# Source: PHP2Shell 遭實際利用！Brotli 弱點 HTTP2Shell 同步延燒，PHP、.NET 緊急更新,Information Security 資安人科技網

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

資安人科技網: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell 遭實際利用！Brotli 弱點 HTTP2Shell 同步延燒，PHP、.NET 緊急更新,Information Security 資安人科技網

**資安人科技網** · [https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=13417](https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=13417) · published 2026-10-27 · added by `curator@php.newsroom` · slug `informationsecurity-article-article-detail-aspx`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261027T094306Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Information Security (資安人, Taiwan, Traditional Chinese), around 27 October: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities cata...

## What it says, as the collector read it

#### PHP2Shell 遭實際利用！Brotli 弱點 HTTP2Shell 同步延燒，PHP、.NET 緊急更新,Information Security 資安人科技網

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tw/news/informationsecurity/article-article-detail-aspx`, snapshot `20261027T094306Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T094306Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Information Security (資安人, Taiwan, Traditional Chinese), around 27 October: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalogue on 26 October, confirming real-world exploitation, and the Brotli decoder flaw CVE-2026-111497 ('HTTP2Shell') keeps widening. It says Perplexity's Adel Karimi confirmed successful remote execution on his honeypot on 24 October, limited to a deliberately favourable single-worker mod_php setup; US federal agencies must update by 29 October; Censys estimates over 32.51 million PHP services still run affected versions; the PHP Foundation repackaged its official Windows builds for PHP 8.2 to 8.5 on 26 October (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) to ship a patched Brotli 1.2.1, with the PHP2Shell fix unchanged; Microsoft issued .NET updates on 25 October; Imperva has shown remote execution for the Brotli flaw with a public proof of concept but no real-world exploitation is reported. The article is a compilation from The Hacker News and BleepingComputer.

> 美國網路安全暨基礎設施安全局（CISA）於美國時間 10 月 26 日，將 PHP 的「PHP2Shell」弱點 CVE-2026-109618 與 CVE-2026-109619 列入已知遭利用弱點目錄（KEV），確認已有實際利用。

_Curator's translation:_ "On 26 October US time, CISA added PHP's 'PHP2Shell' flaws CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalogue, confirming real-world exploitation."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell 遭實際利用！Brotli 弱點 HTTP2Shell 同步延燒，PHP、.NET 緊急更新,Information Security 資安人科技網". Selected mechanically, not read by a person.

#### Capture notes

Language `en`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T094306Z · HTTP 200 · https://www.informationsecurity.com.tw/article/article_detail.aspx?aid=13417- `headers.json` fd8ddb8f85dfa87dea9a3c607e66cf185a31f4239f73fcdbaaf972aea25ef7b5 459 bytes
- `page.html` 967df0cb7eb566cc0ae8b952e26a3d1ebd3a242fae06ff631000e335e6c6c0a4 41,047 bytes
- `provenance.json` 64313d593fc11fe9d4d14fc9aa017ea5fedf2e87088c1dc9a45b54168d69952c 1,751 bytes
- `rendered.html` 8657538f1a40c0720d00aff2cd0f773657ce000f5272d1281ac0b106266710e5 68,510 bytes
- `screenshot.jpg` 98a79d1f91990679a1851fa29fc7882dead7829f19cf59f7055f51dfa7724430 510,849 bytes
- `text.txt` 7c6a10ada7b3c0c23ad2cb5cbb2e660cdfd68a145d37d84d23c12935e69fbcc9 6,420 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.45 · data as of 2026-10-27T09:43Z · vault commit 55b47c4d6af1 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/informationsecurity-article-article-detail-aspx/index.html