# Source: Dua Kerentanan Kritis PHP Bocor Sebelum Patch Dirilis | Telset.id

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Telset.id: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Dua Kerentanan Kritis PHP Bocor Sebelum Patch Dirilis | Telset.id

**Telset.id** · [https://telset.id/laptop-pc/dua-celah-kritis-php-bocor-sebelum-patch-situs-web-terancam](https://telset.id/laptop-pc/dua-celah-kritis-php-bocor-sebelum-patch-situs-web-terancam) · published 2026-10-22T00:01:37 · added by `curator@php.newsroom` · slug `telset-laptop-pc-dua-celah-kritis-php-bocor-seb`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Telset.id (Indonesian), 22 October: two critical PHP flaws leaked before the patch, via the Hacker News forum. It says PHP's advisory announced a patc...

## What it says, as the collector read it

#### Dua Kerentanan Kritis PHP Bocor Sebelum Patch Dirilis | Telset.id

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/telset/laptop-pc-dua-celah-kritis-php-bocor-sebelum-patch-situs-web`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Telset.id (Indonesian), 22 October: two critical PHP flaws leaked before the patch, via the Hacker News forum. It says PHP's advisory announced a patch at 14:00 UTC on Wednesday 21 October for two flaws rated 9.2 on CVSS 4.0, that the flaws are expected to affect PHP versions 5 to 8, that PHP reserved the right to release earlier if details of either became public or active exploitation appeared, and that no active exploitation had been reported at the time.

> PHP juga menyatakan pihaknya berhak merilis lebih awal apabila detail salah satu kerentanan menjadi publik atau muncul bukti eksploitasi aktif di lapangan.

_Curator's translation:_ "PHP also stated that it reserves the right to release earlier if details of one of the vulnerabilities become public or evidence of active exploitation appears in the field."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Telset rewrite of BleepingComputer's pre-release story: details leaked via Hacker News (user 'petecooper') and Florian Roth's X post, watchTowr confirmed, the patch was due 21 Oct 14:00 UTC, and there was no active exploitation yet.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Dua Kerentanan Kritis PHP Bocor Sebelum Patch Dirilis | Telset.id". Selected mechanically, not read by a person.

#### Capture notes

Language `id`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://telset.id/laptop-pc/dua-celah-kritis-php-bocor-sebelum-patch-situs-web-terancam- `headers.json` d6548b34b56836fbcf7759404a269f06ca5cf591cc3d6c5f0f26ae5feffc6532 1,783 bytes
- `page.html` bc7715e659768ef71feb1740c4bfa735480a4c2b7ca0f56c439e0243fc716ba9 130,239 bytes
- `provenance.json` c99492c1cf4aea28da47e3d69b0ba45d7140d70a7e5588e64eb64fd5db204352 1,749 bytes
- `rendered.html` f0b452131392e31b60b2f2d29590caca7696b0919e5bfdf9392a0d3b8b87d2cc 134,514 bytes
- `screenshot.jpg` e215e09df169dcd602d107c91631f54bb8d94e228c43133bd5c0a104b0670f52 661,474 bytes
- `text.txt` 815181e03b96f48f774618be7dc381ea2439fcf490651d45d27f45e661d334b2 7,843 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/telset-laptop-pc-dua-celah-kritis-php-bocor-seb/index.html