인증 없이 서버 장악 가능…티오리, 치명적 PHP 취약점 ‘PHP2Shell’ 대응책 공개 < no_feed < 컴퓨팅/AI < 뉴스 < 기사본문 - 뉴스탭

인증 없이 서버 장악 가능…티오리, 치명적 PHP 취약점 ‘PHP2Shell’ 대응책 공개 < no_feed < 컴퓨팅/AI < 뉴스 < 기사본문 - 뉴스탭

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page kr/news/newstap/news-articleview-html, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Newstap (Korean), 23 October. The Korean security firm Theori says it has reproduced and verified exploit code for PHP2Shell itself and published an emergency response guide with interim mitigations and a check script. It says a proof-of-concept video and security-patched binaries leaked before the official advisory and that PoC code is spreading quickly, and it expects others to build the same exploit. Affected versions are given as PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 and below, plus unsupported 8.1 and older (7.x, 5.x). Theori stresses that interim measures cannot fully block the flaws and may cause side effects such as session-function errors, and that patching comes first.

> 특히 이번 취약점은 공식 보안 권고가 발표되기 전부터 개념증명(PoC) 시연 영상과 보안 패치가 적용된 바이너리가 유출되면서 보안 위협이 확산하고 있다.

_Curator's translation:_ "In particular, the threat is spreading because a proof-of-concept (PoC) demonstration video and security-patched binaries leaked before the official security advisory was published."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "인증 없이 서버 장악 가능…티오리, 치명적 PHP 취약점 ‘PHP2Shell’ 대응책 공개 < no_feed < 컴퓨팅/AI < 뉴스 < 기사본문 - 뉴스탭". Selected mechanically, not read by a person.

Capture notes

Language ko. The footer carries a copyright line ('무단전재 및 재배포, AI학습 및 활용 금지': no reproduction, redistribution, or AI training or use). It is a rights notice, not an instruction to act; recorded here and flagged to the editor. Nothing else addresses an AI or hides text from a reader.