深刻度9.2のPHP脆弱性「PHP2Shell」、OpenAIが影響確認ツール公開 - PC Watch

深刻度9.2のPHP脆弱性「PHP2Shell」、OpenAIが影響確認ツール公開 - PC Watch

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page jp/news/pc-watch-impress/docs-news-2150338-html, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

PC Watch (Impress, Japanese), 22 October. It reports that the PHP project brought forward its fixed releases and that OpenAI published, on 21 October on GitHub under Apache-2.0, a tool called 'PHP Version Checker' that reads the PHP version from a site's HTTP response headers and says whether it is older than the fixed versions; it can also check a local PHP and is offered as a Codex skill. The tool only compares version numbers, does not verify that a fix is applied, and cannot judge sites that do not expose the version. It dates PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to 21 October, says PHP 5.4 and later before the fixed versions are affected, and says Wiz Research found it using Gemini 4 Argon, GPT-5.6 Sol and others. Noted here as material only: the vault does not run such tools against live sites.

> ただし、同ツールはバージョン番号を比較するだけで、修正の適用そのものは検証しない。

_Curator's translation:_ "However, the tool only compares version numbers and does not verify that a fix has actually been applied."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "深刻度9.2のPHP脆弱性「PHP2Shell」、OpenAIが影響確認ツール公開 - PC Watch". Selected mechanically, not read by a person.

Capture notes

Language ja. Nothing in the page addresses an AI or hides text from a reader.