# Source: Erste PHP2Shell-Angriffe bestätigt – das sollten Händler jetzt tun

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

ohn.haendlerbund: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Erste PHP2Shell-Angriffe bestätigt – das sollten Händler jetzt tun

**ohn.haendlerbund** · [https://ohn.haendlerbund.de/themen/ki-tech/erste-php2shell-angriffe-bestaetigt](https://ohn.haendlerbund.de/themen/ki-tech/erste-php2shell-angriffe-bestaetigt) · published 2026-10-27 · added by `curator@php.newsroom` · slug `ohn-haendlerbund-themen-ki-tech-erste-php2shell-angriffe`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T032724Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A German-language trade-press piece for online retailers (Händlerbund's news portal, 27 October), relaying Golem.de: after doubts about whether PHP2Sh...

## What it says, as the collector read it

#### Erste PHP2Shell-Angriffe bestätigt – das sollten Händler jetzt tun

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/ohn-haendlerbund/themen-ki-tech-erste-php2shell-angriffe-bestaetigt`, snapshot `20261028T032724Z`. Copied byte for byte; every file's sha256 is in `captures/20261028T032724Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A German-language trade-press piece for online retailers (Händlerbund's news portal, 27 October), relaying Golem.de: after doubts about whether PHP2Shell attacks could succeed (high complexity, many AI-generated exploits not working), successful attacks have been confirmed on a researcher's honeypot, where attackers ran their own code, and on a deliberately vulnerable PHP site holding 0.025 bitcoin that was taken after just over 19 hours. It cites Censys for about 42 million affected sites, of which just over 10 million were patched between 21 October and the article, leaving about 32 million, and says several authorities and companies temporarily took sites offline.

> Beide Fälle zeigen, dass ein funktionierender Exploit für die PHP-Sicherheitslücken existiert.

_Curator's translation:_ "Both cases show that a working exploit for the PHP vulnerabilities exists."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Erste PHP2Shell-Angriffe bestätigt – das sollten Händler jetzt tun". Selected mechanically, not read by a person.

#### Capture notes

Language `de`. Secondhand: the article relays Golem.de and Censys rather than reporting its own findings. The researchers are named in the page; the claims here leave their names out. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261028T032724Z · HTTP 200 · https://ohn.haendlerbund.de/themen/ki-tech/erste-php2shell-angriffe-bestaetigt- `headers.json` 6c123ddaf523fdc505306845994dc04582716f6186017b4a83b77da82a7624e0 682 bytes
- `page.html` 243589352116bd254df7baf42b436628207e6285d93a979c5c2707380f45137a 150,995 bytes
- `provenance.json` 711295b847feb0c7f7c97d3d8e63039552f63c99b8944e2f39467e5fe030df9b 1,743 bytes
- `rendered.html` e439a78e94ff135bb4f023defbd0c2c00fb1266cb2b41274c0be3aa497eebe2b 374,992 bytes
- `screenshot.jpg` fa8888a319d987db5022407415a8627a3388c8ede078ee99198bf50909ae8a8c 366,131 bytes
- `text.txt` 8d08c48935e920b53bf4174a19c4534caadcfe7fdf8105eafc968fbb51271ce2 5,242 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.51 · data as of 2026-10-28T17:15Z · vault commit 75668aedfb6d · https://refs.php.oct.2026.newsroom.sgit.ai/sources/ohn-haendlerbund-themen-ki-tech-erste-php2shell-angriffe/index.html