Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
PHP2Shell: corrigido no código, exposto em produção | TI INSIDE Online
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T094557Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A Brazilian IT-management opinion column (TI Inside, 26 October, by the CEO of a Kubernetes-security company) arguing that PHP2Shell is fixed in the c...
What it says, as the collector read it
PHP2Shell: corrigido no código, exposto em produção | TI INSIDE Online
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page br/news/tiinside/26-10-2026-php2shell-corrigido-no-codigo-exposto-em-producao, snapshot 20261028T094557Z. Copied byte for byte; every file's sha256 is in captures/20261028T094557Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
A Brazilian IT-management opinion column (TI Inside, 26 October, by the CEO of a Kubernetes-security company) arguing that PHP2Shell is fixed in the code but still exposed in production. It relays Wiz that PHP runs about 70% of websites and that AI models helped find the flaw and adapt the attack to WordPress, Drupal and Joomla within hours, says the CVE numbers leaked a day before the fix and the embargo was broken, cites Palo Alto's count of more than 22.6 million exposed instances, and describes last week's choice between staying exposed and going offline: Anatel took its SEI and other digital services offline, regional courts interrupted access, European governments did the same, and the NSA and CERT-EU advised switching off whatever could not be patched. The rest is advice on rebuilding container images, software inventories and supplier responsibility under Brazilian central-bank rules.
> Na semana passada, quem não conseguiu atualizar a tempo teve que escolher entre ficar exposto e sair do ar.
_Curator's translation:_ "Last week, whoever could not update in time had to choose between staying exposed and going offline."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: corrigido no código, exposto em produção | TI INSIDE Online". Selected mechanically, not read by a person.
Capture notes
Language pt-BR. The capture shows no publication date; 26 October is taken from the page address. First-person opinion by a vendor's CEO, with a plug for the author's own hardened images. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261028T094557Z · HTTP 200 · https://tiinside.com.br/26/10/2026/php2shell-corrigido-no-codigo-exposto-em-producao/
headers.json07145f1076f7cb788154da4b1ac3e780c8abebcc1cb9f798c0cb1deda9f002b5 2,493 bytespage.html7c8f959e58c22e7cc85c78db01ae4d9464467a76afc511630f2f0425d27746cb 216,733 bytesprovenance.json260d3ad170d7b8ae2c3c9a63555a9442cd64a090a18e64e5c2dbd01130df218d 1,757 bytesrendered.html464bbcc7ddf578cf7034bdf3af369dd2b36773b615583630f12e2acafcd4fc4a 235,737 bytesscreenshot.jpg6818c1866494fa03038e79b18903ec13074d39408bc537e0669212a238ea408d 404,975 bytestext.txtebb76190abbed166248fd24940ccb53b95ce9a563d2ecdc4c41846582f6d00ca 7,294 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →