# Source: Уязвимостите в PHP вече се използват в реални атаки - има и успешни пробиви - kaldata.com

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Kaldata.com: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Уязвимостите в PHP вече се използват в реални атаки - има и успешни пробиви - kaldata.com

**Kaldata.com** · [https://www.kaldata.com/it-%d0%bd%d0%be%d0%b2%d0%b8%d0%bd%d0%b8/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d0%b8%d1%82%d0%b5-%d0%b2-php-%d0%b2%d0%b5%d1%87%d0%b5-%d1%81%d0%b5-%d0%b8%d0%b7%d0%bf%d0%be%d0%bb%d0%b7%d0%b2%d0%b0%d1%82-%d0%b2-%d1%80%d0%b5-717672.html](https://www.kaldata.com/it-%d0%bd%d0%be%d0%b2%d0%b8%d0%bd%d0%b8/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d0%b8%d1%82%d0%b5-%d0%b2-php-%d0%b2%d0%b5%d1%87%d0%b5-%d1%81%d0%b5-%d0%b8%d0%b7%d0%bf%d0%be%d0%bb%d0%b7%d0%b2%d0%b0%d1%82-%d0%b2-%d1%80%d0%b5-717672.html) · published 2026-10-26T20:13:07+00:00 · added by `curator@php.newsroom` · slug `kaldata-it-d0-bd-d0-be-d0-b2-d0-b8-d0-bd-d0-b8-d`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261027T094306Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Kaldata (Bulgaria, Bulgarian), 26 October, by Emil Vasilev: the PHP flaws are now used in real attacks, with successful breaches. It relays BleepingCo...

## What it says, as the collector read it

#### Уязвимостите в PHP вече се използват в реални атаки - има и успешни пробиви - kaldata.com

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `bg/news/kaldata/it-d0-bd-d0-be-d0-b2-d0-b8-d0-bd-d0-b8-d1-83-d1-8f-d0-b7-d0`, snapshot `20261027T094306Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T094306Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Kaldata (Bulgaria, Bulgarian), 26 October, by Emil Vasilev: the PHP flaws are now used in real attacks, with successful breaches. It relays BleepingComputer: Perplexity's Adel Karimi reported that his decoy servers recorded a successful attack on Apache mod_php with PHP 8.4.26, in which the attacker extracted about 800 KiB of process memory and then used an extracted function address in a following request, the server running the shell command about 1.6 milliseconds after the last byte; Expel's Marcus Hutchins confirmed the result. Cloudflare, Hadrian, watchTowr, Previdian and Patchstack had earlier reported attempts that had not led to successful exploitation, and Amazon had seen the first attempts on 17 October, four days before the fixes. It also describes the PHP security team's mitigation advice for a third flaw (CVE-2026-115560) that affects systems with an unusual configuration and has no patch yet: set session.upload_progress.enabled to 0 until it is fixed. A social-media post embedded in the page, an apparent tweet from a researcher about confirmed activity from the same IP and a second IP, is part of the article's embed.

> Компаниите Cloudflare, Hadrian, watchTowr, Previdian и Patchstack също съобщиха за опити за атаки, които към този момент не са довели до успешна експлоатация.

_Curator's translation:_ "Cloudflare, Hadrian, watchTowr, Previdian and Patchstack also reported attack attempts that, at that point, had not led to successful exploitation."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Уязвимостите в PHP вече се използват в реални атаки - има и успешни пробиви - kaldata.com". Selected mechanically, not read by a person.

#### Capture notes

Language `bg-BG`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T094306Z · HTTP 200 · https://www.kaldata.com/it-%d0%bd%d0%be%d0%b2%d0%b8%d0%bd%d0%b8/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d0%b8%d1%82%d0%b5-%d0%b2-php-%d0%b2%d0%b5%d1%87%d0%b5-%d1%81%d0%b5-%d0%b8%d0%b7%d0%bf%d0%be%d0%bb%d0%b7%d0%b2%d0%b0%d1%82-%d0%b2-%d1%80%d0%b5-717672.html- `headers.json` 0911c65edf4c1bb07ad414c875a3d41f6a237fd9f7c005d32b981dd9db5fe08a 1,003 bytes
- `page.html` 704ef5f9ffa257dfab6e1532b1255d3ad441665a69ecb734d5057c557dfe97e8 629,610 bytes
- `provenance.json` eba2da7e1625bc1421e902d21ce20c8c28f95ada6d123930bc0e259ef64b0b7e 2,200 bytes
- `rendered.html` 7580dc6bb6b5df2dcd4a563119fe94ebff8eac37b604b4b4aeb66b7bcb1fa1f8 1,795,977 bytes
- `screenshot.jpg` 47dd3ed2cb00efd0bdb9f04a73fec8569976775f628bdb21647b6d350aa5c487 721,135 bytes
- `text.txt` bf766390c5dbde33b2647c570bd53190d42b0d4c90caaec4c115e05e647dfbde 12,618 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.45 · data as of 2026-10-27T09:43Z · vault commit 55b47c4d6af1 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/kaldata-it-d0-bd-d0-be-d0-b2-d0-b8-d0-bd-d0-b8-d/index.html