Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Pplware (Portuguese, SAPO), 21 October: urgent updates for the two PHP2Shell flaws. It says the two CVEs relate to memory management and the handling...
What it says, as the collector read it
PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page pt/news/pplware-sapo/internet-php2shell-disponibilizadas-atualizacoes-urgentes-pa, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Pplware (Portuguese, SAPO), 21 October: urgent updates for the two PHP2Shell flaws. It says the two CVEs relate to memory management and the handling of internal data while processing HTTP requests; that Wiz researchers say the problems existed for decades, but the complexity needed to demonstrate exploitation hindered discovery of a working attack, and that advanced AI models helped overcome some technical difficulties; that PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed set-ups are affected, mod_php especially, where remote code execution was demonstrated with a single unauthenticated request before application code runs.
> Segundo os investigadores da Wiz, os problemas existem há décadas, mas a complexidade necessária para demonstrar a sua exploração dificultou a descoberta de um ataque funcional.
_Curator's translation:_ "According to Wiz's researchers, the problems have existed for decades, but the complexity needed to demonstrate their exploitation made it hard to find a working attack."
_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Pplware explains the urgent updates: the CVEs, the exposed SAPIs, Wiz's memory-read findings, the fixed versions and the backports, plus the NCSC UK take-offline advice.
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas". Selected mechanically, not read by a person.
Capture notes
Language pt-PT. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261023T160435Z · HTTP 200 · https://pplware.sapo.pt/internet/php2shell-disponibilizadas-atualizacoes-urgentes-para-corrigir-duas-falhas-criticas/
headers.json84e1fdc851d894be6dc6eb87d75a5ed625ebe0d8e758567996b068a60a1b7cf5 926 bytespage.html4289afd88c02dfbe2f999f11183cc357a4c12fda6a6018cd8b9f8adab7b04399 232,611 bytesprovenance.json6d5f7da50ada06936d3dd66ebd28aebca6f9013934b5d41d8931ce6b18d24510 1,699 bytestext.txtfb37c3809a81d7b5a986a480f74963135b6b7a9bb742c10ba07c745bf0dafb53 11,868 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →