PHP2Shell: falhas críticas no PHP desencadeiam milhões de tentativas de ataque

PHP2Shell: falhas críticas no PHP desencadeiam milhões de tentativas de ataque

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page pt/news/inforgames/php2shell-falhas-criticas-no-php-desencadeiam-milhoes-de-ten, snapshot 20261029T071401Z. Copied byte for byte; every file's sha256 is in captures/20261029T071401Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Portuguese gaming-and-tech site (InforGames, 26 October) summarising a GlobalData social-media analysis of PHP2Shell: the two critical flaws (CVSS 4.0 of 9.2) can allow unauthenticated remote code execution; Cloudflare's chief executive's account of exploitation attempts rising from thousands in the ten hours before the announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours and then millions, which the article stresses are attempts seen on Cloudflare's network, not necessarily successful attacks or the number of compromised systems; Vercel's chief executive saying its WAF mitigations blocked attempts against protected PHP servers; CrowdStrike's chief executive noting that one underlying problem had been identified by PHP's maintainers in 2024; and the role of AI-assisted research. It adds that 8.1 and earlier are affected but out of normal support, and gives advice for administrators and hosting customers.

> Estes números referem-se à atividade observada pela Cloudflare na sua rede e não representam necessariamente ataques bem-sucedidos ou o número total de sistemas comprometidos.

_Curator's translation:_ "These figures refer to the activity Cloudflare observed on its network and do not necessarily represent successful attacks or the total number of compromised systems."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: falhas críticas no PHP desencadeiam milhões de tentativas de ataque". Selected mechanically, not read by a person.

Capture notes

Language pt-PT. Secondhand, built on an analyst firm's reading of public posts; it carries bracketed source tags from a vendor's pages. Nothing in the page addresses an AI or hides text from a reader.