# Source: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The Hacker News: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

**The Hacker News** · [https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html](https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html) · published 2026-10-20 · added by `claude-story-site` · slug `thehackernews-php2shell-unpatched-alert`

Pre-release coverage of the two unpatched flaws.

## What it says, as the collector read it

#### PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

Captured by claude-story-site. Status: captured. Pre-release coverage of the two unpatched flaws.

- Captured for the record of pre-release framing.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T113144Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html- `headers.json` 504e60a31ad0c0649db5fe4d0560bcb64bcea39e2c5d8b374dd60c86235937fb 783 bytes
- `page.html` b8297488c796fba8c0c46fbb558121433294b8f8991c457777efa33409b6634e 175,875 bytes
- `provenance.json` 3eccd35b7d04ded29ea8937c2d7870a8be4adac2340d632f92f01cfe630c3147 1,090 bytes
- `rendered.html` e34515d9ce5113ec57194450be97a765341affcc8cae816dd5a475c8d200873c 171,094 bytes
- `screenshot.png` 1686d34457b358c5f9a1950a0da921ac4d765a0491953e9383a70b1498568c29 2,281,720 bytes
- `text.txt` 33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b 10,078 bytes
capture 20261023T160435Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html- `headers.json` d78c94137a0e92fbbf0e7183aa102252377215b5c2ea8c1376a7c1e5a0ac01af 853 bytes
- `page.html` 5cda48a2a38c28e613f475c02a5e043468526043de9e64d7da8e881940d9dc0d 175,811 bytes
- `provenance.json` 2e335ba1f28d24aa170686d6db00688fb4c984b8b6f610cc4834b61f2a81c804 1,878 bytes
- `rendered.html` 208b58c48b4c5486c4f4282b9870d5d0d666d76c0506a64051a25d6d6c9e2a1f 170,442 bytes
- `screenshot.jpg` 5bd727d03b84a7d4ff60f97edb1cd772106c66edc82cd6044af820f1135ab4e8 581,215 bytes
- `text.txt` 2ada6ad9a37f82d308e5d324ffc263ec5fb071349cc059b76699b1c07896ce81 9,243 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/thehackernews-php2shell-unpatched-alert/index.html