# Source: PHP-Sicherheitslücke "PHP2Shell": Zwei kritische Lücken gefährden Webseiten weltweit - Wirtschaft - SZ.de

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

SZ.de: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP-Sicherheitslücke "PHP2Shell": Zwei kritische Lücken gefährden Webseiten weltweit - Wirtschaft - SZ.de

**SZ.de** · [https://www.sueddeutsche.de/wirtschaft/php-sicherheitsluecke-2026-php2shell-webseiten-cybersicherheit-li.3566991](https://www.sueddeutsche.de/wirtschaft/php-sicherheitsluecke-2026-php2shell-webseiten-cybersicherheit-li.3566991) · published 2026-10-21T16:37:18Z · added by `curator@php.newsroom` · slug `sueddeutsche-wirtschaft-php-sicherheitsluecke-2026-ph`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Süddeutsche Zeitung (German), 21 October (18:37 local): a dpa-style report, the same text as the Neue Westfälische item (nw-nachrichten-zwischen-weser...

## What it says, as the collector read it

#### PHP-Sicherheitslücke "PHP2Shell": Zwei kritische Lücken gefährden Webseiten weltweit - Wirtschaft - SZ.de

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/sueddeutsche/wirtschaft-php-sicherheitsluecke-2026-php2shell-webseiten-cy`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Süddeutsche Zeitung (German), 21 October (18:37 local): a dpa-style report, the same text as the Neue Westfälische item (nw-nachrichten-zwischen-weser-und-rhein-244), headlined 'Cyber-security emergency'. It says Huntress, the German federal CERT and the official PHP security team describe an acute emergency forcing site operators to act fast, that WordPress alone runs an estimated 400 to 500 million sites and that Moodle, Joomla, Typo3 and Drupal are also PHP, and describes the two CVEs and the remote-code-execution risk. No new claims beyond those recorded on the Neue Westfälische item.

> Wie das IT-Sicherheitsunternehmen Huntress, das Computer Emergency Response Team des Bundes (Cert-Bund) sowie das offizielle PHP-Sicherheitsteam berichten, handelt es sich um eine akute Notfallsituation, die Betreiber von Internetseiten in aller Welt zu schnellem Handeln zwingt.

_Curator's translation:_ "As the IT security company Huntress, the Computer Emergency Response Team of the Federal Government (CERT-Bund) and the official PHP security team report, it is an acute emergency forcing website operators around the world to act quickly."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Süddeutsche Zeitung (dpa-based) explains PHP2Shell and the BSI's 'Orange' threat level and advice to disconnect servers if patching is not possible. It reports Munich, Charité, Freie Universität and berlin.de going offline, and quotes BSI vice-president Caspers expecting large-scale exploitation within hours of the update.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP-Sicherheitslücke "PHP2Shell": Zwei kritische Lücken gefährden Webseiten weltweit - Wirtschaft - SZ.de". Selected mechanically, not read by a person.

#### Capture notes

Language `de`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://www.sueddeutsche.de/wirtschaft/php-sicherheitsluecke-2026-php2shell-webseiten-cybersicherheit-li.3566991- `headers.json` 0e933981f96b2bbb683b55d424f7e102ea4f2e0a943b0756bb79badbf2905b1b 953 bytes
- `page.html` b2b9596ba5189b3e6b748586c5e7990b9bf0502fd227d26a9b2b8bf07b736920 391,677 bytes
- `provenance.json` 888d3a2b38cd07f71a29144b1c7bdeffa5e6b4eca78c0d9746639e1e6f391fb2 1,862 bytes
- `rendered.html` bbd9d177f0549e230ca0ec9345ad4a80e8140059adcffd7204466804c057eda6 743,779 bytes
- `screenshot.jpg` e7bb19e5db8381c4583a30afecddb3492f70293c76ce9a70b6269541512e3526 708,205 bytes
- `text.txt` 735a9edd2137e32dead0a3e0cd6984dee6f6f37f41bc9d6c5eb96cb0ebcbb40f 10,703 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/sueddeutsche-wirtschaft-php-sicherheitsluecke-2026-ph/index.html