# Source: PHP2Shell Saldırıları: İki Kritik PHP Açığı Nasıl Çalışıyor? - Technotoday

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Technotoday: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell Saldırıları: İki Kritik PHP Açığı Nasıl Çalışıyor? - Technotoday

**Technotoday** · [https://technotoday.com.tr/php2shell-saldirilari-iki-kritik-php-acigi-nasil-calisiyor/](https://technotoday.com.tr/php2shell-saldirilari-iki-kritik-php-acigi-nasil-calisiyor/) · published 2026-10-22T16:12:05+03:00 · added by `curator@php.newsroom` · slug `technotoday-php2shell-saldirilari-iki-kritik-php-aci`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Technotoday (Turkey, Turkish), by Muhammed Kayan, dated 23 October on the page: how the two critical PHP flaws work. It says the CVEs were made more c...

## What it says, as the collector read it

#### PHP2Shell Saldırıları: İki Kritik PHP Açığı Nasıl Çalışıyor? - Technotoday

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/technotoday/php2shell-saldirilari-iki-kritik-php-acigi-nasil-calisiyor`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Technotoday (Turkey, Turkish), by Muhammed Kayan, dated 23 October on the page: how the two critical PHP flaws work. It says the CVEs were made more critical by technical details leaking before the 21 October update, that both score 9.2 on CVSS 4.0, that the first attack attempts were reported to have been seen before the official patches were released, and that the number of successfully compromised systems was not yet known. It describes the memory-handling causes at a general level, says the flaw sits in PHP itself so a site with safe application code can still be affected, and notes Wiz's demonstrations against WordPress, Drupal and Joomla.

> Bununla birlikte başarılı şekilde ele geçirilen sistemlerin sayısı henüz kesin olarak bilinmiyor.

_Curator's translation:_ "However, the number of systems successfully taken over is not yet known with certainty."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell Saldırıları: İki Kritik PHP Açığı Nasıl Çalışıyor? - Technotoday". Selected mechanically, not read by a person.

#### Capture notes

Language `tr`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://technotoday.com.tr/php2shell-saldirilari-iki-kritik-php-acigi-nasil-calisiyor/- `headers.json` 11c29c31312ffea5f08690956575683a65e78e911bb465da2798de3a31a9fd29 1,396 bytes
- `page.html` ab4decfc27aa189d1598cb2ee1af922ad809960b345b0f9b598d3a114e8682ca 136,685 bytes
- `provenance.json` 3ef547f8def70c58e139363957f4da1efa64818f5bfed122c9e01a7d2b1095c2 1,780 bytes
- `rendered.html` da5dc5b7e911fc1ffda05006c03d9107f10f893908a2e5726864161d5760a9ff 149,032 bytes
- `screenshot.jpg` e092c6a411531aadc460dcd922c6aaa2a33128538b1933a7d6caa5420de4d4fa 290,667 bytes
- `text.txt` f167921e5723693a3bf70820a4bef11fd6a6b0ceb47e632f67b45b53aa6b31ea 4,072 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/technotoday-php2shell-saldirilari-iki-kritik-php-aci/index.html