adbdf20e9f99f9c780d7b37e830e596 1,370 bytes - `page.html` 1cc49d8c9b94ac2e09eb5f4e2bcb732a0d1fd4f630eaedad06da28a295978e53 24,504 bytes - `provenance.json` d5c1ea12a493fd9c195d90ee56eba85c93cd77d6131bce3ac08929d72f275820 999 bytes - `rendered.html` abb92e1078d68ea54089f704855e78b2a71cee27a6244c2d3f26cd1b8c90b759 23,744 bytes - `screenshot.png` 894baac8f7c1a2e25439f481a468e1c086cf4c783d11e7f020bb354120ef6c99 624,274 bytes - `text.txt` c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3 7,105 bytes ### [[Màj] Multiples vulnérabilités dans PHP (CERTFR-2026-ALE-014)](certfr-2026-ale-014/index.html) [original ↗](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/) **CERT-FR (ANSSI)** · advisory · primary · captured · published 2026-10-21 · added by `collector-gov` · `certfr-2026-ale-014` First and last version 21 Oct 2026. 'Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue...'. Affected: all 5.x, 6.x, 7.x, 8.0, 8.1, and 8.2-8.5 below the fixed versions. Workarounds: session.upload_progress off; block multipart Content-Type at WAF. capture 20261022T081353Z · HTTP 200 · https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/- `headers.json` 96a5cd42d4ca38099fc910e8c06f10cfd15f15e6ca7bebdb699b3b7245d08d58 1,075 bytes - `page.html` 91f474e2f0f414b2d8575b91cecd59d880e62f0179033baae665177100fc094a 26,782 bytes - `provenance.json` 53ea7bfd63a634427908cc6846e7e974b45c9cdc7028b88d7e87d148408ecd59 989 bytes - `rendered.html` f71933fcd112f86a98d8838cc53fa38dabffe5f27a6c4dc7bfc62f9ef6e9aa7c 27,674 bytes - `screenshot.png` e6ccac8825818ecc2cfd2223035c6c335a3de1c38fad734d7dd292215618cef7 502,064 bytes - `text.txt` f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3 5,127 bytes ### [Saistībā ar globāli atklātām PHP ievainojamībām Latvijā ievieš preventīvus pasākumus](certlv-php-preventive/index.html) [original ↗](https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus) **CERT.LV (Latvia)** · government · primary · captured · published 2026-10-21T18:25 local (EEST, =15:25Z); updated 2026-10-21T23:00 local (=20:00Z) · added by `collector-gov` · `certlv-php-preventive` Latvia restricted access from abroad to several state digital resources (geo-blocking, possibly until Mon 26 Oct). Update 23:00: the TVP unified website platform is patched and reachable from Latvia; latvija.gov.lv is restricted only from abroad; lsm.lv and 112.lv restored. About 6000 potentially affected resources in Latvia, a few hundred of them public sector. Automated exploitation attempts seen, none successful so far. capture 20261022T081354Z · HTTP 200 · https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus- `headers.json` b75279eb611beef16c83a6ab4d307db8ec59d18614d4d21ea1c78320a4346166 737 bytes - `page.html` de622b5e59bf43071dcb45655edbd42b337e97f28b3e41e801ebaacc64a33581 35,634 bytes - `provenance.json` e046187fdaa6dc172317abf6fa62152e1b5594b3c2d59c75c1de1baafa4667ba 1,158 bytes - `rendered.html` 4f3a30ed3f755cd5965265ba1cc6f1cce9e514537463c1f9d2b87fdfceaaf514 35,482 bytes - `screenshot.png` 504fd0c9b36378f8039c94b1157842426c17d95ab822429554c1bfc0cdbfb4d2 750,435 bytes - `text.txt` e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e 6,579 bytes ### [Critical vulnerabilities in PHP: Install security updates immediately](ch-bacs-warnung-php/index.html) [original ↗](https://www.bacs.admin.ch/en/warnung-php-en) **Swiss Federal Office for Cyber Security (BACS / NCSC)** · advisory · primary · captured · published 2026-10-21 · added by `collector-gov` · `ch-bacs-warnung-php` Published on 21 October 2026 (the home page teaser shows 20 October 2026). 'If an immediate update is not possible': restrict access; 'Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.' Says a WAF alone is not sufficient. capture 20261022T081700Z · HTTP 200 · https://www.bacs.admin.ch/en/warnung-php-en- `headers.json` 603765d5dfe2bc360d0d8becb67c71a6a5810ad02fbe68f5d677488189ac7317 6,406 bytes - `page.html` bdef753f8a5972cd0d5af92574637f8edd425df0511ef469bf2c11ee39207e0f 160,186 bytes - `provenance.json` 1574e8470bf5e04e0a830d2ee1ffd4d728872599f3828cba3399f0b095066f39 984 bytes - `rendered.html` 7400fa0917a78b8192f819815d7bddbc76a93e9ddb57e9ce574cb60b713b4e0b 174,883 bytes - `screenshot.png` b14b81a2939d7eafc4abdd581e6591629c66d8728ce4402a2c68421d788a9f63 846,454 bytes - `text.txt` 99886a19aead8abe4faab9f41918c8654a2e070c816f856c0dd3e14a194d6890 4,966 bytes ### [BACS home](ch-ncsc-home/index.html) [original ↗](https://www.ncsc.admin.ch/ncsc/en/home.html) **Swiss BACS** · government · secondary · captured · published not stated · added by `collector-gov` · `ch-ncsc-home` Redirects to bacs.admin.ch/en; the PHP teaser is dated 20 October 2026. capture 20261022T081604Z · HTTP 200 · https://www.bacs.admin.ch/en- `headers.json` 80c563292cf0e8178e58809441cc65504b120a6299d27979fc429c606efaa3fd 6,406 bytes - `page.html` db63fa0b832d6e1c47503189a9e2dd40e5a0dc6e8aab560cae02e8db1f3806f4 683,600 bytes - `provenance.json` a459bb8ebb915fac015c2f06c8c45177516e9c968f132531f1d20fa7053e7c69 923 bytes - `rendered.html` 772da1668f48bd3c5a4f64e05a57da3b25759fb0029663257cdb7ffef85aec1f 739,577 bytes - `screenshot.png` 0aaffb075e051c6b2ad0f9f8261010a963e502b32700d1fc07b0cdee4d9a835e 1,095,138 bytes - `text.txt` 29c1b2cfeb73db9702347d8cbb1b37690641e3abf5ddda16da0af6451f54e41b 11,068 bytes ### [Error 503](ch-unige-down/index.html) [original ↗](https://www.unige.ch/) **unige.ch** · government · primary · captured · published not stated · added by `collector-gov` · `ch-unige-down` A capture of the site itself on 22 October (HTTP 503, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081939Z · HTTP 503 · https://www.unige.ch/- `headers.json` 45d418c6a1e13df367e5e13dfedc3c3513a91092939f89a4eb322a8f42577c36 156 bytes - `page.html` 4588df31ba75c0a04c05e175d37f8cc5a25d23d6db540d28a36f66fec14254f9 19,901 bytes - `provenance.json` a570e18cd6797853524a4a28bb0f07494febd3045de07a5606b05023a7db03ec 874 bytes - `rendered.html` 3454bd4fa582794fc00a7bbbb8c4221bb4538f45a3a4bbeeca936dbc7d14ff23 19,945 bytes - `screenshot.png` 74550933cbe68c3937fb109ad47c67a313c15e0a8a3be3d823cb57aebabb0158 41,360 bytes - `text.txt` 103ffaac2e23754954ddd1bdaa2cc5d9afa05b829ba0fe1ccd4e5c701d982a6c 241 bytes ### [Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat - CNA](channelnewsasia-singapore-php-vulnerabilities-csa-singapore-firms-cybersecur/index.html) [original ↗](https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-singapore-firms-cybersecurity-6482006) **CNA (Channel NewsAsia)** · news · secondary · captured · published 2026-10-22T17:33 SGT (updated 17:44) · added by `curator@php.newsroom` · `channelnewsasia-singapore-php-vulnerabilities-csa-singapore-firms-cybersecur` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Singapore organisations were urged to fix the two flaws immediately amid reports of widespread exploitation attempts; Singapore's Commissioner of Cybersecurity... capture 20261023T080331Z · HTTP 200 · https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-singapore-firms-cybersecurity-6482006- `headers.json` 8b9eb34defa1f7a92ae70f04ef00893f67f20c9c5ac0847ad36cba684751eb53 1,010 bytes - `page.html` 47fe437151a88fb830ab716004bbc274b814571cfda942882c6eff62523e649b 514,707 bytes - `provenance.json` 7b953ae928263f33c60d82149f349775c26ad55588e351467a8be9af338f98ce 1,860 bytes - `rendered.html` 7257b6432a920652edf3485bffc58c39923a1cd8c23dc9053d4e2acf7a4a89d4 1,027,313 bytes - `screenshot.jpg` 4663c4fc897f033817bb0c5d9f267ef54a8db7f664e29411a13f13625d069bb8 453,850 bytes - `text.txt` 099af28ae4a894d5bbbb7d057c8ae2a5ed96744cf3f55cae8539d03725bbf8c8 6,109 bytes capture 20261023T160435Z · HTTP 200 · https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-singapore-firms-cybersecurity-6482006- `headers.json` 0bb7ad8ef4cbac6b1cdfa833cdf94b852e6d4c3fcfab446c1df16630b23b3104 1,011 bytes - `page.html` 3126534b4e5d0523314fc3e36ae96b36e2b0928ebd5cc4fcbbfbec3e181ca990 514,574 bytes - `provenance.json` cefab6ab48b8757dc4417242bf77b9f96de5e9ac581830f1338b90510c9fda1d 2,009 bytes - `rendered.html` fb6bcac9a4d987a74695588fa4ee5ae0481236402f60f556d170a2aa12b62099 1,001,298 bytes - `screenshot.jpg` 7063cfc73094d945916a6694a526b552f8b35dd6b3a7467a7fe65766375bb828 426,765 bytes - `text.txt` 3193ae7b5ea47e45be15b3b6c0b6fefdb430a385e00ee042fab553b4c72034e7 5,853 bytes ### [PHP-Sicherheitslücke erreicht den IT-Channel | ChannelPartner](channelpartner-article-4238964-php-sicherheitslucke-err/index.html) [original ↗](https://www.channelpartner.de/article/4238964/php-sicherheitslucke-erreicht-den-it-channel.html) **ChannelPartner** · news · secondary · captured · published October 22, 2026 · added by `curator@php.newsroom` · `channelpartner-article-4238964-php-sicherheitslucke-err` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ChannelPartner (German), 22 October: the PHP flaw reaches the IT channel. Under the name PHP2Shell, security experts warn of two critical vulnerabilit... capture 20261023T160435Z · HTTP 200 · https://www.channelpartner.de/article/4238964/php-sicherheitslucke-erreicht-den-it-channel.html- `headers.json` 9dc2ba9ae924a4d4fd24350615b83a7026861880f6225aa2222b6bc3936fe496 1,365 bytes - `page.html` 3a8329cd009bbcb389fe7360a6596d9c7ebcac9e6ac0c27729c3ab0960919366 233,286 bytes - `provenance.json` cde296d379918edb7475755086e1f8aaa8faba7d4b79830d507ce4e76ff718dd 1,786 bytes - `rendered.html` 108097c0ba35a08e94e2d1ccfb578e8d1f02ff63b7cba2d5db8db9e38007e81e 361,664 bytes - `screenshot.jpg` 74915907ac8a5159b3d9a6e1f1076ae8314ce3c533079a9d8f356fbf1a620abf 428,542 bytes - `text.txt` a5594d29ad3282b351a3cc2d5f751a5fce27fdc53da947f4c8d00c2055becc91 6,205 bytes ### [PHP 爆出"PHP2Shell"高危漏洞：影响约七成网站，OpenAI 牵头全球协防](chinaz-ainews-31789-shtml/index.html) [original ↗](https://www.chinaz.com/ainews/31789.shtml) **站长之家** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `chinaz-ainews-31789-shtml` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Chinaz (Chinese): the headline says PHP has a high-risk 'PHP2Shell' flaw affecting about 70% of websites, with OpenAI leading a global joint defence.... capture 20261023T160435Z · HTTP 200 · https://www.chinaz.com/ainews/31789.shtml- `headers.json` 2b5b46986c092b5c567af8b518c8c878037ea689cf707d0ada9bc7bb50b6c7ad 498 bytes - `page.html` e8bf6c95ad29c4e4ad01fd162ef0b5bd07e0e65e284d9768361d880d06e53f0a 110,032 bytes - `provenance.json` d5f4df92fadbfbd706371b1d0529af17ea0e10363838fa0260272d2fc3eb0060 1,572 bytes - `rendered.html` e1e82d58b5362dfb11c4149a49b3716f5158942298e52b87c3326a464de74108 150,005 bytes - `screenshot.jpg` 77af3fdeaab31eb407f70dfcb6b61de514a25a319da67367b7c3a47d0b178d62 333,038 bytes - `text.txt` a0e6e63a1fa7ba44995721cf3b357235a3d037ae44aef02b2560b827aa828122 8,310 bytes ### [BSI schlägt Alarm: Zwei PHP-Lücken bedrohen Millionen Webseiten - Betreiber müssen handeln - CHIP](chip-news-wifi-dsl-internet-bsi-schlaegt-alar/index.html) [original ↗](https://www.chip.de/news/wifi-dsl-internet/bsi-schlaegt-alarm-zwei-php-luecken-bedrohen-millionen-webseiten-betreiber-muessen-handeln_a4293cda-dd0c-4ca9-afe9-fcf6e993b0a2.html) **CHIP** · news · secondary · captured · published 2026-10-22T09:32:00+02:00 · added by `curator@php.newsroom` · `chip-news-wifi-dsl-internet-bsi-schlaegt-alar` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CHIP (German), 22 October: the BSI (Germany's federal cyber-security office) sounds the alarm over two PHP flaws that threaten millions of websites; o... capture 20261023T160435Z · HTTP 200 · https://www.chip.de/news/wifi-dsl-internet/bsi-schlaegt-alarm-zwei-php-luecken-bedrohen-millionen-webseiten-betreiber-muessen-handeln_a4293cda-dd0c-4ca9-afe9-fcf6e993b0a2.html- `headers.json` 5dd9d20e326692efc63992f35c5cb573233443d32d18d87deba91a388e01c613 774 bytes - `page.html` 3ca5fdb3f7bc84c4ee1c8ad57534216a4e9249827459694116407f84d51eb29b 156,127 bytes - `provenance.json` 99f41a265d26dc2ae2348b10e8b622f7c8f79cf1044757f08e799af0221c87bb 1,804 bytes - `text.txt` fd2adaf6b44e5ea680447d54969c0315116f536363157d9786cb77ad792782ac 5,558 bytes ### [Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation | CISA](cisa-alert-log4j-2021/index.html) [original ↗](https://www.cisa.gov/news-events/alerts/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce-vulnerability-under-exploitation) **CISA** · government · primary · captured · published 2021-12-10 · added by `claude-story-site` · `cisa-alert-log4j-2021` Historical: CISA's alert on Log4j the day it was published. capture 20261022T113354Z · HTTP 200 · https://www.cisa.gov/news-events/alerts/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce-vulnerability-under-exploitation- `headers.json` 81c7dcf0ae8dbb9db7007301569c1098a3ef6556dd79a9630d630651daa84547 2,869 bytes - `page.html` 96fb8cf20f99673da75e17b169ced8e990ef1852c39832a988ce04901089dd93 52,975 bytes - `provenance.json` 3f51e4f7a62ee09109ff3dc36fcb8369a5ad5cc50b151b08368a863938e9bf91 1,209 bytes - `rendered.html` 5badb6aa92a2948ebfdb3e6213117ffa468b50a21ae447dd975d608df7786007 76,046 bytes - `screenshot.png` 181a9b4f1fb059019f1f42b3d6d7ec914a53307ae7276e8d10637cdd93807b1c 311,343 bytes - `text.txt` 98840739d797dd49ca9582640f9a88007c32812ba8e49d2cc0492e54c138c9e5 2,015 bytes ### [Critical Vulnerabilities in PHP Require Immediate Patching](cisa-alert-php-20261021/index.html) [original ↗](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) **US Cybersecurity and Infrastructure Security Agency (CISA)** · advisory · primary · captured · published 2026-10-21 · added by `collector-gov` · `cisa-alert-php-20261021` CISA Alert, Release Date October 21, 2026. Names CVE-2026-109618/109619 'php2shell'. 'Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.' CISA 'has not observed exploitation ... as of the time of publication'. Not in KEV as of catalog 2026.10.21. capture 20261022T081353Z · HTTP 200 · https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching- `headers.json` 30fb6764c792111ac226e0fb1ca4f574f5e2faadfc10d2150ae9dfa35ea0858d 2,825 bytes - `page.html` be6b410fc0da16de2c1b96dc3132a195632d636467ab7c859c343494fa7accfa 53,868 bytes - `provenance.json` ea18f4dbc502d3c87b5d9a6c83d49ff128544ad074140c502f37abff350d9f8a 1,110 bytes - `rendered.html` 0e3e08492a52d48e8ccb18f836df984af4f15f251f6089697676b540458b3371 78,116 bytes - `screenshot.png` 2724e9107ccae45a888b3531fdc43373b154be3eeadb78841791dcb6a60a34c1 384,239 bytes - `text.txt` 7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f 3,223 bytes ### [Page Not Found | CISA](cisa-ed-22-02-log4j/index.html) [original ↗](https://www.cisa.gov/news-events/directives/ed-22-02-mitigate-apache-log4j-vulnerability) **CISA** · government · primary · captured · published 2021-12-17 · added by `claude-story-site` · `cisa-ed-22-02-log4j` Historical: Emergency Directive 22-02 on Log4j. capture 20261022T113402Z · HTTP 404 · https://www.cisa.gov/news-events/directives/ed-22-02-mitigate-apache-log4j-vulnerability- `headers.json` 1b3806dec260fe8e3a777ba86f9ee746b6edd19e249375bf255f7a5d9697921a 2,712 bytes - `page.html` 601f61af5acf4d62056f2376b007d492c9f77dbc84557f9ea9f9f4a7834691da 47,323 bytes - `provenance.json` bdfcae4f97b12f4551a9070ae19917243e91048c4e13feb7fb06f939368c8d1c 1,026 bytes - `rendered.html` 4e45e69f1aa1a5d929a2896dce31b78f23be1bbfd88195b6030c0e1a5b7761e5 66,546 bytes - `screenshot.png` d0899ef76fbd637495baf797c91303c02eaf04c8f12bdfafa20265b9052fe302 186,488 bytes - `text.txt` 74b20e7dc5b8d12bb09978a2b9ab15941b343248ce65584eb76548fd8b68b0d2 1,035 bytes ### [Home Page | CISA](cisa-home/index.html) [original ↗](https://www.cisa.gov/) **CISA** · government · secondary · captured · published not stated · added by `collector-gov` · `cisa-home` Home page at 08:13Z: the PHP alert (Oct 21, 2026) is top of the news list. No emergency directive is shown. capture 20261022T081329Z · HTTP 200 · https://www.cisa.gov/- `headers.json` a76ca34b24fba67b623a4b3e4b5748241af7aac12f07bb31b73a1f88445398b2 2,712 bytes - `page.html` 24ba8c3fe3e00e4445bd9fbbbabf113099d53e872bb4d594e92c8575084cfe31 71,972 bytes - `provenance.json` 364cc06b578cd41d9fc3e1155cd62c9694ca854bdfe27923863a3a00eb71ee53 877 bytes - `rendered.html` 06fa4013f8e36ab399d6cef932f7d506a073b84357e4e4c40627479b5a3a1fa5 92,635 bytes - `screenshot.png` ed352cf8665d21d75d282faefdb680a9c65965edae9b6cbf4541c84f9dcbba23 1,291,590 bytes - `text.txt` ab2aa07bb46ba14c14a2f76a312ff7b81e2c8c19ca3588de9313236b10007a34 4,261 bytes ### [Known Exploited Vulnerabilities Catalog (JSON feed)](cisa-kev-catalog/index.html) [original ↗](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) **CISA** · government · primary · captured · published 2026-10-21T14:04:39Z · added by `collector-primary` · `cisa-kev-catalog` raw/ only (JSON feed). catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39Z. Neither CVE-2026-109618 nor CVE-2026-109619 is listed as of fetch ~08:12Z on 22 Oct. raw, 1 files with SHA256SUMS- `known_exploited_vulnerabilities.json` ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b ### [CISA Known Exploited Vulnerabilities catalog (JSON feed)](cisa-kev-json/index.html) [original ↗](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) **CISA** · advisory · primary · captured · published 2026-10-21T14:04:39Z (catalogVersion 2026.10.21) · added by `collector-gov` · `cisa-kev-json` At 08:15Z on 22 Oct: catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39.8983Z, 1754 entries. CVE-2026-109618/109619 NOT in KEV. Raw JSON + headers + SHA256SUMS in raw/. raw, 2 files with SHA256SUMS- `headers.20261022T0816Z.txt` e3a7dc7610f87ca2b7829303cd01ef65a3d0d08be833334024807456cc943db9 - `known_exploited_vulnerabilities.20261022T0816Z.json` ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b ### [Vulnerabilities in PHP Affecting Cisco Products: October 2026](cisco-sa-php-october26/index.html) [original ↗](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq) **Cisco** · vendor · primary · captured · published not stated · added by `curator@php.newsroom` · `cisco-sa-php-october26` Promoted from the source watch (oq9gflln), snapshot 20261022T191727Z. Cisco investigation and product status (primary) capture 20261022T191727Z · HTTP 200 · https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq- `headers.json` 9284c87155511b2c471216e2096bb1e32f5357928e3cd57fc8d43df4a07370bb 2,545 bytes - `page.html` d5ac143be2171987bc719cac0f05a076fabe7a2d7943168014ff0d7ee05000d4 228,863 bytes - `provenance.json` 5723badb3711c11909083e6771ff8d1b43cf871797a07e8ba2b3784f6c0e2dbd 1,694 bytes - `rendered.html` 1cd58949d6a33eb4802ef0dbff15bd15ce7471bccfba710d79c9c5b9fca98b50 886,276 bytes - `screenshot.jpg` 817ee2282f96dd868da4716cb46c821f57699aded67586674bbaf16363355b97 396,794 bytes - `text.txt` a8149d16b8912fdf12a0d16895c2c484226ca5744e048033c39c1f8d8d1e9cdb 7,868 bytes ### [PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet](clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv/index.html) [original ↗](https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html) **Clarin (English edition)** · news · secondary · captured · published 2026-10-22T13:38 · added by `curator@php.newsroom` · `clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). An explainer: says GPT-5.6 Sol and Gemini 4 Argon uncovered the two flaws, calls it a 14-year-old flaw behind 70% of the internet, and describes government port... capture 20261023T080331Z · HTTP 200 · https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html- `headers.json` cd6b6aca27fd9b5ce029c92362dcfac6916560f42aa088e5feb9460625f7e32c 1,002 bytes - `page.html` b6e1695896fd63cd4b6f47aacb38c4e055346265c4aa327c9966eeaea8d4f9ea 310,116 bytes - `provenance.json` 104cea664352abd14c008254d3d2eb0966a9edaaa0d656deda3fdea6c301b9a6 1,846 bytes - `rendered.html` 42fab97cc7a7b08095ba8b783499fd89abc555bf82a764902d03235d313801f1 322,974 bytes - `text.txt` c11dd717273bac9546aaf433f103637af20d579a0fb1ba06943929d81a70e82d 11,484 bytes capture 20261023T160435Z · HTTP 200 · https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html- `headers.json` 1ed2c706aa0cf8e540f252ccb062a8c22ac0c29bc27cabbe51567449b510361d 1,004 bytes - `page.html` fb183bc9518a6532811c98a4a5e5fea0df058fd92b4cdfed88bbb7712ccf7ef3 310,116 bytes - `provenance.json` 17c4c74191d706a3f7a113c99cb4c3f6ed8e99ac8a6276af6f81bd55351b7a4a 2,073 bytes - `rendered.html` 9e45a8a7d379a8d9bea687b64466511b0845402a297bbc0959b59f44f8407e27 322,371 bytes - `screenshot.jpg` 4ab9356d8a1fa03b9cbb4e08ffdd9bc7c7b5e42538fecc08a226fe67e6ad57f3 930,810 bytes - `text.txt` 1afdd74e14120ea72e68bb67d88654c35a42cb69f4700c4015260d0f61ea2c1c 11,512 bytes ### [Des failles PHP critiques menacent les sites web du monde entier : DPG Media et les pouvoirs publics mettent leurs sites hors ligne | Clickx](clickx-fr-actualites-200877-des-failles-php-critiques-menace/index.html) [original ↗](https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/) **www.clickx.be** · news · secondary · captured · published 2026-10-21T12:31:18+00:00 · added by `curator@php.newsroom` · `clickx-fr-actualites-200877-des-failles-php-critiques-menace` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 4 new items in fr: Clickx reports that DPG Media and public authorities took sites offline. It names DPG Media's Tweakers and RTL Nieuws, Belgium's Smartschool, and Dutch government sites. Belgium's CCB had seen no attacks on Belgian sites capture 20261022T181608Z · HTTP 200 · https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/- `headers.json` 6b45cddbbf163b39958bc4b5094d18b3ce21d4e63996f705a5226ba95e34e3af 1,189 bytes - `page.html` 0951c9c98dafd8cf5331802051ebb7efc8813177268131e37991aca794a95627 260,560 bytes - `provenance.json` ba8bf19e634d1001aa5abfddd06f26d51d7de6e0aa8d96e8f84b1adaa4afef32 2,005 bytes - `rendered.html` b997e23ea15f293a1a587e7c9fc7442b2bc1045a3289bc04fa6f9dbe0b7531c4 338,306 bytes - `screenshot.jpg` 0f5569538118bb4b241b1f0e55b95d57301cea54e6500ec232837d0d7b8ce0fa 522,688 bytes - `text.txt` f1876f8dd43053e0c0b3e106e9409256b3487f7228617f8e2abf7aca5e6c053d 6,290 bytes ### [Cloudflare deploys protections against php2shell vulnerability](cloudflare-blog-php2shell-waf/index.html) [original ↗](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/) **Cloudflare** · vendor · primary · captured · published 2026-10-21 · added by `collector-researchers` · `cloudflare-blog-php2shell-waf` Dated OCTOBER 21, 2026. Says the vulnerability 'was leaked before the official release date and we observed attack traffic targeting our customers'. WAF protection live from Oct 21 03:02 UTC (~9h before disclosure). Lists disclosers as 'Calif.io, Wiz, OpenAI and Quarkslab'. 'PHP is used by almost 70% of websites.' capture 20261022T081216Z · HTTP 200 · https://blog.cloudflare.com/php-vulnerabilities-waf-protection/- `headers.json` 904849b322ddad92fccc55d4ce8527d9c4138d07d61937ce1da5602ea2bef244 7,260 bytes - `page.html` 421005107f81d30d16850fdbf830446d6fd544746dfa7d201be9b4bd3f656e72 301,730 bytes - `provenance.json` 7f98162527014e2989dfaa73146a26c079c634ddf24eff95ae99fad7ea43beb0 1,045 bytes - `rendered.html` a0d3c37cde7c1721a08b028748a412672817c45958d05cc7fedaede582b5537b 373,881 bytes - `screenshot.png` 1784904e6fdda092941881d0e5c85d73801054f216295ca43b17f76e7f5cd34b 989,488 bytes - `text.txt` 302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823 10,205 bytes capture 20261023T160435Z · HTTP 200 · https://blog.cloudflare.com/php-vulnerabilities-waf-protection/- `headers.json` c8d1046d5e15ec072fa3f8200f1b2e9345d25f2fa5c1ce0a5d50de4bc57c2434 7,335 bytes - `page.html` 172e5df835d69af6d6694fe84442639f792a58b8925a1408e8d68921824a7d97 306,061 bytes - `provenance.json` b55c9fe97424debdba98dc1c1dca272d72f5ad2ff601542c5dfaa934de7ce34e 1,798 bytes - `rendered.html` 9375a77287688e3c1d8718c25ce857c25caf62db2c3630e19d21da1c5bf24c48 373,128 bytes - `screenshot.jpg` 16e9126356ed130c33ba0896333af9953971a4c4a4b31ad6f4823d6590d4d895 639,665 bytes - `text.txt` 94476de6ec0b31e035ef97a1dbf9607bc81e7ddbb479c2d5217b8e8b0207ec02 11,328 bytes ### [PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection](cloudlinux-wikipedia-ref-17-php-cve-2026-109618-and/index.html) [original ↗](https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/) **CloudLinux** · news · secondary · captured · published 2026-10-21T10:28:34+00:00 · added by `curator@php.newsroom` · `cloudlinux-wikipedia-ref-17-php-cve-2026-109618-and` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CloudLinux blog, 21 October, updated after the fixes: PHP CVE-2026-109618 and CVE-2026-109619, CloudLinux package status and Imunify360 protection. It... capture 20261025T114552Z · HTTP 200 · https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619- `headers.json` 53dda7d8fe42cc34e04c046fe89c65c2e513762c0cbc6a54a23a132a50733197 1,462 bytes - `page.html` 8baf713eabc8d20f7658385113ab92e59b0053d57812a3906103c4478e262dbd 537,483 bytes - `provenance.json` 886c818a9ba34776eaa509b8312171b635dce945c243c0c03e23bdd36d5fde4c 1,741 bytes - `rendered.html` fa0ad6a66a6b3d6928bb6cbeaf281ef0e7ea32228acd4971a5eb2fea505f5d63 1,239,182 bytes - `screenshot.jpg` d8d459d73952515f259844cfdfe4163110f9c0d1db8362e48a5379f7585b4c58 774,928 bytes - `text.txt` 7b6cc3009fb6ee2e90456e46675809cd7bd3c1c8a9c41dea283e77656fa12bfc 24,117 bytes ### [Deux failles critiques menacent des millions de sites PHP, une mise à jour d’urgence arrive ce mercredi après-midi](clubic-actualite-635179-deux-failles-critiques/index.html) [original ↗](https://www.clubic.com/actualite-635179-deux-failles-critiques-menacent-des-millions-de-sites-php-une-mise-a-jour-d-urgence-arrive-ce-mercredi-apres-midi.html) **Clubic** · news · secondary · captured · published 2026-10-21T09:31:00+02:00 · added by `curator@php.newsroom` · `clubic-actualite-635179-deux-failles-critiques` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Clubic (French), 21 October morning, before the patches: two critical flaws threaten millions of PHP sites and an emergency update was due that Wednes... capture 20261024T083755Z · HTTP 200 · https://www.clubic.com/actualite-635179-deux-failles-critiques-menacent-des-millions-de-sites-php-une-mise-a-jour-d-urgence-arrive-ce-mercredi-apres-midi.html- `headers.json` 68db3b6b764b35a903ba82540af4702ff624d070b7e0723db4dfd9ab6c7115c8 1,719 bytes - `page.html` 7bf62bca66711fcbc9275b3eb344c68e4aa0235065f8ddc9ebd822a785d7d260 557,505 bytes - `provenance.json` 0894c076bd542d79a8a4faff959ca7d101beeeddd362799395d687896e39f73e 1,793 bytes - `text.txt` b134c1a3bfa65288771be5f10ec50b6f407d5683e21a3b7a2f18df9b971b7de3 8,059 bytes ### [Patch PHP2Shell Sudah Terbit, Ini Versi Aman dan Cara Update](cnbcindonesia-tech-20261022094711-37-778474-patch-php2/index.html) [original ↗](https://www.cnbcindonesia.com/tech/20261022094711-37-778474/patch-php2shell-sudah-terbit-ini-versi-aman-dan-cara-update) **CNBC Indonesia** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `cnbcindonesia-tech-20261022094711-37-778474-patch-php2` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CNBC Indonesia, 22 October: the PHP developers officially released emergency security updates for PHP2Shell, which lets attackers run malicious code r... capture 20261023T160435Z · HTTP 200 · https://www.cnbcindonesia.com/tech/20261022094711-37-778474/patch-php2shell-sudah-terbit-ini-versi-aman-dan-cara-update- `headers.json` a03f42b67d1f9de9b63249cf584d974139cc745c4753f0b018d30dfd82025f68 812 bytes - `page.html` 0e97d4d5e97802b7fefe61bbacb5aff445585c9aa8c682ef972b6d6b4afe7920 142,071 bytes - `provenance.json` 665aa8630628423749802d46715182c544290702fc9fb2e3162174dd25da894c 1,828 bytes - `rendered.html` 6171c9538a527d8c93c7e9b36fcd72d05cb893c6d0e4b32313942a82ff8d2bed 168,395 bytes - `screenshot.jpg` 5bee30e0fb5998156a8357c9c69e6e4f4ab51e6b1daea2a872fcaccdb85175a3 430,542 bytes - `text.txt` 806fdcd92e6eab96304c63f573ee63d5b41bc527f98bfa1e964115a7cb59075e 4,854 bytes ### [India ranks 11th among 18 countries most affected by PHP2Shell attacks: Check Point Research - CNBC TV18](cnbctv18-technology-india-ranks-11th-among-18-cou/index.html) [original ↗](https://www.cnbctv18.com/technology/india-ranks-11th-among-18-countries-most-affected-by-php2shell-attacks-check-point-research-20018171.htm) **CNBCTV18** · news · secondary · captured · published 2026-10-23T17:07:51+05:30 · added by `curator@php.newsroom` · `cnbctv18-technology-india-ranks-11th-among-18-cou` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CNBC TV18, 23 October: India ranks 11th among the 18 countries most affected by PHP2Shell attacks, with an impact rate of 14% against a global average... capture 20261023T232528Z · HTTP 200 · https://www.cnbctv18.com/technology/india-ranks-11th-among-18-countries-most-affected-by-php2shell-attacks-check-point-research-20018171.htm- `headers.json` 77a2d23ca5230222d50a353845c0b51872f4808a4a64f86ae451268160371716 679 bytes - `page.html` 781101a1cce80287676f704fc91e5c0fd893519539a82569b5dcfad2e569658c 414,473 bytes - `provenance.json` efe83e6a5452f105f238c4df280470599ab64170df8bb6d89318a2794fe3ece6 1,898 bytes - `rendered.html` 5e37fd361dcb088b5d02b77fdea5042f8d7d7cd35e0751e1c071195915a12e4f 418,961 bytes - `screenshot.jpg` 9df20f14f1ed1c0014d84177a007fd7fc9a85b1ee09b999b555ee10606fdb817 336,097 bytes - `text.txt` c587144444f75d076e75cdc9ef7fc34b4c5bf7b1d857bc691422f5a94a29262f 5,254 bytes ### [Alerta de Vulnerabilidade PHP (CNCS)](cncs-pt-alerta-136114/index.html) [original ↗](https://dyn.cncs.gov.pt/pt/alerta-detalhe/art/136114/alerta-de-vulnerabilidade-php) **CNCS (Portugal)** · advisory · primary · blocked · published not stated · added by `collector-gov` · `cncs-pt-alerta-136114` HTTP 513 'Verifying your browser | DiamWall' challenge to Playwright; curl got a 167-byte stub; WebFetch got a redirect loop. The URL comes from ENISA CNW-2026-04. capture 20261022T081354Z · HTTP 513 · https://dyn.cncs.gov.pt/pt/alerta-detalhe/art/136114/alerta-de-vulnerabilidade-php- `headers.json` 5c140f9296dcaee3311e6857332cd02f3ecef21ddea2f8e064632238f0723a07 411 bytes - `page.html` edb193e6b70aacbf1578ad062b6fa5085bfef2f34cbf0fd97aa924338c502db7 1,083 bytes - `provenance.json` e1e0d3e656a7c6ebfab6919cf39d5574b3af7346b5b2a843039c2dbcb844b2e9 1,028 bytes - `rendered.html` ee72ee19cc622226439df3668a6e44283b40bf5c8a256279d4ca08a5381fe4ad 1,094 bytes - `screenshot.png` 5950f00ba8371e122d55c0b80325546131c084d32f70aed1fdf1bafdbf9f5d27 39,887 bytes - `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes raw, 2 files with SHA256SUMS- `curl-body.20261022T0814Z.html` 9171fe017af37f1f055d8e8bac037fc72bf67dd77e534de433be05297a582b0f - `curl-headers.20261022T0814Z.txt` b246a0bf67a34295b2bb54fc5724574f6176d92a46b05886076810bacd9a7e6c ### [PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet | CNN Business](cnn-php2shell-ai/index.html) [original ↗](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai) **cnn.com** · news · secondary · captured · published not stated · added by `collector-news` · `cnn-php2shell-ai` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T080952Z · HTTP 200 · https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai- `headers.json` b64d36e94223282247e008d1c8fac9c008a3af688e0aec349909e67073a0f99b 2,395 bytes - `page.html` d6d531efb9e3232aec5c2c74cdb854c9b4be45356e8b187001490e9ba5ed6a18 5,605,787 bytes - `provenance.json` 726278ecd313e258d9f1e8278775af8f14c75e895d2c4632e288314cdff80131 1,045 bytes - `rendered.html` 66701f20de23dd4e5c1a9b4ddc55f38cff8552185314c84015ae9af8feb284ba 5,827,372 bytes - `screenshot.png` 2facb080dde6129efd10472048d29104b0b5321b0e43f755895240f244f8e398 144,239 bytes - `text.txt` 81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef 6,595 bytes capture 20261023T160435Z · HTTP 200 · https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl- `headers.json` 7c2747376cb0c0381d9addb9870dba346922465a3626917c238b856a7be70588 2,138 bytes - `page.html` 099addc537b8cb5b4bc419ae9f5ee485637e74e1d4dfab1b0e211af4dfa03b95 5,628,991 bytes - `provenance.json` 3494486a674e1c999ddd96dd28b26623fca127e4e0f671adbae585566465570f 1,645 bytes - `screenshot.jpg` 4320a253df2bf1065952ccd1485b32cd9dc34da3e0f490f53a4b8aaeb8b847f4 115,790 bytes - `text.txt` 4933a8479ff293ef0e78e573b1da82e55f0a0c9d684b06ddcfdffb8e5f3aca79 10,376 bytes ### [Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business](cnn-php2shell-websites-shut/index.html) [original ↗](https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl) **CNN** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `cnn-php2shell-websites-shut` Wikimedia Foundation to CNN: systems 'taken down as a precautionary measure'; '70% of the internet' in the headline. capture 20261022T112616Z · HTTP 200 · https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl- `headers.json` ff524b7f55b3e2e8e2a9abaa229a6d5694a59dcdb7346d04d4e47af17c87dc26 2,363 bytes - `page.html` e194020ee0611e31ea5feb275ff76e19b40e03b3a1680e8e7e6ae37b1cdef60e 5,623,694 bytes - `provenance.json` d46dfcb30fd93dcb98e4468deabbc7c3b555698dc2bcba8c6cbc81fea8306682 1,074 bytes - `rendered.html` 9928b7deeb656b8f9d34f7844cf0e79c2e5a9ea2b05721c03e84a0bc404646d8 5,844,671 bytes - `screenshot.png` a531b130b77be1e05bf3c9896abfc3abc4a70cc920a819eee04f7665c1a438e9 161,563 bytes - `text.txt` ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533 8,896 bytes capture 20261023T160435Z · HTTP 200 · https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl- `headers.json` 0a15aa96ae1cd6a3e1ca76543aaf7e6b776d0917080f6156b09d8ab1dd3c0d1f 2,399 bytes - `page.html` 099addc537b8cb5b4bc419ae9f5ee485637e74e1d4dfab1b0e211af4dfa03b95 5,628,991 bytes - `provenance.json` a0660d4ec26bb94384c8c7040ba159e683a70473440d042063b47706e142ee22 1,694 bytes - `screenshot.jpg` 4320a253df2bf1065952ccd1485b32cd9dc34da3e0f490f53a4b8aaeb8b847f4 115,790 bytes - `text.txt` 4933a8479ff293ef0e78e573b1da82e55f0a0c9d684b06ddcfdffb8e5f3aca79 10,376 bytes ### [Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet | CNN Business](cnn-wikipedia-ref-39-26-10-21-tech-php2shell/index.html) [original ↗](https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai) **CNN** · news · secondary · captured · published 2026-10-21T16:36:24.575Z · added by `curator@php.newsroom` · `cnn-wikipedia-ref-39-26-10-21-tech-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CNN Business, 21 October: websites shut down globally after AI finds a cybersecurity flaw affecting 70% of the internet. The bugs, called PHP2Shell, c... capture 20261025T114552Z · HTTP 200 · https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl- `headers.json` 0b04de527526c29dede8b3e419aabe004ab47d1e4fbb73df14def674506605ba 2,143 bytes - `page.html` 60dc9ede83ee686710fad90791a701e79fde161de4315e1b149e78dd0b7657b0 5,757,686 bytes - `provenance.json` 4c48c73a188874ea2aecf6bddece083efe3f9a82ff140509577c679a21cc7857 1,649 bytes - `screenshot.jpg` 990799d3fdae97509e76787a27e1b71c1037a1966315710c966455640f5ca1ce 113,005 bytes - `text.txt` 49e4e143c4e7e878c3899ca0ecf1ccc4b95011aee8128f2c7c77968023c89c9a 10,185 bytes ### ["Um dos incidentes mais impactantes da memória recente": o que se está a passar na Internet? - CNN Portugal](cnnportugal-php/index.html) [original ↗](https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2) **cnnportugal.iol.pt** · news · secondary · captured · published not stated · added by `collector-news` · `cnnportugal-php` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081548Z · HTTP 200 · https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2- `headers.json` cd1f9101b255c06dcc65efa8a462262b0124e12dc78a4212e714e6f672957362 697 bytes - `page.html` aabf9d1f6cb549ab9ef2affb4395b9e57fa37ef017602b4c3499aeb56e38f613 124,957 bytes - `provenance.json` 2ab5eab908ae48f5311002b82ca343698ee994d045b30704d96111f99861d2e7 1,260 bytes - `rendered.html` 881042229ef5a6897b016fce3e1a7bada7056865f7e3ebc594d760aeaf0059e0 1,315,826 bytes - `screenshot.png` eb0fe8e63035865baa90a43ca5d367188e4d539217ac94e8c1f0daf65bf92ef6 1,325,277 bytes - `text.txt` de3c730717888f1395fbb1acc2b293846e9b0bf90bc7104fec23d64aad5886c2 9,295 bytes ### [PHP2Shell : deux failles critiques PHP corrigées en urgence](coinacademy-actu-php-php2shell-frailles-critiques-ur/index.html) [original ↗](https://coinacademy.fr/actu/php-php2shell-frailles-critiques-urgence/) **Coin Academy** · news · secondary · captured · published 2026-10-21T11:50:03+00:00 · added by `curator@php.newsroom` · `coinacademy-actu-php-php2shell-frailles-critiques-ur` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Coin Academy (French), 21 October, before the patches: two critical PHP flaws and an emergency fix expected that Wednesday. It says watchTowr's resear... capture 20261023T160435Z · HTTP 200 · https://coinacademy.fr/actu/php-php2shell-frailles-critiques-urgence/- `headers.json` f7d2e3ac2dd840128ed5ac087cb883eed0305cf54399ba5730ecfd6fe03f47f6 1,302 bytes - `page.html` dd0fcdb37cecd2a25cde8e35e00890e9e8bf44c1eb0a6651eb3472da95d72ec0 880,640 bytes - `provenance.json` cec84f837e7f9ffcbd6b4257e30ded7d95dcbf019f2b804736fa0d334fa6ea06 1,693 bytes - `rendered.html` 04c86ac9d1ae9067533f91ee80390adc27589e92b585c8b914b3ab745c11c2d3 898,783 bytes - `screenshot.jpg` e1eaea9582fee9ad2fd66b215fcb060bf25dd0da69b95abe6b67392254b5f7fd 816,782 bytes - `text.txt` 2592cf0c08c277858d6cda3b50a31cb0087cb8d01865f60b2ca7815ba8a1e712 11,647 bytes ### [Crypto Firms Say They Don't Use PHP After Critical PHP2Shell Flaw](coingape-crypto-firms-say-they-dont-use-php-after/index.html) [original ↗](https://coingape.com/crypto-firms-say-they-dont-use-php-after-critical-php2shell-flaw/) **Coingape** · news · secondary · captured · published 2026-10-22T07:28:25+00:00 · added by `curator@php.newsroom` · `coingape-crypto-firms-say-they-dont-use-php-after` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Coingape: crypto firms say they do not use PHP after the PHP2Shell flaws. Restates the two flaws, both CVSS 9.2, enabling unauthenticated remote code... capture 20261023T160435Z · HTTP 200 · https://coingape.com/crypto-firms-say-they-dont-use-php-after-critical-php2shell-flaw/- `headers.json` 353041bd4fd246901fb76a7f9f080af1a20bff4c1e995d3b32d46e98b5acbf96 1,330 bytes - `page.html` bc64442be7ca302222fe2a56fd811773acecb04e6e37b90f8143f927df31a16f 553,890 bytes - `provenance.json` 5ac2040b7561f6b81ca289b871372d07a1aa191f128c51e36488f638dad5baeb 1,751 bytes - `rendered.html` 48b5d859a142b0df61e59728e28241959377deba6af79b6d8446fc0d0721b6ab 554,246 bytes - `screenshot.jpg` 76c34316883ebd06ef09131a6a4559514539fdd370a24de939c5c8392adc569a 664,467 bytes - `text.txt` caf9bd5b4fba62c2775e1430af753a4fe91fd04c547a397f4ccc45243a741e56 10,461 bytes ### [PHP Flags Third Unpatched Flaw As Attacks On PHP2Shell Bugs Reach Millions](coinpedia-crypto-live-news-php-flags-third-unpatch/index.html) [original ↗](https://coinpedia.org/crypto-live-news/php-flags-third-unpatched-flaw-as-attacks-on-php2shell-bugs-reach-millions/) **Coinpedia** · news · secondary · captured · published 2026-10-23T17:22:39+00:00 · added by `curator@php.newsroom` · `coinpedia-crypto-live-news-php-flags-third-unpatch` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Coinpedia, 23 October: PHP disclosed a new server vulnerability, CVE-2026-115560, two days after the emergency patches. It can allow attackers to take... capture 20261024T083755Z · HTTP 200 · https://coinpedia.org/crypto-live-news/php-flags-third-unpatched-flaw-as-attacks-on-php2shell-bugs-reach-millions/- `headers.json` 5165630c672323948c7b933895623d6ad08a2a462ac3c171d06d8f582e3cd472 9,727 bytes - `page.html` dd5884ae83bebd270bf5a07cb725166e54d365afb706889f372f82aa084635ce 712,775 bytes - `provenance.json` 4c8161c8d6dc6572c4e2e570793ce5cdd174267500604592919577a41f76751b 1,819 bytes - `rendered.html` 3bf7504b0903f1b512d837671e3a8aad6b0a2f0821d283246a3d8a68f7baab24 713,636 bytes - `screenshot.jpg` b4408b7bedeeaeac4b7fab0e05fc9ce3b95dbbd979dceb3479ab3e25b6eea4c9 214,125 bytes - `text.txt` c8f2ffd9650a73aecce66b34f389460d77edd8626d5c9c008d20e09da9da8c6a 3,047 bytes ### [Fundação PHP admite que “falha estrutural” atrasou correção de segurança](cointelegraph-news-php-foundation-admits-structural-failure/index.html) [original ↗](https://cointelegraph.com.br/news/php-foundation-admits-structural-failure-delayed-critical-security-fix) **Cointelegraph Brasil** · news · secondary · captured · published 2026-10-22T00:44:00.287Z · added by `curator@php.newsroom` · `cointelegraph-news-php-foundation-admits-structural-failure` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: Cointelegraph Brasil covers the PHP Foundation's admission that a 'structural failure' delayed the fix, and the worldwide shutdowns. It adds Australia's ASD, Japan's prime minister, crypto-sector exposure data from SlowM capture 20261022T181608Z · HTTP 200 · https://cointelegraph.com.br/news/php-foundation-admits-structural-failure-delayed-critical-security-fix- `headers.json` 3056212e7d04339b43bd6477a993570d2e60bf22ba49c163f940e537aafd1cc3 2,690 bytes - `page.html` dbd36c7e29a293dae189773f136e4c767c33d3bc4eb4a2b07d8eb4947bfb3f0c 166,544 bytes - `provenance.json` ac3ba91b53d7b7cd66dc956319982ac0302cdd97b93467378eec92826cc8c03c 1,823 bytes - `rendered.html` 3454035f5d3ffc1ce0a21a17266aab9c354cc5635b4b2d0156f8f93e4a426120 167,236 bytes - `screenshot.jpg` d838e687904086ebdf85e3aeb96963af9de712cbffaec80e02bf950b73eb5c5b 534,711 bytes - `text.txt` 67d4e56887747e5353ee3c1417bdeba7fe00233e7aab9b158c69d6e2123296bb 8,169 bytes ### [Kritiek PHP-lek zet miljoenen websites onder druk - Computable.be](computable-2026-10-21-kritiek-php-lek-zet-miljoenen/index.html) [original ↗](https://www.computable.be/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/) **Computable.be** · news · secondary · captured · published 2026-10-21T12:55:03+02:00 · added by `curator@php.newsroom` · `computable-2026-10-21-kritiek-php-lek-zet-miljoenen` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Computable.be (Dutch, Belgium), 21 October: the PHP Foundation issued emergency updates for two critical flaws after information leaked early; the sam... capture 20261023T160435Z · HTTP 200 · https://www.computable.be/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/- `headers.json` 34156009844095dbb666778b36617f7e81997aad150f05485560be6b0487541c 490 bytes - `page.html` 23da22969d92e0065044269841649fedbe583ed84907b2461ece8284bfd55bfd 651,006 bytes - `provenance.json` 5d71cfec76deeb92794802da19c82034da2a750429cf2ba22d101d47a830ccf9 1,759 bytes - `rendered.html` 7fe568d561bee11e0699a4133ada518991e68e750d8a764628388c2d8cc24b98 966,959 bytes - `screenshot.jpg` 695fd4771a82671081c4b5e5035b28236559fce403a2ce8ee53a0a25010ee62c 318,021 bytes - `text.txt` 179da944caa48e3c05c4639f3b3d6ee372a0ea814c069b2f7edfaef38824e74b 5,301 bytes ### [Kritiek PHP-lek zet miljoenen websites onder druk - Computable.nl](computable-2026-10-21-kritiek-php-lek-zet-miljoenen-20261023/index.html) [original ↗](https://www.computable.nl/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/) **Computable.nl** · news · secondary · captured · published 2026-10-21T12:50:05+02:00 · added by `curator@php.newsroom` · `computable-2026-10-21-kritiek-php-lek-zet-miljoenen-20261023` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Computable.nl (Dutch), 21 October: the PHP Foundation issued emergency updates for two critical flaws after information leaked early; both are rated 9... capture 20261023T160435Z · HTTP 200 · https://www.computable.nl/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/- `headers.json` e1a1100482c1177dd71cec6f1c68bd814c7ca292b74e6620509f0c21d394785e 568 bytes - `page.html` a01d22f30899d0bde83861403ecd6748daf017c9e84dba71af7c0cf57ae6afc1 666,172 bytes - `provenance.json` 973da6c2aea04ce0e809d3e960c74674fdaffcdad7d9cc5fece43bc9d5d85298 1,770 bytes - `rendered.html` da697c76c8883eeee5f4338c844d0b5e327d01c92653ef480ab1a90a9b1d4a88 982,175 bytes - `screenshot.jpg` c121e11653edfb64d162eabd03c8e93dbecc6dbce12a37b6036269c9582d79b0 449,159 bytes - `text.txt` 8af27b7e9cb1bf890cb08815bdc8e3b9f6db146f01fac7dd2d084bc6c6428532 6,486 bytes ### [Qué es PHP y PHP2Shell, cuál es el papel de la IA en todo esto y cuánto tiempo tardará en solucionarse una de las mayores crisis de seguridad en la historia de internet](computerhoy-20minutos-ciberseguridad-que-es-php-php2shell-cual/index.html) [original ↗](https://computerhoy.20minutos.es/ciberseguridad/que-es-php-php2shell-cual-es-papel-ia-todo-esto-cuanto-tiempo-tardara-solucionarse-una-las-mayores-crisis-seguridad-historia-internet_7051873_0.html) **computerhoy.20minutos** · news · secondary · captured · published 2026-10-22T12:02:19+02:00 · added by `curator@php.newsroom` · `computerhoy-20minutos-ciberseguridad-que-es-php-php2shell-cual` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Computer Hoy / 20minutos (Spanish), 22 October: what PHP and PHP2Shell are, the role of AI in it all and how long it will take to solve what it calls... capture 20261024T083755Z · HTTP 200 · https://computerhoy.20minutos.es/ciberseguridad/que-es-php-php2shell-cual-es-papel-ia-todo-esto-cuanto-tiempo-tardara-solucionarse-una-las-mayores-crisis-seguridad-historia-internet_7051873_0.html- `headers.json` be4ebc1390bf8766a66ddf525bb05b2ae6961b4fdb252292a31a974871ee011a 675 bytes - `page.html` 096441ab9186b6415e28e02c7eea29c0ce1ac72778cef7d556ca7a3b6d660b1a 155,785 bytes - `provenance.json` 58b241d04916c3a943c88b9a301eb343ca5e6802a5f942de1fe8268923f893bb 1,969 bytes - `text.txt` 31876f7578b421d31530a72c9f2575b804fc60041d45a0a4a9eba4a8f0d3f1fe 5,753 bytes ### [Botched PHP2Shell disclosure revealed as panic continues | Computer Weekly](computerweekly-news-366652674-botched-php2shell-disclos/index.html) [original ↗](https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues) **Computer Weekly** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `computerweekly-news-366652674-botched-php2shell-disclos` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Computer Weekly: the PHP Foundation reveals how a carefully planned disclosure went horribly wrong while teams worldwide cope with the flaws, which si... capture 20261023T160435Z · HTTP 200 · https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues- `headers.json` 7424ee3c0ca4dbd5e22a2cebd1a5cc65ca127116a0e8e9171d8579344085f83d 715 bytes - `page.html` d5954b08d373a7058260a3a671f23dc5d60ecc35db54fcceb2a18fd21ae8daeb 383,707 bytes - `provenance.json` a2d3a3df7c5f50ca7347cb32fcef369418254d30e17dcd9a81a5c778472065e3 1,811 bytes - `rendered.html` f519421f01650d017c88e6100b48447ad70ec8cc181fcda70ffd477b129aeb09 408,600 bytes - `screenshot.jpg` b713a9af3dc3349fecf59e8517f519fbb79a3195f3669fb84720768704f8f6c1 711,491 bytes - `text.txt` 8c5ef3c6921c8db90001a45a4cecbcc172ebbad178e2dcb66d150a72029dbb4e 10,778 bytes ### [Dos fallos críticos de PHP ponen en alerta a Internet | Computerworld.es](computerworld-article-4238887-dos-fallos-criticos-de-p/index.html) [original ↗](https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html) **COMPUTERWORLD ESPAÑA** · news · secondary · captured · published October 22, 2026 · added by `curator@php.newsroom` · `computerworld-article-4238887-dos-fallos-criticos-de-p` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Computerworld España (Spanish): two critical PHP flaws put the Internet on alert. It relays the NCSC-NL description that the impact is not limited to... capture 20261023T160435Z · HTTP 200 · https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html- `headers.json` a08dc05d415171e1f4bbac6a41cef8e09ff5c471968dafc6e934209f77bd49f1 974 bytes - `page.html` 7d555a99926112835b695b6a1bc4f42ddf9a8132e27dc3eb70f773f57c6fb2b0 293,875 bytes - `provenance.json` 9dbac40f846855c846fc44b0e7d1749473a8f2ce4fa53575f18d58696bc2d5f5 1,741 bytes - `text.txt` e008b157b0ff9821a0995ada3ad6e5895f5f361231721c4191868b050a77d886 14,164 bytes ### [PHP2Shell | Panică mondială și ghidul complet de patch](criticarad-php2shell-cve-2026-109618-ghid-patch/index.html) [original ↗](https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/) **Critic Arad** · news · secondary · captured · published 2026-10-22T12:02:38+03:00 · added by `curator@php.newsroom` · `criticarad-php2shell-cve-2026-109618-ghid-patch` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Critic Arad (Romanian): global panic and a full patch guide. It says PHP2Shell, found in August and made public on Wednesday, took government sites of... capture 20261023T160435Z · HTTP 200 · https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/- `headers.json` 387a34ae17de8562acfab2dbf2aed130fd620e4be2c843c544061eb1b59a2311 962 bytes - `page.html` df96f9ecea949bb7067e25b8dd5abb86f8d9229d2c3f371bad400490884b8756 385,267 bytes - `provenance.json` 620794875350fcf150a337cc942aaccfdb31396677a5efa39f4bdac1380d6d31 1,652 bytes - `rendered.html` ec06accfbe05459da12950feceabcd63eb453351f62918aef9970377025f33ff 354,128 bytes - `screenshot.jpg` 862129757dc398c5e32f4986227eea89c8f48e896013541d0ca2a4492831bb17 974,037 bytes - `text.txt` 2f3acccf122140590c9aec1ab56e7076bc1f9c3a6e5f0b693a80f742162a205c 33,454 bytes ### [5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation](crn-news-security-2026-5-things-to-know-about-critical-php-vulne/index.html) [original ↗](https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation) **CRN** · news · secondary · captured · published 2026-10-21 or 22 (date not in the text; the page refers to Wednesday 21 October) · added by `curator@php.newsroom` · `crn-news-security-2026-5-things-to-know-about-critical-php-vulne` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). CRN's five things to know: two critical flaws, together called PHP2Shell, rated 9.2, allow unauthenticated remote code execution; PHP shipped updates on Wednesd... capture 20261023T080331Z · HTTP 200 · https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation- `headers.json` ea917977ce1cc907be6710577f09f4f6fb7930fde089b9b561b16929a6cc5f29 1,129 bytes - `page.html` ad8778a2d65941aacd52ab7956825223c880e45dce2f520b8a306f4fa638777e 20,501 bytes - `provenance.json` 1d1316087d11437f84575ac6924146390aeb14f6fe0a82a7a611303433b3bed7 1,795 bytes - `rendered.html` 5b69e1301cecea73f059f3de8618d54f5e7fcca27a7438e9c1c9a765284d83b2 26,203 bytes - `screenshot.jpg` 61d34da7242d0dae910cd0147dc16e695fd4f1abdc2085a46ec853e8fa42e899 7,597 bytes - `text.txt` 7e2214693dddacf72cedf3f64ad2898acb80fbee6504be4f8122dd7ddb481ee5 5,761 bytes capture 20261023T160435Z · HTTP 200 · https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation- `headers.json` a52c4edd6cf2301348db4cec9672a9b0fb7bcb13c6d3a31b78314f609b326633 1,129 bytes - `page.html` 528bbf0ef5ce75006bd5e94b913b45700df4ae77705a3963609eeaaf1998563d 20,508 bytes - `provenance.json` a6d540748f65978d282b3e5320861b93d81a22559603d58214dcadca71371924 1,931 bytes - `rendered.html` bffe87329149352f6d910c41920965c0541d4519da14fbf53d6a4c676adcb3d1 27,757 bytes - `screenshot.jpg` 61d34da7242d0dae910cd0147dc16e695fd4f1abdc2085a46ec853e8fa42e899 7,597 bytes - `text.txt` 683aa11bc32c6b1012132894fc892d5321c56d9bb0fa24fef1ea74435e105a2b 5,888 bytes ### [Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?](cryptoast-failles-critiques-php-php2shell-france-f/index.html) [original ↗](https://cryptoast.fr/failles-critiques-php-php2shell-france-freebox-que-faire/) **Cryptoast** · news · secondary · captured · published 2026-10-21T10:19:06+00:00 · added by `curator@php.newsroom` · `cryptoast-failles-critiques-php-php2shell-france-f` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cryptoast (French), 21 October: two critical flaws threaten PHP servers; France appears especially exposed, notably because of Freebox devices. A firs... capture 20261023T160435Z · HTTP 200 · https://cryptoast.fr/failles-critiques-php-php2shell-france-freebox-que-faire/- `headers.json` 25cb83b8ab727a96e40ce9ac342ba0f8fd04868a7cbee2ac9b794ca4972f0567 1,490 bytes - `page.html` fbb4869ec546b9c3f7705381453c0902c483263b6eff5f333e7db1c3cc32df82 507,386 bytes - `provenance.json` b85e75f594ea82e06740d17bee3855347b33158ca7ab63c119bbd0fa734d877d 1,625 bytes - `text.txt` 3555725ce40f48f75a5a97724389f85fcf69111a1417820913ceef24fd463208 8,472 bytes ### [Imperva Threat Research analisa falhas críticas do PHP2Shell](cryptoid-ciberseguranca-seguranca-da-informacao-i/index.html) [original ↗](https://cryptoid.com.br/ciberseguranca-seguranca-da-informacao/imperva-threat-research-analisa-falhas-criticas-do-php2shell/) **CRYPTO ID** · news · secondary · captured · published 2026-10-22T20:32:18+00:00 · added by `curator@php.newsroom` · `cryptoid-ciberseguranca-seguranca-da-informacao-i` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Crypto ID (Portuguese, Brazil), 22 October: Imperva Threat Research analyses the critical PHP2Shell flaws. It says researchers at Wiz, OpenAI and Cali... capture 20261023T160435Z · HTTP 200 · https://cryptoid.com.br/ciberseguranca-seguranca-da-informacao/imperva-threat-research-analisa-falhas-criticas-do-php2shell/- `headers.json` adeb91fc07cd269b0243b727027e8a66bfd9ed5d0fa402be2c67072a908b2965 1,047 bytes - `page.html` adee6f36575ecdbd2f31b886048c90bd7cfb3dde48f36603e263a0dddcb9f4ac 398,444 bytes - `provenance.json` e91ee8962ce7a6a40f57f2c01f343ffcff27d63d9dc3e556c083f007b8cc82dd 1,825 bytes - `rendered.html` 09c6e89be3da8655cb8afba92085a7d6fb4712e1bc7a9dc484e8882550f98696 505,818 bytes - `screenshot.jpg` 1525fc69b16ad9b23139382d0e23ee5d34e05532c1505b9702d69a786083329e 1,020,900 bytes - `text.txt` 48a6133f8adb09ef37fa360f8a6bba01e64279bc2642ec7518562e9ede95c36d 26,006 bytes ### [PHP kaynaklı kritik güvenlik açığı: Avrupa'da devlet, okul ve hastanelerin internet siteleri erişime kapatıldı - Son Dakika Bilim Teknoloji Haberleri | Cumhuriyet](cumhuriyet-bilim-teknoloji-php-kaynakli-kritik-guve/index.html) [original ↗](https://www.cumhuriyet.com.tr/bilim-teknoloji/php-kaynakli-kritik-guvenlik-acigi-avrupa-da-devlet-okul-ve-hastanelerin-internet-siteleri-erisime-kapatildi-2549080) **Cumhuriyet** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `cumhuriyet-bilim-teknoloji-php-kaynakli-kritik-guve` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cumhuriyet (Turkish): the headline says the critical PHP flaw led to government, school and hospital websites in Europe being closed to access. The fl... capture 20261023T160435Z · HTTP 200 · https://www.cumhuriyet.com.tr/bilim-teknoloji/php-kaynakli-kritik-guvenlik-acigi-avrupa-da-devlet-okul-ve-hastanelerin-internet-siteleri-erisime-kapatildi-2549080- `headers.json` f8a224489e065398c4efc1aaecf9e6313360e39fe7a2addd045682f3683fe9f7 818 bytes - `page.html` 58b43f47ab4ed217db803d5819d42de2f96924849a15fc7c50cce5f8e3333950 314,923 bytes - `provenance.json` 2d7662031f9f1a7661f47d77b9776fff3ed9bc3041f4e11a79717a7a283c13f0 2,016 bytes - `rendered.html` b3a9f728797d6304c43ee5b02146292fbb9f703fb156939fd74d5ab2f2b63d52 498,126 bytes - `screenshot.jpg` e82d974457c6267479da104f576f482b1f40781bfc73a611ad20b8bc5c318734 524,648 bytes - `text.txt` 9b98d2728804d22f96b6fc43418e135bb46f1b70b6957bf8d245ef576f729f29 9,603 bytes ### [CVE-2008-1447 (DNS cache poisoning, Kaminsky)](cve-cve-2008-1447/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2008-1447) **CVE Program (cveawg API)** · cve · primary · captured · published 2008-07-08T23:00:00.000Z · added by `claude-story-site` · `cve-cve-2008-1447` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2008-07-08. raw, 1 files with SHA256SUMS- `cveawg-api.json` 4025bae38315c16e5ac26105365646c67c4bce58937a187a627274f023ff1501 ### [CVE-2012-1823 (php-cgi query string)](cve-cve-2012-1823/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2012-1823) **CVE Program (cveawg API)** · cve · primary · captured · published 2012-05-11T10:00:00.000Z · added by `claude-story-site` · `cve-cve-2012-1823` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2012-05-11. raw, 1 files with SHA256SUMS- `cveawg-api.json` fc02a593375ecc025b00f8c4ba49d3227cae19c5ed0c9b78f7771362355abdb0 ### [CVE-2014-0160 (Heartbleed)](cve-cve-2014-0160/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2014-0160) **CVE Program (cveawg API)** · cve · primary · captured · published 2014-04-07T00:00:00.000Z · added by `claude-story-site` · `cve-cve-2014-0160` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-04-07. raw, 1 files with SHA256SUMS- `cveawg-api.json` b0b80e14890433984e302ac8c3e6fe5d1669bcd52dfd8bd52de6945a2d06dff9 ### [CVE-2014-6271 (Shellshock)](cve-cve-2014-6271/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2014-6271) **CVE Program (cveawg API)** · cve · primary · captured · published 2014-09-24T18:00:00.000Z · added by `claude-story-site` · `cve-cve-2014-6271` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-09-24. raw, 1 files with SHA256SUMS- `cveawg-api.json` 5f9825de68cb0d172329bdc64da9bd93951aae29803454926d4be7d1ac6d609d ### [CVE-2017-5638 (Apache Struts)](cve-cve-2017-5638/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2017-5638) **CVE Program (cveawg API)** · cve · primary · captured · published 2017-03-11T02:11:00.000Z · added by `claude-story-site` · `cve-cve-2017-5638` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2017-03-11. raw, 1 files with SHA256SUMS- `cveawg-api.json` 525b90b7605a6c18ccd4812dbc70dfdcf7f330374648173e0ade5fcb1e1b8d38 ### [CVE-2019-11043 (PHP-FPM underflow)](cve-cve-2019-11043/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2019-11043) **CVE Program (cveawg API)** · cve · primary · captured · published 2019-10-28T14:19:04.252Z · added by `claude-story-site` · `cve-cve-2019-11043` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2019-10-28. raw, 1 files with SHA256SUMS- `cveawg-api.json` e32115c5b48bca1c90fab5a125d64f9067e728bb3ac6e13939ee0886d267e526 ### [CVE-2021-44228 (Log4Shell)](cve-cve-2021-44228/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2021-44228) **CVE Program (cveawg API)** · cve · primary · captured · published 2021-12-10T00:00:00.000Z · added by `claude-story-site` · `cve-cve-2021-44228` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2021-12-10. raw, 1 files with SHA256SUMS- `cveawg-api.json` cae2ad45ea2739a59680c360555a538019b8f46199c797aed96fba49c073aa89 ### [CVE-2022-22965 (Spring4Shell)](cve-cve-2022-22965/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2022-22965) **CVE Program (cveawg API)** · cve · primary · captured · published 2022-04-01T22:17:30.000Z · added by `claude-story-site` · `cve-cve-2022-22965` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2022-04-01. raw, 1 files with SHA256SUMS- `cveawg-api.json` b38ff19768aa5757d264340669a3c06e4a78e5e2014c813bc509d052e2f267f3 ### [CVE-2023-34362 (MOVEit Transfer)](cve-cve-2023-34362/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2023-34362) **CVE Program (cveawg API)** · cve · primary · captured · published 2023-06-02T00:00:00.000Z · added by `claude-story-site` · `cve-cve-2023-34362` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2023-06-02. raw, 1 files with SHA256SUMS- `cveawg-api.json` feae1a77086ce7533526a0f9d24afb4c67917deb3363569795ea4bbc57b2abbf ### [CVE-2024-4577 (PHP-CGI argument injection)](cve-cve-2024-4577/index.html) [original ↗](https://cveawg.mitre.org/api/cve/CVE-2024-4577) **CVE Program (cveawg API)** · cve · primary · captured · published 2024-06-09T19:42:36.464Z · added by `claude-story-site` · `cve-cve-2024-4577` Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2024-06-09. raw, 1 files with SHA256SUMS- `cveawg-api.json` e8cc1b1dcd1a3333776e9a0f08cd4543bc662e0ee60fc094bda0820f84b114eb ### [CVE-2026-109618: RCE via OOM corruption](cve-cve-2026-109618/index.html) [original ↗](https://www.cve.org/CVERecord?id=CVE-2026-109618) **CVE Program (CNA: PHP Group)** · cve · primary · captured · published 2026-10-21T13:48:34.845Z · added by `collector-primary` · `cve-cve-2026-109618` CVE record JSON in raw/ (cveawg API). dateReserved 2026-10-12T21:03:58Z, datePublished 2026-10-21T13:48:34Z, dateUpdated 2026-10-21T16:07:52Z at fetch. CISA ADP SSVC at 14:34Z: Exploitation none, Automatable no, Technical Impact total. capture 20261022T081218Z · HTTP 200 · https://www.cve.org/CVERecord?id=CVE-2026-109618- `headers.json` 58be2c1dc484c3910605b35d9e612014fc4b6e0c9de9f605d6286d788fde6c7a 1,500 bytes - `page.html` a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50 880 bytes - `provenance.json` adc09f106ba451478b387bb819c13df4cc15e0ac6f7ab6507a24175c8cc75458 952 bytes - `rendered.html` 37b9582087865e1776a98adadf13b2fd1cda169569affa0d7e113500697e5edb 146,271 bytes - `screenshot.png` bfb16ac90b930eabd692ee995fc41e848022b6b3ad486b96eaab255d08553229 341,195 bytes - `text.txt` f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b 3,115 bytes raw, 1 files with SHA256SUMS- `cveawg-api.json` f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1 ### [CVE-2026-109619: RCE via stale global state](cve-cve-2026-109619/index.html) [original ↗](https://www.cve.org/CVERecord?id=CVE-2026-109619) **CVE Program (CNA: PHP Group)** · cve · primary · captured · published 2026-10-21T13:54:43.866Z · added by `collector-primary` · `cve-cve-2026-109619` CVE record JSON in raw/. dateReserved 2026-10-12T21:04:00Z, datePublished 2026-10-21T13:54:43Z, dateUpdated 2026-10-22T08:09:24Z (updated minutes before our fetch; CVE Program container lists oss-security refs incl. 22/2). CISA ADP SSVC: Exploitation none. capture 20261022T081219Z · HTTP 200 · https://www.cve.org/CVERecord?id=CVE-2026-109619- `headers.json` 03c46200ee6c4d6c0d0a06fdaae6fb0a376986fa48431cdc5543e5ae073ca8f7 1,500 bytes - `page.html` a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50 880 bytes - `provenance.json` 7de30cfb3eb2de89b08dcd062e6eee6c14efb0710ba248992dd2c1e2d3636335 952 bytes - `rendered.html` 83e446fe17d5717ad7f281973b506b4ba9e19b1b7cec8a4687132cd84419c71f 150,334 bytes - `screenshot.png` ae02d0aca995d93891d5bc181141c569b6b465a32272d727709884750ecdb50b 367,927 bytes - `text.txt` 3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5 3,351 bytes raw, 1 files with SHA256SUMS- `cveawg-api.json` d045248b93425b1a6f5a0fc29ae36b5cfcd3c8188d969664a0d8e5f82ff05f61 ### [What We Know About php2shell [Critical update]](cybelangel-php2shell/index.html) [original ↗](https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/) **CybelAngel** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `cybelangel-php2shell` Vendor explainer; Cloudflare CTO 07:43 UTC early attacks; Aikido reporting exploitation. capture 20261022T112625Z · HTTP 200 · https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/- `headers.json` 434967eca3ae83ed546f2b8d4839eeb91ca1b11c8740be1e1e1f3864d5e4f809 1,530 bytes - `page.html` 842333792c959891233e6290ecc0857bfd361fbc9dfb4b377a8325657855a025 169,382 bytes - `provenance.json` d2e13e8d5bd7b15ee078cbe727f55708366293caa3c4a68445ce1fbd5e206201 1,070 bytes - `rendered.html` 538f2982edeb0859af905cbcf0dc02f6899dcd997e9a7245917ad53e04faa993 174,398 bytes - `screenshot.png` 64c9ca6ef1602bd645b956fe272f9fcb7d3d50ec0f24b4af5b980edfc9e424d5 1,631,217 bytes - `text.txt` 4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27 12,396 bytes capture 20261024T083755Z · HTTP 200 · https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/- `headers.json` 1a38444e12276d485a486ff2478223ca35a712bbd70cc396518429325a2c18a8 1,589 bytes - `page.html` 539f25deb86fd869eff5280eb233aecdf91aadf766474642003997c12011d500 169,023 bytes - `provenance.json` 316491b54670c17c085c97aa9f967c338bee879e696d92b7ebb62e8276da110c 1,646 bytes - `text.txt` b335c33cfede719c4c86aed963aaaf343c09a0cedb6aa6b6b169c806909e9222 12,795 bytes ### [cyber-gov-au-site](cyber-gov-au-site/index.html) [original ↗](https://www.cyber.gov.au/) **cyber.gov.au** · government · secondary · failed · published not stated · added by `collector-news` · `cyber-gov-au-site` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081951Z · HTTP None · error: page.goto: net::ERR_ABORTED at https://www.cyber.gov.au/- `provenance.json` 42c2c30f7de1649cf0873e3cf2759758856b8ebd94fa2254f3b4ca2961c3f876 447 bytes ### [PHP2Shell: Do you know where all your servers are? - Cyber Daily](cyberdaily-security-14335-php2shell-do-you-know-whe/index.html) [original ↗](https://www.cyberdaily.au/security/14335-php2shell-do-you-know-where-all-your-servers-are) **Cyber Daily** · news · secondary · captured · published 2026-10-21T23:34:41 · added by `curator@php.newsroom` · `cyberdaily-security-14335-php2shell-do-you-know-whe` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Daily (Australia), 21 October: do you know where all your servers are? It quotes watchTowr's head of threat intelligence that watchTowr Intel is... capture 20261023T080331Z · HTTP 200 · https://www.cyberdaily.au/security/14335-php2shell-do-you-know-where-all-your-servers-are- `headers.json` 90529666cfc152e4476c9634261af9c652683c426ba6fa206049e848733ffb72 957 bytes - `page.html` f37018e53c1304d9a7d866bf09a81003673261315fffb3c9df07f099796dae8a 109,990 bytes - `provenance.json` 0cfe1dda8a897600f65d34da0ec2caeaa4b798489d225d0fedf1b79c63f2daa9 1,760 bytes - `rendered.html` 251224e691ba61314010b87923df6e8a8f21ebb89e4685b86c825b744d38babb 135,788 bytes - `screenshot.jpg` 2b7285302943b6fe11665cf0902172032afc1ccbc995b44933b4c3742c3819d8 461,720 bytes - `text.txt` 9e1c2a12df93c53f9d8ea8de8e7efe039f8fa8f900dc4f0e70ec69df692f5bfb 5,456 bytes ### [PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites](cyberexpress-php2shell-gov-sites/index.html) [original ↗](https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/) **The Cyber Express** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `cyberexpress-php2shell-gov-sites` Secondary: Wikimedia quote; government sites hit. capture 20261022T112646Z · HTTP 200 · https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/- `headers.json` 12ba694e03c07c68e519eee401b1f3c26bbbf5e314d5681dd8dee8202a9ddc2b 1,486 bytes - `page.html` 58d2d840bcff4c80b422282f8358fded7d8d4a8a0ae0005b66dd7ce51049222d 567,233 bytes - `provenance.json` b259cfb46f07df0edf091ae5b56f255c93846d9656a80d9adbe65e6aa496349f 1,017 bytes - `rendered.html` ed8d3c7588accfa0810ec2d054a01b00bf1c8783e9100bc6f46557783e623fa5 598,469 bytes - `screenshot.png` d80c357eed47fd016ffe1e5a7866573916c9044f011f6e0e3c7b2487c93d296a 18,579,851 bytes - `text.txt` f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6 14,589 bytes capture 20261023T160435Z · HTTP 200 · https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/- `headers.json` e2ada00fbdd0d42fbb924df1dfe2167b6d88f3feff9657a2396e6be27449c6d1 1,564 bytes - `page.html` e92663a6c78adba74cb4ca9a632159bd091e5570407b27e3d6b1c2865c6b0b70 566,375 bytes - `provenance.json` 9fba84683d5840fa5780c5151f4e98e7f5edc33988a964cbc89be215aeecb71b 1,790 bytes - `rendered.html` ea5c41ea0cc5c6859e3176190e29af9fbdbbcab4a0a50482ed77579eae1d3cf0 573,204 bytes - `screenshot.jpg` 2e75823faf50087d879d1f79ea0820136d1c83552570c7099a7ea02fd2e4fba3 418,655 bytes - `text.txt` a638610541cb7ce3d786cb0053e383e2f09cbdf5d6ed8f33fb1899421505ae71 7,494 bytes ### [PHP2Shell: Critical PHP Flaws Allow Remote Code Execution - Cyber Kendra](cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20/index.html) [original ↗](https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html) **cyberkendra.com** · news · secondary · captured · published 2026-10-21T17:11:07+05:30 · added by `curator@php.newsroom` · `cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Kendra: an explainer on the two PHP flaws allowing remote code execution, organised as questions (what is PHP2Shell and how does it work, who di... capture 20261023T080331Z · HTTP 200 · https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html- `headers.json` 7dad2c91f42ed630bf23e79a47c21e00141f045c6a40cdb04e3a57b6e5dc91ae 1,204 bytes - `page.html` d89dde81d5860f6910890f9273ade96fc531dcdf66682e30cb15f596829303d8 334,670 bytes - `provenance.json` 3743bd1d229f0774d12ad1bc645074d0c76d73bea1c7e3c8eff34784432dc81c 1,599 bytes - `text.txt` c604df6084ae12123c45d972380fb4ef9be0d787f0ef685f9be4161ce9bf5065 13,305 bytes ### [PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernews](cybernews-php2shell-millions/index.html) [original ↗](https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/) **Cybernews** · news · secondary · captured · published 2026-10-22 · added by `claude-story-site` · `cybernews-php2shell-millions` Secondary: Cloudflare and Amazon warnings; millions of attempts. capture 20261022T112703Z · HTTP 200 · https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/- `headers.json` 6be6626f1e9d0a6627adcf4b3cfe7e0e3fbc8107a1ef9772318e3b2f95ccfc6b 2,119 bytes - `page.html` c66a7d30501a36b114a61e46813ab2e0d7ec2dfa4d5fb106f8c5a9ff50ef69b6 264,681 bytes - `provenance.json` fd6fc60ea011e77252fb66fb924fa6ded42288362364dea1c51a872c9f0a80d3 1,087 bytes - `rendered.html` 396bc3073c8b12fb2dc2ed624d0f38b6fc6dbf885f976267d2e1c0b5b47ef108 268,472 bytes - `screenshot.png` 4593aadc41abb1ffd9875242e346506becf26679a960c352c74a1b52d2c5f956 2,513,246 bytes - `text.txt` a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb 7,502 bytes capture 20261023T160435Z · HTTP 200 · https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/- `headers.json` 4e8e2efb43541e36370de273e301a9f0288f6c44ec1032da71cd8de7eecf1a85 2,191 bytes - `page.html` c4ed88ee4af3cc60dc4b43f9236d3b8042b9812d6c33e02158b28c0a8cd0bce2 263,294 bytes - `provenance.json` 0465d653f19e978ef259a2e553fc0a5979e4909bf2a5e699dbc4ccd248dba0b0 1,735 bytes - `rendered.html` 7f0a9563f66c95eb6c0a71a9392dedb45aaf5d4954364b304c9e9bfb35959560 255,030 bytes - `text.txt` 0f0dd44e1980b36b9f39fb0783637f6ac2b9b5b382ca840f299c5c49cfaf990d 7,503 bytes ### [Attackers Were Already Testing PHP2Shell Exploits Before Security Patches Arrived](cyberpress-php2shell-exploits-predate-patches/index.html) [original ↗](https://cyberpress.org/php2shell-exploits-predate-patches/) **Cyber Press** · news · secondary · captured · published 2026-10-22 · added by `curator@php.newsroom` · `cyberpress-php2shell-exploits-predate-patches` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). A secondary report of Amazon's honeypot findings: the earliest exploitation attempt hit Amazon's MadPot telemetry on 17 October, four days before disclosure, fr... capture 20261023T080331Z · HTTP 200 · https://cyberpress.org/php2shell-exploits-predate-patches/- `headers.json` 20c04a3d41af56d86347bb820ae1b3865f963eafe5fd3bb50b175cd0cc0bd4e0 776 bytes - `page.html` 001fe3a7eb405f7bf74d993215bc7a52d562588957aa9705bc0e07e910ca5157 359,318 bytes - `provenance.json` ea60f0b4e9e23765027dafd072ec31be85645474041e5e4f730ef9a9f5fc7180 1,661 bytes - `rendered.html` 00e7c15d9a47cf033cb43272da3ba496ab76779223e5fff60dc4240ba78557ac 951,809 bytes - `screenshot.jpg` 61cab329704a88f174646719bcd1551995d92a24acc0296662d58141c0a7cf28 548,378 bytes - `text.txt` 89f109c027b1ff22badfe13405d7857d8b07cd088afa1d99799fcb33226cc3bc 7,029 bytes ### [PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop](cyberscoop-php-emergency-patches-php2shell-vulnerab/index.html) [original ↗](https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/) **CyberScoop** · news · secondary · captured · published 2026-10-21T13:40:02+00:00 · added by `curator@php.newsroom` · `cyberscoop-php-emergency-patches-php2shell-vulnerab` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). CyberScoop, 21 October: PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, both 9.2 on CVSS v4.0, described by researchers as remot... capture 20261023T160435Z · HTTP 200 · https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/- `headers.json` 132a87949576cdc8b3ac2069289946e817c17f1d514c1266576898c761f0b95b 1,299 bytes - `page.html` ebb0cbafb6697ef41f9e96f40eb2b03c2ff96ec9423d085309271547f11b19b7 123,757 bytes - `provenance.json` f3e09f446895f9f72670f284d28292ce6e9d5a5cf33c53a57974f6f9bf3105c1 1,708 bytes - `rendered.html` 273a4a14c7b6895e3699b3018f98ca49723d3880b97537783f791cdab1c4cdcc 144,434 bytes - `screenshot.jpg` ece2fc2ced31eb8a6679c2f865eab8f6a330f61a70ddbef6fea93157169f4a88 915,217 bytes - `text.txt` b47b3a5031e3f0801e4df342b9542ec8aa684842f98b4f6b6c30920346d917af 11,200 bytes ### [PHP2Shell: due vulnerabilità critiche in PHP, cosa fare](cybersecurity360-nuove-minacce-php2shell-due-vulnerabilit/index.html) [original ↗](https://www.cybersecurity360.it/nuove-minacce/php2shell-due-vulnerabilita-critiche-in-php-come-proteggere-i-server-in-attesa-delle-patch/) **Cyber Security 360** · news · secondary · captured · published 2026-10-21T15:29:45+02:00 · added by `curator@php.newsroom` · `cybersecurity360-nuove-minacce-php2shell-due-vulnerabilit` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Security 360 (Italian), 21 October: the PHP Security Team released emergency patches on 21 October 2026 for the two critical vulnerabilities, pu... capture 20261023T160435Z · HTTP 200 · https://www.cybersecurity360.it/nuove-minacce/php2shell-due-vulnerabilita-critiche-in-php-come-proteggere-i-server-in-attesa-delle-patch/- `headers.json` 9910a96dcb71c952c1036348a4eea7be6f29e39019625439c524d5c3cccbe103 1,371 bytes - `page.html` d7ebc69bddc8d2130edd2603681f9121c774f293f64dd4d14f41102fe1dd3bcb 269,744 bytes - `provenance.json` 0c47216fa06fc1c1cfd3a714c0643d54f5d92657c4ff273d4aa0e846dd637a22 1,870 bytes - `rendered.html` a0dae4452ba2ee230c7e48872331e6b44239a3dfdecaed27ca6d6827a0a69f8e 291,785 bytes - `screenshot.jpg` 77abb72e2d08e0bca4c352d08a7850f07643d38bf7e7ce1e22e5bcf0c0759def 282,297 bytes - `text.txt` fc26cae83a8229935b33de6b9e2b25fc7389acdafaccc99c480ee1d7e259e2a1 4,312 bytes ### [Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware](cybersecuritynews-critical-php2shell-exploit-code/index.html) [original ↗](https://cybersecuritynews.com/critical-php2shell-exploit-code/) **Cyber Security News** · news · secondary · captured · published 2026-10-23T13:00:37+00:00 · added by `curator@php.newsroom` · `cybersecuritynews-critical-php2shell-exploit-code` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Security News, 23 October: exploit code has gone public and hackers are attempting to deploy botnet malware through PHP2Shell. One attempt tried... capture 20261023T232528Z · HTTP 200 · https://cybersecuritynews.com/critical-php2shell-exploit-code/- `headers.json` c2e8689358dbf7b38aa3ec2067e61aaeef9147c21d44015d423a884b38810a23 832 bytes - `page.html` 7f3dcbd4d3c7e25240082aa2e00fe20993ef586981503037c91f02447a353614 370,240 bytes - `provenance.json` f4dc56063e5c384685f772f851bd51d87de146e84b52cd6809e656df4f54dea4 1,685 bytes - `rendered.html` 764d554a8bf9a1fb726baa71c11fc82fd5451a59bd869af79cb34da332b530ae 1,268,050 bytes - `screenshot.jpg` 750b488bb22505b3aab3df88474d497cd183672b54f865ef490e95b366cc87e8 786,589 bytes - `text.txt` bdf6e94a1a8a118b2f1a5546ec71c6eda552a7289fb2b15ed34885ddcbfa89ac 9,743 bytes ### [“อ.นพดล” เตือนภัยไซเบอร์ “PHP2Shell” จี้รัฐอุดช่องโหว่เสี่ยงกระทบเว็บไซต์-แอปฯ | เดลินิวส์](dailynews-news-6303237/index.html) [original ↗](https://www.dailynews.co.th/news/6303237/) **เดลินิวส์** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `dailynews-news-6303237` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Daily News (Thai), 25 October: a Thai academic and former adviser to the Ombudsman warns of the PHP2Shell cyber threat and urges the state to close th... capture 20261025T120459Z · HTTP 200 · https://www.dailynews.co.th/news/6303237/- `headers.json` 286a01c3f15d12863bd497705e7d33304ba81a9c479202a6a76513fc1b618a95 577 bytes - `page.html` 722cbb8c85dfba2b8f33cbb61868471bddd31782292124e8b8af9645bd985960 406,890 bytes - `provenance.json` cf7dfcd7c7531721024991fc9469c8230736fd146f6c3f3048e296bbc6e725a4 1,711 bytes - `rendered.html` 96b9342ad40f3fb1488e146d3d2ecf6be3b691bf3a3ab54d50e400e2aad88969 465,760 bytes - `screenshot.jpg` ff9b53252bc631c612be577e1515386bf6e56d9bec8c77ad95aa376176be459d 573,006 bytes - `text.txt` efb5d7c4f675b0604302224dcb8bf6fb6bb034017c07ae67aa10d64fc63be1aa 17,511 bytes ### [[긴급] PHP2Shell 취약점에 웹서버 보안 비상…긴급 설정 점검과 업데이트 필수 capture 20261023T160435Z · HTTP 200 · https://www.dailysecu.com/news/articleView.html?idxno=208979- `headers.json` c4d8b5fa4496115b9056cb891943b9464f988834ce34e1ef9ed0af5fe9f99786 354 bytes - `page.html` 7d12632c17f4eef5a36f1188c0f7fed81fbd6ef18d0dc1aad2fd56a6268a0afe 105,584 bytes - `provenance.json` 05414c9fd58a572fc405110961ef9bafc2832f69b1fe274dae7a3e846640d24c 1,550 bytes - `text.txt` 19d4370c2b96aaf5cdfaa3fe3ef54788933a7746232e61a19971e6a5b22c2fac 11,927 bytes ### [Doanh nghiệp cần làm gì để bảo vệ trang web trước lỗ hổng PHP? | Báo Dân trí](dantri-cong-nghe-doanh-nghiep-can-lam-gi-de-bao/index.html) [original ↗](https://dantri.com.vn/cong-nghe/doanh-nghiep-can-lam-gi-de-bao-ve-trang-web-truoc-lo-hong-php-20261022215438274.htm) **Báo Dân trí** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `dantri-cong-nghe-doanh-nghiep-can-lam-gi-de-bao` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Dan Tri (Vietnamese): what businesses should do to protect their websites. It cites Vietnam's Cyber Security Department and National Cyber Security As... capture 20261024T083755Z · HTTP 200 · https://dantri.com.vn/cong-nghe/doanh-nghiep-can-lam-gi-de-bao-ve-trang-web-truoc-lo-hong-php-20261022215438274.htm- `headers.json` 63980333d23c590682e6da5af1c99616da099c94c5929145e1af3af845321a80 961 bytes - `page.html` 9aa26e3d298b998365b99aec161eb969b51a3c87057dff5174240e1020d93614 540,691 bytes - `provenance.json` e0bf707ad80dde9478336395d5879ec62e34af4c8fa42ca68b62ee48295af176 1,835 bytes - `rendered.html` 236b4f8c0674ece42a78e37cab56c13679106c5c04fd98e5f18087a8ce964d42 560,364 bytes - `screenshot.jpg` 31d1aa96c8fe2c5321564ee4bf7e24a84001ec1017860dcfda2f8dd68cae28cf 394,408 bytes - `text.txt` 1272489402a4668bb5c1d97dbbe1c8ecc83a596ab269b1745d6e0aebe32a62ff 7,540 bytes ### ['PHP2Shell' Bugs Signal Red Alert for Security Industry](darkreading-php2shell-red-alert/index.html) [original ↗](https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry) **Dark Reading** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `darkreading-php2shell-red-alert` Secondary coverage. capture 20261022T112357Z · HTTP 200 · https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry- `headers.json` 285a1d8359a3246821411a25457fe0ebe5714a3f3b64d2b0d9594549c5e28ee8 1,005 bytes - `page.html` 6a65a719cc37abf4198febfdb8afedb400656bbab8a87ecbf7979436acde2db7 451,026 bytes - `provenance.json` 0f49ff38cf40ae508792e69a36322fd852a90a413670686eb09c7abc3bab0e2a 1,078 bytes - `rendered.html` 94b8a23834d88b4202c8131505e4bb6abb7c27095cd873031af7f721a4d155f3 470,067 bytes - `screenshot.png` 2672b1f34bea1f587b758b2d846512d528d66179b9c6267f491669fb7287326e 2,410,017 bytes - `text.txt` 6db30e279f5f38773c58ae71e0d753d7a7f90fcf4148ea65658c2f967de7f32d 10,175 bytes capture 20261023T232528Z · HTTP 200 · https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry- `headers.json` 72df8aa89cbb5c7e5d5cbb6011981299458c74567325722bc52cc45474d4e485 744 bytes - `page.html` 0339585f258f5f1b4e38e7ebf78e4789002c2863cdf160f611515ba0cecd3a40 449,301 bytes - `provenance.json` 603b7bb784d8a79413f128548bdb7962675410867f8242108a6992a839432553 1,833 bytes - `rendered.html` fd03859a9fd5ae77d423d8835b81ab8ef251537a45a05faabe957954a7d0f167 450,077 bytes - `screenshot.jpg` e03787b20402534a181cf1f864b5f2064f95e65856a3e1ecbffe574cc51eb679 660,285 bytes - `text.txt` 9071d13624a159a9f371e546317ed92c7815d9423f092bd8c7defc2f8b0ef694 10,195 bytes ### [PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News](data-max-article-87622/index.html) [original ↗](https://www.data-max.co.jp/article/87622) **データ・マックス** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `data-max-article-87622` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). NetIB-News / Data Max (Japanese), part one of an explainer: what the serious PHP vulnerability PHP2Shell is, in terms anyone can follow, and what may... capture 20261025T093507Z · HTTP 200 · https://www.data-max.co.jp/article/87622- `headers.json` 8df4fbe37278f6743b0a102d5dfc781000d076efb21b2edf5e767bc993ec6c86 481 bytes - `page.html` a7530533f16fb33e58f71f79538ec1f2f401bb6fd421afbadfa0c062a9df3684 75,084 bytes - `provenance.json` ebdbf9616e6023bd5a40fd808759096ff5dc0a107da6c87f4ddbfa3a80b294ff 1,612 bytes - `rendered.html` 66c6bc747270cdab603672bfb6383b9dcef2b20273dd0e4a573b3a362408abf9 121,987 bytes - `screenshot.jpg` e230aca7695d8112ecffdeb0c85686e6220f59bad8ed05b6067419a76c0a4dd2 869,515 bytes - `text.txt` d7145bababb0f5db514157ec8cc247cac9399a81962ee78d639a643a2e177d72 15,510 bytes ### [php2shell: Informationen zu PHP-Lücken vor Patch-Veröffentlichung offengelegt | datensicherheit.de](datensicherheit-php2shell-informationen-patch-veroeffent/index.html) [original ↗](https://www.datensicherheit.de/php2shell-informationen-patch-veroeffentlichung/) **datensicherheit.de** · news · secondary · captured · published 2026-10-24T14:15:11+02:00 · added by `curator@php.newsroom` · `datensicherheit-php2shell-informationen-patch-veroeffent` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). datensicherheit.de (German), 24 October: information on the PHP flaws was disclosed before the patches. The critical flaws allowed, under certain cond... capture 20261025T093507Z · HTTP 200 · https://www.datensicherheit.de/php2shell-informationen-patch-veroeffentlichung/- `headers.json` 3bcca66d677eedcc50341a1a4b481235bb8511cbd055c750a951f48c0e62a1a2 493 bytes - `page.html` 95e5345f18176619727b7b65522553cf6b7c97b7362720abef536c8a928c27ec 98,464 bytes - `provenance.json` 909b1a17470a38f615d4d5c2f71b3c0b8e2f45f5d0596f34220b01fb5dba1732 1,767 bytes - `rendered.html` 07e7ad19fbeba7fca2b7cc824e7d3f96888a80857a8ffd3801c1252e47c4c0d1 105,206 bytes - `screenshot.jpg` 3e2f592c2dbd8508d3a83437d1fdb5476ad8d9d51b218f2417d0e55ffa12a0f4 588,165 bytes - `text.txt` a15a70b65cb1b388203f50fa3a318935871af53654f047b1bc417709d3612ade 6,556 bytes ### [What the PHP2Shell rumors got wrong, from inside the PHP security team](daubois-blog-php2shell-rumors/index.html) [original ↗](https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/) **Alexandre Daubois (PHP security team / PHP Foundation)** · researcher · secondary · captured · published 2026-10-21 · added by `collector-researchers` · `daubois-blog-php2shell-rumors` Personal blog of a PHP Foundation contractor on the PHP security team, dated 21 OCT 2026. Describes anonymous HN post Oct 20, leaked 'PHP2Shell tool' screenshot credited to Calif.IO, the short exploitation video, and watchTowr confirming the CVEs publicly. Gives GHSA advisory opened 2026-08-27 credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion. capture 20261022T081256Z · HTTP 200 · https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/- `headers.json` 7f4da02c6bd4388f7475aed4c30ba66fbfd5e93f9e9b69537b21005081745afa 1,049 bytes - `page.html` 8f85e508b569e07d58f4ab54611fc7bb886c13f58b8c0448198f44899bf54d10 22,135 bytes - `provenance.json` c86d302cfb9e3442fe758ce082c1015c8500db089f7e8350402efbd4b259241d 1,046 bytes - `rendered.html` 8bc8f77f0b030a431c17cfb6048a516fae5d743bcf9af1d571e1a377dbe77fbd 21,926 bytes - `screenshot.png` c86032b5d2ce179ae664684fe600ba45c0b3ff7003c835716b5cce042a13e514 817,325 bytes - `text.txt` 5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8 8,821 bytes capture 20261023T160435Z · HTTP 200 · https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/- `headers.json` 623adbf1988184eb649cce8858aced007c5165ba6b98c43fcac0f6f8a553ecf2 1,113 bytes - `page.html` cc22de0d3ddaa04114949ea038bb07fa1d246179a302856380c2588aaec8db33 22,135 bytes - `provenance.json` 407a98c95ce52c1483f3569b75eb4c2e34948836cc0da42e26d58572bf9d913d 1,776 bytes - `rendered.html` d1b60675fb382f85b3e100bba166f6ddcd6f6227bb577920e6ace8e38e0c86d4 21,926 bytes - `screenshot.jpg` b6d33a9fcad21d4a5e0492ffaff604c34cb5abed436db0c682cea86e24546adb 585,832 bytes - `text.txt` 530fd6cb980feec08028f50c58a1631f903305d34a3319fe86c46f0f1d71588a 8,821 bytes ### [PHP2Shell: falhas de gravidade 9,2 ameaçam servidores na internet](defesaemfoco-php2shell-falhas-gravidade-92-ameacam-se/index.html) [original ↗](https://www.defesaemfoco.com.br/php2shell-falhas-gravidade-92-ameacam-servidores-internet/) **Defesa em Foco** · news · secondary · captured · published 2026-10-21T13:30:45-03:00 · added by `curator@php.newsroom` · `defesaemfoco-php2shell-falhas-gravidade-92-ameacam-se` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Defesa em Foco (Portuguese, Brazil), 21 October: PHP2Shell, two critical PHP flaws with severity 9.2 out of 10, led European governments to take publi... capture 20261024T083755Z · HTTP 200 · https://www.defesaemfoco.com.br/php2shell-falhas-gravidade-92-ameacam-servidores-internet/- `headers.json` 9f708e106291751843ceb1a8c5cceadd368a2e6c6b39103d185d4baf3471f5d3 1,373 bytes - `page.html` 2757fca153e5def1d029ef9e31e2e408c449616bb59343d3be6208fe7852a0c1 82,633 bytes - `provenance.json` f31392a0e518f5f8f565a5613a1d4a07b1517e95b4fad31d246a44178e33b1e1 1,766 bytes - `rendered.html` 97c6f01bd344b6a99abaa9252b13834080f671085b1c03bd057efaa3990254c2 1,205,876 bytes - `screenshot.jpg` 64d9c72a0ed9763611e27fe3d43bd1d8bd241afb4ac262d48b722c0c07565009 907,285 bytes - `text.txt` d817f318eeea8098c746a75714f1077051ef1eca01bbf829f859cc372ecf6c94 10,004 bytes ### ["Cert.lv" novēro mēģinājumus izmantot PHP ievainojamības kiberuzbrukumos; pagaidām uzbrukumi nesekmīgi](delfi-bizness-44467736-tehnologijas-120139480-certlv-novero/index.html) [original ↗](https://www.delfi.lv/bizness/44467736/tehnologijas/120139480/certlv-novero-atseviskus-meginajumus-izmantot-php-ievainojamibas-kiberuzbrukumos) **DELFI** · news · secondary · captured · published 2026-10-21T17:53:19.000Z · added by `curator@php.newsroom` · `delfi-bizness-44467736-tehnologijas-120139480-certlv-novero` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in lv: Delfi reports that CERT.LV deputy head Varis Teivāns told LTV's Panorāma that mostly automated, bot-driven exploitation attempts against private and state systems in Latvia have so far failed. He said about 6,000 resourc capture 20261022T181608Z · HTTP 200 · https://www.delfi.lv/bizness/44467736/tehnologijas/120139480/certlv-novero-atseviskus-meginajumus-izmantot-php-ievainojamibas-kiberuzbrukumos- `headers.json` 8a9ff64bb037e10f8619989dbdad6e8a5828d2b6423c7c915a14b4b9b4702ad4 745 bytes - `page.html` 5f491916b03eb65cb52c5711afea2cdff4ecb36a64fcca64eee7a7982a4a7c68 220,811 bytes - `provenance.json` 7fb85d627bad83b9c7d1c065e9357ee85681b62068056c0fa16c3a22f9b19b58 1,911 bytes - `rendered.html` fa55bdf3cdc6fb68a654f1f8e30a74a99e796b353e92d5804e86a8aa83c1a580 231,020 bytes - `screenshot.jpg` 592102c9b29d2d4f9d69f7964ad4afacd5671d68590d668c646aa458c41ad63e 288,920 bytes - `text.txt` 916cc9c47bec9f4e9cb06de60da0d0b43a8f3251642b42825df581deaff221e8 4,756 bytes ### [Berita dan Informasi Php2shell Terkini dan Terbaru Hari ini - detikcom](detik-tag-php2shell/index.html) [original ↗](https://www.detik.com/tag/php2shell) **detikcom** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `detik-tag-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). detikcom (Indonesian), a tag page of PHP2Shell news of 22 October: it lists 'Getting to know PHP2Shell: a 20-year-old dangerous hole that can be hacke... capture 20261023T160435Z · HTTP 200 · https://www.detik.com/tag/php2shell- `headers.json` eaacf7a47cb70de6ad7dc923eec7abb30236a7839458102097e759d574716652 1,049 bytes - `page.html` 4746a87341cd6240b4a2b668b3af5953b2fa61bb1ed5c05f94be58af4dcb98e8 65,500 bytes - `provenance.json` 48351941d45a4839b2f628c1621f0056f75a9e87ada92f8750a13ffd6bc0a430 1,376 bytes - `text.txt` b2a0e44281bdb0135391f7a7f9c7b3d710951a0079dc5e801b64f7485cafc302 4,235 bytes ### [PHP2Shell: How Security Teams Should Assess and Contain the Reported PHP RCEs - DeXpose](dexpose-php2shell-php-rce-exposure-response/index.html) [original ↗](https://www.dexpose.io/php2shell-php-rce-exposure-response/) **dexpose.io** · news · secondary · captured · published 2026-10-21T04:03:07+00:00 · added by `curator@php.newsroom` · `dexpose-php2shell-php-rce-exposure-response` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T070559Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). DeXpose, 21 October: how security teams should assess and contain the reported PHP2Shell RCEs. Both flaws are scored 9.2 under CVSS v4.0; the piece is... capture 20261025T070559Z · HTTP 200 · https://www.dexpose.io/php2shell-php-rce-exposure-response/- `headers.json` e191a10ed1f29afd2b4e54e2e7080bc92c2389d9f01cbca4461f8af687c6277a 842 bytes - `page.html` f3ce966817b3e63ec5e8b35a357eaf1e2a587b15897518af249841d733f54491 43,736 bytes - `provenance.json` 39fadaada557bd72e8d91093291df131442a0cf6ab3cf29d1a12ab661bf55b8f 1,661 bytes - `rendered.html` bba4ccd75e49e1fdb7e1ba567d6a674c3fb0c9dd75450fc46c6a122d6362ee9b 44,163 bytes - `screenshot.jpg` 4c12bf4f7d4c11ab3c5a7b18433e4944ee96c072b870880aeffd730f2600acb1 758,754 bytes - `text.txt` d3c0199934656a96323b491a53c5d16deb2d6b8c26a9111e88eb4e1720e85c9f 14,867 bytes ### [AWS detectó un intento de explotar PHP2Shell cuatro días antes de su divulgación - DiarioBitcoin](diariobitcoin-tecnologia-aws-detecto-un-intento-de-exp/index.html) [original ↗](https://www.diariobitcoin.com/tecnologia/aws-detecto-un-intento-de-explotar-php2shell-cuatro-dias-antes-de-su-divulgacion/) **DiarioBitcoin** · news · secondary · captured · published 2026-10-22T15:29:51+00:00 · added by `curator@php.newsroom` · `diariobitcoin-tecnologia-aws-detecto-un-intento-de-exp` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). DiarioBitcoin (Spanish): restates Amazon's findings that its sensors recorded an attempt to exploit PHP2Shell on 17 October 2026, four days before the... capture 20261023T160435Z · HTTP 200 · https://www.diariobitcoin.com/tecnologia/aws-detecto-un-intento-de-explotar-php2shell-cuatro-dias-antes-de-su-divulgacion/- `headers.json` c55939047aeb6995898d25f9e67a6eb9449f3cd9f87bc32bc121a81ce3e03660 474 bytes - `page.html` cacc45206b8581a2101b39d27e2fabcca0941f4f78c50e36ca1176f7828c36c9 230,333 bytes - `provenance.json` fa9a3b88d337277192967a92c37c1f5aae14035c8cb0f77b1ded0def3b99b4ac 1,874 bytes - `rendered.html` 855688bc96830017ef442f08bccf878eb30fd1ace78d404e7ec713acc5347636 257,385 bytes - `screenshot.jpg` 75a1f033be6bcbeded7d4760d67e6f6df2798c1f73682c0a67326258cf428993 1,104,144 bytes - `text.txt` bbe00e86009c74e82f0327e0e6bbc52302bb3504ec515ca98b4242515519a469 15,102 bytes ### [Die PHP-Sicherheitslücke ist alt, die KI hat sie wieder ausgegraben, was sie genau ist und was noch kommt – DiePresse.com](diepresse-41383717-die-php-sicherheitsluecke-ist-a/index.html) [original ↗](https://www.diepresse.com/41383717/die-php-sicherheitsluecke-ist-alt-die-ki-hat-sie-wieder-ausgegraben) **Die Presse** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `diepresse-41383717-die-php-sicherheitsluecke-ist-a` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Die Presse (German, Austria), 23 October, 12:03: the PHP security hole is old and AI dug it up again; what it is and what is still to come. The two fl... capture 20261023T160435Z · HTTP 200 · https://www.diepresse.com/41383717/die-php-sicherheitsluecke-ist-alt-die-ki-hat-sie-wieder-ausgegraben- `headers.json` 574e0801539b91f03762f81b7f604a4245ecbbc6a579284de248b28c363cc0cc 513 bytes - `page.html` f5293180d42561f3df0b3ae6b7ea9256e7d80bb593a819a6e2d25ef77c485076 231,454 bytes - `provenance.json` 32544ae55cf2198e0d5bf3c8fb3e91c2788bf802d0eedbc9e5357fcf626325ff 1,847 bytes - `rendered.html` a30e2627ac5497d4f6d20db2f0f70f7fb8aed992b2d39f562cbb736854c8139c 193,523 bytes - `screenshot.jpg` 6a78fd561c24cca2005b6e47a701fef659bdb6ec6788640da7c5fd0b08212280 795,233 bytes - `text.txt` f6998ff009f030cc5aa035c7032038aa708ec871633b5604e0ba0b8f2bf46220 11,280 bytes ### [Stealien推出“PHP2Shell”免费在线检测服务](digitaltoday-cn-view-118322-stealien-launches-free-ph/index.html) [original ↗](https://www.digitaltoday.co.kr/cn/view/118322/stealien-launches-free-php2shell-vulnerability-check-service) **DigitalToday** · news · secondary · captured · published 2026-10-22T15:46:42+09:00 · added by `curator@php.newsroom` · `digitaltoday-cn-view-118322-stealien-launches-free-ph` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). DigitalToday (Chinese edition), 22 October: the AI security company Stealien announced a free online PHP2Shell check where users enter a site URL for... capture 20261023T160435Z · HTTP 200 · https://www.digitaltoday.co.kr/cn/view/118322/stealien-launches-free-php2shell-vulnerability-check-service- `headers.json` 8db91a3797df351435a741027fc60e684befcacaae542f2e1c93915894322633 546 bytes - `page.html` cd110497566a7502d8eb09fd2ae28267b4205bd48e285a10381194cd27ffa2b0 48,393 bytes - `provenance.json` 4b6d6bbb6f2b24c6c46471f0c4beb842cfe8a4148ae8aaaa54527a36c9d3dc63 1,793 bytes - `rendered.html` 9b5ecde4c609cdfc16b6b47688b241f888126c778b75fec95006ea454a9125dc 204,794 bytes - `screenshot.jpg` ac8e483428f6d4007bde98e3aeab1bf5e43fa3206cf1dce627b39dd36445b6d2 250,092 bytes - `text.txt` 7f84b5032782b4e06f6746e048d773e2586f5a11402bdec9fa11cbff0e1343fb 4,036 bytes ### [PHP : des failles critiques mettent des milliers de sites sous pression - Distributique](distributique-actualites-lire-php-des-failles-critique/index.html) [original ↗](https://www.distributique.com/actualites/lire-php-des-failles-critiques-mettent-des-milliers-de-sites-sous-pression-37446.html) **Distributique** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `distributique-actualites-lire-php-des-failles-critique` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Distributique (French): PHP's critical flaws put thousands of sites under pressure. It says CVE-2026-109618 and CVE-2026-109619 were found with the he... capture 20261025T120459Z · HTTP 200 · https://www.distributique.com/actualites/lire-php-des-failles-critiques-mettent-des-milliers-de-sites-sous-pression-37446.html- `headers.json` 3cde57c6d7e4c9252324a3e12e0c87823ff502047e57422ce44c0534b598f79b 485 bytes - `page.html` 9bd4e2865046e42b3457cbd1603e0c81e12f60fdaa9ecec2d4cdb436c3aaf0eb 54,035 bytes - `provenance.json` 15bed896ccde394db7eb391dfa48d3e24b27d4b53835766efd2f54143d9369ec 1,868 bytes - `rendered.html` 81b381b78951dbf82fe3a1b383205ce731e43b0ec695c5544e604a2123c4a819 167,918 bytes - `screenshot.jpg` 7e0a3d8213b8298f3370b1bb13aeb976cdb3c098d327717e420d161c6557d3de 325,658 bytes - `text.txt` dfe731b251504ae3962d90c095604261c3d0d22a0af05a59ecd00225caffa549 8,971 bytes ### [PHP açığından etkilenen ülkeler ve siteler açıklandı: İşte liste | DonanımHaber](donanimhaber-php-acigindan-etkilenen-ulkeler-ve-sitel/index.html) [original ↗](https://www.donanimhaber.com/php-acigindan-etkilenen-ulkeler-ve-siteler-aciklandi-iste-liste--211962) **DonanımHaber** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `donanimhaber-php-acigindan-etkilenen-ulkeler-ve-sitel` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). DonanimHaber (Turkish): countries and sites affected by the PHP flaw, as a list. The PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for the t... capture 20261023T160435Z · HTTP 200 · https://www.donanimhaber.com/php-acigindan-etkilenen-ulkeler-ve-siteler-aciklandi-iste-liste--211962- `headers.json` a3d3da620ec6fb3fb4275717ded1278f0cccd30b79a6fc80ef7889743fb65f68 924 bytes - `page.html` 20a1964bb333c9dc8a818bb95472c52d98f0a5abd6fb6549ae020a0565474647 281,529 bytes - `provenance.json` cd021a455751f1a5bf0efe9c5a4905534175d454ce90e7069fc5f297b9433e25 1,817 bytes - `rendered.html` 9aa1c51e007c242ab2a444dd4e18e6c695925443cb8fecfa37adf6a99215c179 369,297 bytes - `screenshot.jpg` f36db08bb99e0c78508660a0df942b843c79fc767d05f290c9b9557083a8d78f 595,999 bytes - `text.txt` b572fd822f1b7a9e49a4898e8a9fe84de0c1e17acfe9af1f13f1d6028a489b1a 11,401 bytes ### [PHP曝出代号PHP2Shell高危漏洞- DoNews快讯](donews-news-detail-8-6750596-html/index.html) [original ↗](https://www.donews.com/news/detail/8/6750596.html) **DoNews** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `donews-news-detail-8-6750596-html` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). DoNews (Chinese), a brief flash item: PHP disclosed a high-risk flaw codenamed PHP2Shell; the language underpins about 70% of websites; the flaw comes... capture 20261023T232528Z · HTTP 200 · https://www.donews.com/news/detail/8/6750596.html- `headers.json` 012ffd00fd0bfad1247511f7dd2d460ecd43ebc5ea56cc5d6c1fddf1d981dc16 868 bytes - `page.html` d66e15abc46167aac3007be95149f213807d9324a3d8dc104f8bde2dffcc5a39 37,575 bytes - `provenance.json` 46ad51ea69315112cedc7f2abda57ec97aa893dc6d5a352e99546448ab54caf2 1,579 bytes - `rendered.html` 3f0fbb065286b14942f58c5a9fc5a1d1c3c4f8daaa40d214bed0ae430fea563c 37,978 bytes - `screenshot.jpg` 8d174904138eb9df2b270da3d7c0fd01bc5a295a2fab3f4fa3b9503d134260c5 130,160 bytes - `text.txt` 440a5d4e7eba94d37e25f2650e42a34ef75530ca6279f5b0f55c62ae9b08d089 1,835 bytes ### [Just a moment...](dutchitleaders-websites-offline/index.html) [original ↗](https://www.dutchitleaders.nl/news/763189/diverse-websites-offline-door-kritieke-kwetsbaarheden-in-php) **Dutch IT Leaders** · news · secondary · blocked · published 2026-10-21 · added by `claude-story-site` · `dutchitleaders-websites-offline` Dutch: various websites offline over the PHP flaws. capture 20261022T112724Z · HTTP 403 · https://www.dutchitleaders.nl/news/763189/diverse-websites-offline-door-kritieke-kwetsbaarheden-in-php- `headers.json` 3d4ed9c4a01097923a5877669d569d5ef394a8cdbe10aac65675668a31143782 1,537 bytes - `page.html` 15b89d416c1e20625b50003213b1a4360e6045761598fec254652a1b5f3873b8 6,469 bytes - `provenance.json` 8cea400474f5ccc7e7b350c5c9cf809ccb654b95894cae6c78613d5ff0c04d1e 1,061 bytes - `rendered.html` 2f12251c8ab3b803be5a1123525fe94ec19fd2e3ad6daa9bab26759a181be3fe 7,234 bytes - `screenshot.png` 1e7419104eee208b5ba0cc5f6696749ef060e1608266268dffcbd5d925e8f5ad 20,501 bytes - `text.txt` 28f6003be69e3a9719618a62764a55d30d9d28570363ffd8126d1ef0f32a5803 75 bytes ### [No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times](eadt-minister-budget-no-breach/index.html) [original ↗](https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/) **East Anglian Daily Times (PA)** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `eadt-minister-budget-no-breach` A minister: no breach of Budget security after the OBR site was affected. capture 20261022T112742Z · HTTP 200 · https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/- `headers.json` 4262ef46e445ece7b451c5d9768be9e2c72be47dd23270284566f23c6429c24b 925 bytes - `page.html` 47c1d48da4a78b3172325945c56a5b1bbbdd826cc02ad5b208f097d735b8deb9 291,406 bytes - `provenance.json` b59efe28603612dd036d6a98ba25b7b39db79e7b4739b163b239131955e26cc7 1,163 bytes - `rendered.html` 790f7f3108d2c3fc28b38ccd146871560b9b62412b719911f578da424f7d70df 451,816 bytes - `screenshot.png` 5079181e1c5eb09fb0b82305b4599b7b3767e0da3fdd0263cb2fc25a3cd8c349 1,490,164 bytes - `text.txt` 4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc 7,475 bytes capture 20261023T160435Z · HTTP 200 · https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/- `headers.json` 83d0297c3a8f2f9c9347343b3ad37f66153be63c327a6681e2c01bc379c029d5 997 bytes - `page.html` 721e4e70a7442f2e7c44f60499e046ead870269d892af3506d5397ff8f86b799 291,512 bytes - `provenance.json` 990e6caa5c809c803e1ca362650fce8303fa3f04e5a08fca2ad68699e5961154 1,878 bytes - `rendered.html` 8dde1f7f3e326b63a3383d3e30183e58b0f72db5fe1b8fd105bac26f1dbe63f4 450,448 bytes - `screenshot.jpg` 4715046af95fa2d43afadb38bf697e8a5308dbae8168f9b6b621087033db005e 539,624 bytes - `text.txt` d54c7a0607dc0f9ff795693656f451f517480ebf179a9055eead86766a0048bc 7,891 bytes ### [PHP 취약점 악용한 대규모 사이버 공격 정황...北 라자루스 연계 가능성 capture 20261024T133450Z · HTTP 200 · https://www.ebn.co.kr/news/articleView.html?idxno=1729017- `headers.json` 8b310f192f02e997344dd3fe455e9c7a58d7396ea53a0a2d865e8b895f328177 354 bytes - `page.html` ce462a211caa367b9e6c35732c8080871011d1048d07805ee33a181455de79e0 174,948 bytes - `provenance.json` 1b0e99967ddd003c40d7411c6844de2cea5be5bba54ddbafb198ff033aa4bc33 1,671 bytes - `rendered.html` 77c65f8080e5fd4c2ff7550a041b7b8d6e4b1eee849f168915e7db8101331d6c 1,877,502 bytes - `screenshot.jpg` 6f40ebbfe7836914791e84c8aec99eba4d0300e94ef43f444f918e03e6266130 615,886 bytes - `text.txt` cfb488e3e483ee86d1b316236b5c4f466cdafeeecb821016dd136676b2346982 14,666 bytes ### [Zitec: Vulnerabilitățile în PHP sunt amplificate de inteligența artificială](economedia-zitec-vulnerabilitatile-in-php-sunt-ampl/index.html) [original ↗](https://economedia.ro/zitec-vulnerabilitatile-in-php-sunt-amplificate-de-inteligenta-artificiala.html) **Economedia** · news · secondary · captured · published 2026-10-23T11:03:29+00:00 · added by `curator@php.newsroom` · `economedia-zitec-vulnerabilitatile-in-php-sunt-ampl` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Economedia (Romanian), 23 October: Zitec says the PHP vulnerabilities are amplified by AI. It says they have been in PHP for more than ten years and t... capture 20261023T232528Z · HTTP 200 · https://economedia.ro/zitec-vulnerabilitatile-in-php-sunt-amplificate-de-inteligenta-artificiala.html- `headers.json` 0c9ce24c24951204c214ffc1f136463d76d0141e622d51e95018831579cbde21 1,644 bytes - `page.html` 6deb3f336bbe8b1312c04b40a4edc6fcc9ba52aff99f221a552b8ef21b7f0c28 130,725 bytes - `provenance.json` 1db6a03e3f4b129c380d022a950f5b75832d690859877332e41da18bf5f4e1b6 1,802 bytes - `rendered.html` d78f4cbb44de1c0679527f426f39872247d407007436b572c8246726fd97da79 190,115 bytes - `screenshot.jpg` 024462c93e26ebddbc834c5b3f4855868af1a2c100526f0ff893fa31725d99d8 744,610 bytes - `text.txt` f3b1302f35845fa712621e8974a08d666b6c2b56135382753e3016f9f464da8a 14,648 bytes ### [What is the PHP security vulnerability: The AI-found bug that made governments take websites offline - The Economic Times Video | ET Now](economictimes-indiatimes-tech-technology-what-is-the-php-security/index.html) [original ↗](https://economictimes.indiatimes.com/tech/technology/what-is-the-php-security-vulnerability-the-ai-found-bug-that-made-governments-take-websites-offline/videoshow/135121300.cms) **The Economic Times** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `economictimes-indiatimes-tech-technology-what-is-the-php-security` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). The Economic Times (a video explainer page, with a short text): a critical PHP flaw, the language behind roughly three in four websites, sent governme... capture 20261023T160435Z · HTTP 200 · https://economictimes.indiatimes.com/tech/technology/what-is-the-php-security-vulnerability-the-ai-found-bug-that-made-governments-take-websites-offline/videoshow/135121300.cms- `headers.json` 025281a6a4aa70d4482228847c2553790d30718646b251f1803c7cb635a6ebfe 3,528 bytes - `page.html` c4e3d17af794e4b993d3e39bdb701b1de505d4ef10f2c7e3a44ac61b6f9633b6 212,750 bytes - `provenance.json` 679fc77c5e92c1a2d825d83cf9cc585df93526cf612cfad14fc0d66331182a6c 2,050 bytes - `rendered.html` 22f73e18c439460c72b31d738e7da6317938321ca98eeff95dca7a38f57788e3 242,825 bytes - `screenshot.jpg` 9588f50f7b8034f514ccb4aafc2a4a2ac9001b14f6a73bd23cec7c0072be0e73 470,506 bytes - `text.txt` a7048259754b30de972772d573a3eca368f8ee827b0acfdcc318ce64d0dce735 10,959 bytes ### [Home – The City of Edinburgh Council](edinburgh-council-site/index.html) [original ↗](https://www.edinburgh.gov.uk/) **edinburgh.gov.uk** · government · secondary · captured · published not stated · added by `collector-news` · `edinburgh-council-site` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081903Z · HTTP 200 · https://www.edinburgh.gov.uk/- `headers.json` 3db91a541f2cf7c4f3d76752f43c56bef4372e62b4ac0b8f309810008b1d662b 664 bytes - `page.html` 2163dd11e33228af8669e2da021b61c265764eeb38647d58f7cd87e97ebf92c5 64,820 bytes - `provenance.json` f2805581fa9badaba2c438cbd97c178663d6cc1916480b895b8a226f492bbf06 928 bytes - `rendered.html` 409acf83e164b76627324f651cf203ea0e4bd0629fd3fe0344a5c2e7f66fe78f 85,320 bytes - `screenshot.png` 8d784233c15729623423aec71e016f26af6a8e692efe968707933fbab42d2f50 935,396 bytes - `text.txt` a1add594e2848a98ce202e01007453d32f25473f0665e95b6b5412d81665524e 2,792 bytes ### [Edinburgh council website offline as operators race to patch critical vulnerability](edinburghnews-council-offline/index.html) [original ↗](https://www.edinburghnews.scotsman.com/news/edinburgh-council-website-offline-as-operators-race-to-patch-critical-vulnerability-9302597) **edinburghnews.scotsman.com** · news · secondary · captured · published not stated · added by `collector-news` · `edinburghnews-council-offline` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081124Z · HTTP 200 · https://www.edinburghnews.scotsman.com/news/edinburgh-council-website-offline-as-operators-race-to-patch-critical-vulnerability-9302597- `headers.json` 1eb9dcef9574ab7d6866c511237c9123ad009e29f3be926d53909e2d2f33707b 1,508 bytes - `page.html` ef17d1be8aea7718c5afb4d6d207e0201d954555fee4c8a73bf4dd17f9a51937 253,961 bytes - `provenance.json` c182f93fb8230419e2b79d3b764bb790a224188e58f63e52dd0ed1e21ab57287 1,192 bytes - `rendered.html` fbd4f185d407d87293e272b53090d6617a049d4f483075b6134bd6b176bde0f2 640,085 bytes - `screenshot.png` cc000383e04351c03cf813489d560f7e4214dccc32809ab492b5a9debfe0490a 1,643,684 bytes - `text.txt` ec7b1d470016d4f655c747a0bcd2b1f77d65d6b3d9e69ccf0386e948a34178e0 9,721 bytes ### [PHP2Shell: la vulnerabilidad masiva descubierta por IA que amenaza al 70 % de las páginas web del mundo](eldebate-tecnologia-20261022-php2shell-vulnerabil/index.html) [original ↗](https://www.eldebate.com/tecnologia/20261022/php2shell-vulnerabilidad-masiva-descubierta-ia-amenaza-70-paginas-web-mundo-cns_472527.html) **El Debate** · news · secondary · captured · published 2026-10-22T09:07:33Z · added by `curator@php.newsroom` · `eldebate-tecnologia-20261022-php2shell-vulnerabil` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). El Debate (Spanish), 22 October: PHP2Shell, the massive AI-found vulnerability threatening 70% of the world's web pages. It also says the event coinci... capture 20261023T160435Z · HTTP 200 · https://www.eldebate.com/tecnologia/20261022/php2shell-vulnerabilidad-masiva-descubierta-ia-amenaza-70-paginas-web-mundo-cns_472527.html- `headers.json` dff48cf6e6525aa5d171c4b094ecdb4c587a281309266809e8b574855614f73f 545 bytes - `page.html` f323883239e79314283d518267fbb9d7f2ca8eeaa5ffcad8f11081146069bc17 130,146 bytes - `provenance.json` b5964ff84c0d1afea8ba119bb989ab9c6d260c091f7ce8d40242a69fe2e3ce90 1,891 bytes - `rendered.html` 02f77d3bc78557eb867e477176827aba956896be2dfb7568d9c8147369dd518d 188,491 bytes - `screenshot.jpg` 7fb60021e38331de4d40dad9358a35344528da6280bd46566f0b689d3786ede3 480,985 bytes - `text.txt` 2ea48e54e64b5684346929f4f02c4dc7ce17048f9f69d817c8ca3f5df0494ba9 3,712 bytes ### [Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica](elmundo-economia-2026-10-21-6ad92780fc6c83a57e8b/index.html) [original ↗](https://www.elmundo.es/economia/2026/10/21/6ad92780fc6c83a57e8b45a4.html) **EL MUNDO** · news · secondary · captured · published 2026-10-21T21:05:33Z · added by `curator@php.newsroom` · `elmundo-economia-2026-10-21-6ad92780fc6c83a57e8b` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). El Mundo (Spanish), 21 October: PHP2Shell is the name the security community gave to two critical PHP flaws in the language behind about 70% of websit... capture 20261023T160435Z · HTTP 200 · https://www.elmundo.es/economia/2026/10/21/6ad92780fc6c83a57e8b45a4.html- `headers.json` d11d72dedf488d63f338b220bf1e083a9cfc1231bb4110475e988078a75c1a29 610 bytes - `page.html` 6db702efb67e4fa11a991e973643047f7e8b7e9d2239b34ecdf0f14f38653a2d 317,491 bytes - `provenance.json` 820360a0196ec29e84b026a844ac130042696c47d62cbb1c26d2b283e4da0b49 1,723 bytes - `rendered.html` 2a8f67b0262ab69428c55fd46024af57ece81cc993d018a913b287dc5a7485dc 514,340 bytes - `screenshot.jpg` 5ae361a6732ccc588f3f9c516e034ad36f23f8ce3af612af2a590f2b9dd3581a 689,618 bytes - `text.txt` 3cb32b5c866117283422ed8245edd4c6d8d19e11e737e59bad70938792ccbfcf 14,811 bytes ### [Sitios del Estado caídos y miles de servidores expuestos: el impacto en Uruguay de la falla de PHP](elobservador-ciencia-y-tecnologia-sitios-del-estado-c/index.html) [original ↗](https://www.elobservador.com.uy/ciencia-y-tecnologia/sitios-del-estado-caidos-y-miles-servidores-expuestos-el-impacto-uruguay-la-falla-php-n6061404) **El Observador** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `elobservador-ciencia-y-tecnologia-sitios-del-estado-c` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). El Observador (Spanish, Uruguay): state sites down and thousands of servers exposed, the impact in Uruguay of the PHP flaw. Citing analysts of Team Ca... capture 20261023T232528Z · HTTP 200 · https://www.elobservador.com.uy/ciencia-y-tecnologia/sitios-del-estado-caidos-y-miles-servidores-expuestos-el-impacto-uruguay-la-falla-php-n6061404- `headers.json` 9db90204dcaee8c3358e8f555b234a5bdbb1857b37ed8176c069e49ab9ab7baf 2,615 bytes - `page.html` 85a0daffb900197c594a7c3122cfc7602a5fc793488084472c6b0e7610fdb6ff 185,017 bytes - `provenance.json` 5f42c83cb0dcb7ef5110b8de0292b675d1127e989370cc547a58fa3ea1303bc7 1,919 bytes - `rendered.html` 22b50b1d6502d24522d604b07faa6d4af3322eebc4f4a2f50582b524c2a242b2 228,769 bytes - `screenshot.jpg` 50e46684df96042430e30bdfb2be36226f9ac2f1900400d53be28f8158a7c3f8 901,080 bytes - `text.txt` 9aabf8b5b3239ac521c62e6814ec222c391c0f9b36f61f7d43bc1f5643d65f12 19,805 bytes ### [Dos vulnerabilidades críticas en PHP afectan al 70 % de Internet](elotrolado-noticias-internet-php2shell-seguridad-cv/index.html) [original ↗](https://www.elotrolado.net/noticias/internet/php2shell-seguridad-cve) **ElOtroLado.net** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `elotrolado-noticias-internet-php2shell-seguridad-cv` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). ElOtroLado.net (Spanish): two critical vulnerabilities in PHP affect 70% of the Internet. PHP2Shell is the name of two critical flaws in PHP's core, C... capture 20261025T093507Z · HTTP 200 · https://www.elotrolado.net/noticias/internet/php2shell-seguridad-cve- `headers.json` 04b017d6841f2f14b03b04d768be367e380f16178f14b7625eed156cf9b056ea 498 bytes - `page.html` 92a6af8997170384d50bd567fadeddde0d25bf9559960901fda5fc99334e7f5a 37,656 bytes - `provenance.json` 3d5e3644104a9977b671db8483d4352301cb8cc36bec22fd5dfbe68f36c5b3e2 1,683 bytes - `rendered.html` 7b121d8b5cb647805efeecf7b2c5f7536c7947cd1c03b15b1b1de35d2b8763d3 105,015 bytes - `screenshot.jpg` 956a757f9126ae2ab0ade68e4ab3cfbe8060fb9e92980ec8dcf7d7139dc90858 516,330 bytes - `text.txt` b6266f29e4a535fbeff017325a0ad5baa486e21ae801ac5579d897686ba8475a 9,308 bytes ### [Faille majeure dans PHP : Que révèle la vulnérabilité PHP2Shell ?](emarketerz-faille-majeure-dans-php-que-revele-la-vu/index.html) [original ↗](https://www.emarketerz.fr/faille-majeure-dans-php-que-revele-la-vulnerabilite-php2shell/) **EmarketerZ** · news · secondary · captured · published 2026-10-22T10:02:14+00:00 · added by `curator@php.newsroom` · `emarketerz-faille-majeure-dans-php-que-revele-la-vu` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). EmarketerZ (French), 22 October: a major PHP flaw; a critical vulnerability named PHP2Shell affects PHP and allows remote code execution; a general ex... capture 20261023T080331Z · HTTP 200 · https://www.emarketerz.fr/faille-majeure-dans-php-que-revele-la-vulnerabilite-php2shell/- `headers.json` 6bdfbfd206cd23df0b1a064214545f199a3cc596cd0edf1995e236d0654fabe7 689 bytes - `page.html` 293afe937a2dfa362effdfaf0dc3229b89dd130add9a07794f95f7f97780b3b5 95,945 bytes - `provenance.json` c8748259b7c75ab58aed930e47eaea09053408a9daf37a08d7e8d2681b2153ba 1,765 bytes - `rendered.html` 8e5376f6c447009f5ab767776e535e5161c7c4b2035a807b5fb85d2037ac3cad 1,275,403 bytes - `screenshot.jpg` 7488a969fad4e2d8268523590668b2b6cc6d62be66207165d6f18f59b9fb47eb 570,780 bytes - `text.txt` 45604732e794a96d12610b70831841c1043e1c76377dbe2eea07caf393e249a1 9,656 bytes ### [CSIRTs Network - php2shell (CNW-2026-04)](enisa-cnw-2026-04-php/index.html) [original ↗](https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md) **ENISA / EU CSIRTs Network (CNW)** · advisory · primary · captured · published 2026-10-21 · added by `collector-gov` · `enisa-cnw-2026-04-php` EU CSIRTs Network index of national advisories (date 21-October-2026). Lists ~30 national CSIRT alert links. The 'Mitigation' field still holds unfilled template text. The title has a typo: 'CVE-2026-10961'. curl got 403 from GitHub; Playwright got 200. capture 20261022T081329Z · HTTP 200 · https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md- `headers.json` 4fddd3b1827235c9608b8a4c92566f15c7fde3ea496d7a74061d64b18fdd4072 5,637 bytes - `page.html` 212f41dffb19edf392212f2ec2997428225cc9da6dbbcf1361dffc30f3ac163f 252,581 bytes - `provenance.json` ce33999aec2752cab53039232bb4a7da90a38f090b374d68f470a0f9c78f4c7a 1,052 bytes - `rendered.html` 3d40c318822605660674e8a69d6a51d523c3df892b77cd2ccf520e51bb9ad552 295,999 bytes - `screenshot.png` 0b9c0e94049921b40590086857c547bc0dea05461fad30201388de32c3f35c8e 451,547 bytes - `text.txt` dfcaa1afe1c4194c00ff2dc38b4fab496a900ce9b4e770a722b4bae96b886093 3,930 bytes ### [EPFL](epfl-site/index.html) [original ↗](https://www.epfl.ch/) **epfl.ch** · government · secondary · captured · published not stated · added by `collector-news` · `epfl-site` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081913Z · HTTP 200 · https://www.epfl.ch/en/- `headers.json` 71e94789020c6c4c4865396b8083f9363945273387a12cf1b8099331557f7763 1,985 bytes - `page.html` 4f32cdfa87dfcb2e8cefa3f66fa5fb1f7cbc051e4b857f87a6f0d17ad9def390 54,622 bytes - `provenance.json` de73766f9e91d943f5daf93228e41a6ebf70cf5e97f0b69b93a389a57e4647da 866 bytes - `rendered.html` dddeb8e3424dceed5e931abc113b9e234e486bb6d4a862e10f41f2eceb3e4cee 309,261 bytes - `screenshot.png` 9dffda66f8102b91cf8fd809c878f0efa917a63c2b0cb98488f453de43353425 1,141,176 bytes - `text.txt` 64c6b41680b8451e2b495d134a010f3ba099573dcb4896577174321e56fdcf39 2,321 bytes ### [CVE-2026-109618 and CVE-2026-109619: What we know about PHP2Shell and how to prepare | Equixly](equixly-php2shell-what-we-know/index.html) [original ↗](https://equixly.com/blog/2026/10/21/cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell-and-how-to-prepare/) **Equixly** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `equixly-php2shell-what-we-know` Vendor explainer listing exploitation as disputed and KEV as not listing the CVEs. capture 20261022T112832Z · HTTP 200 · https://equixly.com/blog/2026/10/21/cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell-and-how-to-prepare/- `headers.json` f7cf1d20d42b031e13757abae43ca1755e99a6e9bb3c4924d4b4d4a220ecc177 916 bytes - `page.html` 850a5ee9c4cc603f0e67b5b759b07fd4fa2a58589e3a5ca3c118bb52bb137f1e 69,255 bytes - `provenance.json` 9e7737082f0e4348bffb9bbee063d4618149ca26ce04c93ad349a82de0747038 1,174 bytes - `rendered.html` 5f9daf95daffe64c7e40e58452326ecada0b2a45839cc411b569ccd3d8aa0152 137,760 bytes - `screenshot.png` 4ff3a6bf1cf643f1beaea2676b32f6a8763bd97a1c958c2647e3613fdd247fde 2,260,486 bytes - `text.txt` 34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c 14,172 bytes ### [Hackers aprovecharon las vulnerabilidades de PHP días antes de que se corrigieran | WIRED](es-wired-articulos-hackers-aprovecharon-las-vulne/index.html) [original ↗](https://es.wired.com/articulos/hackers-aprovecharon-las-vulnerabilidades-de-php-dias-antes-de-que-se-corrigieran) **WIRED en Español** · news · secondary · captured · published 2026-10-22T15:12:46.767Z · added by `curator@php.newsroom` · `es-wired-articulos-hackers-aprovecharon-las-vulne` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). WIRED en Espanol (Spanish), 22 October: hackers took advantage of the PHP vulnerabilities days before they were fixed. It reports that Amazon Web Serv... capture 20261024T133450Z · HTTP 200 · https://es.wired.com/articulos/hackers-aprovecharon-las-vulnerabilidades-de-php-dias-antes-de-que-se-corrigieran- `headers.json` 69b2d63ee93a4bb43e387957092382f22a58505cc928c26ddc5182e8bb9ca2c9 1,220 bytes - `page.html` dee986650463c20f4424591eb018caa803bb2fab1f53b7e899460c27ec98edf6 797,022 bytes - `provenance.json` 5396167f1cca37b286cdfd74e0c1c02acc2ea7866fe8ca4392fb5a54a6231f13 1,830 bytes - `rendered.html` 2af4ff2e608ed6e4fc703769ea66c2f1b40bc1c43790fe255829d2277c529844 972,052 bytes - `screenshot.jpg` 24d349dfcaa84dc2756b79cf08b1ec321412bbf29e4a2cd9534501e76c6b31ef 751,948 bytes - `text.txt` 0a4f5041efb345a34ace2000a7cb2db85e3659a34d70ae2ff6ecec6669b315a9 10,218 bytes ### [Brecha no PHP já gerou milhões de tentativas de exploração, diz CEO da Cloudflare - Estadão](estadao-tecmundo-ciberseguranca-brecha-no-php-ja/index.html) [original ↗](https://www.estadao.com.br/tecmundo/ciberseguranca/brecha-no-php-ja-gerou-milhoes-de-tentativas-de-exploracao-revela-ceo-da-cloudflare/) **Estadão** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `estadao-tecmundo-ciberseguranca-brecha-no-php-ja` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Estadao (Portuguese, Brazil), a TecMundo piece: the PHP breach has already generated millions of exploitation attempts, says Cloudflare's CEO. It says... capture 20261024T083755Z · HTTP 200 · https://www.estadao.com.br/tecmundo/ciberseguranca/brecha-no-php-ja-gerou-milhoes-de-tentativas-de-exploracao-revela-ceo-da-cloudflare/- `headers.json` cb470a53618700159216e87818987b137de4f8cf57cdc1eb9fce07df26461e6f 1,896 bytes - `page.html` f42945126f989e11cfc1297d28d263fa7b52cd2aff79337d5f553912485c3981 597,210 bytes - `provenance.json` 84b1f2c9269f54aaf2f57681ac2b2114f2932efe094fae7b53fed36f45ecbb60 1,879 bytes - `rendered.html` abc900320e83cc8f416017315ccaca0a89131280509b4824d3a4f4edfb588faa 451,595 bytes - `screenshot.jpg` 32d46253bb4bf8c2e8e6d307d7714ee3b0f7a1b2248a023bbe007dde97678c72 54,287 bytes - `text.txt` 4bfa9ad84d1811f9d2339bfb91f1262762b3ccea6cdb41e51252a044e723323b 4,521 bytes ### [La llave maestra de internet: así se rompió el secreto de PHP2Shell](estrelladigital-articulo-ciberseguridad-llave-maestra-in/index.html) [original ↗](https://www.estrelladigital.es/articulo/ciberseguridad/llave-maestra-internet-asi-rompio-secreto-php2shell/20261023071000452430.html) **Estrella Digital** · news · secondary · captured · published 2026-10-23T07:10:00+02:00 · added by `curator@php.newsroom` · `estrelladigital-articulo-ciberseguridad-llave-maestra-in` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Estrella Digital (Spanish), 23 October: 'the master key of the internet: how the PHP2Shell secret was broken'. It says nobody had been hacked yet and... capture 20261024T083755Z · HTTP 200 · https://www.estrelladigital.es/articulo/ciberseguridad/llave-maestra-internet-asi-rompio-secreto-php2shell/20261023071000452430.html- `headers.json` 908470ea4974ba463a6bd50ed25ed6966de46ed6598c9f9e86c9df5568583f3e 925 bytes - `page.html` 120ba93cac25b5ed9a9467267b33cc3a22925fb0ff10fcac1f5972305c04e320 487,367 bytes - `provenance.json` 64917684c4f395707d764fe2ef679848d139d6e8bdaadd6b284dc20d85e81241 1,868 bytes - `rendered.html` 9c2b6ccbc03f7d4f3012d2db45a4fbe6ed2800493592155d8b9ba9d6446563c6 490,401 bytes - `screenshot.jpg` a2789836ef16b11ea4aef0a06e9056aa4d458e6da895ae954b935c65f8fb924c 566,565 bytes - `text.txt` 2aa02084e3172fd9ca086b65c7bb965d9b2e8ae122cc75c10d41731bcf5dbacc 9,874 bytes ### [Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche](europapress-portaltic-ciberseguridad-noticia-amazon/index.html) [original ↗](https://www.europapress.es/portaltic/ciberseguridad/noticia-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105435.html) **Europa Press** · news · secondary · captured · published 2026-10-23T10:54:35+02:00 · added by `curator@php.newsroom` · `europapress-portaltic-ciberseguridad-noticia-amazon` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Europa Press (Spanish), 23 October: Amazon detected attempts to exploit PHP2Shell days before the vulnerabilities and their patch were disclosed, acco... capture 20261023T232528Z · HTTP 200 · https://www.europapress.es/portaltic/ciberseguridad/noticia-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105435.html- `headers.json` 69bca1bdc9486e74b95a513051c6ee5b1a68d677f832461a32dcba0eacef3ad9 792 bytes - `page.html` 1861c2f91676e6ebd49f1d2a3106249afa2ef1091f1a9085ae744e3fc591cdaa 267,771 bytes - `provenance.json` b1e0e7394c4540fc1c0e6410f0a3a27a2a2ca5bbdeaa82ac094e2155d4866a45 1,983 bytes - `rendered.html` 164da68d36f4a801d8bda3a4a1e69a45475628882b4a431955b395f8aa74cddc 625,916 bytes - `screenshot.jpg` 2451b349fbd9f5a65d58f99b0f2239b0da5e74f2c7c90df73a76624fdc4bd9a6 607,999 bytes - `text.txt` a3d0f225217dc3a6578a656f30d6438fd0e87e35c0c54896e74e09ed2c7968a6 7,999 bytes ### [Understanding PHP2Shell vulnerabilities and reducing risk while you patch - Express Computer](expresscomputer-guest-blogs-understanding-php2shell-vuln/index.html) [original ↗](https://www.expresscomputer.in/guest-blogs/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch/140359/) **expresscomputer** · news · secondary · captured · published 2026-10-24T04:22:21+00:00 · added by `curator@php.newsroom` · `expresscomputer-guest-blogs-understanding-php2shell-vuln` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T110459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Express Computer (India), a guest blog of 24 October: two critical PHP vulnerabilities disclosed this week pose an urgent security and business-contin... capture 20261024T110459Z · HTTP 200 · https://www.expresscomputer.in/guest-blogs/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch/140359/- `headers.json` 28c1f7ee3a190b6f3dcc2c6570123c9454fdde10696d8ec59504fa04a2b5c319 934 bytes - `page.html` 60cc2738338f2f05d839fdd99cf4d4dc608c7e6ce4d4766967a995c8e64f39a1 206,760 bytes - `provenance.json` 2454d9918848dfd3b7176b1b0662f040b9b1ddb55067a31b6eb5b13e8d68d9b2 1,875 bytes - `rendered.html` 4cfef4f02e7af3e75142a8892a616f9a4742cf4070d530e8b3a43e1cde4c7e8b 206,047 bytes - `screenshot.jpg` bdb41debd82528360145034c462b23e6920bcd16b1442c8e752228321d64a558 548,924 bytes - `text.txt` 4ab671e782cbacdbbecffd151dc8db7e36d5d3d99047a8dca0f2c511b0b34480 6,903 bytes ### [Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastly](fastly-blog-php2shell/index.html) [original ↗](https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618) **Fastly** · vendor · primary · captured · published 2026-10-21 · added by `claude-story-site` · `fastly-blog-php2shell` Candid on exploitability (PoCs need the binary's layout on x86_64; 32-bit assume compromise), on WAF limits, on signals (segfault bursts, workers spawning /bin/sh) and on more bailout paths to come. capture 20261022T111906Z · HTTP 200 · https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618- `headers.json` 6756cb0315f3eede874eb6e0c7c5bf69e9530954bc546eed72665c7d035f47a4 1,049 bytes - `page.html` 811a842d39ce55fe1b7b9ef1e35c767deadda63bbf07044ac6d848812045d8fa 164,855 bytes - `provenance.json` ea10f0c918a09cb23072d0099d2a206b10c844041a8649ce45f3446a7229ccec 1,117 bytes - `rendered.html` beb13bda9a79b867d0b11deda470a987cd8f76186e6af59cb63333eb6d426839 327,821 bytes - `screenshot.png` 259708a035d74a2d833a8fe3a555097ecee5678d854a5e5357b94bf20566b7e4 2,470,515 bytes - `text.txt` bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f 20,043 bytes capture 20261024T133450Z · HTTP 200 · https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618- `headers.json` 2de448031ae90cd0f06fd44b637b55bdbfc8c26a1a2366b49d74ec3335313457 1,084 bytes - `page.html` 38708b00ce5a632e41ce45d1af875df5dbfc9f080568ccd906fe81b7bfb20c86 164,855 bytes - `provenance.json` bb7539f14a97855d49b935b340e081d578ccc64f505a194cb1f30a4280d5772f 1,684 bytes - `text.txt` bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f 20,043 bytes ### [PHP-Sicherheitslücken: Die wichtigsten Fragen und Antworten | FAZ](faz-aktuell-wirtschaft-mehr-wirtschaft-php-s/index.html) [original ↗](https://www.faz.net/aktuell/wirtschaft/mehr-wirtschaft/php-sicherheitsluecken-die-wichtigsten-fragen-und-antworten-accg-201610624.html) **FAZ** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `faz-aktuell-wirtschaft-mehr-wirtschaft-php-s` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). FAZ (German), a questions-and-answers explainer two days after the disclosure: the flaws are CVE-2026-109618 and CVE-2026-109619, together called PHP2... capture 20261023T232528Z · HTTP 200 · https://www.faz.net/aktuell/wirtschaft/mehr-wirtschaft/php-sicherheitsluecken-die-wichtigsten-fragen-und-antworten-accg-201610624.html- `headers.json` 3626583e141da403bdada7458433a8cdaa8369bdf1a6ea0bdc2e3a7f3dcea740 1,618 bytes - `page.html` 8d1440695e2849a7b2cddef9d4fc0034915b8df28da23457769851b1356022af 482,336 bytes - `provenance.json` 247d860c7ef0a74a89cc01d8cad39f001a5e6f3f3e361d383c29529c708a962d 1,833 bytes - `rendered.html` a1759346d9c2d976bf219e78b138d383059318f2e15e2cc2a05165125397cdb4 975,201 bytes - `screenshot.jpg` 8f760d1c2e0c6a54e1e6d8614ccedb3616738f0a86042d629488088501c2a99a 870,664 bytes - `text.txt` 92fe267dca9b3449c0e31c9285a0462253b5c3e8a5100f8a88eb2089e6b14899 14,150 bytes ### [PHP2Shell: DFV warnt Feuerwehren vor kritischen PHP-Sicherheitslücken](feuerwehrmagazin-nachrichten-dfv-warnt-vor-kritischen-php/index.html) [original ↗](https://www.feuerwehrmagazin.de/nachrichten/dfv-warnt-vor-kritischen-php-sicherheitsluecken-145590) **Feuerwehr-Magazin** · news · secondary · captured · published 2026-10-21T20:14:17+02:00 · added by `curator@php.newsroom` · `feuerwehrmagazin-nachrichten-dfv-warnt-vor-kritischen-php` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Feuerwehr-Magazin (German), 21 October: the German Fire Brigade Association (DFV) warns fire brigades of the critical PHP flaws, CVE-2026-109618 and C... capture 20261023T160435Z · HTTP 200 · https://www.feuerwehrmagazin.de/nachrichten/dfv-warnt-vor-kritischen-php-sicherheitsluecken-145590- `headers.json` 4343e8e3c662d0643f15f711b1187fa0265f4e891e8fa1c793612975b64ac697 527 bytes - `page.html` 73deba67435638699d469df6d93bdbd45f051327bc4952eba809f7b210cdace0 127,618 bytes - `provenance.json` 55232b6e109c589a7a42cb2623ec1f5441f9956f53ffe62ff209f64b5610b28b 1,802 bytes - `rendered.html` 30d772b7c32017ee4cffa1a3d3b6c73b38f943be111861907da31d2a9282cf98 139,803 bytes - `screenshot.jpg` 2279493055c685fe3147312919957eed42388c8bef83c97553cc1c35e21b5c96 552,360 bytes - `text.txt` 2e4bb7c790153416a8a1a414e7b98254ac8c709a828daad75291ec627c9edcd4 6,161 bytes ### [fi-valtori](fi-valtori/index.html) [original ↗](https://valtori.fi/) **valtori.fi** · government · primary · failed · published not stated · added by `collector-gov` · `fi-valtori` A capture of the site itself on 22 October (HTTP None, page.evaluate: Target page, context or browser has been closed), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081938Z · HTTP None · error: page.evaluate: Target page, context or browser has been closed- `provenance.json` a524455c8bce437ef41ddd72da2d3bb7ef1b59eb1d510c54e71e0c256b484215 440 bytes ### [OpenAI 发现 PHP「世纪漏洞」，全球 70% 网站都危险了_新浪科技_新浪网](finance-sina-tech-roll-2026-10-22-doc-iniwcaff5189430/index.html) [original ↗](https://finance.sina.com.cn/tech/roll/2026-10-22/doc-iniwcaff5189430.shtml) **新浪财经** · news · secondary · captured · published 2026-10-22T19:19:18+08:00 · added by `curator@php.newsroom` · `finance-sina-tech-roll-2026-10-22-doc-iniwcaff5189430` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Sina Finance (Chinese), 22 October: OpenAI found a PHP 'flaw of the century' and 70% of websites worldwide are at risk. Two days earlier the informati... capture 20261023T160435Z · HTTP 200 · https://finance.sina.com.cn/tech/roll/2026-10-22/doc-iniwcaff5189430.shtml- `headers.json` 704ad2ca5b1bb257266951211d9ec5a3a61f767d4701535a1c9019766454ea06 1,400 bytes - `page.html` 61af69bae7d24210c53e78ba76a05dab88d65073e91e0eee2e237a4cb5f3193c 121,966 bytes - `provenance.json` d960354ec8369469ead6219415f4b10797bbc4b4be6e55abae7475c73cab30b5 1,741 bytes - `rendered.html` fac3a680fb51175664d7428af47ca6602f1d3ae1e091326ac8f7f230238f5056 123,166 bytes - `screenshot.jpg` 23954f5d351351e34b1bfc4366c16ece3569f5f70ab7e79b2e62b31d3de5cbd8 62,232 bytes - `text.txt` a474233db211afbb34f3aee62b3bd9a33bf9547a2321e7e8c1a93ce150443972 9,943 bytes ### [PHP patches critical flaw hitting 70% of websites; Cloudflare, others surge](finance-yahoo-technology-articles-php-patches-critical/index.html) [original ↗](https://finance.yahoo.com/technology/articles/php-patches-critical-flaw-hitting-151052535.html) **Yahoo Finance** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `finance-yahoo-technology-articles-php-patches-critical` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Yahoo Finance: PHP patches the critical flaw hitting 70% of websites, and Cloudflare and other stocks rise. The flaws were patched in four simultaneou... capture 20261023T160435Z · HTTP 200 · https://finance.yahoo.com/technology/articles/php-patches-critical-flaw-hitting-151052535.html- `headers.json` 01ae1bcf8baf3ccf182c4aac70f93aa13d374e1d5cf5ea957852fb640d7e8596 34,236 bytes - `page.html` 377179150738d87537b9a1cc5f31e81e1920ea4c3002debed12d0cc6d55d8a04 884,861 bytes - `provenance.json` 1bbf3e7d8ee54bb7190a0873a7e3a9c67aa95a1a70c65c0a79a4dab42894e3d1 1,794 bytes - `rendered.html` e68fce99fe71acb07e6be68a2c9001b0c223e647a28a05eed3f7683cbd401b40 970,830 bytes - `screenshot.jpg` 47afc2589b5b03ca5da94428306a340aebce0a7e16cd8a22d8cce1a5a63e7961 289,590 bytes - `text.txt` 6184216b6515747eacf47d15fc849c279be07c7171cb9f89bd4506bec27d4727 3,867 bytes ### [Vulnerabilitatea PHP este vizată de milioane de accesări. Autorități europene au oprit preventiv site-uri](financiarul-tehnologie-vulnerabilitatea-php-este-viz/index.html) [original ↗](https://financiarul.ro/tehnologie/vulnerabilitatea-php-este-vizata-de-milioane-de-accesari-autoritati/) **Financiarul** · news · secondary · captured · published 2026-10-22T13:30:16+03:00 · added by `curator@php.newsroom` · `financiarul-tehnologie-vulnerabilitatea-php-este-viz` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Financiarul (Romanian), 22 October: millions of accesses target the PHP vulnerability and European authorities shut down sites preventively. It reprod... capture 20261023T160435Z · HTTP 200 · https://financiarul.ro/tehnologie/vulnerabilitatea-php-este-vizata-de-milioane-de-accesari-autoritati/- `headers.json` d168518e422747bcb1922b1a0809239d98a225ff0b3e8773518fa5114a08b231 1,740 bytes - `page.html` b55295da9cdb343766f532adabae3252f0c4e7f798a706e17d7a4efbed5736c0 81,372 bytes - `provenance.json` 2fc9138a23b4ae04140de5c507e0422d5fa1f69a54a3b72182657d8b4b9c7dd9 1,689 bytes - `text.txt` f8b89d5d99ae3c99d87b1774f07ef25ed93a2ee1488d0d085a7bd426ff7ed3cd 5,368 bytes ### ["우리 홈페이지도 위험할까"…파이오링크, PHP 취약점 점검 페이지 공개 - 파이낸셜뉴스](fnnews-news-202610230856366360/index.html) [original ↗](https://www.fnnews.com/news/202610230856366360) **파이낸셜뉴스** · news · secondary · captured · published 2026-10-23T08:56:37+09:00 · added by `curator@php.newsroom` · `fnnews-news-202610230856366360` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Financial News (Korean), 23 October, from Newsis: the Korean security vendor Piolink opened a 'php2shell emergency check' page on its website to help... capture 20261023T232528Z · HTTP 200 · https://www.fnnews.com/news/202610230856366360- `headers.json` b47b8454f3c993f13ba1a6c1f31e3ce9324dff6ab4158a439c394b6729bf32fe 1,566 bytes - `page.html` 5047291144a180160a310a105732e860ece7ce9f59f2ab1c9acb24ef30c363af 71,342 bytes - `provenance.json` 86e220bd6f389b8c7e733aa6b54d1e4e5468eb686c2d357034ee269a7414eb81 1,626 bytes - `rendered.html` c74b9eed4fd754a5a9e8147f7ca67d362afd7c556ae4411b6ca624640b52bb2f 100,689 bytes - `screenshot.jpg` 5d4ad3b5e78d626540a90ac5ba8f192f6192514923fa012b691a1fd6751953a5 410,968 bytes - `text.txt` eb7a8f436f5a0a0d06e14fe2efb33a684440441a230eaad7f89ad73df08e8125 7,331 bytes ### [Yapay zekayla keşfedildi: PHP güvenlik açığı neden önemli? - Forbes Türkiye](forbes-teknoloji-yapay-zekayla-kesfedildi-php-g/index.html) [original ↗](https://www.forbes.com.tr/teknoloji/yapay-zekayla-kesfedildi-php-guvenlik-acigi-neden-onemli) **Forbes Türkiye** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `forbes-teknoloji-yapay-zekayla-kesfedildi-php-g` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Forbes Turkiye (Turkish): found with AI, why the PHP flaw matters. It quotes Wiz's researchers in their blog that these findings are among the most se... capture 20261024T133450Z · HTTP 200 · https://www.forbes.com.tr/teknoloji/yapay-zekayla-kesfedildi-php-guvenlik-acigi-neden-onemli- `headers.json` 886390069e4e45a68f660aabdf5e0495b1d98d11ab0ae19a4e383dfc8dfb2421 355 bytes - `page.html` 5932d271eaf6f7a00fe0c77b1df7346c86cbb27eab009fd9105458c052f1c55f 175,893 bytes - `provenance.json` 4c50996c818e3b67b5f64dc1b75f1cced2f79299c9e3f3b3fe9e167e8c7914cb 1,625 bytes - `text.txt` 4f3904974e5da87fcc8f3c01f941500c942ea5b1ba6a7555dd9f040e054e13f1 8,241 bytes ### [「PHP」の“致命的”な脆弱性2件が修正、ただちにアップデートを - 窓の杜](forest-watch-impress-docs-news-2150167-html/index.html) [original ↗](https://forest.watch.impress.co.jp/docs/news/2150167.html) **窓の杜** · news · secondary · captured · published 2026-10-22T00:00:00+09:00 · added by `curator@php.newsroom` · `forest-watch-impress-docs-news-2150167-html` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Forest Watch / Mado no Mori (Japanese), 22 October: the two critical PHP vulnerabilities are fixed and users should update at once. It gives the GHSA... capture 20261023T160435Z · HTTP 200 · https://forest.watch.impress.co.jp/docs/news/2150167.html- `headers.json` 1931d4ecc99161b29d3be9e6e430ab40b24897d28bfb7fd20271c008d20687a8 286 bytes - `page.html` d4331c90de2ca208ccc03b262e4b9b72dedb07a5bb7da2254c0547cd3e500c47 140,297 bytes - `provenance.json` aba77746f77bcedc3e0180915ee1f9a0c15ebf309e31c814e649737e1d9dfa32 1,583 bytes - `rendered.html` c7a8b71a559ebdc6273ade7606c592d0ffa971028b6b16a314d1e403bf420f43 301,846 bytes - `text.txt` 2d34bf9e8eb8f53f0c68b54cf568eb6366c896eed1cddea63c1a1be2110da52a 13,325 bytes ### [PSIRT | FortiGuard Labs](fortinet-fg-ir-26-186/index.html) [original ↗](https://fortiguard.fortinet.com/psirt/FG-IR-26-186) **Fortinet** · vendor · primary · captured · published not stated · added by `curator@php.newsroom` · `fortinet-fg-ir-26-186` Promoted from the source watch (oq9gflln), snapshot 20261022T191713Z. Fortinet investigation and product status (primary) capture 20261022T191713Z · HTTP 200 · https://fortiguard.fortinet.com/psirt/FG-IR-26-186- `headers.json` b5fc379c961afb5b761eec930d09fc2bca76fdfa529536804adf20b2c81bb962 2,122 bytes - `page.html` c9f8832a001bf9eb296b5d7d3b4796f4e34e2843d6ddd238f141993944c37b9b 103,438 bytes - `provenance.json` 2da4895b7972284d959f5a12404efa148e8a9b638cf6c6621160b7bc09a7e053 1,547 bytes - `rendered.html` 6032cffb5942e5d75091a6cc30d4c842d8206af5e4e64b1e89e928300459e3e8 96,822 bytes - `screenshot.jpg` 64d162eaae299990dfa73cdda8a3e505228359e3aaeabb32e278ebb5b0f0a627 196,340 bytes - `text.txt` 9143f822233ec0825da53d15f088af72cc826cdb87501af1322f4904dcf2ea9a 2,650 bytes ### [How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community](fortinet-fortiweb-php2shell/index.html) [original ↗](https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750) **Fortinet Community (FortiWeb knowledge base)** · vendor · primary · captured · published 2026-10-22T07:55 (article time, timezone not stated) · added by `claude-story-site` · `fortinet-fortiweb-php2shell` FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates. capture 20261022T112039Z · HTTP 200 · https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750- `headers.json` a0454c866ef8c53658075dd181e88a1d6f0387b633b7e59fcf740b5254c0e7d0 823 bytes - `page.html` d5bc4f5c0a9b665b7bdc4d37c6adebfca47aaab1f93795c3a0551393e25a2531 789,605 bytes - `provenance.json` ddfff2dafe3e00768857136f2f89239b03664e07eaf4a3282e1552b2b1d65ec1 1,150 bytes - `rendered.html` 2d8aabfc30d2116425651b788f2c8e4d58122738b69721391022332ab628815b 1,208,805 bytes - `screenshot.png` 03a275af997e6093c4700503437ee405b77df000307b546eda109ddb0f40acff 826,331 bytes - `text.txt` 66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4 6,244 bytes capture 20261023T160435Z · HTTP 200 · https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750- `headers.json` 53b226bb38f7e8750ac404fad4841b7110fc68e61e7677c40f634b572be20150 894 bytes - `page.html` 04063f9a65d03481164eeb0bf0ae0b4ea584df94bd87f1e919128fdcc8ff56b9 825,162 bytes - `provenance.json` dda6106dcb7d23ff42bf247988986832049169226171ecf8f0e4dfcaf6a40a76 1,742 bytes - `text.txt` d5dfb171e3d0266dfc385d0fe93d6547af86f2b0024bef8ba6e6a165247697a7 6,392 bytes ### [AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune](fortune-ai-tools-php-vulnerability/index.html) [original ↗](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) **Fortune** · news · secondary · captured · published 2026-10-21 (URL date; updated 22 October per the page) · added by `curator@php.newsroom` · `fortune-ai-tools-php-vulnerability` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): an anonymous sta... capture 20261023T012042Z · HTTP 200 · https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/- `headers.json` 02c444c26c3d0f3f1095630d1581deff98ab74328b387d4f28d8f55b6f7277ca 1,256 bytes - `page.html` cd967fa20c098c9ad5adc7efb498607c1cbaa17dabf496d151ee77c8ffb52fe7 468,302 bytes - `provenance.json` 1f99d4968da56a802c82b84801d19d52733755fded99aea1c3d1b0cf120d2296 1,874 bytes - `rendered.html` e65edc6aefa8fb6f947050a3d812d9c5d66b6731c13e0846ea39417e8527ddfc 453,260 bytes - `screenshot.jpg` 071bd30ee33cd70590c2d462392b28f9c974558bd7f95b7814f83a1956ed6fac 558,797 bytes - `text.txt` cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808 11,029 bytes ### [PHP2Shell, il bug che poteva mandare in tilt il 70% dei siti mondiali. Ecco cosa è successo - Fortune Italia](fortuneita-2026-10-22-php2shell-il-bug-che-poteva-m/index.html) [original ↗](https://www.fortuneita.com/2026/10/22/php2shell-il-bug-che-poteva-mandare-in-tilt-il-70-dei-siti-mondiali-ecco-cosa-e-successo/) **Fortune Italia** · news · secondary · captured · published 2026-10-22T07:43:57+00:00 · added by `curator@php.newsroom` · `fortuneita-2026-10-22-php2shell-il-bug-che-poteva-m` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Fortune Italia, 22 October: the bug that could have crashed 70% of the world's sites, what happened. Citing the Wall Street Journal, it says the vulne... capture 20261023T160435Z · HTTP 200 · https://www.fortuneita.com/2026/10/22/php2shell-il-bug-che-poteva-mandare-in-tilt-il-70-dei-siti-mondiali-ecco-cosa-e-successo/- `headers.json` 7329894ba31eb86608f9169abc6228d6bcca552910337d5977752923f1927918 1,508 bytes - `page.html` f8b5169e5a20fd9d70587f122ca324f45c30f525ccd8e31a7d15818f2cb650e5 250,871 bytes - `provenance.json` 3ca4f42628d783a5e6681a5ee6754c57cbc829d8f65eb4bcbc9b1a4d3d8b2d1e 1,883 bytes - `rendered.html` c8902cac65780b70934d03fa8235dbead79d92882e5a2211c6eeb86ff058378f 251,807 bytes - `screenshot.jpg` fe59dffb1ffc5d2ba691c854557e58f7927c73bbbd9e54d57b02d9a16dc05d95 523,800 bytes - `text.txt` 4014537ea808b1aa819511f5788459d3029e05e66f1d2ff1835b8176cf2d1911 5,934 bytes ### [Accueil - France Titres (ANTS)](fr-ants-down/index.html) [original ↗](https://www.ants.gouv.fr/) **ants.gouv.fr** · government · primary · captured · published not stated · added by `collector-gov` · `fr-ants-down` A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081939Z · HTTP 200 · https://www.ants.gouv.fr/- `headers.json` 3a8b686eaad61ad3c1166c5a557b643d60cf33b41d6f3b36da8500ba6f8df09a 448 bytes - `page.html` 0a3fbbc3089a9497aac6380d9ebe9a45effda4cb1339b1a03e0a16cfce2ce7f1 222 bytes - `provenance.json` c823c1300f78d7baec58e9965ee9e7b5b8d7a2c69e363951f201833daf553c85 961 bytes - `rendered.html` 441259fbdac1ceaf407a56a24a7b5e8f5e5c86b846587c2a6e86a73bbab1fc24 2,565,821 bytes - `screenshot.png` 9149cf7d9bc4fdc8ee7c7413c754d4bc9d60e979eebfe736f13e2a232f95197b 526,676 bytes - `text.txt` 7e5c2700ea66b9047b95730e581b84900e9a80c99e7f7aaba270f8840cd1db04 3,337 bytes ### [fr-interieur-down](fr-interieur-down/index.html) [original ↗](https://www.interieur.gouv.fr/) **interieur.gouv.fr** · government · primary · failed · published not stated · added by `collector-gov` · `fr-interieur-down` A capture of the site itself on 22 October (HTTP None, page.evaluate: Target page, context or browser has been closed), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081938Z · HTTP None · error: page.evaluate: Target page, context or browser has been closed- `provenance.json` 7dc87fec965083beeac47ac408eaf6c86e405e70d4b393f3bccfc51a7583039e 458 bytes ### [fr-ppolice-down](fr-ppolice-down/index.html) [original ↗](https://www.prefecturedepolice.interieur.gouv.fr/) **prefecturedepolice.interieur.gouv.fr** · government · primary · failed · published not stated · added by `collector-gov` · `fr-ppolice-down` A capture of the site itself on 22 October (HTTP None, page.goto: Target page, context or browser has been closed), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081939Z · HTTP None · error: page.goto: Target page, context or browser has been closed- `provenance.json` 9230a0d6e075c2454a4e97c83ce614bc0bd184ba8af16c76ea5aea23a6325dc7 471 bytes ### [Site en maintenance | Les Services de l'État](fr-prefecture-nord-down/index.html) [original ↗](https://www.nord.gouv.fr/) **nord.gouv.fr** · government · primary · captured · published not stated · added by `collector-gov` · `fr-prefecture-nord-down` A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081940Z · HTTP 200 · https://www.nord.gouv.fr/- `headers.json` 29cb6331cf00cd335fa38386f85d1dd1812ecba458b235679f31f5793b2efa4c 94 bytes - `page.html` ef6f28223628c5de2e03d6a6579bfb1298a9528970063f00fd96f464c5d06d94 4,199 bytes - `provenance.json` 1f5059bc03a54444a169ce5d0ae12285bc1c92dd76bc2f3f504616729e130aca 928 bytes - `rendered.html` 271a758211ac1eed716bbc27902260eb62e7dea8b54e7856f2c3d76290ee2dc0 3,893 bytes - `screenshot.png` 405a1f823fb044886b626bd8af9aa1931c7b93bcc850ac68c4e39cbbaac7fd89 30,298 bytes - `text.txt` 72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678 140 bytes ### [Site en maintenance | Les Services de l'État](fr-prefecture-rhone-down/index.html) [original ↗](https://www.rhone.gouv.fr/) **rhone.gouv.fr** · government · primary · captured · published not stated · added by `collector-gov` · `fr-prefecture-rhone-down` A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081939Z · HTTP 200 · https://www.rhone.gouv.fr/- `headers.json` 29cb6331cf00cd335fa38386f85d1dd1812ecba458b235679f31f5793b2efa4c 94 bytes - `page.html` ef6f28223628c5de2e03d6a6579bfb1298a9528970063f00fd96f464c5d06d94 4,199 bytes - `provenance.json` 9a65cec4c7c60bd05a1e0f81e3bbbb8ebdfa841ad86f936ba481de0cff685dd3 931 bytes - `rendered.html` 271a758211ac1eed716bbc27902260eb62e7dea8b54e7856f2c3d76290ee2dc0 3,893 bytes - `screenshot.png` 405a1f823fb044886b626bd8af9aa1931c7b93bcc850ac68c4e39cbbaac7fd89 30,298 bytes - `text.txt` 72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678 140 bytes ### [MP Government Websites Vulnerable To 'PHP2Shell' Cyber Threat; NIC Issues Critical Security Advisory, MP CERT Reports No Damage So Far](freepressjournal-bhopal-mp-government-websites-vulnerable/index.html) [original ↗](https://www.freepressjournal.in/bhopal/mp-government-websites-vulnerable-to-php2shell-cyber-threat-nic-issues-critical-security-advisory-mp-cert-reports-no-damage-so-far) **Free Press Journal** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `freepressjournal-bhopal-mp-government-websites-vulnerable` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Free Press Journal (India), 23 October: several Madhya Pradesh government websites face potential risk from the critical PHP flaws; the National Infor... capture 20261024T133450Z · HTTP 200 · https://www.freepressjournal.in/bhopal/mp-government-websites-vulnerable-to-php2shell-cyber-threat-nic-issues-critical-security-advisory-mp-cert-reports-no-damage-so-far- `headers.json` 9aec3612eb77dc808970ee319e7fde235a2f4ad53843bb5132c35df7a962aa86 631 bytes - `page.html` a63d9c3c95e9f4b0424e13e2f2813418dbfa9c608d80d80df26845ce531411aa 107,840 bytes - `provenance.json` 8871e0e5f035525c67ab1532f6563626ad35f3a13908ab937bd267bbba6f7ba7 2,008 bytes - `rendered.html` 1df9e9b50831e0b35ac62399c3d7ed0adaf7fb36e7e320a632f3e71fe2406aa7 154,686 bytes - `screenshot.jpg` 1271e303b2cf7b530262443b65574d8a02bb864a6094c356efe6160776f11915 431,310 bytes - `text.txt` 4e22ee510279ded17cee486b6da5fda541000b4ae5faa53c533f509b4424e91f 5,247 bytes ### [PHP 취약점에 게임사들도 비상, 점검에 서비스 종료까지](gamemeca-view-php/index.html) [original ↗](https://www.gamemeca.com/view.php?gid=1782184) **게임메카** · news · secondary · captured · published 2026-10-22T09:58:42+09:00 · added by `curator@php.newsroom` · `gamemeca-view-php` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Gamemeca (Korean), 22 October: game companies on alert over the PHP flaws, from maintenance to ending service. It says the PHP team published fixed ve... capture 20261023T160435Z · HTTP 200 · https://www.gamemeca.com/view.php?gid=1782184- `headers.json` eb1c210458c6ba6031cb0accf2fa0e8e1a78c104822ce42779481ee969f3d648 572 bytes - `page.html` e0febde2cf556a9e553732431b6de30248e6841b6d75cbc0e63dd5832f5e5ceb 86,676 bytes - `provenance.json` 2645ad738ad6f60a96b42fccf8ee53994f8ec74405b02ea08ffc161555ccb4b7 1,542 bytes - `rendered.html` 2f9e80d6f78cf11964cf0438e50773163552cfb7287c21231bbd701682e9c84b 694,058 bytes - `screenshot.jpg` 310628b3aeab9cf0a32ae25ca8281ffc54bbbeeb89aa107871121d24feb1d05c 481,639 bytes - `text.txt` c47586fec7f1de5d6b6d62bffc73da995db772e9c1cfe79c02062003efc64003 7,106 bytes ### [Allarme PHP2Shell, vulnerabilità gravissime: cosa rischiano i siti web - Gazzetta del Sud](gazzettadelsud-articoli-cronaca-2026-10-22-allarme-php2/index.html) [original ↗](https://gazzettadelsud.it/articoli/cronaca/2026/10/22/allarme-php2shell-vulnerabilita-gravissime-cosa-rischiano-i-siti-web-d9a6ca69-af70-4a0e-8f28-ae2f0da7e1f0/) **Gazzetta del Sud** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `gazzettadelsud-articoli-cronaca-2026-10-22-allarme-php2` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Gazzetta del Sud (Italian), 22 October: PHP2Shell alarm, very serious vulnerabilities, what websites risk. It says that on 21 October the European Com... capture 20261023T160435Z · HTTP 200 · https://gazzettadelsud.it/articoli/cronaca/2026/10/22/allarme-php2shell-vulnerabilita-gravissime-cosa-rischiano-i-siti-web-d9a6ca69-af70-4a0e-8f28-ae2f0da7e1f0/- `headers.json` 909fbc20ac3ad45c7b3be5caf830d29a5a9acbbd0d283953eb22b446379f9e14 1,336 bytes - `page.html` 681e98efe16cfa65cfa9ab515c794ba59c00fe06aa221c383120ec992dcd5ddd 86,650 bytes - `provenance.json` 69f85d21514afcce414f637a1956a3f19e2d41f5ddb746f0507a8fb373efc0a6 1,940 bytes - `rendered.html` 0e7de05c202f5c69250e9dd7b016f683eac38b892f220c4af79e29d79f3ec52d 260,863 bytes - `screenshot.jpg` 69284764681ec20c3f0550ce067de5bf40f5dfb5db1c47c0e410b56b60aa0000 448,898 bytes - `text.txt` 05b6ec66781b50c4b8eebbcfcb3ce3bf468040a437d5ccbc143d21d1327122d9 5,591 bytes ### [PHP2Shell : l'IA est à l'origine de la découverte de la faille qui ébranle le Web](generation-nt-actualites-php-faille-securite-php2shell/index.html) [original ↗](https://www.generation-nt.com/actualites/php-faille-securite-php2shell-ia-cybersecurite-2083236) **Génération NT** · news · secondary · captured · published 2026-10-22T09:12:15+02:00 · added by `curator@php.newsroom` · `generation-nt-actualites-php-faille-securite-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Generation NT (French), 22 October: AI is behind the discovery of the flaw shaking the Web. Security researchers armed with AI models uncovered the cr... capture 20261023T160435Z · HTTP 200 · https://www.generation-nt.com/actualites/php-faille-securite-php2shell-ia-cybersecurite-2083236- `headers.json` f5ada47e765e1695f676c3118763269c6476d9a39f7e93e63af7e07e942dbdc3 767 bytes - `page.html` d05791a8849bf225d0acf8f04359dc30b276962a412e1a3632f49d05effa03c8 114,235 bytes - `provenance.json` cf1ec1e1d8fa0ab70e3377872e03f0ffb7b319f8000e827b4f8237828924db6f 1,806 bytes - `rendered.html` 25365379e41c1e46a8b62b8f5371d444714aa319a448dc19648afe8e581691e8 334,189 bytes - `screenshot.jpg` bc0e0c91e346467304fd2b6ffef6272a22d019e6d1700af449643afcf746d3dc 580,636 bytes - `text.txt` 4b8aee1bfcc45a92682822fe7c08bd162f7384267ddb4fab9329bd95ed29cf61 8,126 bytes ### [「PHP2Shell」脆弱性公表後に悪用試行が数百万件単位に増加したとCloudflareが報告、顧客向けには新ファイアウォールを開発して有効化 - GIGAZINE](gigazine-news-20261023-cloudflare-stats-php2shell/index.html) [original ↗](https://gigazine.net/news/20261023-cloudflare-stats-php2shell-attempts/) **GIGAZINE** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `gigazine-news-20261023-cloudflare-stats-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). GIGAZINE (Japanese), 23 October: Cloudflare reported that exploitation attempts, only thousands before the disclosure, exploded afterwards and reached... capture 20261024T083755Z · HTTP 200 · https://gigazine.net/news/20261023-cloudflare-stats-php2shell-attempts/- `headers.json` 838aa535d9edb86b22e9bab6c8e27a52ec60ea26239c8838e6fca408442cfeb4 747 bytes - `page.html` c2b3e9b39260b423a4038133e28a2c9c30470b8913fda04ea6d4a5c84beb3519 106,622 bytes - `provenance.json` e441d768669f6d49174a8f4b29651c1402fc35d5b68f331fb6f0c334160bf345 1,823 bytes - `rendered.html` 4516eedc8e37d930dd85b4b9fb0a25c4581dd497a0cff2db97ec97b565982cfb 140,655 bytes - `screenshot.jpg` 1b75520a84e4644e5a6494a12fc8c33d8540c3366329fac42bc18bff26add82f 564,983 bytes - `text.txt` 1900395d021799bc4584b9c1cfe73c7cbe1398b4400cbb028c250cf8a646eda8 11,857 bytes ### [Failles critiques de PHP, des millions de tentatives d’exploitation ont eu lieu - GinjFo](ginjfo-actualites-politique-et-economie-failles/index.html) [original ↗](https://www.ginjfo.com/actualites/politique-et-economie/failles-critiques-de-php-des-millions-de-tentatives-dexploitation-ont-eu-lieu-20261022) **GinjFo** · news · secondary · captured · published 2026-10-22T08:06:34+00:00 · added by `curator@php.newsroom` · `ginjfo-actualites-politique-et-economie-failles` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). GinjFo (French): the PHP2Shell patches did not stop attack attempts. Cloudflare observed thousands of attempts in the ten hours before the disclosure... capture 20261023T160435Z · HTTP 200 · https://www.ginjfo.com/actualites/politique-et-economie/failles-critiques-de-php-des-millions-de-tentatives-dexploitation-ont-eu-lieu-20261022- `headers.json` 9a43fa3bc52ae3266ec8da480e4ed443cf30f8b60d31d8a671b51b5bd511140f 593 bytes - `page.html` f04231468c9a3f16683b53522c7ffcf856fa88889390bf8ed1ef1b5fd5df047c 153,825 bytes - `provenance.json` 475541a6301f424321d5667024a78597f52620918b6807a2ef75c49488291474 1,883 bytes - `rendered.html` 65760cb6c538efa6b5312aeadc94811d825d82ced951754258c39351784e1042 194,135 bytes - `screenshot.jpg` 03ad6ffc8db4b3f2784479063a2bc411d652c098ef0cf8cde9cd1ab3bd01ab50 367,524 bytes - `text.txt` 2f3ad2216d74d748ae145aeef7475257028d93e8d8c143a54817095503a2a28d 4,360 bytes ### [PHP2Shell: Detection Opportunities · GitHub](gist-blevene-detection-guide/index.html) [original ↗](https://gist.github.com/Blevene/472692937d05145d29d17dc3c6edc2a0) **Blevene (GitHub gist)** · code · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `gist-blevene-detection-guide` The most detailed detection guide found: verified ModSecurity tripwire on the upload-progress field, Sigma rules for the arm-phase fatal ('in Unknown on line 0'), FPM segfault correlation, Falco worker-exec rules, and the arm/fire success receipt in the access log. capture 20261022T112029Z · HTTP 200 · https://gist.github.com/Blevene/472692937d05145d29d17dc3c6edc2a0- `headers.json` e515879745065efa3f6d82ddfddf934b4dd0528d08c9cd4686517a7909ad53a9 5,398 bytes - `page.html` 638f078193990b68d231d7f9d70c8090f0fa5ea1c6f17144ce040e86005b0e0e 172,916 bytes - `provenance.json` b55dcda494ff7fa675bdade5d18cd9c720a7f4c91f3c8902067bb528fe41a621 1,010 bytes - `rendered.html` e632d2722b6bc2f11dae20c788c7c087967ff8b1617f9e49874b67f34f3ccbc7 171,073 bytes - `screenshot.png` 40cb4bc63512079ac9f9922051f970143f708fe8f10a7839fdf8f3a8cebe109d 2,916,589 bytes - `text.txt` e87c134fef2ac6dadce17cc4b2ede04888da65e4c1939814c3e2acc5683ddb81 28,797 bytes ### [PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 ) · GitHub](gist-silascutler-censys-query/index.html) [original ↗](https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9) **Silas Cutler (GitHub gist)** · code · secondary · captured · published not stated · added by `claude-story-site` · `gist-silascutler-censys-query` A Censys query for php2shell exposure. capture 20261022T112841Z · HTTP 200 · https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9- `headers.json` 07517141f85eb8c967f82ff329f3ec582d07ba06c068b4f69137e6f1b1bbc2bd 5,405 bytes - `page.html` 6efd8ea91d0aeff2abdb43f40fb4a5695eacdbc5720b7a18c6746858dc3e2b89 126,486 bytes - `provenance.json` bfd64368239f0a7cf7a26eac489eda86effc8c0e4c6b09653d8eaa7a838bc2aa 1,044 bytes - `rendered.html` d31d94a0e67d4acc2f75d4548fd7bc98b0259d143eb16ec35ff1181b6f3fc0c6 124,729 bytes - `screenshot.png` fdcd80585ae0e06e894d974485b23ecf187fa65cc7195ccf17f13486b9c5782a 122,357 bytes - `text.txt` 5cea858eacc35a20d7943cf8334baad5fa8b37ed7f19ecbf3416f489935edd49 1,361 bytes ### [GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub](github-darkfibr-php2shell-detect/index.html) [original ↗](https://github.com/darkfibr/php2shell-detect) **darkfibr (Mike Haddock), GitHub** · code · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `github-darkfibr-php2shell-detect` Community detection toolkit: Suricata/Snort rules keyed on request shape (upload-progress field + many array parts), YARA for the public PoC, estate checker. capture 20261022T111956Z · HTTP 200 · https://github.com/darkfibr/php2shell-detect- `headers.json` 0032162778e9e13e6056d409874d38d891d76817b61b685b8cac6978d0946ff1 5,443 bytes - `page.html` 47a54e3191d2665698e13d8dd3b157f63a32f0565ae7755ea8bfb9634774ac91 287,088 bytes - `provenance.json` 1d8350230abbd90feb1f18d64a3d02b15f7b35d71914d26d2207c18cb626d091 1,143 bytes - `rendered.html` e0597533f94146958614e519387471deb149af84b19ea359e01dbd50d4dddbcf 305,777 bytes - `screenshot.png` eb849fd1179b14a53199521fd46cca0b26c498292d2553acc0d976e79b0e03a7 748,563 bytes - `text.txt` 3592ec9f3bb73cd3a91f3fd0c698fb45375984c5c0326bbcb4f7f7c36b2b8f73 7,156 bytes ### [RCE via stale global state (CVE-2026-109619)](github-ghsa-6wmf-4rv5-p3rp/index.html) [original ↗](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) **PHP (php/php-src GitHub security advisory, published by bukka)** · advisory · primary · captured · published 2026-10-21T13:34:13Z · added by `collector-primary` · `github-ghsa-6wmf-4rv5-p3rp` CVSS v4 9.2, same vector as 109618. Use-after-free of worker global state across requests. Confirmed RCE mod_php (PHP 8.5 fatal_error_backtraces path) and session upload progress path on mod_php and FPM. GitHub API blocked; timestamp from page. capture 20261022T080901Z · HTTP 200 · https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp- `headers.json` 9474439a8ed75c50ba02584a2c67a564bf208b0caa8b2aefe0d7d2704e46c263 5,440 bytes - `page.html` 93ff984c03081442f47f1c338683875fabf1741564d711e2a3862d71cef29fdd 221,023 bytes - `provenance.json` ab199ddc3636b44804bf4b7da3949fe9d22f000959f8fc04c7f00eb3e416a0bb 1,039 bytes - `rendered.html` 89eb250785b0066130856745323cc48cd37a515b3264c10da91dfee64deb45cb 222,855 bytes - `screenshot.png` bb279a6b633c6e9d1de5a4778673aa4b3ed7dc5e1a1d9f08a3ba27c30f99820a 1,024,722 bytes - `text.txt` 99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc 13,502 bytes ### [RCE via OOM corruption (CVE-2026-109618)](github-ghsa-w8hw-w9fx-j79w/index.html) [original ↗](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) **PHP (php/php-src GitHub security advisory, published by bukka)** · advisory · primary · captured · published 2026-10-21T13:34:25Z · added by `collector-primary` · `github-ghsa-w8hw-w9fx-j79w` CVSS v4 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Affected capture 20261022T080901Z · HTTP 200 · https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w- `headers.json` a5b68bac81984833a0df448856c563c0abaaf285f4eac25b6fc9a01c0b4d705f 5,447 bytes - `page.html` f429f17d81fee9dced4234a3f88772e1a7fdb87170b5bf5e3c6a016758b2a14e 212,571 bytes - `provenance.json` bb24fb081f4677b9fb91aac8bf728da3b708aec4d694572ccf432df9c0e5162b 1,035 bytes - `rendered.html` 79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110 214,403 bytes - `screenshot.png` 4e10459ced9f68c1f9fb25ce9f8c603fad05b9e1981b2b9de3c10c16ade86d77 535,897 bytes - `text.txt` 84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4 6,692 bytes ### [GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub](github-lexsah-php2shell-detection/index.html) [original ↗](https://github.com/Lexsah/php2shell-detection) **Lexsah, GitHub** · code · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `github-lexsah-php2shell-detection` Blue-team rules (YARA, Sigma, Suricata SIDs 910961801-803, ModSecurity, Falco, auditd) and the server-level session.upload_progress.enabled=Off mitigation. capture 20261022T112009Z · HTTP 200 · https://github.com/Lexsah/php2shell-detection- `headers.json` 25e99ec6775270a84bcecf5a232634c2e640ef9246b469967311c1240df22dd7 5,436 bytes - `page.html` 6151205973ed45a3e00af67742bf708f8d42f4caf1171c1b5671e024b730bdbb 288,052 bytes - `provenance.json` 2560ba2b32e6f1ea7e5feb0e81a7b6db2855392524862a91661362e6410175ca 1,077 bytes - `rendered.html` 14e642e4e762e427c9bd8be65bfd45e0d8e2a3289c65ab7c197e197cc9077a66 301,999 bytes - `screenshot.png` c5300a3f00d8c04d057f920a6e8ceb48282544a99c967bd855027483a7a4ffc9 779,281 bytes - `text.txt` 10b6edf13054c98d5da298e7bdc04a654d2e0a7fa7fa820047a7996a4887c25e 7,136 bytes ### [Branch PHP-7.4-CVE-2026-109618-109619](github-php-src-branch-7.4-backport/index.html) [original ↗](https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619) **php/php-src on GitHub** · code · primary · captured · published 2026-10-18T18:10:24Z · added by `collector-primary` · `github-php-src-branch-7.4-backport` Unofficial minimal source backport for EOL 7.4. '1 commit ahead of ... master'; latest commit 'Avoid state corruption via bailout', commit date 2026-10-18T18:10:24Z. The 8.0 and 8.1 branches are not captured (same naming pattern). capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619- `headers.json` a849a6e452711b855043ae9fe1fd0982b11d14633681acc628fa56e60ceb8323 5,439 bytes - `page.html` 04dcda73bc626ce33da19b196795fd7c00b63b030f9fd6a530acedcbbe4f2b77 363,416 bytes - `provenance.json` b879f4cb8fe1d72fc30175af0e12496f9df0b4e09ce90b1de15b99d1e8ed29fc 1,040 bytes - `rendered.html` f6eba14e4661be71a25a3f70b5e988478a727cc6ea78f657fe86284d54d727fd 412,706 bytes - `screenshot.png` 6a7c4e4d30f1cb137b32490feb57c7053ca293f0f59d4aada14082309c525f0a 759,378 bytes - `text.txt` bd71e98ee89b7c6ca97f0ec6029e0200f86d26f2528387a96c99ac93ea63dc1f 6,550 bytes ### [Commit 3584a98bd: Avoid state corruption via bailout (the php2shell fix) and the PHP-7.4 backport 712e60f9e](github-php-src-fix-commit-3584a98bd/index.html) [original ↗](https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19) **php/php-src (git), read from a clone** · code · primary · captured · published 2026-10-18T15:26:39Z (authored); 2026-10-21T14:06:22Z (committed) · added by `claude-story-site` · `github-php-src-fix-commit-3584a98bd` git show output of the fix commit (stat, file list, engine/main/session hunks), the 7.4 backport commit and patch, and the merge path to PHP-8.5, from a shallow clone made 22 Oct 2026. SHA256SUMS in raw/. 389 files, +10689/-976; authors Arnaud Le Blanc with Ilija Tovilo, Jakub Zelenka, Nora Dossche, Nicolas Grekas. raw, 7 files with SHA256SUMS- `commit-3584a98bd.NEWS.diff` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 - `commit-3584a98bd.engine-main-session.patch` 26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84 - `commit-3584a98bd.files.txt` d9b8465ccfbd22fa5bcd5f1a8c58c11b4af70befe488051f843fd4f45bf559b5 - `commit-3584a98bd.stat.txt` 0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4b - `commit-712e60f9e-PHP-7.4-backport.patch` 307e49f52c4f3829e75ce82697b81c6ab771deb7ce0c8ce961159e40026866da - `commit-712e60f9e-PHP-7.4-backport.stat.txt` 7f5e6289ca2d1a14b2be78ca230e2077f3d5f695bb9d52087773e3df2633e7f0 - `merge-path-3584a98bd-to-PHP-8.5.txt` 81c3025511c2f4744d1fcbe1d18fe7da97cfd68b005a6a883efc229a3c91193f ### [Release PHP 8.5.12](github-php-src-tag-php-8.5.12/index.html) [original ↗](https://github.com/php/php-src/releases/tag/php-8.5.12) **php/php-src on GitHub (release by adoy)** · code · primary · captured · published 2026-10-21T14:06:46Z · added by `collector-primary` · `github-php-src-tag-php-8.5.12` GitHub release published 2026-10-21T14:06:46Z by adoy; tag object 2026-10-21 13:35:38 UTC; tagged commit dated 2026-10-19T17:04:37Z. capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/releases/tag/php-8.5.12- `headers.json` 5c5686f2496a1b93d144afdd699626ee85dc4af2813a242dbf615446ddb664eb 5,448 bytes - `page.html` 67ce23eedb690c74470175cf0a56c7a573cbd02ec5f27120c3ced5d05fa5eb3b 207,502 bytes - `provenance.json` 8e480c6bdb33a1d5e82ddf99493ac5149329b2ab40d2fe95c088ba4b9672832a 990 bytes - `rendered.html` 330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa 214,534 bytes - `screenshot.png` ca5cc2bad8c65a0a5325554ef804f2b83d3fc7a4b7e9c2750dfd7047e564208c 123,213 bytes - `text.txt` 3fa0b4ca147ee06698f340ee959bf381aee7c0fda597bd687ff1f128f4978799 1,184 bytes ### [Tags · php/php-src](github-php-src-tags/index.html) [original ↗](https://github.com/php/php-src/tags) **php/php-src on GitHub** · code · primary · captured · published not stated · added by `collector-primary` · `github-php-src-tags` Tags php-8.5.12, php-8.4.27, php-8.3.36, php-8.2.35 all show 'Verified' and tag dates of 2026-10-21 13:35:38 UTC; php-8.6.0RC4 at 14:57:44 UTC. php-8.5.12RC1 and php-8.4.27RC1 tags also exist. capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/tags- `headers.json` c1e8341353ae8ccbb1b8406734139fd6ade271a8ecb16de19cc396443719b543 5,449 bytes - `page.html` 9dd05842513d6ae6569812a9aad0f4abef35733b14f8515c3b86b3d1fac53d49 279,656 bytes - `provenance.json` fb3a77d83afa6bbbffbf5b0dba33cf24208559ef6dafc50b4fe37998fd225316 928 bytes - `rendered.html` ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9 281,310 bytes - `screenshot.png` 9208f3cecdd6dd08a577e0172d3a114ac84322533de8e95591e5b0694b085eda 125,085 bytes - `text.txt` 850531b6512cfe4d37a2bb6b7fdcd37ec9cbb42ed6ceea172d081be054e28c61 924 bytes ### [GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub](github-rjmendez-phpup-2026/index.html) [original ↗](https://github.com/rjmendez/phpup-2026) **rjmendez, GitHub** · code · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `github-rjmendez-phpup-2026` Detection rules rewritten on 21 Oct after a lab reproduction showed the leaked PoC's mechanism did not match the fix; cites VulnCheck: none of the public PoCs has the correct mechanism. capture 20261022T112003Z · HTTP 200 · https://github.com/rjmendez/phpup-2026- `headers.json` 582bbe71ccaa5a3323db8d3d2caec68f5af4561fd8b8b29bd932cbea2126e5cf 5,445 bytes - `page.html` e7e78dc79587fcaf7eac2ce0b48d90575d55f6fdb4313b768f0637f7a5d8ff0c 275,240 bytes - `provenance.json` 7500ba6175c9e2f09a379b74a283542b6e7e4e637714a2006f0e68a86c44b348 1,048 bytes - `rendered.html` 7bb4a810ad56f4620b7e1f2b14591c31b935a76a017c72cae93435ef05b8d088 302,107 bytes - `screenshot.png` a69607bd90cb0667ecdd5ab2e0191ae6c1534b599824084514dbcc1055712cde 940,580 bytes - `text.txt` 84742b6e86fb259d4db36361e86d4b739c6cd09184337f365f5e2958271f5379 9,221 bytes ### [PHP2Shell : cette faille majeure menace des millions de sites, faut-il s'inquiéter ? | TechRadar](global-techradar-fr-fr-computing-internet-php2shell-cette/index.html) [original ↗](https://global.techradar.com/fr-fr/computing/internet/php2shell-cette-faille-majeure-menace-des-millions-de-sites-faut-il-sinquieter) **TechRadar** · news · secondary · captured · published 2026-10-23T12:55:00Z · added by `curator@php.newsroom` · `global-techradar-fr-fr-computing-internet-php2shell-cette` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). TechRadar France, 23 October: 'this major flaw threatens millions of sites, should you worry?'. PHP2Shell means two recently discovered vulnerabilitie... capture 20261024T083755Z · HTTP 200 · https://global.techradar.com/fr-fr/computing/internet/php2shell-cette-faille-majeure-menace-des-millions-de-sites-faut-il-sinquieter- `headers.json` c5d7212208026db20811af79cd1fb93080bd8ade932c0df05a922c26f0e8c423 2,315 bytes - `page.html` 062cc391d9d36c3af94db6d708973ca63125e5523928b4b00f376dcb93bf6867 1,236,210 bytes - `provenance.json` 2fbee44c5225a23a159f88e37aed79043fba1048b96847a772c816dca791185c 1,899 bytes - `rendered.html` 2d5a48eb011ad6f2b2e29b535f44f3f4809b11dae68661b268b1ebff8bf5a3c2 1,368,571 bytes - `screenshot.jpg` 3c108076144ac915904f6f32adf1558913e9c06c135a52382d069169545e8f6e 702,542 bytes - `text.txt` 41a90ee3a9b2b60958d67f284d679ef26e56cba133e055b8cfa4a878cd2f7f8e 14,452 bytes ### [Ottawa taking down some federal websites over critical global vulnerability - National | Globalnews.ca](globalnews-ottawa-sites/index.html) [original ↗](https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/) **globalnews.ca** · news · secondary · captured · published not stated · added by `collector-news` · `globalnews-ottawa-sites` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081641Z · HTTP 200 · https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/- `headers.json` 3ca16762cb530a7381a789bfc088e122e6def06f38e9ea491f51fa91b00d1039 1,247 bytes - `page.html` f8be121063104c5bba4690a17d1b54eb8ce9ea1281b3e164b1fc4fe7c9f86b87 328,580 bytes - `provenance.json` f9fbf0f2893919b24df4ffcee19026399d3510b4cb555b1e6668c573d7ed9e2b 1,142 bytes - `rendered.html` 13874eedb62c81b7afcf3028b4c61858f5efe21fda76b7a02d53b631d4500085 357,724 bytes - `screenshot.png` c6264dead5508467c41b7c442d261bf34cf473033bbe6b342c780b59703429f0 1,859,701 bytes - `text.txt` 87d2ae5079c3620bd0b22f78e743865d283f1915fde2bc8badc1b1c56daf2ae8 7,761 bytes ### [Cyber Security Services Launches Free PHP2Shell Check for Website Owners - Green Bay Press-Gazette](greenbaypressgazette-press-release-story-197263-cyber-securit/index.html) [original ↗](https://www.greenbaypressgazette.com/press-release/story/197263/cyber-security-services-launches-free-php2shell-check-for-website-owners/) **Green Bay Press-Gazette** · news · secondary · captured · published 2026-10-23T17:14:02+00:00 · added by `curator@php.newsroom` · `greenbaypressgazette-press-release-story-197263-cyber-securit` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Green Bay Press-Gazette, 23 October: a syndicated press release (EIN Presswire) from Cyber Security Services, a Columbus cybersecurity consulting firm... capture 20261024T083755Z · HTTP 200 · https://www.greenbaypressgazette.com/press-release/story/197263/cyber-security-services-launches-free-php2shell-check-for-website-owners/- `headers.json` 9a39a333507fbcc5c89b01ac1fc10b013a60aa016976c8b4477284f81a0b1358 2,527 bytes - `page.html` 7838a72da2d6d8c2f85ea77e9faa3ab5327cdab1f6234906188b8a00947256ee 51,131 bytes - `provenance.json` 02c6a05dbfc740dda90559982c752ae5537d2041320602e35491551f590090ed 1,920 bytes - `rendered.html` acb30ccaf77b8d7c8d7532e2e2ae73d4de3693f08652880bab0eaba2fa411556 51,460 bytes - `screenshot.jpg` c1d596edbc9da2646e4ed6d85107a71c1897875f589f862451a83e7958779f7a 355,875 bytes - `text.txt` 700ae7ce50163c9ad762a6411dca4389e83ef09725c2686ceaa80844a5d0c9d3 5,319 bytes ### [What is PHP and how serious is the computer language flaw causing website shutdowns? | Data and computer security | The Guardian](guardian-wikipedia-ref-40-ge-flaw-causing-global/index.html) [original ↗](https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns) **The Guardian** · news · secondary · captured · published 2026-10-22T16:42:23.000Z · added by `curator@php.newsroom` · `guardian-wikipedia-ref-40-ge-flaw-causing-global` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). The Guardian, 22 October: what PHP is and how serious the flaw causing website shutdowns is. It says sites in Canada, Japan and Germany were taken dow... capture 20261025T114552Z · HTTP 200 · https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns- `headers.json` e3f3b89fd0fcf57d8f184ef95f69bd71d64a2f17536ea0f04c0c1099b8cc2432 3,753 bytes - `page.html` c8fbc745f9c6267a2cbf2a65cbab04ed49e93815f3647c1f568b3c05ccca5d4b 548,842 bytes - `provenance.json` 583acebd1d1d1a99ada4329c9743b0a00579c907504ccc434dcb3554722e1e53 1,871 bytes - `rendered.html` 8f8d7c88abb65102927d785b219b47f0db13a7fa7198c5683a79eca0cb2e82cf 575,986 bytes - `screenshot.jpg` abe9f1b91ffa3649f4eaee3276b915425b41859ce181aeb62053a204fb7edfb4 848,074 bytes - `text.txt` 42e1b49234f03f2417c4a904de5f988c6c1fec4e61e8752e1a5605bf75534691 10,747 bytes ### [Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor | Haber.com](haber-teknoloji-siber-guvenlik-baskanligi-ndan/index.html) [original ↗](https://www.haber.com/teknoloji/siber-guvenlik-baskanligi-ndan-php2shell-aciklamasi-e-devlet-kapisi-guvende-hizmetler-kesintisiz-suruyor-29322) **Haber.com** · news · secondary · captured · published 2026-10-22T09:40:54.300Z · added by `curator@php.newsroom` · `haber-teknoloji-siber-guvenlik-baskanligi-ndan` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Haber.com (Turkish), 22 October: the Presidency's Cybersecurity Directorate says nationwide preventive measures against the PHP2Shell risks were put i... capture 20261023T160435Z · HTTP 200 · https://www.haber.com/teknoloji/siber-guvenlik-baskanligi-ndan-php2shell-aciklamasi-e-devlet-kapisi-guvende-hizmetler-kesintisiz-suruyor-29322- `headers.json` 1abc5d38558f9c38852a8f79ccb5e80f7fdba10b2f57d703842a4e7eef8a6a8d 2,605 bytes - `page.html` 68c81fad10eabeea9fd14eb051f14ea08ce3bc53c2480200b7dcd3e84a40359c 181,974 bytes - `provenance.json` 98afb98a78ea0bbedf960ca4e620dbb66511a19177a372ed0fa732bf9d176d8e 1,926 bytes - `rendered.html` 65672f53fd75c7e1d187995bfab8ed2ada2ddf5bdf9153d9eb4fa723d61103f2 353,789 bytes - `screenshot.jpg` c536ff88079d18729488673a8f62e1c91bd21aed0249909276ee3eb1a972abbc 677,102 bytes - `text.txt` 2825ea23dc0ee99dad084b327460a78610b626aa1f93bcd95017881a08fbcea9 12,513 bytes ### [PHP güvenlik açığı interneti tehdit ediyor: e-Devlet ve bankalar riskte mi? - Haber 7 TEKNOLOJİ](haber7-teknoloji-haber-3670492-php-guvenlik-aci/index.html) [original ↗](https://www.haber7.com/teknoloji/haber/3670492-php-guvenlik-acigi-interneti-tehdit-ediyor-e-devlet-ve-bankalar-riskte-mi) **Haber 7** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `haber7-teknoloji-haber-3670492-php-guvenlik-aci` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Haber 7 (Turkish): the PHP vulnerability threatens the internet, are e-Devlet and banks at risk? PHP2Shell alarms with a 9.2 risk score; the Cybersecu... capture 20261023T160435Z · HTTP 200 · https://www.haber7.com/teknoloji/haber/3670492-php-guvenlik-acigi-interneti-tehdit-ediyor-e-devlet-ve-bankalar-riskte-mi- `headers.json` 2ba1ddeea8f86b7f1eba34db6cc93b05d75f6a624af4959a209f88cef49d0a4d 522 bytes - `page.html` b6e706b362e803625b876680bd6853f710caa9faeff1c66a4e1d9ebda4c3f51a 95,810 bytes - `provenance.json` 6cc979e1ee167ab97d297067e61368589a69a05c4731ac3fe3517f8f676962bd 1,848 bytes - `rendered.html` c5317e309093c1030ba22faab1d45e421a3eba56e8e642a91d75af6da88ffdce 102,513 bytes - `screenshot.jpg` e076ecf23b3b3f7574d7286487976d170e6c38a68c83c9c63baf6475afc1fadd 338,627 bytes - `text.txt` e844eed779d6ace717bbe34e3cedbfcad31d51416cca0858119bfdcff899caba 4,053 bytes ### [北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제](hankyung-article-2026102423207/index.html) [original ↗](https://www.hankyung.com/article/2026102423207) **한국경제** · news · secondary · captured · published 2026-10-24T11:02:46+09:00 · added by `curator@php.newsroom` · `hankyung-article-2026102423207` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Korea Economic Daily (Korean), 24 October: reconnaissance activity exploiting PHP2Shell spotted in a closed network. It reports that the Singapore thr... capture 20261024T133450Z · HTTP 200 · https://www.hankyung.com/article/2026102423207- `headers.json` 4f66c884c3592b6701c47dd1d8a9bdb30e409bca8fab57f9887915f899546052 471 bytes - `page.html` e4bffbd69eead0a1a760d581a330a26e6bc1ff7f711725841ad5dd6da448ed43 99,338 bytes - `provenance.json` bc1e3d4cdfc8562700fcac9e8f1ff65156ab4e2e574ffd1927b83ee8eabfc316 1,615 bytes - `rendered.html` e7a1561f51a0a6709558a29b4fff05e6e58015b8a5426cbf5cb0af359dc51c2b 218,173 bytes - `screenshot.jpg` bd1b4f549a4fdb7b177506b0ac650d0df994ef7f5b458d3366996d0f487e82ec 322,131 bytes - `text.txt` 45e966bc2d1e536c2425f5330889db94abff79d1612b22589b95648277284a1c 7,407 bytes ### [Failles PHP critiques (PHP2Shell) : les correctifs sont sortis, mettez à jour maintenant](hardwarecooking-failles-php-critiques-php2shell-correcti/index.html) [original ↗](https://www.hardwarecooking.fr/failles-php-critiques-php2shell-correctifs-publies/) **HardwareCooking** · news · secondary · captured · published 2026-10-21T20:13:55+00:00 · added by `curator@php.newsroom` · `hardwarecooking-failles-php-critiques-php2shell-correcti` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). HardwareCooking (French), update of 21 October: the PHP team published emergency fixes for two critical flaws nicknamed PHP2Shell; the fixed versions... capture 20261023T160435Z · HTTP 200 · https://www.hardwarecooking.fr/failles-php-critiques-php2shell-correctifs-publies/- `headers.json` b21f072b795a2b8e4167423a1973830f663064a5c7ead005c1a8d06fea14309e 477 bytes - `page.html` e91867fd69d44228af43202e961742499efafaf8118213e77d81e33af50f830f 490,127 bytes - `provenance.json` 111afb0f4dfae871149fcff33caa1e39492ffa8ad79d2ad7c66270bbdf9b4756 1,770 bytes - `rendered.html` ec8a965a17a6e1397c99696f1e601c027759943bf0ea24741a9df691b8841f03 496,204 bytes - `screenshot.jpg` 1d132361237178b45fe2b95bbbf1db2e931834bc331c209dd6f8a114ed66c0b9 589,171 bytes - `text.txt` 59df94f7bc6f0ab08f18933a41783a119fa2be0bf702dd62f4df164d7ed2bdc0 8,728 bytes ### [에버스핀, PHP 치명적 취약점 공격 차단 규칙 적용…“공식 패치 전 대응”](hellot-mobile-article-html/index.html) [original ↗](https://www.hellot.net/mobile/article.html?no=115738) **헬로티** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `hellot-mobile-article-html` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). HelloT (Korean): the Korean vendor Eversafe (Everspin) says it applied a blocking rule for CVE-2026-109618 and CVE-2026-109619 to its web-security Saa... capture 20261023T232528Z · HTTP 200 · https://www.hellot.net/mobile/article.html?no=115738- `headers.json` 8f27567eebb8bd527620ba121c3ec4c1c421c1b76d91870f396e25656ebf6510 898 bytes - `page.html` a9cd6fe2b739c3e610de66a8944e405b2ed509c434b8c098453975572f6f6736 60,722 bytes - `provenance.json` 65b44057cf3c28e1d83343480a21c7fadfab02c9f5c27d12551c18b6b6e4c2ad 1,607 bytes - `rendered.html` b668310d0341a4cc301cca6f403626f02bba4fa364350d6d62eeec83ddfc3bcc 70,511 bytes - `screenshot.jpg` e99732f9ac0a29b0795e879d982e0bb22ebc21a761ab59d6b4824224fbf05616 403,367 bytes - `text.txt` ba8cd797bd851f3f42a88107c5be3afd9e5d3d6538e3e2d0f9a0ea46bf9c38a4 6,226 bytes ### [New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security](helpnetsecurity-2026-10-22-php2shell-scanner-tool/index.html) [original ↗](https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/) **Help Net Security** · news · secondary · captured · published 2026-10-22T12:03:17+00:00 · added by `curator@php.newsroom` · `helpnetsecurity-2026-10-22-php2shell-scanner-tool` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Help Net Security, 22 October: Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to the two flaws... capture 20261023T160435Z · HTTP 200 · https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/- `headers.json` a5c5b62675013f65abaeaf35a391ecec4042c122ba7e6a0eca46d4e6b1947352 1,070 bytes - `page.html` 36d3c37cbd30df62d85a0a399f4caf86ca4045067228eb27489e6cb5e3013174 86,469 bytes - `provenance.json` 55c1045efe48516c97cf73863500e5ae2aaa7140cae91ebec2a19cb6f02e67b8 1,557 bytes - `text.txt` 5af2786ae142ccb6bf69b7d7f2280c3cd37897cfd64aa72586b09b43c1532368 5,011 bytes ### [Government websites shut down in Finland over critical security flaws - Helsinki Times](helsinkitimes-finland-shutdown/index.html) [original ↗](https://www.helsinkitimes.fi/finland/finland-news/domestic/29412-government-websites-shut-down-in-finland-over-critical-security-flaws.html) **Helsinki Times** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `helsinkitimes-finland-shutdown` Valtori began restricting incoming public traffic at 12:45 local; patch scheduled 17:00 Finnish time; restore after checks. capture 20261022T112845Z · HTTP 200 · https://www.helsinkitimes.fi/finland/finland-news/domestic/29412-government-websites-shut-down-in-finland-over-critical-security-flaws.html- `headers.json` 8cfe23a4571454de0ce2c8804eef8e57888689f139258fc400bc4074345e22c4 1,424 bytes - `page.html` aae25312014733334061a2a0cedc5e7a800cfd4d711717e78fe9f492a1923fb1 74,712 bytes - `provenance.json` 616d5f35071adec7fda82e308c994ebebbe96580f9f0d09c2ca595e95eca3565 1,204 bytes - `rendered.html` 86c43a2ba4b2b595bc14316aefdf8f5d08736e778a980690075033168a6258ec 155,636 bytes - `screenshot.png` 9c23d876698ad3081c6ac7846ed601a071d01e5b57de834755b1ef846cc2d26a 701,429 bytes - `text.txt` 524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118 6,660 bytes ### [Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek](hirstart-hk-20261023-php2shell-teendok-nas-okon-t/index.html) [original ↗](https://www.hirstart.hu/hk/20261023_php2shell_teendok_nas-okon_tuzfalakon_es_kontenerekben) **Hírstart** · news · secondary · captured · published 2026-10-23T11:13:04Z · added by `curator@php.newsroom` · `hirstart-hk-20261023-php2shell-teendok-nas-okon-t` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hirstart (Hungarian), 23 October: critical PHP vulnerabilities allow remote code execution and emergency fixes have arrived. The two flaws known as PH... capture 20261024T160544Z · HTTP 200 · https://www.hirstart.hu/hk/20261023_php2shell_teendok_nas-okon_tuzfalakon_es_kontenerekben- `headers.json` 2db7370fdab40bc9a9a4acdae3c2c5b230c6e95413991805d84e27fd31d57978 465 bytes - `page.html` 1006cf7188a8ab3d687f180726d550bf2874a5272fa182a3041fc21735221d09 59,671 bytes - `provenance.json` d151f3c553342126780dbdc75d6aa359c820dddc2dcd4d14f6336af02b31e682 1,802 bytes - `rendered.html` c48ec79c64dae358f4aa21af151a988954dab1f40f721bc7242ba0ccd9166274 101,084 bytes - `screenshot.jpg` c41822fdf6b30319321b96b661bf4516286cdf9c834a48e9106708cda3613729 138,042 bytes - `text.txt` ab29456ac75278c1be923d0c72c710d4c6cf502363c548d622d8e48ce7a69fc2 1,858 bytes ### [Your favorite websites are down due to an internet-breaking PHP security flaw](howtogeek-sites-down/index.html) [original ↗](https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/) **howtogeek.com** · news · secondary · captured · published not stated · added by `collector-news` · `howtogeek-sites-down` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081803Z · HTTP 200 · https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/- `headers.json` ac1300d5bc9c199bf479be95f33a4939aba8b6f5d29bd87c5dd9f2bd7a1c7b4e 3,627 bytes - `page.html` 60b8a3bd8b3a31dee5eb2f99f4cdce0153e463a0c7f5dcc79189ea108fc9f9ae 282,466 bytes - `provenance.json` 2cbaf467287d1420c18817f1b1b4257ed2c58ec119d691654b1329b118e80881 1,113 bytes - `rendered.html` 7285bee583a2028e859815011ff311cdc7cd58e833cd2db577fbf150f92e4889 291,892 bytes - `screenshot.png` c74fddd0b93069d97b4424669c834a62d22e29d7a49e65463c24cfcce3689f02 1,518,193 bytes - `text.txt` fc428f513db5fdc848312aa42f77bb2464902cdfa826e007e7d23427a88a6a2b 5,511 bytes capture 20261023T160435Z · HTTP 200 · https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/- `headers.json` 0b01abadd3f45a837d2687e0401b89e9ea8af1aa7fbd80e1f9962f2cd34e86d0 3,627 bytes - `page.html` 458c67d8cda9735bce0d28b6cefe194768f0ecb7f2d9174bea5b36f41d151836 282,202 bytes - `provenance.json` 6684042b125695ae4c9d676c5bceca540bb049802844f586d6073305bdad49cb 1,676 bytes - `text.txt` 7e375f5c40040efb08b9809c1a0362d976bfa6e0930146a8920d79d1e06e3e66 5,565 bytes ### [Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress](huntress-php2shell-rapid-response/index.html) [original ↗](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) **Huntress** · vendor · primary · captured · published 2026-10-21 · added by `claude-story-site` · `huntress-php2shell-rapid-response` As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code. capture 20261022T112853Z · HTTP 200 · https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities- `headers.json` 39dd8f8ed13d1e993a95f88bddf69702d0cd23e3aef38da50d65068f495d1cff 7,379 bytes - `page.html` 39d79180c85ccbc63f3acbf3bb0f076d56933f94e5fa8a5be8dafc3ca3160c7a 913,455 bytes - `provenance.json` 23031a4937921ef79d80fb4b2546b9d7054028e640b9babec2c44d9f66dee0a2 1,102 bytes - `rendered.html` 41e5af59038a7155953c6809d743ca579e2eeb7cdc503f13f6e3550ea920d970 1,115,188 bytes - `screenshot.png` a4d89c5787921c4fe23ea13f25dc2d0104756a669450c44aad83ad220d9bc3a7 1,862,920 bytes - `text.txt` a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c 17,843 bytes ### [PHP-säkerhetshålen 2026 – Så skyddar du din webbplats](hurbra-php-sakerhetshal-2026-guide/index.html) [original ↗](https://hurbra.se/php-sakerhetshal-2026-guide/) **hurbra** · news · secondary · captured · published 2026-10-22T14:53:25+00:00 · added by `curator@php.newsroom` · `hurbra-php-sakerhetshal-2026-guide` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hurbra (Swedish), 22 October: how to protect your website against PHP2Shell. Two serious PHP flaws have triggered millions of attack attempts against... capture 20261024T160544Z · HTTP 200 · https://hurbra.se/php-sakerhetshal-2026-guide/- `headers.json` 19067a6975a705a791b1fdc795ad42c5e391f548820bd8d19c56a6b5f28ed2f9 494 bytes - `page.html` 3cdffff33179169fcb9d522eed72db209f6dc6050b659e01192d6f24c271d6a5 360,072 bytes - `provenance.json` 33de32f890517cdb9149f3d377d173538fde38cd9bfc44262d82b3368a9925f2 1,584 bytes - `rendered.html` 3bcb2d77a52c7c1dd746d0f5dd1351be2dcf979fc08069ceb404e68317679583 370,547 bytes - `screenshot.jpg` 42360f32ea42ee4deb279570af1021ada5a1d2b729f84e518441713b72bc3c99 40,200 bytes - `text.txt` 99d0f54ec7049dd27c291e6ed2455327ac9172d5f5b0ec6510db7d007fbccf39 22,447 bytes ### [Dünya genelinde siber güvenlik açığı: PHP programlama dilinde sorunlar tespit edildi! Küresel çapta devlet siteleri geçici olarak kapatıldı - Hürriyet Son Dakika Güncel Haberler](hurriyet-dunya-dunya-genelinde-siber-guvenlik-aci/index.html) [original ↗](https://www.hurriyet.com.tr/dunya/dunya-genelinde-siber-guvenlik-acigi-php-programlama-dilinde-sorunlar-tespit-edildi-kuresel-capta-devlet-siteleri-gecici-olarak-kapatildi-43350466) **Hürriyet** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `hurriyet-dunya-dunya-genelinde-siber-guvenlik-aci` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hürriyet (Turkish): worldwide security hole in PHP; government sites were temporarily closed globally. It says security experts found the two flaws wi... capture 20261023T160435Z · HTTP 200 · https://www.hurriyet.com.tr/dunya/dunya-genelinde-siber-guvenlik-acigi-php-programlama-dilinde-sorunlar-tespit-edildi-kuresel-capta-devlet-siteleri-gecici-olarak-kapatildi-43350466- `headers.json` ed96f9d37b883eb52a7e8344e42b5ef245fcde11662b2d4ef95011f9a432fbff 1,036 bytes - `page.html` 169d81bb84fd1ca1097d4f9721416ebecaf0b51f5b68fd80ff5e816400c621a3 133,196 bytes - `provenance.json` 022d559710a8dd7a2fed83696a57857e8b414972dae2be106ffea566c1280bf7 2,065 bytes - `rendered.html` 2336c6ca3be5d2171d640690eb6aa2d9eb0e54de376b400cee9e0334d500d5bf 169,215 bytes - `screenshot.jpg` 59171c4cafd691562e89c6911c34fdb2e3d03aa2c81a2841ff478e7e8bce8cbf 636,810 bytes - `text.txt` b84776ce009e3dc2a206e9ad3ef22832948d4cd2d03b762e9069ec10e9d60934 13,994 bytes ### [Falle PHP già sotto attacco: l'IA le ha scoperte e ora scrive gli exploit | Hardware Upgrade](hwupgrade-news-sicurezza-software-falle-php-gia-so/index.html) [original ↗](https://www.hwupgrade.it/news/sicurezza-software/falle-php-gia-sotto-attacco-l-ia-le-ha-scoperte-e-ora-scrive-gli-exploit_160925.html) **Hardware Upgrade** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `hwupgrade-news-sicurezza-software-falle-php-gia-so` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hardware Upgrade (Italian): PHP flaws already under attack, AI found them and now writes the exploits. The PHP security team released PHP 8.5.12, 8.4.... capture 20261023T160435Z · HTTP 200 · https://www.hwupgrade.it/news/sicurezza-software/falle-php-gia-sotto-attacco-l-ia-le-ha-scoperte-e-ora-scrive-gli-exploit_160925.html- `headers.json` 27e8635a3e062bdd27358070689843db524f6742546ff66110cabf769d50667d 1,154 bytes - `page.html` a83c6ca35f60eb8c579a47f4ce2479f26e7a197129fca967a67242e2b2b61203 138,870 bytes - `provenance.json` 1d229c6ea14e186906db362f81b0e615c58e40909e36ce8f854ef108c3962200 1,876 bytes - `rendered.html` 9c09ebadee15f7a80e25a06b7455d90de115b5542e8c08281bf8fe4f86ab831f 223,740 bytes - `screenshot.jpg` 4c9548af895dae917cbf16f232bf30ff0847417c73af0bf845e1256e194a5e0a 569,652 bytes - `text.txt` 27fe642106500ed29791f821c9e7932d5f7db99fe1be5df459fd977eb7db5114 13,085 bytes ### [Govt sites go down after AI finds 'critical' PHP vulnerabilities | Information Age | ACS](ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php/index.html) [original ↗](https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html) **Information Age (ACS)** · news · secondary · captured · published 2026-10-22T12:09 local (per the page) · added by `curator@php.newsroom` · `ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Tom Williams: several Australian government sites were down or taken down for maintenance overnight, including the Australian Bureau of Statistics and Jobs and... capture 20261023T080331Z · HTTP 200 · https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html- `headers.json` 6c7a0a24e1fe5637fc0128a9543df3a2bb5079a578d1571c5ee745e4b0a07a59 831 bytes - `page.html` 21df95872c121c2f672382dafd6d1ca89fe07372f8cd1a00e76f30b22811c993 34,077 bytes - `provenance.json` 20685a3f6a08933f3b94c2edc57f79936c1349c7d626b8a007e74c089e57ef9d 1,822 bytes - `rendered.html` ff2da2f8b833dd56d03dc9c164f90f8933bf878549b26f126a4119d0572167cd 52,058 bytes - `screenshot.jpg` 33e77e17b0f50d77bfb6a433b86dcaa84c12bf65b5146eb7db156b76fb780928 513,879 bytes - `text.txt` 640f80b25de71eba27f0e3c27d8ff99a44a1fbfbff094fbba106b66ca99af2c5 6,812 bytes capture 20261023T232528Z · HTTP 200 · https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html- `headers.json` 064c15b6236d2c86d950a588c8de3e704d626469895936dabc24c3be4c5b4995 832 bytes - `page.html` 86f824455c0efddf2fc2811d58413e3f8f696aeb12ecddaffd45d618e857a5bd 34,077 bytes - `provenance.json` ec2c14f52e7b9427f8a87e82849fb33ec92672d7e81c736581373b732927cd78 1,962 bytes - `rendered.html` c98c20a129793b26cce63c9bc9d8fa92fd072eadcc3d70c759dfec778d93468f 62,604 bytes - `screenshot.jpg` 6ba539309f5c1427250b5adf86bde8fe3a089c87b037b88db004f3dd6af5591f 515,725 bytes - `text.txt` 7676edbd67afa1a79ccd2d73396f65dd895b364ff7bcc60cfd7d1cff3612bff0 6,806 bytes ### [PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal](ictjournal-news-2026-10-22-deux-failles-critiques-d/index.html) [original ↗](https://www.ictjournal.ch/news/2026-10-22/deux-failles-critiques-dans-php-provoquent-une-mobilisation-mondiale) **ICTjournal** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `ictjournal-news-2026-10-22-deux-failles-critiques-d` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). ICTjournal (French, Switzerland), updated 23 October: thousands of servers remained exposed on 22 October. The firm Risikomonitor examined nearly 690,... capture 20261023T160435Z · HTTP 200 · https://www.ictjournal.ch/news/2026-10-23/php2shell-des-milliers-de-serveurs-vulnerables-des-attaques-deja-tentees-update- `headers.json` 96cb671877675863e47283b7aa831e49e59f92e987abbaaffb9dff9f9f24fa8a 718 bytes - `page.html` 2d3d605f3ec7dac7a67f9f8a5af533342b09ddc97904163f4f7fa3e281b93ca6 61,721 bytes - `provenance.json` 990cfa3359cd3f5ca8b695080c3ce572a5057a16d3669b9c10530ee178a763bd 1,856 bytes - `rendered.html` 73da345102f334f7291a1d5e5da4b616bf72b1ca52f593496f4ebb15f666efd2 73,106 bytes - `screenshot.jpg` 495b8e996db403400218a3d2c6d15b646a1ca330baafe4ef396c65bc073300f5 514,029 bytes - `text.txt` 1eb6afcabd54c35bcf47b491733358b9cdb6263894dcd1fdfd8e17b0c0febb5f 7,901 bytes ### [Jutaan Situs Terancam usai AI Temukan Celah pada Bahasa Pemrograman PHP](idxchannel-playlists-jutaan-situs-terancam-usai-ai/index.html) [original ↗](https://www.idxchannel.com/playlists/jutaan-situs-terancam-usai-ai-temukan-celah-pada-bahasa-pemrograman-php) **IDX Channel** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `idxchannel-playlists-jutaan-situs-terancam-usai-ai` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). IDX Channel (Indonesian): millions of sites are threatened after AI found a flaw in PHP. It quotes Wiz Research that the flaw could let an unauthentic... capture 20261023T160435Z · HTTP 200 · https://www.idxchannel.com/playlists/jutaan-situs-terancam-usai-ai-temukan-celah-pada-bahasa-pemrograman-php- `headers.json` 59c8203710dabee58479da2061b42dbf49b4775706bc773359b0682698390649 3,968 bytes - `page.html` 6124ebee9907b740dc700285d264dd6e3905ce068654d4dddc0730f8f5b964f5 81,430 bytes - `provenance.json` 8889c5a7576c54e6227324ce476acd73a4ee02cb30c3f3f2ccd45114badb6fdf 1,808 bytes - `rendered.html` da7a3707c79abd48f1faea87270a41a4f68e24fa6a52c80002d406cec8f491a3 1,416,412 bytes - `screenshot.jpg` 6f84791300ec03b3a4a653127a59366390b78abec5aa8e2040e290ecac1c2506 166,461 bytes - `text.txt` 966c68b8c58b4f3dfa0e79e9dfba7f119ee6330f55948c065fc7b9d1a807cc85 31,925 bytes ### [全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站](ijiwei-n-1122779/index.html) [original ↗](https://www.ijiwei.com/n/1122779) **ijiwei** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `ijiwei-n-1122779` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Ijiwei (Chinese): 'tonight's thunderclap' for the global internet: the AI-found PHP flaw PHP2Shell forced emergency site closures at government and co... capture 20261025T093507Z · HTTP 200 · https://www.ijiwei.com/n/1122779- `headers.json` 5ec30cc89903a98a18ce31d694e214f7557d14ee3a125ffa489c7f986bc6d027 900 bytes - `page.html` 046759baedb82af3710da90268e93e0acd32baeabff10e48a49119a69cdd7c81 61,676 bytes - `provenance.json` 77ef7f748cf8427119071cf49933d2cd667c654a61c5ddd538303cad878b5995 1,552 bytes - `rendered.html` b3e02665079d0f7252efa4a5eff1a1b0bf54b892054d68dc7f3698d581b22861 60,937 bytes - `screenshot.jpg` 4cc32df55be0c48a7ac54a1f61139756ebe69eb28558584d298189df7b883753 945,195 bytes - `text.txt` 0f6f2bf8436c2b42a5258fe1041aa70afc7a0a8d8421ab76d174467df65b0d0f 17,220 bytes ### [PHP2Shell, quando una vulnerabilità del software diventa un’emergenza mondiale - Il Sole 24 ORE](ilsole24ore-art-php2shell-quando-vulnerabilita-softw/index.html) [original ↗](https://www.ilsole24ore.com/art/php2shell-quando-vulnerabilita-software-diventa-un-emergenza-mondiale-AJIlhFrB) **Il Sole 24 Ore** · news · secondary · captured · published 2026-10-22T10:14:00.000Z · added by `curator@php.newsroom` · `ilsole24ore-art-php2shell-quando-vulnerabilita-softw` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Il Sole 24 Ore (Italian), 22 October: when a software vulnerability becomes a world emergency. A question-led explainer of why PHP2Shell is such a bro... capture 20261023T160435Z · HTTP 200 · https://www.ilsole24ore.com/art/php2shell-quando-vulnerabilita-software-diventa-un-emergenza-mondiale-AJIlhFrB- `headers.json` f751dc7aa146a9af481664da2a4c17d7dedeb8e6f7384f80775fde771569cae2 1,138 bytes - `page.html` fd39496d01df1be37efdf34afab8d0669ca99edbd6e80b3d2c691a1dfd413120 984,211 bytes - `provenance.json` 72e00b0c0ae59cf1ac83888e9efbe531d37de753c86233cc5ee904f7ffd2ea81 1,693 bytes - `text.txt` 34e2f51bedae17519e0584f1cfae76f1f1b7f9dea752397141d8040ad2f49c89 14,089 bytes ### [PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva](imperva-blog-php2shell/index.html) [original ↗](https://www.imperva.com/blog/php2shell-vulnerability-updates/) **Imperva Threat Research (Nadav Avital, Bar Menachem)** · vendor · primary · captured · published 2026-10-21 · added by `claude-story-site` · `imperva-blog-php2shell` Five demonstrated techniques, three via session upload progress; attack complexity high; ~67 KB memory disclosure; no matching traffic in pre-disclosure monitoring; '69% of websites whose server-side language is known'. capture 20261022T111855Z · HTTP 200 · https://www.imperva.com/blog/php2shell-vulnerability-updates/- `headers.json` fa04ad94125d615ccc22bfe0f44544c8737419ff06a9d85acf2e5e4776931849 3,102 bytes - `page.html` b659e89f8fb17c9833c2b8d60454655d038e41bd867043684aff25984c3bf6e2 243,832 bytes - `provenance.json` a2f25ae502d617f41375750794a46ff83e8a433361944da98d0daab48bd962ec 1,022 bytes - `rendered.html` cb3120b21b6f0c89f3af549534f6b8ce3e381a19e5c6eecce3ec513cb1d18d5a 301,023 bytes - `screenshot.png` 1f96ba16ce949cfd1d6f4051df3dd2b7910754612bb6fae060c14d96950f9c9e 1,932,384 bytes - `text.txt` 3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4 15,842 bytes capture 20261023T080331Z · HTTP 200 · https://www.imperva.com/blog/php2shell-vulnerability-updates/- `headers.json` 007d70044b574554e6ab8cdb298d07a9ebb684af433ca2c6cddfdc30af531b23 3,175 bytes - `page.html` 6ef087834881447bfdf1f2e5aee88bbe3672e5915fc1d25307a4873e154ef5f7 243,352 bytes - `provenance.json` 14aafdeae68884459eb7993892c91bb643a6dd7a68ffd0f548be9d03cbc24495 1,595 bytes - `text.txt` c8db3bc67fda0e55dd0a5434c423f099cb6872dfb584273d348f4c21e12861aa 15,819 bytes ### [バルテック、サイバー攻撃によりサービス停止、情報流出の可能性（記事訂正） - INTERNET Watch](impress-watch-valtec/index.html) [original ↗](https://internet.watch.impress.co.jp/docs/news/2150396.html) **INTERNET Watch (Impress)** · news · secondary · captured · published 2026-10-22 (corrected later the same day) · added by `curator@php.newsroom` · `impress-watch-valtec` Promoted from the source watch (oq9gflln), snapshot 20261022T191433Z. Valtec blamed php2shell, then corrected: its own service's flaw (resolved, not PHP) capture 20261022T191433Z · HTTP 200 · https://internet.watch.impress.co.jp/docs/news/2150396.html- `headers.json` 58df97fc9062fc234eef8d1d1582710ea444eb72b939acee668cee7c988492b9 286 bytes - `page.html` 54dca16481319543e0f7f4de7c4bfffb04af2e3ea7b963baa4ea5b6dd06212e0 112,513 bytes - `provenance.json` 29864193cb9702d80c121e6d555f57f9562b46db8d07df01587de8e5986dbc2e 1,664 bytes - `rendered.html` f241ae871799c4086033623f373f304027ad469bdaad5687cf3e21e58e636e88 408,910 bytes - `screenshot.jpg` d0eb4e865c0189bf912fa7f318a5e994d85516c9b51f582289ae00be950d916a 829,142 bytes - `text.txt` 8eb3458dda2e5e8f5ae7763944d9c1d9fe1733285b87b6b21481c02b28d7fd76 12,992 bytes ### [FBI Releases PHP2Shell Advisory As The Internet Explodes In Hilarious PHP Memes; Here Are The Best Ones](in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet/index.html) [original ↗](https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on) **Mashable India** · news · secondary · captured · published 2026-10-22 · added by `curator@php.newsroom` · `in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). A meme roundup with a short news lead: the FBI cyber division posted an advisory on X on the two flaws; Wiz Research is credited with finding them and with the... capture 20261023T080331Z · HTTP 200 · https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on- `headers.json` 5c21b63cab11f946e21274a6a3fea9146896b3662d93ba850f40c3a3acec2897 798 bytes - `page.html` 2faf7c00dcf7b63fd7a47989e9e17267500f049a0ea9663843b7130151a79804 117,616 bytes - `provenance.json` 4e182d5e5155a0660e9b6081712cfcd9869b7cdbe1c4fdd5e9b3f01462d70879 1,915 bytes - `rendered.html` 498c483ee86a3ff90100dbed274edc5c4caf72cb7808dffb8146f9cbb7508965 124,258 bytes - `screenshot.jpg` 49b8df288c07b8c45cb979d76f73601d3c7b90ffeee3f2a72320012eab2a2fd7 559,197 bytes - `text.txt` 072bc5f150b26f629c58d74b6a3e20e8f6b35a9e8d53fdcc2ce072df0ac34acb 7,013 bytes capture 20261023T160435Z · HTTP 200 · https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on- `headers.json` 53af284293b57eae4f44a32cba2edfa37f9ac9770886a1e0f7365f7030a63b09 798 bytes - `page.html` f8403b7bba2c6793b960879bbc601453bd99b836a9cdd1e14266043dfa315db2 117,480 bytes - `provenance.json` a30c2b190b6291979b626291b6750b1b9d450353191ad54978086accb2fb4dda 2,061 bytes - `rendered.html` 87a6ef5412e4d0c3d8a912f9213bc466630a65a5ff77eb91ecc83cc3b06bae0a 125,549 bytes - `screenshot.jpg` e8526f4f62767bbc0809bc5c6dc7223d6eca69aaed1ff19b088a0b53a2251c60 546,771 bytes - `text.txt` 9ae6bd023957e0f9fb23dfa13378ea0670a771d701d8ad250640c4ec5a15ec66 6,859 bytes ### [PHP2Shell: Who Is At Risk And How Can Businesses Stay Safe?](inc42-features-php2shell-who-is-at-risk-and-ho/index.html) [original ↗](https://inc42.com/features/php2shell-who-is-at-risk-and-how-can-businesses-stay-safe/) **Inc42** · news · secondary · captured · published 2026-10-24T16:49:18+05:30 · added by `curator@php.newsroom` · `inc42-features-php2shell-who-is-at-risk-and-ho` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Inc42 (India), 24 October: who is at risk from PHP2Shell and how businesses stay safe. Because the flaws are in PHP itself, website-level security alo... capture 20261024T160544Z · HTTP 200 · https://inc42.com/features/php2shell-who-is-at-risk-and-how-can-businesses-stay-safe/- `headers.json` 65127c501f11f1aea3b745e81af1f3fba77c5f52012906fe5ac8a25e3539aa60 1,633 bytes - `page.html` d605dfe16f73ea5c0b59186b4e49a4482dbd2d9fbd4e676be26c93a1e0c5291c 597,279 bytes - `provenance.json` 96b4db2e45175ba16d0ff9cbbb76892d202f0d19d6bb699b8e289b3e7444f303 1,734 bytes - `rendered.html` 5156991e4499f82ba4f4bc3dc5fa8ccd92532e9b27aaf944e2a292462da4b374 842,406 bytes - `screenshot.jpg` d919f8844f9878c89040ef554614552e1ebfdb9c52edf8558521887a71a66d91 944,749 bytes - `text.txt` aa979376d7d804efc3a819cef821b5d72039af7b7caf8bf7fac85c143045faf9 10,895 bytes ### [PHP security alert: What US and Indian government warnings mean for websites | Technology News - The Indian Express](indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb/index.html) [original ↗](https://indianexpress.com/article/technology/cert-in-php-vulnerability-alert-india-cybersecurity-warning-us-nsa-php-alert-10931962/) **The Indian Express** · news · secondary · captured · published 2026-10-23T09:18 IST (updated, per the page) · added by `curator@php.newsroom` · `indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Bijin Jose: explains the flaws for website owners and summarises the US and Indian government warnings. It says the flaws were identified on Tuesday 20 October... capture 20261023T080331Z · HTTP 200 · https://indianexpress.com/article/technology/cert-in-php-vulnerability-alert-india-cybersecurity-warning-us-nsa-php-alert-10931962/- `headers.json` 932309cea1f97c544e3de604320a561a7da6f22f1e108743c16fd9c45bc961c8 1,378 bytes - `page.html` 058ec4dbb5d6a3fa49dc78990fad2fe11c4fbc684b60041cfb03d749a8b8c431 718,734 bytes - `provenance.json` ab2492f5d688f0ff70f04dba27854b676e2e4efc9c4f3f93f83d90ab08d8e6ac 1,931 bytes - `rendered.html` 37d117de1e907a919f03ab4bdaa3efbbac556f26a4f7dcab5bac5606463dded9 1,019,780 bytes - `screenshot.jpg` 06ea44dd972d4f2311fb756dbd60f11347382c525ae34568c489dcc92e951182 657,045 bytes - `text.txt` ba9bf5143edd15b370ca0e1de90deb11671d6932c4a155d306e2daeda8420046 8,424 bytes capture 20261024T133450Z · HTTP 200 · https://indianexpress.com/article/technology/cert-in-php-vulnerability-alert-india-cybersecurity-warning-us-nsa-php-alert-10931962/- `headers.json` 895756200378691b1ec103b2fdd2fd4d7c74512be022d351fc648d403f07db2d 1,379 bytes - `page.html` 48efc29afdaed234e85347146e50696950a80d2042bf36253fb8866b2ad74b32 748,889 bytes - `provenance.json` f409ba04e5b314cadeb30783a64907c1e1e71726c6bfd1674552517654696fa6 2,082 bytes - `rendered.html` dbbcdf5dcd5ec52e72a953af2d25cd54af16aeed6b77da31dcdcbd2df75eb47e 755,892 bytes - `screenshot.jpg` 91414b6a424bc50841b7c83b1b6427ba30068c6c71399b8944eaa5652863ac31 461,881 bytes - `text.txt` 44decc95cc32f48618d51f1b609b26f8875444cee1a05aebf7158f42a4bab020 19,842 bytes ### [US NSA warns of PHP security flaw that could let hackers take over servers: How to stay safe - India TV News](indiatvnews-technology-news-us-nsa-issues-urgent-php2shell-warning-advis/index.html) [original ↗](https://www.indiatvnews.com/technology/news/us-nsa-issues-urgent-php2shell-warning-advises-taking-unpatched-servers-offline-2026-10-22-1057597) **India TV News** · news · secondary · captured · published 2026-10-22T11:29 IST (updated 12:17) · added by `curator@php.newsroom` · `indiatvnews-technology-news-us-nsa-issues-urgent-php2shell-warning-advis` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Saumya Nigam: the US NSA issued an urgent warning on PHP2Shell, recommending that unpatched servers be taken offline if immediate patching is not feasible. PHP... capture 20261023T080331Z · HTTP 200 · https://www.indiatvnews.com/technology/news/us-nsa-issues-urgent-php2shell-warning-advises-taking-unpatched-servers-offline-2026-10-22-1057597- `headers.json` f00bac1eb7ab38bcdf017eb95abdb9dab29050ee4081236e1f18b86e9feddd46 846 bytes - `page.html` a9966c9deeb3fa0f6dedd780da09bc4cec9ad738eaf3132b0d94f8c54c71d0b6 289,578 bytes - `provenance.json` 8ec6e9b1a8eae8da38e5d1ce6cf313cf38619ca19f57dc539cb44ce736ce2030 1,935 bytes - `rendered.html` d071e2876cbbff0c90275e29f5ed2a795acec972f8ab646616457bb23aef8c0d 309,893 bytes - `screenshot.jpg` 08b95827e5b2f4513fb8ea6921110b3dd51c238910171e895500cbc3ba189061 540,427 bytes - `text.txt` 5890d993ee5bdcb670bd405641ec3e763a82c5c3e1a78695e174b4ea4362430f 6,646 bytes ### [PHP güvenlik açığı (PHP2Shell): Ne oldu, ne yapmalı? Adım adım rehber](indigodergisi-2026-10-php-guvenlik-acigi-php2shell/index.html) [original ↗](https://indigodergisi.com/2026/10/php-guvenlik-acigi-php2shell/) **İndigo Dergisi** · news · secondary · captured · published 2026-10-21T21:45:07+00:00 · added by `curator@php.newsroom` · `indigodergisi-2026-10-php-guvenlik-acigi-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Indigo Dergisi (Turkish), 21 October: what happened and what to do, a step-by-step guide. PHP2Shell is two critical flaws in the language behind about... capture 20261023T160435Z · HTTP 200 · https://indigodergisi.com/2026/10/php-guvenlik-acigi-php2shell/- `headers.json` c409b2bc890f7dd4473de64a24a662c722a35a99229f521645d293c78a0653e0 1,245 bytes - `page.html` 9285154c3176f5b64a1f5c8aefd446a8e56cfa2139122c0c85cb961804abd85a 278,088 bytes - `provenance.json` 367d9a52a3671a03c070aa8d6211e027f8e9981c461536f3fd82cbdf82b3e869 1,533 bytes - `text.txt` c8c3d3e1225d10240ee19544a6a5ea7348bb2b494766b93b515df926c687f53f 25,357 bytes ### [Saking Bahayanya PHP2Shell, Kepala Negara Sampai Turun Tangan](inet-detik-security-d-8718436-saking-bahayanya-php2/index.html) [original ↗](https://inet.detik.com/security/d-8718436/saking-bahayanya-php2shell-kepala-negara-sampai-turun-tangan) **detikInet** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `inet-detik-security-d-8718436-saking-bahayanya-php2` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). detikInet (Indonesian), 22 October: because of how dangerous PHP2Shell is, heads of state had to step in. It says the sudden vulnerability of digital... capture 20261023T160435Z · HTTP 200 · https://inet.detik.com/security/d-8718436/saking-bahayanya-php2shell-kepala-negara-sampai-turun-tangan- `headers.json` 23a7512169ea272c06d6268c84531c130bace8b486de937a8ab671cfd58ed443 1,050 bytes - `page.html` 926417bcfa4613473196d08b2df54fc63e9f54df5b8172ccc1866e48361550bd 319,310 bytes - `provenance.json` 2b4e64fcb5c2195ab8df32108c9b4adf9a5d553076966684a65ba3b560d405e8 1,784 bytes - `rendered.html` dd10feb5862c7ed64b5794e8ceb5baa6d297ad27c7dfb41fd3ee23cdd1ca937e 349,384 bytes - `screenshot.jpg` 5ce6cabb906c802b23be82668166488026ffd30416b82030f29008b06355c4c3 471,268 bytes - `text.txt` 356402f97052a4c24981e92e04e1b206d98eb08502e29da334023fa23ba49475 7,014 bytes ### [PHP2Shell: cómo actuar ante la alerta del FBI que pide desconectar sitios web vulnerables en Estados Unidos - Infobae](infobae-estados-unidos-2026-10-23-php2shell-como/index.html) [original ↗](https://www.infobae.com/estados-unidos/2026/10/23/php2shell-como-actuar-ante-la-alerta-del-fbi-que-pide-desconectar-sitios-web-vulnerables-en-estados-unidos/) **Infobae** · news · secondary · captured · published 2026-10-23T00:21:13.551Z · added by `curator@php.newsroom` · `infobae-estados-unidos-2026-10-23-php2shell-como` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Infobae (Spanish, US edition), 22 to 23 October: how to act on the FBI alert asking people to disconnect vulnerable websites in the United States. It... capture 20261023T160435Z · HTTP 200 · https://www.infobae.com/estados-unidos/2026/10/23/php2shell-como-actuar-ante-la-alerta-del-fbi-que-pide-desconectar-sitios-web-vulnerables-en-estados-unidos/- `headers.json` a77240a075c52a46b20f5c59abb1e4dd06e81fe61c4831c11edd5e48ff1b9b44 1,535 bytes - `page.html` eec41642b23d1bf466fb71d3c3ec3fa9712fddb6194d1a84d1aeebdce9838500 229,867 bytes - `provenance.json` 2d70ca3cc93cb9a2dd7c962ec4d3871d8a11e3f161238501b02bf9fda4547ad0 1,945 bytes - `rendered.html` 95e2a910fba32dbd567f200af32318fc3f2dc2cfa7ba8a98783cdc3768153901 288,481 bytes - `screenshot.jpg` 57e65b45f75c1fbe6b5eca7c4aedadf242c606cdc141ed727670d0dd53a66664 740,965 bytes - `text.txt` 4c4d254cffdbe8820bc107264abe10c11bf472693915876bab0ed70d0af7ba68 12,780 bytes ### [PHP: falha em uma linguagem de programação ameaça tirar sites do ar; entenda](infomoney-mundo-php-falha-ameaca-tirar-sites-ar/index.html) [original ↗](https://www.infomoney.com.br/mundo/php-falha-ameaca-tirar-sites-ar/) **InfoMoney** · news · secondary · captured · published 2026-10-21T15:20:00+00:00 · added by `curator@php.newsroom` · `infomoney-mundo-php-falha-ameaca-tirar-sites-ar` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). InfoMoney (Portuguese, Brazil), 21 October: a flaw in a programming language threatens to take sites offline. It describes CVE-2026-109618 as memory-e... capture 20261023T160435Z · HTTP 200 · https://www.infomoney.com.br/mundo/php-falha-ameaca-tirar-sites-ar/- `headers.json` 40d358ae2c0532a329b8874c7ee11f2db9fcb41fa43cadf001cec99cdb34be00 8,329 bytes - `page.html` 51c34491478f8de90e0236f8ac0a90921b6d6a606810c4693613a2b4cbd3cc91 347,997 bytes - `provenance.json` 896cfe23d05a86e99707febd55e76bdc770006fd21adc462508442e7234388b7 1,683 bytes - `rendered.html` e7b98ed56850b4e7d553e7c388e6b79c2ff3d7ca4b21f406ea1f87b3909f9c6d 426,745 bytes - `screenshot.jpg` 5759c290398a1a15d06c43282ec9b8b47eacb1d5c7a9abdb847b3fc135e1a19d 449,582 bytes - `text.txt` 8f9667fa92ab7592adf69c52549d9447680c8bf106d0576ca6ae86057d060b60 7,101 bytes ### [PHP2Shell-Chaos: Ein Tag der Security-Teams in Alarmbereitschaft versetzte](infopoint-security-php2shell-chaos-ein-tag-der-die-sicherhe/index.html) [original ↗](https://www.infopoint-security.de/php2shell-chaos-ein-tag-der-die-sicherheitswelt-in-alarmbereitschaft-versetzte/a46856/) **Infopoint Security** · news · secondary · captured · published 2026-10-22 08:29:53 · added by `curator@php.newsroom` · `infopoint-security-php2shell-chaos-ein-tag-der-die-sicherhe` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Infopoint Security (German), 22 October: an account of the day security teams were put on alert: two critical flaws, information that leaked early, an... capture 20261023T160435Z · HTTP 200 · https://www.infopoint-security.de/php2shell-chaos-ein-tag-der-die-sicherheitswelt-in-alarmbereitschaft-versetzte/a46856/- `headers.json` 06af9663658e3edfdbedc5b581d2185f0179dc5d573958a4998578c6142f36fb 653 bytes - `page.html` c1b3c072565e35194daef226096a85ca70b0c8a3264475e6e2a4eef37cfd0e92 86,204 bytes - `provenance.json` a229b18a060002e5ef1d1d3f3fc21b0390d6657cd5237b6e5f405cbafec0c1d5 1,859 bytes - `rendered.html` 0a50151936da88bb6c73658ed60885f9f3ec6656391fb3ed3a82b2e6bba1bd1d 88,487 bytes - `screenshot.jpg` 3404ba0037347ba00126afe167367af1bb71b16b4556aee7f7fd31c93bd08b1b 531,860 bytes - `text.txt` ac365d692cf74dd8c1139c2c5d3847bbcf20f617e1364191be5e07c9ca5cafe3 7,488 bytes ### [PHP2Shell Exploitation Attempt Detected Four Days Before Disclosure - Infosecurity Magazine](infosecurity-magazine-news-php2shell-exploitation-attempt/index.html) [original ↗](https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/) **Infosecurity Magazine** · news · secondary · captured · published 2026-10-22T10:10:00 · added by `curator@php.newsroom` · `infosecurity-magazine-news-php2shell-exploitation-attempt` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Infosecurity Magazine, 22 October: Amazon detected a PHP2Shell exploitation attempt four days before the disclosure. The flaws could allow unauthentic... capture 20261023T160435Z · HTTP 200 · https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/- `headers.json` 96c00222dcfb3afd69716fa9e68623a44587a39773564846c0f1c677cc9e4dc0 1,651 bytes - `page.html` 7b80b5a632605b9ecae554c24290303adf32f5cb2ccb374868bade98189d2c95 108,868 bytes - `provenance.json` 00e7ad7ece63f87dec66d5082cf7a547cbe3789b000a88604c0dd421b5ccb07b 1,739 bytes - `rendered.html` 2c72a43d49ed4fe485eaa6ab7e6f291809b7634ec9f69cc59eb7bb8de3ae7f90 118,692 bytes - `screenshot.jpg` b9c095ec113af118bf53544c99f06298253e49dfa5924012d8fb9779e540ebfc 489,006 bytes - `text.txt` 723f0a0bfb538e435f2f44a92033c7e84a12742ff11daff23cba69a7ddf1df8d 7,569 bytes ### [Pemprov Kaltim Waspadai PHP2Shell, Celah Siber Kritis Ancam Server Pemerintahan - IniBalikpapan.Com](inibalikpapan-pemprov-kaltim-waspadai-php2shell-celah/index.html) [original ↗](https://www.inibalikpapan.com/pemprov-kaltim-waspadai-php2shell-celah-siber-kritis-ancam-server-pemerintahan/) **IniBalikpapan.Com** · news · secondary · captured · published 2026-10-24T20:30:00+00:00 · added by `curator@php.newsroom` · `inibalikpapan-pemprov-kaltim-waspadai-php2shell-celah` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IniBalikpapan.com (Indonesian), 24 October: East Kalimantan's provincial government is on guard against PHP2Shell. It tightened the security of its di... capture 20261025T093507Z · HTTP 200 · https://www.inibalikpapan.com/pemprov-kaltim-waspadai-php2shell-celah-siber-kritis-ancam-server-pemerintahan/- `headers.json` 5081a5cc5a97296279ee0e2c330fbe2db992bd1566e53aa99f0ddb188aff943b 1,029 bytes - `page.html` 892fb9bef9b62b109a7b90b1bd99f78f88abacc868c2ab177570dbf2dbd7583c 133,282 bytes - `provenance.json` a992aaaa44b0abd6fa613161f14738b4ab1c7e115c23aad555fe4ffcc3f46a12 1,845 bytes - `rendered.html` dab5b1d01ac4b1fd6a9f2f0cd95da311b20c84793192480fe1f8948b7de643d1 149,471 bytes - `screenshot.jpg` b78e6c1fcd969f51dc97b16c93652056b0698ff8ab26742495c1eceddd841ae4 500,949 bytes - `text.txt` 308b7d4ed87e6bacd051e9d7cb31466cce51d92f630a99a0138d15cc5f466069 8,114 bytes ### [Internet Archive down, Wikipedia hit by outages amid PHP issues - Insider Paper](insiderpaper-archive-wikipedia/index.html) [original ↗](https://insiderpaper.com/internet-archive-wikipedia-down-php/) **insiderpaper.com** · news · secondary · captured · published not stated · added by `collector-news` · `insiderpaper-archive-wikipedia` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081314Z · HTTP 200 · https://insiderpaper.com/internet-archive-wikipedia-down-php/- `headers.json` 5adf01bc00583d1a001661e4324a94447f30fc180f9172d640bd9b20031debac 843 bytes - `page.html` 6c34cea33f4415eef2040587c46e31fef1f843bd25cbfd3bd08f7245207fb2db 105,403 bytes - `provenance.json` 55b2f4e9919b640d8b8d086f609f0f07506af08b29b2f1442230cc2ce0f99a7c 1,041 bytes - `rendered.html` c0a05a9cf251c8172dfbde3ba3cfaf240b14263a4e1dd9ea5e6ecb4f8d661bcf 120,653 bytes - `screenshot.png` 238bd10edbbac79827d10be4d221864096a471909266507d8f4c9963268f14fe 1,361,810 bytes - `text.txt` dba4741ae1b287deea2eafb352e4943ec73bc0fc0e568707b6083cdf1baade63 4,921 bytes ### [Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business](insurance-business-au-asiapac-attacks-begin/index.html) [original ↗](https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx) **Insurance Business** · news · secondary · captured · published 2026-10-22T11:59:56Z (modified 15:52:31Z, per the page's metadata) · added by `curator@php.newsroom` · `insurance-business-au-asiapac-attacks-begin` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Patchstack "conf... capture 20261023T012042Z · HTTP 200 · https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx- `headers.json` d7c6037a3d486dcfea6be77442fd206f61bc6906e70e92270a8041eb3f5543cb 1,441 bytes - `page.html` 98d4b6426324d21a0f86b027448e1edb42f7f14f078cb666b8c2fb7df882f03e 103,632 bytes - `provenance.json` 6e01812fd9981745cf7bddb9cfe50b700144a4470cdc9291f482f5a82c1dde8f 1,838 bytes - `rendered.html` 4017fbe931ba3e838695e7ab60fc4c3b0b9976750eb6b68b958bc939e4bac0d7 275,204 bytes - `screenshot.jpg` e3b290e88f04e0036da577427acade1fa7f0aaee342ce10de8c8f2d2aa846d00 823,298 bytes - `text.txt` 8d88bddde485e36f27c001a80e9ad0506055b64f3879347345be5ad336a10cad 9,469 bytes ### [UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business](insurancebusiness-uk-councils/index.html) [original ↗](https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx) **insurancebusinessmag.com** · news · secondary · captured · published not stated · added by `collector-news` · `insurancebusiness-uk-councils` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081252Z · HTTP 200 · https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx- `headers.json` 30acd0390cc491cfdaf72982b9c580d022f1401872425588f56eac11e5d46509 1,441 bytes - `page.html` 7a49498f54bbb46f5db660369044e8443b338c2d46bf6c6077f3cbcfd609163b 222,907 bytes - `provenance.json` 207911ae60de17b7791b5892a7782f1555d7f31014f6487bb6b8f460b41fdf1f 1,196 bytes - `rendered.html` 8df24098f293286c5fc875108d9d11e344de84a882116093920e43ceff9e1608 401,343 bytes - `screenshot.png` 76be0be292fecd0fd681fc80c534f4e1464d412dc5f68cd11ef02942386b54fd 1,999,104 bytes - `text.txt` daa04c79edfb56f49761d38fa7ce81c2aa1828f78a0b0b4694519818e4e507ca 7,092 bytes ### [UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business](insurancebusiness-uk-councils-met/index.html) [original ↗](https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx) **Insurance Business (Matthew Sellers)** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `insurancebusiness-uk-councils-met` Edinburgh and Oxford councils and the Met Police unavailable; Bristol, Lambeth and Barnet errors; Dutch NCSC offline; Valtori; Cloudflare CTO 'STOPGAP only'; Unit 42 22.6 million systems; W3Techs Aug 2026 ~70%. capture 20261022T112225Z · HTTP 200 · https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx- `headers.json` 3d07c50bb43d9b0530e97433ee53da60ac0afc3cb28ee547618e5cce5e68d8d0 1,370 bytes - `page.html` 3cf31852fd2bdd575e2b3cb127faa507e947fbd823c16befeaca3901daa676a4 223,253 bytes - `provenance.json` 3d2dc87a1364e14f154fb92ea66b98c53bcf8b335f6ab4488be62bf869fe6071 1,200 bytes - `rendered.html` 2db316644de0dc7e608587a786f6571e83708d928733ae4a8a227c5b31f3b1cd 400,028 bytes - `screenshot.png` 143c99a16e7b571c7069d3cc0b3396802d75971d4ec8a883b902db2b02a15061 2,153,476 bytes - `text.txt` 89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20 7,188 bytes capture 20261023T160435Z · HTTP 200 · https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx- `headers.json` e4918aebc93de796d0004aa9c592dcb96b71d3b6fcaa67fbb1195bbefa28563e 1,439 bytes - `page.html` 8735471661303d0f7c21f3318333059ed32a0b65305a459f22a238045ffe4c09 225,142 bytes - `provenance.json` 469615d4724ce097804eb8e80950d12ba7be9a3ae7dd49a1699c47803a90b846 1,978 bytes - `rendered.html` 7657708ca2a91a072929110c703c9a14469a57cf19073e7086c6959da5138bc4 394,152 bytes - `screenshot.jpg` e78ced0dce01243b0d52a290b7e79bbafbea6770bce5801c24dfb09e952723ae 693,294 bytes - `text.txt` 8a97c447cf02381c719100eabb24e9f484d68bcfd4a143a764425dd3af00e1ab 7,173 bytes capture 20261023T232528Z · HTTP 200 · https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx- `headers.json` e6f1f12746bde369562bcc82e470f9338b299d07c8cbf3a64c982aa9c7fe7067 1,441 bytes - `page.html` 2e7cf44382a31a9c30808366e2cd6af835aebcc3e848fc75d962e9978dc3e6e5 225,217 bytes - `provenance.json` 257a837c4d1c19da47b97dd17fbac817c28a7a19373946853b39ec952cece6fc 1,817 bytes - `text.txt` 3876631293f8dad80be19c44d9a9dbeb794f6d0a3d978addc493800dc2399536 7,190 bytes ### [Faille PHP 5 à 8.5 : tout savoir sur la situation d'urgence - iPhoneSoft](iphonesoft-2026-10-22-faille-php-5-8-5-savoir-situa/index.html) [original ↗](https://iphonesoft.fr/2026/10/22/faille-php-5-8-5-savoir-situation-urgence) **iPhoneSoft** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `iphonesoft-2026-10-22-faille-php-5-8-5-savoir-situa` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). iPhoneSoft (French), 22 October: PHP flaw from 5 to 8.5, everything about the emergency. Two critical PHP vulnerabilities caused the preventive shutdo... capture 20261023T160435Z · HTTP 200 · https://iphonesoft.fr/2026/10/22/faille-php-5-8-5-savoir-situation-urgence- `headers.json` 47c98ddd98aa796db0d7c8c8bfabe389f54733d5cb9f0628dcc180f144bae1a6 863 bytes - `page.html` 8beab37b32c4ee9d00bc07098ab56d121b1970a21e9d5264dd0ca6b4c12bef13 44,602 bytes - `provenance.json` 40ed8f1941510f17330002040ba72a4d6ee57c7be1345ce437a09f3951169111 1,726 bytes - `rendered.html` d7fbb000a9ef96a79a5091efd4008f78c5bd568dfd25b8a00c3dd45130c17c8c 818,728 bytes - `screenshot.jpg` 605f912976b484e490fa7787be3929a4f0c39a6f72fbf8c4d1ae2f9754833ad2 529,737 bytes - `text.txt` fe00635f4b0e1b6878a5b861b9c51451ce7a8ecbb379bc4f56a2cd576902769e 6,398 bytes ### [Siber Güvenlik Başkanlığı'ndan PHP2Shell açığı uyarısı: Kritik sistemler için tarama başlatıldı](istanbulticaretgazetesi-siber-guvenlik-baskanligindan-php2shell/index.html) [original ↗](https://istanbulticaretgazetesi.com/siber-guvenlik-baskanligindan-php2shell-acigi-uyarisi-kritik-sistemler-icin-tarama-baslatildi) **İstanbul Ticaret Gazetesi** · news · secondary · captured · published 2026-10-22T08:58:20+03:00 · added by `curator@php.newsroom` · `istanbulticaretgazetesi-siber-guvenlik-baskanligindan-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Istanbul Ticaret Gazetesi (Turkish), 22 October: Turkey's Presidency Cybersecurity Directorate started a national-scale scan against the PHP2Shell fla... capture 20261025T120459Z · HTTP 200 · https://istanbulticaretgazetesi.com/siber-guvenlik-baskanligindan-php2shell-acigi-uyarisi-kritik-sistemler-icin-tarama-baslatildi- `headers.json` eef6a4de66ea3b43df713a7935031b0af4128f66e79e8a75e8c38768a772db58 2,739 bytes - `page.html` 910c7abbacd7659ef9bc0b0a5583d3b04d156ba01264cebe99905550c07417d3 142,852 bytes - `provenance.json` 3ad0469e65270fe5fbcdf2d23ad6e3bbc9226ee27743f755043ee58eeb488882 1,926 bytes - `rendered.html` 07750140aa19a3436206ee810ae054fb9a00139a3d87412b649550b59ce736eb 143,557 bytes - `screenshot.jpg` 6ccdfd799e6ab831dcb9c6cdfca8faf9495a560b2445b3b50f270e6785657505 410,479 bytes - `text.txt` d02caee1e5ef8352d524a1635e38e144e8a6e9892073cfed5a8ac13843972e60 6,069 bytes ### [PHP2Shell: Die aktuelle Lage nach dem Patch](it-daily-shortnews-php2shell-die-aktuelle-lage/index.html) [original ↗](https://www.it-daily.net/shortnews/php2shell-die-aktuelle-lage) **it-daily.net** · news · secondary · captured · published 2026-10-22T15:15:59+02:00 · added by `curator@php.newsroom` · `it-daily-shortnews-php2shell-die-aktuelle-lage` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). it-daily.net (German), 22 October: PHP2Shell, the current situation after the patch. According to Cloudflare's chief executive, criminal actors began... capture 20261023T160435Z · HTTP 200 · https://www.it-daily.net/shortnews/php2shell-die-aktuelle-lage- `headers.json` 9695e41002663a335827fe97a13367472f6f5d5fbf6128ac40c78df5da90e84a 789 bytes - `page.html` 338bd29498bcff507575707c84fa37e15021afcef73df8b236cdcc92f5c1eae4 281,033 bytes - `provenance.json` cacb79068f8c5c16802c4064721916bb9a4e3cfaa15367f1c6b67212c8ec9c00 1,637 bytes - `rendered.html` 64a48e283828bd2220d218801eefab5572919479833a0280971d85c1105d05c6 352,665 bytes - `screenshot.jpg` acc9df37231bcffd2200f1a4b79143d8394539ca34b082567d5a717ae6df9498 555,457 bytes - `text.txt` 540025f0b24a94f3b5314f48cc78559c29526be1eae033198e15eb38c72efa6a 8,207 bytes ### [Avviso per gli exchange di crypto: una grave vulnerabilità PHP mette a rischio i siti di pagamento](it-finance-yahoo-notizie-avviso-per-gli-exchange-di-22423/index.html) [original ↗](https://it.finance.yahoo.com/notizie/avviso-per-gli-exchange-di-224238845.html) **Yahoo Finanza** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `it-finance-yahoo-notizie-avviso-per-gli-exchange-di-22423` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Yahoo Finanza (Italian), a notice for crypto exchanges: a serious PHP vulnerability puts payment sites at risk. On Wednesday 21 October the PHP develo... capture 20261023T160435Z · HTTP 200 · https://it.finance.yahoo.com/notizie/avviso-per-gli-exchange-di-224238845.html- `headers.json` 14b530caf70b8055757198eed4edac7690c7aa2ab491e7e8687687bf1a1d5f8a 31,973 bytes - `page.html` 8d4fdce54a79d0278bce072fd149868819c27fba111211d83f0878f2ca31493e 358,322 bytes - `provenance.json` cae9669db6a1998cee4738ab882a555767e3b79a45818e2d512863857dbc0984 1,773 bytes - `rendered.html` 4daec8f5f4250e80489c770ce967ea917c187f814840da3dd4bd19e62d47dec1 426,581 bytes - `screenshot.jpg` 44a38b539889ea4a8d4cd4905314c8ed3ffb686fe1a749e4937159c7ff6934ee 327,943 bytes - `text.txt` e51ded94e469d4867f3136a2efadb8261a9e7849aa31e73bb75fca0b05243c07 4,330 bytes ### [PHP2Shell-Sicherheitslücken bedrohen auch Banken und Finanzdienstleister](it-finanzmagazin-php2shell-sicherheitsluecken-bedrohen-we/index.html) [original ↗](https://www.it-finanzmagazin.de/php2shell-sicherheitsluecken-bedrohen-weiterhin-auch-banken-und-finanzdienstleister-252814/) **IT Finanzmagazin** · news · secondary · captured · published 2026-10-23T05:30:07+00:00 · added by `curator@php.newsroom` · `it-finanzmagazin-php2shell-sicherheitsluecken-bedrohen-we` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IT Finanzmagazin (German), 23 October: the PHP2Shell vulnerabilities also threaten banks and financial service providers. They let attackers run malic... capture 20261023T160435Z · HTTP 200 · https://www.it-finanzmagazin.de/php2shell-sicherheitsluecken-bedrohen-weiterhin-auch-banken-und-finanzdienstleister-252814/- `headers.json` 151e327491bd02691fbac079064d65a43f92aba097351319275c4c83184c3bf0 796 bytes - `page.html` 1dcb38424cbf19d0e581165c98d5edbbfca5c5e3630a051e774ab8d84566d5c7 322,282 bytes - `provenance.json` 4963156ab7e6c51dceb4b591341db04ce2f3e6266eaf2444ce20787f1096dff6 1,855 bytes - `rendered.html` 5e573606a9c82794efc2db5e9285b27d565fb9b2864c4f127c2e78680923e56a 329,897 bytes - `screenshot.jpg` 12180c5b1670a95f056382e7d90e71bb1fb2510718042919a59e37105b4c9154 859,107 bytes - `text.txt` 9c370ea0d223e2c82ed93afc8e2f860d4089df88fcb3cf3fc0e9904cc1ef516b 11,625 bytes ### [PHP2Shell : une faille majeure dans PHP activement exploitée avant la disponibilité du correctif - ITdaily](itdaily-blogs-logiciel-php2shell-bug-php/index.html) [original ↗](https://itdaily.fr/blogs/logiciel/php2shell-bug-php/) **ITdaily** · news · secondary · captured · published 2026-10-21T13:55:56+02:00 · added by `curator@php.newsroom` · `itdaily-blogs-logiciel-php2shell-bug-php` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ITdaily (French edition), 21 October, updated 16:38: a major PHP flaw actively exploited before the fix was available. PHP shared the patches slightly... capture 20261023T160435Z · HTTP 200 · https://itdaily.fr/blogs/logiciel/php2shell-bug-php/- `headers.json` fc4bc78b399501edb3e7dd3f60cfb24d8be4d1959cf9a4020fb9070fed077262 643 bytes - `page.html` f2a5fe735d6b54ca798a1765dd09f96268a6c756ad9d2aa4e15d35810f599e8e 114,364 bytes - `provenance.json` 3ad577b312b0a9b49db5d0b776e849ec361aaf334e878e3d8bf2977880d7ac29 1,661 bytes - `rendered.html` 6cb2162cb57181e8d106383d80e3e5e38d93ca7960293df9e8140b28c9be6bb6 116,843 bytes - `screenshot.jpg` a2f5c873be763d078f711b06703760c141a7b90d3470c610f546aa4f9e14a0b1 641,339 bytes - `text.txt` 6f61aceea38ee7638b3c7ebf0e1e0a2c4b868cfb0b7bb53ad9e6319e8603a45b 11,129 bytes ### [PHP2Shell: groot lek in PHP actief misbruikt, nog voor beschikbaarheid patch - ITdaily](itdaily-blogs-software-php2shell-bug-php/index.html) [original ↗](https://itdaily.be/blogs/software/php2shell-bug-php/) **ITdaily** · news · secondary · captured · published 2026-10-21T13:55:56+02:00 · added by `curator@php.newsroom` · `itdaily-blogs-software-php2shell-bug-php` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ITdaily (Dutch edition), 21 October: the Dutch-language version of the same article as the French ITdaily capture, headlined that a big PHP leak was a... capture 20261023T160435Z · HTTP 200 · https://itdaily.be/blogs/software/php2shell-bug-php/- `headers.json` 704b2c806f55d1fd2bad5be2e33261b1f464d6714dab72bec03f9c7cf30ff94a 643 bytes - `page.html` 4f3981bd2831a7022c6766d3e93b1774bcad5574ddd2a9a282cf5eaf3aadb3fd 111,628 bytes - `provenance.json` c0028f3e2add5656f16a1eb46a2dbbcee099d2b281f004a6aff327db8a45c06a 1,489 bytes - `text.txt` 7ffb5c6722658267e9f24f45b8bd5951573aeae5d425577b334f1eefff67fda7 9,511 bytes ### [스틸리언, ‘PHP2Shell’ 취약점 무료 점검 서비스 공개 capture 20261023T160435Z · HTTP 200 · https://www.itdaily.kr/news/articleView.html?idxno=242392- `headers.json` 6f23ede504ae1bb70503ca0091b132b288ba0def8c9e3a1be5ccb05e11ab0032 343 bytes - `page.html` 1f9f3df5c5af583a85f178cb4e29038ec750a3992ac29167bf406cef59d06521 144,635 bytes - `provenance.json` 91f0193e71862029bc93fd3e96550b5f8a8dbfb6371092953ccf0c097811f2f1 1,652 bytes - `rendered.html` d5afcf8928b89f59268d20f9f649f4f06880e8157e2ee008803207b621319fcf 165,212 bytes - `screenshot.jpg` 06109396873508333882174a66c794042e43c9d292563e5efd6ebc16352ff0c6 434,636 bytes - `text.txt` 4cc6406a7d9f2fdcdfb6f5d76eda72dfff7f3131cc812850a2ff8bcdcae06023 9,542 bytes ### [PHP Foundation angered by ‘clumsy’ disclosure of vulnerabilities - ITdaily](itdaily-php-clumsy-announcement/index.html) [original ↗](https://itdaily.com/blogs/software/php-angry-clumsy-announcement/) **ITdaily (Jens Jonkers)** · news · secondary · captured · published 2026-10-22T09:36 (local, Belgium) · added by `claude-story-site` · `itdaily-php-clumsy-announcement` Secondary: the Foundation 'caught off guard'; 'aware for two years of at least one vulnerability'; Ecosystem Security Team since May 2026; a VUB professor on the disclosure window. capture 20261022T112142Z · HTTP 200 · https://itdaily.com/blogs/software/php-angry-clumsy-announcement/- `headers.json` 9c96a4285eed59d7470a9a983facb2964a82b6539cf0dd85887c0cb4b2fb0740 606 bytes - `page.html` c93c7d6384ee8c4a47a08e5ac9e9aa9dc1d96089fc05044a194b1220e7c9d4ed 130,955 bytes - `provenance.json` ebec1bc848714c197d387275d82b755dbb12649df06083c9d18633217827d2a5 1,049 bytes - `rendered.html` b634233f4e687df8538e68d9f0af3af145ab15dc5bbe966f7a1457f2350eaf4a 134,246 bytes - `screenshot.png` 5a11124ea720acd8ae8b3af6b0df0a3925b72abfa059d3db627464c578ae2700 1,036,421 bytes - `text.txt` 27772c396e4bd60e2e200b2ba8db0273291060cad355f3927bdcd0ee9c2aa7ad 6,719 bytes capture 20261023T160435Z · HTTP 200 · https://itdaily.com/blogs/software/php-angry-clumsy-announcement/- `headers.json` d4183de402614ab3cb0b3389affe6454e514b1d6b12da33f12503a873da95397 642 bytes - `page.html` 8d38db371f615891a74b891f10fa77d0fd3de5dfb6d19e08fffc359688d1a1c0 109,401 bytes - `provenance.json` 78d3a00092f6a0e89be4ed32fc77d1f99b7f0d97f8dfa034a92f42c9fb295b86 1,788 bytes - `rendered.html` 566da57232a6d2f8319c1043ddd06a4b84edf4f952cdce055268dae2e94f39f9 111,971 bytes - `screenshot.jpg` b21044eab2552799adf4388bb39fc8cced84bfc7cf12d8b58a7939e71ad5a0f9 443,657 bytes - `text.txt` 53476db4c95635cba0849f88b3273310ef0809efbe986864a7b56a0054183a72 7,031 bytes ### [360安全云发布PHP2Shell应急防护方案，助力政企网站抢修窗口期 - IT之家](ithome-1-016-980-htm/index.html) [original ↗](https://www.ithome.com/1/016/980.htm) **IT之家** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `ithome-1-016-980-htm` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IT Home (Chinese): 360 Security Cloud released an emergency protection plan for PHP2Shell to help government and enterprise websites during the repair... capture 20261023T160435Z · HTTP 200 · https://www.ithome.com/1/016/980.htm- `headers.json` 96ed96501f87024261ed73feb08307622b1f1ea3c56bbc826a57c5973be4318d 480 bytes - `page.html` 3ca5e75716670afe7395fcfade59df2b0d4d01c682cc6357dda71faad213b432 29,303 bytes - `provenance.json` 2aa57d913ce0b073757f96d79a187c2e73edcd42c0e91b376ed67ba8d4cf83bb 1,551 bytes - `rendered.html` 848001c36ed2ed66193e920a03d05b0414acff8038b6350ba9634bd74a5992e5 49,645 bytes - `screenshot.jpg` ae9dcb375cfcce508de56f6cdc85d7496871a45c10575cea3376e01f2a10afda 540,044 bytes - `text.txt` 6031329574e60ccca2f5ef8b6105c001e11d921e2e88bbd476ef56902c1220d0 11,251 bytes ### [PHP2Shell, la mise à jour ferme la faille, mais oblige à traquer les compromissions possibles - IT SOCIAL](itsocial-cybersecurite-cybersecurite-articles-php/index.html) [original ↗](https://itsocial.fr/cybersecurite/cybersecurite-articles/php2shell-la-mise-a-jour-ferme-la-faille-mais-oblige-a-traquer-les-compromissions-possibles/) **IT Social** · news · secondary · captured · published 2026-10-23T07:58:01+00:00 · added by `curator@php.newsroom` · `itsocial-cybersecurite-cybersecurite-articles-php` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). IT Social (French), 23 October: the first exploitation attempts came four days before the coordinated disclosure, which shifts a company's response fr... capture 20261023T160435Z · HTTP 200 · https://itsocial.fr/cybersecurite/cybersecurite-articles/php2shell-la-mise-a-jour-ferme-la-faille-mais-oblige-a-traquer-les-compromissions-possibles/- `headers.json` dc4fcd9e93f05f21e466beaf11c106f736bd1683dd6027ea697b4cd9f556c476 880 bytes - `page.html` 7b87fccd00ca774f5357da48c1c26180992bb5f584e6a1b257f38340474fa313 360,599 bytes - `provenance.json` 1475378758653e01c69ddd63ad965d6d1bb1da125c39740623868dc787fa6b81 1,919 bytes - `rendered.html` b798e757871bfc8f6f9028b0f7a4df92dfbb6fcb1fbf4422745e6d569ce00c15 359,599 bytes - `screenshot.jpg` ca7d82ca3ed331cf943625541100023f459ff78ed579076fe731751016a73a28 908,893 bytes - `text.txt` 192f86a7b6081dfb7c2813799068d074cef0b3c931f3957262fe715c09001b70 13,533 bytes ### [PHP2Shell alarm a major cyber security wake-up call | ITWeb](itweb-article-php2shell-alarm-a-major-cyber-se/index.html) [original ↗](https://www.itweb.co.za/article/php2shell-alarm-a-major-cyber-security-wake-up-call/WnpNgM21VmP7VrGd) **ITWeb** · news · secondary · captured · published 2026-10-23T13:27:00+02:00 · added by `curator@php.newsroom` · `itweb-article-php2shell-alarm-a-major-cyber-se` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). ITWeb (Johannesburg), 23 October: PHP2Shell alarm a major cyber security wake-up call. Two critical PHP vulnerabilities, in a language powering about... capture 20261023T232528Z · HTTP 200 · https://www.itweb.co.za/article/php2shell-alarm-a-major-cyber-security-wake-up-call/WnpNgM21VmP7VrGd- `headers.json` 521c2fcfffd785f8a7f6bf54b2be6eee90974cc80cfea0cc58e3e9d7f4efe1aa 724 bytes - `page.html` 88a432a074182a21c6f9cd1b123d248b5b36bb057a9d144cf44ebd115b005f23 289,364 bytes - `provenance.json` 037e5dabc035e5b2b87a63acc0649f4dee1e9723262911e49822d8ba999dccac 1,762 bytes - `rendered.html` e1dffabbcf4eb7f6842867d176192a879ab46c554160c3d4a57a251061264ff1 320,723 bytes - `screenshot.jpg` 8a55008b57824b72bbac1036c97e097c56b8fad3cff7b35de229c219290e110d 726,058 bytes - `text.txt` 1fdfcf3735d1e77ac407b63c2a46f51b907cdaa426ace7f70aba86e5210e6ed9 12,005 bytes ### [PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline | iTWire](itwire-business-it-news-security-php2shell-the/index.html) [original ↗](https://itwire.com/business-it-news/security/php2shell-the-14-year-old-bugs-that-pulled-cyber-gov-au-and-government-sites-worldwide-offline) **itwire** · news · secondary · captured · published 2026-10-23T06:22:09.021Z · added by `curator@php.newsroom` · `itwire-business-it-news-security-php2shell-the` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). iTWire (Australia), 23 October: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline. It says Australia's own cyber se... capture 20261024T160544Z · HTTP 200 · https://itwire.com/business-it-news/security/php2shell-the-14-year-old-bugs-that-pulled-cyber-gov-au-and-government-sites-worldwide-offline- `headers.json` 0eeeddfae657c2b18f8450c7ee4d54502ddb5697452c121ce4b100c64d851882 1,217 bytes - `page.html` 8ad68c5fa0817aebd8621a311d609c3fbe6323bffae7242d89540655ddfccd2a 89,747 bytes - `provenance.json` bf1a8855f708bb076589ce458cbcfad84ab6f36e7746e77fee75725cae16b383 1,889 bytes - `rendered.html` 198722ddb7d84ddfe5e51fefd454516beb90ca1132faa997707ca6427a8443b2 95,215 bytes - `screenshot.jpg` e2ef147959aea6261471e4b18289ad8609f1b0da7037b8161e495fb16d727674 1,012,633 bytes - `text.txt` 172a5231d5923072febae5278aaf4bda3a02684c33054b2bd6f6fe8989f480c0 19,030 bytes ### [Celah PHP2Shell Ancam Server, Peretas Bisa Ambil Alih Sistem Tanpa Login](jawapos-teknologi-2610230446-celah-php2shell-anc/index.html) [original ↗](https://www.jawapos.com/teknologi/2610230446/celah-php2shell-ancam-server-peretas-bisa-ambil-alih-sistem-tanpa-login) **Jawa Pos** · news · secondary · captured · published 2026-10-23T19:33:41+07:00 · added by `curator@php.newsroom` · `jawapos-teknologi-2610230446-celah-php2shell-anc` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Jawa Pos (Indonesian), 23 October: the PHP2Shell flaw threatens servers; hackers can take over a system without logging in. It is a serious threat to... capture 20261024T133450Z · HTTP 200 · https://www.jawapos.com/teknologi/2610230446/celah-php2shell-ancam-server-peretas-bisa-ambil-alih-sistem-tanpa-login- `headers.json` 346c2a44446ea359003944df14704ec17e051fc1b445bddf3d04230fc0fa8aa3 671 bytes - `page.html` b7eadea750ad30bf6412311c3de384f05674389ce50ad0bf28d2e3a0e76f7dca 246,465 bytes - `provenance.json` f46fd0b1e18c9e308aef0df49b5a877072c2add435b273232523a85aeb22f9ca 1,815 bytes - `rendered.html` f5cf7e4cbe73de23bf5b5031ecf851f369e459815ef0511fb24c36c1831f128a 290,351 bytes - `screenshot.jpg` 10c41738af26768a836605d7b9828eed0fe940cd7d2898bf02294107b171a9cb 352,162 bytes - `text.txt` 2754c8748f2b7f9f29581bbb88cb2c6a26211bcaeb2e2b32d67600fc4407d983 4,615 bytes ### [Une faille critique dans PHP fait trembler la moitié du web mondial - JVTECH by jeuxvideo.com](jeuxvideo-news-2110338-une-faille-critique-dans-ph/index.html) [original ↗](https://www.jeuxvideo.com/news/2110338/une-faille-critique-dans-php-fait-trembler-la-moitie-du-web-mondial.htm) **JeuxVideo.com** · news · secondary · captured · published 2026-10-23T12:40:08+02:00 · added by `curator@php.newsroom` · `jeuxvideo-news-2110338-une-faille-critique-dans-ph` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). JVTech by jeuxvideo.com (French), 23 October: a critical PHP flaw makes half the world's web tremble. It says the origin of the serial outages is now... capture 20261023T232528Z · HTTP 200 · https://www.jeuxvideo.com/news/2110338/une-faille-critique-dans-php-fait-trembler-la-moitie-du-web-mondial.htm- `headers.json` 151883387ea3cc14358929da7810f392e4db7cd139bb8bcae34f44856e022549 1,599 bytes - `page.html` 9d40e3b2537a7197163e770f3de2e35d7fe22890bec3aa38e247a2d41a988162 77,947 bytes - `provenance.json` 0c95f5670ed3a65458dbc6453e6e113e648dbbd068962b1eb4b0f7b7f61c7585 1,831 bytes - `rendered.html` 43ca263f7f48a6ded278d1cc501025f3af8a69aa0c241d643fb6a72394079f48 328,753 bytes - `screenshot.jpg` 5fa218edab424b7aa204e4235b3d28195372611b5d329b2a0ffe1ccd21eb5aea 724,539 bytes - `text.txt` c2857e0dbbfe71aa57d9922accfe7900e893fb300499d35f2abfd523ed3fc5e6 14,973 bytes ### [PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開：時事ドットコム](jiji-jc-article/index.html) [original ↗](https://www.jiji.com/jc/article?k=000000015.000171490&g=prt) **時事ドットコム** · news · secondary · captured · published 2026-10-22T14:46:00+09:00 · added by `curator@php.newsroom` · `jiji-jc-article` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Jiji.com (Japanese), a press release of 22 October: the Japanese firm TorchUp made a free white paper available, a checklist for companies that run Wo... capture 20261023T160435Z · HTTP 200 · https://www.jiji.com/jc/article?k=000000015.000171490&g=prt- `headers.json` 3a7c26173c44dadb0ce4f73843adab98336b95bd86166a76b56626852f711df7 359 bytes - `page.html` 7cfc83a3ba8ba4cb99a51eba1a5ab1551fe215306f52ba4b498c4da39d7a1f73 77,436 bytes - `provenance.json` 632c22765aa964517dcdfef7a14a7941a16b884454c94cadb02ea099448c599c 1,579 bytes - `rendered.html` 4c9088c25ac07d98fa0795f07702225b46ba14c50179343dcc7b31bf8e9bb1d4 89,743 bytes - `text.txt` 5c39d0948e9da32377635406b5acb52c9c6e82dcbe210a724ebf5dd3daafeaab 14,731 bytes ### [Erro crítico em PHP obriga desligação de vários sites](jn-pt-sites-desligados/index.html) [original ↗](https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512) **jn.pt** · news · secondary · captured · published not stated · added by `collector-news` · `jn-pt-sites-desligados` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081616Z · HTTP 200 · https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512- `headers.json` f37963c01b0139ff38b53cefb27705bfda717ce5793706d747faaa8251270e42 1,688 bytes - `page.html` 7473d16b8275d2fd7f7ed70f9ef63386cb0b64e5594c7dd07bc7f89efc6bab20 223,187 bytes - `provenance.json` 181d49aac38478ace922953fb01e53d6401909aac8bd9a47082cd18e25d965ed 1,119 bytes - `rendered.html` 2bd81ec1cd9612b7e6a085664d7cbd5133934d10fe8502c9368b777ab59d6f1e 295,643 bytes - `screenshot.png` 0790304d2c70e0946039f7f9e21b42041558a80c19bb4048a54356cdcc297b01 929,926 bytes - `text.txt` d0ab599600817fabee6ab55163b27b2738e2ac00ac5659cd0bac26dfa4eafd2e 4,337 bytes ### [PHP2Shell : des serveurs exposés à une cybermenace mondiale](journalducanada-php2shell-des-serveurs-exposes-a-une-cyb/index.html) [original ↗](https://www.journalducanada.com/php2shell-des-serveurs-exposes-a-une-cybermenace-mondiale-10652-2026/) **Journal Du Canada** · news · secondary · captured · published 2026-10-22T10:25:00+00:00 · added by `curator@php.newsroom` · `journalducanada-php2shell-des-serveurs-exposes-a-une-cyb` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Journal du Canada (French): PHP2Shell exposes servers to a global cyberthreat. On 21 October several European administrations cut access to their plat... capture 20261023T160435Z · HTTP 200 · https://www.journalducanada.com/php2shell-des-serveurs-exposes-a-une-cybermenace-mondiale-10652-2026/- `headers.json` 9b6bd90936afd3c6bf459bd6c7773a384224d895568844ed9b481b5164ac7528 1,113 bytes - `page.html` 0061563c9005736293dda0ce2fb1d521be7e644d6ba14fdbedaca9f35ae414d9 292,979 bytes - `provenance.json` 7935db814ad5eac2198a00773d4c8fd25a8528a753134025ffe6e00a367c9ee7 1,799 bytes - `rendered.html` e53b1a4006bd5c91eabd459e296b7870942aec4d4d6f1913699fb49aca15058c 577,991 bytes - `screenshot.jpg` 2fbf376f129a803edc83e77d751f9db9393675d79d97313b73fc09230f57d5e4 548,264 bytes - `text.txt` b1f54b031a82e34ba149916a3182b1c143120b900264ad5cc0dfb9e64c57da1f 6,792 bytes ### [PHP2Shell : préfectures, impôts, Bercy et Météo-France coupés sur demande de l'ANSSI - Journal du Coin](journalducoin-technologies-php2shell-prefectures-impots-berc/index.html) [original ↗](https://journalducoin.com/technologies/php2shell-prefectures-impots-bercy-sites-coupes-anssi/) **Journal Du Coin** · news · secondary · captured · published 2026-10-21T16:21:30+00:00 · added by `curator@php.newsroom` · `journalducoin-technologies-php2shell-prefectures-impots-berc` Promoted from the source watch (oq9gflln), snapshot 20261022T171501Z. 4 new items in fr: Journal du Coin reports that, at ANSSI's request, French prefecture sites, parts of the tax portal, the Economy ministry, Météo-France and Les Echos were cut off on 21 October. It cites the Interior Ministry's statement capture 20261022T171501Z · HTTP 200 · https://journalducoin.com/technologies/php2shell-prefectures-impots-bercy-sites-coupes-anssi/- `headers.json` 548212ff886ff3e26dbf1be6a11113740680f437ced5e3352ff1e4dffc8a50e1 831 bytes - `page.html` d403208aaab2bfa0dbc4a2873934b14868837429df1440d72ed7d2f7311b86fd 202,949 bytes - `provenance.json` b22d029fbfb73d857b4d7ddacdb5c35906e80b7366b8e03752acb4afd81bc5cc 1,816 bytes - `rendered.html` a34e7562e8bc7a71b521f209620af9bf6441b12c7496accf5bc547d1aa50cd36 215,834 bytes - `screenshot.jpg` 8f4cecf99f8f4a4aa2efbc24a71011d299a101f8dbe013400ecccb1ce2a955d6 526,874 bytes - `text.txt` ca7e51715f8e31ec5e851af199a5f139eed1ae54b1e2449cc52b39e20f7137a5 9,675 bytes ### [PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (JPCERT-AT-2026-0033)](jpcert-at260033/index.html) [original ↗](https://www.jpcert.or.jp/at/2026/at260033.html) **JPCERT/CC (Japan)** · advisory · primary · captured · published 2026-10-22 · added by `collector-gov` · `jpcert-at260033` JPCERT-AT-2026-0033, published 2026-10-22, updated 2026-10-22 (wording fix in section V). Advice: apply fixed versions promptly 'after sufficient testing' and investigate for compromise. No offline advice. Says PHP is widely used in Japan. JVN entry also listed 2026-10-22 14:20 JST. capture 20261022T081700Z · HTTP 200 · https://www.jpcert.or.jp/at/2026/at260033.html- `headers.json` cbc1e287bde3882e41d91bfa7315dcbaccf9a996c0a383acc62f9095fbe921eb 605 bytes - `page.html` 85db7a09e865158643525fef5aa5cfc69513aaf896fcb2da4562189d43decf44 31,008 bytes - `provenance.json` 4ba4d01fa5ebe5235184ed530cedbac6cd8985446a10845775da38efa45aa5b9 1,013 bytes - `rendered.html` c4ba52d8393f4189aade005389d1b8c2923eeb29f0d917a7221b5330cff3bf91 30,690 bytes - `screenshot.png` 99789e60674ab7b0d3f01afbc2012337348a1434417d4820d6c89133f2d6ff64 722,717 bytes - `text.txt` 1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5 8,327 bytes ### [JPCERT home](jpcert-home/index.html) [original ↗](https://www.jpcert.or.jp/) **JPCERT/CC** · government · secondary · captured · published not stated · added by `collector-gov` · `jpcert-home` Home page at 08:16Z: the PHP alert (2026-10-22) and a JVN item at 2026-10-22 14:20. capture 20261022T081606Z · HTTP 200 · https://www.jpcert.or.jp/- `headers.json` ffa0d53fc7fd1c2d4339dd045991caa54d31c4515face33fcad2b50bfbfdb00f 605 bytes - `page.html` 07612f480101608a837f0a0dfff30db2d1f5091eabb55fe048bf6546979e25f7 31,630 bytes - `provenance.json` deeeef14fce691e60314064b4efa728667689e9676e5263b880005c0cdcc5ca3 917 bytes - `rendered.html` b41d0ff975f9a0815c4626b027f239c76e939b2070f0e7221fdeef67c9615d21 32,010 bytes - `screenshot.png` 0870f642b705aeed4116685bb2897f814fff8eb758a665a969b80be60f36dc81 1,483,609 bytes - `text.txt` 0e3188607f06a768281c4dd19a88acecbe0e7fe6b5c20a312e9095a2a498dfba 6,293 bytes ### [PHP2Shell security flaw forces thousands of Nepali websites offline](kathmandupost-science-technology-2026-10-25-php2shell/index.html) [original ↗](https://kathmandupost.com/science-technology/2026/10/25/php2shell-security-flaw-forces-thousands-of-nepali-websites-offline) **The Kathmandu Post** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `kathmandupost-science-technology-2026-10-25-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). The Kathmandu Post, 25 October: PHP2Shell forced thousands of Nepali websites offline. The PHP Foundation disclosed the two flaws on the evening of 21... capture 20261025T093507Z · HTTP 200 · https://kathmandupost.com/science-technology/2026/10/25/php2shell-security-flaw-forces-thousands-of-nepali-websites-offline- `headers.json` 7506560d25e320827ba16b5cb46e7a32de2f0f41f0f052334d4cb9cea459599d 1,191 bytes - `page.html` d9b63ae1d3d45f780d5599d10ce1beef57c3d4ee2e1892de3dd13ae31d1a8614 72,783 bytes - `provenance.json` 2e7a756110d5e11b8e5843ecc284ae16dffd50495643b9d41164a693ba90e419 1,841 bytes - `rendered.html` 1819d744256c53be3890eca8589b436bfa9cba48dd3d17d62882ff0283495b98 248,007 bytes - `screenshot.jpg` 5dcd532e293ed5b16bdd764c43f6dba745e32891a2b53fce0db79079f643ef44 684,896 bytes - `text.txt` b8a541ead3bd8295625877c330bbc21a09e8eb6f77fd70c94881d1c06b38e32e 12,495 bytes ### [PHP2Shell出現第3個漏洞 但因這原因不急著修補｜知新聞](knews-news-7898c3112ba7f79b25f7a44622d2e7d4/index.html) [original ↗](https://www.knews.com.tw/news/7898C3112BA7F79B25F7A44622D2E7D4) **知新聞** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `knews-news-7898c3112ba7f79b25f7a44622d2e7d4` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Knews (Traditional Chinese): PHP2Shell has a third vulnerability, but it is not being rushed. A compilation from foreign news: bad things come in thre... capture 20261025T120459Z · HTTP 200 · https://www.knews.com.tw/news/7898C3112BA7F79B25F7A44622D2E7D4- `headers.json` 4d1975d8440f2dcb627e4f39bd7703a8cfb6bb9f4ef826d3a8b469720dc22307 494 bytes - `page.html` 5caeeebf27ab7a74907faedabcf7d1eba266f3ef37d772ac9c58c9cdf395c0b9 200,730 bytes - `provenance.json` f9dcd74aab18e5357578bef73b468c79c59fd06bfb03635cfb78a19011f617ca 1,653 bytes - `rendered.html` 86e809c3918fec1b4af3adfbe59f1bc09c85286bf874b704291722dfe2ca1f41 232,835 bytes - `screenshot.jpg` 6974ed051c68c3873d7b0731d6c18be8461de8cac48dc6e8a36ad653c8461f78 634,998 bytes - `text.txt` d0f203fc01e344c26f21afe667ef61034b636d88bfab7b1071c24ada428c1879 8,819 bytes ### [PHP2Shell漏洞來勢洶洶！趨勢科技TrendLife推「PHP漏洞急救包」將威脅擋在網站前 - 電腦王阿達](kocpc-archives-700486/index.html) [original ↗](https://www.kocpc.com.tw/archives/700486) **電腦王阿達** · news · secondary · captured · published 2026-10-24T00:53:04+08:00 · added by `curator@php.newsroom` · `kocpc-archives-700486` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Kocpc / Computer King Ada (Traditional Chinese), 24 October: Trend Micro's TrendLife launches a 'PHP vulnerability first-aid kit' to block the threat... capture 20261024T133450Z · HTTP 200 · https://www.kocpc.com.tw/archives/700486- `headers.json` 62cd165c0e77bcdd169f340f3eaca496613b2628341f093374833a525ca697f6 394 bytes - `page.html` 50c7f2792395d3cd876b19b3806436c029fb8e968e3c5c8194d4d85f3f2cabdc 294,200 bytes - `provenance.json` 4c9e3e55bddc52fc6eb16eeabac9d34d46873777828582c15ff1a747b95916d6 1,591 bytes - `rendered.html` ba2205c388a2a7b1120f8791ab426fd7d19d80a69d66d97fd540209294526cb3 707,460 bytes - `screenshot.jpg` 50025c1ab6c0284407b3fc4e2752a5cb0995620b26f5bbac711924a4009edb27 488,321 bytes - `text.txt` 4117951cf369b94d81741e8ac73eedf95a3dc8bf6b9360deb9c9478fb59a0fc4 7,602 bytes ### [Upaya Global Perbaiki Celah Keamanan Siber PHP, dari Amazon hingga Kementerian Jepang](koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana/index.html) [original ↗](https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang) **Koran Jakarta ®** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in id: Koran Jakarta round-up from BBC and Kyodo. A photo caption shows the Keihan Holdings website suspended. Danish IT firm Kombit closed services including the national school platform. Several Japanese ministry pages, inclu capture 20261022T181608Z · HTTP 200 · https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang- `headers.json` 9766db410658d31c0e988a0716096bfaf3c67ca7d4ea2d25e2e1b720f2560ea7 1,641 bytes - `page.html` 213c59ab19f11c47162fa098d33aad2f9718ed4f8c44cf3b35c218b6111f30cf 359,208 bytes - `provenance.json` 8fe27bd61bbf013f723fc63def6e6f9c351768d464a79fb81ba8b7718656de09 1,862 bytes - `rendered.html` ed53485564de5f215f4ce3b8076dc529fe9bc575ae2a7836685f7c95575883ed 427,173 bytes - `screenshot.jpg` 69d5c1a1ca7c639ee0fa500448849ef25b036a55ebb315f535036025594063ca 569,373 bytes - `text.txt` f5c3e92816a8aaf3d21543436c76aa52fac6863eada37a37eb37b0618a5f987d 8,548 bytes ### [Atklātas kritiskas ievainojamības “PHP” programmēšanas valodā un tas skar lielāko daļu publisko tīmekļa vietņu | Kursors.lv](kursors-2026-10-21-atklatas-kritiskas-ievainojam/index.html) [original ↗](https://kursors.lv/2026/10/21/atklatas-kritiskas-ievainojamibas-php-programmesanas-valoda-un-tas-skar-lielako-dalu-publisko-timekla-vietnu/) **kursors** · news · secondary · captured · published 2026-10-21T15:00:00+00:00 · added by `curator@php.newsroom` · `kursors-2026-10-21-atklatas-kritiskas-ievainojam` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Kursors.lv (Latvian), 21 October: critical vulnerabilities found in PHP affecting most public websites. Two critical remote code execution vulnerabili... capture 20261023T160435Z · HTTP 200 · https://kursors.lv/2026/10/21/atklatas-kritiskas-ievainojamibas-php-programmesanas-valoda-un-tas-skar-lielako-dalu-publisko-timekla-vietnu/- `headers.json` 7c7da5a0ed2ef1b6dacef0a8fcd2960d7bb70786d81386239c57b4345b7d61fc 1,307 bytes - `page.html` 902472dfe5c955e45e9c22f6abc99f94caf358290ce933879bdf59768f4d0e46 749,033 bytes - `provenance.json` daa3bb0132927e330cf6b92a190c101cb7ec759ad3fd3c4ce6278adfbdb3dea8 1,928 bytes - `rendered.html` b6b37cbc1672e566ceb489509b2a745d18d76b0edbb7fd5625af8abf6102b976 740,425 bytes - `screenshot.jpg` 7bef0479e261a47a37490d20a6b0d0b8d8730325442b18c422c3c593b7410fd2 413,672 bytes - `text.txt` d3537127f9f0e750383fb12abf7d470004d43c951574a9fec666743a4f95f4ec 6,929 bytes ### [Une faille critique menace des milliers de sites internet : plusieurs plateformes belges concernées, un correctif publié - La Libre](lalibre-economie-digital-2026-10-21-une-faille-critique-mena/index.html) [original ↗](https://www.lalibre.be/economie/digital/2026/10/21/une-faille-critique-menace-des-milliers-de-sites-internet-plusieurs-plateformes-belges-concernees-Q3XDVDBQEJGXLJMEVDSHWNRQHU/) **La Libre.be** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `lalibre-economie-digital-2026-10-21-une-faille-critique-mena` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in fr: La Libre lists Belgian platforms taken offline: Flemish Region sites (on Minister-President Matthias Diependaele's order), the Flemish Parliament, FPS Finance informational sites, DPG Media and Roularta titles, Smartscho capture 20261022T181608Z · HTTP 200 · https://www.lalibre.be/economie/digital/2026/10/21/une-faille-critique-menace-des-milliers-de-sites-internet-plusieurs-plateformes-belges-concernees-Q3XDVDBQEJGXLJMEVDSHWNRQHU/- `headers.json` 7def206a8427e76a9a77b82ecc63f8856f763f90db0c5deaeb192b11faef8291 1,112 bytes - `page.html` 0ebcecda232383168fe35812770704692fc72c1147d2ad701401ce7782b0be9b 699,483 bytes - `provenance.json` 61e4d3306274d69bf7d8ed83a79b8e460269884a1480f881a3704ac7b3ad4c2f 2,008 bytes - `rendered.html` b0d149422f2695bb5599c0e0816ace3df42630195015c7dc8d39f5d3c74e8df9 859,999 bytes - `screenshot.jpg` e3e73da31b8e6317627b63188ba51038f7dceb0d37fc52fe3abb7087f8552c46 285,740 bytes - `text.txt` 49a06a7962f4ad397daaf732e939f6d92d6cd72aef024115b5e9f7c5c58eeca1 8,410 bytes ### [Celah PHP2Shell Ancam Website, Pengelola Wajib Waspada](lampost-teknologi-celah-php2shell-ancam-website/index.html) [original ↗](https://lampost.co/teknologi/celah-php2shell-ancam-website/) **LAMPOST.CO** · news · secondary · captured · published 2026-10-23T10:59:00+07:00 · added by `curator@php.newsroom` · `lampost-teknologi-celah-php2shell-ancam-website` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Lampost (Indonesian), 23 October: the PHP2Shell hole is a warning to site managers not to ignore server security updates. Two critical PHP vulnerabili... capture 20261023T232528Z · HTTP 200 · https://lampost.co/teknologi/celah-php2shell-ancam-website- `headers.json` ab145f320367ec1070bda11dea36b4cfe3bd0f3f8708dba9b0add8d4a0dc0190 742 bytes - `page.html` ec31fb32e02215dc1010bd590f25e05f5001139941d6b991ff14d7b808283003 61,494 bytes - `provenance.json` 88a31d9a3626af863af563f3ecbf579dfbf4166fc8e65d8a777c0e057d86e946 1,639 bytes - `rendered.html` 6de9dd269ef67db567de3ef7259fc81c5cd9f98c9f36d267a7b72318cf117217 847,790 bytes - `screenshot.jpg` ef8492581922c119897f357d841a09b4afa6c133a52038f6d7978cf19d9ffa2e 714,490 bytes - `text.txt` f92f07ed7bfdde52c620728b8dc214ec3bef74dee3c8ed5578ff2b7af45f02ad 8,115 bytes ### [PHP descubre otro fallo de seguridad sin parche apenas dos días después de una actualización urgente: Cloudflare y Amazon ya detectan ataques contra los anteriores](larazon-tecnologia-consumo-php-nuevo-fallo-segur/index.html) [original ↗](https://www.larazon.es/tecnologia-consumo/php-nuevo-fallo-seguridad-sin-parche-ataques-cloudflare-amazon_202610236adb95e23eef771e1ac4e56e.html) **La Razón** · news · secondary · captured · published 2026-10-23T17:15:49+00:00 · added by `curator@php.newsroom` · `larazon-tecnologia-consumo-php-nuevo-fallo-segur` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). La Razon (Spanish), 23 October: PHP discovers another security flaw without a patch just two days after an urgent update; Cloudflare and Amazon alread... capture 20261024T083755Z · HTTP 200 · https://www.larazon.es/tecnologia-consumo/php-nuevo-fallo-seguridad-sin-parche-ataques-cloudflare-amazon_202610236adb95e23eef771e1ac4e56e.html- `headers.json` 8abfc8b45f8c988e4e5c754e734e6bf24116938bbd0eb9a9cae069a55d473b3d 838 bytes - `page.html` 2d01c16a6491b0c53f79c2c973626d6cf19018aa46b5231a69faed969fdce005 615,549 bytes - `provenance.json` 92a7e948802c1f2415a5b318c4e9d21819a6617f35e70b602a9506a0cae39fcf 1,961 bytes - `rendered.html` 27954200233f94acd5657e9978c5116f70f744c98343a47b4805ebc3c2ecd095 735,115 bytes - `screenshot.jpg` 7155c825d9a124af886162f0f337664c90c3c885cf2fd9bd99c83dd64d0a7750 573,348 bytes - `text.txt` 21b72816e736ca309b04551b94e2e98a6bb02d5619415a05d7e31db3c15ee71e 8,515 bytes ### [PHP2Shell: una IA descubre una falla de seguridad que amenaza a millones de sitios web en todo el mundo - La Tercera](latercera-tecnologia-noticia-php2shell-ia-falla-de/index.html) [original ↗](https://www.latercera.com/tecnologia/noticia/php2shell-ia-falla-de-seguridad/) **La Tercera** · news · secondary · captured · published 2026-10-21T15:37:12.933Z · added by `curator@php.newsroom` · `latercera-tecnologia-noticia-php2shell-ia-falla-de` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). La Tercera (Spanish, Chile), 21 October: an AI discovers a security flaw that threatens millions of websites worldwide. A general explainer on PHP2She... capture 20261023T160435Z · HTTP 200 · https://www.latercera.com/tecnologia/noticia/php2shell-ia-falla-de-seguridad/- `headers.json` 8f65f544f9b6365c2c5d30064623650e43391199ab82d3b7fb2f344d6ab24018 2,064 bytes - `page.html` 890c96e25abbaae39fd214199b8aa090714310ddc83ee0b937c152fd5bc11dfe 450,765 bytes - `provenance.json` 4f92bdd1697f8537a928d433283e6a29a03f1a99bc8ba63faf58122cbfc234e3 1,769 bytes - `rendered.html` c8fc5b5abd7b6e2de015226884302e960a35b65d675302d32305f10d2ad30536 468,095 bytes - `screenshot.jpg` 1df1235e7b5dd13c4f01d7ee4823575cc19e7a7cd3b524436e17fdafd29525c7 760,807 bytes - `text.txt` ed964d00af00f08579020f9bf7d0e3d9bd44db6ea7f2e789c083ae2a30de818b 12,449 bytes ### [PHP2Shell: AI Found the Bug Hiding in 70% of the Web. Millions Attacked. Patch Now](latintimes-php2shell-ai-found-bug-hiding-70-web-mil/index.html) [original ↗](https://www.latintimes.com/php2shell-ai-found-bug-hiding-70-web-millions-attacked-patch-now-600515) **Latin Times** · news · secondary · captured · published 2026-10-23T22:39:03-04:00 · added by `curator@php.newsroom` · `latintimes-php2shell-ai-found-bug-hiding-70-web-mil` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T110459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Latin Times, 23 October: PHP2Shell, the two flaws CVE-2026-109618 and CVE-2026-109619, were discovered in August 2026 by Calif and Wiz using AI tools... capture 20261024T110459Z · HTTP 200 · https://www.latintimes.com/php2shell-ai-found-bug-hiding-70-web-millions-attacked-patch-now-600515- `headers.json` d7d96cc5916ca7a58b9f8be2d762ffeec529d074cfe723bb02a2b14682c72f81 1,444 bytes - `page.html` fbc1316508f012a2141a83990f7596caab147505af59b1ef4668b2dfc967e17b 442,562 bytes - `provenance.json` 9d7aacd9a4858445e677e925a66162418af08a0992e22eee4643cf6f53359ef3 1,798 bytes - `rendered.html` 9400e892134fb739c12422bf611f846708e287bf52d23e0cb82d1027bffd5797 448,066 bytes - `screenshot.jpg` 12e9a260592d98fd38f5008866d0e298ca4379859a1dade7c46f1c0436752d64 753,610 bytes - `text.txt` 34b8464dbf35f8b371680e885dade6485d134d7209956e657f661be932ae9b65 11,515 bytes ### [Alerta mundial por dos fallos en el lenguaje PHP con el que se programan las webs](lavanguardia-vida-20261021-11664852-alerta-mundial-do/index.html) [original ↗](https://www.lavanguardia.com/vida/20261021/11664852/alerta-mundial-dos-fallos-lenguaje-php-programan-webs.html) **La Vanguardia** · news · secondary · captured · published 2026-10-21T19:20:00+02:00 · added by `curator@php.newsroom` · `lavanguardia-vida-20261021-11664852-alerta-mundial-do` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). La Vanguardia (Spanish), 21 October: world alert over two flaws in the PHP language used to program websites. The vulnerabilities could let attackers... capture 20261023T232528Z · HTTP 200 · https://www.lavanguardia.com/vida/20261021/11664852/alerta-mundial-dos-fallos-lenguaje-php-programan-webs.html- `headers.json` e7e65b4bf75a8f2154ff6f1cefe264963b513868b567c493e26e861318effb5e 695 bytes - `page.html` b4781a9f65fcdf5ba8aeded507ebdc57d53bd717b24ef75a03f30b08872a3037 69,674 bytes - `provenance.json` 15f3c6dd785b8c55a50f8652feb2deb68e5e2cd886df7e9765ae494d7e026bf8 1,827 bytes - `rendered.html` 0e45424067c0b2101ebbef7add24a78a5bc49f4bdbf7721b21197203f18c242e 182,369 bytes - `screenshot.jpg` ec8f1a86ac0edddd710c3e72017362a5caf6dec347360d84948af1b0335697b3 397,930 bytes - `text.txt` f43c0c7c9506357a424c30c3f98e21419ce514b61663c0dba5c46a0656c81d78 7,088 bytes ### [Websites taken offline as ‘critical’ security flaw hits Met Police, Traitors and government sites | LBC](lbc-uk-websites-offline/index.html) [original ↗](https://www.lbc.co.uk/article/uk-internet-outage-php-websites-tech-5HjdkDd_2/) **LBC** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `lbc-uk-websites-offline` Met Police, The Traitors, government sites offline; fixes 'around 3pm UK time'. capture 20261022T112915Z · HTTP 200 · https://www.lbc.co.uk/article/uk-internet-outage-php-websites-tech-5HjdkDd_2/- `headers.json` 61fade0ae97f79d231f97a5777f63b2e81a66ef6baadd7a7099a825dd6c29ef2 971 bytes - `page.html` d4ed63db00e26889d772c2570efda5fb8fa6cce84a1d5826b8876ade8bf939bb 95,257 bytes - `provenance.json` e04ec30a201ba0f120a5f1c48aafef2c90f871816cde4084454cdc63c5244456 1,094 bytes - `rendered.html` e14de8389551e0d0109667c7b79786b3489c9cfa31c36fac97a71f6cf5398cb7 107,817 bytes - `screenshot.png` 72e82d8825a1870d48523fc0b7ecfd8f99a8f2f981f64bb572699545b7dfd811 1,602,728 bytes - `text.txt` 125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173 6,376 bytes ### [PHP2Shell : comment protéger votre site des attaques PHP](lebigdata-php2shell-des-millions-dattaques-frappen/index.html) [original ↗](https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant) **LEBIGDATA.FR** · news · secondary · captured · published 2026-10-22T17:52:24+00:00 · added by `curator@php.newsroom` · `lebigdata-php2shell-des-millions-dattaques-frappen` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). LeBigData (French), 22 October: millions of attacks hit PHP sites. On 21 October the PHP team published 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two c... capture 20261023T160435Z · HTTP 200 · https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant- `headers.json` 325a1699312af0056c6128f5688997429c86982b84b985e1be4b16a541761eac 1,558 bytes - `page.html` 117c392c1899b61bddfb4642c4c1b0c8312cd994d4f77609d015e03ce30dabae 263,406 bytes - `provenance.json` 1e935583c9e1973d5ee043c4d4dec87ec9f734eca4858f4ceb84abd62a61167c 1,800 bytes - `rendered.html` 4515761b754428c4749c875d693d19e09cdacb187f20a99bd1c736998fb6259f 375,980 bytes - `screenshot.jpg` 5849301e17ec6c999acfa4580b39b6e74ad2df2446a4862ac716272ff21d9328 872,376 bytes - `text.txt` e2295f56852e6bb0a72ce660e7a5be199cf097dfdd19e09a4a5b7cc649ad5f13 38,147 bytes ### [“PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案 | 雷峰网](leiphone-category-industrynews-9dejmhebinubut49-h/index.html) [original ↗](https://www.leiphone.com/category/industrynews/9DeJmHEbinuBUT49.html) **雷峰网** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `leiphone-category-industrynews-9dejmhebinubut49-h` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Leiphone (Chinese), a vendor-sponsored item: Qi An Xin's Tianji offers a one-click check for 'PHP2Shell'. On 21 October PHP was reported to have two s... capture 20261023T160435Z · HTTP 200 · https://www.leiphone.com/category/industrynews/9DeJmHEbinuBUT49.html- `headers.json` d752b49e5621bb72671a2f7d8befec91ef85f5e3a427337111a932bf7c0b17c4 973 bytes - `page.html` 91a62b9977e64a00f20692dcb70e2c9fc1d6384e739d18c1aeb2d20318ea5d1b 55,870 bytes - `provenance.json` edd7c65306d9c9e45aea86da9ca37357084ac74dbcd3884ac6c3fedcb48ae506 1,709 bytes - `rendered.html` 378cd0a617e5b89c34d63c8f45cc3258fbfb017539266a05cc278bc635b68463 83,868 bytes - `screenshot.jpg` bc109ed43d991b64a815bb7fd8467e6eda542c173157a9cf0abd9904d0c8a793 481,959 bytes - `text.txt` 296adb9a9c94826ad410ede7c0981b0b98eb1c748e3cf7f926a5ac61f0a33eed 9,726 bytes ### [Deux failles critiques dans PHP : les entreprises sous pression - Le Monde Informatique](lemondeinformatique-actualites-lire-deux-failles-critiques-d/index.html) [original ↗](https://www.lemondeinformatique.fr/actualites/lire-deux-failles-critiques-dans-php-les-entreprises-sous-pression-100866.html) **Le Monde Informatique** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `lemondeinformatique-actualites-lire-deux-failles-critiques-d` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Le Monde Informatique (French): two critical PHP flaws put companies under pressure. Both are CVSS 9.2 and could let an attacker run arbitrary code on... capture 20261023T080331Z · HTTP 200 · https://www.lemondeinformatique.fr/actualites/lire-deux-failles-critiques-dans-php-les-entreprises-sous-pression-100866.html- `headers.json` 580d3fc32cc273b5d800ac4c5badb761ac24b60dfae67daf0d133f94642d6a3c 801 bytes - `page.html` 1b00b13fae80298f17c5fa16dd7c34a28c63ccc8b0da3ab5b75e04f7c96f8a4b 78,575 bytes - `provenance.json` 65b37f7657e8f3c4756b52e08f4876d5ef97bb2aaef9691bcf9fc714fc2ab008 1,882 bytes - `rendered.html` 27b2b28d575893a70d4f10f53fea0537191f6f7032fe9fb755f683a836d88008 199,789 bytes - `screenshot.jpg` 9ba613377962c1c07af25564d9f8714a7f8b2eca5c5012a1acf4c41be6f124d2 747,109 bytes - `text.txt` 234ef1dec5114b7a83e4d827dc3664326bb52a85406ba3172ebab5f8057b4102 13,477 bytes ### [PHP2Shell : alerte sur des failles critiques à La Réunion](lequotidien-article-societe-2026-10-22-web-mondial-e/index.html) [original ↗](https://www.lequotidien.re/article/societe/2026/10/22/web-mondial-et-failles-php2shell-des-sites-internet-menaces-a-la-reunion) **Le Quotidien de la Réunion** · news · secondary · captured · published 2026-10-22T13:55:00+04:00 · added by `curator@php.newsroom` · `lequotidien-article-societe-2026-10-22-web-mondial-e` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Le Quotidien de la Reunion (French), 22 October: PHP2Shell alert on critical flaws in La Reunion. The alert relayed by Cyber Reunion concerns two crit... capture 20261023T160435Z · HTTP 200 · https://www.lequotidien.re/article/societe/2026/10/22/web-mondial-et-failles-php2shell-des-sites-internet-menaces-a-la-reunion- `headers.json` 64af3de466b48788e9c1207b5de79cfe3a16cf3e3546719126ec06a44c0c3ae0 935 bytes - `page.html` f7e95376d31b8f227451c5615ef7a6918c3bf6730e62198a89ed8869519e7723 89,695 bytes - `provenance.json` 0b3c18585afc07c99c2733dc96919f7c3e95a750b2bcc3b91a8a688d72fd65a9 1,833 bytes - `rendered.html` 3473c4c168692407eeb14af8a492239eddf27bca860fc7811787c67adbee4906 127,768 bytes - `screenshot.jpg` 7d5a2f52eac159c73ccb8ed8c07d2828333e2f2ffd8237a453f8b05693e0a40b 500,273 bytes - `text.txt` efd85dcad5b917b3e186a9f4e114e1378bc73e5bfff5ddfaff3bb55275aa80f3 5,926 bytes ### [PHP2Shell: ce qu’il faut retenir des failles révélées cette semaine - Les Affaires](lesaffaires-opinions-php2shell-ce-quil-faut-en-reten/index.html) [original ↗](https://www.lesaffaires.com/opinions/php2shell-ce-quil-faut-en-retenir/) **Les Affaires** · news · secondary · captured · published 2026-10-22T15:14:06+00:00 · added by `curator@php.newsroom` · `lesaffaires-opinions-php2shell-ce-quil-faut-en-reten` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Les Affaires (French, Quebec), an opinion piece of 22 October: PHP2Shell is a reminder of technical debt, which can be put off until it comes due all... capture 20261023T160435Z · HTTP 200 · https://www.lesaffaires.com/dossiers/intelligence-artificielle-le-marketing-au-temps-des-algorithmes/php2shell-ce-quil-faut-en-retenir/- `headers.json` 20480ea8071f664acb13baed9d166c77c3fe25350c1cb5e83f06456fc6430a0b 774 bytes - `page.html` bb7ff172157c321fc08bfc2c3831759c8b27e933408fee9abdbbf49f8f5fc90e 188,966 bytes - `provenance.json` 105fbdf4291eafca04675bba483e4787518dbf30c18557b0641b6e9d8951d436 1,782 bytes - `rendered.html` fcbad751f78579aa8a71561ae93e5a0a21135a558761932d24d55135a86b3ee6 512,237 bytes - `screenshot.jpg` d501d6457d4adbaf9c227df9d4b22c7f8c837b0795a45aef2415c297f032786f 868,924 bytes - `text.txt` d70540e1f61d216bb6281a083b5e728524b4ec3f55e1bfe492fda10fedf69ab8 17,245 bytes ### [Faille PHP «PHP2Shell»: des millions de sites web menacés dans le monde - L'essentiel](lessentiel-fr-story-mondeluxembourg-une-faille-de-s/index.html) [original ↗](https://www.lessentiel.lu/fr/story/mondeluxembourg-une-faille-de-securite-permet-de-prendre-le-controle-des-serveurs-103653466) **L'essentiel** · news · secondary · captured · published 2026-10-21T14:19:09.172Z · added by `curator@php.newsroom` · `lessentiel-fr-story-mondeluxembourg-une-faille-de-s` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). L'essentiel (French, Luxembourg), 21 October, from a dpa wire report: under the name PHP2Shell, security experts warn of two critical vulnerabilities... capture 20261023T160435Z · HTTP 200 · https://www.lessentiel.lu/fr/story/mondeluxembourg-une-faille-de-securite-permet-de-prendre-le-controle-des-serveurs-103653466- `headers.json` ae43c12ad7d8d3a8293d7639a8201481370a2fce9bfd8a21bad9ce7e2ef4a945 1,030 bytes - `page.html` 31e15e6524d2900eda8e21231662630b24e0036c6417971d2be590d02073eb58 245,809 bytes - `provenance.json` eb2afec0b67b9fd6c4c9e88bc4afc54711aa66f8194d996f84e6508244bb7f48 1,712 bytes - `text.txt` 82df6852e10f2d10229cba85651287220137ad1512a5570e2f8538ae2150524e 10,311 bytes ### [Alerte sur le Web: des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP - Le Temps](letemps-php-sites-debranches/index.html) [original ↗](https://letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php) **letemps.ch** · news · secondary · captured · published not stated · added by `collector-news` · `letemps-php-sites-debranches` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081413Z · HTTP 200 · https://www.letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php- `headers.json` 5007331df9736e8ac4b73506dda7fdd2ae63f582c30c5dd68d79778b99102a1d 3,689 bytes - `page.html` d3a65e2fd0737ae7ab9132c8a84956cfb69749c94b3db910f7ebb3cb25a9192d 240,147 bytes - `provenance.json` acb4558f59f74d9c45deb47a41342784dc02f034806942b610e559b72ac56652 1,237 bytes - `rendered.html` 4d516cac6cb2207d7a2c0ce63b755be7d4b8aabd358d4725d56d681d239d5f89 423,533 bytes - `screenshot.png` 8cbde5fe818acba1bff61e838a4829c20afca0b4dc09f1e65ff54cc1ac9c716e 752,564 bytes - `text.txt` 4330f33c3b6763a95df44d21cfc602ec5f9bfd9df6141e863545c6a9a276cf4e 4,953 bytes ### [Ce este vulnerabilitatea critică din PHP care lovește 70% din site-urile lumii și expune platformele WordPress la atacuri masive](libertatea-stiri-ce-este-vulnerabilitatea-php-care/index.html) [original ↗](https://www.libertatea.ro/stiri/ce-este-vulnerabilitatea-php-care-loveste-70percent-din-site-urile-lumii-si-expune-platformele-wordpress-la-atacuri-masive-0e14ssx) **Libertatea** · news · secondary · captured · published 2026-10-22T12:20:01+03:00 · added by `curator@php.newsroom` · `libertatea-stiri-ce-este-vulnerabilitatea-php-care` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Libertatea (Romanian), 22 October: what the critical PHP flaw hitting 70% of the world's sites is and why WordPress platforms are exposed to mass atta... capture 20261024T133450Z · HTTP 200 · https://www.libertatea.ro/stiri/ce-este-vulnerabilitatea-php-care-loveste-70percent-din-site-urile-lumii-si-expune-platformele-wordpress-la-atacuri-masive-0e14ssx- `headers.json` 3f1f24d54b10bb7044557d969d7b517ccae644598baa87b297708c1b936fe741 1,516 bytes - `page.html` 972a7b473fc7707266b0e4ada7dc8f2c1afe232c62336afe8864b2518d0232bd 279,137 bytes - `provenance.json` 8d86b18cd01cd1cccd11b2306884e75f59d88c0cccf567fecc67ce19e5494166 1,988 bytes - `rendered.html` c0c89e79c533d9cc3f90c3fb4beccdac9672d5fb5d698c9c9068cd4b092a8fee 346,129 bytes - `screenshot.jpg` d1e77b084a964a3484f1cc6b52a1a95bc823736b55424986eefcacf688ac46d3 868,491 bytes - `text.txt` 858b409c48780b09224ef5ba5116ca105bea53c71d0db7b28391d2ceb1041d16 19,392 bytes ### [PHP2Shell, l’IA accelera gli attacchi informatici - LineaEDP](lineaedp-rubriche-sicurezza-php2shell-lia-acceler/index.html) [original ↗](https://www.lineaedp.it/rubriche/sicurezza/php2shell-lia-accelera-gli-attacchi-informatici/) **LineaEDP** · news · secondary · captured · published 2026-10-23T12:00:22+00:00 · added by `curator@php.newsroom` · `lineaedp-rubriche-sicurezza-php2shell-lia-acceler` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). LineaEDP (Italian), 23 October: PHP2Shell, AI accelerates cyberattacks. Critical PHP vulnerabilities and AI-boosted attacks, with the priorities for c... capture 20261023T232528Z · HTTP 200 · https://www.lineaedp.it/rubriche/sicurezza/php2shell-lia-accelera-gli-attacchi-informatici/- `headers.json` 31c50e0835383e4b4a21b1ecb84bbeea08334b6d7f367a04bd89db4872f11110 716 bytes - `page.html` 7954cd299716d20bc027391065da2bff2bd045b131516ef26a96ce0d322ef16b 424,369 bytes - `provenance.json` 867afec79c0eedbc07ed10653e3b4bf22230af669448e56227621fd397998c0b 1,758 bytes - `rendered.html` 8d284df5c3b6a0005b6d42b55b33ddb06ae6179a3152e42c63eac06a7be4e027 513,944 bytes - `screenshot.jpg` 6b036c468812eaeea4091e37dfd7bce8c7af79eefb2325f4b0436fcc6a0d91df 844,146 bytes - `text.txt` 78c698994f0c0f6fbde417a21efc2dd4a3f5856d49712d03a73d7493965d5f8d 14,206 bytes ### [Failles PHP : c'est quoi ? On vous explique la panique mondiale sur internet, l'IA au coeur du problème](linternaute-hightech-internet-11310057-panne-interne/index.html) [original ↗](https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/) **Linternaute.com** · news · secondary · captured · published 2026-10-22T19:36:04+02:00 · added by `curator@php.newsroom` · `linternaute-hightech-internet-11310057-panne-interne` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Linternaute (French), 22 October: a lay explainer of the worldwide panic. It says the cause is two PHP flaws, CVE-2026-109618 and CVE-2026-109619 ('PH... capture 20261023T160435Z · HTTP 200 · https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/- `headers.json` 0383413630ba5ede138ccc6a78815d0e51975378dfe9c571a9303f4dfd9f836c 932 bytes - `page.html` eae3f2f79f90528b21c3a965f21c4810d712358930108548001942f73fb7a373 178,748 bytes - `provenance.json` 6671eb274ea3273dc89d7968970d6495b6cf9a4507fe28cafb76f7a25b41e244 1,965 bytes - `rendered.html` c501436c513066066667ad7af7b5a399e7d92acf10c8a1ebe92ed7ccc9f9bfe8 536,951 bytes - `screenshot.jpg` ee40c9e60b0550992b282c3907130a8092af27fa1e7b9a94b4d2651a0d877fbd 717,622 bytes - `text.txt` 940e7811d3ae55de70fd3dac417e2c383c58e2a555b36c27a5e1a39140fa0a6b 13,096 bytes ### [PHP2Shell: el fallo crítico de PHP hallado con IA](lisanews-internacional-un-fallo-en-php-detectado/index.html) [original ↗](https://www.lisanews.org/internacional/un-fallo-en-php-detectado-con-ia-expone-hasta-el-70-de-las-webs-del-mundo/) **LISA News** · news · secondary · captured · published 2026-10-22T08:18:18+00:00 · added by `curator@php.newsroom` · `lisanews-internacional-un-fallo-en-php-detectado` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). LISA News (Spanish), 22 October: PHP2Shell, the critical PHP flaw found with AI. PHP's makers announced a critical flaw on Wednesday 21 October that e... capture 20261025T120459Z · HTTP 200 · https://www.lisanews.org/internacional/un-fallo-en-php-detectado-con-ia-expone-hasta-el-70-de-las-webs-del-mundo/- `headers.json` d3d4bcdb3965b08bd35f5acc94bed646b8fb61ecf8b46dd912ca54132cb4ae0d 686 bytes - `page.html` 62987245a8313e619860136d525a196b836b1c878b51c911731ead962bc9939c 673,223 bytes - `provenance.json` 40b52d4f6ea17bf3898441ada272c7d93391c679194ef971294d8991c66b92a3 1,787 bytes - `rendered.html` f94802221e1d25b7cacc26d5bf252f8457b88a41419a2674ba2eb7d5a276b26d 700,070 bytes - `screenshot.jpg` 74ec1ea328183ffbbf1ffbd67e304171333d6dc1696a33ab92474f5c0b501ef8 725,329 bytes - `text.txt` 28c2321adc32ccdd2a2937d66f2a49d747f5455a93fff446da9a9a887e11a1da 10,637 bytes ### [حكاية لغة PHP المستخدمة في المواقع الإلكترونية: ثغرة فيها تهدد بريطانيا بالجوع والعطش - المصري لايت](lite-almasryalyoum-technolight-396865/index.html) [original ↗](https://lite.almasryalyoum.com/technolight/396865/) **المصري لايت** · news · secondary · captured · published 2026-10-25T09:52:44+00:00 · added by `curator@php.newsroom` · `lite-almasryalyoum-technolight-396865` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T144008Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Al-Masry Lite (Arabic), 25 October: the story of the PHP language used on websites, a flaw in which it says threatens Britain with hunger and thirst.... capture 20261025T144008Z · HTTP 200 · https://lite.almasryalyoum.com/technolight/396865/- `headers.json` 6210a8cb42c7f92f59e07f12ac90bbc856c3e79072d64579c4ecf77460a5186a 776 bytes - `page.html` 4f7894e81d3df1f32232f2e861743d1e5f76aeab33cadf07e3f7ba1deacd3655 105,472 bytes - `provenance.json` 10065185dd4c0fc4addaef13cd5e2555fcf631b6c07d9c56ecc1e006cc41d680 1,716 bytes - `rendered.html` 8a06e5d566a2e29ad919f72dfd59bc1a2b6e4e80ffdbca75880c53e059b76c8f 162,982 bytes - `screenshot.jpg` 3e54bb43264afba3585b09462265757ab04bd879c76710a76ce75c8cef2f61b3 419,017 bytes - `text.txt` 8e606154af8cb7e815068d80e0dae887e6ab64160b583d639c230c1acffdd26c 12,832 bytes ### [php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security](lorikeet-php2shell/index.html) [original ↗](https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities) **Lorikeet Security** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `lorikeet-php2shell` Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence. capture 20261022T112438Z · HTTP 200 · https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities- `headers.json` b7888c7584d4891b481a804cc3243ec9dff82d301a8ac2c7070c6b7f25bd5fe2 1,727 bytes - `page.html` b74c194ddfc61843d47bd6ffa9d691718fab73fa370cf3c82d1cd24ea3f3f998 343,430 bytes - `provenance.json` 38298cededb4b803f1214bfa4a6a30e1cdf06ddc417f0771577affd057d13e5a 1,123 bytes - `rendered.html` 38608a412a2fb2a979d5821ccb1a9764037d3d2bbad075a509f0d25884973ae5 904,734 bytes - `screenshot.png` 281038d16371213c89c2ce9df773de5a82e6eac69bdfe5c855e3975b02ac6387 8,419,643 bytes - `text.txt` db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349 37,837 bytes capture 20261025T070559Z · HTTP 200 · https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities- `headers.json` 82feef81471d7a64e77b264ed3eb78fe370fdda1a8288764e82829db34e928e2 1,801 bytes - `page.html` cda45109ff195af2678c38806de8c847cf5b6189c9cdf92963d0bfeb789bfc33 342,196 bytes - `provenance.json` 81947b8457c3011818e533361765f04e4d2c051642f123947dcf76c2c69de4ac 1,688 bytes - `text.txt` f3b4827ebfeb5db8d6a63dec4b198e257ec210434bca837c1c8f55444d86989b 36,965 bytes ### [PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům možnost spustit kód na serverech - Lupa.cz](lupa-aktuality-php2shell-kriticke-zranitelnos/index.html) [original ↗](https://www.lupa.cz/aktuality/php2shell-kriticke-zranitelnosti-v-php-davaji-utocnikum-moznost-spustit-kod-na-serverech/) **Lupa.cz** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `lupa-aktuality-php2shell-kriticke-zranitelnos` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Lupa.cz (Czech): PHP2Shell, critical vulnerabilities in PHP give attackers the ability to run code on servers. The two flaws are CVE-2026-109618 and C... capture 20261023T160435Z · HTTP 200 · https://www.lupa.cz/aktuality/php2shell-kriticke-zranitelnosti-v-php-davaji-utocnikum-moznost-spustit-kod-na-serverech/- `headers.json` 7133032f5910a35f204981976cab53074792f28cd28d5328ccbf3983a4f04409 663 bytes - `page.html` 6c9811efb3e7d3b9dc6b88db55a01fb8696ee83987a7221c51e5bd1eaa99da5d 245,222 bytes - `provenance.json` d432bfe81d2ef0ceaf23de6468218a7d3792e33b727be355cb1700b5f24dbae6 1,849 bytes - `rendered.html` c8fe494ed7f9790f4a61aab062cd9f1fa4403ca7394f5e8889c357fa84767b44 433,202 bytes - `screenshot.jpg` af42ed223d6ae4cf4df0eeb141bee7c6fa0848f678a758f89f908f5a79a109a1 351,303 bytes - `text.txt` 4f0699a22c3469b046a76e228284b73af8cb96749bd629a3cd85c57045ede0f5 4,193 bytes ### [ČVUT čelí kybernetickému útoku, údajně doplatilo na kritickou chybu v PHP - Lupa.cz](lupa-cvut-cyber-attack/index.html) [original ↗](https://www.lupa.cz/aktuality/cvut-celi-kybernetickemu-utoku-doplatilo-na-kritickou-chybu-v-php) **Lupa.cz** · news · secondary · captured · published 2026-10-22 ("Dnes"; updated 19:30 local time per the page) · added by `curator@php.newsroom` · `lupa-cvut-cyber-attack` Promoted from the source watch (oq9gflln), snapshot 20261022T191510Z. ČVUT says it faces an attack "part of worldwide attempts against PHP sites", active attack stopped; success unconfirmed capture 20261022T191510Z · HTTP 200 · https://www.lupa.cz/aktuality/cvut-celi-kybernetickemu-utoku-doplatilo-na-kritickou-chybu-v-php/- `headers.json` 9e7cddcd02817e76193919fd96d24ce3c3b47557f4590a79a23862eac5fb3baf 662 bytes - `page.html` d5195979b8f5922d4b2052e2e8954a827aedff331c6794e8d7561328e6a41210 248,530 bytes - `provenance.json` b9993f69e78c56602b3d1be9b434d914f1451bb132d2dbac462d607cfd8fddb6 1,686 bytes - `rendered.html` d8db6b3b2b9b40c2b7d02632307aa6e8708644578ba1c95010426737f51175b8 538,864 bytes - `screenshot.jpg` bff2dc81e08976b5179f030294b31342fdca68d987b547e8568c7343bc383718 340,215 bytes - `text.txt` 0a0abb12fccb6fbccc2b675a8f1b26cc2ab83cfceb120010a8b4cb27effdd337 6,923 bytes ### [lv-latvija-gov](lv-latvija-gov/index.html) [original ↗](https://www.latvija.gov.lv/) **latvija.gov.lv** · government · primary · failed · published not stated · added by `collector-gov` · `lv-latvija-gov` A capture of the site itself on 22 October (HTTP None, page.goto: net::ERR_CERT_COMMON_NAME_INVALID at https://www.latvija.gov.lv/), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081939Z · HTTP None · error: page.goto: net::ERR_CERT_COMMON_NAME_INVALID at https://www.latvija.gov.lv/- `provenance.json` c46e7265217bfc48f378b0011538b59f3e51a97263219d7ca72ed0fd55a3cfb5 465 bytes ### [PHP2Shell: siti offline e aggiornamenti urgenti per PHP - macitynet.it](macitynet-php2shell-vulnerabilita-php-siti-offline/index.html) [original ↗](https://www.macitynet.it/php2shell-vulnerabilita-php-siti-offline/) **macitynet.it** · news · secondary · captured · published 2026-10-22T12:42:16+00:00 · added by `curator@php.newsroom` · `macitynet-php2shell-vulnerabilita-php-siti-offline` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Macitynet (Italian), 22 October: PHP2Shell, sites offline also in Italy, what WordPress users should do. On 21 October GARR, the Italian research netw... capture 20261023T160435Z · HTTP 200 · https://www.macitynet.it/php2shell-vulnerabilita-php-siti-offline/- `headers.json` 99cf9bddafc701ec034763bd3c09a6c16557ad3b615bf010e47a1b71430961a7 1,648 bytes - `page.html` 36ac8367462c24c14617aed19841c480404e0d5978d0664de19e5e6c774c7eda 260,495 bytes - `provenance.json` 2af0225322381f2468693e028a3290d471cd4ded9683645d94306b9a38168999 1,681 bytes - `rendered.html` f0e8dc03096a319edafa4975337f5b857116e2a79699c695325039c6bb5f7cb3 263,664 bytes - `screenshot.jpg` 188acb086ac2716931f85f01a2265ace26ca1746c84cc619fd759dd2569f1a19 711,614 bytes - `text.txt` 578fcf6b9feec91190e40e26fd91e75e869712a60862023673bb5f60b739d0e1 9,078 bytes ### [プレスリリース：HBLAB、PHPの重大脆弱性「PHP2Shell」の影響範囲を調査するアセスメントサービスの提供を開始（PR TIMES） | 毎日新聞](mainichi-articles-20261023-pr2-00m-020-690000c/index.html) [original ↗](https://mainichi.jp/articles/20261023/pr2/00m/020/690000c) **毎日新聞デジタル** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `mainichi-articles-20261023-pr2-00m-020-690000c` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Mainichi Digital (Japanese), a PR TIMES press release: HBLAB Japan begins offering 'PHP2Shell Assessment', a service to investigate the scope of impac... capture 20261023T160435Z · HTTP 200 · https://mainichi.jp/articles/20261023/pr2/00m/020/690000c- `headers.json` 4082fa4d40b82b30dcedc831b3ede60f52b9916a15519bca8ab511cb2b119786 957 bytes - `page.html` 63967065edfb137409b6bcbfb3cf8d2937c6c926e0dc956a56f3ccb5f7132fd9 88,612 bytes - `provenance.json` 31a95fbcbfbee5e87e6b09f433cedc963637af647c37ea1f44fc0e0fd2384539 1,754 bytes - `rendered.html` 99b28bfa65b195402990ce93f5e4cad9fbba2ffa697f2d7ad7acdfa0f002768e 124,040 bytes - `screenshot.jpg` 618aeb473bb25714e07712ae51cc35218140a0c288b11ae1dfc2642cc03307a7 605,537 bytes - `text.txt` a0d3946b2a22cd7f6aa6655a334f916b3cfef4a34697c5aef718ba2f794519ea 11,488 bytes ### [PHP2Shell: Waarom veel websites offline moesten gaan | Malwarebytes](malwarebytes-nl-blog-bugs-2026-10-php2shell-why-websi/index.html) [original ↗](https://www.malwarebytes.com/nl/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates) **malwarebytes** · news · secondary · captured · published 2026-10-21T16:14:18+00:00 · added by `curator@php.newsroom` · `malwarebytes-nl-blog-bugs-2026-10-php2shell-why-websi` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Malwarebytes (Dutch edition), 21 October: why many websites had to go offline. The flaws, known as PHP2Shell, are CVE-2026-109618 and CVE-2026-109619,... capture 20261025T093507Z · HTTP 200 · https://www.malwarebytes.com/nl/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates- `headers.json` c127e590c1c1662737cb2831dc61804a86978d46cbf4dc01bb46e059b1f4bf1c 997 bytes - `page.html` 8c66de54dda6b304ce8e0b514223a7c0a4a991f685a1bbf91cfd7328ca0137b3 393,530 bytes - `provenance.json` 1856aed02753cb762932f941386efc095ea4573c26904168e3a90ae84aaeee1e 1,835 bytes - `rendered.html` e7fb7ef452a667caeb3517d6e835732d4b42deef8e494c97bd76e6d89e2e3e23 404,565 bytes - `screenshot.jpg` 37f8cdd60f58e859a7325c208335e452daeb6345a3ef7aa783f5ccdf2bd07ee1 699,867 bytes - `text.txt` d3098f85c2acf8ef34f5002519916d5f4c17364c6ebf48d06334c9a012984b65 9,514 bytes ### [PHP2Shell nedir? Kimleri etkiliyor, site sahipleri ne yapmalı? - Manşet Haber](mansethaber-bilim-teknoloji-php2shell-nedir-kimleri/index.html) [original ↗](https://mansethaber.com/bilim-teknoloji/php2shell-nedir-kimleri-etkiliyor-site-sahipleri-ne-yapmali) **mansethaber** · news · secondary · captured · published 2026-10-22T00:45:00+03:00 · added by `curator@php.newsroom` · `mansethaber-bilim-teknoloji-php2shell-nedir-kimleri` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Manset Haber (Turkish), 22 October: what PHP2Shell is, who it affects and what site owners should do. Two critical flaws in PHP, used across millions... capture 20261023T160435Z · HTTP 200 · https://mansethaber.com/bilim-teknoloji/php2shell-nedir-kimleri-etkiliyor-site-sahipleri-ne-yapmali- `headers.json` 646e2d109d75f26899af2bf91efea4649c357bf74b5d07f5f1f0e19813b7a33c 3,397 bytes - `page.html` 90732bb1fe902deb1f8873cb098b7974b35fc8bcb864a360fa9a07e6a05b3bc3 233,226 bytes - `provenance.json` fccb535b6654d036a786341c80d97aaad7529c28d6b1deb63f93b701216a1788 1,800 bytes - `rendered.html` 56c6d6d0ef663b576fe86010167d2665c544948b1361df08430eb47b5794f03a 234,583 bytes - `screenshot.jpg` 00825040bcd1efac27ed8074cf6332d5c1023d7a97ec7fdb3a0f74732f5b5a1c 658,308 bytes - `text.txt` b45e8fcedbc9b60ca53f8eebe87ff081eeb8cbfe8316344ee7a1a479f04f3072 8,680 bytes ### [La crisis de seguridad en PHP, explicada para dummies](marketing4ecommerce-crisis-seguridad-php/index.html) [original ↗](https://marketing4ecommerce.net/crisis-seguridad-php/) **Marketing4eCommerce** · news · secondary · captured · published 2026-10-22T11:40:23+00:00 · added by `curator@php.newsroom` · `marketing4ecommerce-crisis-seguridad-php` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Marketing4eCommerce (Spanish), 22 October: 'the PHP security crisis explained for dummies' for people who run websites or online shops. It says it has... capture 20261023T160435Z · HTTP 200 · https://marketing4ecommerce.net/crisis-seguridad-php/- `headers.json` 7e11526ab71fc85e828c42c880ad8bf9a1f50c547b04a7a0f69cb92c4ef2be18 619 bytes - `page.html` fe6cada937dd531d6462eb940acbf26739669197a8288566686d16440bf63616 292,655 bytes - `provenance.json` 1115e0a3e14bb33d6be84d6226a7a88416ec1d84d40bd27f3e2e4841e18eba1d 1,608 bytes - `rendered.html` 9757567561fc958b3c6fabad239d77e483292b31602b75f583507cb674fa9539 252,529 bytes - `screenshot.jpg` c0aff27a85cf0d3d81ee06ca78ab79f51144b09a9e367ddb71c4f09becf15aa1 769,700 bytes - `text.txt` f6697167654f81fa7d28a48e73539bfc43e7c2851bae6a17daabc65ab7caea36 13,422 bytes ### [BSSN Peringatkan Celah PHP2Shell, Jutaan Website Berisiko Diserang](medcom-teknologi-news-teknologi-en442w3n-bssn-p/index.html) [original ↗](https://www.medcom.id/teknologi/news-teknologi/eN442w3N-bssn-peringatkan-celah-php2shell-jutaan-website-berisiko-diserang) **Medcom.id** · news · secondary · captured · published 2026-10-22T23:03:00+0700 · added by `curator@php.newsroom` · `medcom-teknologi-news-teknologi-en442w3n-bssn-p` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Medcom.id (Indonesian), 22 October: BSSN, Indonesia's National Cyber and Crypto Agency, warns of the two PHP2Shell flaws, which could allow remote cod... capture 20261023T160435Z · HTTP 200 · https://www.medcom.id/teknologi/news-teknologi/eN442w3N-bssn-peringatkan-celah-php2shell-jutaan-website-berisiko-diserang- `headers.json` 526a962ae0b8236e4aa56e42859bae7123af2ed59fc62ab73dc7e1da4240860a 361 bytes - `page.html` af1add52dd3742d353822df96632c7d0542dd68f293d4781c992176606189ab5 82,389 bytes - `provenance.json` cee23246b61dc37b31f2a0a545e1940599da7100f3a7929d5b57dab7c8139e4d 1,668 bytes - `text.txt` 855fcadf4fce89cba83f30ec7908f40eae370f9e4f3e50b826ddee04c74662f0 5,543 bytes ### [Celah Keamanan PHP Ditemukan AI, Pemerintah dan Situs Global Lakukan Pemadaman](mediaindonesia-teknologi-947268-celah-keamanan-php-dite/index.html) [original ↗](https://mediaindonesia.com/teknologi/947268/celah-keamanan-php-ditemukan-ai-pemerintah-dan-situs-global-lakukan-pemadaman) **Media Indonesia** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `mediaindonesia-teknologi-947268-celah-keamanan-php-dite` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Media Indonesia, a PHP2Shell piece: a security hole in PHP found by AI, governments and global sites carry out shutdowns. It says the PHP2Shell vulner... capture 20261023T160435Z · HTTP 200 · https://mediaindonesia.com/teknologi/947268/celah-keamanan-php-ditemukan-ai-pemerintah-dan-situs-global-lakukan-pemadaman- `headers.json` 4d62a0152431c3031665bb89a594dce2ce44b4267b69ba67a989bd5ad539381f 1,183 bytes - `page.html` c598431bdbebe5f0133f370e49ab8c27bb4e28bd39e5f01fb2098bdadf88bbd3 87,820 bytes - `provenance.json` 9115ba0e1e6e559bd57d130d068c762f7730ca5d6bc0f7a71f609e30541b8925 1,852 bytes - `rendered.html` 81725165b34fb73d4c3b28b3bb6e69ee9b52a98b70365f4f8b94d8411fbd5302 338,886 bytes - `screenshot.jpg` 1997abde87a46bbd470646b07a49e9186f41c3a3c867b0f33e75fd8150525691 470,168 bytes - `text.txt` cf7d08e38622b59aa531459fce47543a1f1d52a0b3b39eb8f82a1d178a4824a5 7,230 bytes ### [What are the two PHP vulnerabilities behind a global rush to update](medianama-2026-10-223-php-vulnerabilities-global-rush-update/index.html) [original ↗](https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/) **MediaNama** · news · secondary · captured · published 2026-10-22 · added by `curator@php.newsroom` · `medianama-2026-10-223-php-vulnerabilities-global-rush-update` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). AZDHAN: the flaws were disclosed on 21 October with patches and named 'php2shell' by Ryan Austin at Calif, who published a paper. It says PHP 5.4 through 8.5.11... capture 20261023T080331Z · HTTP 200 · https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/- `headers.json` ee157858bcb602c0c1ce9b7372c50ba7d675acd38b035c7cf8d465dcf3f48c2e 991 bytes - `page.html` 11383a14b16bc87a3cc06ec7634aeb3baf026b2cc373ad339f5c2a089cfa441a 95,061 bytes - `provenance.json` a10e2b5d071b21abd84e83601f2d4bafc27985668bb9f35ec7e43f5ebfcbb2e6 1,728 bytes - `rendered.html` 784c7da38952ea9ba7b2a655e2e41fcbf0ed138188bfd74f7861e9a2931cf29f 99,545 bytes - `screenshot.jpg` e6084674816cdad668b6e423b809d50a32e464c382d5286130604b537a41748a 735,737 bytes - `text.txt` b30b86dc910dc8d60cbb6deaf6383d04f99c68b984c5d04673dd949e1cb4f04d 10,521 bytes ### [Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities](miltonkeynes-must-read-astra-security-launches-free-t/index.html) [original ↗](https://www.miltonkeynes.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867) **Milton Keynes Citizen** · news · secondary · captured · published 2026-10-23T14:57:09.000Z · added by `curator@php.newsroom` · `miltonkeynes-must-read-astra-security-launches-free-t` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Milton Keynes Citizen, 23 October: a syndicated press release from Astra Security, a security vendor, announcing two free tools to help organisations... capture 20261023T232528Z · HTTP 200 · https://www.miltonkeynes.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867- `headers.json` 55198ccc5170c3b3d540f1cc158507a7564a9a1894a705f4f7f8546f8e4ebdf1 1,509 bytes - `page.html` 4f56247754677abaa151428c7ac908cc2d1d683f7ea05e9fe74a3d5cd75da6b1 231,359 bytes - `provenance.json` 2d9e12ba2172fd1ca6f46b6d5244945530fb3a37fd81de23d88bf98a6b22a795 1,897 bytes - `rendered.html` 0462f2d1a075fec4568e57fbaa0251eef9d5e2fb7958e0235c29b8dc4ba507a0 237,625 bytes - `screenshot.jpg` 2b637f018b47e9ca86864363bc3305dfa3d88183a5786c6839beaf525477567c 344,391 bytes - `text.txt` c4a894f10da9042e9411c86a9764e204e4510e468ca0973fffc813c10155e9bb 6,927 bytes ### [La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial](moncloa-2026-10-22-vulnerabilidad-php2shell-fall/index.html) [original ↗](https://www.moncloa.com/2026/10/22/vulnerabilidad-php2shell-fallo-critico-ia-3453167/) **MONCLOA.COM** · news · secondary · captured · published 2026-10-22T09:55:12+02:00 · added by `curator@php.newsroom` · `moncloa-2026-10-22-vulnerabilidad-php2shell-fall` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Moncloa.com (Spanish), 22 October: the AI discovers the PHP2Shell vulnerability, the critical PHP flaw that exposes 70% of the world's web. It says an... capture 20261023T160435Z · HTTP 200 · https://www.moncloa.com/2026/10/22/vulnerabilidad-php2shell-fallo-critico-ia-3453167/- `headers.json` 43425b1dbaa35825bffd5af2d6c40ecf455de6acb0c0f380c999f15a33c1e6a0 3,015 bytes - `page.html` a218ae80394ff14f952df41dbe2190a8453767a9809e136d6a63a95513e8ea42 836,913 bytes - `provenance.json` 9e0107b70d9d92bcadeebd216ff30a4fcc520affdf6724a2c4047bdae0b3421d 1,786 bytes - `rendered.html` 61bc44b62bef2214661ea769e869132d05fc419dbbcaefb8495d77aff9fe489a 836,519 bytes - `screenshot.jpg` 26c53f68097b0952bbe0c13d10af60373e00d3c30e7193a0233f91d1d7c6e35f 540,124 bytes - `text.txt` b6c5efbb52b2517a92d8c5f05ccf4f3df911394881bc73fef1287e6822f69626 8,169 bytes ### [PHP-Sicherheitslücke und Hacker-Angriffe: Viele Websites wieder online](morgenpost-politik-article413475223-weltweite-siche/index.html) [original ↗](https://www.morgenpost.de/politik/article413475223/weltweite-sicherheitsluecke-zahlreiche-webseiten-werden-abgeschaltet.html) **Berliner Morgenpost** · news · secondary · captured · published 2026-10-22T12:32:41.000Z · added by `curator@php.newsroom` · `morgenpost-politik-article413475223-weltweite-siche` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Berliner Morgenpost (German), 22 October: many websites back online; the PHP2Shell vulnerability triggered millions of attack attempts worldwide. Acco... capture 20261024T083755Z · HTTP 200 · https://www.morgenpost.de/politik/article413475223/weltweite-sicherheitsluecke-zahlreiche-webseiten-werden-abgeschaltet.html- `headers.json` 6932a2fce0d33d0deabcbdd76a371593f894435e90175c9458d1bb1f6455b975 711 bytes - `page.html` c99b082464f9e8666d2dfd752dc3ad6a50701d99675aab2ab2bb61cd7301229a 365,980 bytes - `provenance.json` 4d524cf800f97e5bb620fc71475d2e28930effa00e6dd9c8c2bc5784c004ed16 1,691 bytes - `text.txt` d74246f0d89bb48b410f6da43dec7b755f8f15b3a3cee7d07858fc4f7592ad9e 10,139 bytes ### [Morocco’s DGSSI Warns of Critical ‘PHP2Shell’ Vulnerabilities](moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu/index.html) [original ↗](https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/) **Morocco World News** · news · secondary · captured · published 2026-10-22 · added by `curator@php.newsroom` · `moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Oumaima Moho Amer: Morocco's DGSSI issued a critical bulletin, reference 69782110/26, on the two flaws, saying proof-of-concept code is available. PHP is used b... capture 20261023T080331Z · HTTP 200 · https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/- `headers.json` f51d49ff2934353321b804f16536cfec7fc66697ee3b305572c023d2c6c2d6dd 863 bytes - `page.html` f9e9d6407bc111b7b2ded3ebe5c64bcdcdba311441620104c6fa326a2d032bde 262,781 bytes - `provenance.json` f129b2291c1142a9ea132fdd0bc5623f37d49ab5c8dae870e4a48fe92458dbd6 1,839 bytes - `rendered.html` 9f8a8f67c9fcedbe8ec73019b15f00e4f3ad9ca3b0510a542397bd411941291c 314,791 bytes - `screenshot.jpg` 24f9199e5f1dc3934486d5b71a33c1d4e497e3e1192e667a20afc1fc9a5a7515 394,771 bytes - `text.txt` 56b8e97d863b6884f74d8af7f5d2b7cae0e071eb875027895e35e8c483eaacdc 4,275 bytes capture 20261023T160435Z · HTTP 200 · https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/- `headers.json` 96afc786c13047fabbbb8ddd87df4db936471b5c46a0d67d8149b76fd174b045 864 bytes - `page.html` ce5cd0fc6fe7b74599506c6d8b91c9b6bee9f09c61754925b3f591862be4e718 276,203 bytes - `provenance.json` 58e5bf80ec39e90fc46df548e21b3f21fd78a94976f7397baf625ebb31902729 1,840 bytes - `text.txt` 384fd855e0fa5ebcfd79a4253dc6b8c75891247e15ca6ccb7a8ca34414c7ba58 4,756 bytes ### [PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이](mt-tech-2026-10-24-2026102414170377166/index.html) [original ↗](https://www.mt.co.kr/tech/2026/10/24/2026102414170377166) **머니투데이** · news · secondary · captured · published 2026-10-24T14:26:36+09:00 · added by `curator@php.newsroom` · `mt-tech-2026-10-24-2026102414170377166` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Money Today (Korean), 24 October: signs of North Korean hacking planning exploiting the PHP vulnerability, with South Korea, the US and Japan as core... capture 20261024T133450Z · HTTP 200 · https://www.mt.co.kr/tech/2026/10/24/2026102414170377166- `headers.json` 78f7a8b030886216969762f32bc1d809c0a474a33892878583c433cdb45c737c 1,516 bytes - `page.html` 41ff83151d4b3d797c3d6fde55f50ccbe4375c3bdba2aadb694844b52cb76e50 76,145 bytes - `provenance.json` b68e30f647833828851f0a85a2e813a13417c62d914523908882dc9ade73993d 1,504 bytes - `text.txt` c4b5b04752433be6012bd4ac2637ae2b30e7fc9b49dc10d66a21be5efc0e6ef9 6,796 bytes ### [PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet](muycomputer-2026-10-21-php2shell-el-fallo-de-php-que/index.html) [original ↗](https://www.muycomputer.com/2026/10/21/php2shell-el-fallo-de-php-que-ha-puesto-en-jaque-a-internet/) **MuyComputer** · news · secondary · captured · published 2026-10-21T17:21:39+00:00 · added by `curator@php.newsroom` · `muycomputer-2026-10-21-php2shell-el-fallo-de-php-que` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). MuyComputer (Spanish), 21 October: PHP2Shell, the PHP flaw that has put the Internet in check. The incident has its origin in two vulnerabilities in P... capture 20261023T160435Z · HTTP 200 · https://www.muycomputer.com/2026/10/21/php2shell-el-fallo-de-php-que-ha-puesto-en-jaque-a-internet/- `headers.json` 57a9d2a059d52772b3ffb5aabd3d1fb49e679144ed83562468d751d4fbb63cb3 1,125 bytes - `page.html` 12342e01d2cb41cd40ee5aae407a9f1b731c14f50756d61e4f7c9422ebc82b27 198,655 bytes - `provenance.json` 23bc37bbc4efb9bf93dfbdf82320b401cd05295b63c21ad9bd021a8a45dbb350 1,780 bytes - `rendered.html` e628fee8b55ecdda4144f2a4a171d626bd22eceee7cfd360a665479ac565ed8b 265,171 bytes - `screenshot.jpg` 60e0a43871f2c79e7663ddedb9cd647a946a6290d308a079cd21aa42f93b5208 1,070,763 bytes - `text.txt` 61c7b6c00f7eeb0477aa0a315fea86c01b786193082188d18a15becbd98e4099 21,496 bytes ### [PHP güvenlik açığı alarmı! İki kritik açık bulundu: PHP nedir, ne işe yarar? - TREND](mynet-php-guvenlik-acigi-alarmi-iki-kritik-aci/index.html) [original ↗](https://www.mynet.com/php-guvenlik-acigi-alarmi-iki-kritik-acik-bulundu-php-nedir-ne-ise-yarar-190101302483) **Mynet** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `mynet-php-guvenlik-acigi-alarmi-iki-kritik-aci` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Mynet / Trend (Turkish): PHP security alarm, two critical flaws found; what PHP is and what it does. The two flaws, named PHP2Shell, may let attackers... capture 20261023T160435Z · HTTP 200 · https://www.mynet.com/php-guvenlik-acigi-alarmi-iki-kritik-acik-bulundu-php-nedir-ne-ise-yarar-190101302483- `headers.json` 2ba13f4cc0e6ecc51e2b3c9279fe083ac9198d9c969ddc313d76656239d619ff 765 bytes - `page.html` 0225305288ac670a973acd5e47b7b0d8c2135c7a36266648795c9a45d3205a34 151,189 bytes - `provenance.json` 19dd8cd3cff169c8bf7ffc6efc92ad1e3aea748b51b20c1df635f3295ba0c3b0 1,664 bytes - `text.txt` 526ad8cca6bc26bb43d83c72029e335adf3b6fe69a95ba2af3280736b9c4399e 15,701 bytes ### [Critical security issue affecting PHP](ncsc-news-php/index.html) [original ↗](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php) **UK National Cyber Security Centre (NCSC)** · advisory · primary · captured · published 2026-10-21 · added by `collector-gov` · `ncsc-news-php` NCSC Alert. Page: PUBLISHED 21 October 2026; JSON-LD dateModified 2026-10-22; HTTP last-modified Thu, 22 Oct 2026 07:30:02 GMT. Names CVE-2026-109618 and CVE-2026-109619. Advice: update; else PHP Foundation temporary mitigations; 'If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.' Wording differs from BBC's quote. capture 20261022T080903Z · HTTP 200 · https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php- `headers.json` 642ad2462903a32f7050dae5e198654e710dadc0a6225333d96370031c7ede4c 852 bytes - `page.html` 2d8e9e72ec5efa695b2d587a4af1bcb75662ead0add90b964cf767e8023ff4f8 225,168 bytes - `provenance.json` fe3daad10ed2709f256ce5547b2a21d8b35120fe041248d698a63d75652a19fb 1,025 bytes - `rendered.html` 0b839c8974dc2310cc6f85d334620ae5b5cd944842d6de180bf76938f5b6dcf5 761,056 bytes - `screenshot.png` 260b9c91a3bf1a838fd1a81633415032eacd24ccaf249c11227903c6038b4544 542,775 bytes - `text.txt` a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339 5,135 bytes ### [NCSC NL | Security Advisories (PHP banner: Ernstige kwetsbaarheden in PHP: bereid je voor op patchen)](ncsc-nl-advisories/index.html) [original ↗](https://advisories.ncsc.nl/advisories) **NCSC-NL** · advisory · primary · captured · published not stated · added by `collector-gov` · `ncsc-nl-advisories` Final URL advisories.ncsc.nl/. A banner is still the pre-patch text: 'bereid je voor op patchen', patch expected '21 oktober 16:00 Nederlandse tijd'; 'Er is een publieke Proof of Concept (PoC)- code beschikbaar, maar het NCSC heeft nog geen actief misbruik gesignaleerd.' Affects 'alle versies vanaf versie 5'. capture 20261022T081605Z · HTTP 200 · https://advisories.ncsc.nl/- `headers.json` 3e389f62cb8a1de496ebc873bbcfb98ccf729f22e1ec56c94d0893bba1bef324 884 bytes - `page.html` c0c4e5aa82e2eaec26497f7eb201c72888ecdcb1361964f73aab7b5dcc046c5f 240 bytes - `provenance.json` cd3655ebd5a05e5e7a94cfc0438e17c9f78418f1c570bf5097613f30ba7612ca 980 bytes - `rendered.html` f008b1f5da4c00459105f979db89eebc16702be90d3a6de1656acfab41951cc6 69,813 bytes - `screenshot.png` 9bd5b7a047aff8b7f81e8c61b6f1ccc1475f7be1ad89a7d9d32a6f2aee84abbe 611,099 bytes - `text.txt` b7e4ac6caf7d177d8b7e55fa8c587da75a1e78fafc951012d2d2595a6dfa5e8b 8,130 bytes ### [NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilities](ncsc-nl-php2shell/index.html) [original ↗](https://github.com/NCSC-NL/php2shell) **NCSC-NL (Netherlands National Cyber Security Centre)** · advisory · primary · captured · published 2026-10-21T15:25:00Z · added by `collector-gov` · `ncsc-nl-php2shell` README: 'Readme last significant change: 21 October 2026 17:25 CEST TLP:CLEAR' (=15:25Z). Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Links to CERT-EU SA 2026-018 and ENISA CNW-2026-04. Holds the software inventory list (the NCSC UK cites it). Does NOT advise taking systems offline. capture 20261022T080925Z · HTTP 200 · https://github.com/NCSC-NL/php2shell- `headers.json` dbef75c6f088a0a21eeac77ab2178aead9e625d6ed750dd4894fc7fb9537f297 5,443 bytes - `page.html` 4e1f8dc6dd2c6d494b9d1229a0de601b0e1096e81337d8a4b5b06fa7c3c293ce 261,528 bytes - `provenance.json` 939b683f13402c1f5d315ff79800619b30e3780d4eb31bfc2b17282148c8e03a 1,005 bytes - `rendered.html` 323e0a19a3dd13c2b214ff7b1a8553eacac4c17bdfb8b8c1a9bf2032781934db 273,849 bytes - `screenshot.png` a27d227bafcdfbc38ca5c431a5fb525aa95eeac6e7bfbe31c98ae8057c2e4d64 494,937 bytes - `text.txt` 8944dd45c25fa7c1fc1c6f3e2a646d86fe0849a83248fe1f91cec791a58589e6 4,852 bytes capture 20261022T084815Z · HTTP 200 · https://github.com/NCSC-NL/php2shell- `headers.json` dc374a245415e7981501c8d9adea6d18ac20101116a21380bafe62b351dba7c0 5,453 bytes - `page.html` 556efff0dd62f6bdf88e3ed5566f6f2213e828b2bbfeba7eef0b3cd3ac622057 261,276 bytes - `provenance.json` 7544f40915d6c5cb74cdc60621deee2e3d7773de3a0191201caf4089fbd5d094 1,005 bytes - `rendered.html` 42194f5b28315e862789c25ed7c3a2bbbfa3244da3bb68e8e3ff284f321ccd38 275,802 bytes - `screenshot.png` c6a14bc8234e3b2b5692240e1f2821e9e80e51e52bd5bec2e89dcf3a7a8a1764 497,834 bytes - `text.txt` f3eec24a226910fb8440714b4f44c40db5c5f7826f3c23b65aece1cc5775712e 4,854 bytes raw, 3 files with SHA256SUMS- `commits-cca173c64ec5.txt` 4d4f80bd9da0076e2bd74323e947a05f1e0f1a246a5a25b2874dd9370b4a2ea9 - `php2shell-cca173c64ec5.bundle` 4a72bcc9bbc58e886df6eee7cc875bd5deab547f1028f7525a7e7e808859411f - `software-list-cca173c64ec5.json` f0a17e96a336a8782231290acf4ba4a4f4fa469270c59a7c87a95da2207dad01 ### [List of software with PHP dependency potentially affected by php2shell CVEs](ncsc-nl-php2shell-software-list/index.html) [original ↗](https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md) **NCSC-NL (Netherlands National Cyber Security Centre)** · government · primary · captured · published generated from the repo's SPDX inventory; commit cca173c64ec5 at 2026-10-22T08:40:58Z · added by `claude-newsroom-lead` · `ncsc-nl-php2shell-software-list` Pointed out by the editor as the source for affected systems. 674 entries at commit cca173c64ec5. CVE-2026-109618: Fix 46, Investigation 418, Vulnerable 206, Not vuln 3. The parsed list, the repo bundle and the tree are in ../ncsc-nl-php2shell/raw/. capture 20261022T084807Z · HTTP 200 · https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md- `headers.json` ced0e6933669176a62c459545b9b58df2ecd44f502200c04ac548e8bf513cf2d 5,624 bytes - `page.html` b6810b0801213bba67b7fff83b519ffc971c4271b217cf2ab4083ecee77d2c81 223,836 bytes - `provenance.json` d02a4a269f2919ede5233e84a57e72d3dc9adb56e4d98d2ca23fb319384925b9 1,059 bytes - `rendered.html` ed0e84fc69079d5df2c192b657719a25a29e9ce62aae2034ece866b27ee6c079 288,875 bytes - `screenshot.png` c610a27540c7c58e4e02cc90bc268c1a5f5b8bd8295fd543badb47cfcdad0e3c 137,355 bytes - `text.txt` 83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004 1,255 bytes ### [NCSC-NL php2shell software inventory, all 27 per-letter files (snapshot 18:36 UTC, 22 October 2026)](ncsc-nl-php2shell-software-list-letters/index.html) [original ↗](https://github.com/NCSC-NL/php2shell/tree/main/software) **NCSC-NL** · government · primary · captured · published the files as served by raw.githubusercontent.com at 2026-10-22T18:36:24Z · added by `curator@php.newsroom` · `ncsc-nl-php2shell-software-list-letters` Promoted from the source watch (oq9gflln), snapshot 20261022T183624Z. The inventory now lives in 27 per-letter files (724 products at 18:36 UTC: 61 Fix, 216 Vulnerable, 440 Investigation per CVE); one evidence source holding all 27 as one capture capture 20261022T183624Z · HTTP None · https://github.com/NCSC-NL/php2shell/tree/main/software- `provenance.json` 96fefbdceedc7a77392ab4eb02113b66e1fe23086cee94e7d5915e8d4ba83529 27,536 bytes - `software_list_0-9.headers.json` 8b6c3861a446ab0e235a94c6fe581a8a8c29d07766d05ad27d1081395b00183f 1,084 bytes - `software_list_0-9.md` e90872af6f1fdb008813a09c19cf47ac5e35273f1b62b22de7f98689543d447e 994 bytes - `software_list_a.headers.json` 7a031d8aeaabee81d6e88e92327a4ffcc255bc9782d25eabdac5bea4c86839c1 1,088 bytes - `software_list_a.md` 662945741f0143d43f56c10f20b46a595e9e10e3880199fb2b2311b0c89e504a 12,423 bytes - `software_list_b.headers.json` a5fe813f15d6cfb9a849d51d1f508944ef2049dfe5bd999ab6b8ccbbbb0066d1 1,086 bytes - `software_list_b.md` cb1e67ea7608987077b79a4681f35965afa555b6592cc5cd8bec8f3c271fd9fb 8,636 bytes - `software_list_c.headers.json` 2942f75360df0abc6202f2202939b60a2e413694c35e62f5e04cf927ae309a3a 1,086 bytes - `software_list_c.md` 43013c1e1db1e111976262680a9e3cda0f4fd17a79352b2db8240528524187fc 40,915 bytes - `software_list_d.headers.json` ffea5957977ad9253169a44a1bd6143972eda64c577a32f1eb760433b481872f 1,087 bytes - `software_list_d.md` f56d6989bb7d533935ce59f47ec623db4fd40bc0fb4fcff4b50c35e4b6df9f20 12,025 bytes - `software_list_e.headers.json` 18deb3e0c81d2cfc91bbda13945bca9b5c614d2a0832decd6ff85a09daf61cbd 1,085 bytes - `software_list_e.md` bc44010fd79ae3c0fb75d072a4fe1eb48b980b4e25a67b6dc5307b052fc9a446 7,385 bytes - `software_list_f.headers.json` 13883536787fbb42283db2b451051ea1e894650295f2ab4a6ca37b427167712d 1,087 bytes - `software_list_f.md` 839e816c660e9b5a6660b8b904d9220919312db233bdb781684934c707164568 18,502 bytes - `software_list_g.headers.json` ae66666fc2a6dce8318687792be825299dcd76b50f3140572352ce377dc0db3b 1,089 bytes - `software_list_g.md` a1de1b0e10dd759cd2e3493b78555b76e37eab2e51b99fe9465a54235e29fe6f 9,783 bytes - `software_list_h.headers.json` 19700f8b2fd8516f4356d22200cb19793541f6e547bab91fb4961267b5584ab1 1,088 bytes - `software_list_h.md` 28b2a1ca72e63781edf9d40243b845792217f14d2b24f9faf1e50d3799e3d042 6,127 bytes - `software_list_i.headers.json` 14e4a0a8cdceb3c4488f20c81082c88f53e4f784cb49749d01197631c59f38cb 1,086 bytes - `software_list_i.md` f25e5ef68d476c053abd638b75441aa462fd630a83d7059696ff675f53fa55eb 9,544 bytes - `software_list_j.headers.json` 9a3a89932a8136873d2329df111b302a69a125a2eea210d176e5c18c5b49c3a9 1,084 bytes - `software_list_j.md` 1fece5bf0287178a9830d55a417ae41064449dc8b07c15145e3dfb21b0e0255f 4,328 bytes - `software_list_k.headers.json` d6f8dee8005fba048c718ec7143cda2c461dccea10e5a39876e32e7c2d444bd2 1,085 bytes - `software_list_k.md` 50ff337adf97f4e309944fc6e88ca0d2319c5fec10670a4c2c05f2f650fc1399 4,978 bytes - `software_list_l.headers.json` db1c368cbf02cfa10e902e7b9926ffd976c0caa6258da644484a8218afcf2822 1,087 bytes - `software_list_l.md` 0250e097e5e08cb8ec83f1bbd7c670838111746a0670c1005a4ad3d9e6462115 10,711 bytes - `software_list_m.headers.json` 79ffa6f42f1d8b23efe0a5da78cd4afaa03d00a6ed86090cc5ec423c14e90214 1,087 bytes - `software_list_m.md` 5cbd54517c4d4f0c7ea4c0ef47d368fc2a639d91b9ceb10280b0235887f8e222 16,116 bytes - `software_list_n.headers.json` e1af67c61abf4be0cf4f59ff84a1b0278e8de116baab69f8982f4bbb12fc3829 1,087 bytes - `software_list_n.md` dc21e57314a4f89399576af7e9f0587e3f25dd585d610881b84fc1e252b3239f 18,152 bytes - `software_list_o.headers.json` 1e3b2c062c0a4c739e0e9ce939b185c096423057767d8a802be897d363d48973 1,086 bytes - `software_list_o.md` 3ae25cad7f40224327009357d83d9ae970f05cedc3e7a877b763307f165edfef 14,380 bytes - `software_list_p.headers.json` c967aab44c297b58ff8112c62a249d4b0c767c28a069403049c2b4d6118b7061 1,089 bytes - `software_list_p.md` ad665b8c782cbf7225359bcca0f1ae51d320c0b76138401803899d0239cbdab7 36,990 bytes - `software_list_q.headers.json` a820ff9846f76569cb042649ceb3de18a0317b2d8968a962f4e5406f34ed7096 1,086 bytes - `software_list_q.md` 0c2f85c6cc5203850206c1a6e1d6495b2207b2a52152259871379a74795cf40d 6,289 bytes - `software_list_r.headers.json` 548df3d986e6c7f1a0fbdcb2efaa33fe266854d5c4fba1fbe4e713f9fd9b231c 1,087 bytes - `software_list_r.md` cf5264700a6574d02b6c446aa88faf87506af68581e0bccf1cd3bccc25eaaab2 6,473 bytes - `software_list_s.headers.json` bfcff85e346870ec70c5ecf2887aea4136f74d1eb06c318cc6be6fbcbbb13da7 1,086 bytes - `software_list_s.md` d77663690cb40c3130a659ecce4929ddacbaaad90261e1be317ae78ee54f9661 32,086 bytes - `software_list_t.headers.json` 82bac062177772af480d8b3831bfaa423eac771d1dc843c1b209e9142a28bb1b 1,087 bytes - `software_list_t.md` 6d3c76f3348ab1ab6d7d3518ab81fb9677b7b43d8901b4186efac826b0350e5e 54,594 bytes - `software_list_u.headers.json` 154b0a19184c0cbca223d090a6c71782d60bbf568c96f193452d139604d304e3 1,084 bytes - `software_list_u.md` 2314ce9b13c2b0739abb64cc0e130eee4233e5704ea03d9c698e3f1a4eecdb24 3,417 bytes - `software_list_v.headers.json` 6b25a8a110a18aa9a436d2d0bca8536f5f75f669b5fd7b18c8be85ac5ada0282 1,089 bytes - `software_list_v.md` 6bb20eaf53eea2e2b5373700830a143488d34b4ac155d15bbf1625b9c044b8da 5,264 bytes - `software_list_w.headers.json` 3353748d1be69cd5270077a030af25dc8bd196cbeb2ed11b8d21fe4744c27d55 1,086 bytes - `software_list_w.md` e8c883dc89ea18181d4dcc983e9f9a61a3cdc36a9735222913a5d147f68bd7fb 13,362 bytes - `software_list_x.headers.json` 8206f477c2e723b9a1a65b7bdffeb9198c5a127a022be7dffc2c3492a7e07252 1,086 bytes - `software_list_x.md` 7b4c34711d7e953b33d23f35aeba6ce69af769b058630b525d514d4f81ab8aa7 3,021 bytes - `software_list_y.headers.json` 35e0724c27915b35eb5a552757c58d4a7546aec7a5e489f4ec3f7017f5f88538 1,085 bytes - `software_list_y.md` 78990fac6d7071a22f609957976a7e9c9a9e1876b97822430fd7be92c1537fa0 2,828 bytes - `software_list_z.headers.json` 152b1ab0a8509afb6ac913c65e14454560dda814767397c43232cae20b3f8f29 1,086 bytes - `software_list_z.md` 25c393e4f1f8ebbf10b320f3cd9f4ec816c332e0e53e3d381e80a670defe4dea 2,454 bytes ### [Home | NCSC](ncsc-nl-site/index.html) [original ↗](https://www.ncsc.nl/) **ncsc.nl** · government · secondary · captured · published not stated · added by `collector-news` · `ncsc-nl-site` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081919Z · HTTP 200 · https://www.ncsc.nl/- `headers.json` 6cbf05984f4a5ced5bbdf7a66efdeb3593bc31f42d8e5ece3b2374243aa4c93a 2,626 bytes - `page.html` 56e85c916a4374a807a48b56f862a59b3fcdc40d9bc7b2ab509da69c6839d3d4 388,144 bytes - `provenance.json` a65f48250e2eed9d26f87eeda6ebdd8b6400d508cb3c3af7da02f79073db395a 873 bytes - `rendered.html` e377634251464e2e41da76f3a2aa2fffafaa487377a619551dd90482c0692911 400,426 bytes - `screenshot.png` c606a866a453a17b8d6b58e4063e53825d2579eb38cea185a68df21786517ec3 1,096,351 bytes - `text.txt` 4cff0c7ba341429e99659d7404208300de0c4a702c9c28da82b183c71d30bd32 2,387 bytes ### [UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP](ncsc-nz-alert-php/index.html) [original ↗](https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/) **NCSC New Zealand** · advisory · primary · captured · published 2026-10-22T09:15+13:00 (=2026-10-21T20:15Z); updated 10:20am 22-10-26 NZDT (=21:20Z) · added by `collector-gov` · `ncsc-nz-alert-php` TLP:CLEAR. 'The NCSC is aware of reports of active exploitation.' The only agency so far to say this. Advice: update to fixed versions 'as soon as possible'; investigate compromise. No offline advice. capture 20261022T081700Z · HTTP 200 · https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/- `headers.json` 5e5b7ef0258116f0d6925dab7f8189e2223e414a58521729043ca4f399ceabcc 1,992 bytes - `page.html` 9f3205c8338c598bedc1fa1f1b0726243fd7cce324d6d0a797a7c55fbd277915 49,604 bytes - `provenance.json` 7536377248a3645980d9a70e1d2e6c3bb2f1c0e799ff9ccd12b4320bd1724b01 1,049 bytes - `rendered.html` 32cdd5364dd2c631a73c0c834763cf3cb9b776145d2ebf5e4f3376e25e89758e 41,928 bytes - `screenshot.png` 4dd2cb007efcf0696650ebca1087f184c6ed83297bc6f80dd678d9f6954146ac 528,343 bytes - `text.txt` 992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301 3,799 bytes ### [Alerts listing](ncsc-nz-alerts/index.html) [original ↗](https://www.ncsc.govt.nz/alerts/) **NCSC New Zealand** · government · secondary · captured · published not stated · added by `collector-gov` · `ncsc-nz-alerts` Listing at 08:16Z: the PHP alert, dated 22 October 2026. capture 20261022T081605Z · HTTP 200 · https://www.ncsc.govt.nz/alerts/- `headers.json` 74c848feb39a21fb80f489bb294b8d8a697fe6fdae03a6c61098de514241564c 2,034 bytes - `page.html` 328191a093edcb0fb9ff08b20687f3c271db0b69eb58c770700dbfdfa080da96 75,111 bytes - `provenance.json` 1e8d90e0d23cf4b63e37636b005fac4be349ebd5ce37cd39f3e8e921d84644fb 894 bytes - `rendered.html` ccc94fffbb92d25658fbb11c5935488c45109113a44b5ec6bf775ad2240cea3f 53,664 bytes - `screenshot.png` f9033cc86d53addc1cf8ed9db6855d4e30e30eec050db17bec1d47beb99651ee 226,803 bytes - `text.txt` d1c97bbc45ba4cc7861035a6f606f1bc1c7b782b44ce8bdc279c7143640f4a5f 1,276 bytes ### [PHP-Sicherheitslücken: Wir stehen auf den Schultern vieler kleiner Giganten - netzpolitik.org](netzpolitik-2026-wir-stehen-auf-den-schultern-vieler/index.html) [original ↗](https://netzpolitik.org/2026/wir-stehen-auf-den-schultern-vieler-kleiner-giganten/) **Netzpolitik.org** · news · secondary · captured · published 2026-10-23T12:21:04+02:00 · added by `curator@php.newsroom` · `netzpolitik-2026-wir-stehen-auf-den-schultern-vieler` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). netzpolitik.org (German), a commentary of 23 October: 'We stand on the shoulders of many small giants'. It says the PHP2Shell exploit recalls Log4Shel... capture 20261024T133450Z · HTTP 200 · https://netzpolitik.org/2026/wir-stehen-auf-den-schultern-vieler-kleiner-giganten/- `headers.json` cd95491c2b87084cde8da6847aeebb3fa67f634655eee7eace72fa55f0b3753d 1,174 bytes - `page.html` 02c47b6b89e3d22c5d088274626290eae47d09e22ca93f80a70fe83e88f435ef 166,957 bytes - `provenance.json` 0c4265539dc17a6306bdf7b20fb7921102e671941a978ab4979aa4a9b6a01939 1,627 bytes - `text.txt` 70b03cc81aa541d878e6919549a8c30a55c6da170c4842b14905860192cf4d81 16,684 bytes ### [Coinbase y Bitgo niegan impacto por vulnerabilidad de PHP; CZ alerta - Bitcoin News](news-bitcoin-es-security-coinbase-y-bitgo-niegan-impa/index.html) [original ↗](https://news.bitcoin.com/es/security/coinbase-y-bitgo-niegan-impacto-por-vulnerabilidad-de-php-cz-alerta/) **Bitcoin News** · news · secondary · captured · published 2026-10-22T11:00:54+00:00 · added by `curator@php.newsroom` · `news-bitcoin-es-security-coinbase-y-bitgo-niegan-impa` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bitcoin News (Spanish), 22 October: Coinbase and BitGo deny impact from the PHP vulnerability; CZ alerts. Several large crypto firms, among them Coinb... capture 20261023T160435Z · HTTP 200 · https://news.bitcoin.com/es/security/coinbase-y-bitgo-niegan-impacto-por-vulnerabilidad-de-php-cz-alerta/- `headers.json` 07bb1a804ba13a6885ef7e4d585d923bc4db2db97d6d383334ee7df128656069 3,112 bytes - `page.html` bc163640ffdf1aa4236e3cfb4d0e7529ecc1cb8f3e6c2976e24c9f62ebfa9400 1,014,415 bytes - `provenance.json` 4b343660959bce3e9f5cc9e9d523cc8ab1afc283e5f0454f9f0c2ff349c056b0 1,821 bytes - `rendered.html` f36b9c9b68c0dae24ad7b1957c6c72c8ecadfc3aa9a1207c62f5e597e0524a37 1,017,595 bytes - `screenshot.jpg` 031d2ebed543f4293f3ea357c77c28522bf3fbc4ff9dc67e34065ec87b212306 671,442 bytes - `text.txt` 218d24d1a495bce6fa39a4fd68a75c8eb05c05ea46524df26babce4c21ffb1a7 12,341 bytes ### [PHP2Shell Could Put Millions of Websites at Risk: NSA Urges Immediate Patching - ClearanceJobs](news-clearancejobs-2026-10-23-php2shell-could-put-millions/index.html) [original ↗](https://news.clearancejobs.com/2026/10/23/php2shell-could-put-millions-of-websites-at-risk-nsa-urges-immediate-patching/) **ClearanceJobs News** · news · secondary · captured · published 2026-10-23T11:30:57+00:00 · added by `curator@php.newsroom` · `news-clearancejobs-2026-10-23-php2shell-could-put-millions` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). ClearanceJobs, 23 October: the NSA issued an advisory on Wednesday recommending critical patches for the PHP vulnerability. It quotes the NSA that all... capture 20261023T232528Z · HTTP 200 · https://news.clearancejobs.com/2026/10/23/php2shell-could-put-millions-of-websites-at-risk-nsa-urges-immediate-patching/- `headers.json` b2cf579e1a8c7f47e034d6d65d63476e05069776adf028dac6ff11196f97381d 1,236 bytes - `page.html` 403fa2a20375a9dddd8a4ef89a95142f0398d53c780c9b8c6abf095c89d400f2 103,549 bytes - `provenance.json` 4b4a30d41b42794c2fda747cac31b17891167b0763005652b04241f6343f05ab 1,875 bytes - `rendered.html` e15d2a2170c69a24a7b30a8f9c4d04ea3cc7bf2b4c5ea6caafccb3c20815c366 103,510 bytes - `screenshot.jpg` 1130b32c31a85efb71431b6202e0a125c104e00cc9a4a31e9a582f898491e56b 414,729 bytes - `text.txt` f21aea405a7ef7da976c401d0fe72dd075f352583917145b0d5fbb8065876070 7,956 bytes ### [เตือนภัยช่องโหว่ความปลอดภัย PHP เสี่ยงถูกรันโค้ดระยะไกลโดยไม่ต้องยืนยันตัวตน : 테크/과학 : JKN](news-jkn-editions-thai-post-1040742/index.html) [original ↗](https://news.jkn.co.kr/editions/thai/post/1040742) **재경일보** · news · secondary · captured · published 2026-10-21T18:35:36.000Z · added by `curator@php.newsroom` · `news-jkn-editions-thai-post-1040742` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). JKN / Jaeil Ilbo (Thai edition), 21 October: warning about a PHP security flaw with the risk of remote code running without authentication. The PHP te... capture 20261023T160435Z · HTTP 200 · https://news.jkn.co.kr/editions/thai/post/1040742- `headers.json` 4085318bae4a5d377c2c9f925adc4385ed7307f4d901784ae426780dd03b1c63 493 bytes - `page.html` 07bcd63e65e926bac6675d4ed298458d10e8bda908b761d65430b7fba621efa0 155,486 bytes - `provenance.json` 4e59deb6a448c2dc3e54284a1c44738c541cc49e030d888b208ed1470d43488c 1,772 bytes - `rendered.html` 943a7df3537903ba1b1e7aeebec8b188845e4dada31ae08593742fc3533e9a3a 155,831 bytes - `screenshot.jpg` 42327458fc6cda4766985292136d1f56e6a276d8ac8295fd50a0f6b042276726 341,502 bytes - `text.txt` 20dc3ca671aae1a2bcfda397a14a25faea7d1dd86f7ae2c726e9729be3dbca75 17,531 bytes ### [【図解】重大な脆弱性が見つかった「PHP」とは？（Yahoo!ニュース オリジナル THE PAGE）](news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94/index.html) [original ↗](https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6) **Yahoo!ニュース** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Yahoo! News Japan (a graphic explainer made from Jiji Press articles), 22 October: two serious PHP vulnerabilities were found, both at the highest 'em... capture 20261023T160435Z · HTTP 200 · https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6- `headers.json` 8e38c9dabae0c22eb10b65080334789ac9ae4bfbb14c14d8f3d935fc87ac2c59 1,350 bytes - `page.html` f5809005f7712b639f7f24d92d83b1ef60a309160b562bc68dca7953a0946a36 141,487 bytes - `provenance.json` 759ce75eb93948dc8233e2f1c0744244521e9810be168b3325225ca11052bfa5 1,763 bytes - `rendered.html` dbc84b8a484fb6645519a9c8976fc08606425c3b7fbec041d59f1be59d758a6f 345,740 bytes - `screenshot.jpg` d24acfe25228d4843e7a2965dd22f89e9f380065ec75cbd3a1b91458b71a45b1 620,052 bytes - `text.txt` 3f6309ea905ada2a3609b89da18be043419e1e2c246a6acd26772a44a06cdee3 15,798 bytes ### [What is PHP2Shell? Critical PHP flaws put millions of websites on emergency patch alert](news9live-technology-tech-news-what-is-php2shell-c/index.html) [original ↗](https://www.news9live.com/technology/tech-news/what-is-php2shell-critical-php-vulnerabilities-websites-hacking-risk-3018004) **News9Live** · news · secondary · captured · published 2026-10-22T11:54:37+05:30 · added by `curator@php.newsroom` · `news9live-technology-tech-news-what-is-php2shell-c` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). News9Live (India), 22 October: what PHP2Shell is, which PHP versions need updates, how AI helped the researchers and what website owners should do. Th... capture 20261023T160435Z · HTTP 200 · https://www.news9live.com/technology/tech-news/what-is-php2shell-critical-php-vulnerabilities-websites-hacking-risk-3018004- `headers.json` b9f7895e448e41949e0ec262457aa3a3112a56b7dccaadb942569d3848b13dcf 809 bytes - `page.html` 8014ac6a2042e8b55294d6bbee18e3aeb82b2de08806339c48a0c9da0b50bac9 267,955 bytes - `provenance.json` 6b94a2dba7e0f560c82f50ead01f31667fb4310821ed0f44ec210b2663c4e926 1,703 bytes - `text.txt` b2105e78dcc0bd5fe87b6b6721da7f139577d91e413440943e4530f81dea8b9c 10,360 bytes ### [PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek](newsweek-php2shell-list/index.html) [original ↗](https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225) **newsweek.com** · news · secondary · captured · published not stated · added by `collector-news` · `newsweek-php2shell-list` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081350Z · HTTP 200 · https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225- `headers.json` 7732bbe45a2c2ac0eb9414f511a971483a2ff33927c5b2591150a5578b57774d 2,439 bytes - `page.html` 02014f6004d880e2069129f15e86dde9bc0690358b12879271104aa686ed7af0 559,900 bytes - `provenance.json` ae0d237da8f695dc44b28ffcd2fb2e36cac58cecad93ed3b5666d6c7871c5f9b 1,102 bytes - `rendered.html` 2f4d6beb749cd4010729eff950983514ed19755c1b44915b56ddb7f31c8debb3 804,597 bytes - `screenshot.png` b13b1042a450751a2cb5a722defaa60f78a4012c987c02e2549a0b9b5e82e299 2,054,746 bytes - `text.txt` dc7ff69a1e38d3d6a18e69e19cca63a0b086601d4ae1fb2fe1c77654b30957be 11,452 bytes ### [PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek](newsweek-php2shell-websites/index.html) [original ↗](https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225) **Newsweek** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `newsweek-php2shell-websites` Secondary: Wikimedia Foundation quote 'taken down a number of other systems as a precautionary measure'; no evidence of US federal sites compromised or offline. capture 20261022T112237Z · HTTP 200 · https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225- `headers.json` b6ede4c5fe94adc6fedb71cb10b74af567162d6452ec0218be0bb8c7b17748dd 2,453 bytes - `page.html` 02014f6004d880e2069129f15e86dde9bc0690358b12879271104aa686ed7af0 559,900 bytes - `provenance.json` 3924e8c0bcf61c3ac2c4018ed3883377b700cd1ff8b1868e156d09adbb78ffc1 1,106 bytes - `rendered.html` ba7e1618e4d6808ff4982067fda5725d0e4c5a6fcfd94dc91b4b6bd65068189d 815,834 bytes - `screenshot.png` 3d81fb9fa70f4b8446dc70da529dd38f40b9e9caf64fd826a7c1fd282de0d3b0 2,773,005 bytes - `text.txt` 323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294 11,698 bytes capture 20261023T160435Z · HTTP 200 · https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225- `headers.json` faf61f64516867ad47751a3be3203baca24c2053db187112aa86c124a10e7645 2,103 bytes - `page.html` 840b1860e8f20027b239264055ea0d5fb6d33a16935a383c48a35a96d3f38e45 558,757 bytes - `provenance.json` 63c6db9ff77248c1a38ac59726acbec980b22a666dc3cd368252da1b68c20be2 1,663 bytes - `text.txt` 943f76081090db5de7270a1d6cf276a50ae13472e60014f6d4387bfbde55da13 10,844 bytes capture 20261023T232528Z · HTTP 200 · https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225- `headers.json` 9bf306696c932407cb1b726e549ae41153193f0352a309f9d1d3db2dd9546ce4 2,057 bytes - `page.html` c7f33ed1ceef33ef0d61bcb61d5bb757337a2f3034197ea7974528abc65b7923 558,756 bytes - `provenance.json` 16adf17467a02821f8a0cbc8774ecf10e4d3846004bb7cc6750c707b06d38a89 1,675 bytes - `text.txt` bc1065d2b5f8a874cc4f4df68f0734771fcba3ea0e9e2a1ff3e08fdff91496b9 11,003 bytes ### [Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ](nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan/index.html) [original ↗](https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html) **nguoiquansat.vn** · news · secondary · captured · published 10/23/2026 10:02:01 AM · added by `curator@php.newsroom` · `nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Nguoi Quan Sat (Vietnamese), 23 October: the php2shell flaws, leaked early on Hacker News, threaten 70% of websites worldwide. The headline and lead s... capture 20261023T160435Z · HTTP 200 · https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html- `headers.json` 570a39341d28feba0b8b6198f6b4eb2d510321cd2b23b40ffc251f97e1cd83bd 805 bytes - `page.html` 55b9bdacd024871a75d2f59f0ae9101a1fae3592a855167a05c8927429efce65 145,838 bytes - `provenance.json` fcab0e17849f10d7aacdd9cea46f069598e422c3b2e728f3c1ed0c04327608a0 1,933 bytes - `rendered.html` a4b33b682d6194dd69f507f7f8cfcbc1150f2666bd4cc6feb56908d69ffd80fb 229,340 bytes - `screenshot.jpg` a88e85bc8441bc40a63edf1c446a0163fcf78f77b407023dc551f092c5df991a 753,491 bytes - `text.txt` 176d23d05dee09bd3ec76145b7258bdc602945e0ae56615e62e4164b7e2def48 19,627 bytes ### [[October 2026] What is PHP2Shell? How Generative AI is Shortening the 'Time' of Security｜Masaland](note-masaland-n-n1bda3e5bc53f/index.html) [original ↗](https://note.com/masaland/n/n1bda3e5bc53f?hl=en) **note** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `note-masaland-n-n1bda3e5bc53f` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Masaland (Japanese blog, English edition), October 2026: what PHP2Shell is and how generative AI is shortening security's time. It says preventive shu... capture 20261024T133450Z · HTTP 200 · https://note.com/masaland/n/n1bda3e5bc53f?hl=en- `headers.json` 615b8ec663bdce29c123e7b77d217c73e106e63523f3652f11ceeea338597d8e 3,233 bytes - `page.html` 7e68ad5aeb82d284e91a868d6ff441b7ad9132c17cb749a7a03de992fb98cce7 286,015 bytes - `provenance.json` 509ca4b4e941e0d652e051633a0ac8879ee6fbaeb7a52a6522dc1c770b7fa03a 1,607 bytes - `rendered.html` 3cf1ab452ddcca5fb8ea83aafe33a5688e548a8b5d3c22c5251b7ee201c047ac 290,236 bytes - `screenshot.jpg` 51eab516be9c432f8e1cd6f34582c9a432986257cb6091b449372bbf646f644d 673,497 bytes - `text.txt` 23c1454f28f47beeacf55737af352da53ed6bfc3040e6ef7588abad291661127 15,881 bytes ### [PHP2Shell: le falle critiche di PHP colpiscono soprattutto i server mod_php - NotebookCheck.it News](notebookcheck-php2shell-le-falle-critiche-di-php-colpi/index.html) [original ↗](https://www.notebookcheck.it/PHP2Shell-le-falle-critiche-di-PHP-colpiscono-soprattutto-i-server-mod_php.1430599.0.html) **Notebookcheck.it** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `notebookcheck-php2shell-le-falle-critiche-di-php-colpi` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck.it (Italian): the critical PHP flaws hit mod_php servers most. PHP brought the security release forward to Wednesday 21 October at 14:00... capture 20261023T160435Z · HTTP 200 · https://www.notebookcheck.it/PHP2Shell-le-falle-critiche-di-PHP-colpiscono-soprattutto-i-server-mod_php.1430599.0.html- `headers.json` c95e2c73ec72ba8ca67b45f79042c5cb33e3a682fafe627f90bd1a425f2f3e08 963 bytes - `page.html` 97b616e2c905233496da1acaf9b44616a2b7c1ee69667948fd38c29016eb4298 117,432 bytes - `provenance.json` e40e82b4ebee5918fdfff0a967357c41f5624d0ca95a50d360cdcf075b2b9cdc 1,776 bytes - `rendered.html` 71b1a624e2811d2afb57e028419d78d2027bc2567f74d4a73c533abd5b0f70ff 136,833 bytes - `text.txt` e511e7a4fd8faed0bd00e00fc3f87c957049cd80ffe909d7caae3ed02a623b2d 9,274 bytes ### [PHP2Shell: What QNAP, Nextcloud and OPNsense users should check - Notebookcheck Review](notebookcheck-php2shell-what-qnap-nextcloud-and-opnsen/index.html) [original ↗](https://www.notebookcheck.net/PHP2Shell-What-QNAP-Nextcloud-and-OPNsense-users-should-check.1431047.0.html) **Notebookcheck** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `notebookcheck-php2shell-what-qnap-nextcloud-and-opnsen` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck (English), a guide for home and small-office users: PHP2Shell is not only a web-hosting problem, because PHP also runs NAS interfaces, f... capture 20261023T232528Z · HTTP 200 · https://www.notebookcheck.net/PHP2Shell-What-QNAP-Nextcloud-and-OPNsense-users-should-check.1431047.0.html- `headers.json` 5109a72b4d1c55cf0dd66e9c2a4d1d48bb8cc5e1b30e0d90ae5793b8674ba8ae 1,134 bytes - `page.html` 058416cdd6d4042309b2cb1969e2976f6bc8b8dcd9ea65ae295151f33daf41df 135,876 bytes - `provenance.json` d7bd3901e0a3760e68118ae2ac1f359dda3dafe8f28cd4e97172720501a61600 1,827 bytes - `rendered.html` fdc95027a30c2618daa5c538dc1c1fb239c8554a20f3addafaa59e6ddce62e3e 180,440 bytes - `screenshot.jpg` f587668cf3e59f25e0832ec55f78095446273971cd96470cee97fb1cb98083ae 694,915 bytes - `text.txt` d376c84ec11bb7cce3865735ad55ff97ba64cbf82daf7f9a8b7aebe19fe1a2c5 10,843 bytes ### [NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities](nsa-press-php-4630238/index.html) [original ↗](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/) **US National Security Agency (NSA)** · government · primary · captured · published 2026-10-21 · added by `collector-gov` · `nsa-press-php-4630238` Press release dated Oct. 21, 2026 (no time given). Nicknames the bugs 'PHP2Shell'. Recommends patching, inventory, enhanced logging, replacing EOL PHP; 'If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.' Says the risks 'require immediate patching across United States Government departments and agencies'. capture 20261022T080954Z · HTTP 200 · https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/- `headers.json` 97a8c93336e9eaf70c80dd55bf2a30afda4f796323bb1e628388046b2d71ff58 671 bytes - `page.html` 18db3cea62d9017227ca3bc12cc73fe965e84f2a0d946dbc0278c4772dd415f3 98,539 bytes - `provenance.json` 246b632f5be873be48cc8894fb4abdb03858ee784e155a5f703c690e0c937495 1,286 bytes - `rendered.html` 0e42d4e7ce3e0af33f09f09b458d895320523102285301139861be8ba95f5889 122,356 bytes - `screenshot.png` 1bc158a28beb2de8ef2533cca0ddffbec42a196ae7094ca2d019ff076cd27725 992,031 bytes - `text.txt` 8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154 4,995 bytes ### [NSA Cyber on X: Effective Immediately ... two critical vulnerabilities](nsa-x-2112903220209098897/index.html) [original ↗](https://x.com/NSACyber/status/2112903220209098897) **NSA Cybersecurity (@NSACyber)** · social · primary · captured · published 2026-10-21T13:45:58Z · added by `collector-gov` · `nsa-x-2112903220209098897` First NSA post (pinned). Time from tweet snowflake ID = 2026-10-21T13:45:58Z; the page shows '13:45 · 21 Oct 2026' (UTC browser). 10.1M views at capture. 'If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.' capture 20261022T080954Z · HTTP 200 · https://x.com/NSACyber/status/2112903220209098897- `headers.json` 2b72f04731267bb06c6ed80fb9fab697c55697ef2b83303924c315720ed63729 9,020 bytes - `page.html` 49362e7db1112702cb4586ed77daa898c86293d85b5ebe33b7a7dca7db1396a2 139,058 bytes - `provenance.json` 569e1386915c3d850f140375196be63051f6099dd3eaa803bee46f3d014e8984 1,240 bytes - `rendered.html` a95403e3cb7230cb93a3aad7f6f4a09998596f2636f7516355cf3d52bb8fcf58 162,779 bytes - `screenshot.png` f9e02ad5c04f114f4ab6cc0cd14b556924d445869fb512f4306683da40d50564 452,042 bytes - `text.txt` 92ebce791a7b35429d2fee94427932a19b1629de3821a52201648a58298d52e7 1,811 bytes ### [NSA Cyber on X: UPDATE: Specific mitigation guidance ... now available](nsa-x-2113068811058622971/index.html) [original ↗](https://x.com/NSACyber/status/2113068811058622971) **NSA Cybersecurity (@NSACyber)** · social · primary · captured · published 2026-10-22T00:43:58Z · added by `collector-gov` · `nsa-x-2113068811058622971` Second NSA post, from the snowflake ID: 2026-10-22T00:43:58Z. It links (t.co/nuXgQ10Fzc) to the NSA press release 4630238. 206.4K views at capture. capture 20261022T080954Z · HTTP 200 · https://x.com/NSACyber/status/2113068811058622971- `headers.json` 9292b5863f63684cb58479f72ed4579062a1ff66108183ddfd21a51a34f25f60 9,022 bytes - `page.html` 8b2c9d9cbd6c8cfa6e5614e7900653b6bcddb21e5d8e4a0a880b9613ae9d1bfe 166,142 bytes - `provenance.json` 0931b8c67b66649c978bd87fd385c5c0e597b091e5e840db5dc9d4d1e1b63c9d 1,154 bytes - `rendered.html` 3a297e1972ba61e2d78a5ca5842af0507e79e8d8b04aa8c7dcfa311794d9242c 167,035 bytes - `screenshot.png` 846daf6b3e0004aee5355c16bf1ad5d57544d6b38547e5cf26d513a0dc8d168a 224,980 bytes - `text.txt` 899e5ba4af69c5311210a846d98721e674abded497de292dfdc4af17b2ff1bd3 2,052 bytes ### [NSA Cyber (@NSACyber) / X profile timeline](nsa-x-nsacyber/index.html) [original ↗](https://x.com/NSACyber) **NSA Cybersecurity (@NSACyber)** · social · secondary · captured · published not stated · added by `collector-gov` · `nsa-x-nsacyber` Profile timeline at 08:09Z: the pinned PHP post plus the UPDATE post; 201.8K followers. capture 20261022T080925Z · HTTP 200 · https://x.com/NSACyber- `headers.json` 9fa8661bfa8f332a71ed3f88de6e09033b05073ba537b3d891f1b4209bf1c757 9,022 bytes - `page.html` 35b05885b38c909cd06bc0f6617a32454843249a5c4d5c92274ca3a543b98310 160,043 bytes - `provenance.json` 0680efdf34c9fb08e25e730dbadcc178f7f0a02d64d82260f9802d4fdaf70a00 893 bytes - `rendered.html` ae4abd70be7db953acec8f33cae64b339eb2729b8661c3191dc88e62eb17ee1d 198,521 bytes - `screenshot.png` 20541dc8b918cda68c8be3b4a94e4698a53f3edb149d38ba9d8344210189f384 1,255,100 bytes - `text.txt` 5889a1c26173dac8ee58b5269e4f78aeb57dc93520afa220d496e634b5e5b7c0 2,388 bytes ### [nitter.net (shutdown notice, no tweets)](nsa-x-nsacyber-nitter/index.html) [original ↗](https://nitter.net/NSACyber) **nitter.net** · social · secondary · failed · published not stated · added by `collector-gov` · `nsa-x-nsacyber-nitter` Mirror is dead: it serves only the maintainer's 10 Oct 2026 notice about X Corp cease-and-desist letters. xcancel.com/NSACyber returned HTTP 451 via curl (not captured). capture 20261022T080925Z · HTTP 200 · https://nitter.net/NSACyber- `headers.json` ab425e76be267227a6680e0572e20c30271e2d99585b0cb665f948349e7e5e22 700 bytes - `page.html` 846a9048bdd79311b1c92ef549dc68d73a61edd0f9832264cea107686a3f53cc 12,341 bytes - `provenance.json` 5866931f9bcffc1f87e58582a3b73e4fd0fe9414f675213c27278464589fa4c8 895 bytes - `rendered.html` 21e41f57eb9abbe1a4b2db26e202689f711d079cff963c4af7c549714eccd108 12,292 bytes - `screenshot.png` d179e4f97e7b7e0371b33c4fc9e9dd245980aa3bf0ef5add188775144552c848 162,950 bytes - `text.txt` f4e954159062308642561f65d6f65c068c8ee1001bcafdf6e9388181a78d2d93 1,513 bytes ### [Národní úřad pro kybernetickou a informační bezpečnost - NÚKIB upozorňuje na kritické zranitelnosti v PHP - jediným řešením je aktualizace](nukib-aktuality-2470/index.html) [original ↗](https://nukib.gov.cz/cs/infoservis/aktuality/2470-nukib-upozornuje-na-kriticke-zranitelnosti-v-php/) **NÚKIB** · government · primary · captured · published 2026-10-21 (as stated on the page) · added by `curator@php.newsroom` · `nukib-aktuality-2470` Promoted from the source watch (oq9gflln), snapshot 20261022T191421Z. NÚKIB's own notice (Czech national agency, primary) capture 20261022T191421Z · HTTP 200 · https://nukib.gov.cz/cs/infoservis/aktuality/2470-nukib-upozornuje-na-kriticke-zranitelnosti-v-php/- `headers.json` f5321ce1db92227c40357773a8d05918af0f96b576298cee99e949176aba079e 668 bytes - `page.html` 296b1217f2035ac2359eb3d9a8d23272cab5d92b1b094e9b90bd30f3cb0e4921 20,034 bytes - `provenance.json` 1509e228b9e5bebec20f205996a0547bc6bbe773ca72bccbff27386e40813b57 1,746 bytes - `rendered.html` f2efe7588603ad22543871e1961496198708b432f02e180222490ab263ff8235 25,310 bytes - `screenshot.jpg` dee3d09770a0ff852d171814fe7f059ff4ac7ba21ef138be0e08120f2f33ec79 153,675 bytes - `text.txt` 6bd4d3066e7caa885325cee2a95e81530c916bc62bc45b78f676430944dfbbbb 3,868 bytes ### [NVD - CVE-2026-109618](nvd-cve-2026-109618/index.html) [original ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) **NIST National Vulnerability Database** · cve · primary · captured · published 2026-10-21T14:17:09.357Z · added by `collector-primary` · `nvd-cve-2026-109618` NVD page did not render in two Playwright captures (empty text); the authoritative copy is raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 17:18:24Z, status Modified. Only CNA (security@php.net, Secondary) CVSS v4 9.2; no NIST primary score yet. NVD CWEs: 416, 755, 824, 1325 (no 1419). No CISA KEV fields. capture 20261022T081218Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618- `headers.json` f81072c6a6dc3dda5884e2b701c37879b7d8762357ffa7bd4ea88ab95f9e5d6a 1,414 bytes - `page.html` 5218b57d88785ba853fce0de8804f8994d73d4cb3209339fa458c4a5cbb9881f 2,453 bytes - `provenance.json` f9105904aa37fc65ae54d1cb66b08b59b354c3eb7b20bf7cc925bd7ff4cfce78 935 bytes - `rendered.html` b4880a9e6a29cbee557232a66f9db3531b225dd95a517433c6e326be8bb41e87 2,827 bytes - `screenshot.png` 442aa587ff9ee582c291e7c7a8bca102504856b7a4db838cb313226e016f993e 106,759 bytes - `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes capture 20261022T081302Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618- `headers.json` 5d77eaec3eb1fe5d7fb3a76a35571380e31671576d24b40c26f0f87d75f2c610 1,414 bytes - `page.html` f372c9f8983a6331efb78d85ea53abc653d4bbe75457c02c9a25d9cc1ec2086e 2,453 bytes - `provenance.json` 578b5687fe8afa3ad4f74ab69b8ca2471a0b0ee0a650e832021623cf9e346931 935 bytes - `rendered.html` 2aa4037a7f7c9c97111573860083b648f53df74a60cea8fc7f9205b76d01f36e 2,827 bytes - `screenshot.png` 8d848319be976cd91ac761f8f5b19ff3d8547393428ff570f273a774b5094d39 106,512 bytes - `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes raw, 1 files with SHA256SUMS- `nvd-api-2.0.json` dd864fa6ed53d4b549d2429fad6a22878ddb5a6def44b80cac0628cf4fdab438 ### [NVD - CVE-2026-109619](nvd-cve-2026-109619/index.html) [original ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-109619) **NIST National Vulnerability Database** · cve · primary · captured · published 2026-10-21T14:17:09.823Z · added by `collector-primary` · `nvd-cve-2026-109619` Page rendered only as 'Loading CVE Information'; use raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 21:17:52Z. CNA CVSS v4 9.2 only; no NIST score. No KEV fields. capture 20261022T081219Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109619- `headers.json` fc8d0ec5d6feaed052fd64b49abaebe2394f7ef3bc2ce70aee91e20e1306822e 1,413 bytes - `page.html` fbdf9ac8177380bc8093bab92baaa18402cc52721b3aaa5b037cb507c15a3bf3 2,453 bytes - `provenance.json` bad76168518f8666d20502a4cb32e9b3425e785e7abbf63160cbd9081db807b5 944 bytes - `rendered.html` 3784d224686072278cb9ed34c55c7390353818b2d9b35535eb289099d5bb536f 31,323 bytes - `screenshot.png` 56539f358f1226f93c35cc6828cee0c2edbcda7da8a3fce9e8deaad68f133fea 106,528 bytes - `text.txt` fbcf781e4294ea8f1f693ce52cf0e7c6ff9e8dff930df337294d54fb9f849466 839 bytes raw, 1 files with SHA256SUMS- `nvd-api-2.0.json` 627fdaed31c96626e2dcc8af24a6acab1b2da1658bb32b5cf627e30149a0b61c ### [NCSC issues warning over critical PHP remote code execution vulnerabilities](openaccessgovernment-ncsc-issues-warning-over-critical-php-re/index.html) [original ↗](https://www.openaccessgovernment.org/ncsc-issues-warning-over-critical-php-remote-code-execution-vulnerabilities/215806/) **Open Access Government** · news · secondary · captured · published 2026-10-23T08:13:02+00:00 · added by `curator@php.newsroom` · `openaccessgovernment-ncsc-issues-warning-over-critical-php-re` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T110459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Open Access Government (UK), 23 October: the NCSC released an urgent advisory urging all UK organisations to act at once on the two PHP vulnerabilitie... capture 20261024T110459Z · HTTP 200 · https://www.openaccessgovernment.org/ncsc-issues-warning-over-critical-php-remote-code-execution-vulnerabilities/215806/- `headers.json` 337a54d14a98383111a3574b9ddd9bd6936e16f172f3ac483dc6ff5643b07ede 1,332 bytes - `page.html` fac236061bd8cbec7c2c07ab1a3971ed62b049d7e1df230c38ba3af925ca5dad 327,373 bytes - `provenance.json` 4005f560dbb864735773556748fffd7d63391f4abbd579c787bb123d9bd6618e 1,863 bytes - `rendered.html` 6bde993c96d1e6039d6110e0ec078d237daf91643d09c03e0f0eecdde57d3c92 401,611 bytes - `screenshot.jpg` 31b52f6755cab88b156cc80a3147e89340bd2e42cf91d9daa0ee11893e8d3c61 585,160 bytes - `text.txt` 9e971974c7995f7f24d076c5ad6674fd405b32f5b0233e213dce35b99017abc7 6,493 bytes ### [Patch the Planet: global response coordination as agents uncover critical vulnerabilities](openai-blog-coordinated-disclosure/index.html) [original ↗](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) **OpenAI** · researcher · primary · blocked · published 2026-10-21 · added by `collector-researchers` · `openai-blog-coordinated-disclosure` openai.com served a Cloudflare 'Just a moment...' challenge (HTTP 403) to capture.mjs, curl and WebFetch at 2026-10-22T08:11Z. The 403 capture folder is kept as the record. Content known only via secondary quotes; another agent should retry. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. capture 20261022T081113Z · HTTP 403 · https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/- `headers.json` 7b02609d3cb8321fcd39f1fb944357b1becd2b3914b213682188380e551a576e 1,912 bytes - `page.html` fdf2d9f575486a9ace314ca2636c5ddac6e6cbe0cb71fbd74c561248b86caef2 10,672 bytes - `provenance.json` 044271cf8e68e02415a432222e0036e63e3bc6ba426046d653313c6cf329a96e 1,012 bytes - `rendered.html` 582d07e3d24a3e25bdb6f9515a3ecee4de66710e90c88b8fe2bb35f6457f1387 11,479 bytes - `screenshot.png` c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc 13,108 bytes - `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes capture 20261022T112413Z · HTTP 403 · https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/- `headers.json` e4f85b63820ea6efd08d11267c2b64182f40b903e674511097639f35151ff850 1,914 bytes - `page.html` db092a078bc5df2a4c7258208dd350e18d58597541c27492bb6085ddc605b519 10,672 bytes - `provenance.json` adbd882dc23ca47f5c3ce16c95f07213ed270f28011521f7beade694144a3cb0 1,012 bytes - `rendered.html` 727b7be84beefe987e85a9a6d99200779878441c04443791f3ee6aa992118351 11,479 bytes - `screenshot.png` c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc 13,108 bytes - `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes ### [OpenAI models help researchers uncover critical PHP security flaws](openai-community-php-flaws/index.html) [original ↗](https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490) **OpenAI Developer Community (user 'sps', Leader)** · forum · secondary · captured · published 2026-10-21 · added by `collector-researchers` · `openai-community-php-flaws` Forum repost of OpenAI's announcement text, Oct 21; links https://github.com/openai/php2shell-checker (Codex skill). capture 20261022T081721Z · HTTP 200 · https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490- `headers.json` 86f75f0dcbf3bc611bd0c24cc8c87f49138270eaac36ff55f379acd57638d537 1,273 bytes - `page.html` 9b1e1cbea269bc3fe068f7344d39a81937b9ec473044047d9d0700cb653af679 296,980 bytes - `provenance.json` 1394b5dabf1a6c5064c6bd0a2a0750815ffb787cf14f7155f7a1c680a5566c8d 1,153 bytes - `rendered.html` f20e90bdf364618ef6f4900343a7e3abbdb5e6006e628ae4e80a8b92bd8bdf47 624,051 bytes - `screenshot.png` e3138cd2f1d4e9539051514491c494acd19c7c4afffabe913081dd1ef8d3a691 370,209 bytes - `text.txt` 43afe7a0a3b96a86e52cbeea1c6ae41560bab1566da848fc4f9067152f739cd5 3,504 bytes ### [Patch the Planet (launch announcement)](openai-patch-the-planet-launch/index.html) [original ↗](https://openai.com/index/patch-the-planet/) **OpenAI** · researcher · primary · captured · published not stated · added by `collector-researchers` · `openai-patch-the-planet-launch` Cloudflare challenge (403) at 2026-10-22T08:17Z. Launch date reported by secondary sources as June 2026 (unverified); Calif says invitation came by July 30 2026; BBC says PHP Foundation joined in July 2026. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured. capture 20261022T081658Z · HTTP 403 · https://openai.com/index/patch-the-planet/- `headers.json` dabb6d316b2a9ca13a6a49cd3d11a59538e1df05d7bd684ec04dd3ff4a830c61 1,920 bytes - `page.html` 1debac9983b263577c7488d66e2818ce992f602955f908219aa39abff4854500 10,484 bytes - `provenance.json` eecdf8db164ee1e68d9f8e7f6c9705554227dbe3f65fa9ddf547d56f2aa0fb54 940 bytes - `rendered.html` 80b0289e281954fb599df1170766a5d6f8a6bdecad2a5b444dd54e0a109542ab 11,291 bytes - `screenshot.png` c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc 13,108 bytes - `text.txt` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes capture 20261022T112430Z · HTTP 200 · https://openai.com/index/patch-the-planet/- `headers.json` cb97f3646fc464783030ad6f26b7191a2153e7964501252ae1fd40d86db2fbb7 3,536 bytes - `page.html` ad9f31cd0180d78e020821254328f835f4aa9b45f55d380ac5c4ba0e0fbd0a12 471,833 bytes - `provenance.json` a4668895879d2911dd924db2f462ac177db64b7dd8c7343b68e6f57540c78da8 1,007 bytes - `rendered.html` 66a7a5d479dc9553dcba734583b2b1a930f2ea9a4284417125fb1ec24ff54088 471,423 bytes - `screenshot.png` d24aaf68ae28b9ffd320d4f4bec241764fe84587ae5932454b99c3780aafe6b2 1,532,182 bytes - `text.txt` 1bc9a32356688dd3f82be20cb4c54b29c9d9d1fd3d04278dcdccb0fe504c2db4 13,908 bytes ### [Re: CVE-2026-109619 thread (21/16, 21/17, 21/23, 22/2)](openwall-oss-security-109619-thread/index.html) [original ↗](https://www.openwall.com/lists/oss-security/2026/10/21/16) **oss-security list (replies: Aaron Rainbolt, Yves-Alexis Perez/Debian, Christian Fischer/Greenbone)** · forum · secondary · captured · published 2026-10-21T15:24:37Z · added by `collector-primary` · `openwall-oss-security-109619-thread` raw/ curl copies of four replies. Fediverse report (fedi.katze.sh/@elise) that the 8.5.12 fix may be incomplete or a different new bug; Canonical reportedly told by PHP 'unrelated and not a real issue' (second-hand, via Matrix). Greenbone notes 7.4-8.1 are implicitly affected. raw, 4 files with SHA256SUMS- `oss-security-2026-10-21-16.html` 6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccf - `oss-security-2026-10-21-17.html` 059317aa4a1f458e19196e6add44a6b3106632b82c82f104a5b83d0df6fbe09f - `oss-security-2026-10-21-23.html` 39555f34a419becc6a47480eabb369e05f4bac6ce06e9e3843e4dfcb5c99801b - `oss-security-2026-10-22-2.html` bbc0f0fc06953b13308925334e39e7808796e46ea9505630917762502996bea2 ### [Upcoming Critical PHP Security Release](openwall-oss-security-2026-10-20-34/index.html) [original ↗](https://www.openwall.com/lists/oss-security/2026/10/20/34) **oss-security list (Alan Coopersmith, Oracle)** · advisory · primary · captured · published 2026-10-20T20:22:51Z · added by `collector-primary` · `openwall-oss-security-2026-10-20-34` Date header Tue, 20 Oct 2026 13:22:51 -0700 (= 20:22:51Z). Quotes the php.net pre-announcement verbatim: scheduled 21 Oct 14:00 UTC, two vulns CVSS v4.0 9.2. capture 20261022T081408Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/20/34- `headers.json` 716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114 239 bytes - `page.html` 46a94f610255e2ee75ab240c658666ef2589e34e4dd4fcb93b5c5e45fc9917d4 5,800 bytes - `provenance.json` 04ff8e63e2b72caeb3d48ed4a44ecc28434a0414db9f8d59022e7b75af8ccb40 1,012 bytes - `rendered.html` 5c80dc74b7328496b9f3ee62eef06aa707db7327bd0bcdd7ab9aa4f0c5a5a5d8 6,056 bytes - `screenshot.png` c03f4fc0fefe0485485685cdf28d3e439a4b167b3022a946ee928be55cd4ee0d 120,872 bytes - `text.txt` 57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392 1,415 bytes ### [CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption](openwall-oss-security-2026-10-21-6/index.html) [original ↗](https://www.openwall.com/lists/oss-security/2026/10/21/6) **oss-security list (Jakub Zelenka, PHP security team)** · advisory · primary · captured · published 2026-10-21T14:41:54Z · added by `collector-primary` · `openwall-oss-security-2026-10-21-6` Date header Wed, 21 Oct 2026 16:41:54 +0200. Official PHP security team announcement. capture 20261022T081408Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/21/6- `headers.json` 716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114 239 bytes - `page.html` d43a7569e9b4ff185814a61ed2a17e0b058d4554558a9fee8e3a7a29810169c5 6,170 bytes - `provenance.json` 9ab3756501428b0a77ed30c1d7ef15298f6a8edb131b1dc1436043a045609b4b 1,024 bytes - `rendered.html` 0686ceff1b17dfaad334b167b4f0fbb9dc9cbcdc897203d210b9a1d7a9630269 6,426 bytes - `screenshot.png` 6604c447fd5c7db94e64b0c9eeb75cd7301d461bd4f903890db31f9971d20236 146,765 bytes - `text.txt` 2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f 1,805 bytes ### [CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state](openwall-oss-security-2026-10-21-7/index.html) [original ↗](https://www.openwall.com/lists/oss-security/2026/10/21/7) **oss-security list (Jakub Zelenka, PHP security team)** · advisory · primary · captured · published 2026-10-21T14:44:06Z · added by `collector-primary` · `openwall-oss-security-2026-10-21-7` Date header Wed, 21 Oct 2026 16:44:06 +0200. Replies at 21/16, 21/17, 21/23, 22/2 are in openwall-oss-security-109619-thread. capture 20261022T081407Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/21/7- `headers.json` ffb76440772a63ed2186c00ea575b6e673ca3c7222ae89205c2bbb9de07e38ae 239 bytes - `page.html` 81caae4759a5e9cd8e501221e12f31928874e9d16d7f7e8523e8cb1d36aa69fd 6,323 bytes - `provenance.json` deeabe8cb21005c2d60c6ffcca6537969877e4411a8d1bbc88503109265756ce 1,028 bytes - `rendered.html` b797761c288a2b59dad8b9bf3c0f4810af1b669a685b93013a7d6edc0e688638 6,579 bytes - `screenshot.png` d6c5ab360073ebc5769973dc76493c74acf62cdc6e099f668ebffae91de551fa 154,322 bytes - `text.txt` ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384 1,934 bytes ### [PHP-Lücke: Millionen Angriffsversuche im Netz - news.ORF.at](orf-stories-3445806/index.html) [original ↗](https://orf.at/stories/3445806/) **ORF** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `orf-stories-3445806` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in de: ORF reports Cloudflare's 'millions' of attack attempts and that institutions worldwide took sites offline. It names Austrian sites offline (Uni Wien, TU Wien, NÖN), quotes BSI vice-president Thomas Caspers and expert Chr capture 20261022T181608Z · HTTP 200 · https://orf.at/stories/3445806/- `headers.json` 7dda938522a9e06e23db8ac07a637b7a5e71391b0c097f4a60436e8eddd13bbf 970 bytes - `page.html` fe941fbb4ff6eab5be2d373b56a1d21596fd1f7da019c049d5130aad097fa7e8 28,555 bytes - `provenance.json` ef992ab43c609302291f8ae584725bba3392ef237c0056ddc12f7a8c826e13a6 1,506 bytes - `rendered.html` beb03fcd0e185c838e137f6b81d3908667a6a8d3ec13468cae9670ac96ef050d 1,051,193 bytes - `screenshot.jpg` 4bb4a201278373d57af25912a623e595853d5a34d407f448b8231da8f6a1cb3c 377,054 bytes - `text.txt` e88c6f39edbd6d1c325ec7cc18abe50a9b8ad94010b2d5a425ba59e4252b2d0d 7,659 bytes ### [PHP2Shell Bisa Curi Data Website, Kenali Tanda Server Diretas](ototekno-harianjogja-r-1276080-php2shell-bisa-curi-data-websi/index.html) [original ↗](https://ototekno.harianjogja.com/r-1276080/php2shell-bisa-curi-data-website-kenali-tanda-server-diretas) **Berita Oto Tekno - Harianjogja.com** · news · secondary · captured · published 2026-10-23T10:47:23+07:00 · added by `curator@php.newsroom` · `ototekno-harianjogja-r-1276080-php2shell-bisa-curi-data-websi` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Harian Jogja (Indonesian), 23 October: PHP2Shell could steal website data; know the signs of a hacked server. Website managers should check server sec... capture 20261024T133450Z · HTTP 200 · https://ototekno.harianjogja.com/r-1276080/php2shell-bisa-curi-data-website-kenali-tanda-server-diretas- `headers.json` cbafae73ecac80985d68f55ea581c7e2e0ee7006b7051b876fc9d7cd44674092 1,552 bytes - `page.html` 4a1c5ad08835ee6b511a4661a45f962c5bf8569ba6f14264822c18435b90606e 124,786 bytes - `provenance.json` 758996285bd25506418f1d941ba3f818dbacbae5032e08ef231430528e73cb8a 1,818 bytes - `rendered.html` 94ec302bbc6b4ff08c7d06877d30dd2194242c47d456eaf91e8d907b7bf4bdbb 120,640 bytes - `screenshot.jpg` a41a458c76369ad149c3f6789fc71bae67901ef621e1b5efba7dc095b56aa749 881,899 bytes - `text.txt` 6c47b3ae262b5f79baeedf0202654ea00bfed03d6b434e11d040ab69ed1b38c1 12,345 bytes ### [Homepage | Overheid.nl](overheid-nl-site/index.html) [original ↗](https://www.overheid.nl/) **overheid.nl** · government · secondary · captured · published not stated · added by `collector-news` · `overheid-nl-site` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081927Z · HTTP 200 · https://www.overheid.nl/- `headers.json` bf5d6a65737591b5c4ae5c9f0b4ab31b0f86d83a9eb676f1573f7a8ec4b7117b 1,659 bytes - `page.html` 35c79d57cc23f2a234e8501c31e556531a3176023c58ec67115742617270cd93 18,228 bytes - `provenance.json` b4e3d33bfcf26c6daeb90bacf96d905882f526c1925c8fbeb1be25a39d54c0d0 896 bytes - `rendered.html` 018fe9effcbc10e7d76127ec98e1fab7ebfa67830ab994cc643fc9bc7ac2ceee 19,560 bytes - `screenshot.png` 1162ac68eaaeb8ff7a05376c48939f345186554ffa661e62b4cca355e4be7749 776,840 bytes - `text.txt` 93278f942198c318881e84d7d62b8bf6f6613b8ed5da0dc5f37bd9f658d11c13 2,216 bytes ### [Oxfordshire council websites offline amid critical global security issue | Oxford Chronicle](oxfordchronicle-councils-offline/index.html) [original ↗](https://www.oxfordchronicle.co.uk/2026/10/21/oxfordshire-council-websites-offline-amid-critical-global-security-issue/) **Oxford Chronicle** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `oxfordchronicle-councils-offline` Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'; Oxfordshire County Council also down. capture 20261022T112935Z · HTTP 200 · https://www.oxfordchronicle.co.uk/2026/10/21/oxfordshire-council-websites-offline-amid-critical-global-security-issue/- `headers.json` ffb2fca308d4c4c89c5593350a364a6121becb966829713a17b3a99c2669d99b 1,048 bytes - `page.html` 7603fb4868cc7b8a8fa437b7e2a8500726acf1332fd3f2252489e8f71471e5a2 472,071 bytes - `provenance.json` 94eda260baf0d2faf05d45a4bb93b717ed498b664f3b724444bb046dba9ec628 1,169 bytes - `rendered.html` e1614eeb5b71eb2bebf826c3131167eed9cefd83826c53632ff386d1a1a90afa 477,225 bytes - `screenshot.png` 6e1d23c7119672f3ed76f38b59112885b43f6961b77abd0009ea77015e7ec42d 1,579,440 bytes - `text.txt` 35c847290193f872826f6d65f370bcb6863fafe692817cc449f97431f350ae73 6,281 bytes ### [CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products](paloalto-psirt-cve-2026-109618/index.html) [original ↗](https://security.paloaltonetworks.com/CVE-2026-109618) **Palo Alto Networks** · vendor · primary · captured · published not stated · added by `curator@php.newsroom` · `paloalto-psirt-cve-2026-109618` Promoted from the source watch (oq9gflln), snapshot 20261022T191713Z. PAN-OS 10.2 to 12.2 affected: PHP inside firewalls (primary) capture 20261022T191713Z · HTTP 200 · https://security.paloaltonetworks.com/CVE-2026-109618- `headers.json` dbb0d97e793d1ab43471679575bd42cdcfe25371f3539b641bfc4e4b8134c45f 633 bytes - `page.html` 2223f8cf00418cf2174e08ad35e9e6113921fbfad65643a49eabc34f65ff7305 26,484 bytes - `provenance.json` 9f7ef8ede1978405b5d95d06ec70b54a29fee6138e5e29d45c3b52e92486877e 1,688 bytes - `rendered.html` 16f631fe00f8a74a26da4a70fd8b0e6874030910dd0913dd7a31024756e01d6f 27,036 bytes - `screenshot.jpg` eaa6bf9b8c388263b12fb52e625c80308697f89df7fcd7a8675bf516eacee049 364,463 bytes - `text.txt` 16cb7bd74aeeac250781e98cc4d8574d338480ada1651de0e53572d0e7bb760f 6,603 bytes ### [PHP2Shell: des milliers de sites exposés au Luxembourg | Paperjam News](paperjam-article-php2shell-des-milliers-de-sites/index.html) [original ↗](https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg) **Paperjam** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `paperjam-article-php2shell-des-milliers-de-sites` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Paperjam (French, Luxembourg): thousands of sites are exposed in Luxembourg. The two flaws are rated 9.2 out of 10 and sit in the PHP engine itself, n... capture 20261023T160435Z · HTTP 200 · https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg- `headers.json` 2224804391f9039f9c3b3b8f9e69bfc0078a9b68b20731ea3536d5de439e6cc6 1,049 bytes - `page.html` 0e5257c13c396617b977794021ed67914b1b48fe67e99643852efc8abcaa4e5e 162,673 bytes - `provenance.json` fd1670a04f377f14d3fa93b4017bed37541143fbb9bac35e6fa7ddb7cf5a06f8 1,598 bytes - `text.txt` 73aed7ccd645b7172699b36b2e9dd8540c0300f2ff6c3de8ad218d7aeb29b20e 14,203 bytes ### [Patch the Planet — OpenAI](patchtheplanet-org/index.html) [original ↗](https://patchtheplanet.org/) **OpenAI (Patch the Planet / Daybreak)** · researcher · primary · captured · published not stated · added by `collector-researchers` · `patchtheplanet-org` OpenAI microsite. 'An OpenAI Daybreak initiative'; 'In collaboration with Trail of Bits, Calif, HackerOne'. Latest disclosure php2shell links to https://php2shell.com/. No date on page. capture 20261022T081652Z · HTTP 200 · https://patchtheplanet.org/- `headers.json` 2efe5a08cc256108fdb7a72a5bdeb92c7596564181f1d63e2e31fd2b71e2a321 563 bytes - `page.html` 280b5c18a8bb8c6254841014830e299d803e1d21ffd98141296156a2b5423bda 2,325 bytes - `provenance.json` e6def2821be82e7593e0ea8682f9c24fdf763a48424e1814e65b815a1db3a78f 909 bytes - `rendered.html` d347cfa4c1e9dc2c990b725259875a732e38470560bfc51b6bb21da3419d2662 7,680 bytes - `screenshot.png` 0872d96463aabdeccdeb873b9cb455601fe9cdea8cb6b15f45c65a9e85f1bb75 285,779 bytes - `text.txt` 3e32706fb7c0ed83bb988da8372dbca5e70dbdfebc6135060f3f777805f852ae 1,053 bytes capture 20261023T232528Z · HTTP 200 · https://patchtheplanet.org/- `headers.json` bef5ad2305cc911064e3220ea40101ea93808644720426b1ba89f104134316b7 622 bytes - `page.html` a98d556b82b60f2f0bbe54986d03c73d64af0ca025e64785f43cba2fc5ab07ee 2,325 bytes - `provenance.json` f37266b025b2e6402f394ebc1fc8c6ec7f9bf1838fd23a90eb3ff1c75f0c272f 1,629 bytes - `rendered.html` 6c1494423baff5a3e35188574e221186ede298bb90b42c2964ddcb5e3bbf631b 8,032 bytes - `screenshot.jpg` ffd3e34781095497e36d6aa4ef318de85c038de8ffc12d6bf9e9140bc36fbaf3 146,354 bytes - `text.txt` 63821bd00a0a9f37db0eb0068d039bbfe8fb7d27dce1623dc0c66386b394ad5f 1,218 bytes ### [Hackers Already Trying to Exploit Serious PHP Flaw | PCMag](pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/index.html) [original ↗](https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw) **PCMag** · news · secondary · captured · published 2026-10-21 · added by `curator@php.newsroom` · `pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Michael Kan: hackers quickly probed and tried to exploit the PHP flaws; VulnCheck traced one attempt to an IP address in China; Amazon found signs of an attempt... capture 20261023T080331Z · HTTP 200 · https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw- `headers.json` a4c60087b9dadf6ce73051690a2912ee969a4a57c4edf252d7e96c6cd05a023d 658 bytes - `page.html` 9634154ceca3930e61ef3c720663e361e9fb03690d3d765e90d8d58d2cad88b2 770,407 bytes - `provenance.json` eac54b3d5931c2d6e9a98bf73e9419d41265cc9a4a2089c77434a2eabeacbd85 1,722 bytes - `rendered.html` c0541438d0fa5ea4c569d63693e3755501968267907e8ed90840ee454b381571 794,429 bytes - `screenshot.jpg` 5b39ba74ac4faa6aac845254d931f7aaa68265f214d3fdbf11e4fc4cefd6ad8a 478,513 bytes - `text.txt` 82ef905cd2201bd4507643ba274b135e32b1e440606b1ded976617c782b28166 10,926 bytes capture 20261023T160435Z · HTTP 200 · https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw- `headers.json` 2b9c03883f70f1faabe082d41d9fcbe6092c52767ee752e93f89755969f261fe 658 bytes - `page.html` fe493cc63c77e8e83b384a2cd2fbfe3e8d967b7600095f9697e78d3af62f86c3 770,596 bytes - `provenance.json` 5d35f51515acb289a88cbfd15c74448b4d5d9c8c9960ed6301cebd1ec0a977d0 1,712 bytes - `text.txt` aed5a180dbdb800e3b610efd1721f668f58e7935fa393d6adbbc3efb4493beea 10,839 bytes ### [This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says | PCMag](pcmag-wikipedia-ref-31-s-should-consider-going/index.html) [original ↗](https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-consider-going-offline-nsa-says) **PCMag** · news · secondary · captured · published 2026-10-21T15:08:23+00:00 · added by `curator@php.newsroom` · `pcmag-wikipedia-ref-31-s-should-consider-going` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). PCMag, 21 October: this flaw is so serious websites should consider going offline, the NSA says. It says the threat emerged on Tuesday when an anonymo... capture 20261025T114552Z · HTTP 200 · https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-consider-going-offline-nsa-says- `headers.json` 3d27faf2a77514adfba4cc608ae62fdc986beb54145d8b9cd626538381a3fc91 658 bytes - `page.html` 4c13581487efae8ddc12b29dd529ccd742aab6a7b12d5311fa4b26b7918b4174 770,744 bytes - `provenance.json` 97097a71c53b8341bf578a477b47ab19d78cc86a1301a2cc1e8b5b414d26fd87 1,773 bytes - `rendered.html` ede02de1c70cbaf3e452b906e45b119e566ad3e232ba619c11c6f4f29d760666 900,132 bytes - `screenshot.jpg` 1fec68968bec0ff53949365533ec7aab222a428fef3f3933fa54a2fd774977b4 591,896 bytes - `text.txt` afb256d6323403bdc244f3599639aef775e3aa0c4d06934c6529c347c182dda9 11,733 bytes ### [Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities](peterboroughtoday-must-read-astra-security-launches-free-t/index.html) [original ↗](https://www.peterboroughtoday.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867) **Peterborough Telegraph** · news · secondary · captured · published 2026-10-23T14:57:09.000Z · added by `curator@php.newsroom` · `peterboroughtoday-must-read-astra-security-launches-free-t` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Peterborough Telegraph, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tool... capture 20261024T083755Z · HTTP 200 · https://www.peterboroughtoday.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867- `headers.json` b68ad7f752d93dc6a0bf9ad4880408a52a93ee9ba390ed6725c6945329c3a86d 1,515 bytes - `page.html` ddcd21b8ed1f7f6d440e23e10d8bbdd6947af1f9854f0d5c5bb0f30228e9cff9 234,865 bytes - `provenance.json` 797fd66d0131ede7b9f9288b8c694f0ba029e430eb5cd7facff025183653ce71 1,922 bytes - `rendered.html` f6efd090bd67b12bbc93ddaccd396301336fa77afeef2353d64586932578cd30 231,525 bytes - `screenshot.jpg` 341c84faf52d48591ff55438d64bd89e5815dcb2dbfa7a1766e716c238d38ef1 337,064 bytes - `text.txt` 0a9f92c40ee353320783f8d267aaa563ee55416c31a14fb5b9d5a0001eaf9ef2 5,430 bytes ### [Today's PHP Security Release, and How We're Strengthening PHP Security](php-foundation-blog-security-release/index.html) [original ↗](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) **The PHP Foundation** · advisory · primary · captured · published 2026-10-21 · added by `collector-primary` · `php-foundation-blog-security-release` Foundation's account of discovery, 2024 audit origin, leak timeline (20 Oct 15:00Z), Calif video, Chainguard embargo break (21 Oct 07:41Z). Page embeds an r/PHP comment thread (third-party, not Foundation). capture 20261022T080901Z · HTTP 200 · https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/- `headers.json` c18914982a4c07d0a15b76e052d18c5f77f345016e356ea5cb65e766f0096b0f 857 bytes - `page.html` 6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223 40,324 bytes - `provenance.json` 2acdcc9ae9ee9e14a8960ed26727dee21b5561915fc6632378e78c9ae27a3f1b 1,218 bytes - `rendered.html` 874a78d766936a3c9d375512a1882ac83f25921f0a1050ed8169c5f37ea72cf2 126,413 bytes - `screenshot.png` f6eb5d0b42048f1570880df5c5e38adea3d5ee8635a98b8fef51f6234e5d2089 2,631,098 bytes - `text.txt` a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04 31,882 bytes ### [Security advisory: Critical remote code execution vulnerabilities, update now](php-net-advisory/index.html) [original ↗](https://www.php.net/archive/2026.php#2026-10-21-5) **PHP Group (php.net)** · advisory · primary · captured · published 2026-10-21 · added by `collector-primary` · `php-net-advisory` Official php.net advisory (archive anchor 2026-10-21-5) plus the 8.2.35/8.3.36/8.4.27/8.5.12 release posts and the 20 Oct pre-announcement on the same page. Feed timestamps (00:05-00:35Z on 21 Oct; 20:32Z on 20 Oct) do not match the Foundation's stated times (release 14:00Z, pre-announcement 19:30Z). raw/ holds feed.atom and a curl copy. capture 20261022T080901Z · HTTP 200 · https://www.php.net/archive/2026.php#2026-10-21-5- `headers.json` 42812c4d4f151d93b62d63d08b84b83e50a94a9e2ab79427924d5b5df582cc72 899 bytes - `page.html` 3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555 99,388 bytes - `provenance.json` b1c9672106ace3646ee3912d7e4e87d94dc91cc5b60b9acc1066295675ce5014 948 bytes - `rendered.html` a8cbeb0c17b3646681217db64cce0e0beb6dc71765bd1bad550f8e20170ef7d0 238,404 bytes - `screenshot.png` 4727eaed5a4a5a90eb95aed5c3c0093702f427e1aae4bc63ed9ccfea2ca92da4 3,983,360 bytes - `text.txt` df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e 35,947 bytes raw, 2 files with SHA256SUMS- `archive-2026.curl.html` 3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555 - `feed.atom` 79c12996a433f66b2e2422e32d1dd5d4251c7c24531f75c3a0611f58dc1894a8 ### [PHP 8 ChangeLog](php-net-changelog-8/index.html) [original ↗](https://www.php.net/ChangeLog-8.php) **PHP Group (php.net)** · advisory · primary · captured · published not stated · added by `collector-primary` · `php-net-changelog-8` 8.5.12, 8.4.27, 8.3.36, 8.2.35 entries dated '22 Oct 2026' (the original target date), although they were released 21 Oct. Core entry: 'Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).' 8.5.12 and 8.4.27 also carry unrelated bug fixes. capture 20261022T081558Z · HTTP 200 · https://www.php.net/ChangeLog-8.php- `headers.json` 7e0f775cb09c408472e389bec122b0fc703a450df430b26aca98e4539caf6f4f 892 bytes - `page.html` 8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68 752,126 bytes - `provenance.json` 08d9493b6d1480061ad20e23c5ea875c121bb9741f79ccf69dd923284133f1c9 919 bytes - `rendered.html` 03ecb3465829e89ba578ae7bc7f36881fbbd37d9bc77ae5bb3c74bdd15e2d36a 751,162 bytes - `screenshot.png` 0954e33d2a52ac1470b5c204eaaeea8d8fe811854486542ece88541cf7dbc526 15,023,593 bytes - `text.txt` e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70 417,190 bytes raw, 1 files with SHA256SUMS- `ChangeLog-8.curl.html` 8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68 ### [PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web](php2shell-com/index.html) [original ↗](https://www.php2shell.com/) **OpenAI / Wiz / Calif joint microsite (php2shell.com)** · researcher · primary · captured · published not stated · added by `claude-story-site` · `php2shell-com` The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure. capture 20261022T111831Z · HTTP 200 · https://www.php2shell.com/- `headers.json` 95d2d3cfe2f388045327d30e2dd08bb49dd3e8dd426ae09aa80e1261f01cd7ed 1,509 bytes - `page.html` 8c12d8880e5b0e798d3e4457997397a1c0de6b36ab774a8fe46518f3270532a0 284,683 bytes - `provenance.json` 020c3cad8f308d11c8454cbf625b7310e0958428a69ade312c2cd43d349c2897 952 bytes - `rendered.html` e5958b710931a3753baaa7475dea5c3be9f08677412269976d9e50100e3f9022 506,683 bytes - `screenshot.png` 77a8c0a27f91ee02eab5575847f4611e6605f030f286c20c51eb4de3cf0f496a 2,152,724 bytes - `text.txt` b1e83b4f0feb87d5abb59bfb76015b154a7b678a51c0e965e06929f1e6b17f48 9,251 bytes capture 20261023T160435Z · HTTP 200 · https://www.php2shell.com/- `headers.json` 97b231d6043caaa850edf7ddf8cb4b37e0d828dbaa2f34af25642f1b32af18d6 1,567 bytes - `page.html` 3cd8d65ea92fff67fe8ba33a859adf17d23ec992b51a919ea16ace361b803805 288,798 bytes - `provenance.json` b81bb4aec0049450718b2a7e5f7d1b38aff54270a4eca66f8a201a04025819fd 1,502 bytes - `text.txt` 1a5b93f5d3550ef4fbcedbbb1d54e790c6c63205ff114093e88174b27f79dd4c 9,276 bytes ### [PHP Security in 2025: Lessons from the Core Security Audit | PHP Architect](phparch-php-security-2025-audit/index.html) [original ↗](https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/) **php[architect]** · news · secondary · captured · published 2025-09 · added by `claude-story-site` · `phparch-php-security-2025-audit` Background on the 2024 core security audit. capture 20261022T112947Z · HTTP 200 · https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/- `headers.json` f94a2cb9fd6c974ab16b7f672856596b84da0ee50036c93a902f055a2efebb3f 1,063 bytes - `page.html` 85b9dacfb542ca35651d775dfe24c41186dfdca2ae5abc86bafcdd1e19b79195 94,581 bytes - `provenance.json` 4783394753855b623aa99c5c3077af3a72dc1b6dbd18ba5e2e181737ffcbc90b 1,095 bytes - `rendered.html` 8f4192ecc48d4d4fb38e2492bac830525bfcab04ff70a72849ad8ccc35e38358 94,279 bytes - `screenshot.png` 51293897aa9bc0b5b07dbb244193f6b3da545420a92eb912de4664a8e0ebe245 2,293,707 bytes - `text.txt` 95189f8e2e198e19e39271f1750db73ca525f593abbe9ec363969f3eae4499ec 28,517 bytes ### [Today's PHP Security Release, and How We're Strengthening PHP Security](phpfoundation-blog-security-release-leak/index.html) [original ↗](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) **The PHP Foundation** · advisory · primary · captured · published 2026-10-21 · added by `collector-researchers` · `phpfoundation-blog-security-release-leak` Dated Oct 21, 2026. Primary account of the leak: CVE IDs circulating Oct 20 ~15:00 UTC; Calif 'mistakenly published a video' ~20:00 UTC; mitigation advice may have leaked; Chainguard broke embargo Oct 21 07:41 UTC. Captured text also contains reader comments below the post (lines ~90 onward) — those are third-party, unverified. capture 20261022T081244Z · HTTP 200 · https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/- `headers.json` 3b9ca485b393afa38381b67bb251208dca58e32f815fd1aed95ba69e1d88dda3 856 bytes - `page.html` 6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223 40,324 bytes - `provenance.json` 777ac74e8e4915a67c651d019c1cdcf9a099773e9963221b097b676fa5054bde 1,222 bytes - `rendered.html` 074da5662f04df8f88a2efc163726c553f5bb43c8095278a089daa0faf364955 126,414 bytes - `screenshot.png` 09956999247e6e42a5635bb2b1234a2f8a11f0c66c26b88fafc020c31f3b6cd6 2,630,327 bytes - `text.txt` b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd 31,883 bytes ### [PHPocalypse Tracker (allixsenos)](phpocalypse-tracker-sites-csv/index.html) [original ↗](https://allixsenos.github.io/phpocalypse-tracker/sites.csv) **PHPocalypse Tracker (allixsenos)** · other · secondary · captured · published not stated · added by `curator@php.newsroom` · `phpocalypse-tracker-sites-csv` Promoted from the source watch (oq9gflln), snapshot 20261022T183616Z. The community list of 50 sites dark and back, with times and cited claims (data) capture 20261022T183616Z · HTTP 200 · https://allixsenos.github.io/phpocalypse-tracker/sites.csv- `headers.json` 5b36e9822f2d454b789c5f6ffbe04185fa3ccc3c435cd4512241240f5f5ea478 826 bytes - `page.html` 8109506bc80264887f2bd36eb452c1ad5468db6330efe4f167623be9f9965fe6 18,969 bytes - `provenance.json` 83c0f400d5e4a6eb1dcbc049c4dae82a42be94efb84aeeb72dc7581ae29484a7 1,295 bytes - `text.txt` 8109506bc80264887f2bd36eb452c1ad5468db6330efe4f167623be9f9965fe6 18,969 bytes ### [[종합] 靑, PHP 사이버 보안비상에 민관군 긴급회의…국내 취약 자산 11만건 추정 capture 20261022T181608Z · HTTP 200 · https://www.polinews.co.kr/news/articleView.html?idxno=746632- `headers.json` ae83250b82306abe2e1856516b552ca589dc081b94ee8dc3510d5a2eb419a0c7 355 bytes - `page.html` b7cada245604c7e609d57286d94cb94aaa17c0990e68b2b323102409bc7a8c19 153,197 bytes - `provenance.json` cd806083f05b72f0b87a699666a3cc2790e05f84290f3324a748e7fe6661a12d 1,721 bytes - `rendered.html` abab15a515f0e377f7658bdf5fd782d45e6f9510b2f12a347b520f4dcfe2f12d 507,749 bytes - `screenshot.jpg` 1f30415ca69f3c7857c286053e7e107bacda26ac54e6d6d7c09c591453dbeec7 523,290 bytes - `text.txt` b4f4006727c71782d57186c85e4f20f197589c088961d658ac30ccf8aac159f1 10,851 bytes ### [Page accueil | Préfecture de Police](prefecture-police-site/index.html) [original ↗](https://www.prefecturedepolice.interieur.gouv.fr/) **prefecturedepolice.interieur.gouv.fr** · government · secondary · captured · published not stated · added by `collector-news` · `prefecture-police-site` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081934Z · HTTP 200 · https://www.prefecturedepolice.interieur.gouv.fr/- `headers.json` 9134dcb7c5881a8b194d3f9dd3ffbc2378b9c539130eeffa47ac45748d5f48d4 473 bytes - `page.html` 0d34ee20b6d729126f325918feec97ab0d8808e852e96e505214b643123a14e8 222 bytes - `provenance.json` 36da19b3c25610bbc46a1d736fbea1a8ebb03726e59893c483a481517ee1007a 1,025 bytes - `rendered.html` 8d759eec1f0249c6e5fd78724fad69cb850e27fc7c2a9c12d1b24afcd09e4af4 104,031 bytes - `screenshot.png` 65910824ad9b6a70a3d52b37c03081b28de5bcf27ce8d96459de86fc56a83f0e 219,205 bytes - `text.txt` 3689dd69c688f7c18520c26d77dfd3de27079a3ce0905e8154628e52a3b7698a 2,044 bytes ### [php2shell: Detecting and Investigating CVE-2026-109618 and CVE-2026-109619 | Prophet Security](prophetsecurity-php2shell-detect/index.html) [original ↗](https://www.prophetsecurity.ai/blog/php2shell) **Prophet Security** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `prophetsecurity-php2shell-detect` Vendor detection guidance. capture 20261022T112954Z · HTTP 200 · https://www.prophetsecurity.ai/blog/php2shell- `headers.json` 3d69271680bbf150bc6fae70fc1287cd80311e2b43424bbf4f428714ecd955b7 1,637 bytes - `page.html` b00c997496adf4b1764b46125a9a74849e83e0baf12ba075d39cc6b0c4493bb0 178,998 bytes - `provenance.json` c58cd7be80e63d3760a0f31b5507e5a3f5678bcc269f1ef1e986c903224553af 1,025 bytes - `rendered.html` 3ac8595af5225424d4be82b0b063abfb5254d537481410f86cb935ebdb46b2a5 797,451 bytes - `screenshot.png` 8a43fab6765b4d462f55e613f1f5fec6d081c690d44afd1fc4af635f917078f4 1,773,221 bytes - `text.txt` 2e8efe1d3d72efc2c7357b939ba6e0a4ee639b3fb3cde21efaa44f5f60a00e51 15,452 bytes capture 20261023T232528Z · HTTP 200 · https://www.prophetsecurity.ai/blog/php2shell- `headers.json` 997bfc5af7c0b384391765e06e77a9627a395760d29d0491157bcb82da159ee7 1,709 bytes - `page.html` db354351b01d8447569f087c81b0f2d39a2babefd76ba695e70059f0a3235ab4 177,663 bytes - `provenance.json` 2783ca95e3795e226b6328e9f52e76e77523a6469728f2988dcb8021fbf02202 1,655 bytes - `text.txt` 8549941ea19ea0071065130a1c3b1bee7d19b4e3a8595a65fbae489972228f83 16,243 bytes ### [PHP security crisis raises testing stakes for banks - QA Financial](qa-financial-php-security-crisis-raises-testing-stake/index.html) [original ↗](https://qa-financial.com/php-security-crisis-raises-testing-stakes-for-banks/) **QA Financial** · news · secondary · captured · published 2026-10-22T13:42:51+00:00 · added by `curator@php.newsroom` · `qa-financial-php-security-crisis-raises-testing-stake` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). QA Financial: the PHP security crisis raises the stakes of software testing for banks. The opening paragraph refers to an alert covering CVE-2026-1096... capture 20261023T160435Z · HTTP 200 · https://qa-financial.com/php-security-crisis-raises-testing-stakes-for-banks/- `headers.json` 7023ce5ee1ef7f5bbdd3abf28da4178dce1e1a4a23d3081219e3d7d7adea44c7 961 bytes - `page.html` 06ecd3bded5d56c322656eddc050f0c7d97300c8d202f49485e431fcc475df15 114,510 bytes - `provenance.json` 9b2fef1858514a1fe035ca4d97e6e9acff71fd254c44258aeacdc7f6189c94dd 1,580 bytes - `text.txt` 3a64bdadbb6d9fe39fb4d15c9f31c449471ea339f3bd17e8882e711c66ce1e88 7,331 bytes ### [Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP](qnap-qsa-26-18/index.html) [original ↗](https://www.qnap.com/en/security-advisory/qsa-26-18) **QNAP** · vendor · primary · captured · published 2026-10-22 (release date on the page) · added by `curator@php.newsroom` · `qnap-qsa-26-18` Promoted from the source watch (oq9gflln), snapshot 20261022T191720Z. QNAP products affected; take NAS offline (primary) capture 20261022T191720Z · HTTP 202 · https://www.qnap.com/en/security-advisory/qsa-26-18- `headers.json` aa08aaebb6e26e71a93712249fa6ad431e8d910a925ae174fa44959c2321f018 739 bytes - `provenance.json` 9ed0a563b1c7b28729c903b027ae9f66d5e825faa7b14caab83cf5c699111d72 1,555 bytes - `rendered.html` a49d81def04843e1e2bf1e474dfd384989bb9eeb992dc1cb33ca624a08fa4c42 209,652 bytes - `screenshot.jpg` 775851d837e4ee7b5e48ca2f7be725c84564336a7f215265a5861185023bc955 401,134 bytes - `text.txt` 45f3ae53efc4028d20fc6d29bf21d91f84ff1bf962beef861d70be6f72d04593 7,261 bytes ### [QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP](qnap-statement-php2shell/index.html) [original ↗](https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance) **QNAP** · vendor · primary · captured · published 2026-10-22 (dateline Taipei) · added by `curator@php.newsroom` · `qnap-statement-php2shell` Promoted from the source watch (oq9gflln), snapshot 20261022T191720Z. QNAP PSIRT saw scanning and attack attempts (primary) capture 20261022T191720Z · HTTP 200 · https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance- `headers.json` c253a6f6b0a50935f373029d625f1816fe441abf971eae8fab073bd5ddd84df6 5,433 bytes - `page.html` 6d7e8996b605faaaa6df09930f6790a531f355fbe2fe16f5ffef4c1e93ebb781 169,112 bytes - `provenance.json` 5bde08241c094606508438d02703564d9ee44a9f24dff12bd8d67a88dba8840e 1,790 bytes - `rendered.html` 70a37c635627cbe7026e77c82a9d45f14fd116c035e5e8fb06787c951812aa94 200,745 bytes - `screenshot.jpg` 4c6ebb3a51a831ef15bcb4d9b250468467353cce02251de6b8eda4e444665fad 320,971 bytes - `text.txt` 7ef4fbb68cf300de902a7ae7193b4d2e5ce539e4b21c4040a0e6fcabf7e02e2f 4,716 bytes ### [403 Forbidden](qualys-blog-php-preannounce/index.html) [original ↗](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities) **Qualys** · vendor · secondary · blocked · published 2026-10-20 · added by `claude-story-site` · `qualys-blog-php-preannounce` Published on 20 October on the pre-announcement. capture 20261022T113004Z · HTTP 403 · https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities- `headers.json` 9ae7ad7eb7ecad9ff1195f99f730cc79be3ed1abdbb907f73ad003c7d28c5651 628 bytes - `page.html` dd1c2f122d665c4b3fb0be7b2e8e1eb717607b195475efd409f666dfbd979b60 1,486 bytes - `provenance.json` f3a38995a937d0edc65d7304bf5014e3d946eb475aa675593c5aa03aea58e148 1,110 bytes - `rendered.html` eddbe1ecca686ffa5ca8cfa12c3054e26ecd8eb8c21461faaa9951759d65f41d 1,203 bytes - `screenshot.png` 88143431c2f2ccebbb073449167e29d4114759e3e211d651114b2d152afd2e9e 10,431 bytes - `text.txt` c6c1266b1b8854e014702a20b4d2b956f885b89fc66f21fad180d33a4c37467d 19 bytes ### [Security audit of PHP-SRC - Quarkslab's blog](quarkslab-blog-php-src-audit/index.html) [original ↗](https://blog.quarkslab.com/security-audit-of-php-src.html) **Quarkslab** · researcher · primary · captured · published 2025-04-10 · added by `claude-story-site` · `quarkslab-blog-php-src-audit` Quarkslab's own account of the 2024 php-src audit (OSTIF, Sovereign Tech Agency): findings, two redacted high-severity issues with fixes in progress. capture 20261022T113008Z · HTTP 200 · https://blog.quarkslab.com/security-audit-of-php-src.html- `headers.json` 9a1974a3d0e74f6c61049df444eec6f88c921c1df160c4d36547d455f5f69d3a 721 bytes - `page.html` cfffdbab1e24dbeaafa236432ed6653fa2442387aeae475f996cddddb722bb89 28,339 bytes - `provenance.json` c1a3e69c282c4e578340fa0788f636f5604d1f0d0a6076bac4cd7bd024ee55ca 996 bytes - `rendered.html` 032ff57da663f85dcf219749a2b1849c606efef96c9044684130409249a05e18 27,638 bytes - `screenshot.png` 84a81db5a451d763ffe7a40817ea3c94e0e0a7d7da3bd0b7c74b2b8b0c912974 932,374 bytes - `text.txt` cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321 7,821 bytes ### [PHP2Shell Exploitation: Two Critical PHP Flaws Explained](recordedfuture-php2shell/index.html) [original ↗](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation) **Recorded Future** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `recordedfuture-php2shell` Vendor explainer. capture 20261022T113014Z · HTTP 200 · https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation- `headers.json` 3f16adaf8c9cba92536851d7836d4e787039ea13bccb4da34e56759d45f7fbef 1,234 bytes - `page.html` cd54cc52e04832d03115211f9aca789fb9d4861a8460a25a4e6ccc45f2d11f9b 27,860 bytes - `provenance.json` d044ae83506d9d12bb11b3e2357405fd0be2350bf9782b8f21e5d0bc7134c316 1,034 bytes - `rendered.html` ca1457d1d590d21807ebf2cd64d30304ff3607b8171472c2d205a8fd4365a37c 178,844 bytes - `screenshot.png` cd745753c1ec28fcaf45c4b291d01045bdf86c88cbd0184e664e196bdd0f8ddc 2,871,582 bytes - `text.txt` f9cb130d64545fe46a477766dce91126405f12d99e8051aff2c05e084a904fe9 18,444 bytes capture 20261023T012042Z · HTTP 200 · https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation- `headers.json` df92af5f1f15a9b85ac768da0a431d3d7aeadec8e8e1068f4d7d57e76f9b56b1 1,305 bytes - `page.html` cd54cc52e04832d03115211f9aca789fb9d4861a8460a25a4e6ccc45f2d11f9b 27,860 bytes - `provenance.json` 9c026e4540e485d466a7ebfb9befe5fe2ea5a26a87647d09af9bbb5d950e3209 1,706 bytes - `rendered.html` e4e4f2824c8737f38089591489f1357b6b278f491cc344717f0a01d6de090dee 91,816 bytes - `screenshot.jpg` 68cd85ed3f9dc7d419ee012d3ab12f44d57604bffc4dad62486f71cd98e5a098 899,644 bytes - `text.txt` 39efeb7b8ae8152f98ccf53437e4070f12339a7e718570de9f01ac96d23b0622 17,215 bytes capture 20261023T232528Z · HTTP 200 · https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation- `headers.json` a5b6e014f8f9bad6ff90385d3a483a51fec3e5af097bc5ce4162c306687fe3f8 1,305 bytes - `page.html` d93a1ac76ef2a1cbc5efb69085764a3b86d3ec663e9fef379392bd05c683cbbf 27,860 bytes - `provenance.json` 5d37943846b2c5186dc66fa38523588b066ccf066a901a7e37e11aacceb6647f 1,787 bytes - `rendered.html` 7e5416dba92c0c59ea7f7e10bb5481e565b2d87f419a1ff778b9a917ae169101 91,859 bytes - `screenshot.jpg` 68cd85ed3f9dc7d419ee012d3ab12f44d57604bffc4dad62486f71cd98e5a098 899,644 bytes - `text.txt` 455f6f3614b4acfb45ef4b051f2db40c015a61a3e797016042ca5ff9c0a00f9f 17,215 bytes ### [PHP2Shell, l’IA svela due falle critiche nel web - la Repubblica](repubblica-tecnologia-2026-10-21-news-php2shell-ia/index.html) [original ↗](https://www.repubblica.it/tecnologia/2026/10/21/news/php2shell_ia_due_falle_web-425663861/) **la Repubblica** · news · secondary · captured · published 2026-10-21T17:55:56Z · added by `curator@php.newsroom` · `repubblica-tecnologia-2026-10-21-news-php2shell-ia` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). la Repubblica (Italian), 21 October: AI reveals two critical flaws in the web, both 9.2 on CVSS, together called PHP2Shell. It argues that the same sy... capture 20261023T160435Z · HTTP 200 · https://www.repubblica.it/tecnologia/2026/10/21/news/php2shell_ia_due_falle_web-425663861/- `headers.json` 45bea6772e54153e771d375e8dd3dc5e4504588e04db6330e62bbe061e8ae95f 1,987 bytes - `page.html` 57b4522b2978e48a007d6bf4bfbd025bfa1f7f3899e268d0a0f2489829eecd12 163,017 bytes - `provenance.json` 135bf07c552eee1b70fe0f3f83b1e8cfab80555f9d67f05a6b03656bd4fb421e 1,618 bytes - `text.txt` 15cece2248273664131179c3462761620f79e5f2ed3af09e3aee95a919e3b217 13,395 bytes ### [Major European Websites Offline Amid Critical PHP Security Flaws](reuters-factbox-gbaf/index.html) [original ↗](https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/) **globalbankingandfinance.com** · news · secondary · captured · published not stated · added by `collector-news` · `reuters-factbox-gbaf` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081002Z · HTTP 200 · https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/- `headers.json` 0f82cac11c2c31881c8242d2bf90ed1ebc349bbb702d299abb0e94c2b2fc1880 1,330 bytes - `page.html` 8b08fae52d13b125e5261388eb67d5e549c6ee18d44c3d6d93c35a155d104314 211,274 bytes - `provenance.json` 0ec20c99fc8c619438aa226c1087f5d008ef9a7db541e19985ae4af428a0042f 1,066 bytes - `rendered.html` cdcd3539791cbe2e6d50b9b6206835f8ccf4f1fb48ed26adad8b43e163ba64f4 225,149 bytes - `screenshot.png` be60a7208d66854ef7c6ec0949fbd543dea20f03eb2f712803865e01ee11e6ce 3,384,956 bytes - `text.txt` 9703a69c2faf52b56bf06d29691f5173128b527dc9b76db27050db282fff262b 8,772 bytes ### [Global Websites Offline Amid PHP Security Flaws: Finance Sector Impact](reuters-factbox-websites-offline/index.html) [original ↗](https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/) **Reuters factbox, via Global Banking and Finance** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `reuters-factbox-websites-offline` Reuters list of websites taken offline: Netherlands, France, Germany, Belgium, Finland and others. capture 20261022T113026Z · HTTP 200 · https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/- `headers.json` 8756be9a476cea45bf6f0ba5d6afec78293d9a1c08b04c463ba887aa51643743 1,259 bytes - `page.html` 8c4668f8881f07f4e9fcdaf5498ac560214aa9243a2e163122532b0a80b2d141 214,076 bytes - `provenance.json` 93bc4bfda9e1316396b718afd5bf442ed65dbddf92c7700d9308c0d04c3c7806 1,084 bytes - `rendered.html` 5732718cdad049baa24fe5d9d7c0e91fd962f71df61672c4e0b3d101b9a262c3 227,694 bytes - `screenshot.png` 28b7c31e70d01ad1a8ca150a6127d7188c38f431b913c022f6aa6a997c47cc5c 3,456,506 bytes - `text.txt` d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3 10,148 bytes capture 20261023T160435Z · HTTP 200 · https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/- `headers.json` a624791e097041e6abf1e0e6b6abc35bdab5812d0bba162c99d36c6ae134e7a1 1,354 bytes - `page.html` f45743afa98ecc69805e3186c1672ce9cb07f73588a358041e316682975662c1 212,742 bytes - `provenance.json` da3f25a56f17707a7318f3719a8a3facdaaad926401b3ff066abb8aa422b86c7 1,766 bytes - `rendered.html` 7d1caa464a19381a8838781832a841b7a677de19ab56746d8fdcd24c83b2fe51 220,594 bytes - `screenshot.jpg` a3a13d7a6abe4a384970719218cf0e608fbbefc3a5b3e314dbe10d9d6e9c5d34 796,133 bytes - `text.txt` 580b1825b53a02b647e824a20640ed311a5fc9b52a41f4d4dfe3799f365310dc 9,611 bytes capture 20261023T232528Z · HTTP 200 · https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/- `headers.json` 49b0b8c9d4f582ca5c7660b7fa87294c3a67aa9f1bf7aa59650a9bbecc961351 1,354 bytes - `page.html` bac73707ea379a721131c9b0cf14ba3b75a2cc834875f008cde49b792219b26c 212,658 bytes - `provenance.json` 89a0679a453e4343388fd8fcd83c18cecd38fa74bd9697ab6f741f29863c8379 1,802 bytes - `rendered.html` 1d5baf8d98f6f0d3737219eeb089eeb9124a8b0d00764956a88c642639fe17c4 220,510 bytes - `screenshot.jpg` f1b373c45ccb4a638fb123526c6b9698acbd4b0dc4e87f093f1b124244a93a6a 786,557 bytes - `text.txt` cee32261ea200d861ff0b9c5363eeb61fd513192358fde3ec394df4e8108e023 9,569 bytes ### [NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl](rijksoverheid-ncsc-php-news/index.html) [original ↗](https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php) **Rijksoverheid (Dutch government) / NCSC-NL** · government · primary · captured · published 2026-10-21 · added by `claude-story-site` · `rijksoverheid-ncsc-php-news` Primary: NCSC.NL taken offline 'uit voorzorg'; advises a risk assessment per internet-facing PHP system and considering switching systems off until fixed. capture 20261022T113033Z · HTTP 200 · https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php- `headers.json` 02c777fcd4897b76fb5febbe44f6827eac84175c43def883b4074889c879f1e6 2,789 bytes - `page.html` cd5e199ae854bb38177fa187f36f80b267ee93f5b23262122697c7038276e21e 240,904 bytes - `provenance.json` 41eeb42a42ffe905a45ac1fe625d4acb5b9ba172ca4fd9253d01dc7295a7aa8b 1,072 bytes - `rendered.html` e364ac0a4f3336a54bc2581a182d37db39961f47802adca7c95247e9c0fd4613 244,344 bytes - `screenshot.png` 0b023dc6a8fca71e18932ef0a168051841129928264b33c1937fff623cab4457 435,918 bytes - `text.txt` 7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3 3,720 bytes ### [PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab](rocket-boys-security-measures-lab-php2shell-poc-expl/index.html) [original ↗](https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/) **合同会社ロケットボーイズ** · news · secondary · captured · published 2026-10-22T14:56:52+00:00 · added by `curator@php.newsroom` · `rocket-boys-security-measures-lab-php2shell-poc-expl` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Security Measures Lab / Rocket Boys (Japanese), 22 October: proof-of-concept code for PHP2Shell is surging on GitHub. The Korean firm AhnLabs examined... capture 20261023T160435Z · HTTP 200 · https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/- `headers.json` 2fa11046b852bd7af02b3a4a36eff2eab616cdb9797f80587b3065a2cd420f54 1,444 bytes - `page.html` 0d96245e6d02d7170bb3666d25918320a9728cf856c4d4a8f0a52f23520fc7b1 615,369 bytes - `provenance.json` 77749fc927be896e16ce7318e493d0d9ecf80ea4996f0cbb3b84d35851cb616f 1,904 bytes - `rendered.html` 7c53e1dbafedd63bc6a78deaeed6c424f6769f27ae8759d206c1d5e18a290244 628,633 bytes - `screenshot.jpg` 9e4bfc3e74986643d92c2075b3db42e1f1ead0838b37b7c1777e22db8b1821a4 1,087,188 bytes - `text.txt` 200b9c25496ebb7c2ce6a67438d5aa9ff91913881792669617d5194d17301151 24,573 bytes ### [Websites go dark as AI exposes critical security flaws](rte-reuters-websites-go-dark/index.html) [original ↗](https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/) **rte.ie** · news · secondary · captured · published not stated · added by `collector-news` · `rte-reuters-websites-go-dark` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081010Z · HTTP 200 · https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/- `headers.json` f5b5b1d3b6b258e2668d1a3047ddb2a89d50c42adc9c44c86ef90afd467c1bc3 1,235 bytes - `page.html` 2945a45c012dc5bd698063f5c9a20f07fd33bcd8caf04a6367975d09fd13d668 113,113 bytes - `provenance.json` 76e5dfc557b4b3c9272c645b3194acdc2db8d1133b8afbb477a1aaed2ffb15d8 1,022 bytes - `rendered.html` 2e18e85345a2955f871b8555cb252692d6dbcf108944014933fa45e2c30fc839 332,598 bytes - `screenshot.png` 17168dd7f381156936039432350ee18a1b46c8e6f4906d21645fc0fcf7bf2a1f 1,313,851 bytes - `text.txt` 99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653 9,940 bytes ### [PHP-Lücke: BSI warnt vor Cyber-Gefahr – Firmen oft unwissend](rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi/index.html) [original ↗](https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html) **RTL.de** · news · secondary · captured · published 2026-10-22T19:41:37 · added by `curator@php.newsroom` · `rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in de: RTL (dpa-based) reports the BSI has found no cases of exploitation so far and believes many operators have patched. Digital Minister Wildberger praised BSI and ITZBund and said shutting down sites was right; the Interior capture 20261022T181608Z · HTTP 200 · https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html- `headers.json` 321a40764cf371471d79d6f2d6b9f3227260276dfcb529eebfcd688f7e5ad5b9 1,618 bytes - `page.html` abe3016b1607d34a0956dd46eac3453997dad2d79d292600a3c1c90d5be02960 1,203,929 bytes - `provenance.json` 75a301ad356d6e1a61261537316a74a33e17dc037d70875abd177eb6b3483efa 1,796 bytes - `rendered.html` b15ecaa96265133b0343466847e71af449c249b10ed1a8622c8f2e0a57f90ce3 1,225,662 bytes - `screenshot.jpg` be70d324955662023d26ab0cc1419cadafc6d450f8bd3517d4fa5aab90fe120f 119,816 bytes - `text.txt` a69da5f39287ad4307292733dfaf03317eb57edfcc30fc1959d41922af77bcf7 7,400 bytes ### [Alerta por fallos críticos en PHP: riesgo en servidores web](rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili/index.html) [original ↗](https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml) **RTVE.es** · news · secondary · captured · published 2026-10-22T01:49:29+02:00 · added by `curator@php.newsroom` · `rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in es: RTVE describes the global alert, Spain's INCIBE critical notice and the NSA warning. It lists precautionary shutdowns: ITZBund in Germany, French prefecture sites, Belgian portals, Finland, and Czechia's government page. capture 20261022T181608Z · HTTP 200 · https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml- `headers.json` b5dad02e568f4ab4cfd809b3fe342ed8cf08defddf91510779f5afe2637dc887 606 bytes - `page.html` af0bf01237b873ef9dcabdb4816360d6bd3f4ffd3ec09ada675afefde44af993 95,615 bytes - `provenance.json` 6201b6d432f17cc9fc0b4d70179f355634fd09105282bb90ee5d8e51d9339aec 1,833 bytes - `rendered.html` 3ef986deb6a9e2970044a3f98bb0ecf6bf0dce0baa34426bbaf3e2054bde3fb8 179,111 bytes - `screenshot.jpg` b96238b874f2f01b6987479aee95c2e60d58e80ffa155472735187d0e3e796b0 829,185 bytes - `text.txt` 0c7f8e327e5c8bd0d5c3b0c7c6ab7cb7ef3a383f5da908cecc7da96ba7a19ccf 11,153 bytes ### [PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog](safeguard-how-hard-to-exploit/index.html) [original ↗](https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes) **Safeguard (vendor blog)** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `safeguard-how-hard-to-exploit` Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation. capture 20261022T113039Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes- `headers.json` f024dda4aca45ee7784179ce10f5502c7cdc1848b68820c5e3ac4d5ae9977fe4 1,910 bytes - `page.html` ca8f171043e3a56f99149b1ffa731bfdd00faa1aca0dde315bab896ba544148f 419,051 bytes - `provenance.json` dc78d80894e1f67eb84e8f3dbcb4fce3d4687ae21172b11e13dab9e452491777 1,094 bytes - `rendered.html` d50d0675b422cf74595a98594b026b8936b4a597bfdd8e14bf6417f1fb65c089 425,970 bytes - `screenshot.png` 81bc77d288b0f16b3a5aff9755c8f70d850d79e54d2f786960ea233e942d2e24 3,150,477 bytes - `text.txt` 271a233b1b8e628f66e764b3e3f089b09951d09ecdbb5fb9ef39d619eae623e9 37,594 bytes capture 20261023T160435Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes- `headers.json` d50c6a9ddd97239fa2ed1d9614882d0507ba77f07c9484fc833498c7ed6307d6 1,917 bytes - `page.html` 959573a3f2c3d2e8848e4f61f7cabb007ee6331d4673a54a6d7c1c9b66bc230d 419,348 bytes - `provenance.json` f8b12a3e1a08e3c7e4903cb98245fd94c2e743c19e8e39a9278b9eaf6432b84f 1,844 bytes - `rendered.html` 0a7a5c755f46e5b6dbf8c621456c0772fb7d7a77d2a2c3994eb743198469366d 417,090 bytes - `screenshot.jpg` 73084c3582950994b826c9dbfbaaac7cf5304f70bb032169e76d55d2ecc92382 855,170 bytes - `text.txt` b71f6bcecfb482abe1ff03d2d333d48f6729f67fad7c3525ff8abacfb7b03a67 38,094 bytes ### [PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog](safeguard-waf-rules-limits/index.html) [original ↗](https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits) **Safeguard (vendor blog)** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `safeguard-waf-rules-limits` Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL. capture 20261022T111928Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits- `headers.json` 0c47d1b3b4483fe3dfbc1d2c92601e2da277c00bd9b13a0b4e1400d532b810f8 1,911 bytes - `page.html` 7ee15349d487eb9f5fb2f578f4e465e1bdd8b44a4f7ecbfc4b2d6da5277b7dda 428,039 bytes - `provenance.json` a152958c004bbd289d33c79fc1eaf5b3b1aa6442001c31226607d2a25f3b67d4 1,055 bytes - `rendered.html` 9cf1b889fa9c9bfb3bc5a219a58059a1fbb4ad867e796b6d89a2ca8960724e69 436,335 bytes - `screenshot.png` ec0109ce98dbf571daf5c08aeff60ae7e9957e2fc907b50f17bd9e196ef0c621 3,153,430 bytes - `text.txt` 664a398aae1f5c1df20e43deb46b962fd818b4403c864de8cab55f23c79c193c 36,136 bytes capture 20261023T160435Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits- `headers.json` a314209add798e06b3201c58b75dd001a6daa7a4ff87db80e6ea6f850fd42f97 1,917 bytes - `page.html` f050c34d2436011467e49cdbc40eb33073ec2f702dfc89de060201e134559a83 428,336 bytes - `provenance.json` 48c3dd6455b47b497867076dddbcbab1bc42a3f52e7df3ca7297a39eef513956 1,796 bytes - `rendered.html` ed5af89a5a77b0082b72458d20a56ccad03f03e8235e6460165cafa9da9c4faa 426,115 bytes - `screenshot.jpg` 71998cc58d77b7bb204a1d1c83e2585cd195ef802f9d2c1a4ef72de08290ec36 772,450 bytes - `text.txt` 9c8bc44b157ad4c12dd5b38c06b69f4622f866c3ceadfa5fe0eb5d0cb1bb7767 36,495 bytes ### ["Massive Sache": Folgen der PHP-Sicherheitslücke für heimische Wirtschaft noch unklar - Salzburg24.at](salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic/index.html) [original ↗](https://www.salzburg24.at/news/oesterreich/massive-sache-folgen-der-php-sicherheitsluecke-fuer-heimische-wirtschaft-noch-unklar-art-342173) **salzburg24** · news · secondary · captured · published 2026-10-22T13:23:30+02:00 · added by `curator@php.newsroom` · `salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in de: Salzburg24 (APA-based) says the damage to the Austrian economy cannot yet be estimated. The Interior Ministry reports no confirmed successful attacks so far; WKÖ's Markus Roth calls it 'a massive thing', VÖSI urges check capture 20261022T181608Z · HTTP 200 · https://www.salzburg24.at/news/oesterreich/massive-sache-folgen-der-php-sicherheitsluecke-fuer-heimische-wirtschaft-noch-unklar-art-342173- `headers.json` 6430448bafcff3d14b3338abb5a7e0b688efd672d89994532cd0a8a87f1b831c 458 bytes - `page.html` 98c9bd3cddf8b6da466f829144d927edfb8d2fcd418ed67f70032b634a635b4f 112,344 bytes - `provenance.json` ba66f55c36702b317066bdcdf72907e8c7ec45aabb5d7026df03f879a0bebc28 1,910 bytes - `rendered.html` 46d378c2461d705290e7367aa3267dbbbc33ebc9ac5ea969430d6697a5d5efd5 119,883 bytes - `screenshot.jpg` d42f5c02ab3a0d2c4e847c973e018677438181c10a51ff27163b2d60e9c5e577 535,431 bytes - `text.txt` c08f50a226214f7bc04c16d3d05dce23038cc1a460fa4349860046d0f0a1e74f 6,818 bytes ### [エンタメサイトDMMがサービス停止、外部システムの脆弱性への対応 「情報漏洩は無し」 - 産経ニュース](sankei-dmm-service-halt/index.html) [original ↗](https://www.sankei.com/article/20261022-ARAQ7L3PNVFVLMMEJUZW4LJ4A4/) **産経ニュース** · news · secondary · captured · published 2026-10-22T11:11+09:00 (as stated on the page) · added by `curator@php.newsroom` · `sankei-dmm-service-halt` Promoted from the source watch (oq9gflln), snapshot 20261022T191536Z. DMM halted services for an "external software vulnerability", would not confirm PHP capture 20261022T191536Z · HTTP 200 · https://www.sankei.com/article/20261022-ARAQ7L3PNVFVLMMEJUZW4LJ4A4/- `headers.json` fa65e324a3b7cf7c1196a64c9fd86793a9917fed803cb87912c7989f3d1b642a 1,835 bytes - `page.html` 9a5b021f7f274c1239b30a485f69d7cb47c8927c5282b90674b0b53df0a9d521 214,258 bytes - `provenance.json` 4704131fdfdbc8c60e3335bfd3137a614a4230409e82de18c060c74c538c3664 1,671 bytes - `rendered.html` a1873be5089d2750c1332f457f1981689089867c7ec13aa53a9fd51505b2cff6 380,702 bytes - `screenshot.jpg` 571e296c44ad89cc5f1581a63007d9b169a0b5556ce6633166924deb243cca71 91,325 bytes - `text.txt` 8baf5de68d8527ed2167041c1b91cafb575afa7165abb55cab5566fcd9e2d610 5,432 bytes ### [PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansec](sansec-research-php2shell/index.html) [original ↗](https://sansec.io/research/php2shell) **Sansec** · researcher · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `sansec-research-php2shell` Vendor advisory predicting mass exploitation within 15 minutes of release; no IOCs; later accused in a reader comment of leaking a vector in page metadata (unverified). capture 20261022T113104Z · HTTP 200 · https://sansec.io/research/php2shell- `headers.json` 2dfd5ab190184ed3ba6295db2882e7dce9719d6048f860a68a011034c1e1e26e 1,167 bytes - `page.html` 60368be8e17445397b0865e1a7c8a7142cd888ffd81aac0b11d7d0644dbaab1d 36,814 bytes - `provenance.json` 7443427160ac153a29c5b8c8c5278458e0b6c1eb5bc1bb1597d25757d01836bb 978 bytes - `rendered.html` 31f57c6c03a271c045e195256e2d406614c505ca3c3d07ce40c299983be0cc0a 37,783 bytes - `screenshot.png` 21518bc8c146169d1d397668488e88840c646c1286340aa20808740f0538eed8 1,506,901 bytes - `text.txt` 281e3c508909a7002ae17602fd885f6acbd78e3766d8de3153f1139c7be8d134 9,554 bytes capture 20261023T160435Z · HTTP 200 · https://sansec.io/research/php2shell- `headers.json` 08e45c06d2d5b4dcc02bb11b1ce1b21e663992ce40c20d74d0b89ae2ae32fc97 1,228 bytes - `page.html` 0464d92757acaa440ff1a843c8b17488b8c4d11c76829960603d05df17be5c00 36,616 bytes - `provenance.json` dfff01421f95d98b2c7ecc72a48a9df8580284f8e24d0b9541c9103220f34cb2 1,534 bytes - `text.txt` 17011ff26544f8a95f05ff13b9ec30ee2bd69f22541ee7ac87635385f42b85dd 9,778 bytes ### [Edinburgh council website offline amid global cyber security alert](scotsman-edinburgh-council/index.html) [original ↗](https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652) **scotsman.com** · news · secondary · captured · published not stated · added by `collector-news` · `scotsman-edinburgh-council` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081043Z · HTTP 200 · https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652- `headers.json` 5611f99e1d303b8595b1fb461712ec67fcf267031ac6236b0c9132ed03f58115 1,606 bytes - `page.html` 85fe7278d49241428ba4260ba45ef05404b05a13506d4fd2f84ff3002f15edc3 262,891 bytes - `provenance.json` f5286c2605672538c7198984bab2fe42a0c6eaeaddb14ec027f66d04d8d19c7d 1,110 bytes - `rendered.html` c0b3ace7431c2f7a00313b57ca3b4f7e65b274431ac45fd1653c2281e8368546 545,168 bytes - `screenshot.png` d762e99ddb102895bafd39a1da11a34a4d00e0a6d3be8d8106a67a3ef473f1a3 1,619,065 bytes - `text.txt` 3598df2ac437acced78bcb4e6e3d00d9fefacec158ff9f8fcc2cbcb24f41d702 6,887 bytes ### [Edinburgh council website offline amid global cyber security alert](scotsman-edinburgh-council-offline/index.html) [original ↗](https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652) **The Scotsman (Jack Davies)** · news · secondary · captured · published 2026-10-21T18:09+01:00 · added by `claude-story-site` · `scotsman-edinburgh-council-offline` Edinburgh council site offline late Wednesday afternoon; spokesperson: 'essential maintenance', 'waiting on an update from our provider'; link not confirmed. capture 20261022T112150Z · HTTP 200 · https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652- `headers.json` 1c3f67fd980359a0bfbaa40d100d35aea3cac3074d6b29d0a1753b16584a605a 1,536 bytes - `page.html` 90aaacae5232524ded421df348d5573c267ac8e950c4e48628bd8ed586c6aedd 262,633 bytes - `provenance.json` 25e30a911da3a7887aafc5080201b7d8bc5dc8508f1d3a7a2545b1c4d5963ee7 1,118 bytes - `rendered.html` e02581dcf2ba49c3963ed48490b34c813b9558ff27991256fc0f50231be75ac2 712,640 bytes - `screenshot.png` bb1c80d6965bbdc9c3143e0ff88f84de54ca8c9af02419c854993868a6452a05 2,399,966 bytes - `text.txt` fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6 8,754 bytes ### [Kamervragen over offline halen van overheidswebsites wegens PHP2Shell - Security.NL](security-nl-kamervragen/index.html) [original ↗](https://www.security.nl/posting/958558/Kamervragen+over+offline+halen+van+overheidswebsites+wegens+PHP2Shell) **Security.NL** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `security-nl-kamervragen` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Security.NL (Dutch): members of the Tweede Kamer asked Justice and Security minister van Weel questions about taking government websites offline over... capture 20261023T160435Z · HTTP 200 · https://www.security.nl/posting/958558/Kamervragen+over+offline+halen+van+overheidswebsites+wegens+PHP2Shell- `headers.json` 4d107d3dd5173a9c9d151632ca49ecdd8b9e07da296ed9e66654a32e564ba3c0 702 bytes - `page.html` 51174f6f099c2dd54eebb00885496dccc70e52fe65131aba42243838ada22887 129,717 bytes - `provenance.json` 3fad892523646e88d17ddc1dea9c70fc4e1a2bdeedf65f00b1dce8050ec463c5 1,709 bytes - `rendered.html` e81c7d4fbde3e05d6194610f42b9d9788585cca1b48ee5979f24c3047e2a7d92 128,856 bytes - `screenshot.jpg` 1786f1bdd2b07ed1b6dbc345c5ca95b0f937c90726a069b0871ac879c19bd641 929,859 bytes - `text.txt` d18184822cdd69f9eb08811366a5bda90e62a1ee40360b9392836db3b92c43e7 60,715 bytes ### [Pierluigi Paganini answers questions about the PHP2Shell flaws](securityaffairs-201662-hacking-pierluigi-paganini-answer/index.html) [original ↗](https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html) **Security Affairs** · news · secondary · captured · published 2026-10-24T18:58:38+00:00 · added by `curator@php.newsroom` · `securityaffairs-201662-hacking-pierluigi-paganini-answer` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Security Affairs, 24 October: Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks and the... capture 20261025T093507Z · HTTP 200 · https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html- `headers.json` 0972fb957930d8bc89841ab7dfd5cdb707e82f6915df1c628325e547af45cb88 1,271 bytes - `page.html` bc6a336b46da76735321b216c1ee1d4420ed78fbedfecd3766daa9248710f280 118,112 bytes - `provenance.json` 9883a90a228e8dd72d00ae82f9a49d12148ba4ded84af834284981fd03c0256d 1,817 bytes - `rendered.html` 6147b596bfa7cf408aa117d01f97c896be15c439d7b5d529729afa0b3c3bdea9 119,912 bytes - `screenshot.jpg` ea10f7c681e0d1c3e47de4b915ed3dc9c7d61a7bf8d81e3b880be44b765cf113 125,354 bytes - `text.txt` f9efb87ab0fdf675c849f17b9818a935cc473331439fd53942ec7854cd6ca6ad 9,786 bytes ### [Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online - Security.NL](securitynl-misbruik-gemeld/index.html) [original ↗](https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online) **Security.NL** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `securitynl-misbruik-gemeld` Promoted from the source watch (oq9gflln), snapshot 20261022T191411Z. "Abuse reported" headline that is attempts in the body; Previdian: attackers failed to execute PHP capture 20261022T191411Z · HTTP 200 · https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online- `headers.json` c37024d430f2b3fa5c95ea5683e5940449e88b7fd413a8b988d5b319ec8994cc 702 bytes - `page.html` cd6e2c2562a334ee538a1077307216c177a9519ccade2c2d0a9d40f148343ee7 74,522 bytes - `provenance.json` f78382e73afa9d49b87094527fd7370934f9a39f7e1272487b9d005ddc94f61d 1,719 bytes - `rendered.html` 5e59252be35ff9eaeb2d499c3533191bc9cdde4e6e5e5afcfc01a5578845d3b4 74,281 bytes - `screenshot.jpg` d5216b9d695d581b8a409a63a898b4f230cb56b9ba77ec1347bb252de5ffd0c2 947,395 bytes - `text.txt` 95d1565c5959e61fa188ea5af37ef0518b3c171d442554cbee86484dd03ddd09 22,446 bytes ### [PHP2Shell Exploitation Started Days Before Patches - SecurityWeek](securityweek-exploitation-days-before/index.html) [original ↗](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/) **SecurityWeek** · news · secondary · captured · published 2026-10-22 · added by `claude-story-site` · `securityweek-exploitation-days-before` Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks. capture 20261022T112314Z · HTTP 200 · https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/- `headers.json` 20346ce7a28ae2cea09c5ce445b478a4fe9837f2cc4cf97d5ae15a6bcd846d48 1,083 bytes - `page.html` d00e2e5608d37d978b2fa983ffa1087430976a445caa72df9a49b7618dbe9566 168,865 bytes - `provenance.json` 99114af56492dfd4921ca1b095bf85f256188ccd6d6e17fdaadd7657d629d83b 1,072 bytes - `rendered.html` e493b8fc733dacfc40164c4bb153884e96b82e984e2e3c738c13c536a5edce73 259,915 bytes - `screenshot.png` e5454077149da3ca0ea83a39c68e30ce9f6f984788c53349e104a0d45dea3fb9 2,097,665 bytes - `text.txt` ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c 13,376 bytes capture 20261023T012042Z · HTTP 200 · https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/- `headers.json` b01a0edd023e17c2f04a4913c33e56ac238c88c8e9485fb7626d944108450f84 1,154 bytes - `page.html` f647ac130d515c7b5c236e72825fe19525346633a458f5418dd0c7f086b1f105 168,791 bytes - `provenance.json` 9c39d001855e1787e2c3cca3b9f32ebd1eb7ed763fd137f8650e9e3a183e0d98 1,755 bytes - `rendered.html` dba965e893cc4ff6b487e9ba323d2d44187ec4dec5f54b7a12701b556e6c1f06 168,220 bytes - `screenshot.jpg` 9377de12373bc83afe1223d09bfd971c7e094cedf8d6ed2d183c3454b734a04e 745,141 bytes - `text.txt` b922b47f8fab0fa86af000c740795a67ad78d0d4cdc6a57a316408988acb5835 12,604 bytes capture 20261023T232528Z · HTTP 200 · https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/- `headers.json` a3950340c23973d8fa713fde8e45b57fdad16597cd3e4c15caffce4ed9ac2c89 1,348 bytes - `page.html` a33eb3fa95d02d124aadccb41bd5593400b53f0c220a6fefc3fed3cee5883808 168,695 bytes - `provenance.json` 88e631a105418e1339c970fd9cfc8fad0b897c58aa97535350ffaad3d1117d15 1,695 bytes - `text.txt` 9dfbfafa6b4a57d429b41f22ff482aa77766cf6bea32505f0edd54168adb4435 13,264 bytes ### [PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek](securityweek-first-attempts-sensors/index.html) [original ↗](https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/) **SecurityWeek** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `securityweek-first-attempts-sensors` Secondary: patches land; first exploitation attempts hit sensors. capture 20261022T112324Z · HTTP 200 · https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/- `headers.json` dd993a8f1006a3a64fb1decac73db56de8468b6aa2d213379f7b8925a27f83af 1,083 bytes - `page.html` 6d603d0aa60802788b1f163a27b575df0c62e1bb903bca9e6a3c98133e5d095c 169,487 bytes - `provenance.json` 2dca30a4387489ca9868c223790494256dc26503ee6b709a46643fa881c589e8 1,115 bytes - `rendered.html` f5cdb5755f0b1ab2a897933da2b213a674ccfa76931ab1a19ef6627b79408b15 261,102 bytes - `screenshot.png` f5f51f0db7037127107f38fdaa5cbdc77c6df0328ef92619061ceb4a76bfb575 2,236,355 bytes - `text.txt` b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41 13,245 bytes capture 20261023T160435Z · HTTP 200 · https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/- `headers.json` da6e36978588173199425c7098f5072fedba3ae1eb7cb61af08ef2a4b3eb2e6f 1,349 bytes - `page.html` 6cae7e52b173e57cb4b7b0402b411bd7e307aa280511a3e4b644ebb5e6911d5b 170,004 bytes - `provenance.json` a3483e71e341aa8163d8fc77e1a3a874ba316fdb8b29a8a8ec46cb72d03d499e 1,881 bytes - `rendered.html` a958e07b323981251b63f8c41027c69f9e7a3f38a21bbe0a5d195ee85e10f09a 169,734 bytes - `screenshot.jpg` a4a219aa9272cf0f28de6eb030272d13a43d4f2813cf5ccdefe50da15fba6a91 787,321 bytes - `text.txt` 7e1552c58d4b6cb44154eb8e322fde07d0ed92d7a91450941d6c79d417f92440 13,149 bytes ### [PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeek](securityweek-mass-exploitation-looms/index.html) [original ↗](https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/) **SecurityWeek** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `securityweek-mass-exploitation-looms` Pre-release: 'mass exploitation looms'; watchTowr and Huntress had not seen exploitation. capture 20261022T113111Z · HTTP 200 · https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/- `headers.json` bb347753d4feee250192fd7b5bdc50a5bd970acacdb2bbc50ff7ec8f02e421f5 1,083 bytes - `page.html` cee26b75f5542752d57c034b8a0eccf6b6227242d7619e33a91a35e8d3af8ebb 162,723 bytes - `provenance.json` f31a296260b932686cb33c7c964e56367479a31e090172999a0b6a20bfac343c 1,111 bytes - `rendered.html` a85f0c144d03bd751e0f5f14784fdfcb65809370f94510720b7abc2d66c06403 254,022 bytes - `screenshot.png` 65e2d5f0404ae070f6a43772ca24731d6e2b0a1125aac8132107060f194bc2d7 1,822,934 bytes - `text.txt` 693aa4300139d2afc431484c18fe038f9b0b2fb411a89b5defbdad622958e851 9,475 bytes capture 20261023T160435Z · HTTP 200 · https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/- `headers.json` d07cb8cbdf94965f4f3da38d31c3e8eb4d4ec8b5289a58d45b97a85370ffa0ee 1,332 bytes - `page.html` dc1cf5772ad9e42f303ab0e22885b7f84e9c4d3ad400ceb52b1fb77dba44d45a 163,084 bytes - `provenance.json` e13a97bd224cb86b0afc537599b080084d303a62dbfdda7df6105d979c1e180c 1,880 bytes - `rendered.html` a04c14343ca455a6fe20025ba4f4eff6ba4473572a8828d688e7569bdfc29da9 161,828 bytes - `screenshot.jpg` 1493059f9cee65ae994aa49e6861f1d4d5590cc2fe9a8fbc791e4cb752c0b0e7 543,279 bytes - `text.txt` 163bb31414d1edad48e1a2f3ea08d52bbc2f525787b4eecae3f2faed27c07c94 8,869 bytes ### [Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique](sentinelone-php2shell/index.html) [original ↗](https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/) **SentinelOne** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `sentinelone-php2shell` Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing). capture 20261022T113120Z · HTTP 200 · https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/#cq=i1- `headers.json` 652bccd3c7747978e637a6cf3ca0dd3adcb9d8d6dff7f6ea1e7529206dfc78b6 6,215 bytes - `page.html` aaf6dfa7fac00ac3a9150b9baee326803df94377bbae974995178f465292bf84 343,729 bytes - `provenance.json` 2a83e001a66dd0c777afe90a659023a49d81f93cd3c8310b6024faf644b74974 1,146 bytes - `rendered.html` d09c9b7551468ab7f7a69721a397eab5bb3d72b48ef9b756d0427a34c54bc0af 553,092 bytes - `screenshot.png` aeaf87bfa3d2dea7b44c00746ea38837ee3dbaf866640044a48d46125967360c 3,003,286 bytes - `text.txt` 0e75697fb5149ca627012455a8e06b03535c31e0c70e6ef87501d1beb7d39d69 24,686 bytes capture 20261023T160435Z · HTTP 200 · https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/- `headers.json` 863ff56cb29da4c1ade084e29b4a9018ee0a884182ea33b3b7f76b936e9c12f3 6,277 bytes - `page.html` c9af48dca9b4a268093289b9330ec9e5b332d8b01cb59fc55cacb27efd4cd6e5 343,960 bytes - `provenance.json` b7aae5eea5005c42df5442fdeb6d692d21a99cb0f5989e5644c59e9df02ed9ec 1,722 bytes - `text.txt` 6618dbfd02c809cf9a1b2dc95939d0713e202c9fd49f5c7bd895eb26457042f1 24,519 bytes ### [Google Advice On Taking Sites Down When Fixing PHP2Shell - The PHP Exploit](seroundtable-google-php2shell-42353-html/index.html) [original ↗](https://www.seroundtable.com/google-php2shell-42353.html) **Search Engine Roundtable** · news · secondary · captured · published 2026-10-21T11:35 (per the page) · added by `curator@php.newsroom` · `seroundtable-google-php2shell-42353-html` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Barry Schwartz: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 carry the fix; many sites were taken offline as a precaution; Google's John Mueller gave advice on taking... capture 20261023T080331Z · HTTP 200 · https://www.seroundtable.com/google-php2shell-42353.html- `headers.json` f50455e0f9952f10bc96711e1388fd73157cc021ce0c12a504a06a3b8d0eecd5 1,313 bytes - `page.html` 23fea89ce0c76bd8bd49b5bdf234b1a626477eb3db3c94f2e12c153f626fc96f 113,491 bytes - `provenance.json` 1f188a910843234d6da7fcf9fb9adb351cef951526ecf51083d2b62dc188e27f 1,485 bytes - `text.txt` ced33ac294361df1bd82380fede1bad604578ac5148f9ac7f71ba83ebabbb24e 4,938 bytes ### [PHP2Shell Exploited 4 Days Before Disclosure [2026]](shattered-php2shell-attacks-began-4-days-before-di/index.html) [original ↗](https://shattered.io/php2shell-attacks-began-4-days-before-disclosure-2026/) **shattered.io** · news · secondary · captured · published 2026-10-22T13:08:22+00:00 · added by `curator@php.newsroom` · `shattered-php2shell-attacks-began-4-days-before-di` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). shattered.io (English): a rewrite of The Register's 22 October report. Amazon Threat Intelligence spotted a PHP2Shell exploitation attempt on 17 Octob... capture 20261023T160435Z · HTTP 200 · https://shattered.io/php2shell-attacks-began-4-days-before-disclosure-2026/- `headers.json` 0581379715dbf96d91db230506953f5cb953437580223b59995cdddf27c7aca6 906 bytes - `page.html` 54a6f56103177b36ccb1627362f284d7c1caf3773e81d8b76c4abcf5c5f8f886 211,743 bytes - `provenance.json` 41b78ffcc200494abfa5f58f25edb1d066ea5730e4181169ce9695abce49043d 1,706 bytes - `rendered.html` c0b9eb91684c89eba77056b7369a845265dbc55fde2516539c8b176c3fb47f27 218,949 bytes - `screenshot.jpg` 9f769b80c5fe3638b6ced0ac4d586438e7a89f6aee03acfc94919dcf9cea5e8c 853,792 bytes - `text.txt` 24bf5e3a430544ca2706f89eab01e6e92aad96dfc014a1223346a265e1e42e28 26,442 bytes ### [PHP 취약점 발견, 전세계 해킹 '비상'…사이버위기 '주의'로 상향 capture 20261023T160435Z · HTTP 200 · https://www.shinailbo.co.kr/news/articleView.html?idxno=5074899- `headers.json` ca98e26b91f037e324257fa079278bc1f62faf63efcbed9a6f127e6a9cb66545 354 bytes - `page.html` 21a3b0997f27a72d34ad3b60a31995596acf89a391a69c72413d7b73069f579a 180,031 bytes - `provenance.json` 08278383418e1c213820fb95e1fe01cc907e49d9e700e73a6258ec81fa5dd4d8 1,680 bytes - `rendered.html` 3ad20030e239d467e9a07c36a5c4fc534697972f8e05605341434166b5e09173 232,174 bytes - `screenshot.jpg` 26369a1d866f79eda075ce7083eacaf41723a4727f65789693c7bbbeea5cdb05 551,885 bytes - `text.txt` 75bd3f1d6f44cd9018d0bed9c21a914bdfc192ff78a77dcae5f88a679556f10f 12,320 bytes ### [PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE](siliconangle-2026-10-22-php2shell-attacks-began-four/index.html) [original ↗](https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/) **SiliconANGLE** · news · secondary · captured · published 2026-10-22T23:27:27+00:00 · added by `curator@php.newsroom` · `siliconangle-2026-10-22-php2shell-attacks-began-four` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). SiliconANGLE, 22 October: Attackers began targeting the PHP2Shell vulnerabilities four days before the patches, Amazon disclosed, and exploit attempts... capture 20261023T160435Z · HTTP 200 · https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/- `headers.json` f679f363bdb6ceb4cbf592bbdaa119594435a71852cc91500bc2876a2e0cc066 692 bytes - `page.html` 93efa7ec542828a79d8323a9cd649fb2e6f0ebf0b1f33ef2db2d07f8688d0781 183,203 bytes - `provenance.json` 5a2eb385e610b58cadb52127dc58577ddf9aa4fc62465e1aeeda07c18d25fab0 1,721 bytes - `text.txt` bfad1c9512cf702bd764da66e5ce5bdc3e602ec3a8c87826b2ad7fc85bda6f77 9,686 bytes ### [Just a moment...](socket-blog-embargo-dispute/index.html) [original ↗](https://socket.dev/blog/php-embargo-dispute) **Socket** · news · secondary · blocked · published not stated · added by `claude-story-site` · `socket-blog-embargo-dispute` BLOCKED: Cloudflare bot challenge. capture 20261022T112047Z · HTTP 403 · https://socket.dev/blog/php-embargo-dispute- `headers.json` a80f2b5ad8ae81c3b83a000871a7819d186da9f1d450b3717ea39deb9bcacc71 1,990 bytes - `page.html` b8ac97a2a385dc96494c44b3886248703441a11d350a683a472b690ffe293803 6,187 bytes - `provenance.json` 8255345be61952af9d34d90c1a80520fcab5675c9c8ed3951c2aa93bdc5d64db 939 bytes - `rendered.html` 45f09ae7a4bb5f729e0b016d77de302dd1646fe819943e3054160f7bc5552cb1 28,771 bytes - `screenshot.png` 38b458f2d97ad16e0fe1fa55afc35614ff1c9d6704c168964e2d9c3c625be655 38,311 bytes - `text.txt` 2edb7b291225f9a58dd5ed7546e5c5ead9d84e0c92a9d78e93e06e030687646e 258 bytes capture 20261023T160435Z · HTTP 200 · https://socket.dev/blog/php-embargo-dispute- `headers.json` baea8c10ee7417b9d6581044628ab5d5bd8ffb728f6337222ea3c20b90220ce1 5,394 bytes - `page.html` 01eb6c37dae7a7eda46afaae385660f01e7af2a754b9e53891ef942907561310 339,187 bytes - `provenance.json` 070d1aa24a28f016f7f8a2558d86cd424f274fee7040432d34c2a9120260107d 1,747 bytes - `rendered.html` eb511176c44e9b76fa3fe4c694e590706b4e5924e2d686fc9eeee3d976ce2fc0 338,513 bytes - `screenshot.jpg` 4eb3231603ef76ee3bd37b0b1f2c48ed3f40229f90f85c515a048b476632f8e4 667,670 bytes - `text.txt` c13e57baa3387cf5943c258a1c7de3c28dc015692d81ea03f9bb260eb2a081e7 10,562 bytes ### [PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix](socradar-blog-php2shell/index.html) [original ↗](https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/) **SOCRadar** · news · secondary · captured · published 2026-10-21T13:38:58+03:00 · added by `curator@php.newsroom` · `socradar-blog-php2shell` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). SOCRadar blog, 21 October: PHP2Shell (CVE-2026-109618 and CVE-2026-109619), critical PHP RCE flaws, with affected versions and how to fix them. A long... capture 20261023T160435Z · HTTP 200 · https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/- `headers.json` 09eba8417ddea4703689bb42e31c614aece5a2fb35a0f23fa0c803fb66951a44 1,589 bytes - `page.html` 98bc01963dcce2e927d6c4e0eb5eaf4c288ce2f03e7b8739e2151559a948d559 277,344 bytes - `provenance.json` 94b85489793072435a5663eba6c4f62860713790b611b35d300c7b7e47984a3f 1,613 bytes - `rendered.html` 0285c3fc043540fec66f56ce7b604e96399b55e6eb400041bb7248d6575a993d 299,254 bytes - `screenshot.jpg` 5cc1bba339f9504fd439a309f782370650d1f79850c1790f509d3c811d13830a 833,962 bytes - `text.txt` 88edcdf127e01f96370214c807432bd24ffb506f250d1f9f1c38df6abd6b1083 30,240 bytes ### [The Patch Is the Exploit - by David Lopez-Kurtz](substack-lopezkurtz-patch-is-the-exploit/index.html) [original ↗](https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit) **David Lopez-Kurtz (Substack)** · other · secondary · captured · published 2026-10 · added by `claude-story-site` · `substack-lopezkurtz-patch-is-the-exploit` Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding. capture 20261022T113134Z · HTTP 200 · https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit- `headers.json` 93831a587e5a9a37a455a49bb5bc1a735ffddbaa9462baecf8483bd621dc0d80 3,448 bytes - `page.html` 77bae2f3d20efe5af0c1bf780b1c2618202d3da7941792444a8fbfed1d4a87f5 224,610 bytes - `provenance.json` b49aa2b0f632867066da181f78cf57cd3495f0c1c9c7c7634875a04c5f86b5ff 1,023 bytes - `rendered.html` 5a9958401f0de8caa87154eb38d082ae37fe969fe4928862d4e557f4bac4ba1e 263,845 bytes - `screenshot.png` 4f94dc2329c6fd545b1a600cccfc7b2ce2db41deb2b8288403a9eec27e63dd56 3,979,940 bytes - `text.txt` cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330 33,564 bytes capture 20261025T070559Z · HTTP 200 · https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit- `headers.json` 291a03786f22e9ef3f0fbfcf09b0a35dcb8e7c85a0b9810e8f656c73de87d5e5 3,505 bytes - `page.html` 36e4a823e30df237f0260fda544fb6e93b88ad7e498b73fec5981bf313269661 226,138 bytes - `provenance.json` 2ae8be0697b36b3c625f6d55cf48465f7b16d2774caf6f062dd9050f7a7d7f7e 1,798 bytes - `rendered.html` bab69619a3ab52770596118198b3dd28a8dc00ef00cb13bb268e604859efd40d 263,962 bytes - `screenshot.jpg` a72392a29cacaabbb3774c72bcb58fec9b366695dbfe21c9296515f2fbbb3f9a 931,783 bytes - `text.txt` ed681f55311835a718a1de42b7d825e0e266eacdea83474879bd56f7d5d27483 33,564 bytes ### [Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities](sunderlandecho-must-read-astra-security-launches-free-t/index.html) [original ↗](https://www.sunderlandecho.com/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867) **Sunderland Echo** · news · secondary · captured · published 2026-10-23T14:57:09.000Z · added by `curator@php.newsroom` · `sunderlandecho-must-read-astra-security-launches-free-t` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Sunderland Echo, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tools to as... capture 20261023T232528Z · HTTP 200 · https://www.sunderlandecho.com/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867- `headers.json` 647c2769b31045a17b4e690d3a63407d8cb9c5b359a391f39062278241bbc709 1,669 bytes - `page.html` 68fe70bf49beb5e6b1fbb4e7e7e26bad7c8dab2326ecaa1ede51a7649e955425 228,866 bytes - `provenance.json` 6de020130f207d63bb9d714ecbb24849547e9d3f7e69c9a432ff24af90cb69d8 1,903 bytes - `rendered.html` e90d71907d7799d5723f7be2e6fc42db33f2910f3c7da44f9ea00e371d33b10b 236,536 bytes - `screenshot.jpg` c2700e329487424096dfb8fe2627cada1f0cb096ee2469fcdfffdcfb82d003b0 346,095 bytes - `text.txt` 899ed0de261ef42b0a4c93e076df0c61a09c813ed7517f65345520fbb227c871 6,606 bytes ### [Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities](sussexexpress-must-read-astra-security-launches-free-t/index.html) [original ↗](https://www.sussexexpress.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867) **SussexWorld** · news · secondary · captured · published 2026-10-23T14:57:09.000Z · added by `curator@php.newsroom` · `sussexexpress-must-read-astra-security-launches-free-t` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). SussexWorld, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tools to assess... capture 20261023T232528Z · HTTP 200 · https://www.sussexexpress.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867- `headers.json` a2d71c2eb9a377e7d8dccd52cd6ad9afda67e37505a5cb51aa9190aeff8e3eba 1,678 bytes - `page.html` 952da7d44dd1a57977dc7a743d42a81129f060fc02100244731139088d9fd0f5 235,514 bytes - `provenance.json` 6c31e3a50e43716e01668de84c9ca96e8b991a4304f4beeea1094fa7fe1220a8 1,902 bytes - `rendered.html` 569b02a4db12b29f26ebe7f4d4d900a8c5b01c4ecd7d842a77491ceedb4f9463 233,215 bytes - `screenshot.jpg` 60b532b4492a6cd660c4b2d736f984c57aa386e68501c7b1cfac87505fd3aee8 332,279 bytes - `text.txt` ac79f3e2e45506267ca21a78b4605c28d3c8f8fc6727064d2ea760a5b70277e4 5,455 bytes ### [Sicherheitslücke: „Millionen“ Hacker-Versuche: Viele Webseiten noch offline](tagesspiegel-dpa-noch-offline/index.html) [original ↗](https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-millionen-hacker-versuche-viele-webseiten-noch-offline-16186782.html) **tagesspiegel.de** · news · secondary · captured · published not stated · added by `collector-news` · `tagesspiegel-dpa-noch-offline` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081509Z · HTTP 200 · https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-millionen-hacker-versuche-viele-webseiten-noch-offline-16186782.html- `headers.json` 86ad8f46f4091f6f34bd73d9618834a0d24ae6b34d21aff82c63dddd22685989 2,206 bytes - `page.html` 964ba8f9a0f47fa611d089cc83f40fdc86ece4c050c602c0dc4661e681cfe8e0 427,516 bytes - `provenance.json` 930f043564eecbeff95506cb2928c7e186e06d30a7ce31a08ac09d6d78701805 1,193 bytes - `rendered.html` a85f172a5b4be987ce218fb4e2a01b1db2301e6d9daa9c09735d00f16245c082 395,185 bytes - `screenshot.png` 9716d20f18ff56bd31a88188f81e8a38aef651c6e4bedbe0e81f190dfba22755 740,028 bytes - `text.txt` 0255857572a7411c4f2c88bf5ff7fd00a0bcb89cfca6f84234f0a55999ff3c79 5,013 bytes capture 20261023T160435Z · HTTP 200 · https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-im-internet-millionen-hacker-versuche-viele-webseiten-wieder-online-16186782.html- `headers.json` dfd49341c2968ad18ba184e17d83f30476f2704e4673342c830633888ace52b3 2,208 bytes - `page.html` ca26c4db6077b3188713d4b0fec01f620f4b60fba9a1e37eb245b1f338d69833 433,423 bytes - `provenance.json` 533fae58738885c6be06dd2a20b3b751785f9b4074a85b3a4f35de994555f4a7 1,806 bytes - `text.txt` 03282d093de71a4ff4f9d4aea3458d633a827a6db3f1902424e55887053e4aa2 6,910 bytes ### [日本政府全力應對「PHP」漏洞 通過SNS廣泛提醒注意](tchina-kyodonews-articles-15266/index.html) [original ↗](https://tchina.kyodonews.net/articles/-/15266) **共同網** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `tchina-kyodonews-articles-15266` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in zh: Kyodo (Chinese edition): the Japanese government is coordinating its PHP response through the National Cybersecurity Office (NCO). The NCO posted on X on 21 Oct and advised temporarily stopping websites that cannot be pa capture 20261022T181608Z · HTTP 200 · https://tchina.kyodonews.net/articles/-/15266- `headers.json` 41b14dbd6bfd7cae983a3c789bb5fcc6bb1b7fde60d2a962ccc64dd2d3b9abf5 629 bytes - `page.html` 0992c7a3d2e34db52eba96c7ccd42dd28971bb55794a61bfb7fa80da9b059ebf 41,675 bytes - `provenance.json` dd348f2f793e79fab81b7510d109d933794bb63abcf9d7b3861abb7157af9300 1,577 bytes - `rendered.html` 05a6b62c1ba5b3b6ed8aa822340563f5400ac6b220527930f64e1437ca0593a8 145,362 bytes - `screenshot.jpg` 0221e66ed7476307936a6f062a8747fb6dc8c022648172564a8333d513ea7306 259,279 bytes - `text.txt` f638db697df7eced152a6cc515ffdad78ae8f0ae06c827284e7f40cc04652173 4,377 bytes ### [Vulnerabilità PHP: il 70% dei siti al mondo è stato a rischio per più di 10 anni!](tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo/index.html) [original ↗](https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html) **Everyeye Tech** · news · secondary · captured · published 2026-10-23T08:30:00+02:00 · added by `curator@php.newsroom` · `tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Everyeye Tech (Italian), 23 October: the headline says 70% of the world's websites were at risk for more than 10 years. The patches fix two vulnerabil... capture 20261023T160435Z · HTTP 200 · https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html- `headers.json` 1033588b0b0979cac12fb3b7abe3eb031cb53ef0a6b5b318fcb11415ef4b55b4 782 bytes - `page.html` c12e14252ec4e468f220422f9b5516d5b5716fac875a8b1fd725e0632a551cdd 57,672 bytes - `provenance.json` 961a1a318348cf1b33331123399d361f6921794b2a637d72f6e36f99c5698c48 1,796 bytes - `rendered.html` 1c5653d11e5fcbaf7c8f18b03fc3164e3db2062d2c04486bf109127875386a6d 85,546 bytes - `screenshot.jpg` 9dc5ba083ccb0610474a46e753440046e7dd335e30555aa41ee8d811ad5b4603 654,979 bytes - `text.txt` e7a5a2d24c7eb2aa38181b0292f6a2cc695ad4388ed7ca476335140c75cab18d 6,765 bytes ### [PHP2Shell: The Emergency PHP Patch Is Out](techaeris-2026-10-21-php2shell-the-emergency-php-p/index.html) [original ↗](https://techaeris.com/2026/10/21/php2shell-the-emergency-php-patch-is-out/) **Techaeris** · news · secondary · captured · published 2026-10-21T09:14:26-05:00 · added by `curator@php.newsroom` · `techaeris-2026-10-21-php2shell-the-emergency-php-p` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Techaeris, 21 October: the emergency PHP patch is out and the real race starts now. The PHP security team released fixes on Wednesday 21 October 2026... capture 20261023T160435Z · HTTP 200 · https://techaeris.com/2026/10/21/php2shell-the-emergency-php-patch-is-out/- `headers.json` 1aa31bc55521f931aa20a3b25c90991f330d67d3726196eab7de3d203ae5b7e0 1,209 bytes - `page.html` 3fc752e21ee0a92ffaae10a2a2f468f2d31b644915d6eabc17aafa477ad2796f 352,309 bytes - `provenance.json` b14a9b3075404e6aa1b4023af75ab7ec5b104913a37b89caa5df44864869e63d 1,540 bytes - `text.txt` 2dfe83a6dd42414c846217e91064fd836dfe85eb7c240ca3802b954d18acab5f 12,022 bytes ### [PHP2Shell: 22M exposed servers at risk as emergency patches released | TechTarget](techtarget-cybersecurity-news-366652444-php2shell-2/index.html) [original ↗](https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released) **TechTarget** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `techtarget-cybersecurity-news-366652444-php2shell-2` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). TechTarget, a news piece: 'PHP2Shell: 22M exposed servers at risk as emergency patches released'. AI gave defenders a head start, but PHP2Shell has sp... capture 20261023T232528Z · HTTP 200 · https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released- `headers.json` 01b64580a78bd6540f2ba577f1a39e1318d39cf99fec060470103c09bfaa6f39 649 bytes - `page.html` 2e80afaab63864d63fd5576bd930374708a7de19ed8bee095cda4dc0e50ff767 326,708 bytes - `provenance.json` cadb807c3d21b086488c4d7dfcf4106f13650a2208d98431782cc2bad6b74e85 1,848 bytes - `rendered.html` 4655866500679d77a40877f6232299c59a16bc4ee291b4d53977558b287107cc 346,405 bytes - `screenshot.jpg` ac949048de5339dd9f680d5732f3d4d46568b85ca2993b2b9dd3eca1397083b4 563,841 bytes - `text.txt` 9c9a0459deeccb0d0f8702c4727cedf98afe67f8151d093511d9fd341ae175e2 8,195 bytes ### [PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget](techtarget-disclosure-unravels/index.html) [original ↗](https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop) **TechTarget** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `techtarget-disclosure-unravels` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "hard vulnerabil... capture 20261023T012042Z · HTTP 200 · https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop- `headers.json` 87d33c4caf1882ea5e9811dcd54795674e0daed96eda7777f7747cbeee38db5a 649 bytes - `page.html` 0223170b84edc3cf77a3901e446e8f957010d65649c750657d38ee5bf934a171 328,498 bytes - `provenance.json` 69ff5c6742e78f811ceeedfb7649bef62e0bd8b0e55f6aa02961068734c0df60 1,749 bytes - `rendered.html` 0fc25e764308756339016f1356395c2d0c9df502cb917185f4a3f0c7740568cf 353,658 bytes - `screenshot.jpg` bb1a9c86e83b49f116612264096508106615025ce4df63205f5f31aaa75c0d6a 729,081 bytes - `text.txt` c186055de6bb1abc70e426281fe382563363ff7b1fe80ba32542b4b9a45f9374 10,677 bytes ### [PHP脆弱性「PHP2Shell」で2260万件に影響 情シスの緊急チェックリスト：OpenAIモデルが暴いた脆弱性 - TechTargetジャパン](techtarget-itmedia-tt-article-2610-23-2000002526/index.html) [original ↗](https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/) **TechTargetジャパン** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `techtarget-itmedia-tt-article-2610-23-2000002526` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). TechTarget Japan (Japanese): the headline says the PHP2Shell vulnerability affects 22.6 million and gives an urgent checklist for IT staff; the lead s... capture 20261023T160435Z · HTTP 200 · https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/- `headers.json` 1ed00bf9510a28811029c3773c98ef4917dc6ae3376546f9ee49eeefdf791094 870 bytes - `page.html` 1498ca3c19557d38005bc06db2069e1561066b51714b0d2154695008912616bc 132,446 bytes - `provenance.json` ec02390651f5159484927d2430d0edeab353f6f7320e822b78e7370d8e935e5d 1,753 bytes - `rendered.html` 1df30985b49b1cb8309a37f9516a902205855509ba3cd2f2622cd72c65234984 162,276 bytes - `screenshot.jpg` 5917450e22e610727faa5390c93e7e7903e92d75d6a8b1d8c676bcf6e8cb7d2e 530,090 bytes - `text.txt` 14c421632d9592d8a6b0b2bef1f45af7363175b91bd978cc453d73de9b51dbdb 9,486 bytes ### [PHP accuses Chainguard in PHP2shell](techzine-php-chainguard/index.html) [original ↗](https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/) **Techzine Global** · news · secondary · blocked · published not stated · added by `collector-researchers` · `techzine-php-chainguard` Cloudflare challenge (HTTP 403) at 2026-10-22T08:13Z; 403 capture folder kept. Per search snippet: Chainguard CEO Dan Lorenc does not dispute timeline but denies leaking. Unverified until captured. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. capture 20261022T081301Z · HTTP 403 · https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1- `headers.json` e4c1c978fae1d476008a0220bd56d79c287115d6dca754076ac5c220c8403209 1,084 bytes - `page.html` f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd 103 bytes - `provenance.json` 0b93d24048c39675ef0bec6c63cbadc201cd4c761b3fd85f96538ec7afa93ea9 1,084 bytes - `rendered.html` 8631afb05e141985b74d3ac4fc67eca679d940e50dcd377593b0a5faf473e4a8 29,118 bytes - `screenshot.png` 83e27bf325b865db2d303c7c20ec30a0a5c0b452145b2b48175a74d4b292d20f 38,816 bytes - `text.txt` a709538005b7efca9f1059e2eeaa4a13cd196d9f8215befc91b286d42f56d334 263 bytes capture 20261022T112124Z · HTTP 403 · https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1- `headers.json` 5345616d7653c07e708bb2b1f5f0b9fe2afefd06cca4a63dc7bb7fee0684222a 1,080 bytes - `page.html` f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd 103 bytes - `provenance.json` 8870e433407b07164f7f83ef420dd5307c6c1c525544cc382a43dd9da569c4ac 1,084 bytes - `rendered.html` f9d1600dea692ee1e52186d55f0ac9eee1a19f909c76aec8fa9b5ef26f1278bb 29,118 bytes - `screenshot.png` 6127fef1895a985b7bcd7168fff19347a8ca8f67cfc409d39a802caebc1fce9c 38,923 bytes - `text.txt` 93f61d068317f6ef84245b70a7d8b8ea0f4b1d351af10fc89a31cbe4ae7eb1da 263 bytes ### [Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias](tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell/index.html) [original ↗](https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/) **SAPO Tek** · news · secondary · captured · published 2026-10-22T07:50:00+00:00 · added by `curator@php.newsroom` · `tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP serv capture 20261022T181608Z · HTTP 200 · https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/- `headers.json` 121c973fd73d36bc65dfc31653a2ff19422a7b8e25d1f328f86411b7d8c3c77d 1,738 bytes - `page.html` 8d41c37fca5cebfd108617002fc0317fffc002ca8c41b3b9a66fb17c2c45ba89 353,947 bytes - `provenance.json` 5f6cbedc7a1d7e479d21d57a1c6ac4dff7f7f572029fd0e0f56a7405c4ba6e25 1,778 bytes - `rendered.html` 72eded33521a415c81fd37e27d2afe80e2d4e2c4c14c08faad6584dbb4c0a2fc 373,282 bytes - `screenshot.jpg` 83bdcf2750a1108c7ef489988c10baeed1011c19c18e79b17e3a7e86acf6e14d 902,271 bytes - `text.txt` 7203d6e735dd3989c864ca946af9c9743d051148d4c016d9fc4c0af587b4023a 18,453 bytes ### [PHP2Shell Crisis: 2 Critical Flaws Put 70% of Websites at Risk - teleSUR English](telesurenglish-php2shell-vulnerabilities/index.html) [original ↗](https://www.telesurenglish.net/php2shell-vulnerabilities/) **teleSUR English** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `telesurenglish-php2shell-vulnerabilities` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). teleSUR English: PHP2Shell crisis, two critical flaws put 70% of websites at risk. The PHP Foundation released emergency patches after technical detai... capture 20261025T093507Z · HTTP 200 · https://www.telesurenglish.net/php2shell-vulnerabilities/- `headers.json` b5bf418e8f7a4753c95a7dff0c621d50fefa528d2c448c86d4b43a724f1f2079 1,227 bytes - `page.html` fe0ddb6162ea441d8bf8609df7299ee43107fb5547abbf44fa8f4d35f209fdd4 266,548 bytes - `provenance.json` 8ca9e8a35a23c6de03bc7d7b441ecd379f1c8426a215bab2ee0b2039341966a6 1,641 bytes - `rendered.html` 6532d8704935b744e94a431c096d257cf9da6d09d578f250dcd5bfae0024b894 533,492 bytes - `screenshot.jpg` 0c5395be653ab916048e1c2878f0e8f0480025192a61beff28e1f5fd3b9a6412 910,018 bytes - `text.txt` 6efd752b24f540730043417e4f8e1837289ad08b2351a62e22a4bc2bdc3e8ad6 13,719 bytes ### [php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®](tenable-php2shell-faq/index.html) [original ↗](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) **Tenable** · vendor · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `tenable-php2shell-faq` Vendor FAQ; notes Cloudflare's rules cover only traffic routed through Cloudflare. capture 20261022T112331Z · HTTP 200 · https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote- `headers.json` 5ddfb8ebd67d5b056190eb932bd7230be55b6dcec36b71da7591e9ff3ef787e9 1,390 bytes - `page.html` 0f90e53e8a45f385d5e14f7493f1aa99aff8d34b7405ed43d70a3534381dd264 274,325 bytes - `provenance.json` f1f23ada9af900931c49744b7cb544a8b730ec5038bd6637c3a3b521f095c4d6 1,155 bytes - `rendered.html` bbc941dd99bd25fbb24457889bb89c0cd2213187cc104c491b15a86ad1167425 469,247 bytes - `screenshot.png` fb42572ffc60b269206740e6d85216b9fa06d7226bfb49682d148b44740c897c 2,222,099 bytes - `text.txt` 10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54 16,528 bytes capture 20261023T080331Z · HTTP 200 · https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote- `headers.json` 1d02381084191d6534f0983e1c7a9f34065d722a633b924b9d5f4ab911f53790 1,459 bytes - `page.html` c231dd15491a108f1ace260f414fb4d60d4f4d42763f7c4aa7813c8a7170de79 273,785 bytes - `provenance.json` c31c494b31128bda6983281792f57d8f98477983b9afa9810176bfa94e7a74d4 1,875 bytes - `rendered.html` d755e9f15fdceebffb5e603cca452d77d6a11085e45d792a961c59602842ff85 463,959 bytes - `screenshot.jpg` fd220e0c7ad0bd16ea40637a14d213d69ed25dbf59b1729c084677c6c15697fb 712,844 bytes - `text.txt` 7cc4ddb02c3fbb29a56167a1dd773f3166ea426fed07f8ce4ca27c3b95497359 15,649 bytes ### [Millions of PHP2Shell attempts so far, but officials see no break-in](the-next-web-php2shell-no-confirmed-breaches/index.html) [original ↗](https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches) **The Next Web** · news · secondary · captured · published 2026-10-22T13:03:23+00:00 · added by `curator@php.newsroom` · `the-next-web-php2shell-no-confirmed-breaches` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). The Next Web, 22 October: millions of PHP2Shell attempts so far, but officials see no break-in. Cloudflare's chief executive, Matthew Prince, said on... capture 20261024T083755Z · HTTP 200 · https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches- `headers.json` e6d8d4adb500bd8557202df5e2ea5efa0d422e74d385a5e8bbfbada2dc2f9ede 6,339 bytes - `page.html` c51dfb0561b1bdb2cd0a5691a16ffc394908928d2deab03e90047ca1b6311bdb 187,527 bytes - `provenance.json` a0b248b887c69f899d2340dd7db5144b7abcc3350ea0ea1e7b86f45cd08ee9a0 1,561 bytes - `text.txt` 75d67773b979aa86ec9f32e1690fa2d13b8d5905d6cfac239cfcd9331d8c17dc 5,405 bytes ### [Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure](the-register-hackers-pile-on-php2shell/index.html) [original ↗](https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749) **The Register** · news · secondary · captured · published 2026-10-22T12:15Z (page metadata) · added by `curator@php.newsroom` · `the-register-hackers-pile-on-php2shell` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Hadrian "exploit... capture 20261023T012042Z · HTTP 200 · https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749- `headers.json` 3cfdc7a18e4e95df52e618a5577820ba9581c24d8855b4d3aecd33ff83bcc675 681 bytes - `page.html` 148ef10bfbb853f07c9a557ad0fcdcc0e9f426031b2db8b35ef02eb74e388e48 177,151 bytes - `provenance.json` 1ec8e239956f02724e1a998759c4233e281a4bec4a595c22bba308b9d01a7171 1,787 bytes - `rendered.html` 38861fc6b57607a8dfa8f014cad3832159f9b54efa5f873ba6a8fc63016cfe23 191,595 bytes - `screenshot.jpg` 770a3106cd4f7fc29127787f5dd14f505c0c3919890e7ed4466f4e5ab5a8e3b6 717,098 bytes - `text.txt` 84de32feb23a6eb85ee2770c86b383a8219f0adcf22756f9b38c00a680f09a13 9,167 bytes ### [Everything we know so far about the PHP2Shell vulnerability | The Verge](the-verge-php2shell-websites-down/index.html) [original ↗](https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down) **The Verge** · news-live · secondary · captured · published 2026-10-22T15:12:27Z (modified 16:49:48Z, per the page's metadata) · added by `curator@php.newsroom` · `the-verge-php2shell-websites-down` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation E... capture 20261023T012042Z · HTTP 200 · https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down- `headers.json` 72488aee5271c869c30dbc34fd1f73be05596b76500d2d7c01afbd7b5b326334 1,261 bytes - `page.html` f55d379b157610b1272175bd8026288fe5bac8641b3baaf66e69bb6ebf9a784f 270,997 bytes - `provenance.json` f1547601bdcc8989fbbe161f438dfc162581a8ba708a13b4d8ece17d4f022eff 1,677 bytes - `rendered.html` 4dce1bbf4c543244209fdb9ff0730f6ddf7ed9b7e83ef7a59372e028ca555129 464,122 bytes - `screenshot.jpg` 8b53a0fc3da806d09328a78fdf251eea67a748f0ac8bda9783fafee8fa05603a 591,159 bytes - `text.txt` 1a9a20537e477cc84bdd688c3d13f165e980a7bae0aa54bd2f88011d32d3b3d3 8,601 bytes ### [PHP2Shell Alert: Two Critical 9.2-Rated Flaws Put PHP Servers on High Alert - The420.in](the420-php2shell-critical-vulnerabilities-cve-2/index.html) [original ↗](https://the420.in/php2shell-critical-vulnerabilities-cve-2026-109618-cve-2026-109619/) **The420.in** · news · secondary · captured · published 2026-10-23T05:47:10+00:00 · added by `curator@php.newsroom` · `the420-php2shell-critical-vulnerabilities-cve-2` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). The420.in, 23 October: two critical 9.2-rated flaws put PHP servers on high alert. The updates were scheduled for 21 October at 14:00 UTC; the page no... capture 20261023T160435Z · HTTP 200 · https://the420.in/php2shell-critical-vulnerabilities-cve-2026-109618-cve-2026-109619/- `headers.json` 9842e6aa0dbf52c52bbb8cc3fdf5e7e0a1101470b98c5d8f0995b012c162c394 908 bytes - `page.html` 41a9edaa576abcb3c6d76cd4681335e3db644cef861940d3ac1369cbe391df75 127,752 bytes - `provenance.json` f059b1b3cd2ba2598603cdaaf6b860b641e1c41774abf92c1da3aa5635b2f7d2 1,763 bytes - `rendered.html` 48f4d57b1e323d8cd251901d6cca64e42b9ca544eab33a8d07599e56f813f7e5 142,903 bytes - `screenshot.jpg` 6dd31a1080ee573994d0b65a949239ba6e1f01b2d1a68320efef20e8a8c74f47 629,801 bytes - `text.txt` b04078d220da16a820c7c3fff6b6b572df24270cefc82538612e11d4de7a8166 9,089 bytes ### [Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed](thehackernews-php2shell-4days/index.html) [original ↗](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html) **The Hacker News (Ravie Lakshmanan)** · news · secondary · captured · published 2026-10-22 · added by `collector-researchers` · `thehackernews-php2shell-4days` Dated Oct 22, 2026. Quotes Amazon CISO CJ Moses ('post shared with The Hacker News'): MadPot honeypot exploit attempt Oct 17 2026 from anonymization network IP geolocated to Australia; PoC attempts from ~02:00 UTC Oct 21. Says 'details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time' — contrast PHP Foundation 'No technical details leaked'. VulnCheck: PHP on 2,608,039 internet-facing hosts. capture 20261022T081320Z · HTTP 200 · https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html- `headers.json` 54c094189f50f4afa3962d0e484ef93cf0f92bd1fefb71ae2fec7e63b71b3b14 783 bytes - `page.html` b2b51b3736eab8ebf9fb584770654a563ec0cde9a258c8ccc9b2cac5e2759495 181,180 bytes - `provenance.json` ef03914e372ab683b87cf258b84ec703ba5cc140e8b724fe1fa547d0f7a066fe 1,081 bytes - `rendered.html` a7caeb00fddc406d6dcfeb68c7fdce453fdb39446eb83daa364cb3f2986a7834 176,478 bytes - `screenshot.png` 71b28408de124895b1534822f79eff33a445be5296c09203d51f152ef67d089c 2,255,956 bytes - `text.txt` c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4 12,295 bytes capture 20261023T160435Z · HTTP 200 · https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html- `headers.json` 421a40b8b01bedb96dc2f965ab732985b9acdfe566cb1046ac4522f6b5ce82a7 854 bytes - `page.html` ef230d20b5059df376ebaca22a0031d7d1cb8b1bde9736da35073b93c319a3d7 186,319 bytes - `provenance.json` 30680a19ac8a0b6c34a81631234187928f82c134b8a42f79dc7534efcd056463 1,839 bytes - `rendered.html` 1426a64bb1181ef901405314bec3c221608a0d215a92c84dedf3b88febfc4896 183,052 bytes - `screenshot.jpg` 139266d86df524fb02573a64129c85fa1e62866024c1aad8ffae1af2f86ae158 742,596 bytes - `text.txt` 0c31fcebda310760b15f83418566d5bd2e63ebaffa0b93669443fb6f970efe31 12,859 bytes ### [PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert](thehackernews-php2shell-unpatched-alert/index.html) [original ↗](https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html) **The Hacker News** · news · secondary · captured · published 2026-10-20 · added by `claude-story-site` · `thehackernews-php2shell-unpatched-alert` Pre-release coverage of the two unpatched flaws. capture 20261022T113144Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html- `headers.json` 504e60a31ad0c0649db5fe4d0560bcb64bcea39e2c5d8b374dd60c86235937fb 783 bytes - `page.html` b8297488c796fba8c0c46fbb558121433294b8f8991c457777efa33409b6634e 175,875 bytes - `provenance.json` 3eccd35b7d04ded29ea8937c2d7870a8be4adac2340d632f92f01cfe630c3147 1,090 bytes - `rendered.html` e34515d9ce5113ec57194450be97a765341affcc8cae816dd5a475c8d200873c 171,094 bytes - `screenshot.png` 1686d34457b358c5f9a1950a0da921ac4d765a0491953e9383a70b1498568c29 2,281,720 bytes - `text.txt` 33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b 10,078 bytes capture 20261023T160435Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html- `headers.json` d78c94137a0e92fbbf0e7183aa102252377215b5c2ea8c1376a7c1e5a0ac01af 853 bytes - `page.html` 5cda48a2a38c28e613f475c02a5e043468526043de9e64d7da8e881940d9dc0d 175,811 bytes - `provenance.json` 2e335ba1f28d24aa170686d6db00688fb4c984b8b6f610cc4834b61f2a81c804 1,878 bytes - `rendered.html` 208b58c48b4c5486c4f4282b9870d5d0d666d76c0506a64051a25d6d6c9e2a1f 170,442 bytes - `screenshot.jpg` 5bd727d03b84a7d4ff60f97edb1cd772106c66edc82cd6044af820f1135ab4e8 581,215 bytes - `text.txt` 2ada6ad9a37f82d308e5d324ffc263ec5fb071349cc059b76699b1c07896ce81 9,243 bytes ### [PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't](thehackernews-what-protects-you/index.html) [original ↗](https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html) **The Hacker News** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `thehackernews-what-protects-you` What protects before the 14:00 UTC patch; no compromise confirmed; public exploit code not shown to work; not in KEV. capture 20261022T113151Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html- `headers.json` 1d0e37d8f272c2035915a1e3bae5d055fd9d8a9dac4b60116725e2af378e7d7a 783 bytes - `page.html` c3d4ade9c8b6af04990a2ee26114a8665f943ed5142ae7348e38ef3b23d34ab9 180,675 bytes - `provenance.json` b3b2d8123bee4172bcdb4453abeb515d86f34dd658088159147c1b0b944661d2 1,081 bytes - `rendered.html` 64ef5d20df0ea8dfc700220c350757cc455bcfc017751142819841c35e11ff9c 179,165 bytes - `screenshot.png` e0e1a25547dc8d319ff4071cceff2950d36aa030ec7f2ab1625d04018d2e39cc 3,022,943 bytes - `text.txt` 2301d254784fd6612f36f844e16a706e2e7ca5f8d8f942f7f36544c59d78d82c 13,774 bytes capture 20261023T160435Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html- `headers.json` 6fe8d9a594d87cf3b4e9bff6ba69087b72b6caae8189f7c963459900dbfc9457 854 bytes - `page.html` ac78fa7d842fd9a45c9ce0e37f6d967597b33523f67008ec1a947a71d1d32453 180,622 bytes - `provenance.json` 6331f3ea1bddda7045300126dcf0e02e399cc9f23e0ac6a8473ecacb20cd0104 1,845 bytes - `rendered.html` 77fb59d32cd5b8d132a7f9909e2798408b7410faee4448752b405a9138704474 182,039 bytes - `screenshot.jpg` ea9238fdc90aa3a11701eb1c2d3bd19ccc41d5917ff3a02836b83f7c17345990 737,255 bytes - `text.txt` 0a3177145305ec7cb2ab8689aea2d0b8a71f695571ed483cf9374df75c18f191 13,743 bytes ### [ASD rushes out ‘critical’ alert on unpatched PHP vulnerability](themandarin-322640-asd-rushes-out-critical-alert-on-unpatched-php-vulner/index.html) [original ↗](https://www.themandarin.com.au/322640-asd-rushes-out-critical-alert-on-unpatched-php-vulnerability/) **The Mandarin** · news · secondary · captured · published 2026-10-21 · added by `curator@php.newsroom` · `themandarin-322640-asd-rushes-out-critical-alert-on-unpatched-php-vulner` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Julian Bajkowski: the Australian Signals Directorate put government and business on alert on Wednesday afternoon, quoting the PHP Foundation's advance notice an... capture 20261023T080331Z · HTTP 200 · https://www.themandarin.com.au/322640-asd-rushes-out-critical-alert-on-unpatched-php-vulnerability/- `headers.json` 2786d04a60bb9fdd6e9fe1c8b3676b622ed6893d92da0dfaf1d4da8e62762983 1,322 bytes - `page.html` 9021ab20ae8fe8628bb6d9ef05a6dcbbca3e9ca72dd23f7deabe62f3ad2c3c1c 814,074 bytes - `provenance.json` 85d0416f786cca79b53d8f656628392578ac47490f15b4dabddd411d6bb0b026 1,812 bytes - `rendered.html` 374f0fe50f0b037a070773e8f00baef19b503425a88f30a363ec75e7006b08b8 833,792 bytes - `screenshot.jpg` 572e4eca4484969f39d4346e8ef118f81fcba26185f481640896c82ea63d316f 446,918 bytes - `text.txt` b6625a35ad00fcab445a86fa4d0e8a0cfb781915ed1fa78e7cdd0055c23f397f 5,673 bytes ### [PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Record from Recorded Future News](therecord-php-foundation-statement/index.html) [original ↗](https://therecord.media/php-foundation-statement-critical-vulnerabilities) **The Record (Recorded Future News)** · news · secondary · captured · published 2026-10-22 · added by `claude-story-site` · `therecord-php-foundation-statement` Secondary: the Foundation's account that AI review first sparked alarm in August but signs surfaced in 2024. capture 20261022T113158Z · HTTP 200 · https://therecord.media/php-foundation-statement-critical-vulnerabilities- `headers.json` 2257c81e7400eff589569be8295f608e775b7e305c9af66d1e8d4a8f580c7229 914 bytes - `page.html` 8849918ee23ea9f6e709c68d21726ff22f31b4e88bf3fc8d6c2d67f55d338d81 92,120 bytes - `provenance.json` e26d3d9bab095c3530be9242fd010f71c6efd72f0f561f48cc26892f32df92cb 1,122 bytes - `rendered.html` 387866a008c5068d55372962daa2904c6bee30821494b4c30a467aaa1c775383 96,511 bytes - `screenshot.png` 31f0aeaac3e78e1ab3c579a6217361b9148b439f02245b029c43c19d4f7f759a 1,498,927 bytes - `text.txt` 28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e 7,717 bytes capture 20261023T160435Z · HTTP 200 · https://therecord.media/php-foundation-statement-critical-vulnerabilities- `headers.json` 2556552de87e0fb836287316ada33cfbf38a8854dd71c77a7c51a32cad3bcf28 987 bytes - `page.html` 174ced4d86e17882246f66b238020390f7025ebd7540bf47cea84b3941e0d830 92,236 bytes - `provenance.json` 91d4623dd66eb56ccd65fead43d62255897d8e5e92a595fe9d40eaa890448210 1,878 bytes - `rendered.html` 14c928a86548e2e96efa8ef7d725ac5a832fb58d993c74436e44ee03818a690c 96,434 bytes - `screenshot.jpg` a6805b7be8e65d53c948e0f3548693b0d97ac4f4448f96cdf1deb60f47bacedf 538,706 bytes - `text.txt` be05daefbd9bf0d2d1f784c5c8e34c73955e15d6b420dc4f75ecd35701a92ddb 7,730 bytes ### [Hundreds of websites taken offline as concern grows over two PHP vulnerabilities | The Record from Recorded Future News](therecord-php-warnings/index.html) [original ↗](https://therecord.media/php-script-vulnerabilities-warnings) **therecord.media** · news · secondary · captured · published not stated · added by `collector-news` · `therecord-php-warnings` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T080854Z · HTTP 200 · https://therecord.media/php-script-vulnerabilities-warnings- `headers.json` bf9113e74b1e6fc5bdd612ddf58eda8304cdbe00ea65f0e32c62070fe5c48171 985 bytes - `page.html` cdc8d409db3a15177c95696d32903a6f181766a8f37ef3f114e63810f7adaf50 92,880 bytes - `provenance.json` 67050f29346e8aa3be54f2ab569c9e34e21f12f48d2f4458f9ff96f9e7c05dee 1,069 bytes - `rendered.html` 6b4ce2be2649726e849b9a114c3d0c6c1e9477082e820c0c1561f427cbad00d0 97,133 bytes - `screenshot.png` 7b41ac3613b3db9c15c197aef53bcda877ae332bff01b2155e5dbb4e5291927f 1,516,966 bytes - `text.txt` 39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443 7,551 bytes capture 20261023T160435Z · HTTP 200 · https://therecord.media/php-script-vulnerabilities-warnings- `headers.json` 2796e5f62520fb3f9ba89e4efcffe6c9b2d11bbbdc18cc295d2526830e271c6a 985 bytes - `page.html` 81217ad9ce720fb18adb95f74c70c257fbfaf0977c285d60eaf20c2eb1ee1862 93,427 bytes - `provenance.json` 3e3ee8cb18e3ca186473fcebf920eba42be6971c1033bafa3b15d2ee3e023e81 1,641 bytes - `text.txt` 4ee6aaf030fcd7f6d4fa3d6dd56586dbd78afd39977e4603a2c40dadd53d93a0 7,498 bytes ### [PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk](theregister-php-blames-chainguard/index.html) [original ↗](https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611) **The Register** · news · secondary · captured · published 2026-10-22 · added by `claude-story-site` · `theregister-php-blames-chainguard` Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress. capture 20261022T113204Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611- `headers.json` f037ca6b2e792623b19de3cc87220576a70faf147d1140a31fe0f0a22fa34d1e 610 bytes - `page.html` f7f24a70afadc30edf03beb3e697086d5126ad7f5ddf2875c2e5c54bc07208a5 183,584 bytes - `provenance.json` 28bb52465a44cfdc683cafd60ae043da8145a2e31fa1e280fa7ed7b81e417e32 1,225 bytes - `rendered.html` 3729f08f3b948bc4af5a39a2b7351e38db6eeafbbcb982556755e5929dabb56d 197,763 bytes - `screenshot.png` d7c98b6141ded745143bbb5bc018fb02e07f795ab320a20434e063f150a3b875 1,745,666 bytes - `text.txt` b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca 13,215 bytes capture 20261023T160435Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611- `headers.json` a1978393d061c66f63509e1c1c1a981a94391c640732adda0650aff46e5136d2 681 bytes - `page.html` 2ae362bc7596728abff7d47881889ac36ea6b0f56b399d1764f98a7032de6dec 183,254 bytes - `provenance.json` 84d6fb599d488aaf94357843ef4ed03d95f6b1c458afccacf0ceb42f0e84a701 1,985 bytes - `rendered.html` b138f7fef816c5180a11c1d2fc70655a5669b0af56c0c9eb19c663c72191ca2c 199,783 bytes - `screenshot.jpg` 1451218d7d84aec414a1764685d312ecefea6858a4a230fda6c9991961e4f3cc 964,556 bytes - `text.txt` ca382cdb9b4ecdf3e8ef86975c0671cea61b842d9de3ca1b06b1f60c98febe6d 12,962 bytes ### [Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star](thestar-aseanplus-aseanplus-news-2026-10-22-seri/index.html) [original ↗](https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/22/serious-language-programme-php039s-security-flaw-leaves-internet-websites-at-major-risk-reports-dpa) **The Star** · news · secondary · captured · published 2026-10-22T12:48:00.000Z · added by `curator@php.newsroom` · `thestar-aseanplus-aseanplus-news-2026-10-22-seri` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). The Star (Malaysia), a dpa wire report of 22 October: PHP's security flaw leaves websites at major risk. Security experts warned of two critical vulne... capture 20261023T160435Z · HTTP 200 · https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/22/serious-language-programme-php039s-security-flaw-leaves-internet-websites-at-major-risk-reports-dpa- `headers.json` 6821f5025b8949aeddbf985a428f0baf8d02f287b669ee066a7dfecdc0ecd764 1,374 bytes - `page.html` b0bf2d6452f14d74d1e3257844ee35730c93de2f0da5bef61322cda24943076d 423,848 bytes - `provenance.json` 6de00b038120b27d2949aeaa6f4916ddef07cd08a99baa6b6ddf1e53fd7466ef 1,945 bytes - `rendered.html` fd7b35fbbccd69663821a4bb016415ce72b4e8e16f05dfc0143461f5f7668bb0 526,354 bytes - `screenshot.jpg` 7834b934aa582fdd0dc3d3c29742f93983d06719ada07f891f5e5eb6cf24c6f7 544,408 bytes - `text.txt` 465bf0298d2e3f5d97b451b1816104c3d11790e4a222732501d273842e71bcb0 6,304 bytes ### [PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL](tpo-nl-digid-offline/index.html) [original ↗](https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/) **TPO.nl** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `tpo-nl-digid-offline` Dutch: DigiD, MijnOverheid and the Tweede Kamer offline. capture 20261022T113213Z · HTTP 200 · https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/- `headers.json` 3b4fb879e9421d7c88e3feb33a0521286d51f96fea6fe5ce5a04f9a54f055b3b 826 bytes - `page.html` 1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad 233,569 bytes - `provenance.json` e8a125363be8a52f4be95819b63112af3af8ea3317977ed509fbe2a52b0e31df 1,020 bytes - `rendered.html` d32cd4732dc20dda8b4464a52f471b942ec7756397f0ff01d40dd7344843c936 407,728 bytes - `screenshot.png` 50d028e45666fd51dea41fe9359edc265ec4671d4ca742a6acc17eb2ef119a4d 1,351,320 bytes - `text.txt` 2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb 3,796 bytes ### [PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL](tpo-tpo-nl-digid-offline/index.html) [original ↗](https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/) **TPO** · news · secondary · captured · published 2026-10-21T14:53:56+00:00 · added by `curator@php.newsroom` · `tpo-tpo-nl-digid-offline` Promoted from the source watch (oq9gflln), snapshot 20261022T171501Z. 6 new items in nl: TPO reports that NotuBiz, used by about 100 municipalities, went down first, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-leave tool, RTL, ANP, the Schiphol app, hospitals and KW capture 20261022T171501Z · HTTP 200 · https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/- `headers.json` d679fd249c5d952dda77dd7e6cacb7c092e618eb15c5e59246e6deaedfd6bfe4 903 bytes - `page.html` 1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad 233,569 bytes - `provenance.json` 01b81cb90dbf7aa36af6f95353411d042db7aaebbfc47685d58e68efa55540ae 1,577 bytes - `rendered.html` 115512a91059970f03be37577b59b1af81dd6f12a2e113783ecfa9740cfd65b0 406,102 bytes - `screenshot.jpg` c831463120c4b1e47b6e6d8123de97f6e1c5d84a5e959062aad715898eeee87c 348,035 bytes - `text.txt` 2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb 3,796 bytes ### [70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell - Trak.in - Indian Business of Tech, Mobile & Startups](trak-stories-70-websites-at-security-risk-due/index.html) [original ↗](https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/) **Trak.in** · news · secondary · captured · published 2026-10-22T01:39:26+00:00 · added by `curator@php.newsroom` · `trak-stories-70-websites-at-security-risk-due` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Trak.in (India), 22 October: researchers at Wiz uncovered critical PHP vulnerabilities, dubbed PHP2Shell, that could let attackers run malicious code... capture 20261023T160435Z · HTTP 200 · https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/- `headers.json` 8fde4430e8c470e49b420cd29fee49793f43d3268f43588b2ba02416312839a1 1,484 bytes - `page.html` da1aed41fe100616f8a86703474d47523f95c935adb9d20a5b65859ffe6287da 194,289 bytes - `provenance.json` 4d427b769b9cb3f10ad791e195f0f582fd24a190503c9e200e6be5e3b92be443 1,826 bytes - `rendered.html` 074589989cd1856a02772f19472fe2f6cc4cccba33b84c7111de496a2cbde883 240,970 bytes - `screenshot.jpg` ec39f77be4fbb05ab80efb990eb4abb700a658e2171e10f91d64fa0c8c6f67e9 556,334 bytes - `text.txt` 019553b7a67c18ab791515f5de15e32683828dbee3ffb981c370cf741299b786 7,293 bytes ### [Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech](tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco/index.html) [original ↗](https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell) **TugaTech** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while abou capture 20261022T181608Z · HTTP 200 · https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell- `headers.json` 9ba4e8c110dfec261e69ff9e30583f3035699374cdc4c8bbda36e6ffbd8be6a6 1,238 bytes - `page.html` 5eb2708e19df644429bd5ac2756cb2c61c3e5e6404055fe5e598966c814d6a35 94,257 bytes - `provenance.json` ce02f1eecf8e728dc52f46b35ef04cd30431f0d48c23a3a7ce338c973434e38f 1,787 bytes - `rendered.html` 3e2919e620909a26d898f060386cd197035237503335812de34a61a73a525b5b 447,588 bytes - `text.txt` 86e513bd05a0b5fdd5b9e959b368b60b23112bfffe99f7d9ae4097f42042cc26 8,239 bytes ### [Due gravi falle in PHP mandano offline i siti web governativi](tuttotech-news-2026-10-22-vulnerabilita-php-html/index.html) [original ↗](https://www.tuttotech.net/news/2026/10/22/vulnerabilita-php.html) **TuttoTech.net** · news · secondary · captured · published 2026-10-22T16:41:29+02:00 · added by `curator@php.newsroom` · `tuttotech-news-2026-10-22-vulnerabilita-php-html` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 7 new items in it: TuttoTech reports government shutdowns in the Netherlands, France, Denmark and Finland, plus Canada, Wikipedia and the Internet Archive. It covers the AI discovery and AWS's early detection, and cites Censys data that 1. capture 20261022T181608Z · HTTP 200 · https://www.tuttotech.net/news/2026/10/22/vulnerabilita-php.html- `headers.json` a1887304d23ff9d1adb3f4ea5a2ab31d260170b5c193a662ee297f69283fd170 794 bytes - `page.html` d565db358e1e3174b9bee376602cb8654314a0e1b36d29b47478e8730b12c075 206,784 bytes - `provenance.json` 6f96056f90767210f819d3048606463447f461b4558c9d8f322f7a103687b0a3 1,660 bytes - `rendered.html` e555f146d258fe7ed6e95496fb0cd0daa3d9a4e40db7b332d71a234c93d20e22 211,746 bytes - `screenshot.jpg` 3b6f02b69024fd2de862fe8555157c453c8fef3e29b2b7f720ed33f226bff325 676,024 bytes - `text.txt` cd3f99c6c9f942595087eaa47ae8e71639cd4526a4453110ddd6a6365de3ae26 11,890 bytes ### [Home – The City of Edinburgh Council](uk-edinburgh-council/index.html) [original ↗](https://www.edinburgh.gov.uk/) **edinburgh.gov.uk** · government · primary · captured · published not stated · added by `collector-gov` · `uk-edinburgh-council` A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing. capture 20261022T081940Z · HTTP 200 · https://www.edinburgh.gov.uk/- `headers.json` 5b0c2f2f2f2adac16e8aea91766e3bf330147b025746aefc77de7cbc15b28b80 621 bytes - `page.html` 91d7847df525e1b8df2d6e6df1ca60c56e5def200252796893d555bf256b5360 64,820 bytes - `provenance.json` 479d5602d1a8929b0e89a474628de89b7091e747ec84c503d26442211780c7fb 926 bytes - `rendered.html` 3b404767e790607c81648c674f2c3a6f2c1cf4e0b5f510c60372e7ced18b4f04 85,320 bytes - `screenshot.png` 612cdf82ad70d709d2f503e5bd0e4bbe0d95286c72e51e9e2dcceb4c4dda1a9d 934,354 bytes - `text.txt` eef60737c49dfded7a4cf9d305998ac3db3278cf7683c33adb852be709ee3b97 2,792 bytes ### [Error 503](unige-site/index.html) [original ↗](https://www.unige.ch/) **unige.ch** · government · secondary · captured · published not stated · added by `collector-news` · `unige-site` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081909Z · HTTP 503 · https://www.unige.ch/- `headers.json` 45d418c6a1e13df367e5e13dfedc3c3513a91092939f89a4eb322a8f42577c36 156 bytes - `page.html` 4588df31ba75c0a04c05e175d37f8cc5a25d23d6db540d28a36f66fec14254f9 19,901 bytes - `provenance.json` 6c2047a27366d8503e5879f2b0f2c3944b2955861f810845b58c9686c7784120 871 bytes - `rendered.html` 1a4e507f0d762ff9c1a560b5ee5c9d49cefcab50d31cb7a71e961b34e611a01a 19,945 bytes - `screenshot.png` d1297a7617fc41349319a3083ffb2125087cc9d2d9e00983e19af3ea4f21a14d 41,256 bytes - `text.txt` 4bdf3d6eb3f0d3b621b80a040ea09917da9c7b4a435f5ab1d995009e57ed3e92 241 bytes ### [Latest on PHP vulnerability as patch gets released, NSA issues warning](usa-today-php2shell-live/index.html) [original ↗](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) **USA Today** · news-live · secondary · captured · published 2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata) · added by `curator@php.newsroom` · `usa-today-php2shell-live` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Cloudflare: atte... capture 20261023T012042Z · HTTP 200 · https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/- `headers.json` 986913b020afb8175c71098e3c5ae0a1dd98b5e4946f4fdf9aaae4210d123029 3,227 bytes - `page.html` 2fd5c3af9f85319dbc2a5ed6bcee683a64e480fb1b923b9b1e311ee541d0f299 238,686 bytes - `provenance.json` 2b254772d214775a4d8b0ccdff400e4e98bca7f49709467c73bb13ada1d85c40 1,685 bytes - `rendered.html` cda4c0f9cd9bc2cb7444c5c9440efa87788e7228859c88e885d1b36f32d4ad76 1,301,168 bytes - `screenshot.jpg` 465c18afd0371a4b6dc4990243f5594fdacc682deec3820eeab7b9f325103966 538,847 bytes - `text.txt` ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355 18,287 bytes ### [RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIX](voix-business-cards-rainforest-ip-activity-an/index.html) [original ↗](https://voix.jp/business-cards/rainforest-ip-activity-analysis/) **voix** · news · secondary · captured · published 2026-10-23T09:16:38+00:00 · added by `curator@php.newsroom` · `voix-business-cards-rainforest-ip-activity-an` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). VOIX (Japanese), 23 October: the Japanese firm RainForest published findings on PHP2Shell. Using its own honeypot network, it cross-checked threat inf... capture 20261024T160544Z · HTTP 200 · https://voix.jp/business-cards/rainforest-ip-activity-analysis/- `headers.json` 19c9b0cd27d0cd052155a7af4f2856f249a5401e8acefb2e7effb4b07f5dc626 1,034 bytes - `page.html` e0bbe671adc77bad60f96f39cf3a1ba4315573b5e78c5a90373eadc6df9ccbd6 110,333 bytes - `provenance.json` 9f4d26c952e32aa982c8e31db8c787cd017d4454ffe563b2e3d6761444e64c91 1,707 bytes - `rendered.html` 873b42ec13cb5d4d5962a2c457a884f2884eb91b9166cef439a0b74c011045bb 112,883 bytes - `screenshot.jpg` 6258f273644324fd5b5031139cac3d2bc9b7a35b991880decb0c8be3076de4d3 585,936 bytes - `text.txt` 3e5e879383dd76ceedde10291eb662d52a451e20b573d86c3b1c0ef1ace3b61a 11,610 bytes ### [IMPORTANT Vulnerabilitatea PHP2Shell: ce recomandă experții în tehnologie și unde e expunerea cea mai mare](wall-street-articol-it-and-c-important-vulnerabilita/index.html) [original ↗](https://www.wall-street.ro/articol/it-and-c/important-vulnerabilitatea-php2shell-ce-recomanda-expertii-in-tehnologie.html) **Wall-Street.ro** · news · secondary · captured · published not stated in the capture · added by `curator@php.newsroom` · `wall-street-articol-it-and-c-important-vulnerabilita` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Wall-Street.ro (Romanian): important, the PHP2Shell vulnerability, what technology experts recommend and where exposure is highest. The same Zitec tex... capture 20261025T093507Z · HTTP 200 · https://www.wall-street.ro/articol/it-and-c/important-vulnerabilitatea-php2shell-ce-recomanda-expertii-in-tehnologie.html- `headers.json` 575efb2794e26eefc288a844f31621c90353ed62cee86e658d368b67a889c4d1 1,817 bytes - `page.html` 3ba1ef988552f2c5c6f8e5e6dfc66644a5f662edb0ecb3a45e1079cad65791c8 183,067 bytes - `provenance.json` 9e41fea08822a6b1432ed7c273ef502cec7d05d38f69c0911952d150f43c7658 1,875 bytes - `rendered.html` ae5825099ba301faa875a0b8218c5efac8bb93628d588b3bcc950559810d915b 158,846 bytes - `screenshot.jpg` 9cd885983134935381a7ada14d0f10846eec9f89c43218e2b9b35f3019331831 896,304 bytes - `text.txt` c7b3997e8853ddbaf2dbbedd5d43f3647ed05da0223a4f4e6dbd648be234e0e0 16,060 bytes ### [watchtowr.com](watchtowr-php2shell/index.html) [original ↗](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/) **watchTowr** · researcher · primary · captured · published not stated · added by `claude-story-site` · `watchtowr-php2shell` BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild. capture 20261022T111839Z · HTTP 200 · chrome-error://chromewebdata/- `headers.json` ff01331edab1c463627b7d97ebbf6c6089f2893fb06dcf8f589c2d11416bf603 2,911 bytes - `page.html` cfe1d709b20d9c9c8d6383853add5bab85c168f532041e5f4733b5cce5fed8f3 456,212 bytes - `provenance.json` 97a66648fa1ef3d782a7e0d1be25a472e3d4248521e20afc78bba0856d9006cb 1,001 bytes - `rendered.html` afa2a67a0dee2a2d057885312d74f1277ab47cc85f919220d2421a6d6044265d 183,693 bytes - `screenshot.png` cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee 21,632 bytes - `text.txt` 1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab 106 bytes capture 20261023T232528Z · HTTP 200 · https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/- `headers.json` 9569e2acde13e8a452b23805f6ba7482845cc4544b0eee5ee3dc0e37aa1ab84d 3,172 bytes - `page.html` 49880f3a542b39683d2008bdad6af97f5fd98e1aa62a7163cd2bcb35a1c7f7d6 461,495 bytes - `provenance.json` 2c8567c9443613c7212763a8699b43fde1826d21f9744b59164606bc69800e5a 1,735 bytes - `rendered.html` 77923dc2a9eeb33d82effb69df89fb6e137ce0ea3ff56fe67959498711bfd051 535,286 bytes - `screenshot.jpg` 2bfb399a3f975123b73f36d938d2c48e0b57c46f1530edd612255273341bfc27 761,462 bytes - `text.txt` e09524178ed5f328df70485889aa78f37e3bf819682db33e22b4d1a875d1199f 12,450 bytes ### [watchtowr.com](watchtowr-php2shell-faq/index.html) [original ↗](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/) **watchTowr** · researcher · primary · captured · published not stated · added by `claude-story-site` · `watchtowr-php2shell-faq` BLOCKED: HTTP 403. capture 20261022T111847Z · HTTP 200 · chrome-error://chromewebdata/- `headers.json` 0c655abac86df9e59b49a895ed0bc35a702af92b957d5db757df55be64fd9ff8 2,908 bytes - `page.html` 9ad5ad45ab50498bff4fec7104988da089ca1e17cc8145805e57fe493e22893c 457,843 bytes - `provenance.json` 779e5cb94040a7b1083dedc2aa737205276d134f02007caceae9ff3ab737420c 993 bytes - `rendered.html` ed77bdfb70c799526cb11ef4c80486ab375a2bebf338de76275278dd5be92f25 183,669 bytes - `screenshot.png` cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee 21,632 bytes - `text.txt` 1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab 106 bytes capture 20261023T160435Z · HTTP 200 · https://watchtowr.com/intelligence/php-cve-2026-109618-faq/- `headers.json` cad4df531da848990002b6cb29acf493343ce806cbfc1a14d5d8f5cfc4681400 3,171 bytes - `page.html` a37d6427ad2b41f96406baf00c0582a62bc01a93589026fe41e1674189f6ef2e 463,706 bytes - `provenance.json` 214e9f9b59ac4b19cc20a4783d38bd711654c978f19bde3bbe1cb58b9d002c3b 1,723 bytes - `rendered.html` ed1654f5460ab4343b5451a30df79efe21e650a9aa2c0e037eeaeb8c6b11c286 481,960 bytes - `screenshot.jpg` a039228f4e36bf0a2026db2e79fa46bab9461133bdc3789b8082681080cea63a 591,741 bytes - `text.txt` 3c561d0c08e9343f817d78c30427c55eb4a491ccd2a59babcb879a65da8def37 8,906 bytes ### [PHP2Shell: Laut Bund keine Hackerangriffe in der Schweiz bekannt](watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein/index.html) [original ↗](https://www.watson.ch/wirtschaft/schweiz/322033892-php2shell-laut-bund-keine-hackerangriffe-in-der-schweiz-bekannt) **Watson** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein` Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in de: Watson (Keystone-SDA) reports the Swiss Federal Office for Cyber Security (BACS) knows of no attacks in Switzerland and has no reliable figures, but confirms PHP applications in the federal administration were affected. capture 20261022T181608Z · HTTP 200 · https://www.watson.ch/wirtschaft/schweiz/322033892-php2shell-laut-bund-keine-hackerangriffe-in-der-schweiz-bekannt- `headers.json` d076c07a3a2f4ade16f12ce6a3fce3efb319f6cd5ab2345bc1ab3213346ba530 860 bytes - `page.html` 48610e805d8f58a45344032ed4eee18b235df468dd0fc08045b0f262cff47b63 690,448 bytes - `provenance.json` b2040a586fb4888425c0d92e3bafe5d567c47fd11670fc929e65fa54f07d585e 1,813 bytes - `rendered.html` eeb6716159d724161fe63d1b9ea9be7af3f313efd005a75a0c93e95848fc4725 872,416 bytes - `screenshot.jpg` e4169bfc29bd37d796008bffff79d8dc547e9c37deda057432bc710668e6950e 676,413 bytes - `text.txt` 6fe889c621b7f2e10f0d7e50707cf7b1293585ce07ebcb55833beb176c3e2ac5 8,097 bytes ### [Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop](weirdgloop-blog-php2shell/index.html) [original ↗](https://weirdgloop.org/blog/php2shell) **Weird Gloop (cookmeplox)** · vendor · primary · captured · published 2026-10-21 · added by `claude-story-site` · `weirdgloop-blog-php2shell` Operator's own account: web servers off for 13 hours, longest outage ever, ~94% of page views served from cache. capture 20261022T111827Z · HTTP 200 · https://weirdgloop.org/blog/php2shell- `headers.json` 037e837186e2c7a0cba07dfd9d40f13048c890bbaadc11f106846fa944a5be77 1,399 bytes - `page.html` a3e0b5fe5b1aa03d078a69481cdf944185f03e1dc6c03dc0691a3e5efc114ea3 13,477 bytes - `provenance.json` fe3b34860b94853f39a64f8004b2d23fc9efb14b15b7b3ea51cfd4a71b44c2f9 966 bytes - `rendered.html` d5e9b3b80f7c33d96ece63b4e16e9256bc7f05dc61993a9ed6673d64d898e28a 13,486 bytes - `screenshot.png` 8014b0889ab8777b9c1ef8b2562da1fe3f4c2d0d858c2727dfe7d79acae1ceaa 369,760 bytes - `text.txt` 6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962 4,262 bytes capture 20261023T080157Z · HTTP 200 · https://weirdgloop.org/blog/php2shell- `headers.json` c5dd775f0cfc5e09754017b41f0ac823475353d4cfd52237b146ed48608d8371 1,461 bytes - `page.html` d974a801e093822c24a502653b6df2c3dec5197feba2f37adf88049822948d3d 13,480 bytes - `provenance.json` 455402873ad13afe50b64e46dd937b476e49ec4dddd3e42daa108cacfd2f9fea 1,546 bytes - `text.txt` 52f0a619f6b077916c97436152c0dbf919eb15c18f189672a30fcecee0827038 4,265 bytes ### [Wikimedia Status](wikimediastatus-page/index.html) [original ↗](https://www.wikimediastatus.net/) **wikimediastatus.net** · news · secondary · captured · published not stated · added by `collector-news` · `wikimediastatus-page` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081850Z · HTTP 200 · https://www.wikimediastatus.net/- `headers.json` 43b0b5cfcac9a0b20aec9f323980f25fc68c73a4c28cd03779fd05bf1ef170df 2,587 bytes - `page.html` 932bc299819bdcdd36ea74d48217ba41c86685f95b95ef4e681ec151a52a9626 98,053 bytes - `provenance.json` 14eb7c6e76fec0a2d270f7346e0e6f69f27e24c14bb016e7413b30504cc18dc8 910 bytes - `rendered.html` bd57bc4e1fab2c0e051a4b7b577e24a15117ce0315f32b8c5ea5af9c6dc67706 232,435 bytes - `screenshot.png` 93eb032f0b0834ff0c5e4ce281e745d4c53afc0c9426480e0cbf541d56996704 309,152 bytes - `text.txt` 13e068d2c2b3665d1ad67a02da3752c77bb617ab952507f4cbc16168b0e1a72f 2,228 bytes ### [Dan Kaminsky - Wikipedia](wikipedia-dan-kaminsky/index.html) [original ↗](https://en.wikipedia.org/wiki/Dan_Kaminsky) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-dan-kaminsky` Tertiary: Dan Kaminsky, for the 2008 DNS flaw. capture 20261022T113323Z · HTTP 200 · https://en.wikipedia.org/wiki/Dan_Kaminsky- `headers.json` 230fef32ef2b8e3a03fd564dddff422d11bc2aaa9c55bf790e489e49cd1728d0 6,516 bytes - `page.html` 6c89a48790d2570768a3e30b6e6773d391a8726a2ea374490158e9788351b499 239,532 bytes - `provenance.json` 912e913138aa6da2c78cb8a72b6f0f49ff311ecb7d55a3f3ebe018788dc415c7 940 bytes - `rendered.html` 6965408cf93703569203e0b1fa6278195218e7179ca2f79c981126987636c876 431,088 bytes - `screenshot.png` 615f1446bfe1602439edb7b7273d7e7b74aeb78f40c45e5ef95312ecab6b44d8 2,208,990 bytes - `text.txt` 565033cfb92639ca1311f148e4c1fddbec463cd655a7b253b698b0d3bbee7d5b 19,564 bytes ### [Wikipedia, the free encyclopedia](wikipedia-en-mainpage/index.html) [original ↗](https://en.wikipedia.org/wiki/Main_Page) **en.wikipedia.org** · news · secondary · captured · published not stated · added by `collector-news` · `wikipedia-en-mainpage` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081858Z · HTTP 200 · https://en.wikipedia.org/wiki/Main_Page- `headers.json` e955926167e0071dc046d0d19f1e93de7c6f689da1fd735810200711d198ec98 6,588 bytes - `page.html` 124c0cf0f5d69d4eb2f539691b78a3d2b7f775276d7d403ce7b41c790d05afc8 256,072 bytes - `provenance.json` 2069c319a6a98a5ea0b1b892cbce10d6403fedecbdbb77caa0b194640df7976e 941 bytes - `rendered.html` 342d21cca365ec9dca361d699b42b88ffee199c899ee2903183a7b86ad1a441c 417,303 bytes - `screenshot.png` 9e9389a0f25bde4e29d9de15fffef615450272353491c9a719285f4a0cdce022 1,270,714 bytes - `text.txt` e1f68a6602ba7fa72443285d1a741f99af7d3266877b5cb3d6dfcdfe655d35ad 8,195 bytes ### [2017 Equifax data breach - Wikipedia](wikipedia-equifax-breach/index.html) [original ↗](https://en.wikipedia.org/wiki/2017_Equifax_data_breach) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-equifax-breach` Tertiary: the 2017 Equifax breach (Struts CVE-2017-5638). capture 20261022T113329Z · HTTP 200 · https://en.wikipedia.org/wiki/2017_Equifax_data_breach- `headers.json` c3bc169ae4d898eb6475902410fddd73fa4ed34ce0daddd19f5f6a5f46ce5742 6,561 bytes - `page.html` 063ebe77541faf5b4a538fb6536569545115ba07e4ece30ec4b609b3f10e0715 357,275 bytes - `provenance.json` f1e5a749836d6e8fa78cb7d8298991d435408424506415523c68e32f854be7ea 978 bytes - `rendered.html` fd59a52a810139932c34d91ab988792d0f289833507ce5edaa59b5f0c50a1403 561,514 bytes - `screenshot.png` 87c5de1374b3c50ce76b221a56993bae2c23023f9774f9bce5dea3822cde37c9 3,123,746 bytes - `text.txt` e38b857233007afea66a356c3b1b109917746f474776fef1897536936986af07 34,565 bytes ### [Heartbleed - Wikipedia](wikipedia-heartbleed/index.html) [original ↗](https://en.wikipedia.org/wiki/Heartbleed) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-heartbleed` Tertiary: the Heartbleed article, for the context page. capture 20261022T113241Z · HTTP 200 · https://en.wikipedia.org/wiki/Heartbleed- `headers.json` ebf98b097de4ce11194b4121b9de21f82d8c75e7117279bd2b10d469c923f907 6,561 bytes - `page.html` 548f1ff2c768078511e876df9f95289590100729e454fe278693a08fc838717e 833,943 bytes - `provenance.json` 6ce9e63913d1a8ac51b9519d592d2eb038f9cf41bd235baf4008e90594ca666b 932 bytes - `rendered.html` 7fa05158620c1d78de2df881c24a28d80da7f4244ada06ba16854d311e830cf5 1,113,858 bytes - `screenshot.png` 7affc5c7f2af7e59d01dddfa5ae745b2a322d785e9d0e23b518defaf08b9b12c 6,147,603 bytes - `text.txt` 335a02e5907d498b4ff7cd3bb3e63c86596c9590ec307cd2b82a13a8d0b9911d 66,888 bytes ### [Log4Shell - Wikipedia](wikipedia-log4shell/index.html) [original ↗](https://en.wikipedia.org/wiki/Log4Shell) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-log4shell` Tertiary: the Log4Shell article. capture 20261022T113317Z · HTTP 200 · https://en.wikipedia.org/wiki/Log4Shell- `headers.json` 87abc43f478d756f7d6b4f160635cf45fb9be84375d34b71cc12d70e91c81117 6,559 bytes - `page.html` f21f5113f869aeb05d3c2467525fa6a946a0622c8295ec8ca5e52e2cdee958ad 350,814 bytes - `provenance.json` d08c417c0b7261fd57ff15f73a65ba91d48121268d596490e7f069b30b449a53 928 bytes - `rendered.html` 6b9cee027909f277350e142b3d325f5a0575732f0b5e2c76f8c35c9361c214e3 553,202 bytes - `screenshot.png` a64453cfa8cdf7caa73bdc64dbb02943ed99ea9130ce83fd5c6cdd1cebdb74d5 2,405,972 bytes - `text.txt` cd08f6a7082ea6e3cc172d7738243c4eda26331c8af2aded091e27dca5066058 25,890 bytes capture 20261023T160435Z · HTTP 200 · https://en.wikipedia.org/wiki/Log4Shell- `headers.json` 93384855ddaba204221406c48283eee52724b53d5dd8de164e4cd63b773d8031 6,588 bytes - `page.html` 8a2c0743a4acf7df7119376f8eb7cb787134f185ad08b490a4e857818661da0f 349,414 bytes - `provenance.json` cb59c8ab9d2e3bde3537252dd3fb30f9231bf9b8a30a2f202fab2b6426ca33ca 1,647 bytes - `rendered.html` f3f241535690f775a0652bce819500eb5e6047e4a2f2c7e4194bacb531c7b636 551,718 bytes - `screenshot.jpg` 223465a3fb231521e37e0934dd81cd07ba7f4ccd357236f735e02bbe80db999c 1,137,683 bytes - `text.txt` 2ba8f232d639e2bf4ee509ae602ea5ab3c86726d6f393c94d16fc39b686f71f9 25,860 bytes ### [2023 MOVEit data breach - Wikipedia](wikipedia-moveit-breach/index.html) [original ↗](https://en.wikipedia.org/wiki/2023_MOVEit_data_breach) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-moveit-breach` Tertiary: the 2023 MOVEit breach. capture 20261022T113336Z · HTTP 200 · https://en.wikipedia.org/wiki/2023_MOVEit_data_breach- `headers.json` 5c9771f190e153438296ebd93a2e83ed2e272b0edabfdc8e90270b0e8cc36a0a 6,516 bytes - `page.html` 586dcd3eba4df977cd0483dd2543c14bb75c8097933ea13131fa4b0913ac6847 163,389 bytes - `provenance.json` 9ac856ea4fd003d7c9d3e5784e6ab684a8bc8ccd3c807e4cf1174b414aee3936 974 bytes - `rendered.html` bcc9ee65deff5809f27130574759019489d461e3374937d785fd991252a55488 339,581 bytes - `screenshot.png` 3348e9116d0ce06e40962d5c5f4bb2592f0ff8d1b01baab3d3911f1710f8f8f5 1,089,154 bytes - `text.txt` ad5c2515a778a3582e85c270cfbb1178c90a7477c3f38eaf804fa10528942be1 11,123 bytes capture 20261023T160435Z · HTTP 200 · https://en.wikipedia.org/wiki/2023_MOVEit_data_breach- `headers.json` 934c64d49c553613038160a00c8fcc485fd00b415923ce7e1e22afb3b5be7c41 6,576 bytes - `page.html` f7acb730b3150aaaeb60d022f48615f28d4b9751aacba6e1e1b426953c0b0913 162,382 bytes - `provenance.json` e2cbf422e2b86074184a03f554b9baaae0a5c919c9b87478a500587761a2ee8b 1,717 bytes - `rendered.html` cc0f252542136f86d32e45c49fce9ac935cedacfe9004ab88f5a13326807d622 338,605 bytes - `screenshot.jpg` c3a33842225c4c1375e6068f974c0505192e1294c5237a986d23db93497a1ded 542,854 bytes - `text.txt` 047ae65c996b5fd9a88e4b4cdc857b59143f633632ed49a3dc7991cb7f4d1267 11,019 bytes ### [PHP2Shell - Wikipedia](wikipedia-php2shell/index.html) [original ↗](https://en.wikipedia.org/wiki/PHP2Shell) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-php2shell` Tertiary: the encyclopaedia article, captured as a record of the public account on 22 Oct; says publicly announced 20 Oct and patched the next day. capture 20261022T112309Z · HTTP 200 · https://en.wikipedia.org/wiki/PHP2Shell- `headers.json` df684951111f873760fab5d20078208e1e989557f1150d9aeaa7966ee6c8ca75 6,560 bytes - `page.html` f306b23e38d55d74fa6405a49e04b8dd420d7f5795c1b999f7d2303feed2a904 223,796 bytes - `provenance.json` 16395d927a990f7bb2679d0861242bf3705586641c4f2e7bc9b839580b0eaf64 928 bytes - `rendered.html` f51281e6ee013358343fd07568c8ef63acc38f4340841c824d6c3941004b14e3 408,195 bytes - `screenshot.png` ae58953f05c3bd41c5e57931462c15c8213fb7843a0c45d0b9b045b00f4ce8c5 1,586,902 bytes - `text.txt` bbb51bbd069506b09282b45086984565ae875b5d974d121584c8e2b3c912222f 16,230 bytes capture 20261023T160435Z · HTTP 200 · https://en.wikipedia.org/wiki/PHP2Shell- `headers.json` e2254fb49fc7a7329531a655adc103548d954d74cf59cc4781d1c86e9f61020c 6,585 bytes - `page.html` a310d7d84e2748ce729107fcef3642e5c4e9c12996a184bb0c9f5cf3590b4681 273,715 bytes - `provenance.json` 3d3536d66a4944740ef6d94c5dced200c2c89313558af830457eee534742f7ca 1,646 bytes - `rendered.html` ce058df595b4dfbd8f8229172fe343fbd5ddd91cbace3b7671f44af3212ec2f8 464,711 bytes - `screenshot.jpg` 409ba4f4b1053d44542ff9aaf6e33e4e3d5afe13669ce1ea05b3a80a3be8c603 765,132 bytes - `text.txt` 8123fb7cd4cfbb45571a8e05537e0c5d29133a05e1488ed96f323069848ddacc 15,524 bytes ### [Shellshock (software bug) - Wikipedia](wikipedia-shellshock/index.html) [original ↗](https://en.wikipedia.org/wiki/Shellshock_(software_bug)) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-shellshock` Tertiary: the Shellshock article. capture 20261022T113310Z · HTTP 200 · https://en.wikipedia.org/wiki/Shellshock_(software_bug)- `headers.json` f2a4b3ae6fb24202324c3478fe96ec7d871fbf062829bf047dea987ca29a646d 6,559 bytes - `page.html` 800b60bd11e65365ea12c0db8526f932f55188ca76f3f6eaec4ff4833ba26fec 326,860 bytes - `provenance.json` 0468fb94f26b99cb42b1033597a200e955bd047d1d544cf0aa1e63108588a950 977 bytes - `rendered.html` 2823f220d4e3aa6ce700cdff250ab35732495a32d273c0b6ab24dd2445aa2dc1 522,813 bytes - `screenshot.png` 5f62672b0225c6d055a4a1d802c68a3acf695790ff6f20fee8baaf67f7b5f21a 2,735,619 bytes - `text.txt` 300be73066bba3f66a53bc1116a1a3c7bbe5e61695f1ce8a801c112237b61041 27,686 bytes ### [Spring Framework - Wikipedia](wikipedia-spring-framework/index.html) [original ↗](https://en.wikipedia.org/wiki/Spring_Framework) **Wikipedia (English)** · other · secondary · captured · published not stated · added by `claude-story-site` · `wikipedia-spring-framework` Tertiary: Spring Framework (Spring4Shell section). capture 20261022T113341Z · HTTP 200 · https://en.wikipedia.org/wiki/Spring_Framework- `headers.json` 93660dd4eb58188f8cdd099a1a9f09f42a33c872d13690748edc637974e623d7 6,517 bytes - `page.html` 242f49c0d152a3caa2f0bf0cbfef5baa6f4dfcc62b890886a6f53576021af63d 622,623 bytes - `provenance.json` 2a065f50a364fdd1cae0a5b064fe9e7fe715a6aabe14d7e11ca72727b5b61330 956 bytes - `rendered.html` 96223727d419aba6ee0c683f3d172a10324e28762e3f7dcb32d41519da2596a8 896,578 bytes - `screenshot.png` 0601fe81d23975fda4d4036553b0ff37eb4fe8ea9928d9b697df2d4791acf6da 4,931,001 bytes - `text.txt` 710060585680e022348a35516ce4f13f4d99c2df75fe72a6ec01fe1a223081d1 49,455 bytes ### [Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED](wired-exploited-days-before-patched/index.html) [original ↗](https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/) **WIRED** · news · secondary · captured · published 2026-10-22T02:24Z (page metadata) · added by `curator@php.newsroom` · `wired-exploited-days-before-patched` Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation: ... capture 20261023T012042Z · HTTP 200 · https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/- `headers.json` cdea39f9041c102d99987c0678b106458e3ea49746c7b6df268cd29ff1610a17 1,668 bytes - `page.html` fb4d5d01f6a54a59b38b324364e19dc66eaf270a0528f0468dffebe21b015afc 1,245,418 bytes - `provenance.json` c88e3863ab2f3db40fa3d4bad4d2f8b6c49dc11bb2e0b264727c9de6f242ecf7 1,723 bytes - `rendered.html` 3dfcff4c0800daedd95b55f7510974ced8eac740a0e6ab92d8e0eb5cd206ecf9 1,499,604 bytes - `screenshot.jpg` 4d6198142ef9e78fff96238d160eb6750b0c420c9e963ec76b2b13ae49b48d5d 706,558 bytes - `text.txt` d43b99af65d563ddd047c20c80d5318813eda28abd497763f91dd0a6ab8427cd 9,384 bytes ### [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](wiz-blog-php2shell/index.html) [original ↗](https://www.wiz.io/blog/php2shell-php-rce) **Wiz (Wiz Research)** · researcher · primary · captured · published 2026-10-21 · added by `collector-researchers` · `wiz-blog-php2shell` Wiz Research post dated October 21, 2026. Source of '70% of the Internet' headline; body basis is 'powers 70% of all websites'. Disclosure timeline: discovered Aug 19, reported Aug 24, PHP ack Sep 21. Credits Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas. capture 20261022T081047Z · HTTP 200 · https://www.wiz.io/blog/php2shell-php-rce- `headers.json` f3a7f515bda9ae91541c7792cad2fbb4d5864a7962be4f5db93bccbe8caa2d03 5,075 bytes - `page.html` 32408c9f60071e7bdcf0e702160f6c398d6967cb89fbc81b5f0e0029e34af07b 438,665 bytes - `provenance.json` 4e362d46ccd571e124b20fb3518c8d00076dc508a0146ee5338a7dce931d1fa1 1,002 bytes - `rendered.html` 6db43e32910bdf4bc2b82a93afa5097900aa4a205b5cdde32d1a2510beff4c68 580,534 bytes - `screenshot.png` 4ba83874c540e1f7faf4c817b6b8c3ae1ef61eacda5851a112d6601e47d6d91f 2,753,995 bytes - `text.txt` e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea 19,147 bytes capture 20261023T160435Z · HTTP 200 · https://www.wiz.io/blog/php2shell-php-rce- `headers.json` 9a16e711afa57b40119200d4edbace18a1e933561b09e239752b3796525ce1a9 5,133 bytes - `page.html` 76dcb531033b21e366d4f5a6f70f4985f27945ecd9d4483e54929e184f778d47 439,659 bytes - `provenance.json` e1c70991a21d294d5f694fae2f0a1cccb9fc5d6e7905faacc0d639652e991c31 1,537 bytes - `text.txt` 4c6c2b8a41be8de0fd90fcc8232995625833e085788e2f99ce8ef9789b09635d 19,135 bytes ### [Matthew Prince 🌥 on X: "Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X](x-eastdakota-php2shell-stats/index.html) [original ↗](https://x.com/eastdakota/status/2113079352682570051) **Matthew Prince (@eastdakota), Cloudflare CEO** · social · primary · captured · published 2026-10-22T01:25Z · added by `claude-story-site` · `x-eastdakota-php2shell-stats` Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture. capture 20261022T111808Z · HTTP 200 · https://x.com/eastdakota/status/2113079352682570051- `headers.json` d77dc66c0c59c96e2e54ddfecf08d3b1bd24635a9d74435e5e11a42df31beefb 9,023 bytes - `page.html` 957516e4670ab0fa18a3dbfcc6a2a4fb7bf154370fd7b09506a876e6d327f357 143,568 bytes - `provenance.json` 6ef963e6f636da1603f65de2817e02480ed92a2c4d5b330a151bc2d515c21277 1,249 bytes - `rendered.html` 25a31a5f7554396a5640c88efcf0624e0eab811ea96a53cebc603eb9c55925ad 165,274 bytes - `screenshot.png` 7a098d734f074f04d4c95973bd0f4463f3c18bd7aaf274912a6eea795095879c 216,866 bytes - `text.txt` 4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3 1,884 bytes ### [Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X](x-feross-chainguard/index.html) [original ↗](https://x.com/feross/status/2113043398664015878) **Feross Aboukhadijeh (@feross) on X** · social · secondary · captured · published 2026-10-22 · added by `claude-story-site` · `x-feross-chainguard` A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'. capture 20261022T112105Z · HTTP 200 · https://x.com/feross/status/2113043398664015878- `headers.json` c7243f6c403eb56e9b3d6e563eb8a8b216ea9dd8211fb1b22d4707fb94277f57 9,023 bytes - `page.html` a96f60627079ac4894ec940931bd0fd5f7aafe3bf8894230fb3292b941681412 192,869 bytes - `provenance.json` a7be68aef95eb2bd14be51e50215f101dd44d0e36eb5539a9393115df9ab4ce2 1,233 bytes - `rendered.html` 61fc4e7f751c5a119c9a9a1081b8c47669ac9fe2d7dfd07833772658c39e8fdf 173,209 bytes - `screenshot.png` 75299998b6abad9947b1d3f6d8ce0f477a1e8980c7f9484bdde10796bfc16bb1 560,505 bytes - `text.txt` de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6 5,709 bytes ### [LCFR on X: hash commitment d935be02…](x-lcfr-hax-hash-tweet/index.html) [original ↗](https://x.com/lcfr_hax/status/2085031675382071483) **Ryan Austin (@lcfr_hax), Calif** · social · primary · captured · published 2026-08-05T15:54Z · added by `collector-researchers` · `x-lcfr-hax-hash-tweet` Hash-only tweet shown as '15:54 · 5 Aug 2026' (capture browser in UTC). Cited by Calif's timeline and by X Community Note on OpenAI's post as proof of prior discovery. Pre-image not published here. capture 20261022T081603Z · HTTP 200 · https://x.com/lcfr_hax/status/2085031675382071483- `headers.json` ea81d1bf086428a65e67d0551ac1c3aebc53a1cd4c39b43d3ed837bbd8acee28 9,022 bytes - `page.html` 11a7ec8817e3966590490fb928089c210339261afe54cc2f72353dca15f41391 132,347 bytes - `provenance.json` 508544ce2c74aa23119fa27daa5a30b5ae63e47e7cd3e690fb9cf9a54ef7cded 1,012 bytes - `rendered.html` 9a1b5b36d22e9689e136b35c76adc712c6977f4ec6f1bd41655bdb1caff65fac 160,702 bytes - `screenshot.png` 9dfa4845de672eb2ec27885a9cff17fe9af803635a290c1cfc17f6ee5902d54e 262,114 bytes - `text.txt` 2c10f3991caf3a74b21df9d9e0362fd1bab8aefc5113877a412dac999ca36372 1,018 bytes ### [OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP](x-openai-php2shell/index.html) [original ↗](https://x.com/OpenAI/status/2112907856018309586) **OpenAI (@OpenAI)** · social · primary · captured · published 2026-10-21T14:04Z · added by `collector-researchers` · `x-openai-php2shell` Shown '14:04 · 21 Oct 2026', 5.2m views. Full text captured (stands in for the blocked openai.com post). Carries an X Community Note disputing OpenAI's discovery role and linking lcfr_hax. capture 20261022T081645Z · HTTP 200 · https://x.com/OpenAI/status/2112907856018309586- `headers.json` 427b75f5bb12cb7b0acee221f2065095d92c82279e0db87f9b80909525886df3 9,023 bytes - `page.html` 8e6a0183b6982e8530d7b48277e4b0f6f010b22d3348b30328cc4460cc371d90 160,064 bytes - `provenance.json` 3e52aad242520de5ca4db4103baf86c58e7d477a8f7c04c19b841034f1ca49e3 1,232 bytes - `rendered.html` 2e31eee6ab72f0703675cd74158267dbe5cfb55bf03b80153deaa1b899be4c10 147,195 bytes - `screenshot.png` aaf750d50e69e80b34fbdf908a9fdc330ac315b765eacb2e3e8361cb40f2cbb2 570,247 bytes - `text.txt` 785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189 3,316 bytes ### [Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet](x-wiz-io-php2shell/index.html) [original ↗](https://x.com/wiz_io/status/2112899813264277528) **Wiz (@wiz_io)** · social · primary · captured · published 2026-10-21T13:32Z · added by `collector-researchers` · `x-wiz-io-php2shell` Shown '13:32 · 21 Oct 2026' (UTC in capture browser) — 28 min before the 14:00 UTC release. Thread says 'Apply the Oct 22 security release immediately' — stale date from the original schedule. capture 20261022T081624Z · HTTP 200 · https://x.com/wiz_io/status/2112899813264277528- `headers.json` f9a8ec8c80b7e7b13a6e772a718ece30ec0796dffd3481acc57a310616eca249 9,022 bytes - `page.html` 6adc23abb012a9e89f22453d2d8d4f0eff574edc67373bc94eef59cfc12ebe85 183,867 bytes - `provenance.json` 5df6949985ad1cf4a150d5b9a7e52f1355bac3b127484b31c70c8052986b1556 1,086 bytes - `rendered.html` 9c5f87ac8afbe6aad1205a23ecbe79d83dc801c77f4d0ffb750ffb5b53625888 193,354 bytes - `screenshot.png` d2187dc09d49ec23ea5593aa7ffef5df60cd2385f290922ec6d77b6861fc7abb 578,314 bytes - `text.txt` 6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809 2,222 bytes ### [GMO「悪用確認されず」から一転 FX口座ログイン情報、流出の可能性 不正操作報告も（J-CASTニュース） - Yahoo!ニュース](yahoo-jp-gmo-fx-login-leak/index.html) [original ↗](https://news.yahoo.co.jp/articles/d6083f71bbeab0f1488fac1edbb1e75d9156e358) **Yahoo! News Japan (J-CAST)** · news · secondary · captured · published not stated · added by `curator@php.newsroom` · `yahoo-jp-gmo-fx-login-leak` Promoted from the source watch (oq9gflln), snapshot 20261022T191523Z. GMO FX VPS compromise: 26,739 servers, logins possibly taken, fraud reported; cause not stated capture 20261022T191523Z · HTTP 200 · https://news.yahoo.co.jp/articles/d6083f71bbeab0f1488fac1edbb1e75d9156e358- `headers.json` 8089e945f23a0dff3b1328e4d3d1ccf2adccd21dee3ce523093c79be2c59f641 1,350 bytes - `page.html` f87878e9d634a797da428109b424f11ac2d1b2ec5f69f14006d048fba00e62f1 158,328 bytes - `provenance.json` b8ce463ecb94a4bb90fa9db888989e777e612c4c2b78513fed0a314d7c463dc3 1,724 bytes - `rendered.html` 4fe1a7d56ce6ed822914bdbec4af2771bc55d380a56364c1284352f72d6af220 632,171 bytes - `screenshot.jpg` f7f8063a4acbf8153c3c3b4d01d948ddf21e998f37822649e9dc4101b49ca5eb 796,250 bytes - `text.txt` f3823c3f22ffbc12645f52b502bdce26ced07bcb0865b7d9fb26529e49c85c0b 16,504 bytes ### [PHP vulnerability: Which websites and services are affected?](yahoo-mashable-affected-list/index.html) [original ↗](https://tech.yahoo.com/cybersecurity/articles/php-vulnerability-websites-services-affected-183230666.html) **tech.yahoo.com** · news · secondary · captured · published not stated · added by `collector-news` · `yahoo-mashable-affected-list` Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet. capture 20261022T081334Z · HTTP 200 · https://tech.yahoo.com/cybersecurity/articles/php-vulnerability-websites-services-affected-183230666.html- `headers.json` cde379d690d5370a749d5505b292a9ef1fe0714d62672b58d76ea7e55e1eadfa 4,323 bytes - `page.html` 6198af91fb2af8f05ce115ff0db9c18ce2b421b477e4303f59bd6e396225de06 551,620 bytes - `provenance.json` 04fba138ed4d27a76e8797ab54d65eb7d6eaa507b4e3ba604d79bba53ac1cf47 1,108 bytes - `rendered.html` aa107002ef0db63caa902fee00205df466b8cb37838c7c34a1fe7fab3d432f28 946,086 bytes - `screenshot.png` e343558921b9040566f12c213a9d8572a3f0e1192301c2cd54537a8f2adc4ce1 2,896,297 bytes - `text.txt` 8b1d776cdacbd0a5685d30dc147ad864aa9ddd07a905b9bc8d27bbaf1b49fe46 14,640 bytes ### [Finland temporarily shuts down government websites as a precaution for critical vulnerabilities | Yle News | Yle](yle-finland-government-sites-shut/index.html) [original ↗](https://yle.fi/a/74-20252600) **Yle (Finnish public broadcaster)** · news · secondary · captured · published 2026-10-21 · added by `claude-story-site` · `yle-finland-government-sites-shut` Finland temporarily shuts government websites as a precaution; Valtori; NCSC-FI rated 9.2, no sign of exploitation. capture 20261022T113225Z · HTTP 200 · https://yle.fi/a/74-20252600- `headers.json` 629207adb678c676219268f5339e1768a1aa4af6f503c8ab3dc33a9690a1dc94 4,002 bytes - `page.html` 2845424a60768d77b6561e42e259b0675624771b8b77baa4741fbaf4cd0103c8 325,894 bytes - `provenance.json` e77236132533b194633ab7767e55f09e2854beb49c9ce44fc2725e3606534e78 1,011 bytes - `rendered.html` 156e30b543681b560d3356d18ca5ff9531fa172e3e81f59ceae7ec8662120dd9 269,020 bytes - `screenshot.png` f6f90718b94a07351d302934a8a237c2e0360d1ac9ae51e79faf8a29afdaf46e 2,031,875 bytes - `text.txt` 720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57 6,283 bytes ### [PHP2Shell : deux failles critiques menacent les serveurs web – ZATAZ.COM](zataz-php2shell-deux-failles-critiques-menacen/index.html) [original ↗](https://www.zataz.com/php2shell-deux-failles-critiques-menacent-les-serveurs-web/) **ZATAZ** · news · secondary · captured · published 2026-10-21T14:55:11+02:00 · added by `curator@php.newsroom` · `zataz-php2shell-deux-failles-critiques-menacen` Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). ZATAZ (French), 21 October: two security flaws, CVE-2026-109618 and CVE-2026-109619, put web server administrators on alert; each scores 9.2 out of 10... capture 20261023T160435Z · HTTP 200 · https://www.zataz.com/php2shell-deux-failles-critiques-menacent-les-serveurs-web/- `headers.json` b35ab9ad8831b3f51cff8c2865955db824fdf0fe161874763b18f60057242a4d 1,620 bytes - `page.html` eb74c6a603c31633b6328274b63eee5dead0f618d3f75b450ba7edcc08c2b1d7 231,368 bytes - `provenance.json` 703934a6ab003ff02b39c20417903b175793891a2c06da55d39d114ead203b9c 1,739 bytes - `rendered.html` e702dee420da79c21f16753f44e547ee42e2cc53d6b6868c69d04900bff34985 532,477 bytes - `screenshot.jpg` 5044af60498ac8c78d52ef1c9f02ba13d637d2043fc1f2c60de624460ebdee20 1,013,007 bytes - `text.txt` 2479abb34d03467d05614d11e4d97c3e0d4a40b9a2b50da1dc11c0da37db889f 15,535 bytes --- site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/index.html