# Source: watchtowr.com

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

watchTowr: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · researcher · primary · captured

# watchtowr.com

**watchTowr** · [https://watchtowr.com/intelligence/php-cve-2026-109618-faq/](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/) · published not stated · added by `claude-story-site` · slug `watchtowr-php2shell-faq`

BLOCKED: HTTP 403.

## What it says, as the collector read it

#### watchtowr.com

Captured by claude-story-site. Status: captured. BLOCKED: HTTP 403.

- 403. Search summary: the FAQ ties exploitation to watchTowr's honeypot network and describes the flaws as disclosed ahead of an expected 22 October announcement.

## Claims that cite it

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| watchTowr sees active exploitation attempts and lists the flaws as exploited in the wildwatchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. [fact timeline →](../../facts/watchtowr-itw/index.html) | watchTowr | unverified | **A6** Established●●●●●● | 2/2 | [watchTowr](../../sources/watchtowr-php2shell/index.html) [watchTowr](../../sources/watchtowr-php2shell-faq/index.html) |

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T111847Z · HTTP 200 · chrome-error://chromewebdata/- `headers.json` 0c655abac86df9e59b49a895ed0bc35a702af92b957d5db757df55be64fd9ff8 2,908 bytes
- `page.html` 9ad5ad45ab50498bff4fec7104988da089ca1e17cc8145805e57fe493e22893c 457,843 bytes
- `provenance.json` 779e5cb94040a7b1083dedc2aa737205276d134f02007caceae9ff3ab737420c 993 bytes
- `rendered.html` ed77bdfb70c799526cb11ef4c80486ab375a2bebf338de76275278dd5be92f25 183,669 bytes
- `screenshot.png` cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee 21,632 bytes
- `text.txt` 1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab 106 bytes
capture 20261023T160435Z · HTTP 200 · https://watchtowr.com/intelligence/php-cve-2026-109618-faq/- `headers.json` cad4df531da848990002b6cb29acf493343ce806cbfc1a14d5d8f5cfc4681400 3,171 bytes
- `page.html` a37d6427ad2b41f96406baf00c0582a62bc01a93589026fe41e1674189f6ef2e 463,706 bytes
- `provenance.json` 214e9f9b59ac4b19cc20a4783d38bd711654c978f19bde3bbe1cb58b9d002c3b 1,723 bytes
- `rendered.html` ed1654f5460ab4343b5451a30df79efe21e650a9aa2c0e037eeaeb8c6b11c286 481,960 bytes
- `screenshot.jpg` a039228f4e36bf0a2026db2e79fa46bab9461133bdc3789b8082681080cea63a 591,741 bytes
- `text.txt` 3c561d0c08e9343f817d78c30427c55eb4a491ccd2a59babcb879a65da8def37 8,906 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/watchtowr-php2shell-faq/index.html