# Source: Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Báo Quân đội nhân dân: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá

**Báo Quân đội nhân dân** · [https://www.qdnd.vn/phap-luat/tin-tuc/hai-lo-hong-nghiem-trong-trong-php-da-co-ban-va-nguoi-dung-internet-khong-can-qua-lo-lang-1061728](https://www.qdnd.vn/phap-luat/tin-tuc/hai-lo-hong-nghiem-trong-trong-php-da-co-ban-va-nguoi-dung-internet-khong-can-qua-lo-lang-1061728) · published not stated in the capture · added by `curator@php.newsroom` · slug `qdnd-phap-luat-tin-tuc-hai-lo-hong-nghiem-tro`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). People's Army Newspaper (Vietnamese), citing Vietnam's Cybersecurity Department and the National Cybersecurity Association: the two CVEs were patched...

## What it says, as the collector read it

#### Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `vn/news/qdnd/phap-luat-tin-tuc-hai-lo-hong-nghiem-trong-trong-php-da-co-b`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

People's Army Newspaper (Vietnamese), citing Vietnam's Cybersecurity Department and the National Cybersecurity Association: the two CVEs were patched on 21 October and both score 9.2 on CVSS 4.0; Wiz and other teams found them with AI tools and passed the information to the PHP team before disclosure. It says exploitation requires specially crafted requests and exact control of memory state, that a suitably configured WAF can limit some unusual requests but is no substitute for patching, and that some hosting and cloud providers have patched and added WAF rules. For ordinary internet users it says the flaws sit on the servers, not on personal devices or browsers, so there is no need to stop browsing or shopping online, while basic security habits still apply.

> Vì vậy, người dùng internet thông thường không cần ngừng truy cập website, tìm kiếm thông tin, mua sắm hoặc thực hiện các giao dịch trực tuyến chỉ vì thông tin về hai lỗ hổng này được công bố.

_Curator's translation:_ "Therefore, ordinary internet users do not need to stop visiting websites, searching for information, shopping or making online transactions just because information about these two vulnerabilities has been published."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá". Selected mechanically, not read by a person.

#### Capture notes

Language `vi`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261024T083755Z · HTTP 200 · https://www.qdnd.vn/phap-luat/tin-tuc/hai-lo-hong-nghiem-trong-trong-php-da-co-ban-va-nguoi-dung-internet-khong-can-qua-lo-lang-1061728- `headers.json` d0e5b05bdec369ac00d7efba505069b451dafa6c0982265a31e36fedcf39525b 1,286 bytes
- `page.html` 26078fba025c6012ccbcce562add2b64e063b1ad9499333d28d26ab60352a7ba 111,518 bytes
- `provenance.json` 4a686c403cbd4d5440e89024068ff8be702e61026ea5462f716bb5b764e7de91 1,832 bytes
- `rendered.html` 21b2bcbb6d65d20a294b18df7ad59a0c26d8d43c6d521aabf6f90184969255f6 115,148 bytes
- `screenshot.jpg` e6a608d019533ca9ffaa6b05c20916bd423ede9146078839740e37c6f0e77e44 551,929 bytes
- `text.txt` 7b9e2e56682eb15eea7a5d5b7b1e2d94e59f2a84201005bd779308eac19fa510 9,105 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/qdnd-phap-luat-tin-tuc-hai-lo-hong-nghiem-tro/index.html