# Source: [PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

디지털데일리: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# [PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리

**디지털데일리** · [https://m.ddaily.co.kr/page/view/2026102611404279049](https://m.ddaily.co.kr/page/view/2026102611404279049) · published 2026-10-26 13:04:22 (page time zone not stated) · added by `curator@php.newsroom` · slug `m-ddaily-page-view-2026102611404279049`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T144241Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Digital Daily (Korean), 26 October, by Kim Bo-min: 'PHP emergency: now Node.js', a second runtime flaw a week later. It says Theori announced a Node.j...

## What it says, as the collector read it

#### [PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/m-ddaily/page-view-2026102611404279049`, snapshot `20261026T144241Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T144241Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Digital Daily (Korean), 26 October, by Kim Bo-min: 'PHP emergency: now Node.js', a second runtime flaw a week later. It says Theori announced a Node.js vulnerability, 'Node2Shell' (CVE-2026-111497), a Brotli decoder out-of-bounds write that can cause denial of service, memory disclosure or remote code execution, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1; this is a separate flaw from PHP2Shell, which TTMChange's report summarises (CVSS 9.2, mod_php the most exposed, code back to PHP 5.4). It gives a sequence of events: Amazon's honeypot saw an attempt on 17 October, details leaked on 20 October, Cloudflare applied emergency firewall rules and PHP published its advisory on 21 October, watchTowr and SOCRadar then reported exploit tools used in real environments, and on 24 October Palo Alto Networks warned its devices were affected. It also says the cyber-security firm Cyfirma found Korean-speaking members of a closed I2P network simulating attacks on the PHP flaws, aimed at government bodies, banks and other sectors in many countries, and raised the possibility of a link to the Lazarus group ecosystem with 'moderate' confidence.

> 사이버보안 기업 사이퍼마에 따르면, 익명성이 보장되는 폐쇄형 네트워크인 I2P 내부에서 한국어를 사용하는 특정 조직원들이 PHP 취약점을 악용한 사이버 공격을 모의한 것으로 나타났다.

_Curator's translation:_ "According to the cyber-security firm Cyfirma, certain Korean-speaking members inside I2P, a closed network that guarantees anonymity, were found to have simulated cyber attacks exploiting the PHP vulnerabilities."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "[PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리". Selected mechanically, not read by a person.

#### Capture notes

Language `ko`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261026T144241Z · HTTP 200 · https://m.ddaily.co.kr/page/view/2026102611404279049- `headers.json` 574bc5122d6c9e37bb2774023ecf1925bc2b379e8a5d56d3e0e8bb956b1ebf72 526 bytes
- `page.html` 8dae8d2947592cdb21dc8d37513fbe6d6848379bb13177910a75523bc7a7fdc2 51,187 bytes
- `provenance.json` cae04ebe4c01ffe473e20c9a7eef9c6b16eec3bbffcad39b6589ad8fbf528db1 1,662 bytes
- `rendered.html` 0bc02faad92091b2edf2d30003f3d580356f200c3908f138fa79f1a472f3222c 382,190 bytes
- `screenshot.jpg` 6c122d0886b317c0df57e0a8a2076351e54f3a97db3cb838e9a11edd33376438 500,772 bytes
- `text.txt` b23973093bf2a28f25c412e1c2da9c17bbb502376bbc53788e513ae5fac76925 10,232 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/m-ddaily-page-view-2026102611404279049/index.html