# Source: Kyberturvatutkijan hunaja-ansa paljasti: PHP2Shell-reikiä käytetään nyt oikeissa kyberiskuissa | Tivi

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Tivi: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Kyberturvatutkijan hunaja-ansa paljasti: PHP2Shell-reikiä käytetään nyt oikeissa kyberiskuissa | Tivi

**Tivi** · [https://www.tivi.fi/uutiset/a/76dfed20-ffb8-48e7-ad18-12f44ad2608b](https://www.tivi.fi/uutiset/a/76dfed20-ffb8-48e7-ad18-12f44ad2608b) · published 2026-10-27 · added by `curator@php.newsroom` · slug `tivi-uutiset-a-76dfed20-ffb8-48e7-ad18-12f44a`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T071103Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A Finnish IT-trade page (Tivi, 27 October) headlined as a security researcher's honeypot having shown PHP2Shell flaws are now used in real attacks. On...

## What it says, as the collector read it

#### Kyberturvatutkijan hunaja-ansa paljasti: PHP2Shell-reikiä käytetään nyt oikeissa kyberiskuissa | Tivi

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fi/news/tivi/uutiset-a-76dfed20-ffb8-48e7-ad18-12f44ad2608b`, snapshot `20261028T071103Z`. Copied byte for byte; every file's sha256 is in `captures/20261028T071103Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A Finnish IT-trade page (Tivi, 27 October) headlined as a security researcher's honeypot having shown PHP2Shell flaws are now used in real attacks. Only the standfirst and first sentence are readable; the rest is behind a free-registration wall. It says PHP2Shell vulnerabilities have been exploited successfully where earlier only many attempts had been seen, citing Bleeping Computer.

> PHP2Shell-haavoittuvuuksia on käytetty onnistuneesti hyväksi. Aiemmin oli havaittu vain paljon erilaisia yrityksiä.

_Curator's translation:_ "PHP2Shell vulnerabilities have been exploited successfully. Earlier only many different attempts had been seen."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Kyberturvatutkijan hunaja-ansa paljasti: PHP2Shell-reikiä käytetään nyt oikeissa kyberiskuissa | Tivi". Selected mechanically, not read by a person.

#### Capture notes

Language `fi`. Mostly behind a free-registration wall: only the teaser is captured, so this source supports one claim. The page also lists unrelated headlines and related stories. Nothing in it addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261028T071103Z · HTTP 200 · https://www.tivi.fi/uutiset/a/76dfed20-ffb8-48e7-ad18-12f44ad2608b- `headers.json` 08f72cff4ace7d27cba1444ecf1afa172d4d9f51e6df822795237ce58309821f 1,060 bytes
- `page.html` 8fb567660b20cfcc5c2b9a454c14132ca855f8ab23fbfe9cc61d4b8eda56f9b8 469,343 bytes
- `provenance.json` 9f6c54d83941cf532311807704cdf462f13fb40a73e4770ce89b9cc946b1f3d3 1,711 bytes
- `rendered.html` 4f3d7b1b6ee14e44ef01885703cd613c88e86994d72ae069f358f1b44a317e5b 433,666 bytes
- `screenshot.jpg` 472fb840127ffde440f01043e278c2f25efbdca4c9841f18b8f609e77421d716 527,696 bytes
- `text.txt` 0edca2db1f04bfcf6a8a79c6ed48d9fdd51a2fe03091051f20f400f6be9c8b75 5,937 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.51 · data as of 2026-10-28T17:15Z · vault commit 75668aedfb6d · https://refs.php.oct.2026.newsroom.sgit.ai/sources/tivi-uutiset-a-76dfed20-ffb8-48e7-ad18-12f44a/index.html