トレンドマイクロ、PHPの重大な脆弱性「PHP2Shell」への支援・対応策を発表 | トレンドマイクロ (JP)

トレンドマイクロ、PHPの重大な脆弱性「PHP2Shell」への支援・対応策を発表 | トレンドマイクロ (JP)

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page eg/news/trendmicro/ja-jp-about-newsroom-press-releases-2026-pr-20261023-01-html, snapshot 20261024T083755Z. Copied byte for byte; every file's sha256 is in captures/20261024T083755Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Trend Micro Japan (Japanese), 23 October: a press release announcing support measures for PHP2Shell, including a free 'PHP2Shell Exposure Checker' (reads a public site's HTTP headers to indicate whether it may be affected) and a PHP web shield for small businesses. It says the flaw details leaked and exploit code was published before the fix, that initial exploitation attempts have been reported, and in a footnote that successful exploitation in the wild had not been confirmed by independent verification (TrendAI security blog, 22 October); it also says results are an indication from externally visible information such as the PHP version, since Linux distributions may ship fixes without changing the version string. Vendor marketing; noted as material only: the vault does not run such tools.

> 実環境での悪用成功は、独立した検証によって確認されていません

_Curator's translation:_ "Successful exploitation in real environments has not been confirmed by independent verification."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "トレンドマイクロ、PHPの重大な脆弱性「PHP2Shell」への支援・対応策を発表 | トレンドマイクロ (JP)". Selected mechanically, not read by a person.

Capture notes

Language ja. Nothing in the page addresses an AI or hides text from a reader.