Erste PHP2Shell-Angriffe bestätigt – das sollten Händler jetzt tun

Erste PHP2Shell-Angriffe bestätigt – das sollten Händler jetzt tun

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page de/news/ohn-haendlerbund/themen-ki-tech-erste-php2shell-angriffe-bestaetigt, snapshot 20261028T032724Z. Copied byte for byte; every file's sha256 is in captures/20261028T032724Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A German-language trade-press piece for online retailers (Händlerbund's news portal, 27 October), relaying Golem.de: after doubts about whether PHP2Shell attacks could succeed (high complexity, many AI-generated exploits not working), successful attacks have been confirmed on a researcher's honeypot, where attackers ran their own code, and on a deliberately vulnerable PHP site holding 0.025 bitcoin that was taken after just over 19 hours. It cites Censys for about 42 million affected sites, of which just over 10 million were patched between 21 October and the article, leaving about 32 million, and says several authorities and companies temporarily took sites offline.

> Beide Fälle zeigen, dass ein funktionierender Exploit für die PHP-Sicherheitslücken existiert.

_Curator's translation:_ "Both cases show that a working exploit for the PHP vulnerabilities exists."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Erste PHP2Shell-Angriffe bestätigt – das sollten Händler jetzt tun". Selected mechanically, not read by a person.

Capture notes

Language de. Secondhand: the article relays Golem.de and Censys rather than reporting its own findings. The researchers are named in the page; the claims here leave their names out. Nothing in the page addresses an AI or hides text from a reader.