# Source: מה השתבש באירוע PHP2Shell ולמה נסגרו אתרים? | Let's AI בינה מלאכותית

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Let's AI: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# מה השתבש באירוע PHP2Shell ולמה נסגרו אתרים? | Let's AI בינה מלאכותית

**Let's AI** · [https://letsai.co.il/php2shell-security-flaws/](https://letsai.co.il/php2shell-security-flaws/) · published 2026-10-29 · added by `curator@php.newsroom` · slug `letsai-php2shell-security-flaws`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261102T155746Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A Hebrew-language explainer on an Israeli AI-community site (Let's AI, 29 October) written for business owners on what went wrong in the PHP2Shell epi...

## What it says, as the collector read it

#### מה השתבש באירוע PHP2Shell ולמה נסגרו אתרים? | Let's AI בינה מלאכותית

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `il/news/letsai/php2shell-security-flaws`, snapshot `20261102T155746Z`. Copied byte for byte; every file's sha256 is in `captures/20261102T155746Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A Hebrew-language explainer on an Israeli AI-community site (Let's AI, 29 October) written for business owners on what went wrong in the PHP2Shell episode and how to check a site is protected. It recaps the 2024 first signs, Calif's GPT-5.6 Sol-assisted work and Wiz's separate finding, the early circulation of the CVE numbers on 20 October with wrong severity and date information, Calif's mistakenly published demonstration video, Chainguard's early packages more than six hours before the agreed time, and Amazon's honeypot attempt on 17 October. It lists precautionary outages (the government of Newfoundland and Labrador on 21 October, a limit on access from abroad to some Latvian government services the same day, Lancashire County Council's closure of some sites on 22 October on the NCSC's advice), stresses that an outage does not prove an intrusion, and notes CISA's KEV listing on 26 October and Palo Alto's report of exploitation against exposed PAN-OS management interfaces. It cites a Wiz report of 27 October showing about a 67% fall in exposed vulnerable machines in Wiz's own measurement, cautioning that the fall may come from updates, shutdowns or access limits and does not show what happened at any site, and adds that on 26 October Windows packages were published with a separate fix in the Brotli component without changing PHP's version number. It ends with steps for site owners: list all sites and systems, get written answers from each provider, and decide with a professional how to limit access until a fix is in.

> עצם זה שאתר ירד מהאוויר לא מוכיח שתוקף נכנס אליו.

_Curator's translation:_ "The mere fact that a site went offline does not prove that an attacker got in."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "מה השתבש באירוע PHP2Shell ולמה נסגרו אתרים? | Let's AI בינה מלאכותית". Selected mechanically, not read by a person.

#### Capture notes

Language `he`. Secondhand and aimed at non-specialists. The page carries a newsletter-and-community sign-up and a chart caption whose figure (a 47.9% fall in the share of organisations significantly affected) is attributed to Wiz without a definition. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261102T155746Z · HTTP 200 · https://letsai.co.il/php2shell-security-flaws/- `headers.json` a6ccb9e9bfed7dc29a02f8f030e6d38e56b7e8b4c6e9723fa149b14c45fa77ca 392 bytes
- `page.html` 0c1d9d66953cdbd051cde531c39227b36682c73e121be8e25864b8ae5de48e87 486,429 bytes
- `provenance.json` 55c8cf50afd150d92831d1cf9916400643f20069a57b31a3a43795ffad535731 1,619 bytes
- `rendered.html` 5ec8785f31b406eaf4654f287dda8a206c605e729a31bc7edace6903583186f2 512,318 bytes
- `screenshot.jpg` 8355824bf0630bc67cb96fa5b03ebbf53f56f08c6f7eba54e26cc720159bd19c 822,375 bytes
- `text.txt` 287891a809b4b07aec269cf2df43f51f7d026c6ff8ac2c2b5c52b6e11a39df62 21,234 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.57 · data as of 2026-11-02T15:57Z · vault commit e4bbd16da443 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/letsai-php2shell-security-flaws/index.html