# Source: PHP2Shell : le mea culpa de la PHP Foundation sur une faille ignorée

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

ITforBusiness.fr: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell : le mea culpa de la PHP Foundation sur une faille ignorée

**ITforBusiness.fr** · [https://www.itforbusiness.fr/php2shell-mea-culpa-php-foundation-108993](https://www.itforbusiness.fr/php2shell-mea-culpa-php-foundation-108993) · published 2026-10-27 · added by `curator@php.newsroom` · slug `itforbusiness-php2shell-mea-culpa-php-foundation-10899`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T032724Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). A French IT-management piece (ITforBusiness, 27 October) on the PHP Foundation's own post-mortem of PHP2Shell, which it calls a mea culpa. According t...

## What it says, as the collector read it

#### PHP2Shell : le mea culpa de la PHP Foundation sur une faille ignorée

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/itforbusiness/php2shell-mea-culpa-php-foundation-108993`, snapshot `20261028T032724Z`. Copied byte for byte; every file's sha256 is in `captures/20261028T032724Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A French IT-management piece (ITforBusiness, 27 October) on the PHP Foundation's own post-mortem of PHP2Shell, which it calls a mea culpa. According to the article the foundation says a memory-handling defect behind CVE-2026-109618 was glimpsed in 2024 during an externally funded audit but left unfixed because no exploitation path was known and the security team could not agree between competing fixes; that AI-assisted research in 2026 demonstrated exploitability within days; and that the coordinated disclosure leaked two days early (CVE ids circulating on 20 October with a wrong publication time and a CVSS of 10.0 instead of 9.2, then a proof-of-concept video posted by mistake by one of the researchers), forcing the advisory forward to 21 October. The author's argument is that PHP2Shell is an organisational alert about governance, concentrated expertise and funding as much as a code flaw.

> Les outils d’IA trouvent désormais les failles et comment les exploiter bien plus vite qu’auparavant, que l’on se place du côté des attaquants comme du côté des défenseurs.

_Curator's translation:_ "AI tools now find flaws, and how to exploit them, much faster than before, whether one stands on the attackers' side or the defenders'."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell : le mea culpa de la PHP Foundation sur une faille ignorée". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `fr-FR`. Secondhand on the PHP Foundation's post, which is the primary source and is not this page. The page gives no technical detail of how the flaws are triggered. Nothing in it addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261028T032724Z · HTTP 200 · https://www.itforbusiness.fr/php2shell-mea-culpa-php-foundation-108993- `headers.json` d5907dfe4f03fe41c079dab14d2a2fc8278e236e7932be91e1ea1c752cb0e5ce 468 bytes
- `page.html` 81eed6d37271a9e4aa4c8180b3acda466c38dbdcad21d6b5123989a2191ee35a 205,484 bytes
- `provenance.json` 3630d7f80376b747069e680f07b5065587089b5a7cab6fb62a8c81799de0e573 1,700 bytes
- `rendered.html` ab19531cfc0cd27c0307cd28f0562bd63926f1b6c78789cd18b14c81d11e62eb 225,073 bytes
- `screenshot.jpg` 0b6a521f0cfd3447e2e660e037aa06d9084a3eed34dfa3b0045e5ea54531a74b 774,670 bytes
- `text.txt` 538572db7e19240089aca7cd44d0030185c1d4cf92562237f961acab64654bfd 14,330 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.51 · data as of 2026-10-28T17:15Z · vault commit 75668aedfb6d · https://refs.php.oct.2026.newsroom.sgit.ai/sources/itforbusiness-php2shell-mea-culpa-php-foundation-10899/index.html