Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck Nederland (Dutch, DeepL translation of Steffen Zahn's German piece), 22 October. PHP brought its security release forward to Wednesday 2...
What it says, as the collector read it
PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page nl/news/notebookcheck/php2shell-kritieke-php-kwetsbaarheden-treffen-mod-php-server, snapshot 20261025T093507Z. Copied byte for byte; every file's sha256 is in captures/20261025T093507Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Notebookcheck Nederland (Dutch, DeepL translation of Steffen Zahn's German piece), 22 October. PHP brought its security release forward to Wednesday 21 October, 14:00 UTC, after details of two flaws leaked on Hacker News the day before; the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, both flaws are in the interpreter, both score 9.2 on CVSS 4.0, and PHP confirmed code execution without authentication. It explains why Apache with mod_php is the most exposed set-up, and that PHP-FPM is less so for the first flaw. It reports watchTowr seeing active attempts and Cloudflare seeing attacks before the patch, with no successful break-in confirmed yet; Dutch government services including DigiD and MijnOverheid went offline as a precaution and the UK NCSC advises taking unpatched systems offline as a last resort. It says Wiz Research found the flaws and reported them on 24 August, with Gemini 4 Argon and GPT-5.6 Sol helping.
> PHP heeft zijn beveiligingsrelease vervroegd naar woensdag 21 oktober om 14.00 uur UTC, nadat een dag eerder details over twee kwetsbaarheden waren uitgelekt op Hacker News.
_Curator's translation:_ "PHP moved its security release forward to Wednesday 21 October at 14:00 UTC, after details of the two vulnerabilities leaked on Hacker News a day earlier."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws". Selected mechanically, not read by a person.
Capture notes
Language nl. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261025T093507Z · HTTP 200 · https://www.notebookcheck.nl/PHP2Shell-Kritieke-PHP-kwetsbaarheden-treffen-mod_php-servers-het-hardst.1430631.0.html
headers.json6d8119c1614093dfc87e6eda0d1b27ca9b42884395d0e7adf24a95011224640d 980 bytespage.html1d3748e0f07ee8524e56559ee3e0b686ee1c40753acad97b72940ebc210b4cc4 108,257 bytesprovenance.json563593746c42d0f64fc88934f5d0e0f5babec711fbcb419bb7a2826398705032 1,860 bytesrendered.html4c458801868b07f44700f25579050a53be37b591861d1fe45dee82cc6910221f 108,245 bytesscreenshot.jpg7b789eaf2ab2ffbf7d97f1072c91480446d2ae97619b9a22c64dd73fdbe6d157 512,753 bytestext.txt2f5f55ec2c0146e3c450bf8f7bccdb681d712ae050b0b9a5ad18c8a2ed24015f 8,826 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →