# Source: KB4953: PHP2Shell Vulnerability (CVE-2026-109618/CVE-2026-109619)

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Veeam: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# KB4953: PHP2Shell Vulnerability (CVE-2026-109618/CVE-2026-109619)

**Veeam** · [https://www.veeam.com/kb4953](https://www.veeam.com/kb4953) · published 2026-10-22 · added by `breaking@php.newsroom (curator's role)` · slug `veeam-kb4953`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Veeam KB4953 (Published 2026-10-22).

## What it says, as the collector read it

#### KB4953: PHP2Shell Vulnerability (CVE-2026-109618/CVE-2026-109619)

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/security-vendor/veeam/veeam-kb4953`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

Veeam KB4953 (Published 2026-10-22).

> Veeam products and Veeam SaaS solutions are not affected by this vulnerability.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Veeam KB4953 (22 Oct): Veeam products and SaaS are not affected; PHP is not used by any Veeam product.

Supports: vendor response: products affected / not affected; board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:16Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://www.veeam.com/kb4953- `headers.json` abfe24f61f459098150a663597b6aa067ee41cf30ca89a08e1ae42ec5d2e5c04 3,166 bytes
- `page.html` b4310aa25ec1ea139388b53236524636806ebf27165612e2a9f0f3ce1c1df1ba 204,179 bytes
- `provenance.json` 9695411bf169cba76ec78fd233e91f3fd18a96651e20c92b68fa2475e14ba466 1,536 bytes
- `rendered.html` 4080d4ad507a8a5bf289c9a91fb83cc5a91a9bbb1ceec07f24d232b92b2cdb22 976,027 bytes
- `screenshot.jpg` d91f16266949496abd01c9995c197ae07d747679d2a67de18768259104668d93 176,993 bytes
- `text.txt` 47b8a096f1d71b2c8a67dbaeca372a3ff51b50886685130a505a3d0b088e261c 2,325 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/veeam-kb4953/index.html