# Source: PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

notebookcheck: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws

**notebookcheck** · [https://www.notebookcheck.nl/PHP2Shell-Kritieke-PHP-kwetsbaarheden-treffen-mod_php-servers-het-hardst.1430631.0.html](https://www.notebookcheck.nl/PHP2Shell-Kritieke-PHP-kwetsbaarheden-treffen-mod_php-servers-het-hardst.1430631.0.html) · published 2026-10-22 · added by `curator@php.newsroom` · slug `notebookcheck-php2shell-kritieke-php-kwetsbaarheden-tr`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck Nederland (Dutch, DeepL translation of Steffen Zahn's German piece), 22 October. PHP brought its security release forward to Wednesday 2...

## What it says, as the collector read it

#### PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/news/notebookcheck/php2shell-kritieke-php-kwetsbaarheden-treffen-mod-php-server`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Notebookcheck Nederland (Dutch, DeepL translation of Steffen Zahn's German piece), 22 October. PHP brought its security release forward to Wednesday 21 October, 14:00 UTC, after details of two flaws leaked on Hacker News the day before; the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, both flaws are in the interpreter, both score 9.2 on CVSS 4.0, and PHP confirmed code execution without authentication. It explains why Apache with mod_php is the most exposed set-up, and that PHP-FPM is less so for the first flaw. It reports watchTowr seeing active attempts and Cloudflare seeing attacks before the patch, with no successful break-in confirmed yet; Dutch government services including DigiD and MijnOverheid went offline as a precaution and the UK NCSC advises taking unpatched systems offline as a last resort. It says Wiz Research found the flaws and reported them on 24 August, with Gemini 4 Argon and GPT-5.6 Sol helping.

> PHP heeft zijn beveiligingsrelease vervroegd naar woensdag 21 oktober om 14.00 uur UTC, nadat een dag eerder details over twee kwetsbaarheden waren uitgelekt op Hacker News.

_Curator's translation:_ "PHP moved its security release forward to Wednesday 21 October at 14:00 UTC, after details of the two vulnerabilities leaked on Hacker News a day earlier."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws". Selected mechanically, not read by a person.

#### Capture notes

Language `nl`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261025T093507Z · HTTP 200 · https://www.notebookcheck.nl/PHP2Shell-Kritieke-PHP-kwetsbaarheden-treffen-mod_php-servers-het-hardst.1430631.0.html- `headers.json` 6d8119c1614093dfc87e6eda0d1b27ca9b42884395d0e7adf24a95011224640d 980 bytes
- `page.html` 1d3748e0f07ee8524e56559ee3e0b686ee1c40753acad97b72940ebc210b4cc4 108,257 bytes
- `provenance.json` 563593746c42d0f64fc88934f5d0e0f5babec711fbcb419bb7a2826398705032 1,860 bytes
- `rendered.html` 4c458801868b07f44700f25579050a53be37b591861d1fe45dee82cc6910221f 108,245 bytes
- `screenshot.jpg` 7b789eaf2ab2ffbf7d97f1072c91480446d2ae97619b9a22c64dd73fdbe6d157 512,753 bytes
- `text.txt` 2f5f55ec2c0146e3c450bf8f7bccdb681d712ae050b0b9a5ad18c8a2ed24015f 8,826 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/notebookcheck-php2shell-kritieke-php-kwetsbaarheden-tr/index.html