# Source: PHP2Shell: falhas críticas no PHP desencadeiam milhões de tentativas de ataque

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

InforGames: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell: falhas críticas no PHP desencadeiam milhões de tentativas de ataque

**InforGames** · [https://inforgames.pt/php2shell-falhas-criticas-no-php-desencadeiam-milhoes-de-tentativas-de-ataque/](https://inforgames.pt/php2shell-falhas-criticas-no-php-desencadeiam-milhoes-de-tentativas-de-ataque/) · published 2026-10-26 · added by `curator@php.newsroom` · slug `inforgames-php2shell-falhas-criticas-no-php-desenca`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261029T071401Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A Portuguese gaming-and-tech site (InforGames, 26 October) summarising a GlobalData social-media analysis of PHP2Shell: the two critical flaws (CVSS 4...

## What it says, as the collector read it

#### PHP2Shell: falhas críticas no PHP desencadeiam milhões de tentativas de ataque

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pt/news/inforgames/php2shell-falhas-criticas-no-php-desencadeiam-milhoes-de-ten`, snapshot `20261029T071401Z`. Copied byte for byte; every file's sha256 is in `captures/20261029T071401Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A Portuguese gaming-and-tech site (InforGames, 26 October) summarising a GlobalData social-media analysis of PHP2Shell: the two critical flaws (CVSS 4.0 of 9.2) can allow unauthenticated remote code execution; Cloudflare's chief executive's account of exploitation attempts rising from thousands in the ten hours before the announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours and then millions, which the article stresses are attempts seen on Cloudflare's network, not necessarily successful attacks or the number of compromised systems; Vercel's chief executive saying its WAF mitigations blocked attempts against protected PHP servers; CrowdStrike's chief executive noting that one underlying problem had been identified by PHP's maintainers in 2024; and the role of AI-assisted research. It adds that 8.1 and earlier are affected but out of normal support, and gives advice for administrators and hosting customers.

> Estes números referem-se à atividade observada pela Cloudflare na sua rede e não representam necessariamente ataques bem-sucedidos ou o número total de sistemas comprometidos.

_Curator's translation:_ "These figures refer to the activity Cloudflare observed on its network and do not necessarily represent successful attacks or the total number of compromised systems."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: falhas críticas no PHP desencadeiam milhões de tentativas de ataque". Selected mechanically, not read by a person.

#### Capture notes

Language `pt-PT`. Secondhand, built on an analyst firm's reading of public posts; it carries bracketed source tags from a vendor's pages. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261029T071401Z · HTTP 200 · https://inforgames.pt/php2shell-falhas-criticas-no-php-desencadeiam-milhoes-de-tentativas-de-ataque/- `headers.json` d4169895fd6d8261e51bdf79424a1012f01e8a121460b4246748ef0bf43b0475 1,144 bytes
- `page.html` b72a4cd345a423924a141581bdeed350132d130b7f14cab76249605fb87e7262 330,475 bytes
- `provenance.json` 7daecc1621e356abb4739da698adc525e6c0d8d7599beeff7e1446a64d6c7307 1,800 bytes
- `rendered.html` 207d74a867f769bc660a9b904f6c0382f70f82a84331b9cc2db9b72cb7f023f9 328,957 bytes
- `screenshot.jpg` ff17434d648fa994bc971e8f1b93793991508a4c3ab4c36c6532c7aa6be63ab5 357,549 bytes
- `text.txt` 8e4fa71db118015d4871cc8b4d89f5f041deb71522e5c1a0b7ecb4e5ea72e9d9 11,882 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.54 · data as of 2026-10-29T17:13Z · vault commit cd9375f1aefd · https://refs.php.oct.2026.newsroom.sgit.ai/sources/inforgames-php2shell-falhas-criticas-no-php-desenca/index.html