Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
PHP2Shell 遭實際利用！Brotli 弱點 HTTP2Shell 同步延燒，PHP、.NET 緊急更新,Information Security 資安人科技網
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261027T094306Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Information Security (資安人, Taiwan, Traditional Chinese), around 27 October: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities cata...
What it says, as the collector read it
PHP2Shell 遭實際利用！Brotli 弱點 HTTP2Shell 同步延燒，PHP、.NET 緊急更新,Information Security 資安人科技網
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page tw/news/informationsecurity/article-article-detail-aspx, snapshot 20261027T094306Z. Copied byte for byte; every file's sha256 is in captures/20261027T094306Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Information Security (資安人, Taiwan, Traditional Chinese), around 27 October: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalogue on 26 October, confirming real-world exploitation, and the Brotli decoder flaw CVE-2026-111497 ('HTTP2Shell') keeps widening. It says Perplexity's Adel Karimi confirmed successful remote execution on his honeypot on 24 October, limited to a deliberately favourable single-worker mod_php setup; US federal agencies must update by 29 October; Censys estimates over 32.51 million PHP services still run affected versions; the PHP Foundation repackaged its official Windows builds for PHP 8.2 to 8.5 on 26 October (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) to ship a patched Brotli 1.2.1, with the PHP2Shell fix unchanged; Microsoft issued .NET updates on 25 October; Imperva has shown remote execution for the Brotli flaw with a public proof of concept but no real-world exploitation is reported. The article is a compilation from The Hacker News and BleepingComputer.
> 美國網路安全暨基礎設施安全局（CISA）於美國時間 10 月 26 日，將 PHP 的「PHP2Shell」弱點 CVE-2026-109618 與 CVE-2026-109619 列入已知遭利用弱點目錄（KEV），確認已有實際利用。
_Curator's translation:_ "On 26 October US time, CISA added PHP's 'PHP2Shell' flaws CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalogue, confirming real-world exploitation."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell 遭實際利用！Brotli 弱點 HTTP2Shell 同步延燒，PHP、.NET 緊急更新,Information Security 資安人科技網". Selected mechanically, not read by a person.
Capture notes
Language en. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261027T094306Z · HTTP 200 · https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=13417
headers.jsonfd8ddb8f85dfa87dea9a3c607e66cf185a31f4239f73fcdbaaf972aea25ef7b5 459 bytespage.html967df0cb7eb566cc0ae8b952e26a3d1ebd3a242fae06ff631000e335e6c6c0a4 41,047 bytesprovenance.json64313d593fc11fe9d4d14fc9aa017ea5fedf2e87088c1dc9a45b54168d69952c 1,751 bytesrendered.html8657538f1a40c0720d00aff2cd0f773657ce000f5272d1281ac0b106266710e5 68,510 bytesscreenshot.jpg98a79d1f91990679a1851fa29fc7882dead7829f19cf59f7055f51dfa7724430 510,849 bytestext.txt7c6a10ada7b3c0c23ad2cb5cbb2e660cdfd68a145d37d84d23c12935e69fbcc9 6,420 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →