# Source: PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Pplware: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas

**Pplware** · [https://pplware.sapo.pt/internet/php2shell-disponibilizadas-atualizacoes-urgentes-para-corrigir-duas-falhas-criticas/](https://pplware.sapo.pt/internet/php2shell-disponibilizadas-atualizacoes-urgentes-para-corrigir-duas-falhas-criticas/) · published 2026-10-21T14:49:25+00:00 · added by `curator@php.newsroom` · slug `pplware-sapo-internet-php2shell-disponibilizadas-atua`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Pplware (Portuguese, SAPO), 21 October: urgent updates for the two PHP2Shell flaws. It says the two CVEs relate to memory management and the handling...

## What it says, as the collector read it

#### PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pt/news/pplware-sapo/internet-php2shell-disponibilizadas-atualizacoes-urgentes-pa`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Pplware (Portuguese, SAPO), 21 October: urgent updates for the two PHP2Shell flaws. It says the two CVEs relate to memory management and the handling of internal data while processing HTTP requests; that Wiz researchers say the problems existed for decades, but the complexity needed to demonstrate exploitation hindered discovery of a working attack, and that advanced AI models helped overcome some technical difficulties; that PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed set-ups are affected, mod_php especially, where remote code execution was demonstrated with a single unauthenticated request before application code runs.

> Segundo os investigadores da Wiz, os problemas existem há décadas, mas a complexidade necessária para demonstrar a sua exploração dificultou a descoberta de um ataque funcional.

_Curator's translation:_ "According to Wiz's researchers, the problems have existed for decades, but the complexity needed to demonstrate their exploitation made it hard to find a working attack."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Pplware explains the urgent updates: the CVEs, the exposed SAPIs, Wiz's memory-read findings, the fixed versions and the backports, plus the NCSC UK take-offline advice.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas". Selected mechanically, not read by a person.

#### Capture notes

Language `pt-PT`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://pplware.sapo.pt/internet/php2shell-disponibilizadas-atualizacoes-urgentes-para-corrigir-duas-falhas-criticas/- `headers.json` 84e1fdc851d894be6dc6eb87d75a5ed625ebe0d8e758567996b068a60a1b7cf5 926 bytes
- `page.html` 4289afd88c02dfbe2f999f11183cc357a4c12fda6a6018cd8b9f8adab7b04399 232,611 bytes
- `provenance.json` 6d5f7da50ada06936d3dd66ebd28aebca6f9013934b5d41d8931ce6b18d24510 1,699 bytes
- `text.txt` fb37c3809a81d7b5a986a480f74963135b6b7a9bb742c10ba07c745bf0dafb53 11,868 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/pplware-sapo-internet-php2shell-disponibilizadas-atua/index.html