PHP2Shell : le mea culpa de la PHP Foundation sur une faille ignorée

PHP2Shell : le mea culpa de la PHP Foundation sur une faille ignorée

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page fr/news/itforbusiness/php2shell-mea-culpa-php-foundation-108993, snapshot 20261028T032724Z. Copied byte for byte; every file's sha256 is in captures/20261028T032724Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A French IT-management piece (ITforBusiness, 27 October) on the PHP Foundation's own post-mortem of PHP2Shell, which it calls a mea culpa. According to the article the foundation says a memory-handling defect behind CVE-2026-109618 was glimpsed in 2024 during an externally funded audit but left unfixed because no exploitation path was known and the security team could not agree between competing fixes; that AI-assisted research in 2026 demonstrated exploitability within days; and that the coordinated disclosure leaked two days early (CVE ids circulating on 20 October with a wrong publication time and a CVSS of 10.0 instead of 9.2, then a proof-of-concept video posted by mistake by one of the researchers), forcing the advisory forward to 21 October. The author's argument is that PHP2Shell is an organisational alert about governance, concentrated expertise and funding as much as a code flaw.

> Les outils d’IA trouvent désormais les failles et comment les exploiter bien plus vite qu’auparavant, que l’on se place du côté des attaquants comme du côté des défenseurs.

_Curator's translation:_ "AI tools now find flaws, and how to exploit them, much faster than before, whether one stands on the attackers' side or the defenders'."

Why it is here

From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell : le mea culpa de la PHP Foundation sur une faille ignorée". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language fr-FR. Secondhand on the PHP Foundation's post, which is the primary source and is not this page. The page gives no technical detail of how the flaws are triggered. Nothing in it addresses an AI or hides text from a reader.