PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům možnost spustit kód na serverech - Lupa.cz

PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům možnost spustit kód na serverech - Lupa.cz

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page cz/news/lupa/aktuality-php2shell-kriticke-zranitelnosti-v-php-davaji-utoc, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Lupa.cz (Czech): PHP2Shell, critical vulnerabilities in PHP give attackers the ability to run code on servers. The two flaws are CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

> Konkrétně se jedná o dvě zranitelnosti CVE-2026–109618 a CVE-2026–109619. Chyby jsou opraveny ve verzích PHP 8.5.12, 8.4.27, 8.3.36 a 8.2.35.

_Curator's translation:_ "Specifically these are two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The bugs are fixed in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Lupa.cz reports that the Czech Government Office (Úřad vlády) took its website offline from 19:00 on 21 October on NÚKIB's advice, and that it was back online by 08:00 on 22 October. It quotes NÚKIB and links a related story saying Czech Technical University (ČVUT) faced a cyber attack reportedly linked to the PHP flaw.

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům možnost spustit kód na serverech - Lupa.cz". Selected mechanically, not read by a person.

Capture notes

Language cs. Nothing in the page addresses an AI or hides text from a reader.