Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
Kyberturvatutkijan hunaja-ansa paljasti: PHP2Shell-reikiä käytetään nyt oikeissa kyberiskuissa | Tivi
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T071103Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A Finnish IT-trade page (Tivi, 27 October) headlined as a security researcher's honeypot having shown PHP2Shell flaws are now used in real attacks. On...
What it says, as the collector read it
Kyberturvatutkijan hunaja-ansa paljasti: PHP2Shell-reikiä käytetään nyt oikeissa kyberiskuissa | Tivi
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page fi/news/tivi/uutiset-a-76dfed20-ffb8-48e7-ad18-12f44ad2608b, snapshot 20261028T071103Z. Copied byte for byte; every file's sha256 is in captures/20261028T071103Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
A Finnish IT-trade page (Tivi, 27 October) headlined as a security researcher's honeypot having shown PHP2Shell flaws are now used in real attacks. Only the standfirst and first sentence are readable; the rest is behind a free-registration wall. It says PHP2Shell vulnerabilities have been exploited successfully where earlier only many attempts had been seen, citing Bleeping Computer.
> PHP2Shell-haavoittuvuuksia on käytetty onnistuneesti hyväksi. Aiemmin oli havaittu vain paljon erilaisia yrityksiä.
_Curator's translation:_ "PHP2Shell vulnerabilities have been exploited successfully. Earlier only many different attempts had been seen."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Kyberturvatutkijan hunaja-ansa paljasti: PHP2Shell-reikiä käytetään nyt oikeissa kyberiskuissa | Tivi". Selected mechanically, not read by a person.
Capture notes
Language fi. Mostly behind a free-registration wall: only the teaser is captured, so this source supports one claim. The page also lists unrelated headlines and related stories. Nothing in it addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261028T071103Z · HTTP 200 · https://www.tivi.fi/uutiset/a/76dfed20-ffb8-48e7-ad18-12f44ad2608b
headers.json08f72cff4ace7d27cba1444ecf1afa172d4d9f51e6df822795237ce58309821f 1,060 bytespage.html8fb567660b20cfcc5c2b9a454c14132ca855f8ab23fbfe9cc61d4b8eda56f9b8 469,343 bytesprovenance.json9f6c54d83941cf532311807704cdf462f13fb40a73e4770ce89b9cc946b1f3d3 1,711 bytesrendered.html4f3d7b1b6ee14e44ef01885703cd613c88e86994d72ae069f358f1b44a317e5b 433,666 bytesscreenshot.jpg472fb840127ffde440f01043e278c2f25efbdca4c9841f18b8f609e77421d716 527,696 bytestext.txt0edca2db1f04bfcf6a8a79c6ed48d9fdd51a2fe03091051f20f400f6be9c8b75 5,937 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →