PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲

PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page jp/news/tech-noisy/2026-10-22-php2shell-php-rce-cve-2026-109618, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

tech-noisy (Japanese), 22 October: an explainer headed 'PHP2Shell: two flaws in PHP itself and fixed versions 8.5.12'. It says PHP published fixes on 21 October (CVSS 4.0 9.2), the official advisory names PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed and rates mod_php highest, 8.2 to 8.5 need updating and 8.1 and earlier get no official fix, and that Wiz, which found it, says it used Gemini 4 Argon and GPT-5.6 Sol. It says PHP had pre-announced on the 20th that it might publish earlier if details became public or real exploitation was seen, that the CVE numbers were reported to have leaked online the day before, and that, although some reports say real attacks had started, Huntress said at the evening of 21 October (US Eastern) that it had not seen exploitation in its monitored environments. It carries an editorial view and an FAQ.

> 実際の攻撃が出始めたとの報告もある一方、Huntress は 21 日夕方(米東部時間)の時点で、自社の監視先では悪用を確認していないとしています。

_Curator's translation:_ "While there are reports that real attacks have begun, Huntress says that as of the evening of the 21st (US Eastern time) it had not confirmed exploitation in the environments it monitors."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ tech-noisy.com (Japan) explainer of the advisory and Wiz research. It adds Google Cloud guidance (rebuild GKE/Cloud Run images, Cloud Armor managed rules protect, App Engine standard PHP 8.2+ auto-patched) and Huntress saying it had seen no exploitation as of 21 Oct evening (US Eastern).

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲". Selected mechanically, not read by a person.

Capture notes

Language ja. Nothing in the page addresses an AI or hides text from a reader.