Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
CISA בהתרעת חירום: פרצת PHP2Shell משתוללת ברשת -
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261029T071401Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). An Israeli IT-trade piece (Anashim U'Machshevim, 28 October), headlined as a CISA emergency alert, reporting that CISA confirmed hackers are actively...
What it says, as the collector read it
CISA בהתרעת חירום: פרצת PHP2Shell משתוללת ברשת -
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page il/news/pc/news-d7-90-d7-91-d7-98-d7-97-d7-aa-d7-9e-d7-99-d7-93-d7-a2-d, snapshot 20261029T071401Z. Copied byte for byte; every file's sha256 is in captures/20261029T071401Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
An Israeli IT-trade piece (Anashim U'Machshevim, 28 October), headlined as a CISA emergency alert, reporting that CISA confirmed hackers are actively exploiting two severe PHP flaws, added them to its Known Exploited Vulnerabilities catalog and required US civilian federal bodies to apply the updates by 29 October. It relays Amazon's intelligence unit, via Tenable's blog, that first attack attempts were recorded on 17 October, four days before the emergency updates; Perplexity's detection lead's confirmation of a successful attack on a honeypot; a principal threat researcher at Expel calling it the best confirmation seen since the crisis began for servers on the Apache mod_php configuration; Cloudflare's technology chief's note that WAF rules for the known vectors were deployed to all customers as a stopgap before the patch release; and TechCrunch's account that Calif used AI models to work out how to exploit flaws once thought unexploitable.
> CISA, הסוכנות לאבטחת סייבר ותשתיות של ארצות הברית, אישרה כי האקרים מנצלים כעת באופן פעיל שתי פרצות אבטחה חמורות בתוכנת PHP
_Curator's translation:_ "CISA, the US Cybersecurity and Infrastructure Security Agency, confirmed that hackers are now actively exploiting two severe security flaws in PHP software."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "CISA בהתרעת חירום: פרצת PHP2Shell משתוללת ברשת -". Selected mechanically, not read by a person.
Capture notes
Language he-IL. Secondhand, quoting social-media posts and press reports. The page quotes the technical detail of a honeypot observation, which is not copied here. The lead image is noted as an illustration made with ChatGPT. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261029T071401Z · HTTP 200 · https://www.pc.co.il/news/%d7%90%d7%91%d7%98%d7%97%d7%aa-%d7%9e%d7%99%d7%93%d7%a2-%d7%95%d7%a1%d7%99%d7%99%d7%91%d7%a8/460454/
headers.jsonf73b4bd70672f045deed546080ee5723d374fa2d8a83861d9a628912ceaf28ff 1,241 bytespage.htmlec93f0825eeaca7410c3030f440475114afd00812b312248267d0692b8cec6fc 281,912 bytesprovenance.jsone6ae1500588217121b02a007b4b9dffac5655f28e99e7684c34817f967f262bf 1,822 bytesrendered.htmla49edbf96a5bae1e9478346d9a7532e824e2a4b35fc57e2b387fc7e2b3ba07bb 687,221 bytesscreenshot.jpg8b7abefd0b20a927652ae66e704b1da128798f8520ad0c7de6a0cdf6f2643f45 842,531 bytestext.txtca7238364f79f6ba663079aebdd5ff6e8249a78eab51b6cfea1ae9620f602bbb 11,702 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →