PHP2Shell 漏洞爆料者公開道歉　稱不知道有保密期

PHP2Shell 漏洞爆料者公開道歉　稱不知道有保密期

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page hk/news/unwire/2026-10-23-php2shell-hacker-news-leak-apology-tech-secure, snapshot 20261024T083755Z. Copied byte for byte; every file's sha256 is in captures/20261024T083755Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

unwire.hk (Hong Kong, Traditional Chinese), 23 October: the Hacker News user who posted the two CVE identifiers on 20 October, before the planned disclosure, has publicly apologised. The page says the user claimed to have it from a reliable source that PHP would announce two remote-code-execution flaws, listed the two CVEs, said there was no other evidence and claimed a CVSS score of 10.0; in the apology the user says the person who gave the information said there was no confidentiality restriction, that the source's own source had said the same, that they compile PHP themselves on its roughly four-week cycle and only meant to warn others who do the same, and admits not having all the facts. It then sets out the PHP Foundation's timeline (the CVE ids circulating on 20 October with a wrong release time and a wrong 10.0 score and no technical detail; the release moved from 22 to 21 October; Calif's video published by mistake, deleted but copied; Chainguard's early images) and adds that the available information does not support blaming the whole incident or the later attacks on that one user, since Amazon recorded a honeypot attempt on 17 October, before the post. The user is a private individual: the vault's notes and claims leave the handle out on purpose.

> Amazon 威脅情報團隊稱，早在 10 月 17 日已於 MadPot 蜜罐系統發現疑似針對 PHP2Shell 的攻擊嘗試，比 Hacker News 爆料更早

_Curator's translation:_ "Amazon's threat intelligence team says it spotted suspected PHP2Shell attack attempts in its MadPot honeypot system as early as 17 October, earlier than the Hacker News post."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell 漏洞爆料者公開道歉　稱不知道有保密期". Selected mechanically, not read by a person.

Capture notes

Language zh-HK. The page names a private individual by their Hacker News handle. The vault's notes and claims refer to 'a Hacker News user' and do not repeat the handle; the capture itself is kept as published. Nothing in the article text addresses an AI or hides text from a reader.