Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
PHP2Shell im Homelab: QNAP, Nextcloud und OPNsense jetzt prüfen - Notebookcheck News
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck (German), 23 October, by Steffen Zahn: a guide to finding and patching the PHP2Shell flaws in home-lab software. QNAP published bulletin...
What it says, as the collector read it
PHP2Shell im Homelab: QNAP, Nextcloud und OPNsense jetzt prüfen - Notebookcheck News
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page at/news/notebookcheck/php2shell-im-homelab-qnap-nextcloud-und-opnsense-jetzt-pruef, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Notebookcheck (German), 23 October, by Steffen Zahn: a guide to finding and patching the PHP2Shell flaws in home-lab software. QNAP published bulletin QSA-26-18 on 22 October with no fixed version yet and advises taking the NAS off the internet; Download Station and PHP Extensions will get no fix at all (support ended 30 September). OPNsense released 26.7.7 (Community, PHP 8.5.12) and 26.4.2p3 (Business, PHP 8.3.36) on Wednesday evening; Netgate shipped new PHP for pfSense, installable only by SSH or console. Synology had published no bulletin by 22 October. The article says watchTowr has seen active attempts since Wednesday but reported no successful break-ins, that the German BSI knew of no confirmed exploitation in its 21 October warning, and that QNAP says it knows of no attacks on its own devices. It also appears as a Polish edition (notebookcheck-php2shell-co-powinni-sprawdzic-uzytkowni).
> Fertige Updates gibt es noch nicht, der Status lautet „Fixing“.
_Curator's translation:_ "There are no finished updates yet; the status is 'Fixing'."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell im Homelab: QNAP, Nextcloud und OPNsense jetzt prüfen - Notebookcheck News". Selected mechanically, not read by a person.
Capture notes
Language de. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261023T160435Z · HTTP 200 · https://www.notebookcheck.com/PHP2Shell-im-Homelab-QNAP-Nextcloud-und-OPNsense-jetzt-pruefen.1430521.0.html
headers.jsonb01da97be5afb160c7ee5dec6745f649db859f0ccc803e443af5f900f1a5b172 1,126 bytespage.html7996535183f090225392c7c1e0d277ad1851b706aa93dc407ae0ea69a7c1dc2d 136,810 bytesprovenance.jsonde7b349d5b6622f24cdf5d85821664dda1c1e9e9358a7fc173d15117694afe91 1,739 bytesrendered.html9663e33bd283392efb6ee72e85f195314a8a4910924aee905a9889a02b32d2bb 154,680 bytestext.txt0b475e957e8ad759a8b5414ebe6f67ea8e3e7ff504f7b0600339fda7d083eacb 11,247 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →