# Source: watchtowr.com

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

watchTowr: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · researcher · primary · captured

# watchtowr.com

**watchTowr** · [https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/) · published not stated · added by `claude-story-site` · slug `watchtowr-php2shell`

BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild.

## What it says, as the collector read it

#### watchtowr.com

Captured by claude-story-site. Status: captured. BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild.

- 403 'Access to watchtowr.com was denied'. Content known only second-hand. Retry from another egress.

## Claims that cite it

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| watchTowr sees active exploitation attempts and lists the flaws as exploited in the wildwatchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. [fact timeline →](../../facts/watchtowr-itw/index.html) | watchTowr | unverified | **A6** Established●●●●●● | 2/2 | [watchTowr](../../sources/watchtowr-php2shell/index.html) [watchTowr](../../sources/watchtowr-php2shell-faq/index.html) |

## Events that cite it

No timeline event cites this source yet.

### Exploitation signals from this source
- [2026-10-21](https://php.oct.2026.newsroom.sgit.ai/exploitation/): Active exploitation attempts; the flaws listed as exploited in the wild.

## The bytes
capture 20261022T111839Z · HTTP 200 · chrome-error://chromewebdata/- `headers.json` ff01331edab1c463627b7d97ebbf6c6089f2893fb06dcf8f589c2d11416bf603 2,911 bytes
- `page.html` cfe1d709b20d9c9c8d6383853add5bab85c168f532041e5f4733b5cce5fed8f3 456,212 bytes
- `provenance.json` 97a66648fa1ef3d782a7e0d1be25a472e3d4248521e20afc78bba0856d9006cb 1,001 bytes
- `rendered.html` afa2a67a0dee2a2d057885312d74f1277ab47cc85f919220d2421a6d6044265d 183,693 bytes
- `screenshot.png` cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee 21,632 bytes
- `text.txt` 1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab 106 bytes
capture 20261023T232528Z · HTTP 200 · https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/- `headers.json` 9569e2acde13e8a452b23805f6ba7482845cc4544b0eee5ee3dc0e37aa1ab84d 3,172 bytes
- `page.html` 49880f3a542b39683d2008bdad6af97f5fd98e1aa62a7163cd2bcb35a1c7f7d6 461,495 bytes
- `provenance.json` 2c8567c9443613c7212763a8699b43fde1826d21f9744b59164606bc69800e5a 1,735 bytes
- `rendered.html` 77923dc2a9eeb33d82effb69df89fb6e137ce0ea3ff56fe67959498711bfd051 535,286 bytes
- `screenshot.jpg` 2bfb399a3f975123b73f36d938d2c48e0b57c46f1530edd612255273341bfc27 761,462 bytes
- `text.txt` e09524178ed5f328df70485889aa78f37e3bf819682db33e22b4d1a875d1199f 12,450 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/watchtowr-php2shell/index.html