# Source: CISA בהתרעת חירום: פרצת PHP2Shell משתוללת ברשת -

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

אנשים ומחשבים: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# CISA בהתרעת חירום: פרצת PHP2Shell משתוללת ברשת -

**אנשים ומחשבים** · [https://www.pc.co.il/news/%d7%90%d7%91%d7%98%d7%97%d7%aa-%d7%9e%d7%99%d7%93%d7%a2-%d7%95%d7%a1%d7%99%d7%99%d7%91%d7%a8/460454/](https://www.pc.co.il/news/%d7%90%d7%91%d7%98%d7%97%d7%aa-%d7%9e%d7%99%d7%93%d7%a2-%d7%95%d7%a1%d7%99%d7%99%d7%91%d7%a8/460454/) · published 2026-10-28 · added by `curator@php.newsroom` · slug `pc-news-d7-90-d7-91-d7-98-d7-97-d7-aa-d7-9e`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261029T071401Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). An Israeli IT-trade piece (Anashim U'Machshevim, 28 October), headlined as a CISA emergency alert, reporting that CISA confirmed hackers are actively...

## What it says, as the collector read it

#### CISA בהתרעת חירום: פרצת PHP2Shell משתוללת ברשת -

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `il/news/pc/news-d7-90-d7-91-d7-98-d7-97-d7-aa-d7-9e-d7-99-d7-93-d7-a2-d`, snapshot `20261029T071401Z`. Copied byte for byte; every file's sha256 is in `captures/20261029T071401Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

An Israeli IT-trade piece (Anashim U'Machshevim, 28 October), headlined as a CISA emergency alert, reporting that CISA confirmed hackers are actively exploiting two severe PHP flaws, added them to its Known Exploited Vulnerabilities catalog and required US civilian federal bodies to apply the updates by 29 October. It relays Amazon's intelligence unit, via Tenable's blog, that first attack attempts were recorded on 17 October, four days before the emergency updates; Perplexity's detection lead's confirmation of a successful attack on a honeypot; a principal threat researcher at Expel calling it the best confirmation seen since the crisis began for servers on the Apache mod_php configuration; Cloudflare's technology chief's note that WAF rules for the known vectors were deployed to all customers as a stopgap before the patch release; and TechCrunch's account that Calif used AI models to work out how to exploit flaws once thought unexploitable.

> CISA, הסוכנות לאבטחת סייבר ותשתיות של ארצות הברית, אישרה כי האקרים מנצלים כעת באופן פעיל שתי פרצות אבטחה חמורות בתוכנת PHP

_Curator's translation:_ "CISA, the US Cybersecurity and Infrastructure Security Agency, confirmed that hackers are now actively exploiting two severe security flaws in PHP software."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "CISA בהתרעת חירום: פרצת PHP2Shell משתוללת ברשת -". Selected mechanically, not read by a person.

#### Capture notes

Language `he-IL`. Secondhand, quoting social-media posts and press reports. The page quotes the technical detail of a honeypot observation, which is not copied here. The lead image is noted as an illustration made with ChatGPT. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261029T071401Z · HTTP 200 · https://www.pc.co.il/news/%d7%90%d7%91%d7%98%d7%97%d7%aa-%d7%9e%d7%99%d7%93%d7%a2-%d7%95%d7%a1%d7%99%d7%99%d7%91%d7%a8/460454/- `headers.json` f73b4bd70672f045deed546080ee5723d374fa2d8a83861d9a628912ceaf28ff 1,241 bytes
- `page.html` ec93f0825eeaca7410c3030f440475114afd00812b312248267d0692b8cec6fc 281,912 bytes
- `provenance.json` e6ae1500588217121b02a007b4b9dffac5655f28e99e7684c34817f967f262bf 1,822 bytes
- `rendered.html` a49edbf96a5bae1e9478346d9a7532e824e2a4b35fc57e2b387fc7e2b3ba07bb 687,221 bytes
- `screenshot.jpg` 8b7abefd0b20a927652ae66e704b1da128798f8520ad0c7de6a0cdf6f2643f45 842,531 bytes
- `text.txt` ca7238364f79f6ba663079aebdd5ff6e8249a78eab51b6cfea1ae9620f602bbb 11,702 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.55 · data as of 2026-10-30T17:13Z · vault commit 2f80607e87ad · https://refs.php.oct.2026.newsroom.sgit.ai/sources/pc-news-d7-90-d7-91-d7-98-d7-97-d7-aa-d7-9e/index.html