[ { "slug": "01net-actualites-failles-php-pourquoi-cest-vra", "url": "https://www.01net.com/actualites/failles-php-pourquoi-cest-vrai-casse-tete-internet-mondial.html", "publisher": "01net", "kind": "news", "title": "Failles PHP : pourquoi c'est un vrai casse-tête pour l'Internet mondial", "published": "2026-10-22T10:30:00+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "751abf832477b03c4bfcd1d054188cc75e3a6fd0b238fc77ee45aa53bc73ce06", "bytes": 1381 }, "page.html": { "sha256": "408b1e9061a8b08b046d491e76e90bd01fff7fd6008cf3601d1eaf2d3362633d", "bytes": 132625 }, "provenance.json": { "sha256": "3913ff9cb0fa41223487d0b244cd3b06286553a4baefa7c9d0e2ce4735a4ac5b", "bytes": 1771 }, "rendered.html": { "sha256": "61263962972ed5f38ea25dc58f03bff7fa255fa74a3c08a465c7aa96357ad2f3", "bytes": 197029 }, "screenshot.jpg": { "sha256": "d7be83112edf82a8d3b2b9a7c3827184c35c5b87780ef3b54627031c16ca6bc4", "bytes": 626923 }, "text.txt": { "sha256": "7f962c4324c29bcf638323ac398a6f0acfffe054c449b2dfe19b6cf946add33b", "bytes": 7602 } }, "started_utc": "2026-10-23T16:10:39.207Z", "status": 200, "final_url": "https://www.01net.com/actualites/failles-php-pourquoi-cest-vrai-casse-tete-internet-mondial.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). 01net (French): the PHP2Shell flaws are a headache for the whole Internet because PHP is everywhere and often invisible, so organisations struggle to...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Failles PHP : pourquoi c'est un vrai casse-tête pour l'Internet mondial\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/01net/actualites-failles-php-pourquoi-cest-vrai-casse-tete-interne`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\n01net (French): the PHP2Shell flaws are a headache for the whole Internet because PHP is everywhere and often invisible, so organisations struggle to find where it runs; some public sites are going offline as a precaution. Experts at the security firm Filigran say the real challenge is not fixing PHP's code but locating every deployment, and compare the situation to Log4Shell.\n\n> PHP2Shell réunit bon nombre des ingrédients de Log4Shell : une exécution de code à distance sans authentification, dans un logiciel présent presque partout\n\n_Curator's translation:_ \"PHP2Shell combines many of the ingredients of Log4Shell: unauthenticated remote code execution, in software present almost everywhere\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ 01net explains why PHP2Shell is hard to remediate: the problem is locating every PHP installation, not applying the patch. It quotes French security firm Filigran (CEO Samuel Hassine, Debrah Galea, Mathieu Rigotoo) and Tanium's Matt Psencik, and compares the situation to Log4Shell.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Failles PHP : pourquoi c'est un vrai casse-tête pour l'Internet mondial\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "20-minuten-20min-fr-suisse-romande", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "publisher": "20 minutes / 20 Minuten", "kind": "news", "title": "Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes", "published": "2026-10-22T06:25:10.292Z", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "9aef40669d0201d439c47909509365a37137d09199d8c388612cab0f3a29c553", "bytes": 1029 }, "page.html": { "sha256": "358331e9dc87d8f08acab4bbaeb6774b1d19fe55e7824c522206baffe72d33c9", "bytes": 306879 }, "provenance.json": { "sha256": "58151440f0c86b5e464fbde2d27cd829a27cc49575fd2c108baeb74dae50c3a1", "bytes": 1744 }, "rendered.html": { "sha256": "338f5ad40d6bf3467a1a4513b54a58819dbd98e8874a971bf1bb5d2a226c879d", "bytes": 476953 }, "text.txt": { "sha256": "d8cc82c5b6a9481087a4ef62989c8855f0cd8432771d1e02fa8a4b9572387e65", "bytes": 8032 } }, "started_utc": "2026-10-22T18:19:14.293Z", "status": 200, "final_url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 4 new items in fr: 20 Minutes reports that French-speaking Switzerland was heavily affected: the universities of Geneva and Fribourg, EPFL and the canton of Basel-Stadt took services offline, and several Romandy communes were disrupted. La", "raw_sha256": {}, "has_notes": true, "notes_md": "# Faille de sécurité: Panne mondiale: la Suisse romande fortement impactée - 20 minutes\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `ch/news/20-minuten/20min-fr-suisse-romande`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: 20 minutes / 20 Minuten. Language: fr. URL: https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\n20 Minutes reports that French-speaking Switzerland was heavily affected: the universities of Geneva and Fribourg, EPFL and the canton of Basel-Stadt took services offline, and several Romandy communes were disrupted. Lausanne's TL site and Orange's site were still down on Thursday morning. The Federal Office for Cybersecurity (OFCS/BACS) urged patching or disconnecting.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/ch/news/20-minuten/20min-fr-suisse-romande.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: The universities of Geneva and Fribourg, EPFL and the canton of Basel-Stadt were affected, with some services still unavailable early Thursday; several Romandy communes were disrupted.\n\n> En Suisse, plusieurs institutions ont été affectées, notamment les universités de Genève et de Fribourg, l’EPFL ainsi que le canton de Bâle-Ville. Tôt jeudi matin, certains de leurs services restaient indisponibles.\n\n_Watch reader's translation:_ In Switzerland, several institutions were affected, notably the universities of Geneva and Fribourg, EPFL and the canton of Basel-Stadt. Early Thursday morning, some of their services remained unavailable.\n\n**offline**: Lausanne's public transport (TL) site was not responding around 08:30 and Orange's site was still in maintenance around 08:45.\n\n> À Lausanne, le site des TL ne répondait pas encore vers 8h30, tandis que l’application des CFF semblait fonctionner normalement. Le site de l’opérateur Orange était, lui aussi, toujours en maintenance vers 8h45.\n\n_Watch reader's translation:_ In Lausanne, the TL site was still not responding around 8:30, while the SBB app seemed to work normally. The operator Orange's site was also still in maintenance around 8:45.\n\n**offline**: EPFL temporarily suspended access to its sites, keeping some services available via VPN.\n\n> L’EPFL a ainsi suspendu temporairement l’accès à ses sites, tout en maintenant certains services disponibles via VPN.\n\n_Watch reader's translation:_ EPFL thus temporarily suspended access to its sites, while keeping some services available via VPN.\n\n**agency**: The Swiss Federal Office for Cybersecurity recommends patching quickly, including internal systems, or limiting access or disconnecting critical services.\n\n> L’Office fédéral de la cybersécurité (OFCS) recommande d’appliquer rapidement les mises à jour, y compris sur les systèmes internes. Si cela s’avère impossible, il préconise de limiter les accès ou de déconnecter temporairement les services critiques d’internet.\n\n_Watch reader's translation:_ The Federal Office for Cybersecurity (OFCS) recommends applying the updates quickly, including on internal systems. If that is impossible, it advises limiting access or temporarily disconnecting critical services from the internet.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 4 new items in fr: 20 Minutes reports that French-speaking Switzerland was heavily affected: the universities of Geneva and Fribourg, EPFL and the canton of Basel-Stadt took services offline, and several Romandy communes were disrupted. La\n\nSupports: translations/ch/news/20-minuten/20min-fr-suisse-romande.json\n\n## Capture notes\n\nNo screenshot: the watch kept none for this snapshot (minor change). Its sha256 was 39d42d0761be07feda77fe8b2ac9095f75ff3f619dd680f423b5c7f7efec639f.\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "20min-fr-suisse-romande", "url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792", "publisher": "20min.ch", "kind": "news", "title": "Faille de sécurité: Panne mondiale des sites web: la Suisse romande touchée - 20 minutes", "published": null, "captures": [ { "stamp": "20261022T081421Z", "files": { "headers.json": { "sha256": "ec6caf4135da86719aa40d4ab03f56d65f84c1393a323affb9b5f566075a2e33", "bytes": 1030 }, "page.html": { "sha256": "c122c6a713574ec43e9c27b9bdd9afe662a2f25cfd14112bb4c399a34fe6aeb6", "bytes": 306897 }, "provenance.json": { "sha256": "a8bd1322043249d1ceb3331e4025987411e7ae56db3c8d5db4199e90f81ae86c", "bytes": 1146 }, "rendered.html": { "sha256": "18773701ad81c36911a593f2d4138ca96ea9955371f3e7022556ab7340ced316", "bytes": 500134 }, "screenshot.png": { "sha256": "c6d13f3785d57ca5b3405690794daba119f9a746779960b2867a560f25784a42", "bytes": 1280191 }, "text.txt": { "sha256": "97a639a7c23eb1a480daf7e711e19852b387f74e01996372a8e3a23d59839dc4", "bytes": 8850 } }, "started_utc": "2026-10-22T08:14:21.874Z", "status": 200, "final_url": "https://www.20min.ch/fr/story/vulnerabilite-it-panne-mondiale-des-sites-web-la-suisse-romande-touchee-103653792" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "20minutos-tecnologia-ciberseguridad-por-que-gobiernos-hospit", "url": "https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html", "publisher": "20Minutos", "kind": "news", "title": "Alerta de PHP: por qué gobiernos, hospitales y colegios desconectan sus webs", "published": "2026-10-22T09:57:42+02:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "3b530c0136bed295474acf950e476f09ae9c7b5dbb85b3d66293e016854e77f2", "bytes": 674 }, "page.html": { "sha256": "a42a8667a49876b3b4ae75f6ac8b985200cd0871f5443e3d7b149b3e1da82eed", "bytes": 236595 }, "provenance.json": { "sha256": "1ab349bdf6ba1f266a1e5536cfc5a32f60bc80cb0bd8afe85e0a6c9fc6e4ac8b", "bytes": 1866 }, "rendered.html": { "sha256": "6d72d1dd7ea4a27f9b093a48a5f7e1cc75d88573091f6b58513efe7a8c678e91", "bytes": 390108 }, "screenshot.jpg": { "sha256": "95c9fa8ba98b9927fb742e0496de6c33e0da29f10fc10fe63ebc5addaf21305a", "bytes": 662231 }, "text.txt": { "sha256": "96ea536b04fe59c76df5ae9fc13efbf08dc59d6eeb8232b7d4c22a85becff632", "bytes": 10690 } }, "started_utc": "2026-10-22T18:20:47.011Z", "status": 200, "final_url": "https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 8 new items in es: 20minutos explains why European governments, hospitals and schools disconnected their sites. It cites an EU joint statement, a warning from BSI vice-president Thomas Caspers, and a detailed (EFE-sourced) list of Belgian ", "raw_sha256": {}, "has_notes": true, "notes_md": "# Alerta de PHP: por qué gobiernos, hospitales y colegios desconectan sus webs\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `es/news/20minutos/tecnologia-ciberseguridad-por-que-gobiernos-hospitales-coleg`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: 20Minutos. Language: es. URL: https://www.20minutos.es/tecnologia/ciberseguridad/por-que-gobiernos-hospitales-colegios-desconectan-webs-alerta-php_7051888_0.html\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\n20minutos explains why European governments, hospitals and schools disconnected their sites. It cites an EU joint statement, a warning from BSI vice-president Thomas Caspers, and a detailed (EFE-sourced) list of Belgian shutdowns: the Flemish government, federal ministries, Smartschool, VRT, Antwerp hospitals and vdk bank. It also covers Germany's Charité and Spain's INCIBE critical notice.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/es/news/20minutos/tecnologia-ciberseguridad-por-que-gobiernos-hospitales-coleg.json`), not the publisher's and not checked word for word by the curator.\n\n**agency**: A joint communiqué from the European Commission, ENISA, CERT-EU, Europol and the EU CSIRTs network advised considering disconnection of exposed applications that cannot be patched.\n\n> la Comisión Europea, ENISA, CERT-EU, Europol y la red europea de equipos de respuesta aconsejan en su comunicado conjunto considerar la desconexión de las aplicaciones expuestas a internet hasta poder corregirlas.\n\n_Watch reader's translation:_ the European Commission, ENISA, CERT-EU, Europol and the European network of response teams advise in their joint communiqué considering disconnecting internet-exposed applications until they can be fixed.\n\n**official**: BSI vice-president Thomas Caspers warned that large-scale exploitation within hours of the patch release was likely (via EFE).\n\n> “Consideramos probable que se produzca un aprovechamiento a gran escala y a corto plazo, en las pocas horas siguientes a la publicación de las actualizaciones de seguridad”.\n\n_Watch reader's translation:_ \"We consider it likely that large-scale exploitation will occur in the short term, within the few hours following the publication of the security updates.\"\n\n**offline**: The Flemish government ordered its PHP-based official websites taken down, including the regional Parliament portal; federal FPS Foreign Affairs, Finance and Employment sites also went down.\n\n> el Gobierno flamenco ordenó retirar temporalmente sus webs oficiales que funcionan con PHP. La medida alcanzó al portal del Parlamento regional y coincidió con la desconexión de páginas de los servicios públicos federales de Asuntos Exteriores, Finanzas y Empleo.\n\n_Watch reader's translation:_ the Flemish government ordered the temporary withdrawal of its official PHP-based websites. The measure reached the regional Parliament portal and coincided with the disconnection of pages of the federal public services for Foreign Affairs, Finance and Employment.\n\n**offline**: School platform Smartschool and public broadcaster VRT's sites were unavailable in Belgium.\n\n> Las familias también encontraron inaccesible Smartschool, la plataforma que utilizan los colegios para comunicarse con padres y alumnos. Varias webs de medios de comunicación, entre ellas las de la radiotelevisión pública flamenca VRT, quedaron igualmente fuera de servicio\n\n_Watch reader's translation:_ Families also found Smartschool, the platform schools use to communicate with parents and pupils, inaccessible. Several media websites, including those of the Flemish public broadcaster VRT, were likewise out of service\n\n**offline**: Two Antwerp hospitals (AZ Monica and university hospital UZA) took their sites down; vdk bank took its corporate site down while online banking continued.\n\n> Dos hospitales de Amberes, AZ Monica y el universitario UZA, retiraron sus páginas. El banco vdk bank hizo lo mismo con su web corporativa, aunque aseguró que la banca electrónica continuaba funcionando.\n\n_Watch reader's translation:_ Two Antwerp hospitals, AZ Monica and the university hospital UZA, took down their pages. The bank vdk bank did the same with its corporate website, although it said online banking continued to work.\n\n**agency**: The Centre for Cybersecurity Belgium said it had no knowledge of actual incidents in the country at that time.\n\n> el Centro para la Ciberseguridad de Bélgica precisó que, en ese momento, no tenía constancia de incidentes reales en el país.\n\n_Watch reader's translation:_ the Centre for Cybersecurity Belgium specified that, at that time, it had no record of actual incidents in the country.\n\n**offline**: In the Netherlands, the Parliament and MijnOverheid went offline alongside DigiD; in Germany administrations, universities and hospitals including Charité did too.\n\n> En Países Bajos, las desconexiones preventivas afectaron al Parlamento, al portal gubernamental MijnOverheid y a DigiD\n\n_Watch reader's translation:_ In the Netherlands, the preventive disconnections affected Parliament, the government portal MijnOverheid and DigiD\n\n**agency**: Spain's INCIBE issued a critical-importance notice urging updates and, if not possible, isolation of exposed systems from public networks.\n\n> En España, el Instituto Nacional de Ciberseguridad (Incibe) también ha emitido un aviso de importancia crítica y ha pedido instalar las actualizaciones cuanto antes.\n\n_Watch reader's translation:_ In Spain, the National Cybersecurity Institute (Incibe) has also issued a critical-importance notice and has asked for updates to be installed as soon as possible.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 8 new items in es: 20minutos explains why European governments, hospitals and schools disconnected their sites. It cites an EU joint statement, a warning from BSI vice-president Thomas Caspers, and a detailed (EFE-sourced) list of Belgian \n\nSupports: translations/es/news/20minutos/tecnologia-ciberseguridad-por-que-gobiernos-hospitales-coleg.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "24-article-969853-ai-php-70", "url": "https://24.ae/article/969853/كيف-لعب-الـAI-دوراً-حاسماً-في-اكتشاف-ثغرة-PHP-تهدد-70-من-مواقع-العالم-", "publisher": "موقع 24", "kind": "news", "title": "كيف لعب الـAI دوراً حاسماً في اكتشاف ثغرة \"PHP\" تهدد 70% من مواقع العالم؟ - موقع 24", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c0a664d8f3d750e83ce55ea219e9d7c2bc662e183efddb6ac865e1ff8a902b9f", "bytes": 872 }, "page.html": { "sha256": "13ee2265f6d28fa811963290a095b98c61d5b719fcd5fefc543f262c382cab4d", "bytes": 110206 }, "provenance.json": { "sha256": "e8643a9455e78bc8801bb3e773f693c62f3351216092d28efebe1dec29fa5afd", "bytes": 2041 }, "rendered.html": { "sha256": "e393fbc613b2df7027eb42d8af47bc3957e0049bf6e6877fd5a437f560dab304", "bytes": 147075 }, "screenshot.jpg": { "sha256": "868e008ced044f1a418460626a80ecde20a9ccb2b2fdfe0c25d5c0bbd0ceadae", "bytes": 543735 }, "text.txt": { "sha256": "b00b4ee3ceb08beabe4387d853d6715bb89202536a3ad1a038d737e35cd83bec", "bytes": 18164 } }, "started_utc": "2026-10-23T16:09:04.382Z", "status": 200, "final_url": "https://24.ae/article/969853/%D9%83%D9%8A%D9%81-%D9%84%D8%B9%D8%A8-%D8%A7%D9%84%D9%80AI-%D8%AF%D9%88%D8%B1%D8%A7%D9%8B-%D8%AD%D8%A7%D8%B3%D9%85%D8%A7%D9%8B-%D9%81%D9%8A-%D8%A7%D9%83%D8%AA%D8%B4%D8%A7%D9%81-%D8%AB%D8%BA%D8%B1%D8%A9-PHP-%D8%AA%D9%87%D8%AF%D8%AF-70-%D9%85%D9%86-%D9%85%D9%88%D8%A7%D9%82%D8%B9-%D8%A7%D9%84%D8%B9%D8%A7%D9%84%D9%85-" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Site 24 (Arabic, UAE): how AI played a decisive role in finding the PHP flaw said to threaten 70% of the world's sites. It says the researchers, thank...", "raw_sha256": {}, "has_notes": true, "notes_md": "# كيف لعب الـAI دوراً حاسماً في اكتشاف ثغرة \"PHP\" تهدد 70% من مواقع العالم؟ - موقع 24\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ae/news/24/article-969853-ai-php-70`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSite 24 (Arabic, UAE): how AI played a decisive role in finding the PHP flaw said to threaten 70% of the world's sites. It says the researchers, thanks to the models, found a set of flaws in the PHP engine itself, grouped under two: CVE-2026-109618, a memory-management bug when memory runs out while handling requests, and CVE-2026-109619, a bug that leaves pointers behind.\n\n> بفضل قدرات النماذج عثر الباحثون على مجموعة من العيوب الأمنية\n\n_Curator's translation:_ \"Thanks to the capabilities of the models, the researchers found a set of security flaws\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ UAE outlet 24.ae explains how AI (Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol) helped find the PHP flaws, quoting Wiz and the NSA advice to patch or go offline. It says countries including Japan, the US, France and Denmark disabled some digital services, and a linked teaser says Japanese banks and airlines suspended digital services.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"كيف لعب الـAI دوراً حاسماً في اكتشاف ثغرة \"PHP\" تهدد 70% من مواقع العالم؟ - موقع 24\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "24heures-php2shell-qui-est-affecte-par-la-faille", "url": "https://www.24heures.ch/php2shell-qui-est-affecte-par-la-faille-en-suisse-196968803007", "publisher": "24 Heures", "kind": "news", "title": "«PHP2Shell»: qui est affecté par la faille en Suisse", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a098465a772cdbccc0fa1111e6a85f02e956e643baaf8d439ad2721faefac8dc", "bytes": 567 }, "page.html": { "sha256": "6e359c13024a6847fd506739b658a84828446b64efbd428002db7e7aa0cd3d24", "bytes": 327391 }, "provenance.json": { "sha256": "9797b6bfb56fd9a61b220292942a3a3219065acf0e7d57cf1fbf1d8c69154b9f", "bytes": 1745 }, "rendered.html": { "sha256": "d226ed76c93ef2040647949efcfbd56a0fe41a0080c51f91bb0a5744a193104d", "bytes": 416857 }, "screenshot.jpg": { "sha256": "a2b4f370dc3da4706e167da6eb314db3471064d055541aed3416f4e61dff3574", "bytes": 648655 }, "text.txt": { "sha256": "5a3e765f34731b2628ce57ef7c16d6fbf9b65c05a88a3e17fb46c9199c4db11c", "bytes": 9385 } }, "started_utc": "2026-10-23T16:12:05.185Z", "status": 200, "final_url": "https://www.24heures.ch/php2shell-qui-est-affecte-par-la-faille-en-suisse-196968803007" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). 24 Heures (French, Switzerland), 22 October: who is actually affected by PHP2Shell. Critical PHP flaws forced the EPFL and other institutions to suspe...", "raw_sha256": {}, "has_notes": true, "notes_md": "# «PHP2Shell»: qui est affecté par la faille en Suisse\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/24heures/php2shell-qui-est-affecte-par-la-faille-en-suisse-1969688030`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\n24 Heures (French, Switzerland), 22 October: who is actually affected by PHP2Shell. Critical PHP flaws forced the EPFL and other institutions to suspend access to their sites; details leaked prematurely and many sites were taken offline as a precaution.\n\n> En Suisse, plusieurs institutions ont été touchées, notamment l’École polytechnique fédérale de Lausanne (EPFL), l’administration de Bâle-Ville et l’Université de Genève (UNIGE).\n\n_Curator's translation:_ \"In Switzerland, several institutions were affected, notably the Ecole polytechnique federale de Lausanne (EPFL), the Basel-Stadt administration and the University of Geneva (UNIGE).\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ 24 heures runs a Q&A on who is affected in Switzerland: EPFL, the Basel-Stadt administration and UNIGE went offline, and insurer La Mobilière suspended its website. Swiss host Cyon (more than 110,000 sites) took sites offline and lifted the alert at 04:00 Thursday. Germany's BSI compared PHP2Shell to Log4Shell and Heartbleed.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"«PHP2Shell»: qui est affecté par la faille en Suisse\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "2days-22-10-07-109016-it-program", "url": "https://2days.kr/22/10/07/109016/it/program/", "publisher": "2days.kr", "kind": "news", "title": "PHP 보안 취약점 비상, AI 발견 PHP2Shell 워드프레스 서버 패치 - 투데이즈.kr", "published": "2026-10-22T07:46:43+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "666ebb2161e3dd02d36462d363c099b25f3410e5078c967df6ca4af594a98be9", "bytes": 522 }, "page.html": { "sha256": "2fb757e100676d202897bf9557c9006973055ce3936dff59e0c763276531d59e", "bytes": 394514 }, "provenance.json": { "sha256": "d1923ac61c00a9bee2cc0c8a60dc8e9dd5e1a091ec650c2ed2d07446f89ebf1f", "bytes": 1609 }, "rendered.html": { "sha256": "c6b4b3820dc377f2d7d619fc9f4db39f23ab3f3bc7d45f1d312b49e874ec0c81", "bytes": 517739 }, "screenshot.jpg": { "sha256": "5ceaaa4bba350a2843f88aa800cf8807eca9789a5bf25af2697ed6ab3d7bb52d", "bytes": 592971 }, "text.txt": { "sha256": "53241401e8e04d5dbcbc8d63265e5147ef32a96d35e89b6009cf2fc31f7efc9d", "bytes": 15297 } }, "started_utc": "2026-10-23T16:21:02.143Z", "status": 200, "final_url": "https://2days.kr/22/10/07/109016/it/program/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko-KR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). 2days.kr (Korean), 22 October: a headline piece on the PHP security vulnerability emergency, the AI-discovered PHP2Shell, and patching WordPress serve...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP 보안 취약점 비상, AI 발견 PHP2Shell 워드프레스 서버 패치 - 투데이즈.kr\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/2days/22-10-07-109016-it-program`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\n2days.kr (Korean), 22 October: a headline piece on the PHP security vulnerability emergency, the AI-discovered PHP2Shell, and patching WordPress servers; it has a section on why PHP2Shell is serious. Only the headings were read closely.\n\n> PHP 보안 취약점 비상, AI 발견 PHP2Shell 워드프레스 서버 패치\n\n_Curator's translation:_ \"PHP security vulnerability emergency: the AI-found PHP2Shell, patching WordPress servers\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ 2days.kr Korean blog explainer for WordPress operators on PHP2Shell: versions, mitigations, how to check for compromise.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP 보안 취약점 비상, AI 발견 PHP2Shell 워드프레스 서버 패치 - 투데이즈.kr\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko-KR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "aa-en-science-technology-php-security-crisi", "url": "https://www.aa.com.tr/en/science-technology/php-security-crisis-prompts-websites-worldwide-to-push-updates-for-critical-vulnerabilities/4097614", "publisher": "Anadolu Ajansı", "kind": "news", "title": "PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities", "published": "2026-10-22T18:59:20.067", "captures": [ { "stamp": "20261025T120459Z", "files": { "headers.json": { "sha256": "e834d71b803615b52d3404d84d03e2051ad6113d764181ecd2a842cef9df3946", "bytes": 4338 }, "page.html": { "sha256": "e714e5101b4f667459f4f2ae0d3ad209e0afbd989b96d83772e12d2d00cca7dd", "bytes": 307051 }, "provenance.json": { "sha256": "bbd12ca6fe32cf4cb8ce8be64361a0a55cb185f5601d5e8407a291cb332045b9", "bytes": 1878 }, "rendered.html": { "sha256": "2074b6f14e6b4868f149dee38532674873075245fb18c49d5c1e23aaae9a2b13", "bytes": 266399 }, "screenshot.jpg": { "sha256": "63d5f214d40065cd4421250f95b9830911bfa038498237800047ff2db353f69c", "bytes": 271563 }, "text.txt": { "sha256": "12d252dc05d720eb4be42c63a7f99de7240f7db3b52b27bd840cd386d18a01bb", "bytes": 3552 } }, "started_utc": "2026-10-25T12:26:00.065Z", "status": 200, "final_url": "https://www.aa.com.tr/en/science-technology/php-security-crisis-prompts-websites-worldwide-to-push-updates-for-critical-vulnerabilities/4097614" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Anadolu Agency (English), 22 October: the PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities. The PHP2Shell r...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/aa/en-science-technology-php-security-crisis-prompts-websites-w`, snapshot `20261025T120459Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T120459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAnadolu Agency (English), 22 October: the PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities. The PHP2Shell remote code execution flaw is patched, but organisations still need to identify vulnerable systems and update, agencies warn; it stems from errors in code and memory management that allow remote code execution without a username or password.\n\n> ‘PHP2Shell’ remote code execution vulnerability patched, but organizations need to identify vulnerable systems and update to the latest PHP version, agencies warn\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP security crisis prompts websites worldwide to push updates for critical vulnerabilities\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "abc-au-gov-sites-exposed", "url": "https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812", "publisher": "abc.net.au", "kind": "news", "title": "Australian government sites among those exposed to 'critical' PHP software flaw - ABC News", "published": null, "captures": [ { "stamp": "20261022T081518Z", "files": { "headers.json": { "sha256": "7eb1bee622cf88c19ad0c31a199ac5c5fa98f148909ca4ffda4aeef8ee212c8e", "bytes": 980 }, "page.html": { "sha256": "506809c0c2a4827c59244c5f032fedc30ff94c21df141cc94f292f2aeb920e41", "bytes": 355918 }, "provenance.json": { "sha256": "c69347feb600272b4099bc58e7e72cb706de4d81fb734b5ebf4f1f0c1ef88666", "bytes": 1080 }, "rendered.html": { "sha256": "142b8b27452f3beaf38f835213c9448696b78ff4c6232ec416384dcdb6ddd8c5", "bytes": 373382 }, "screenshot.png": { "sha256": "dd71e33143d109e44b4c5fb22a80f0d797c698d1cf4260e20d5d40edc3ffc378", "bytes": 2393273 }, "text.txt": { "sha256": "84937c7c5b87e7c94cf87f2aed94f82ebbf2824d6dea9841cd50e39111d2cb48", "bytes": 9085 } }, "started_utc": "2026-10-22T08:15:18.739Z", "status": 200, "final_url": "https://www.abc.net.au/news/2026-10-22/php-vulnerabilities-cyber-asd/107294812" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "abc-au-politics-live", "url": "https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950", "publisher": "abc.net.au", "kind": "news", "title": "Federal politics: No government websites hacked after global security flaw found — as it happened - ABC News", "published": null, "captures": [ { "stamp": "20261022T081530Z", "files": { "headers.json": { "sha256": "78001e770a86a878a5ebbf2ed9724c2eeaf6f9a29dcdbbc821df7c4043fbe78c", "bytes": 956 }, "page.html": { "sha256": "e91a707c8b974b1afe24cd6863a6b4e860bb4facdf86456630dde038f9ae025d", "bytes": 911394 }, "provenance.json": { "sha256": "7f0e05f09575c7515b8f03d9afa0bb0948122701de5fd040cf69b20506ce3839", "bytes": 1116 }, "rendered.html": { "sha256": "ac5782fe9d12a17ebc032bb0cd75e0b92b2074fd68a151cea865e274104429c6", "bytes": 1003403 }, "screenshot.png": { "sha256": "92b44e296ddf641d1d22a62d5bbb43fa39efd8bf9c2bbb3120a6aa976cf28fb3", "bytes": 4591087 }, "text.txt": { "sha256": "a86331d9b7a21f78af1750d3daf6ebbb696253e1216649e973e34262313040b1", "bytes": 43063 } }, "started_utc": "2026-10-22T08:15:30.938Z", "status": 200, "final_url": "https://www.abc.net.au/news/2026-10-22/federal-politics-live-blog-helen-haines/107294950" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "acn-it-php2shell", "url": "https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php", "publisher": "ACN / CSIRT Italia", "kind": "advisory", "title": "PHP2Shell: sanate vulnerabilità critiche in PHP (AL07/261021/CSIRT-ITA)", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081354Z", "files": { "headers.json": { "sha256": "c44211ff9b8440ef6922919056abed0873179324fdf7db7ddf969c8d1dd6bd15", "bytes": 732 }, "page.html": { "sha256": "6ab511ebb1dd7a3d6235d88dc71a02c8ecefec27283538cec68a134d33d67440", "bytes": 118598 }, "provenance.json": { "sha256": "b832861c53d09b3d98083bc23e3c4578748f1f8173e2ea7c23bd8c9dfa6f1c8b", "bytes": 1038 }, "rendered.html": { "sha256": "91c9550654c551eeacb33e829fe2246a7307efbcf7cd00d4cf10f5a44413cf07", "bytes": 131205 }, "screenshot.png": { "sha256": "94246ab38f323d629edf5c1820908d804f7f45f61bc276e7c77e756aa549fc65", "bytes": 687162 }, "text.txt": { "sha256": "19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6", "bytes": 6137 } }, "started_utc": "2026-10-22T08:13:54.096Z", "status": 200, "final_url": "https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Alert AL07/261021/CSIRT-ITA, published 21-10-2026. CVSS v4.0 9.2 each (Use After Free). Mitigation: only 'aggiornare i prodotti vulnerabili' (update); it gives no offline advice.", "raw_sha256": {}, "has_notes": true, "notes_md": "# ACN / CSIRT Italia alert AL07/261021/CSIRT-ITA\n\n- \"Pubblicato il 21-10-2026\". Captured 2026-10-22T08:13:54Z.\n- It calls both CVEs \"Use After Free\" with CVSS v4.0 9.2. Affected: 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35 (it does not list EOL branches).\n- Mitigation, verbatim: \"Si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.\" It advises update only, with NO offline or isolation advice.\n" }, { "slug": "acsc-alert-php", "url": "https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php", "publisher": "ASD's ACSC (Australia)", "kind": "advisory", "title": "Critical vulnerabilities in PHP", "published": "2026-10-21 (Published); Last reviewed 2026-10-22", "captures": [ { "stamp": "20261022T081658Z", "files": { "headers.json": { "sha256": "3f7c0fe9c702d22193630225a56b0991c08fc52fb05ef53f26ea0f611b798b4e", "bytes": 1985 }, "page.html": { "sha256": "650742fe93abb6dec911f58d21b7cd6d8d82c2d4a7b89eb9745e9a9857bc0c72", "bytes": 1541271 }, "provenance.json": { "sha256": "37ce725a8459c6db87ef8d7e3abd3cf92d350bab9e4228852c7d07dd08d65a6f", "bytes": 985 }, "rendered.html": { "sha256": "731eef8ce851ccf1650bc66cf3bb8658569c3de13b3a8084c14761658743e931", "bytes": 1557700 }, "screenshot.png": { "sha256": "39318847477c383a130dbafc83210dc27ed7ccae88107979ed124e372d67da9d", "bytes": 345966 }, "text.txt": { "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "bytes": 6299 } }, "started_utc": "2026-10-22T08:16:58.765Z", "status": 200, "final_url": "https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Alert Status: Critical. Published 21 Oct 2026, last reviewed 22 Oct 2026. 'Recent update': identify PHP, review php.net, apply updates and mitigations, monitor. NO offline advice. 'not aware of successful active exploitation within Australia'. Says full details were announced 'Thursday 22 October 2026 at 0100 AEDT' (=21 Oct 14:00Z). The body text is stale (pre-patch).", "raw_sha256": {}, "has_notes": true, "notes_md": "# ASD's ACSC alert: Critical vulnerabilities in PHP\n\n- Site title \"CGA\". Plain curl to cyber.gov.au timed out from this egress, but Playwright got 200.\n- \"Alert Status: Critical\". \"Published 21 Oct 2026\". \"Last reviewed 22 Oct 2026\". Captured 2026-10-22T08:16:58Z.\n- Recent update (verbatim): \"Patches have been released ... ASD's ACSC recommends organisations: - Identify PHP within their environments - Review the latest PHP guidance at https://www.php.net/index.php - Apply available security updates and other appropriate mitigations - Monitor PHP applications and related systems for suspicious activity.\"\n- The older body text is still pre-patch: \"Prepare to update and apply security patches as they become available.\" It also says \"full details publicly announced on Thursday 22 October 2026 at 0100 AEDT\" (= 2026-10-21T14:00Z). The summary line still reads \"is set for public disclosure on 22 October 2026.\"\n- \"ASD’s ACSC is not aware of successful active exploitation within Australia\".\n- **No take-offline or isolation advice.** This contradicts the BBC framing that the Australian counterpart issued advice like the NCSC/NSA. The ACSC advice is patch, mitigate and monitor.\n" }, { "slug": "acsc-home", "url": "https://www.cyber.gov.au/", "publisher": "ASD's ACSC", "kind": "government", "title": "cyber.gov.au home", "published": null, "captures": [ { "stamp": "20261022T081604Z", "files": { "headers.json": { "sha256": "3d448cbb053930039edd6bcb6779264beb2fa8c4c073bc5084ca3a5b0c369a5f", "bytes": 1937 }, "page.html": { "sha256": "bd81a8f884e1cbe1f2ae88c146b6198346568f2324677adce3198b5578db19c3", "bytes": 1854064 }, "provenance.json": { "sha256": "992e9c6ce0b26d2edb42343e569ac2634e532a277a5e804ec657ed66acda47a9", "bytes": 879 }, "rendered.html": { "sha256": "e22b8af8cb588bdf894c62c53337db8940108a269e2f517f1d6ffa1886d8d904", "bytes": 1889870 }, "screenshot.png": { "sha256": "3f7acad6a96208dca53692a35f83a89e3b21e8266fcd183892673c6e4b3b39b0", "bytes": 723009 }, "text.txt": { "sha256": "b7198501ad800f9312359edf414e81c46b1b35f7d0fae787ff629a8f029ad0b9", "bytes": 13389 } }, "started_utc": "2026-10-22T08:16:04.649Z", "status": 200, "final_url": "https://www.cyber.gov.au/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Home at 08:16Z: the PHP alert teaser is dated 22 Oct 2026 with the stale pre-disclosure blurb.", "raw_sha256": {}, "has_notes": true, "notes_md": "# cyber.gov.au home\n\nCaptured 08:16Z. Teaser: \"22 Oct 2026 Critical vulnerabilities in PHP. A security release for two critical PHP vulnerabilities is set for public disclosure on 22 October 2026.\"\n" }, { "slug": "actainfo-news-php2shell-vulnerabilita-php-allerta", "url": "https://www.actainfo.it/news/php2shell-vulnerabilita-php-allerta-nsa/", "publisher": "actainfo", "kind": "news", "title": "PHP2Shell: allerta NSA, aggiornamenti urgenti siti web - Actainfo", "published": "2026-10-23T10:57:22+00:00", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "bf9d8f1d4ac4796532e432c43178eddd691035edb91eef84a7d89fa084e5118a", "bytes": 576 }, "page.html": { "sha256": "598e104bba47d62cf9411ebfc901fe9e7b9940e1c6f5c25f0d644447a96e570d", "bytes": 175943 }, "provenance.json": { "sha256": "2f654ebd1e1a7f4fcf42dfed4eeff8141911545165f0e9cd368b39371830d08f", "bytes": 1685 }, "rendered.html": { "sha256": "932ef002b633cca784937cc0acf982daba804202c59224b3a03e1e245f85d6ac", "bytes": 180594 }, "screenshot.jpg": { "sha256": "660674662717a7db269d4d4cf2340f14735134b31f0debe03e502f547eb91777", "bytes": 803875 }, "text.txt": { "sha256": "0dc76adb26d5b438f7b78faa9e2ad069dbcca30c663ead7950b7527c93412f3d", "bytes": 8952 } }, "started_utc": "2026-10-25T09:49:06.917Z", "status": 200, "final_url": "https://www.actainfo.it/news/php2shell-vulnerabilita-php-allerta-nsa/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Actainfo (Italian), 23 October: PHP2Shell, NSA alert, urgent website updates. On 21 October 2026 the US NSA published an advisory on the vulnerabiliti...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: allerta NSA, aggiornamenti urgenti siti web - Actainfo\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/actainfo/news-php2shell-vulnerabilita-php-allerta-nsa`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nActainfo (Italian), 23 October: PHP2Shell, NSA alert, urgent website updates. On 21 October 2026 the US NSA published an advisory on the vulnerabilities, inviting organisations to inventory the services that use PHP and prioritise security updates. Amazon Threat Intelligence reports an attempt traced to PHP2Shell in its MadPot decoy systems on 17 October, four days before disclosure, and further attempts on 21 October, including after the fixes were released.\n\n> Il 21 ottobre 2026 la National Security Agency statunitense ha pubblicato un avviso sulle vulnerabilità note come PHP2Shell, invitando le organizzazioni a censire i servizi che utilizzano PHP e a dare priorità agli aggiornamenti di sicurezza.\n\n_Curator's translation:_ \"On 21 October 2026 the US National Security Agency published an advisory on the vulnerabilities known as PHP2Shell, inviting organisations to inventory the services that use PHP and to give priority to security updates.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: allerta NSA, aggiornamenti urgenti siti web - Actainfo\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "actu17-prefectures", "url": "https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html", "publisher": "actu17.fr", "kind": "news", "title": "Failles critiques dans PHP : des sites coupés en urgence dans le monde entier, dont ceux des préfectures en France", "published": null, "captures": [ { "stamp": "20261022T081432Z", "files": { "headers.json": { "sha256": "51ca3518271f6b77dfd5502a1084de33fcdcc75aa21d76280fd7b10227be55d2", "bytes": 910 }, "page.html": { "sha256": "e4744fede4d347f630287801ecbdbefc7a21ab25a961f5bb12a06dcc959c3585", "bytes": 37354 }, "provenance.json": { "sha256": "2faf46b7a81953effd2d1256c51fe7dae806b2c5671339fc78ae35e43432c07e", "bytes": 1228 }, "rendered.html": { "sha256": "a31b9a050ff5cf246e67672d2863411d61d66aa22c7b054dafc0ec617050cec2", "bytes": 637675 }, "screenshot.png": { "sha256": "8a46e45f9c1b73734d153216ebbff665fd9ea8d86befee39b20ea269d2a41b64", "bytes": 10462799 }, "text.txt": { "sha256": "84edb7f59b55a5ce64bf9458671e49987b9e48e0e8388039de616a4c8c1e534d", "bytes": 16675 } }, "started_utc": "2026-10-22T08:14:32.222Z", "status": 200, "final_url": "https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ff08af6368a1938907d64264b50c26f9ec768e5cf3f8c8a72c869153ee89dabe", "bytes": 919 }, "page.html": { "sha256": "12d76736b5a61df0f780f8c16abfbc13f5250c76bc90be48999aabedaca7a576", "bytes": 37430 }, "provenance.json": { "sha256": "5e7ed4bee317997ff444c2822619c1a56be8a387f4f5f3117355f586ad2eef65", "bytes": 1914 }, "rendered.html": { "sha256": "22d20d4a76c1c6dbba5542ff54a5129fbf7b558132cf589ad89b1a98f7112dee", "bytes": 282481 }, "screenshot.jpg": { "sha256": "c7fb452c9b364c96f7c9095fe4291a6cc5725c61bb22f8ac64e8501da1cc16f9", "bytes": 727672 }, "text.txt": { "sha256": "346a32b44db2a9745dafe50e004627c4c52846c76c906e2e23f2e38779046e3b", "bytes": 8936 } }, "started_utc": "2026-10-23T16:14:43.004Z", "status": 200, "final_url": "https://actu17.fr/societe/failles-critiques-dans-php-des-sites-coupes-en-urgence-dans-le-monde-entier-dont-ceux-des-prefectures-en-france.html" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "actuia-anssi-sites-offline", "url": "https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/", "publisher": "ActuIA", "kind": "news", "title": "PHP flaws: France's ANSSI orders sites offline", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112454Z", "files": { "headers.json": { "sha256": "ee48005ae8388bf72bebfeea8f3d95100abf6faae001e3c235a5506d2f6dc21e", "bytes": 473 }, "page.html": { "sha256": "ff30fd43654cd08a1f693e8d4d915c41820729be9a1991d5f4e462d1d0bb22f4", "bytes": 116023 }, "provenance.json": { "sha256": "e9c5fc723d72d43ad18613c74102fa5d72fc2799e91e0f81c2cfbfd51a52d794", "bytes": 1090 }, "rendered.html": { "sha256": "74e68194027420a7a98f41f234f8da46f93ff0e5c77fec86c07d115f15365688", "bytes": 122914 }, "screenshot.png": { "sha256": "f934a67b32d8386b43d01a1a9baece42d7406c36ed9bec407ef19f9a26d73475", "bytes": 1673964 }, "text.txt": { "sha256": "8f399970329ffcead878dced88dbb206b9677895965091d0efb60334becc9f9a", "bytes": 10744 } }, "started_utc": "2026-10-22T11:24:54.144Z", "status": 200, "final_url": "https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/" }, { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "2e67366960549dd0c8d6f5b46152a23c84be7952bc81edb5881bd28cf1edfdf6", "bytes": 545 }, "page.html": { "sha256": "4e706e01786613c1617993f9a6021c067d3b342ea36247611bd0ed68103158de", "bytes": 116430 }, "provenance.json": { "sha256": "c6ebc049ea166eda01e5d0d19d2882489a9649afe8adfdc97b7fb80ba8f18dc9", "bytes": 1812 }, "rendered.html": { "sha256": "61b5414da65b86014b4957ead0a8a777498dc78d1c83acac4576860692df8a57", "bytes": 123339 }, "screenshot.jpg": { "sha256": "9317ff24b17d932099ad6308dfa0c7bea69e531f1e8420eb6b634af3505d481f", "bytes": 631317 }, "text.txt": { "sha256": "d8e16086232ef31ed906359127734021cef7e4809b320813548c7d85927b9323", "bytes": 10731 } }, "started_utc": "2026-10-23T08:16:47.348Z", "status": 200, "final_url": "https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: 'France's ANSSI orders sites offline'; compare CERT-FR's own wording (isolate, then migrate).", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP flaws: France's ANSSI orders sites offline\n\nCaptured by claude-story-site. Status: captured. Secondary: 'France's ANSSI orders sites offline'; compare CERT-FR's own wording (isolate, then migrate).\n\n- The headline overstates CERT-FR's text.\n" }, { "slug": "addustour-articles-1598648", "url": "https://www.addustour.com/articles/1598648", "publisher": "جريدة الدستور", "kind": "news", "title": "«الأمـن السيــبـرانــي» يدعو إلى تحديث «PHP» لمعالجة ثغرتين أمنيتين", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "37e76206a07cafa8d3e8428fbe243ad9aa5178e6be1a49cb3ad37db8056b4fed", "bytes": 1229 }, "page.html": { "sha256": "5360a2d02e4a90b00c7c1d8732011052fde48e08a56834ee3cb85d128d46cd34", "bytes": 179845 }, "provenance.json": { "sha256": "25f342479806d5adb91ec94d953f4d8e8312e913588283de1e6db19020b1a219", "bytes": 1612 }, "rendered.html": { "sha256": "a67d2c5ac0ef9bb660330ab0c81c936770f76b23811f28ef324325ce41da1dc0", "bytes": 295980 }, "screenshot.jpg": { "sha256": "87cffb9dc3b324680962ad21b8c1ce87d84ad5e0aa9cea1db071fe4231f613a8", "bytes": 546569 }, "text.txt": { "sha256": "ace3332a472a3d8b7bb12d71ab52e23bda54a30023018adcc43004900cee65db", "bytes": 11321 } }, "started_utc": "2026-10-23T23:40:01.488Z", "status": 200, "final_url": "https://www.addustour.com/articles/1598648" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Addustour (Arabic): a national cyber security centre recommends that national institutions using affected PHP versions give priority to fixing CVE-202...", "raw_sha256": {}, "has_notes": true, "notes_md": "# «الأمـن السيــبـرانــي» يدعو إلى تحديث «PHP» لمعالجة ثغرتين أمنيتين\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sa/news/addustour/articles-1598648`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAddustour (Arabic): a national cyber security centre recommends that national institutions using affected PHP versions give priority to fixing CVE-2026-109618 and CVE-2026-109619 and apply the additional security measures needed to limit the risk. The page does not name the country in the part read; the outlet is likely Jordan's.\n\n> أوصى المركز الوطني للأمن السيبراني، المؤسسات الوطنية التي تستخدم إصدارات متأثرة من لغة البرمجة «PHP» بإعطاء الأولوية لمعالجة ثغرتين أمنيتين\n\n_Curator's translation:_ \"The National Cyber Security Centre recommended that national institutions using affected versions of the PHP language give priority to dealing with two security vulnerabilities\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"«الأمـن السيــبـرانــي» يدعو إلى تحديث «PHP» لمعالجة ثغرتين أمنيتين\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "agconnect-maatschappij-security-welke-nederlandse-websites-w", "url": "https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht", "publisher": "AG Connect", "kind": "news", "title": "Offline door PHP kwetsbaarheden: Welke Nederlandse websites waren uit de lucht?", "published": "2026-10-21T20:55:05+02:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "7225010355dbfcd01a55cf7b99ee6c5b8037357178f53cb5a187bece7cf79015", "bytes": 598 }, "page.html": { "sha256": "367f64895fae9a5747832edea3af9968270b22166991f49a61cdd221e2c32202", "bytes": 72981 }, "provenance.json": { "sha256": "c89b09ab27440860478f4dc92f031ca378a261db0a49b3fcd4fb422648ba8f2d", "bytes": 1790 }, "rendered.html": { "sha256": "787bd9fd2c74a4ae3dfce48d3c514034b797b7b86c06a673320fa807bd327859", "bytes": 146785 }, "screenshot.jpg": { "sha256": "4836abeb16e1d3583a117a35296b477e61bab178c52c88a797244b502ec60af4", "bytes": 500736 }, "text.txt": { "sha256": "505809e89b530fe70249289f22bf5d7aa6c94100d0656851754fb9a469552cbc", "bytes": 6233 } }, "started_utc": "2026-10-22T18:26:50.173Z", "status": 200, "final_url": "https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 7 new items in nl: AG Connect lists Dutch websites that went offline: at least 13 of 25 safety regions, the Schiphol app, the Port of Rotterdam, Odido's BEN and Simpel brands, many political parties, the Tweede Kamer and MijnOverheid, seve", "raw_sha256": {}, "has_notes": true, "notes_md": "# Offline door PHP kwetsbaarheden: Welke Nederlandse websites waren uit de lucht?\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `nl/news/agconnect/maatschappij-security-welke-nederlandse-websites-waren-uit-d`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: AG Connect. Language: nl. URL: https://www.agconnect.nl/maatschappij/security/welke-nederlandse-websites-waren-uit-de-lucht\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nAG Connect lists Dutch websites that went offline: at least 13 of 25 safety regions, the Schiphol app, the Port of Rotterdam, Odido's BEN and Simpel brands, many political parties, the Tweede Kamer and MijnOverheid, several hospitals, AG Connect itself and supermarket Hoogvliet. Most central government (Rijksoverheid) sites stayed up because they do not use PHP.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/nl/news/agconnect/maatschappij-security-welke-nederlandse-websites-waren-uit-d.json`), not the publisher's and not checked word for word by the curator.\n\n**number**: At least 13 of the 25 Dutch safety regions took their websites offline, including IJsselland, Twente, Gelderland-Midden, Noord-Holland-Noord, Rotterdam-Rijnmond and Zeeland.\n\n> Zo gingen de websites van zeker dertien van de 25 veiligheidsregio's in Nederland offline.\n\n_Watch reader's translation:_ Thus the websites of at least thirteen of the 25 safety regions in the Netherlands went offline.\n\n**offline**: Schiphol took the Schiphol app offline as a precaution, while its website stayed up with a notice about a global digital threat.\n\n> Schiphol haalde de Schiphol-app uit voorzorg uit de lucht.\n\n_Watch reader's translation:_ Schiphol took the Schiphol app offline as a precaution.\n\n**offline**: The Port of Rotterdam temporarily took its website offline, saying there were no signs of concrete security problems.\n\n> Ook het Havenbedrijf Rotterdam heeft zijn website tijdelijk offline gehaald, maar gaf aan dat er geen signalen waren dat de situatie tot concrete veiligheidsproblemen leidde.\n\n_Watch reader's translation:_ The Port of Rotterdam Authority also temporarily took its website offline, but indicated there were no signs that the situation led to concrete security problems.\n\n**offline**: Telecom company Odido took the sites of its brands BEN and Simpel offline; Odido's own site does not use PHP.\n\n> Telecombedrijf Odido heeft uit voorzorgeen de sites van de merken BEN en Simpel offline gehaald.\n\n_Watch reader's translation:_ Telecom company Odido took the sites of the brands BEN and Simpel offline as a precaution.\n\n**offline**: VVD, CDA, PRO, BBB and PvdD said their sites were taken offline preventively; D66, SGP, ChristenUnie, DENK and JA21 sites were also offline.\n\n> VVD, CDA, PRO, BBB en PvdD hebben ook laten weten dat hun sites preventief offline zijn gehaald vanwege het risico.\n\n_Watch reader's translation:_ VVD, CDA, PRO, BBB and PvdD have also announced that their sites were taken offline preventively because of the risk.\n\n**offline**: Several hospital sites were unreachable, including Maastricht UMC+, Jeroen Bosch Ziekenhuis, BovenIJ, Albert Schweitzer Ziekenhuis, Haaglanden MC, St. Antonius and Elisabeth-TweeSteden.\n\n> De sites van onder meer Maastricht UMC+, het Jeroen Bosch Ziekenhuis in Den Bosch, BovenIJ in Amsterdam en het Albert Schweitzer Ziekenhuis in Dordrecht waren niet bereikbaar.\n\n_Watch reader's translation:_ The sites of, among others, Maastricht UMC+, the Jeroen Bosch Hospital in Den Bosch, BovenIJ in Amsterdam and the Albert Schweitzer Hospital in Dordrecht were not reachable.\n\n**other**: Most Dutch central-government organisation websites kept working because they do not use PHP.\n\n> De meeste websites van rijksoverheidsorganisaties werkten nog wel gewoon. Die maken geen gebruik van PHP.\n\n_Watch reader's translation:_ Most websites of central government organisations still worked normally. They do not use PHP.\n\n**offline**: Supermarket chain Hoogvliet took its website offline; AG Connect and sister titles such as iBestuur were also taken offline.\n\n> Supermarktketen Hoogvliet haalde echter wel de website uit de lucht.\n\n_Watch reader's translation:_ Supermarket chain Hoogvliet did, however, take its website offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 7 new items in nl: AG Connect lists Dutch websites that went offline: at least 13 of 25 safety regions, the Schiphol app, the Port of Rotterdam, Odido's BEN and Simpel brands, many political parties, the Tweede Kamer and MijnOverheid, seve\n\nSupports: translations/nl/news/agconnect/maatschappij-security-welke-nederlandse-websites-waren-uit-d.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "agendadigitale-sicurezza-php2shell-lai-accelera-la-scop", "url": "https://www.agendadigitale.eu/sicurezza/php2shell-lai-accelera-la-scoperta-delle-falle-rischi-per-le-aziende/", "publisher": "Agenda Digitale", "kind": "news", "title": "PHP2Shell, l’AI accelera la scoperta delle falle: rischi per le aziende - Agenda Digitale", "published": "2026-10-22T14:23:20+00:00", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "0bbf81a12db16da4437819cd3bd89fe2cdbe3eb1c4d88e0931979e41c53705d7", "bytes": 1173 }, "page.html": { "sha256": "a192b4cfa6e16c33514bbea1c80c3437e9a9af076031cfd816da0fdfde0053d2", "bytes": 481976 }, "provenance.json": { "sha256": "7b6e4c499af98046ef8fa0ca9806cfcd71c821386e65901431216918776f2e3a", "bytes": 1841 }, "rendered.html": { "sha256": "deda7873e265cdb63cff63ce58342c3c47455bf71bfcc46cd96646d5aa911b06", "bytes": 487649 }, "screenshot.jpg": { "sha256": "f7be1f74d0d7f388a8f2b69b7de259cbf18cab3fe2dd7acf3ee1f659c8c013ef", "bytes": 798326 }, "text.txt": { "sha256": "0a0361261572daf4ae962802e81afb2bf4fddeea2c3c03ef8efaf198e64e5506", "bytes": 30304 } }, "started_utc": "2026-10-26T09:49:16.193Z", "status": 200, "final_url": "https://www.agendadigitale.eu/sicurezza/php2shell-lai-accelera-la-scoperta-delle-falle-rischi-per-le-aziende/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Agenda Digitale (Italian), 22 October, by Giovanni Masi: an analysis of PHP2Shell and what the AI role means for companies and shared software. It giv...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, l’AI accelera la scoperta delle falle: rischi per le aziende - Agenda Digitale\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eu/news/agendadigitale/sicurezza-php2shell-lai-accelera-la-scoperta-delle-falle-ris`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAgenda Digitale (Italian), 22 October, by Giovanni Masi: an analysis of PHP2Shell and what the AI role means for companies and shared software. It gives W3Techs shares (PHP on 69.3% of sites whose server-side language is known; 64.5% of the first million, 61.0% of the first 100,000, 59.7% of the first 10,000, 59.3% of the first 1,000), says CERT-EU urged immediate updates, and relays the PHP Foundation's reconstruction: Calif's audit began on 30 July; on 11 August Ryan A reported an attack able to execute code remotely, the same day an independent analysis arrived from OpenAI, with further contributions from Wiz on 24 August and OpenAI on 18 September. It adds that Amazon Threat Intelligence puts an attempt on 17 October, MadPot sensors recorded new attempts on 21 October and Cloudflare saw hostile traffic and request changes to bypass countermeasures. It also relays that a leak on 20 October led PHP to bring the advisory and patches forward from 22 to 21 October, and that a video demonstration published by mistake and early circulation of already-patched software images made secrecy harder.\n\n> Secondo la PHP Foundation, l’audit di Calif era iniziato il 30 luglio e l’11 agosto Ryan A aveva segnalato un attacco capace di eseguire codice da remoto\n\n_Curator's translation:_ \"According to the PHP Foundation, Calif's audit had begun on 30 July and on 11 August Ryan A had reported an attack capable of executing code remotely.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, l’AI accelera la scoperta delle falle: rischi per le aziende - Agenda Digitale\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it-IT`. The page carries an 'Ask the AI / Summarise this article' widget and a contents list (site chrome). Nothing in the article text addresses an AI or hides text from a reader.\n" }, { "slug": "ai4business-intelligenza-artificiale-php2shell-lai-s", "url": "https://www.ai4business.it/intelligenza-artificiale/php2shell-lai-scopre-falle-critiche-in-php-attacchi-gia-iniziati/", "publisher": "AI4Business", "kind": "news", "title": "PHP2Shell: l’AI scopre falle critiche in PHP, attacchi già iniziati - AI4Business", "published": "2026-10-22T07:28:03+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d244724ce6c259e7d3fd6c5a9e8abdad182ea766d490ea5a67d9c7f467d9a271", "bytes": 1169 }, "page.html": { "sha256": "2c4bd4710209c64635ab97a9ca3494049e9d33e591b62417d0a684975dc9ee3b", "bytes": 264597 }, "provenance.json": { "sha256": "b20ffd2513cc96195a1710a1c49d2659a7fe607d2acf68d5ca6134cb54f29b6c", "bytes": 1842 }, "rendered.html": { "sha256": "b4c3d69d770f102980a11b96bc951e18ebca46761238e4c23b400a48f7d9b612", "bytes": 285290 }, "screenshot.jpg": { "sha256": "e98aa24fd252e12f87473d0d2cf3b7262640cde76ac3855d0af6b15f00f389ca", "bytes": 769857 }, "text.txt": { "sha256": "0a757e69b13b1d9d4abb3f75ab2ceffd5627a758332d38335e6eb0e587c8248e", "bytes": 16805 } }, "started_utc": "2026-10-23T16:18:35.608Z", "status": 200, "final_url": "https://www.ai4business.it/intelligenza-artificiale/php2shell-lai-scopre-falle-critiche-in-php-attacchi-gia-iniziati/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). AI4Business (Italian): an AI helped discover two flaws at the core of PHP, grouped as PHP2Shell, that under certain conditions allow commands to run o...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: l’AI scopre falle critiche in PHP, attacchi già iniziati - AI4Business\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/ai4business/intelligenza-artificiale-php2shell-lai-scopre-falle-critiche`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAI4Business (Italian): an AI helped discover two flaws at the core of PHP, grouped as PHP2Shell, that under certain conditions allow commands to run on a server without credentials; the headline says attacks had already begun.\n\n> Un’intelligenza artificiale ha contribuito a scoprire due falle nel cuore di PHP\n\n_Curator's translation:_ \"An artificial intelligence helped discover two flaws at the heart of PHP\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ AI4Business gives a business-oriented explainer: how Calif (Ryan Austin with GPT-5.6 Sol) and Wiz found the flaws, the history from Stefan Esser in 2004 to the 2024 Quarkslab/OSTIF audit, how the bugs work, and AWS's pre-disclosure detection.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: l’AI scopre falle critiche in PHP, attacchi già iniziati - AI4Business\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "aimatters-news-report-56697", "url": "https://aimatters.co.kr/news-report/56697/", "publisher": "AI Matters", "kind": "news", "title": "'PHP2Shell' 취약점에 \"딥시크가 원격 패치\" 주장 확산…근거는 확인 안 돼 - AI매터스", "published": "2026-10-23T13:30:39+09:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "a84d7e20383176795f7c35dc6a749f4aba349b84776e824eb81b75d73a9d4b69", "bytes": 275 }, "provenance.json": { "sha256": "994b954bf89ef57a3f8d97ee7c537ba1d66063dd8905306fd94b33d069a83d63", "bytes": 1533 }, "rendered.html": { "sha256": "d428517e028b7487122f5da7dec71ce839407ee0e81fee5937bccb2fea27a61e", "bytes": 336779 }, "screenshot.jpg": { "sha256": "5926a1a6f6b97506f4f930402886e81ab1246e8980ff0ec98122d75b01682ad7", "bytes": 333645 }, "text.txt": { "sha256": "2b72bd0b8d42ca31c873e0af226e523220c7dc285d4bd22504726fd1d77227b1", "bytes": 6208 } }, "started_utc": "2026-10-24T13:52:03.365Z", "status": 200, "final_url": "https://aimatters.co.kr/news-report/56697/?ckattempt=1" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko-KR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). AI Matters (Korean), 23 October: a claim has spread on X that someone is running a large number of AI agents based on China's DeepSeek model, a 'swarm...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 'PHP2Shell' 취약점에 \"딥시크가 원격 패치\" 주장 확산…근거는 확인 안 돼 - AI매터스\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/aimatters/news-report-56697`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAI Matters (Korean), 23 October: a claim has spread on X that someone is running a large number of AI agents based on China's DeepSeek model, a 'swarm', to patch unpatched PHP servers remotely; the article says no security firm or DeepSeek has confirmed it, so the basis is unconfirmed. It restates the CVEs, the fixed versions and that the PHP team published minimal source patches for the end-of-life 7.4, 8.0 and 8.1. The page also carries 'ask an AI about this article' buttons, which are the site's interface and were not acted on.\n\n> 보안 업체나 딥시크가 이를 확인한 내용은 나오지 않았다.\n\n_Curator's translation:_ \"Nothing has appeared in which a security firm or DeepSeek confirmed it.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"'PHP2Shell' 취약점에 \"딥시크가 원격 패치\" 주장 확산…근거는 확인 안 돼 - AI매터스\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko-KR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "aitnews-2026-10-23-d8-ab-d9-84-d8-a7-d8-ab-d8-a9", "url": "https://aitnews.com/2026/10/23/%D8%AB%D9%84%D8%A7%D8%AB%D8%A9-%D8%A3%D8%AD%D8%B1%D9%81-%D9%87%D8%B2%D9%91%D8%AA-%D8%A7%D9%84%D8%A5%D9%86%D8%AA%D8%B1%D9%86%D8%AA-%D9%85%D8%A7-%D9%82%D8%B5%D8%A9-%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-php/", "publisher": "البوابة التقنية", "kind": "news", "title": "ثلاثة أحرف هزّت الإنترنت.. ما قصة ثغرات PHP التي تهدد المواقع حول العالم؟ | البوابة التقنية", "published": "2026-10-23T00:15:43+00:00", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "e33cbe95faad2c2c19ea87384dcd960f8490d5a19a6fc39a3a85fe9128538e38", "bytes": 1007 }, "page.html": { "sha256": "4e7eb6500dc66a74c7198cf6488a3e83645db0660289bcd45cb74b82b81dd212", "bytes": 129231 }, "provenance.json": { "sha256": "2dcded91540541b62a0f69d396b4fc721c2911a278a98de26acb953cfcae70da", "bytes": 2128 }, "rendered.html": { "sha256": "4aff09be6b8e8863071d64ddc2447ec77d6eeca33b575319e05d806c2f5424da", "bytes": 125811 }, "screenshot.jpg": { "sha256": "d6bd507f85840779ba36e83cf940ac4b6e63820946fe33bc76491c7c4e5ecd19", "bytes": 682538 }, "text.txt": { "sha256": "f056b20036373674bfac4acc8e04626db7344e0b8b8bf2c85e05a163ef80b280", "bytes": 14759 } }, "started_utc": "2026-10-23T08:15:24.705Z", "status": 200, "final_url": "https://aitnews.com/2026/10/23/%D8%AB%D9%84%D8%A7%D8%AB%D8%A9-%D8%A3%D8%AD%D8%B1%D9%81-%D9%87%D8%B2%D9%91%D8%AA-%D8%A7%D9%84%D8%A5%D9%86%D8%AA%D8%B1%D9%86%D8%AA-%D9%85%D8%A7-%D9%82%D8%B5%D8%A9-%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Tech Portal (Arabic), 23 October: 'three letters that shook the internet', on the PHP flaws threatening sites worldwide. It describes CVE-2026-109618...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثلاثة أحرف هزّت الإنترنت.. ما قصة ثغرات PHP التي تهدد المواقع حول العالم؟ | البوابة التقنية\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/aitnews/2026-10-23-d8-ab-d9-84-d8-a7-d8-ab-d8-a9-d8-a3-d8-ad-d8-b1-d`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTech Portal (Arabic), 23 October: 'three letters that shook the internet', on the PHP flaws threatening sites worldwide. It describes CVE-2026-109618 as a memory-management bug when memory runs out, where PHP may handle internal data that was not fully initialised in an unsafe way, and CVE-2026-109619 as internal data surviving after its memory is freed, which could let an old state be used when handling a new request.\n\n> وتحمل الثغرة الأولى المعرّف CVE-2026-109618\n\n_Curator's translation:_ \"The first vulnerability carries the identifier CVE-2026-109618\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثلاثة أحرف هزّت الإنترنت.. ما قصة ثغرات PHP التي تهدد المواقع حول العالم؟ | البوابة التقنية\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "aiweekly-issues-php2shell-millions-of-attacks-15m", "url": "https://aiweekly.co/issues/php2shell-millions-of-attacks-15m-servers-unpatched-on-day", "publisher": "aiweekly", "kind": "news", "title": "PHP2Shell: Millions of Attacks, 1.5M Servers Unpatched on Day One | AI Weekly", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "5ee7bc3395bc1d4d4f8319696754e7e8953ec008b5fb23a243dd9c96b2ed2718", "bytes": 1367 }, "page.html": { "sha256": "4526e16bcc1f6bb429531e76c96f879d5d5d00c401daddd0031b81215f1ef34a", "bytes": 37612 }, "provenance.json": { "sha256": "e00231f484ec68cd9bf3f1b88c3c883b704293f0e01c79e1db2c38a76d686bc1", "bytes": 1761 }, "rendered.html": { "sha256": "d7ab9352c9d403885c5c6e8bc5741ac67b52f747415c6eca612ce43e5cdeb141", "bytes": 40286 }, "screenshot.jpg": { "sha256": "44503def2e28201fa2883694f435d879fcf3c3f87d25ade162d45add06c764be", "bytes": 729453 }, "text.txt": { "sha256": "fbdf38d39137fee6021cee2d3bcdb0b06458887a217cc51ecd4c67a9455c6a23", "bytes": 14314 } }, "started_utc": "2026-10-23T23:28:40.772Z", "status": 200, "final_url": "https://aiweekly.co/issues/php2shell-millions-of-attacks-15m-servers-unpatched-on-day" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). AI Weekly, 23 October: a newsletter issue headlined 'Millions of attacks, 1.5M servers unpatched on day one'. It says AI models helped researchers fin...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Millions of Attacks, 1.5M Servers Unpatched on Day One | AI Weekly\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `bg/news/aiweekly/issues-php2shell-millions-of-attacks-15m-servers-unpatched-o`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAI Weekly, 23 October: a newsletter issue headlined 'Millions of attacks, 1.5M servers unpatched on day one'. It says AI models helped researchers find PHP2Shell, two critical flaws that let anyone take over a web server with one request, that details leaked before the fix, that attackers were probing four days early and that attempts are now in the millions. The '1.5M unpatched' figure is in the headline and its source was not found in the part read.\n\n> AI models helped researchers find PHP2Shell, two critical flaws in PHP that let anyone take over a web server with one request.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Millions of Attacks, 1.5M Servers Unpatched on Day One | AI Weekly\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "akamai-blog-cve-2024-4577-one-day", "url": "https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure", "publisher": "Akamai Security Research", "kind": "vendor", "title": "CVE-2024-4577 Exploits in the Wild One Day After Disclosure", "published": "2024", "captures": [ { "stamp": "20261022T112501Z", "files": { "headers.json": { "sha256": "b8600b926f54d0c326ae453a4aa45ee026728ff7329884997710f9d1e5f541cb", "bytes": 5460 }, "page.html": { "sha256": "10bed4c03e0d208afa3e6d6d67c8d2250149138bb4d63e87605d1e28079a5171", "bytes": 279021 }, "provenance.json": { "sha256": "67c5b82965151100b965313d300e89e4bd9ca9ce8520a47fa8ba174bd637833b", "bytes": 1084 }, "rendered.html": { "sha256": "3aea0cbcf996a4c4d7b0dfe721b61fee812595d5df395a7b8eb1317ca7c0fa8f", "bytes": 478692 }, "screenshot.png": { "sha256": "5fed6383355ce8c109b539a7e534592d29b584d533df10d4b2228cd9c2431475", "bytes": 2944679 }, "text.txt": { "sha256": "f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567", "bytes": 23021 } }, "started_utc": "2026-10-22T11:25:01.255Z", "status": 200, "final_url": "https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical: exploits of the previous PHP core RCE, CVE-2024-4577, seen in the wild one day after disclosure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CVE-2024-4577 Exploits in the Wild One Day After Disclosure\n\nCaptured by claude-story-site. Status: captured. Historical: exploits of the previous PHP core RCE, CVE-2024-4577, seen in the wild one day after disclosure.\n\n- Comparator for the context page.\n" }, { "slug": "akamai-blog-php-core-rce", "url": "https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core", "publisher": "Akamai Security Research", "kind": "vendor", "title": "Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112525Z", "files": { "headers.json": { "sha256": "3ed908175f73e8f392f99df0845982f172ad44c49cb12692c16c1fcf7849d28d", "bytes": 5850 }, "page.html": { "sha256": "8f9e02a272dd67f8a2770e849f8f8118fc34e45f1cd056fd56e4b5a7f9bae592", "bytes": 213450 }, "provenance.json": { "sha256": "c335fab9c5745922bf97664aa64c00fa23b563ae875eeb2c95316f70f3ae758d", "bytes": 1103 }, "rendered.html": { "sha256": "0400fefe0ed144f5140e8077e5e6d9b401d41cad7ef0b66825c4dec6663f4b33", "bytes": 415118 }, "screenshot.png": { "sha256": "5757611708b507626fda25038e770bb96adb831e42b474d6c5229c30ba0a3a98", "bytes": 609040 }, "text.txt": { "sha256": "2a001600cd450bc582ed42e8355951626ef8ae60e5c4afe233629dbeeaacba5b", "bytes": 5509 } }, "started_utc": "2026-10-22T11:25:25.138Z", "status": 200, "final_url": "https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai\n\nCaptured by claude-story-site. Status: captured. Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence.\n\n- Primary vendor statement.\n" }, { "slug": "albiladpress-news-2026-6586-finance-1027748-html", "url": "https://www.albiladpress.com/news/2026/6586/finance/1027748.html", "publisher": "جريدة البلاد", "kind": "news", "title": "جريدة البلاد | “PHP2Shell” تستنفر المصارف.. ثغرات الويب ترفع كلفة الحماية واستمرارية الخدمات", "published": "2026-10-26", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "f098c98e4a90ff36edeb366071a1aff6a6d7365de55cc201525f9a6587c072cf", "bytes": 1806 }, "page.html": { "sha256": "c597cc9a702e30de3791a66388ff3ba5f095fe6f7f9c58654c649bdc9f63749f", "bytes": 109476 }, "provenance.json": { "sha256": "91f84e8e25242175027e9606cf4eb9c36e8e272606ab111662b9a9e803ce76c8", "bytes": 1761 }, "rendered.html": { "sha256": "d846f9fa6ceedce2b56f1c71a86ed960c5b7859bfbaa78ff09ec824bde9a72dc", "bytes": 117644 }, "screenshot.jpg": { "sha256": "c751493a28624864b2d9583fcb9539b7ecb2b2c7027f88f0d49d1ee31c78a008", "bytes": 442062 }, "text.txt": { "sha256": "6fbb86283122956d38c390fd04cc96e5037dd718e1b91312228e99dcb407c73f", "bytes": 10839 } }, "started_utc": "2026-10-26T07:31:12.611Z", "status": 200, "final_url": "https://www.albiladpress.com/news/2026/6586/finance/1027748.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Al Bilad (Bahrain, Arabic), 26 October, an economics piece by Omar Al-Kaabneh on what PHP2Shell means for banks. It says Kyodo reported on 22 October...", "raw_sha256": {}, "has_notes": true, "notes_md": "# جريدة البلاد | “PHP2Shell” تستنفر المصارف.. ثغرات الويب ترفع كلفة الحماية واستمرارية الخدمات\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sa/news/albiladpress/news-2026-6586-finance-1027748-html`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAl Bilad (Bahrain, Arabic), 26 October, an economics piece by Omar Al-Kaabneh on what PHP2Shell means for banks. It says Kyodo reported on 22 October that Mitsubishi UFJ Bank suspended some services for emergency maintenance, including opening investment-fund accounts on its online banking platform, which the agency tied to the PHP problem, and that MUFG Morgan Stanley Securities separately suspended electronic identity checks for account opening and passkey registration without stating a technical cause. The article stresses that these announcements do not show that the banks were breached or customer money stolen, since a maintenance stop shows availability was affected, not that an attacker got in; it labels its cost discussion as analysis, not loss estimates, and cites Wiz that some exploitation paths could expose passwords, tokens and API keys.\n\n> ولا تعني هذه الإعلانات ثبوت اختراق المصارف أو سرقة أموال العملاء.\n\n_Curator's translation:_ \"These announcements do not mean that the banks were breached or customers' money stolen.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"جريدة البلاد | “PHP2Shell” تستنفر المصارف.. ثغرات الويب ترفع كلفة الحماية واستمرارية الخدمات\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "alghad-section-225-d8-aa-d9-83-d9-86-d9-88-d9-8", "url": "https://alghad.com/Section-225/%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7/%D8%AB%D8%BA%D8%B1%D8%A9-%D9%81%D9%8A-PHP-%D8%AA%D9%81%D8%AA%D8%AD-%D8%A7%D9%84%D8%A8%D8%A7%D8%A8-%D8%A3%D9%85%D8%A7%D9%85-%D9%85%D9%88%D8%AC%D8%A9-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-2100790", "publisher": "الغد", "kind": "news", "title": "ثغرة في PHP تفتح الباب أمام موجة هجمات سيبرانية...", "published": "2026-10-24T13:01:37", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "113fc1ac24be9268dbf658cb06485cf7f8da0dda7075c6f6998d5941d4aa8391", "bytes": 1070 }, "page.html": { "sha256": "17cd7cdd84cb7a82160c7394458a8ca4f8050fb75bf3003744cb460ce093f653", "bytes": 150043 }, "provenance.json": { "sha256": "215e96aaf5df6d164124c3b53029d9276e7ad733cdf2a04c2b2c119c60ff975d", "bytes": 2234 }, "rendered.html": { "sha256": "a45b8f5ca1c76b29b11d84fb30b8f67b65f5f99685d9a0a3d89d7580429f974a", "bytes": 230008 }, "screenshot.jpg": { "sha256": "daaa43153f2f71a6650e964c60c7cf3dbb4d29e30cc5c9c29a3c92a4c47e4ad0", "bytes": 396690 }, "text.txt": { "sha256": "679a2220aeebc2f7412f5d56f561b010d65793b3cef5dce86d832c2c40cf9ebd", "bytes": 8445 } }, "started_utc": "2026-10-24T16:14:01.406Z", "status": 200, "final_url": "https://alghad.com/Section-225/%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7/%D8%AB%D8%BA%D8%B1%D8%A9-%D9%81%D9%8A-PHP-%D8%AA%D9%81%D8%AA%D8%AD-%D8%A7%D9%84%D8%A8%D8%A7%D8%A8-%D8%A3%D9%85%D8%A7%D9%85-%D9%85%D9%88%D8%AC%D8%A9-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-2100790" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Al-Ghad (Arabic), 24 October: a PHP flaw opens the door to a wave of cyberattacks. The flaw, known as PHP2Shell, may let attackers take control of sit...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثغرة في PHP تفتح الباب أمام موجة هجمات سيبرانية...\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/alghad/section-225-d8-aa-d9-83-d9-86-d9-88-d9-84-d9-88-d8-ac-d9-8a`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAl-Ghad (Arabic), 24 October: a PHP flaw opens the door to a wave of cyberattacks. The flaw, known as PHP2Shell, may let attackers take control of sites' servers, steal data and disrupt electronic services.\n\n> وقد تتيح الثغرة، المعروفة باسم PHP2Shell، للمهاجمين السيطرة على خوادم المواقع، وسرقة البيانات، وتعطيل الخدمات الإلكترونية.\n\n_Curator's translation:_ \"The flaw, known as PHP2Shell, may allow attackers to take control of sites' servers, steal data and disrupt electronic services.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثغرة في PHP تفتح الباب أمام موجة هجمات سيبرانية...\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "aljarida-article-148264", "url": "https://www.aljarida.com/article/148264", "publisher": "جريدة الجريدة الكويتية", "kind": "news", "title": "ثغرات «PHP» تضع بيانات الإنترنت تحت رحمة القراصنة - جريدة الجريدة الكويتية", "published": "2026-10-23 20:38", "captures": [ { "stamp": "20261026T170916Z", "files": { "headers.json": { "sha256": "4fea6ae1bd97399184bf68f9bfa4faf01792a7c5c3094304c33e8c593429b745", "bytes": 1204 }, "page.html": { "sha256": "81a830b039160ed7c8ae92c041092025cde40daf0cddf62db01850f99017ec4b", "bytes": 242979 }, "provenance.json": { "sha256": "a297f1c341da169c1533dc16d68c790744e5d79e7b4c99b108db8629756197d9", "bytes": 1459 }, "text.txt": { "sha256": "f05c7687b060c9c9c0a354e0549a2fb276decc0920762e8987c1b520bec696c4", "bytes": 3400 } }, "started_utc": "2026-10-26T17:17:16.552Z", "status": 200, "final_url": "https://www.aljarida.com/article/148264" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T170916Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Al-Jarida (Kuwait, Arabic), 23 October: a short article saying PHP's two serious flaws (CVE-2026-109618 and CVE-2026-109619) put internet data at the...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثغرات «PHP» تضع بيانات الإنترنت تحت رحمة القراصنة - جريدة الجريدة الكويتية\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/aljarida/article-148264`, snapshot `20261026T170916Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T170916Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAl-Jarida (Kuwait, Arabic), 23 October: a short article saying PHP's two serious flaws (CVE-2026-109618 and CVE-2026-109619) put internet data at the mercy of hackers, a local warning coinciding with a worldwide emergency in the IT industry after the details leaked unintentionally, and that in Germany municipalities, hospitals and universities temporarily stopped their services and sites as a precaution. No new facts.\n\n> ففي ألمانيا، بادرت بلديات ومستشفيات وجامعات إلى إيقاف خدماتها ومواقعها مؤقتاً كإجراء احترازي.\n\n_Curator's translation:_ \"In Germany, municipalities, hospitals and universities moved to stop their services and sites temporarily as a precaution.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Kuwaiti daily Al-Jarida describes the PHP2Shell flaws and the leak, citing Huntress and the German government CERT, and says German municipalities, government bodies, universities and hospitals took sites offline. It reports that Kuwait's Central Agency for Information Technology issued a warning bulletin.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثغرات «PHP» تضع بيانات الإنترنت تحت رحمة القراصنة - جريدة الجريدة الكويتية\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "americanbanker-news-banks-dodge-early-damage-from-php2s", "url": "https://www.americanbanker.com/news/banks-dodge-early-damage-from-php2shell-flaws", "publisher": "American Banker", "kind": "news", "title": "Banks dodge early damage from PHP2Shell flaws | American Banker", "published": "2026-10-23T16:18:33.586", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "15e6ea894fadba01472595414bd8a115f59040b12b137c0fd07e14f140604fdb", "bytes": 787 }, "page.html": { "sha256": "84e2320fb1caf71e1794a48815b4503235af44dbfbc87ac3df6e9572159e544e", "bytes": 298544 }, "provenance.json": { "sha256": "d367fa9ba378380e772e440a1a4314eac8ce06b25646be09f313fce10e7c36fc", "bytes": 1737 }, "rendered.html": { "sha256": "17f8b9cf5fd801d15dbca340216bf2a1255da22e3a96ddedd829a58955444065", "bytes": 839767 }, "screenshot.jpg": { "sha256": "348a95ae92e965152778a86d8791213071bfe7200a2c343634c0f7583ba69faa", "bytes": 271555 }, "text.txt": { "sha256": "2b6aa63f39e73b0ee1344ecc0362be26ac765764c3dac7b04da934c8ea3e6b3f", "bytes": 3839 } }, "started_utc": "2026-10-24T09:01:58.402Z", "status": 200, "final_url": "https://www.americanbanker.com/news/banks-dodge-early-damage-from-php2shell-flaws" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). American Banker, 23 October: banks have so far dodged early damage from PHP2Shell. Attackers have fired millions of attempts at the flaws, but no U.S....", "raw_sha256": {}, "has_notes": true, "notes_md": "# Banks dodge early damage from PHP2Shell flaws | American Banker\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/news/americanbanker/news-banks-dodge-early-damage-from-php2shell-flaws`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAmerican Banker, 23 October: banks have so far dodged early damage from PHP2Shell. Attackers have fired millions of attempts at the flaws, but no U.S. bank or credit union has publicly reported a compromise.\n\n> Attackers have fired millions of attempts at the PHP2Shell flaws, but no U.S. bank or credit union has publicly reported a compromise.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Banks dodge early damage from PHP2Shell flaws | American Banker\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "analyticsinsight-news-changpeng-zhao-warns-crypto-users-a", "url": "https://www.analyticsinsight.net/news/changpeng-zhao-warns-crypto-users-amid-new-php2shell-threats", "publisher": "Analytics Insight", "kind": "news", "title": "Changpeng Zhao Warns Crypto Users Amid New PHP2Shell Threats", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "d0cf3a2f6ff0f4347125ab1ec8faec5b29a6edb234474a9ce40b94ff9a9fb3f5", "bytes": 1220 }, "page.html": { "sha256": "25936687f5568100b08ad53ae29d18211496e51913933ce75b708b1cdad76813", "bytes": 1011934 }, "provenance.json": { "sha256": "6ebb25bf1f68f6dab96c21abe759cfcc75989a91439d7f2bb43194e50dca6aeb", "bytes": 1646 }, "text.txt": { "sha256": "a1cb6f490bf50653944d5a23223b537266ac80df0c159430448183187313385e", "bytes": 15821 } }, "started_utc": "2026-10-23T08:11:31.256Z", "status": 200, "final_url": "https://www.analyticsinsight.net/news/changpeng-zhao-warns-crypto-users-amid-new-php2shell-threats" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Analytics Insight: reports that Changpeng Zhao, a crypto-industry figure, warned internet users on 22 October to be careful when visiting websites aft...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Changpeng Zhao Warns Crypto Users Amid New PHP2Shell Threats\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/analyticsinsight/news-changpeng-zhao-warns-crypto-users-amid-new-php2shell-th`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAnalytics Insight: reports that Changpeng Zhao, a crypto-industry figure, warned internet users on 22 October to be careful when visiting websites after developers patched the two PHP flaws; repeats the CVE IDs, the 9.2 scores and that WordPress, Magento, Drupal and Joomla run on PHP. A crypto-news angle on the story, with little original reporting.\n\n> Changpeng Zhao warned internet users on October 22 to exercise caution when visiting websites after developers patched two critical PHP vulnerabilities.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Changpeng Zhao Warns Crypto Users Amid New PHP2Shell Threats\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "andina-agencia-noticia-peru-y-otros-paises-advi", "url": "https://andina.pe/agencia/noticia-peru-y-otros-paises-advierten-vulnerabilidad-php-estos-son-los-riesgos-seguridad-1096953.aspx", "publisher": "Agencia Andina", "kind": "news", "title": "Perú y otros países advierten de vulnerabilidad en PHP: estos son los riesgos de seguridad | Agencia Andina", "published": "2026-10-22T00:00:00.0000000", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "0ed85079e5b5808b8b44a1c7e26eec5fa10956d269b8ef1c2faaa8b44bb0ee39", "bytes": 311 }, "page.html": { "sha256": "7ca9aa7a56c542f9b4354c98ef5c591a9303c42e6c902c00d2d2e4270d7194ce", "bytes": 203589 }, "provenance.json": { "sha256": "2db5a9c751c668cc78862e95e85d44febfe1fb29472350c8212d6eec8d72a2b5", "bytes": 1784 }, "rendered.html": { "sha256": "65bbcfc988d0bddfa5967b9607f9c26a1c807c86d1cb52307dafdda0fcb5f9c9", "bytes": 222929 }, "text.txt": { "sha256": "c5a17380affd5daba963dad02f154c020d703e0c9eed5b824deaa08f11526528", "bytes": 9905 } }, "started_utc": "2026-10-23T16:23:52.804Z", "status": 200, "final_url": "https://andina.pe/agencia/noticia-peru-y-otros-paises-advierten-vulnerabilidad-php-estos-son-los-riesgos-seguridad-1096953.aspx" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Agencia Andina (Peru's state news agency, Spanish): Peru and other countries warn of the PHP vulnerability. It quotes Peru's Centro Nacional de Seguri...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Perú y otros países advierten de vulnerabilidad en PHP: estos son los riesgos de seguridad | Agencia Andina\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pe/news/andina/agencia-noticia-peru-y-otros-paises-advierten-vulnerabilidad`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAgencia Andina (Peru's state news agency, Spanish): Peru and other countries warn of the PHP vulnerability. It quotes Peru's Centro Nacional de Seguridad Digital, in its 21 October report, on a critical threat named PHP2Shell tied to two PHP flaws whose technical details leaked before the coordinated disclosure.\n\n> se ha identificado una amenaza crítica denominada PHP2Shell, asociada a dos vulnerabilidades de seguridad en PHP\n\n_Curator's translation:_ \"a critical threat called PHP2Shell has been identified, associated with two security vulnerabilities in PHP\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Andina, Peru's state news agency, reports that Peru, among other countries, warned about PHP2Shell. It quotes the 21 October report from Peru's National Digital Security Centre and INCIBE's rating, and adds comments from Lightwell (IBM/Red Hat) and Kaspersky sent to EFE.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Perú y otros países advierten de vulnerabilidad en PHP: estos son los riesgos de seguridad | Agencia Andina\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "arcticwolf-php2shell-exposure", "url": "https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/", "publisher": "Arctic Wolf Labs", "kind": "vendor", "title": "Finding, Prioritizing, and Patching PHP2Shell Exposure | Arctic Wolf", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112342Z", "files": { "headers.json": { "sha256": "cb2dc7b843210683b8616d4f651fe7942a43433cea11e494ec0adb084f793b82", "bytes": 1052 }, "page.html": { "sha256": "62b3d068fbefbb9b312c2418b4a38ef788132d55782e1e41244e77c0bad59726", "bytes": 351404 }, "provenance.json": { "sha256": "015cfc5316cc7077049a8aee5da1a198699d54f7244e62ab8f7bf89b9e5ac590", "bytes": 1123 }, "rendered.html": { "sha256": "1f059cea13ae6b9fa434e23a67c3e8ec05c47fa9af94ac9c5a476013862adb78", "bytes": 1342610 }, "screenshot.png": { "sha256": "0f1c79ead2d73038424318bb8efbe497717653cc82a2b3763f24ce7a95386336", "bytes": 1555808 }, "text.txt": { "sha256": "ef2210c0fd1c35032d70283c91ab44c01c091342c21c9ac55571b12b45f8f75b", "bytes": 10879 } }, "started_utc": "2026-10-22T11:23:42.940Z", "status": 200, "final_url": "https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "440350905beb9a972cf206015579a9460d7122dec3ca256f53e2239cc0586df0", "bytes": 1123 }, "page.html": { "sha256": "19a9957b4d8769c87fa61b221753ea52107ae4c94e8dd82d4ef5872a37ed9081", "bytes": 352468 }, "provenance.json": { "sha256": "135feb75d38e7b71b6f62d88fb1596ae37e5f3fc99be68d008edf434a803f58d", "bytes": 1726 }, "text.txt": { "sha256": "1f0d3416e0d6ed95dc5aa64628a10b3319e6dde70da44b12c6251b5a3f626c24", "bytes": 11183 } }, "started_utc": "2026-10-23T16:27:32.250Z", "status": 200, "final_url": "https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor guidance on finding and patching exposure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Finding, Prioritizing, and Patching PHP2Shell Exposure | Arctic Wolf\n\nCaptured by claude-story-site. Status: captured. Vendor guidance on finding and patching exposure.\n\n- Captured for the record.\n" }, { "slug": "areacucuta-php2shell-log4shell-a-la-velocidad-de-la", "url": "https://www.areacucuta.com/php2shell-log4shell-a-la-velocidad-de-la-ia-y-la-perspectiva-de-un-ciso/", "publisher": "areacucuta.com", "kind": "news", "title": "PHP2Shell: vulnerabilidad en PHP amenaza empresas con IA", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c49168790d202ef5b7ffaada2cfbd2f795c03f07d51db02afa325a8dafe74ac5", "bytes": 1325 }, "page.html": { "sha256": "2593c2b0bb9f033b4f411e857d8b5a4e667e7864f6a5324ff2c0b3aeb5613c4a", "bytes": 212056 }, "provenance.json": { "sha256": "4cc302c86440656bec4b25bc63644813b579dea822020511fac18d74c15d9658", "bytes": 1775 }, "rendered.html": { "sha256": "e717ab7ac7c1f715134612a9d475fcb8e024ecb1017f5d131b5e00be01f1ada6", "bytes": 244614 }, "screenshot.jpg": { "sha256": "ca3f350a123e24f2754ffb9a719437f215e9981bec9cf2c961c88b0e0b0c1acc", "bytes": 555750 }, "text.txt": { "sha256": "9320567484319cee421e5ee72d2fc11b08bdadf63742d6b33ef6118760b1ddec", "bytes": 8032 } }, "started_utc": "2026-10-23T16:22:29.380Z", "status": 200, "final_url": "https://www.areacucuta.com/php2shell-log4shell-a-la-velocidad-de-la-ia-y-la-perspectiva-de-un-ciso/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). areacucuta.com (Spanish), a perspective piece 'PHP2Shell: Log4Shell at the speed of AI, and a CISO's view', five years after Log4Shell. It cites Check...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: vulnerabilidad en PHP amenaza empresas con IA\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `mx/news/areacucuta/php2shell-log4shell-a-la-velocidad-de-la-ia-y-la-perspectiva`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nareacucuta.com (Spanish), a perspective piece 'PHP2Shell: Log4Shell at the speed of AI, and a CISO's view', five years after Log4Shell. It cites Check Point Research that malicious activity linked to PHP2Shell has already impacted 10% of organisations worldwide, 14% in Europe. A vendor-commentary article; the statistic's definition of 'impacted' is not given.\n\n> Informes de la unidad Check Point Research revelan que la actividad maliciosa vinculada a PHP2Shell ya registra impactos en el 10 % de las organizaciones en todo el mundo, con un repunte del 14 % en el mercado europeo.\n\n_Curator's translation:_ \"Reports from the Check Point Research unit reveal that malicious activity linked to PHP2Shell already records impacts on 10% of organisations worldwide, with a 14% rise in the European market.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: vulnerabilidad en PHP amenaza empresas con IA\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "armis-php2shell-find-patch", "url": "https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/", "publisher": "Armis", "kind": "vendor", "title": "Just a moment...", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112544Z", "files": { "headers.json": { "sha256": "beaea17cfe605c6045c7491c7d444b6fc828d614e9fbacea1cc080a269cc4c31", "bytes": 1990 }, "page.html": { "sha256": "f8ff0c9e277962b98d66e9cf2027f78e3bfbc4d17999419d62b105822a78c6ba", "bytes": 6399 }, "provenance.json": { "sha256": "0cdaf4cb11738a799892b7d79d673ed08c085634e8be431b89fd732adde39e19", "bytes": 1026 }, "rendered.html": { "sha256": "64996869be46fe0ae90238d579e23c2599e4293e9f0c15e82d322efe96fde39b", "bytes": 28992 }, "screenshot.png": { "sha256": "4da50c06b7082cecc3965a33e2fcf67ce4919b97b0730000f14723d2e5ec0321", "bytes": 38997 }, "text.txt": { "sha256": "d15eed6dfa57239bfe3d8333949627f35d8011042027db230828460dbf2b4ff3", "bytes": 261 } }, "started_utc": "2026-10-22T11:25:44.808Z", "status": 403, "final_url": "https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "baca22884fe7c035a79dd418a0722363020765d167e128558a474b6053e5a7ef", "bytes": 1141 }, "page.html": { "sha256": "085b997a04b1225c51e9d615bdb4104c6da4a3804d465322633390618711a2f4", "bytes": 144286 }, "provenance.json": { "sha256": "910e25517ade6ab5036a505a197e6487980dd277c89e987fe1105e276544b3d7", "bytes": 1821 }, "rendered.html": { "sha256": "e9950fdf7a9df47cee2ac27e207c454b8e1451e7e9b65ad077a77eecdceaff2e", "bytes": 146994 }, "screenshot.jpg": { "sha256": "98efbad718ce3475cb75f1e4b4d8b5747681c4d7af0f0c4e36d61254d75680d2", "bytes": 842746 }, "text.txt": { "sha256": "311436ec35cbb50a61009ad36bbf4117b0abe67052880e335107d6a324fddc54", "bytes": 11660 } }, "started_utc": "2026-10-23T16:27:33.824Z", "status": 200, "final_url": "https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "Vendor guidance on finding and patching.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Just a moment...\n\nCaptured by claude-story-site. Status: blocked. Vendor guidance on finding and patching.\n\n- Captured for the record.\n" }, { "slug": "arstechnica-security-2026-10-php-maintainers-tell-web-devs-to-prepare-th", "url": "https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/", "publisher": "Ars Technica", "kind": "news", "title": "PHP warns it plans to release 2 emergency patches imminently - Ars Technica", "published": "2026-10-20 (updated 2026-10-21 14:55 per the page)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "d82ea6774aa7fd97afe368204d1ff2f0d13b71cf17ea85a45d9d417a6bea65aa", "bytes": 823 }, "page.html": { "sha256": "fde5092a336040720599fc85f6c66de19b5a880374ac4b784df6e3749f4200af", "bytes": 146413 }, "provenance.json": { "sha256": "9191e7b89ed24206ef5a45384b0ab5d65cf98a006a5d1542053335ab6992e237", "bytes": 1776 }, "rendered.html": { "sha256": "1b7902197bf923479314e247b3146c50b55279e6357d0fb040417de3d58257ea", "bytes": 567868 }, "text.txt": { "sha256": "96a800209bd0263f7de25263d9e594d65ca1b53c449993784a99f193831e21ab", "bytes": 5244 } }, "started_utc": "2026-10-23T08:10:15.898Z", "status": 200, "final_url": "https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "13840bbc0aa9682890b32ae4962783eed7c6e38bf68bb9ed5e781ae99afd5e47", "bytes": 823 }, "page.html": { "sha256": "ca33b2d1ef96e80928e8e8ab4f631c94358fb7eee7b800a248aa6a44fe254232", "bytes": 146512 }, "provenance.json": { "sha256": "aa85e34dad75bad9917f13c1a251df25f9127086a141bbe8fcc7e95a320e7d1d", "bytes": 2010 }, "rendered.html": { "sha256": "742a140357e3dc19cd4484b5493dff5e2e287fa0ce5c1bb2bce09354c116cffc", "bytes": 565322 }, "screenshot.jpg": { "sha256": "aeba250f9d891ef1e07f41c11603009f03bec97db93382a9c946379c8e710d14", "bytes": 342851 }, "text.txt": { "sha256": "62681a6a40fd9b229aefd4e838524abff4492b4da3b487a115d2d9b606fbabcc", "bytes": 5250 } }, "started_utc": "2026-10-23T16:09:59.377Z", "status": 200, "final_url": "https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Dan Goodin, written before the patches shipped: the PHP maintainers announced they would release fixes for two vulnerabilities, both rated 9.2 out of 10, after...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP warns it plans to release 2 emergency patches imminently - Ars Technica\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/news/arstechnica/security-2026-10-php-maintainers-tell-web-devs-to-prepare-th`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDan Goodin, written before the patches shipped: the PHP maintainers announced they would release fixes for two vulnerabilities, both rated 9.2 out of 10, after purported details leaked. An unconfirmed report showed a video of an exploit tool called PHP2Shell running code on named WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS versions. watchTowr said it had confirmed CVE-2026-109618 and CVE-2026-109619 are real; Sansec said it expected mass attacks within 15 minutes of the release.\n\n> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "asahi-and-pressrelease-16986349", "url": "https://www.asahi.com/and/pressrelease/16986349", "publisher": "朝日新聞デジタル", "kind": "news", "title": "「キャンつく」「ヨミトル」PHP重大脆弱性（php2shell）への対応完了のお知らせ | 朝日新聞デジタルマガジン＆[and]", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "99e8fe64b3f75bb1625bad50d01c521d0fe56b0a5636ea71b4af9c4fc5df0b5b", "bytes": 1847 }, "page.html": { "sha256": "4c8bfb4f812fcd6ac7edf66ef201a9cf8efd7e70b13a8cc36ca2ec28cb68382c", "bytes": 158942 }, "provenance.json": { "sha256": "bdebff9f5f5b543f8610120c5bc4cc22b66968e6b14c15c8557444ad522de74c", "bytes": 1667 }, "rendered.html": { "sha256": "387271e8e2f31d969844024e018a41e1242d4d10b0a7cd21dd3a011731ef264e", "bytes": 159217 }, "screenshot.jpg": { "sha256": "a68db1225703f0ad548d2186219e6596989d71c9b235c51569a25eb0ac947346", "bytes": 375533 }, "text.txt": { "sha256": "ac30b9c51cb8453e5918872a32d12ff394b985b485eef6b870ba5443d3887d9c", "bytes": 7433 } }, "started_utc": "2026-10-23T16:19:19.090Z", "status": 200, "final_url": "https://www.asahi.com/and/pressrelease/16986349" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Asahi Shimbun Digital Magazine &[and] (Japanese), a PR TIMES press release of 22 October: the company that runs a campaign tool and a diagnostics clou...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 「キャンつく」「ヨミトル」PHP重大脆弱性（php2shell）への対応完了のお知らせ | 朝日新聞デジタルマガジン＆[and]\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/asahi/and-pressrelease-16986349`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAsahi Shimbun Digital Magazine &[and] (Japanese), a PR TIMES press release of 22 October: the company that runs a campaign tool and a diagnostics cloud says it updated both services to the fixed PHP and finished at 02:39 on 22 October, after starting on the day of disclosure. It describes the flaws as rated critical, 9.2 on CVSS v4.0, and says reports of abuse were already appearing after disclosure.\n\n> 2026年10月22日 02:39に修正版PHPへの更新を完了しております\n\n_Curator's translation:_ \"we completed the update to the fixed PHP at 02:39 on 22 October 2026\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Press release (via Asahi's PR section) from Tokyo company Pickles Inc.: its services Kyantsuku and Yomitoru finished updating PHP at 02:39 on 22 Oct. It also claims exploitation reports appeared right after disclosure.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"「キャンつく」「ヨミトル」PHP重大脆弱性（php2shell）への対応完了のお知らせ | 朝日新聞デジタルマガジン＆[and]\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "asiaone-singapore-php-vulnerability-singapore-cy", "url": "https://www.asiaone.com/singapore/php-vulnerability-singapore-cyber-security-advisory", "publisher": "AsiaOne.com", "kind": "news", "title": "Singapore firms urged to act urgently over critical PHP vulnerabilities, Singapore News - AsiaOne", "published": "2026-10-22T17:30:00+08:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "6f220277a9007cf6c922a3f2c954bfed8fce86e956369ab36769acf26d5a5be6", "bytes": 1687 }, "page.html": { "sha256": "9ee5fb6de889d4124aa283abaf4fb775a6eb662aaf3b9eaa43365580ccafc30e", "bytes": 45762 }, "provenance.json": { "sha256": "74ba964c0b375631467201c326762194f84f9ea6713948928fe081f20b49f220", "bytes": 1778 }, "rendered.html": { "sha256": "2542d7286b42e012202211d6f8005cbec91a40998bf02772cf1751e8118e6442", "bytes": 74356 }, "screenshot.jpg": { "sha256": "603dd37e588ee37cad2d419b504527cfcc21b59af88e2cd144e1afea5afbcbaf", "bytes": 303547 }, "text.txt": { "sha256": "59d25b11948335424a559975e074f1370e9d3b3e0ecb134cc4c1532b852ebecd", "bytes": 3639 } }, "started_utc": "2026-10-23T16:24:45.711Z", "status": 200, "final_url": "https://www.asiaone.com/singapore/php-vulnerability-singapore-cyber-security-advisory" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). AsiaOne (Singapore): Singapore firms are urged to act urgently over the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collect...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Singapore firms urged to act urgently over critical PHP vulnerabilities, Singapore News - AsiaOne\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sg/news/asiaone/singapore-php-vulnerability-singapore-cyber-security-advisor`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAsiaOne (Singapore): Singapore firms are urged to act urgently over the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively PHP2Shell), reported to have lurked in the language for years before being uncovered using artificial intelligence, according to the PHP developers. A shorter report of the same Cyber Security Agency of Singapore advice as the CNA piece.\n\n> have reportedly been lurking in the programming language for years before they were uncovered using artificial intelligence, according to the software's developers\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Singapore firms urged to act urgently over critical PHP vulnerabilities, Singapore News - AsiaOne\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ask-corp-news-2026-10-synology-php2shell-vulnerab", "url": "https://www.ask-corp.jp/news/2026/10/synology-php2shell-vulnerabilities.html", "publisher": "株式会社アスク", "kind": "news", "title": "Synology製品における「PHP2Shell」脆弱性の影響について | 株式会社アスク", "published": "2026-10-23T12:14:16+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f7efa40eced7de094e1454d75d903089f8edc6283538b1bb1bb167a7e7e9f96d", "bytes": 513 }, "page.html": { "sha256": "36e585132825e6f74d0c7dc8949cc4939fcaa561e6040f042c7284224c180609", "bytes": 32059 }, "provenance.json": { "sha256": "1fb451ccb51d0aab506320c5326cf44cf08b624947042521b72fde2e91aaa87e", "bytes": 1745 }, "rendered.html": { "sha256": "1c8e49b4f6e8a2fc19fac8fb79c8da79cbf34c504a78cb01c6afb81a7b9a50af", "bytes": 36453 }, "screenshot.jpg": { "sha256": "06a6815944d0dfb8ab21e9f3785a6c539ffaebb2a1d99b6d7cd2ed9fe3ede788", "bytes": 290684 }, "text.txt": { "sha256": "6522b5d445b74558fd46281774222b2a0bc0cba617fbd4017dce5a6556577011", "bytes": 6428 } }, "started_utc": "2026-10-23T16:19:23.735Z", "status": 200, "final_url": "https://www.ask-corp.jp/news/2026/10/synology-php2shell-vulnerabilities.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ASK Corporation (Japanese distributor of Synology), 23 October: Synology's PSIRT investigated and found the impact is limited to systems running certa...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Synology製品における「PHP2Shell」脆弱性の影響について | 株式会社アスク\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/ask-corp/news-2026-10-synology-php2shell-vulnerabilities-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nASK Corporation (Japanese distributor of Synology), 23 October: Synology's PSIRT investigated and found the impact is limited to systems running certain PHP-dependent packages: Calendar, IDrive (third party), Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress; Synology Drive is not affected. Security updates for PHP were released for DSM 7.4, 7.3 and the end-of-life 7.2; updating through Package Center restarts the package and clears the flaw (MailStation needs a manual update).\n\n> これによる影響は一部のPHP依存パッケージ（アプリ）を実行しているシステムに限定されている\n\n_Curator's translation:_ \"the impact is limited to systems running some PHP-dependent packages (apps)\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Synology製品における「PHP2Shell」脆弱性の影響について | 株式会社アスク\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "atpress-ne-news-644147", "url": "https://www.atpress.ne.jp/news/644147", "publisher": "アットプレス", "kind": "news", "title": "PHPセキュリティ延長保守サービス、 PHP2Shellの修正を保守終了版PHP 5.3～8.1に提供 | エレクトロニック・サービス・イニシアチブ有限会社", "published": "2026-10-26 15:15 (page time zone not stated)", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "e8f4a79f16febaa91ac4ac9f0d562a3ada2bd96c0ca591b34ba7801e80d063fa", "bytes": 3801 }, "page.html": { "sha256": "c555a7b5009344fe46f2632b9e5c3806e98130dd1d497e3036fe67b0c65dabe6", "bytes": 229409 }, "provenance.json": { "sha256": "9f0932e4af313edce7458b886eb59a4b8172ff9abf2b161ed5399c00e7763ea6", "bytes": 1649 }, "rendered.html": { "sha256": "358fe159f90c2413005e37e8110f578dd60adb9b1e5011d6b6061f686c2f518f", "bytes": 226054 }, "screenshot.jpg": { "sha256": "f9e11ca9a8d971e28e2296704295e04d09bc4c6263285ddd4a0fe0c048e4163c", "bytes": 451416 }, "text.txt": { "sha256": "6aa977b484b0dd56de929fc81c954b577469237fd8ffb40efa233c182ab4d6ae", "bytes": 11263 } }, "started_utc": "2026-10-26T09:55:19.239Z", "status": 200, "final_url": "https://www.atpress.ne.jp/news/644147" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). AtPress (Japanese press-release service), 26 October: a press release by Electronic Service Initiative (ESI), Okayama, which sells extended security m...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPセキュリティ延長保守サービス、 PHP2Shellの修正を保守終了版PHP 5.3～8.1に提供 | エレクトロニック・サービス・イニシアチブ有限会社\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/atpress-ne/news-644147`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAtPress (Japanese press-release service), 26 October: a press release by Electronic Service Initiative (ESI), Okayama, which sells extended security maintenance for end-of-life PHP. It says it ported the two security fixes from PHP 8.2.35 to all PHP 5.3 to 8.1 versions and released them on 23 October (release esi-8.2.35). It says the upstream advisory lists only the supported 8.2 and later, but ESI's investigation confirmed the underlying structure exists in all end-of-life versions 5.3 to 8.1; the upstream fix is about 390 files and over 10,000 lines and had to be rewritten per version; some behaviour changes, as upstream, such as what happens at the memory limit; release notes need a subscription. It plans a hardening patch for related issues found during verification and a check of PECL modules. Commercial and promotional in tone.\n\n> ESIの調査で、原因となる作りが保守終了版のPHP 5.3～8.1のすべてにあることを確認しました。\n\n_Curator's translation:_ \"ESI's investigation confirmed that the underlying construction exists in all the end-of-life PHP versions 5.3 to 8.1.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHPセキュリティ延長保守サービス、 PHP2Shellの修正を保守終了版PHP 5.3～8.1に提供 | エレクトロニック・サービス・イニシアチブ有限会社\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "aws-security-blog-madpot", "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "publisher": "Amazon (CJ Moses, AWS Security Blog)", "kind": "vendor", "title": "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111755Z", "files": { "headers.json": { "sha256": "cd2b6b91c536e98366aa450fc499555f4c46f1fc50e52b619d41fdd8156f7621", "bytes": 961 }, "page.html": { "sha256": "94afa0f2233266fa0310186f90425778563bae6747ca3cf284d7d176d5339c8b", "bytes": 1407726 }, "provenance.json": { "sha256": "0d0fa2b45ba63031f0e80fc3fdf09aaa336dc7d1bb31664221072c5be8924343", "bytes": 1223 }, "rendered.html": { "sha256": "5e11969294ad2dba28416a6f535b5e0674e071861c00efcd5c7b6dbecd42ee92", "bytes": 1473573 }, "screenshot.png": { "sha256": "838da55574a9351f12a7a7ef936be739360c2221877d6e744c1ec445ad70a84a", "bytes": 688402 }, "text.txt": { "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "bytes": 8561 } }, "started_utc": "2026-10-22T11:17:55.526Z", "status": 200, "final_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "e0ce26cc23e02ee712c46b0459d730662b9f6c4eb58a7fa0d6e89aa359d4b13c", "bytes": 1032 }, "page.html": { "sha256": "97b8d87ec2bdc87224e2b4fda3e8e9a8e88cbff80a3f648357313cd537435b1a", "bytes": 1407737 }, "provenance.json": { "sha256": "e0642397fc34af1b1f8f3fe7b3c5bd2cb39ab9f1163b292c8f1312d7db92abf5", "bytes": 1920 }, "rendered.html": { "sha256": "cdeee247d98d602a20e40fbea16608d42d2d3169c6c20fd0084f69ddbfe64565", "bytes": 1465446 }, "screenshot.jpg": { "sha256": "cec27caf9be0f02f4189524eff01ba6bbbd4258ca6554bc7eb5ef6b49a0cae60", "bytes": 379262 }, "text.txt": { "sha256": "4108b2850c48a8f2141f05996ef7e7ed115a0a0f80ce697b3d237b8d13e7c764", "bytes": 7474 } }, "started_utc": "2026-10-23T16:26:35.440Z", "status": 200, "final_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Primary account of the 17 October honeypot attempt and the 02:00 UTC proof-of-concept attempts; 'PHP2Shell is now being broadly exploited in the wild'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog\n\nCaptured by claude-story-site. Status: captured. Primary account of the 17 October honeypot attempt and the 02:00 UTC proof-of-concept attempts; 'PHP2Shell is now being broadly exploited in the wild'.\n\n- By CJ Moses, 21 Oct 2026. Verbatim: 'identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure'; 'originated from an IP address associated with a commercial anonymization network'; 'it remains unclear how the actor acquired exploit information prior to disclosure'.\n- 'multiple proof of concept exploits for the vulnerability, with the earliest around 2026-10-21 0200 UTC'; attempts 02:00 to 08:00 UTC from additional anonymised infrastructure, 'multiple actors'; 'it's unclear if any of these attempts would have succeeded in real-world systems'.\n- After release: 'PHP2Shell is now being broadly exploited in the wild.' No counts.\n- Advice: investigate from 17 October; detections that do not rely on a CVE signature; consider blocking multipart uploads where you cannot patch.\n- A reader comment complains AWS managed distributions lacked packages for 10 hours (unverified).\n" }, { "slug": "bangkokbiznews-opinion-1257779", "url": "https://www.bangkokbiznews.com/opinion/1257779", "publisher": "bangkokbiznews", "kind": "news", "title": "ช่องโหว่ PHP สะเทือน ความมั่นคงไซเบอร์ (PHP Vulnerabilities Threaten Cybersecurity)", "published": "2026-10-26T07:45:00+07:00", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "0a14bbac07951cd161839051749fee4c7117ebfcda6a0867bda54e109dcbbaf2", "bytes": 984 }, "page.html": { "sha256": "29df7f16a5bebac87209a063a244e55fe470909c53d13a27087df104898e52e2", "bytes": 318449 }, "provenance.json": { "sha256": "869e1d6fc85d15dd813023efbd93d19893fff655fd865877cd747a740385afa4", "bytes": 1656 }, "rendered.html": { "sha256": "f4adbe40a6d4140d7869be13d2005d9b715bb8bacab021375197b10c867ea91e", "bytes": 301956 }, "screenshot.jpg": { "sha256": "4104d53d2b5b2c59398a05ccf3f9de739ae185553e91423c3079ce74b323be35", "bytes": 493558 }, "text.txt": { "sha256": "540d778a5144a3da476572f9ff10915ae60f67bed447f5fc7fac73d3ae412e9f", "bytes": 17398 } }, "started_utc": "2026-10-26T07:31:35.409Z", "status": 200, "final_url": "https://www.bangkokbiznews.com/opinion/1257779" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "th", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bangkok Biz News (Thai), 26 October, an opinion piece on PHP vulnerabilities and cyber-security. It says researchers found the two flaws while taking...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ช่องโหว่ PHP สะเทือน ความมั่นคงไซเบอร์ (PHP Vulnerabilities Threaten Cybersecurity)\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `th/news/bangkokbiznews/opinion-1257779`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBangkok Biz News (Thai), 26 October, an opinion piece on PHP vulnerabilities and cyber-security. It says researchers found the two flaws while taking part in an OpenAI programme that uses AI to look for internet weaknesses, after finding a flaw in the same area years before; that the PHP Foundation acknowledged the delay in fixing the problem stems from resource limits and the security team's decision-making; that both flaws score 9.2; and that government and company sites worldwide closed temporarily. It cites the US NSA advising organisations that cannot patch to take sites offline, and Cloudflare seeing tens of thousands of attempts within 45 minutes and hundreds of thousands within two hours of disclosure.\n\n> นอกจากนั้นหลังมีการเปิดเผยช่องโหว่ Cloudflare พบความพยายามโจมตีหลายหมื่นครั้งภายใน 45 นาที และเพิ่มเป็นหลายแสนครั้งภายใน 2 ชั่วโมง\n\n_Curator's translation:_ \"Also, after the vulnerabilities were disclosed, Cloudflare found tens of thousands of attack attempts within 45 minutes, rising to hundreds of thousands within two hours.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ช่องโหว่ PHP สะเทือน ความมั่นคงไซเบอร์ (PHP Vulnerabilities Threaten Cybersecurity)\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `th`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "bankinfosecurity-attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a", "url": "https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161", "publisher": "BankInfoSecurity", "kind": "news", "title": "Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP", "published": "2026-10-21", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "e39137f0640ff139d6bfd1f49a013c591568caf7d6b8592dce82b72ed4238e04", "bytes": 1611 }, "page.html": { "sha256": "540fb442ed0aa87627a2a85b0dbd67554aded52034a2dd61e9123f5a477fbafb", "bytes": 414138 }, "provenance.json": { "sha256": "c20c777fabfab04476c89396c87628a54de16b76a5ddf80679c05d08bb7dc590", "bytes": 1814 }, "rendered.html": { "sha256": "e97a0f0bcea1546dfcc583f8e31481483debe5f7a3588e29947804f43a3aa210", "bytes": 438185 }, "screenshot.jpg": { "sha256": "f269193f2b88e4b9015f672ab938acb410ca32e6c08b3330c17f95edba423a42", "bytes": 688403 }, "text.txt": { "sha256": "c0242ed45a367f748a8e597436b19a84a00c9199c5e0300ff98dfc94e55c43c3", "bytes": 10226 } }, "started_utc": "2026-10-23T08:18:05.778Z", "status": 200, "final_url": "https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "78a379eab1d52f97aa107cf2d29673c0e05a8f228910f5f69a9379903491ee7c", "bytes": 1604 }, "page.html": { "sha256": "71c0a7fda1e587a37c8b41f949c378b929d51f59ede6992fed2b94b2aecf2e72", "bytes": 414177 }, "provenance.json": { "sha256": "52ed617ae2be1da48c62f371047c0730425e0ce222934467489b58273ceec711", "bytes": 1814 }, "text.txt": { "sha256": "83102b4d722e0f3676a26b94f152f680c4c325f5fc5caa8949ab9f9cf7ca1032", "bytes": 10156 } }, "started_utc": "2026-10-23T16:16:58.731Z", "status": 200, "final_url": "https://www.bankinfosecurity.com/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a-33161" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Mathew J. Schwartz: attackers were exploiting one or more zero-days in PHP after details leaked before the patches; the PHP Foundation planned updates later Wed...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `ie/news/bankinfosecurity/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-a`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMathew J. Schwartz: attackers were exploiting one or more zero-days in PHP after details leaked before the patches; the PHP Foundation planned updates later Wednesday (editor's note: released); the UK NCSC advised updating internet-facing systems at once or taking them offline; a CISO quoted calls the leak a 'five-alarm cyber fire'; Huntress blogged a warning.\n\n> five-alarm cyber fire\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "baogialai-lo-hong-php-do-ai-phat-hien-khien-nhieu", "url": "https://baogialai.com.vn/lo-hong-php-do-ai-phat-hien-khien-nhieu-website-tren-the-gioi-tam-ngung-hoat-dong-post602798.html", "publisher": "Báo Gia Lai điện tử", "kind": "news", "title": "Lỗ hổng PHP do AI phát hiện gây tạm ngưng nhiều website trên thế giới", "published": "2026-10-22T14:57:50+07:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2950f37d5f1a2436d9bc84b066135aaf07119b8d3842f58c02f9dd9196edb98e", "bytes": 339 }, "page.html": { "sha256": "e394109ce5480af71e08e1f062bbe2dc5b4b0c3fa6cf1c9c6a3d75dffbcbb102", "bytes": 222148 }, "provenance.json": { "sha256": "7210424cf75dea3fdfd8c6ee6b09697fc5b34bb1b243a0a2f8efb0fcfa03e4e6", "bytes": 1699 }, "text.txt": { "sha256": "4334d90d02918c0d014abc9aa6940db9a3c3c5debafedf926caec5a03be6f8ad", "bytes": 19859 } }, "started_utc": "2026-10-23T16:29:04.273Z", "status": 200, "final_url": "https://baogialai.com.vn/lo-hong-php-do-ai-phat-hien-khien-nhieu-website-tren-the-gioi-tam-ngung-hoat-dong-post602798.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "vi", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bao Gia Lai (Vietnamese), 22 October: a PHP flaw found by AI caused many websites worldwide to be suspended temporarily. It says the flaws, together c...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Lỗ hổng PHP do AI phát hiện gây tạm ngưng nhiều website trên thế giới\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `vn/news/baogialai/lo-hong-php-do-ai-phat-hien-khien-nhieu-website-tren-the-gio`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBao Gia Lai (Vietnamese), 22 October: a PHP flaw found by AI caused many websites worldwide to be suspended temporarily. It says the flaws, together called PHP2Shell, relate to PHP's memory management and error handling.\n\n> Các lỗ hổng, được gọi chung là PHP2Shell, liên quan đến cơ chế quản lý bộ nhớ và xử lý lỗi của PHP.\n\n_Curator's translation:_ \"The vulnerabilities, collectively called PHP2Shell, relate to PHP's memory management and error-handling mechanism.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Bao Gia Lai (Vietnam) rewrite of CNN: European government sites, the Netherlands, Finland and Wikimedia paused, Cloudflare saw millions of attempts, and the patch came a day early. Quotes Arctic Wolf's Ismael Valenzuela on the 70% figure.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Lỗ hổng PHP do AI phát hiện gây tạm ngưng nhiều website trên thế giới\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `vi`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "bbc-live-ckgel5xp2xv9t", "url": "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t", "publisher": "BBC News", "kind": "news-live", "title": "PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live", "published": "2026-10-22T06:16:24Z", "captures": [ { "stamp": "20261022T080453Z", "files": { "headers.json": { "sha256": "6f92f9cc2df7e178c6a5480cde0a0d07eaa057374c17573ed0539cd2ec5e4f76", "bytes": 5640 }, "page.html": { "sha256": "dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981", "bytes": 24 }, "provenance.json": { "sha256": "de7ccc50e0cd85c96d0c814a87e22d61df580452ccc7cc08bec00fe2acb36000", "bytes": 1094 }, "rendered.html": { "sha256": "e9ae7f01673df9b32a99007f255c2106bc6f4179841891af83732ce54cac1bde", "bytes": 500416 }, "screenshot.png": { "sha256": "a466ce380b452e0a851e07db1d769f1ccb1b41391a8bf001b5febe1a6b0a8352", "bytes": 2737568 }, "text.txt": { "sha256": "df1dbe6b553a8c004f6d950a1d606138f2795062d3225feaa37043d24343bc99", "bytes": 14389 } }, "started_utc": "2026-10-22T08:04:53.526Z", "status": 200, "final_url": "https://www.bbc.com/news/live/ckgel5xp2xv9t" }, { "stamp": "20261022T080526Z", "files": { "headers.json": { "sha256": "d63c60c458f9e0144dfc1ec7336b7e7eb13ac35383008623841bf01030b99175", "bytes": 5690 }, "page.html": { "sha256": "dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981", "bytes": 24 }, "provenance.json": { "sha256": "b0b6c73c98d7b9af8e3cea8a007eb2212d89e38f80d8fdcb1c99b32cac545a18", "bytes": 1094 }, "rendered.html": { "sha256": "b42a90b0ed17266eac83cb8bc81fc6e2321285b3b3dd01c15aed55411ec51255", "bytes": 511866 }, "screenshot.png": { "sha256": "65eb8a2dd5d93f8ef2399b62dd91d4bae200c41997a77ccae9b9388d33c505bf", "bytes": 3587122 }, "text.txt": { "sha256": "9ae96265aa96cff67f4da71f5ed410376023b17283d83b617eab7e98d2602738", "bytes": 14501 } }, "started_utc": "2026-10-22T08:05:26.517Z", "status": 200, "final_url": "https://www.bbc.com/news/live/ckgel5xp2xv9t" }, { "stamp": "20261022T080559Z", "files": { "headers.json": { "sha256": "adef455045234df0fcb6936e0b86ce89d83c6b68719892c1e08bc498d0704517", "bytes": 5647 }, "page.html": { "sha256": "50bc0fc20681b834b1a40742cf921b27ceb5356d5ab38b417c7e53513016eefd", "bytes": 501921 }, "provenance.json": { "sha256": "b62c78eb8ac92bd2d3d7bbd6749e8f0c24519b5d2edac76d107af558eaf78d2f", "bytes": 1092 }, "rendered.html": { "sha256": "8ae9c4bca9c7ff8b5037ffa58536c2b75c45efdee1f851d583a80ac5cd05ff5c", "bytes": 501515 }, "screenshot.png": { "sha256": "f3cf0359a5f9aec2edf5dfa6cd060f55f94aa3c64b90f7e260edec02180a434c", "bytes": 2685632 }, "text.txt": { "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "bytes": 14389 } }, "started_utc": "2026-10-22T08:05:59.064Z", "status": 200, "final_url": "https://www.bbc.com/news/live/ckgel5xp2xv9t" } ], "status": "captured", "primary": false, "added_by": "claude-newsroom-lead", "notes": "Live page; bbc.co.uk redirects to bbc.com. raw/ holds a curl copy at 07:55Z and its __INITIAL_DATA__. Captures 080453Z and 080526Z have no raw body (the tool's first fallback was blocked by egress); 080559Z is complete. Edited by Kieran Kelly and Imogen James.", "raw_sha256": { "initial-data.json": "ee7445a58187bcd67df827007a8100941993a24dc3e7eea7e8a45f723a9e3305", "page.2026-10-22T0755Z.html": "fe32274b64ee109a7e37fc4c26e37e793dc22481a6122888782c393e01102488" }, "has_notes": true, "notes_md": "# BBC News live page: notes\n\n- URL: https://www.bbc.co.uk/news/live/ckgel5xp2xv9t, which redirects to https://www.bbc.com/news/live/ckgel5xp2xv9t\n- Live since 2026-10-22T06:16Z (seoTimestamps.firstPublished 06:16:24.321Z); edited by Kieran Kelly and Imogen James\n- First copy at 07:55Z (curl): 12 posts, 07:15 to 08:50 BST. See `extracted-text.md`.\n- The 08:00 BST post appeared after 07:55Z: \"No evidence that hackers have exploited flaw so far, says researcher\" (Ryan Austin, Calif).\n\n## Claims attributed here (follow each to its primary source)\n- PHP Foundation: coordinated disclosure \"worked well\" until a leak; Calif \"mistakenly published a video\". Find the foundation's statement.\n- OpenAI \"Patch the Planet\" initiative; the PHP Foundation was accepted in July 2026. Find OpenAI's blog post.\n- Calif found the flaw in August; OpenAI and Wiz found it independently shortly after. Find the Calif and Wiz posts.\n- Wiz: \"roughly 70%\" of the internet affected. The BBC could not verify this.\n- Woodward: \"something like 30 million websites\"\n- NSA cyber (X post): \"two critical vulnerabilities\". Take offline if an update is not feasible.\n- NCSC note: \"Where immediate remediation is not feasible, organisations should consider taking the system offline\". Also EU and Australian counterparts.\n- Amazon and Cloudflare saw probing (Woodward). Find Cloudflare's or AWS's own statement.\n- Affected: Wikipedia (parts taken down), Edinburgh council, French government sites, the University of Geneva (header image), online shops, the BBC.\n- In 2024 PHP Foundation researchers found a theoretical flaw they could not exploit.\n- Not in the blog: CVE IDs, affected versions or SAPIs, the patched releases. Get these from php.net.\n" }, { "slug": "bgonair-a-5-science-434196-kritichna-uyazvimost", "url": "https://www.bgonair.bg/a/5-science/434196-kritichna-uyazvimost-v-php-sprya-pravitelstveni-saytove-v-evropa", "publisher": "Bgonair", "kind": "news", "title": "Критична уязвимост в PHP спря правителствени сайтове в Европа - Bgonair", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c4e820be49379950d863108a87aa3dfbad2f5a528d2f8c64e750992a1ee01516", "bytes": 850 }, "page.html": { "sha256": "e650b289ccfa05e9947462d5c16e5abcecc3e58f33aab9d332cbdca6378925d8", "bytes": 108183 }, "provenance.json": { "sha256": "132fe38523f9c1cf7f2b415f8be03529e1428394d0134daf5ff9f3820a6580f8", "bytes": 1845 }, "rendered.html": { "sha256": "e92638364e7962f93780d238e7f94a2e71fcf4cc76dd57ab6e88119a2ec9208e", "bytes": 115826 }, "screenshot.jpg": { "sha256": "4a0c93662dbb23e0e33ce0170f8ee2823265a7ca0e4c661f0d83e482f70a35f9", "bytes": 510187 }, "text.txt": { "sha256": "516d8149a92b149276cba7b183d204955b6e9a52ac0594ae57c267ee8f7f55b3", "bytes": 12463 } }, "started_utc": "2026-10-23T16:11:09.492Z", "status": 200, "final_url": "https://www.bgonair.bg/a/5-science/434196-kritichna-uyazvimost-v-php-sprya-pravitelstveni-saytove-v-evropa" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "bg", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bgonair (Bulgarian): a critical PHP vulnerability stopped government sites in Europe. The flaws are known together as PHP2Shell and carry a risk of re...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Критична уязвимост в PHP спря правителствени сайтове в Европа - Bgonair\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `bg/news/bgonair/a-5-science-434196-kritichna-uyazvimost-v-php-sprya-pravitel`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBgonair (Bulgarian): a critical PHP vulnerability stopped government sites in Europe. The flaws are known together as PHP2Shell and carry a risk of remote execution of malicious code under certain conditions.\n\n> Те са известни под общото название PHP2Shell и създават риск от дистанционно изпълнение на злонамерен код при определени условия.\n\n_Curator's translation:_ \"They are known under the common name PHP2Shell and create a risk of remote execution of malicious code under certain conditions.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Bulgarian site Bgonair summarises Reuters and WSJ reporting that government sites in Europe were temporarily shut over the PHP2Shell flaws, rated 9.2. Generic advice to check PHP versions; no Bulgarian angle.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Критична уязвимост в PHP спря правителствени сайтове в Европа - Bgonair\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `bg`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "bitpage-php2shell-php-sicherheitsluecke-webseite", "url": "https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/", "publisher": "Bitpage.de", "kind": "news", "title": "PHP2Shell: Wer offline ist, wer gepatcht hat und was zu tun ist - Bitpage.de", "published": "2026-10-22T06:21:47+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "98241adeba9a7cc8fa85d770ca82323b08a5f43eb3e4548c02455dcac256367f", "bytes": 789 }, "page.html": { "sha256": "d842d79b8094876b9a5081dfe5ea816a4fa8cc09bf32b0f05350216716e07201", "bytes": 374328 }, "provenance.json": { "sha256": "4ec337fd7770c0a1ab6012864a9c19014bbd895be8d1f9ffc4ab98a57e9ff6ef", "bytes": 1556 }, "text.txt": { "sha256": "50d84bde38c55c1772d88500502e6aa7a1e20d4691519ca18654499441ad8786", "bytes": 59785 } }, "started_utc": "2026-10-23T16:12:58.182Z", "status": 200, "final_url": "https://bitpage.de/php2shell-php-sicherheitsluecke-webseiten-offline/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de-DE", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Bitpage.de (German): a situation report from the evening of Wednesday 21 October, updated on Thursday and Friday morning, on why half of Europe switch...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Wer offline ist, wer gepatcht hat und was zu tun ist - Bitpage.de\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/bitpage/php2shell-php-sicherheitsluecke-webseiten-offline`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBitpage.de (German): a situation report from the evening of Wednesday 21 October, updated on Thursday and Friday morning, on why half of Europe switched its websites off. It names the City of Mainz website going down at midday, then the Charité, then the host Mittwald saying all its customers' sites were offline, then Dutch sites, and goes on to explain what PHP2Shell is, who is offline, who has patched and what to do. A long page (about 58,000 characters); only the opening was read in full.\n\n> Es fing am Mittag damit an, dass die Webseite der Stadt Mainz nicht mehr aufging, kurz darauf war die Charité weg\n\n_Curator's translation:_ \"It started at midday with the City of Mainz's website no longer opening; shortly after, the Charité was gone\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Wer offline ist, wer gepatcht hat und was zu tun ist - Bitpage.de\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `de-DE`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "bleepingcomputer-amazon-4-days-before", "url": "https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/", "publisher": "BleepingComputer", "kind": "news", "title": "Amazon says PHP2Shell exploitation began 4 days before patches", "published": null, "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "668fb6eaa9fed6428617810fa613ea89128912ab5a69ca9b6b07745619eca389", "bytes": 1034 }, "page.html": { "sha256": "e0b6621a06d202fe071370cdaabe66d71c2f5140fa24ed84944ee545eadc0c0c", "bytes": 90448 }, "provenance.json": { "sha256": "4b9107ed9dfda71ba900872536cb9a543352733b8b9cf058ac39652728d7ff33", "bytes": 1732 }, "rendered.html": { "sha256": "af0f5bafbd31cd2f15782a44bb16120c0356bcb9d0b4b1023880e8c5fa904d4e", "bytes": 150348 }, "screenshot.jpg": { "sha256": "cd8f6c7adbf3fd996cf0fa8b8fc6045875dc12132019c0dcf9440db26e55862d", "bytes": 518677 }, "text.txt": { "sha256": "2978662261ce3880962943cd129485066fab46e3bc7a181762dbe83479aa8997", "bytes": 5970 } }, "started_utc": "2026-10-23T01:38:32.793Z", "status": 200, "final_url": "https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): \"unclear how man...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Amazon says PHP2Shell exploitation began 4 days before patches\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/tech-press/bleepingcomputer/amazon-4-days-before`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: BleepingComputer. Language: en. URL: https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBleepingComputer: Amazon Threat Intelligence says the first exploitation attempts began on 17 October, four days before the patches, from a commercial anonymisation network, and that multiple proof-of-concept exploits were used from VPN addresses hours after disclosure, apparently by several actors; \"it's unclear if any of these attempts would have succeeded in real-world systems\", yet PHP2Shell is \"now being broadly exploited in the wild\". It says Cloudflare, watchTowr, Previdian, Hadrian and Patchstack detected unsuccessful exploitation attempts before disclosure, that the PHP team said pre-patch PoCs were not functional, and quotes Dataminr's TRACE team: activity since disclosure \"remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises\". VirusTotal tracks more than 5.1 million PHP hosts, about 3.8 million with a port open.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): \"unclear how many attacks are successful\"\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "bleepingcomputer-php2shell", "url": "https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/", "publisher": "bleepingcomputer.com", "kind": "news", "title": "PHP ships emergency patches for critical PHP2Shell flaws", "published": null, "captures": [ { "stamp": "20261022T081018Z", "files": { "headers.json": { "sha256": "9204c9d3cedc821d3f1fe3b9b829b20b9fce7eaddb285be33ddc3ce09bc61974", "bytes": 1034 }, "page.html": { "sha256": "e6f9f8d5119ac7742807418bf305184e2b93a11051d35241184ba320a7e80651", "bytes": 91998 }, "provenance.json": { "sha256": "79d14d3581b9b39dcd1feb8a7848a6c6f3a697a6b91f615cb747919d14f16c43", "bytes": 1100 }, "rendered.html": { "sha256": "5357928e9e81ec6b27c56d8bd9c89953bdfdac5cd5f098d3ffdb2943bf6c0e3f", "bytes": 170279 }, "screenshot.png": { "sha256": "7bface94f50938d69eff243e48acb16f1cdcb1f94fd50644f07d7dc744d8cf6d", "bytes": 1525231 }, "text.txt": { "sha256": "ad35f92f5f9bf98f235b92c8180ba7ba15b7a222bf882cb8b3d074e060f862b1", "bytes": 7078 } }, "started_utc": "2026-10-22T08:10:18.689Z", "status": 200, "final_url": "https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ad0cf71daaecac8875fd26ec93ab203967a0a77fe49b543d82f649c3b1babf5d", "bytes": 1034 }, "page.html": { "sha256": "83b2007c154fba517b5d5426fd4c9d3eb80e9cc5b3079fa1d4d5bdf95294e291", "bytes": 91775 }, "provenance.json": { "sha256": "f2c73943812b4f87f5ab8daaf2ec6b497c5242a6086dd590111a8ba7ead8fc22", "bytes": 1702 }, "text.txt": { "sha256": "63f09a43ab70aab1b5d441ee1227ec138415c4ef7386b36ecd6093f50da20bd8", "bytes": 7101 } }, "started_utc": "2026-10-23T16:28:22.314Z", "status": 200, "final_url": "https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "bleepingcomputer-wikipedia-ref-12--flaws-emergency-patche", "url": "https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/", "publisher": "BleepingComputer", "kind": "news", "title": "PHP warns admins of two critical flaws, emergency patches coming tomorrow", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "ca863dbfec9805bdc59cdd994438b05448b73a74158d405cf19a657965e6b2ae", "bytes": 1034 }, "page.html": { "sha256": "d0de273c85bf93f86a708f1a69f3b9e8748c845615daf26e6bdde9e65adb85d3", "bytes": 94411 }, "provenance.json": { "sha256": "bc46428b2ef9e4f0a919b707f1b95ea7737ad40fe0deec8182ad68a727379174", "bytes": 1857 }, "rendered.html": { "sha256": "1e4b558ff00a6e867733bf569f7fb2f8a5321d84dfd6e09d1eec77aa2f4a1f49", "bytes": 213001 }, "screenshot.jpg": { "sha256": "0e577c60bdce9fc2fe64f87fd4bd5b60079dd704fc49ca0c7c76cdd39c172f93", "bytes": 634029 }, "text.txt": { "sha256": "067232e02619cba94e53ac7052dc4154a3664cebd75d222e9cf2c40a462328cb", "bytes": 8606 } }, "started_utc": "2026-10-25T11:47:11.195Z", "status": 200, "final_url": "https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-us", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). BleepingComputer, written before the patches (updated 21 October with a link to its newer article): PHP warns admins of two critical flaws with emerge...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP warns admins of two critical flaws, emergency patches coming tomorrow\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/tech-press/bleepingcomputer/wikipedia-ref-12--flaws-emergency-patches-coming-tomorrow`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBleepingComputer, written before the patches (updated 21 October with a link to its newer article): PHP warns admins of two critical flaws with emergency patches coming the next day. The PHP security team reserved the right to release early if details leaked or exploitation appeared; the developers had disclosed no technical details. watchTowr told BleepingComputer that two remote code execution flaws had been leaked an hour earlier, previously under embargo for Thursday at 11 am ET; that both were CVSS 10 and understood to affect PHP versions 5, 6, 7 and 8; and that it believed it had reproduced CVE-2026-109618 but would not release technical information until patches were out.\n\n> These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP warns admins of two critical flaws, emergency patches coming tomorrow\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-us`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "blocktempo-openai-php2shell-checker-codex-skill", "url": "https://www.blocktempo.com/openai-php2shell-checker-codex-skill/", "publisher": "動區動趨", "kind": "news", "title": "OpenAI 開源 php2shell 版本檢查器：Codex 技能一鍵比對 PHP 版本，但「OK」不代表真安全 | 動區動趨-最具影響力的區塊鏈新聞媒體", "published": "2026-10-22T22:23:10+08:00", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "5d90c2ead37f4999ffa4a5f9613a43acb62df36efbf7d8460adfed364e924e27", "bytes": 1163 }, "page.html": { "sha256": "101375f18a72db5b11795bc27f0cd811b4ad3c7eeb37eef183978ed0933d3d6c", "bytes": 174106 }, "provenance.json": { "sha256": "fce73b61529ea1b6601ae704aa48616e326a31e3910aeb69bf152151cf5a467d", "bytes": 1762 }, "rendered.html": { "sha256": "27f56a099582f6d6a0af220eadfdddb2bad38dcbefe56ff653b8b85bf43ef7d1", "bytes": 178800 }, "screenshot.jpg": { "sha256": "2325cb8183bec12e1e140fd91d437f79b2ff617ac2b2b3482e1c79ea1dac7290", "bytes": 313690 }, "text.txt": { "sha256": "8db46ec6b3d92fce1d4d9124253dc2736a1a8f9d96980bea7312f27ccf228d39", "bytes": 10324 } }, "started_utc": "2026-10-23T08:13:59.978Z", "status": 200, "final_url": "https://www.blocktempo.com/openai-php2shell-checker-codex-skill/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-TW", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). BlockTempo (Traditional Chinese), 22 October: OpenAI open-sourced php2shell-checker on GitHub, usable as a Codex skill or a one-line Node.js command,...", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI 開源 php2shell 版本檢查器：Codex 技能一鍵比對 PHP 版本，但「OK」不代表真安全 | 動區動趨-最具影響力的區塊鏈新聞媒體\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `cz/news/blocktempo/openai-php2shell-checker-codex-skill`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBlockTempo (Traditional Chinese), 22 October: OpenAI open-sourced php2shell-checker on GitHub, usable as a Codex skill or a one-line Node.js command, which compares a PHP version against the two CVSS 9.2 flaws' affected range; it only reads versions, sends no attack traffic, and OpenAI stresses UNKNOWN does not mean patched. Created on 21 October (Taipei time) under Apache 2.0, with over 700 stars by the evening of 22 October. The curator did not fetch or run the tool; the page describes it and gives no instruction to the curator.\n\n> OpenAI 在 GitHub 釋出開源工具 php2shell-checker，以 Codex 技能或一行 Node.js 指令比對 PHP 版本\n\n_Curator's translation:_ \"OpenAI released an open-source tool, php2shell-checker, on GitHub, which compares PHP versions through a Codex skill or a one-line Node.js command\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Taiwanese crypto outlet BlockTempo describes OpenAI's open-source php2shell-checker tool on GitHub (Codex skills phpcheck-url and phpcheck-server), which only compares version numbers and warns that UNKNOWN does not mean patched. It repeats CISA, Cloudflare and watchTowr reporting.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"OpenAI 開源 php2shell 版本檢查器：Codex 技能一鍵比對 PHP 版本，但「OK」不代表真安全 | 動區動趨-最具影響力的區塊鏈新聞媒體\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-TW`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "blog-nouvelles-technologies-389778-php2shell-faille-critique-php-cor", "url": "https://www.blog-nouvelles-technologies.fr/389778/php2shell-faille-critique-php-correctifs/", "publisher": "le Blog des Nouvelles Technologies", "kind": "news", "title": "PHP2Shell : une faille critique de PHP déclenche l’alerte mondiale", "published": "2026-10-25T09:20:00+01:00", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "fd9a653888616bc12a9ad4b75860a30f5f242dbd497ee71982c7fa3dec11b4a7", "bytes": 1770 }, "page.html": { "sha256": "d20daa73b3cb93ca61a59c5bf97411d0bd947e38188695fff4478dc28a17d5ba", "bytes": 316687 }, "provenance.json": { "sha256": "efa4f0a56bfc8430ca4a9c5a7d4ee1fa6cf782c2683e66f1651d2ad6cc7ef93c", "bytes": 1796 }, "rendered.html": { "sha256": "68d345aa7ff877f4fe939da97cb62097a4cc2dd392d2d29bbd68a0459aa529ba", "bytes": 1108599 }, "screenshot.jpg": { "sha256": "5907db3ccb1a486d4c7e0ce88d87f79852054fa0b2b108dfb75e9b2f8bcb50a9", "bytes": 642950 }, "text.txt": { "sha256": "65f30d3a9ba0e5491a8dcdbd5ee3260abea69d8d50f0442ff21a3a6a0b28c097", "bytes": 10452 } }, "started_utc": "2026-10-26T07:20:36.076Z", "status": 200, "final_url": "https://www.blog-nouvelles-technologies.fr/389778/php2shell-faille-critique-php-correctifs/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Le Blog des Nouvelles Technologies (French), 25 October, by Yohann Poiron: an explainer saying PHP2Shell set off a wave of attacks on websites and tha...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : une faille critique de PHP déclenche l’alerte mondiale\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/blog-nouvelles-technologies/389778-php2shell-faille-critique-php-correctifs`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLe Blog des Nouvelles Technologies (French), 25 October, by Yohann Poiron: an explainer saying PHP2Shell set off a wave of attacks on websites and that millions of exploitation attempts were reported after public disclosure. It says Calif and Wiz worked on the flaws with AI tools and that the PHP Foundation says it used advanced models to review its code, in work with OpenAI and other partners. It names the two CVEs (both 9.2 on CVSS 4.0) and, citing Cloudflare, that they can lead to remote code execution, data exposure or denial of service. It gives no source for the 'millions' count.\n\n> Des millions de tentatives d’exploitation ont été signalées après la divulgation publique du problème.\n\n_Curator's translation:_ \"Millions of exploitation attempts were reported after the problem was publicly disclosed.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : une faille critique de PHP déclenche l’alerte mondiale\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "blogdumoderateur-failles-critiques-php-versions-mettre-a", "url": "https://www.blogdumoderateur.com/failles-critiques-php-versions-mettre-a-jour-comment-proteger-serveurs/", "publisher": "BDM", "kind": "news", "title": "Failles critiques dans PHP : quelles versions mettre à jour et comment protéger ses serveurs", "published": "2026-10-22T11:32:58+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c0639e4130945a6225ea17ddc77a70beaabd3cdf20f5a2e8f6bda4e3c4462435", "bytes": 1510 }, "page.html": { "sha256": "b36c8dcb951e96c43153ea0818c9130f4292135cc952df25f823f7530109e8ff", "bytes": 203825 }, "provenance.json": { "sha256": "b5bafe2dc90a211bd286e7453991e0ddf9fcb42dd22519e32557d7411cc0f7fb", "bytes": 1692 }, "text.txt": { "sha256": "795b299b2ea070a2915cafe3d2c86387b6ce281a3932d3cbbc183fa4cca9b2d0", "bytes": 8926 } }, "started_utc": "2026-10-23T16:10:42.090Z", "status": 200, "final_url": "https://www.blogdumoderateur.com/failles-critiques-php-versions-mettre-a-jour-comment-proteger-serveurs/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Blog du Modérateur (French): which PHP versions to update and how to protect servers. CVE-2026-109618 and CVE-2026-109619 are rated 9.2 out of 10 on C...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Failles critiques dans PHP : quelles versions mettre à jour et comment protéger ses serveurs\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/blogdumoderateur/failles-critiques-php-versions-mettre-a-jour-comment-protege`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBlog du Modérateur (French): which PHP versions to update and how to protect servers. CVE-2026-109618 and CVE-2026-109619 are rated 9.2 out of 10 on CVSS v4.0 and sit in PHP's engine, in memory handling, so any site on a vulnerable PHP version is exposed whatever its own code.\n\n> se situent dans le moteur de PHP lui-même, au niveau de la gestion de la mémoire\n\n_Curator's translation:_ \"lie in PHP's engine itself, at the level of memory management\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Blog du Modérateur explains which PHP versions to update and how. It cites CERT-FR's alert, GoDaddy's guidance and W3Techs version shares. It also reports the French Interior Ministry's preventive maintenance at ANSSI's request and ANSSI's count of PHP servers in France.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Failles critiques dans PHP : quelles versions mettre à jour et comment protéger ses serveurs\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "bloomberg-governments-offline", "url": "https://www.bloomberg.com/news/articles/2026-10-21/governments-take-websites-offline-after-php-security-warnings", "publisher": "Bloomberg", "kind": "news", "title": "Bloomberg - Are you a robot?", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112602Z", "files": { "headers.json": { "sha256": "ebbf488d8ec3cb9e82e0b2850092794fa151b40e36e5527483c925bd8bc043c2", "bytes": 1744 }, "page.html": { "sha256": "42ba14394a9bbfcfd2d92ca9d569ec69f03944659af408f36f57faea50e788d2", "bytes": 13856 }, "provenance.json": { "sha256": "3c8c1301b67db2b3dbe016f7c0f83861dc5a27d0a02c693c16b232b3a0f0bc56", "bytes": 1091 }, "rendered.html": { "sha256": "cf863d12c016944da5fa0f4a5d5a6b20441810b9d390e4cd795477677e22219c", "bytes": 15882 }, "screenshot.png": { "sha256": "381a9b176a6f0b8aa7805f9ddb22a7cd17826528afa7a41b24b0015b1c3a355e", "bytes": 78255 }, "text.txt": { "sha256": "a66e04101bddd06c4cc5019d69b57bd2db4ff7d0a6ecdfe0fbd4d6fc5e05b303", "bytes": 665 } }, "started_utc": "2026-10-22T11:26:02.384Z", "status": 403, "final_url": "https://www.bloomberg.com/news/articles/2026-10-21/governments-take-websites-offline-after-php-security-warnings" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "European governments take websites offline; may be paywalled, see capture status.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Bloomberg - Are you a robot?\n\nCaptured by claude-story-site. Status: blocked. European governments take websites offline; may be paywalled, see capture status.\n\n- See provenance for whether the body was served.\n" }, { "slug": "bluewin-de-digital-php-sicherheitsluecke-ondrej", "url": "https://www.bluewin.ch/de/digital/php-sicherheitsluecke-ondrej-sury-rettet-internet-li.3646381", "publisher": "blue News", "kind": "news", "title": "PHP2Shell: Wie Ondřej Surý das Internet rettete", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "511c9b18e843f308ea9ca719a7dbd0b04614f751c128b5b2084ff050ad81cb29", "bytes": 1189 }, "page.html": { "sha256": "68b7183d54075fbee5604bfc206f159019e362d1f77c833768293bc690bcd014", "bytes": 1038518 }, "provenance.json": { "sha256": "4758638831a21849710be5f228400230a3bbc37ed19b876b9703f855442b0dc9", "bytes": 1747 }, "rendered.html": { "sha256": "01e568d5870a64b8fa57f931694da6096eead2ce92ac6a8174ed9cca94218c9c", "bytes": 1040805 }, "screenshot.jpg": { "sha256": "6ca53852b85d0f1a5401c65feaa43d9917ea53f3a465e8a850de98376f733095", "bytes": 513241 }, "text.txt": { "sha256": "f9a3771421acf48c94eb3e31e3b071739cb4418c9708dba568ff5ab7f7291e8b", "bytes": 7294 } }, "started_utc": "2026-10-24T13:40:41.969Z", "status": 200, "final_url": "https://www.bluewin.ch/de/digital/php-sicherheitsluecke-ondrej-sury-rettet-internet-li.3646381" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). blue News (German, Switzerland): 'PHP2Shell: how Ondrej Sury saved the internet'. It says two PHP flaws threaten a large share of all websites; that p...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Wie Ondřej Surý das Internet rettete\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/bluewin/de-digital-php-sicherheitsluecke-ondrej-sury-rettet-internet`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nblue News (German, Switzerland): 'PHP2Shell: how Ondrej Sury saved the internet'. It says two PHP flaws threaten a large share of all websites; that precursors of the bug had been known since 2004 but never fixed; and that a Czech maintainer, Ondrej Sury, builds in his free time the update packages administrators worldwide use to secure their servers, receiving only donations.\n\n> Vorläufer des Fehlers waren schon seit 2004 bekannt, behoben wurde er trotzdem nie.\n\n_Curator's translation:_ \"Precursors of the bug had been known since 2004, but it was never fixed.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Wie Ondřej Surý das Internet rettete\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "boannews-news-articleview-html", "url": "https://www.boannews.com/news/articleView.html?idxno=146663", "publisher": "boannews", "kind": "news", "title": "[PHP 파장] “개인정보 유출 우려... DB 접근권한 최소화 시급” < 긴급경보 < 공공·정책 < 기사본문 - 보안뉴스", "published": "2026-10-22T17:01:36+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ffe49f69fbfe2f700a70ca3c87bf90eeaa4b74a29b07551b11dde6ced6b4f4fb", "bytes": 354 }, "page.html": { "sha256": "7f52efe4c89e57ed6b9a9da9b28bdd8edb209953580e4de96716ee24e55ffc2b", "bytes": 143504 }, "provenance.json": { "sha256": "9471e7a25d4c72a8993f49ff00041b1d7addb1394ee32cf68faaf542a897a121", "bytes": 1680 }, "rendered.html": { "sha256": "f17e26947dcbfc0b3f49b2e4e80bf92cacd5035f0054e5828fb981404b7b971d", "bytes": 144749 }, "screenshot.jpg": { "sha256": "8b9498eb4d92025b9079f482f521ce3dce005ac62bd2eb2fb3eb0a3143afc46d", "bytes": 619854 }, "text.txt": { "sha256": "992d0cbd7b31e0d69b4c9ec0f11ff0643f2eed68140c2062ca76eda87be5e1be", "bytes": 9427 } }, "started_utc": "2026-10-23T16:21:03.540Z", "status": 200, "final_url": "https://www.boannews.com/news/articleView.html?idxno=146663" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Boan News (Korean), 22 October, headlined 'concern about personal-data leaks; minimising DB access rights is urgent'. It says PHP2Shell, announced on...", "raw_sha256": {}, "has_notes": true, "notes_md": "# [PHP 파장] “개인정보 유출 우려... DB 접근권한 최소화 시급” < 긴급경보 < 공공·정책 < 기사본문 - 보안뉴스\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/boannews/news-articleview-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBoan News (Korean), 22 October, headlined 'concern about personal-data leaks; minimising DB access rights is urgent'. It says PHP2Shell, announced on the 21st, lets an attacker run arbitrary commands on a web server without logging in, and that a leak of personal data stored in linked databases is also a concern, especially where phpMyAdmin is exposed or DB permissions are excessive. Korea's Personal Information Protection Commission urged operators to act: urgent fixes, stronger DB access control, mass-leak prevention and checking blind spots.\n\n> 개인정보위는 웹 서비스를 운영하는 개인정보처리자에게 보호조치를 신속히 이행할 것을 당부했다.\n\n_Curator's translation:_ \"The Personal Information Protection Commission urged personal-information handlers operating web services to carry out protective measures promptly.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"[PHP 파장] “개인정보 유출 우려... DB 접근권한 최소화 시급” < 긴급경보 < 공공·정책 < 기사본문 - 보안뉴스\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "borncity-blog-2026-10-21-php2shell-php-schwachste", "url": "https://borncity.com/blog/2026/10/21/php2shell-php-schwachstellen-cve-2026-109618-und-cve-2026-109619/", "publisher": "BornCity", "kind": "news", "title": "php2shell: PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619Borns IT- und Windows-Blog", "published": "2026-10-21T13:20:52+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "e5590d010f043055660e961be0a483504d7a4ed93480c36a288ca3f595ffbc6e", "bytes": 794 }, "page.html": { "sha256": "625aa0a420a0a900dfba6aad62794bd507aa5e6807aee58a816a4314d5539606", "bytes": 355141 }, "provenance.json": { "sha256": "c710138a52c85dedbb612a3dc83558a915acec7e9fb87c601bd687f9c55e3d54", "bytes": 1811 }, "rendered.html": { "sha256": "ea2064e3b443f7b73db67225a5b4a7047364619c3c600d923e4c3b23a2c4e3e8", "bytes": 364116 }, "screenshot.jpg": { "sha256": "597e71c72aa7ca054f0eaaacb05839f2cb45cc1795d5f0377bbf145dfa050fac", "bytes": 650886 }, "text.txt": { "sha256": "ac019c2d35b1f126f0a4b19cc896409cde99b37682e90df4cff859aeb76b3ac5", "bytes": 65743 } }, "started_utc": "2026-10-23T16:09:26.679Z", "status": 200, "final_url": "https://borncity.com/blog/2026/10/21/php2shell-php-schwachstellen-cve-2026-109618-und-cve-2026-109619/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Born's IT and Windows blog (German), 21 October: two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, became public. The PHP maintai...", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell: PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619Borns IT- und Windows-Blog\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `at/news/borncity/blog-2026-10-21-php2shell-php-schwachstellen-cve-2026-109618`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBorn's IT and Windows blog (German), 21 October: two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, became public. The PHP maintainers had announced on 20 October that details and patches would follow on 21 October; information apparently leaked beforehand. A long running post (about 64,000 characters) with later updates; the opening was read in full.\n\n> Die PHP-Maintainer haben zum 20. Oktober 2026 angekündigt, am heutigen 21. Oktober 2026 Details und Patches zu veröffentlichen.\n\n_Curator's translation:_ \"The PHP maintainers announced for 20 October 2026 that they would publish details and patches today, 21 October 2026.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Günter Born's IT blog covers the leak and pre-announcement of the PHP fixes, notes that 8.1 and older will not be patched, and reports readers taking WordPress/Nextcloud instances offline or behind passwords. It mentions a BSI warning (criticality 3/orange), Huntress's John Hammond on webshells, and links to follow-up articles.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"php2shell: PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619Borns IT- und Windows-Blog\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "boursorama-reuters-sites-gouv", "url": "https://www.boursorama.com/bourse/actualites/des-sites-gouvernementaux-hors-service-sur-fond-de-failles-dans-php-un-correctif-critique-attendu-70b6b2c5823e9cf3e5dd17efb767a981", "publisher": "boursorama.com", "kind": "news", "title": "Des sites gouvernementaux hors service sur fond de failles dans PHP, un correctif critique attendu - 21/10/2026 à 16:44 - Boursorama", "published": null, "captures": [ { "stamp": "20261022T081500Z", "files": { "headers.json": { "sha256": "4cfefb7acbde24b1c20a1ba8333fc6bf7b3f9306ff39e4b0f2e46bd4d1d16dc0", "bytes": 713 }, "page.html": { "sha256": "a3ff1c1936dbdc9e95bfd9f790a2d8efca4f5142ae1ca227ac2fb0328f04163e", "bytes": 945994 }, "provenance.json": { "sha256": "cdb64045594736d1dfb6ffca73b7d9bd3a24f19eead44272bed34cfca44b1bb1", "bytes": 1322 }, "rendered.html": { "sha256": "fa0c4547e744675c7372948ee9a090d77cad1b8539e4fc859472aac46d96024d", "bytes": 1003767 }, "screenshot.png": { "sha256": "08778bfe5be98ae08aedcdf07c1abddac7bab7bc05be669ae0f808932a489685", "bytes": 966367 }, "text.txt": { "sha256": "cc4667b91c744182995cf31ded0e703d9cfd3ea1f87983a11b665ae840d784d1", "bytes": 11528 } }, "started_utc": "2026-10-22T08:15:00.439Z", "status": 200, "final_url": "https://www.boursorama.com/bourse/actualites/des-sites-gouvernementaux-hors-service-sur-fond-de-failles-dans-php-un-correctif-critique-attendu-70b6b2c5823e9cf3e5dd17efb767a981" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "broadcom-security-php2shell", "url": "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619", "publisher": "Broadcom (Symantec) Security", "kind": "vendor", "title": "PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COM", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112608Z", "files": { "headers.json": { "sha256": "90e7e97292b84a9655eb632719cd295101372dea8bfbbea1c37cac21f29c6083", "bytes": 2018 }, "page.html": { "sha256": "ee4999fb83f9cd38b29e33384e6cd904f855429326277bbcaaaa0b5796879cf8", "bytes": 329468 }, "provenance.json": { "sha256": "c676441507e6939f7a352231caebe725dfa363ad55108ae190166cc7123411b0", "bytes": 1093 }, "rendered.html": { "sha256": "087b78f1dbe37ce2b31dc124b10b31a4009ac15969a40407f65afddb1dff30b7", "bytes": 431453 }, "screenshot.png": { "sha256": "a4a4f3fec342e365df75bcdd5a2b61bac1edb4a1417b9a1200702734cd579cff", "bytes": 2841458 }, "text.txt": { "sha256": "ade5eb86aa233a2122f483429993bf21453456fc608ee191949dacc2f7e3a260", "bytes": 13607 } }, "started_utc": "2026-10-22T11:26:08.556Z", "status": 200, "final_url": "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COM\n\nCaptured by claude-story-site. Status: captured. Vendor explainer.\n\n- Captured for the record.\n" }, { "slug": "btc-echo-news-krypto-boersen-akut-bedroht-kritisc", "url": "https://www.btc-echo.de/news/krypto-boersen-akut-bedroht-kritische-php-luecke-239718/", "publisher": "BTC-ECHO", "kind": "news", "title": "Akute Warnung: PHP-Schwachstelle gefährdet Krypto-Dienste", "published": "2026-10-22T16:05:00+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f243d20f6550d7beecd6da503c41ae09c37ce8265a1538f7945a4f069bc6890a", "bytes": 1856 }, "page.html": { "sha256": "6283db83b9e79dee0d153c22d7ed0a06d9a407930aa06d45494d388e8a63e7f9", "bytes": 329819 }, "provenance.json": { "sha256": "3bf9ebb27a9da7b9ae56c25e5dd9c43caef6ccd4ee7615ca87d8dd2c4e9230d9", "bytes": 1744 }, "rendered.html": { "sha256": "c5b3888525e8b9b45851bbfb4113e5570e1d95618271aaa0e31a9a90d5e41d49", "bytes": 354811 }, "screenshot.jpg": { "sha256": "80970b46fbcbef6561fc9b3fa5f7e8b3a7b897180cff883c6790c4d350b433d2", "bytes": 380870 }, "text.txt": { "sha256": "823b6258aff1919cf186d59298248a87a39e5fff07ba0a612f82b929afc3398b", "bytes": 5998 } }, "started_utc": "2026-10-23T16:13:01.369Z", "status": 200, "final_url": "https://www.btc-echo.de/news/krypto-boersen-akut-bedroht-kritische-php-luecke-239718/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). BTC-ECHO (German), 22 October: a critical PHP flaw puts crypto-infrastructure operators on alert after the emergency patches for CVE-2026-109618 and C...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Akute Warnung: PHP-Schwachstelle gefährdet Krypto-Dienste\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/btc-echo/news-krypto-boersen-akut-bedroht-kritische-php-luecke-239718`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBTC-ECHO (German), 22 October: a critical PHP flaw puts crypto-infrastructure operators on alert after the emergency patches for CVE-2026-109618 and CVE-2026-109619, rated 9.2. It says that so far there is no evidence that large crypto exchanges or payment providers were compromised through PHP2Shell, and that many established exchanges isolate their web servers or use newer languages.\n\n> liegen bislang allerdings keine Nachweise dafür vor, dass große Krypto-Handelsplattformen oder Zahlungsdienstleister durch PHP2Shell kompromittiert wurden\n\n_Curator's translation:_ \"there is so far no evidence that large crypto trading platforms or payment providers have been compromised through PHP2Shell\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Akute Warnung: PHP-Schwachstelle gefährdet Krypto-Dienste\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "bursadabugun-haber-php-nedir-php2shell-guvenlik-acigi", "url": "https://www.bursadabugun.com/haber/php-nedir-php2shell-guvenlik-acigi-ne-anlama-geliyor-1958356.html", "publisher": "Bursada Bugün", "kind": "news", "title": "[object Object]", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "698c87dca3995e343baf7fa6b6bed84295f4dfc5aab4a93756012d06dbaf81ea", "bytes": 923 }, "page.html": { "sha256": "47baefd10b77a0242c7fcbc252911468ad6099b6d40d1393432b576e6d0c2c57", "bytes": 65282 }, "provenance.json": { "sha256": "aabca441b13cf7c5a465e69c1ca1f6b37ca58bbee433d269da10ce9f709b918c", "bytes": 1743 }, "rendered.html": { "sha256": "fa088ce88148ce62d73fab8cf54c0e9041ffe4e723ee004388c433d9169bde12", "bytes": 114948 }, "screenshot.jpg": { "sha256": "7f5a6bc419cc255ed27bc2a333b1ad65e04a2ed38c9150cf6561754f8cbbbc1e", "bytes": 967814 }, "text.txt": { "sha256": "3edab98a39d927f9952e0de3b21bd1e55475fd673858003e9449e48626e15946", "bytes": 15392 } }, "started_utc": "2026-10-23T16:25:21.912Z", "status": 200, "final_url": "https://www.bursadabugun.com/haber/php-nedir-php2shell-guvenlik-acigi-ne-anlama-geliyor-1958356.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bursada Bugun (Turkish), 22 October: what PHP is and what PHP2Shell means. It says the Presidency's Cybersecurity Directorate announced that national-...", "raw_sha256": {}, "has_notes": true, "notes_md": "# [object Object]\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/bursadabugun/haber-php-nedir-php2shell-guvenlik-acigi-ne-anlama-geliyor-1`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBursada Bugun (Turkish), 22 October: what PHP is and what PHP2Shell means. It says the Presidency's Cybersecurity Directorate announced that national-scale security scans had started against the flaws and, in a security notice of 21 October 2026, described two PHP flaws that can under certain conditions be used remotely. The page's title came through the capture as the placeholder '[object Object]'; the headline is in the text.\n\n> Cumhurbaşkanlığı Siber Güvenlik Başkanlığı, 21 Ekim 2026 tarihli güvenlik bildiriminde PHP altyapısındaki iki zafiyetin belirli koşullarda uzaktan\n\n_Curator's translation:_ \"The Presidency's Cybersecurity Directorate, in its security notice dated 21 October 2026, said two vulnerabilities in the PHP infrastructure can under certain conditions be used remotely\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"[object Object]\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "bursahakimiyet-teknoloji-php-deki-kritik-guvenlik-acigi-alar", "url": "https://www.bursahakimiyet.com.tr/teknoloji/php-deki-kritik-guvenlik-acigi-alarmi-dunya-genelinde-cok-sayida-site-erisime-kapatildi-1734665", "publisher": "Bursa Hakimiyet", "kind": "news", "title": "PHP’deki kritik güvenlik açığı alarmı! Dünya genelinde çok sayıda site erişime kapatıldı - Bursa Hakimiyet", "published": null, "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "ee7c2ff55056fdd5205bf22839c6a4098141ab77bd076586a41dbec94a2c9e3c", "bytes": 1277 }, "page.html": { "sha256": "b22e098c612d6edf368f9e35c9526317bcc77a9fa8bf6e4eaf97c00948734cf5", "bytes": 145833 }, "provenance.json": { "sha256": "d15e81672ea2ad1fe040471edb81e47ccbac2188eabd5caed2f38ba4a72a8c78", "bytes": 1935 }, "rendered.html": { "sha256": "e1ec6baba97ee252baf342aa63560981ae22c58f9904352e9cdbdd50d4cd1a39", "bytes": 207604 }, "screenshot.jpg": { "sha256": "685610fa48aa5a89720ed16794fe8c20e973f4defd0758e712e8a7e5b7e65a85", "bytes": 710490 }, "text.txt": { "sha256": "123ba1f9630dac63b317075915e88355e1da3a67680aae5df46d9db571a4ed32", "bytes": 9715 } }, "started_utc": "2026-10-22T18:28:40.696Z", "status": 200, "final_url": "https://www.bursahakimiyet.com.tr/teknoloji/php-deki-kritik-guvenlik-acigi-alarmi-dunya-genelinde-cok-sayida-site-erisime-kapatildi-1734665" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in tr: Bursa Hakimiyet compiles international reactions. The FBI advised taking sites offline; Japan's health ministry suspended a long-term-care information site (Kyodo); Denmark's agency urged updates; and Norway's NSM warned", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP’deki kritik güvenlik açığı alarmı! Dünya genelinde çok sayıda site erişime kapatıldı - Bursa Hakimiyet\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `tr/news/bursahakimiyet/teknoloji-php-deki-kritik-guvenlik-acigi-alarmi-dunya-geneli`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: Bursa Hakimiyet. Language: tr. URL: https://www.bursahakimiyet.com.tr/teknoloji/php-deki-kritik-guvenlik-acigi-alarmi-dunya-genelinde-cok-sayida-site-erisime-kapatildi-1734665\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nBursa Hakimiyet compiles international reactions. The FBI advised taking sites offline; Japan's health ministry suspended a long-term-care information site (Kyodo); Denmark's agency urged updates; and Norway's NSM warned, with NRK, the Digitalisation Directorate and Feide reported down. Dutch PM Rob Jetten announced that DigiD and MijnOverheid were closed.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/tr/news/bursahakimiyet/teknoloji-php-deki-kritik-guvenlik-acigi-alarmi-dunya-geneli.json`), not the publisher's and not checked word for word by the curator.\n\n**agency**: The FBI's cyber unit warned of the flaws and advised those unable to update to take sites offline temporarily.\n\n> FBI, sistemlerini hemen güncelleyemeyen kurum, kuruluş ve kişilere internet sitelerini geçici olarak çevrim dışı bırakmaları tavsiyesinde bulundu.\n\n_Watch reader's translation:_ The FBI advised institutions, organisations and individuals unable to update their systems immediately to take their websites offline temporarily.\n\n**offline**: Japan's Ministry of Health, Labour and Welfare suspended the website of an information-sharing system with long-term care providers' contact details (Kyodo).\n\n> Japonya Sağlık, Çalışma ve Refah Bakanlığı, uzun süreli bakım hizmeti sağlayıcılarının iletişim bilgilerinin bulunduğu bilgi paylaşım sistemine ait internet sitesini önlem amacıyla geçici olarak askıya aldı.\n\n_Watch reader's translation:_ Japan's Ministry of Health, Labour and Welfare temporarily suspended, as a precaution, the website of the information-sharing system containing contact details of long-term care providers.\n\n**offline**: Norwegian media reported that NRK, the Norwegian Digitalisation Directorate and the Feide education login platform were out of service.\n\n> Norveç medyasında yer alan haberlerde, NRK, Norveç Dijitalleşme Müdürlüğü ve eğitim ile araştırma alanında güvenli giriş ve veri paylaşımı için kullanılan Feide gibi platformların devre dışı kaldığı aktarıldı.\n\n_Watch reader's translation:_ Reports in Norwegian media said platforms such as NRK, the Norwegian Digitalisation Directorate and Feide, used for secure login and data sharing in education and research, were out of service.\n\n**agency**: Denmark's Agency for Cyber Security and Resilience urged admins to update and to take systems offline if they cannot.\n\n> Danimarka Siber Güvenlik ve Dayanıklılık Kurumu, sistem yöneticilerine yazılımlarını mümkün olan en kısa sürede güncellemeleri çağrısı yaptı. Güncelleme yapılamayan sistemlerin ise geçici olarak kapatılması önerildi.\n\n_Watch reader's translation:_ Denmark's Agency for Cyber Security and Resilience called on system administrators to update their software as soon as possible. It recommended that systems that cannot be updated be temporarily shut down.\n\n**official**: Dutch PM Rob Jetten said DigiD and MijnOverheid were temporarily closed.\n\n> Hollanda Başbakanı Rob Jetten, vatandaşların kamu hizmetlerine ulaşmak için kullandığı DigiD ve MijnOverheid platformlarının geçici olarak erişime kapatıldığını açıkladı.\n\n_Watch reader's translation:_ Dutch Prime Minister Rob Jetten announced that the DigiD and MijnOverheid platforms, which citizens use to access public services, had been temporarily closed.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in tr: Bursa Hakimiyet compiles international reactions. The FBI advised taking sites offline; Japan's health ministry suspended a long-term-care information site (Kyodo); Denmark's agency urged updates; and Norway's NSM warned\n\nSupports: translations/tr/news/bursahakimiyet/teknoloji-php-deki-kritik-guvenlik-acigi-alarmi-dunya-geneli.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "cairo24-2516354", "url": "https://www.cairo24.com/2516354", "publisher": "القاهرة 24", "kind": "news", "title": "الذكاء الاصطناعي يكشف ثغرة خطيرة في PHP تهدد ملايين المواقع على الإنترنت", "published": "2026-10-22T17:15:51Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f3d765797c5b6c0f4da708195842472d8da1fe6ad1dcfa0cb42d1e71c8364afc", "bytes": 1032 }, "page.html": { "sha256": "3d715c61fd4250387e2008a6b79852dfa4d3166258f6b7b807750921940af7c5", "bytes": 95292 }, "provenance.json": { "sha256": "99cfd00ac82f0287c6f5f7a2cd361714753ada8cb8515e048e458db94b5efbc3", "bytes": 1565 }, "rendered.html": { "sha256": "f2e3353df52d219d26a9f8a7420849aa96fddc3fb63e8cc6b6c4e3e0c79d7e40", "bytes": 386981 }, "screenshot.jpg": { "sha256": "2ad6853557ce9cfe8c7e6dece44ca133b0d44db5375c6f511348f6234db6b1cb", "bytes": 378266 }, "text.txt": { "sha256": "4e5ce91906555051fcf2bf5b78b64b4d4341ba8476421daed2d27851d358e980", "bytes": 6692 } }, "started_utc": "2026-10-23T16:13:54.836Z", "status": 200, "final_url": "https://www.cairo24.com/2516354" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar-eg", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cairo 24 (Arabic, Egypt), 22 October: AI reveals a serious PHP flaw threatening millions of sites. It relays the BBC: PHP runs about 70% of the world'...", "raw_sha256": {}, "has_notes": true, "notes_md": "# الذكاء الاصطناعي يكشف ثغرة خطيرة في PHP تهدد ملايين المواقع على الإنترنت\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/cairo24/2516354`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCairo 24 (Arabic, Egypt), 22 October: AI reveals a serious PHP flaw threatening millions of sites. It relays the BBC: PHP runs about 70% of the world's sites and is maintained by the non-profit PHP Foundation; Wiz and Calif named the flaws php2shell and said they lie in the language itself and cover versions released over the past decade.\n\n> تشغّل PHP نحو 70% من مواقع العالم\n\n_Curator's translation:_ \"PHP runs about 70% of the world's sites\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Cairo24 summarises the BBC story: AI found two decade-old PHP flaws, with Wikimedia, the Finnish government, Edinburgh council, the BBC and the Dutch cyber agency taking sites down. It quotes experts Paul Spain, Jill Slay and Salil Kanhere.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"الذكاء الاصطناعي يكشف ثغرة خطيرة في PHP تهدد ملايين المواقع على الإنترنت\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar-eg`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "calif-php2shell", "url": "https://calif.io/php2shell/", "publisher": "Calif (Calif Research)", "kind": "researcher", "title": "php2shell by Calif Research — A tale of two PHP remote vulnerabilities", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081033Z", "files": { "headers.json": { "sha256": "1fc0b2864079499b5911e31166e216c1c753a83da9a65d38086609e84372794e", "bytes": 759 }, "page.html": { "sha256": "9f3df4d68b9d185563f9b5eec4b1e910f296389f54e02b4f6a25fef2573662a3", "bytes": 68302 }, "provenance.json": { "sha256": "c800836bfdf2759a20495415eb65bff17d26b8d9127d0695f7be27870b1dc67b", "bytes": 906 }, "rendered.html": { "sha256": "24e345e4514f5240f94df7537536a5ed14ba6e440cffffae74f8c38c7c8e5644", "bytes": 68280 }, "screenshot.png": { "sha256": "38990c6ce9af5828a86614d9dff808d621097986d5288e8136bda70412b3ac63", "bytes": 20097747 }, "text.txt": { "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "bytes": 23876 } }, "started_utc": "2026-10-22T08:10:33.263Z", "status": 200, "final_url": "https://calif.io/php2shell/" }, { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "4a8ab067dd4e49688e657fdfd0c51aec0e51a8a6aebf16f0dd8bcf9b6e2d0dc1", "bytes": 738 }, "page.html": { "sha256": "2b77deb5169ba2a3872ea2045454735893bcc915a4f2f4eb2132ec415b62f7cb", "bytes": 69595 }, "provenance.json": { "sha256": "a3e7faae2faf08834fc17c711b74edc2c6b6ef4983321a0e8fdbc7f161e5a095", "bytes": 1438 }, "text.txt": { "sha256": "effb0fa357b68ea97d847a69a42809262dd6c84accfe18cfc4113ec58e5c849b", "bytes": 23899 } }, "started_utc": "2026-10-24T13:59:39.413Z", "status": 200, "final_url": "https://calif.io/php2shell/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Calif's own write-up by Ryan Austin (@lcfr_hax). Page has no machine timestamp; story panel dated 'Oct 21, 2026'. Embeds two YouTube exploit demo videos (pfWZrdzvooc 'php2shell exploit demonstration', cE4h79AWbT4 'Exploiting Nginx with PHP-FPM'); videos NOT downloaded. Its timeline omits the leaked/deleted video.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Calif: \"php2shell by Calif Research\" — notes (collector-researchers)\n\n- URL: https://calif.io/php2shell/ (linked from the calif.io homepage banner \"Calif discovered php2shell\"). Captured 2026-10-22T08:10:33Z, HTTP 200.\n- Date: no machine-readable publish time; the comic timeline's last panel reads \"Oct 21, 2026 and here we are...\". Credits: \"Research and writeup by Ryan Austin (@lcfr_hax) of Calif ... Poster and comic story by Michal Zalewski (@lcamtuf) of Calif.\"\n- Framing: \"two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) discovered by Calif, OpenAI and Wiz\".\n\n## Calif's timeline (verbatim from \"An interesting timeline of events\")\n- \"2026 — August 1 Calif discovered multiple different paths independently leading to RCE that resurfaced the 2024 issues and new trigger points.\"\n- \"2026 — August 5 Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.\" (links https://x.com/lcfr_hax/status/2085031675382071483)\n- \"2026 — August 11 Calif reported the first bug to PHP and started coordinated disclosure process.\"\n- \"2026 — August 14 Calif shared an RCE PoC with PHP.\"\n- \"2026 — August 15 PHP confirmed that the RCE PoC worked as expected.\"\n- \"2026 — August 21 Calif reported the second bug to PHP.\"\n- \"2026 — October 21 Patched versions released.\"\n- Comic panel 4: \"July 30, 2026 Patch the Planet ... OpenAI invited us to join its Patch the Planet initiative ... Stefan connected us with Volker Dusch, who accepted our invitation.\"\n- 2024 panel: \"OSTIF and Quarkslab performed an audit of PHP and rediscovered the same OOM issue. However, exploitation was not proven, hence the bug was not fixed.\"\n\n## AI angle\n- \"No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery.\" Austin: \"I asked my LLM companion for help.\" Model is NOT named on this page (press says GPT-5.6 Sol).\n- \"We were not expecting to find anything critical - everyone and every lab had already done extensive AI assisted audits of this target.\"\n\n## Exploit demos (not downloaded)\n- Page embeds \"Here is a demo video of the exploits running:\" YouTube iframes: youtube-nocookie.com/embed/pfWZrdzvooc (\"php2shell exploit demonstration\") and /embed/cE4h79AWbT4 (\"Exploiting Nginx with PHP-FPM\"). Claims confirmed pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony, WHMCS.\n- Whether pfWZrdzvooc is the same video the PHP Foundation says Calif \"mistakenly published\" on Oct 20 is UNKNOWN. The page does not mention the leak or the deleted video at all.\n\n## Contradictions\n- Calif: discovery Aug 1; first report Aug 11. Fortune repeats Aug 1. PHP Foundation: Calif's audit began July 30, report Aug 11 (agrees).\n- Calif homepage also links two archive.is snapshots (arHsF, spwCf), probably of WSJ/NYT coverage — not checked.\n" }, { "slug": "canaltech-seguranca-falhas-no-php-chegam-ao-brasil-e-fazem-a", "url": "https://canaltech.com.br/seguranca/falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tribunais-suspenderem-sistemas/", "publisher": "Canaltech", "kind": "news", "title": "Falhas no PHP chegam ao Brasil e fazem Anatel e tribunais suspenderem sistemas - Canaltech", "published": "2026-10-21T15:48:39.000-03:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "368957ca4ad660d4b59134fb78844bc19e9a466fb04d090e559ba419cc17b29d", "bytes": 623 }, "page.html": { "sha256": "2d85fe534c28b399f20a6f9953c176ee1ea036a0dbae60b62b0a9a9fec1cc26f", "bytes": 103764 }, "provenance.json": { "sha256": "e044551b114d050bbeb624642a1b11e328fe9aecb95bffd46ed7dc93f3558b52", "bytes": 1845 }, "rendered.html": { "sha256": "3a2788a5c93a734f8d4a540d043eaa4c3c4f07c3b21170ddae43f8b8a8c271cf", "bytes": 424150 }, "screenshot.jpg": { "sha256": "99e5531aeb8dddfbf3fbc93d4fa3605d074a31ed132ab4e9476ceb77618f0edb", "bytes": 493674 }, "text.txt": { "sha256": "974a10fda0668457316ff8ce01e2236748efd7a86c13dbd9a585ed0cea380e77", "bytes": 5982 } }, "started_utc": "2026-10-22T18:18:31.331Z", "status": 200, "final_url": "https://canaltech.com.br/seguranca/falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tribunais-suspenderem-sistemas/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in pt: Canaltech reports that the PHP flaws reached Brazil. Anatel took its SEI electronic-process system offline, federal courts TRF1, TRF4 (Justiça Federal da 4ª Região) and TRF6 suspended external access or deadlines, and th", "raw_sha256": {}, "has_notes": true, "notes_md": "# Falhas no PHP chegam ao Brasil e fazem Anatel e tribunais suspenderem sistemas - Canaltech\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `br/news/canaltech/seguranca-falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tr`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: Canaltech. Language: pt. URL: https://canaltech.com.br/seguranca/falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tribunais-suspenderem-sistemas/\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nCanaltech reports that the PHP flaws reached Brazil. Anatel took its SEI electronic-process system offline, federal courts TRF1, TRF4 (Justiça Federal da 4ª Região) and TRF6 suspended external access or deadlines, and the federal CTIR Gov issued an official alert.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/br/news/canaltech/seguranca-falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tr.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: Anatel, Brazil's telecoms regulator, confirmed to Canaltech that it took its SEI (electronic information system) offline because of the PHP vulnerabilities.\n\n> A Agência Nacional de Telecomunicações (Anatel) confirmou ao Canaltech que retirou temporariamente do ar seu Sistema Eletrônico de Informações (SEI) por causa das vulnerabilidades.\n\n_Watch reader's translation:_ The National Telecommunications Agency (Anatel) confirmed to Canaltech that it temporarily took its Electronic Information System (SEI) offline because of the vulnerabilities.\n\n**official**: Anatel stated the outage is not an SEI flaw but is due to the PHP vulnerability, and warned that Moodle and Joomla systems could also be affected.\n\n> \"O caso não se trata de uma falha ou vulnerabilidade inerente ao SEI. A indisponibilidade temporária do serviço está relacionada a uma vulnerabilidade recente identificada no próprio PHP\", explicou a agência.\n\n_Watch reader's translation:_ \"The case is not a flaw or vulnerability inherent to SEI. The temporary unavailability of the service is related to a recent vulnerability identified in PHP itself,\" the agency explained.\n\n**offline**: Federal court TRF1 suspended external access to SEI, following a recommendation from TRF4; no restoration time given.\n\n> O Tribunal Regional Federal da 1ª Região (TRF1) confirmou que suspendeu temporariamente o acesso externo ao SEI em razão das vulnerabilidades do PHP.\n\n_Watch reader's translation:_ The Federal Regional Court of the 1st Region (TRF1) confirmed it temporarily suspended external access to SEI because of the PHP vulnerabilities.\n\n**offline**: The federal courts of the 4th Region (Rio Grande do Sul, Santa Catarina, Paraná) cut external access to their systems from 11:00 on Wednesday.\n\n> Já a Justiça Federal da 4ª Região, que atende Rio Grande do Sul, Santa Catarina e Paraná, anunciou a interrupção temporária do acesso externo aos seus sistemas a partir das 11h desta quarta-feira.\n\n_Watch reader's translation:_ The Federal Justice of the 4th Region, which serves Rio Grande do Sul, Santa Catarina and Paraná, announced a temporary interruption of external access to its systems from 11am this Wednesday.\n\n**offline**: TRF6 in Minas Gerais suspended court business and procedural deadlines across the state's federal courts (eproc, SEI, Moodle, portal and intranet affected), per O Fator.\n\n> Em Minas Gerais, o TRF6 foi além e suspendeu o expediente e os prazos processuais em toda a Justiça Federal do estado, segundo reportagem do portal O Fator.\n\n_Watch reader's translation:_ In Minas Gerais, TRF6 went further and suspended working hours and procedural deadlines across the entire Federal Justice of the state, according to a report by the portal O Fator.\n\n**agency**: Brazil's CTIR Gov (Presidency's Institutional Security Cabinet) issued an official alert recommending immediate patching and, if impossible, suspending external access.\n\n> O Centro de Prevenção, Tratamento e Resposta a Incidentes Cibernéticos de Governo (CTIR Gov), ligado ao Gabinete de Segurança Institucional da Presidência, também publicou um alerta oficial nesta quarta-feira (21).\n\n_Watch reader's translation:_ The Government Cyber Incident Prevention, Handling and Response Centre (CTIR Gov), linked to the Presidency's Institutional Security Cabinet, also published an official alert this Wednesday (21st).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 6 new items in pt: Canaltech reports that the PHP flaws reached Brazil. Anatel took its SEI electronic-process system offline, federal courts TRF1, TRF4 (Justiça Federal da 4ª Região) and TRF6 suspended external access or deadlines, and th\n\nSupports: translations/br/news/canaltech/seguranca-falhas-no-php-chegam-ao-brasil-e-fazem-anatel-e-tr.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "cccs-al26-026", "url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "publisher": "Canadian Centre for Cyber Security (CCCS)", "kind": "advisory", "title": "AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "0db6dd151e1887553a32a56de4d1f6a133645e87d6dbee931f362e8a21a370f3", "bytes": 583 }, "page.html": { "sha256": "171c897e4a6fde98e73f9d1e221188dae6d0c04b49e8b6a242fba591739a11c9", "bytes": 39250 }, "provenance.json": { "sha256": "9759aec757d5df865a795a86bf304ffdcc697988c45f47adcc0159a6771a4fa1", "bytes": 1195 }, "rendered.html": { "sha256": "d6536d39602e9709a1afb05fb61fad1b88b57a5d1b839a7f5de58c7f3588300c", "bytes": 149258 }, "screenshot.png": { "sha256": "9df75da37b7ed8ceb13b241f71f041d29c9f33055750a65070c6c785bbe9cdd2", "bytes": 538343 }, "text.txt": { "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "bytes": 5403 } }, "started_utc": "2026-10-22T08:17:00.039Z", "status": 200, "final_url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Date: October 21, 2026; Date modified 2026-10-21. 'Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.' PoC available; no active exploitation identified. Also AV26-1070 (PHP security advisory), same date.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CCCS AL26-026\n\n- \"Date: October 21, 2026\"; \"Date modified: 2026-10-21\". Captured 2026-10-22T08:17:00Z. The alerts listing (`cccs-alerts`) also shows AV26-1070 \"PHP security advisory\", 2026-10-21. (The listing table labels AL26-026 as \"AV26-026\", a typo on the page.)\n- Verbatim: \"Organizations should identify affected systems and apply the appropriate updates immediately.\" / \"Update affected PHP installations immediately to a fixed, supported release.\" / \"Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.\"\n- Note: the CCCS sentence \"Where immediate remediation is not feasible, organisations should consider ...\" matches the opening of the sentence the BBC attributes to the UK NCSC. The wording is shared across Five Eyes and CERT-EU text (CERT-EU: \"Where that is not feasible, organisations should consider isolating...\"). \n- Exploitation: \"a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.\"\n" }, { "slug": "cccs-alerts", "url": "https://www.cyber.gc.ca/en/alerts-advisories", "publisher": "CCCS", "kind": "government", "title": "Alerts and advisories - Canadian Centre for Cyber Security", "published": null, "captures": [ { "stamp": "20261022T081604Z", "files": { "headers.json": { "sha256": "43f213e29f0be568c8c4a231d0404fc7c33db33ea4b6d75c538f505a2a139b88", "bytes": 586 }, "page.html": { "sha256": "b7e604271809b8579356f2e76d4be26c44d1aa9a92893b73efa23358036ba52e", "bytes": 21909500 }, "provenance.json": { "sha256": "bcff9a25cb070bd8554c2d407548464544b8792a9046b93a670f29e70dc5c6ad", "bytes": 1026 }, "rendered.html": { "sha256": "b15a0c243be41ff42e41fd4f94617f75373bce255f915cc57cded297c97ef6a4", "bytes": 50788748 }, "screenshot.png": { "sha256": "9029e12095ac74977c8777919e317ffd20cc42da26e60903f1964abddab3774d", "bytes": 494360 }, "text.txt": { "sha256": "c226b8df2f21a14934c6c79d53fae9685707e4adcca0fcf2d7b6143e296b2000", "bytes": 3812 } }, "started_utc": "2026-10-22T08:16:04.829Z", "status": 200, "final_url": "https://www.cyber.gc.ca/en/alerts-advisories" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Listing page at 08:16Z: AL26-026 and AV26-1070 (PHP), both 2026-10-21.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CCCS alerts listing\n\nCaptured 08:16Z. It lists AL26-026 (Alert) and AV26-1070 (PHP security advisory), both dated 2026-10-21. The page is very large (about 21 MB).\n" }, { "slug": "ccn-cert-al-11-26", "url": "https://www.ccn-cert.cni.es/es/seguridad-al-dia/alertas-ccn-cert/13200-ccn-cert-al-11-26-actualizacion-inmediata-de-vulnerabilidad-critica-en-php.html", "publisher": "CCN-CERT (Spain)", "kind": "advisory", "title": "CCN-CERT AL 11/26: Actualización inmediata de vulnerabilidad crítica en PHP", "published": null, "captures": [ { "stamp": "20261022T081353Z", "files": { "provenance.json": { "sha256": "3499d3985dcda97902ce1e89dd5edffba4a20b56ba01cab266db1e9fc7f50c36", "bytes": 780 } }, "started_utc": "2026-10-22T08:13:53.323Z", "status": 403, "final_url": "https://www.ccn-cert.cni.es/es/seguridad-al-dia/alertas-ccn-cert/13200-ccn-cert-al-11-26-actualizacion-inmediata-de-vulnerabilidad-critica-en-php.html", "error": "page.title: Execution context was destroyed, most likely because of a navigation" } ], "status": "blocked", "primary": true, "added_by": "collector-gov", "notes": "HTTP 403 bot challenge ('Voight-Kampff Browser Test') to both Playwright and curl; WebFetch also got 403. The URL and title come from ENISA CNW-2026-04. The challenge body is saved in raw/.", "raw_sha256": { "curl-body.20261022T0814Z.html": "a3de1982de0d6d2967b7ac55d2787011ba4fdd8707f4a8e9e25e1b50b345d9f7", "curl-headers.20261022T0814Z.txt": "a397cde2f98a7851bb54672621f25f4834926a0250ea5140f65c91110b53d3f8" }, "has_notes": true, "notes_md": "# CCN-CERT AL 11/26 (blocked)\n\nThe URL comes from the ENISA CNW-2026-04 list. At 08:13-08:14Z, Playwright and curl both got HTTP 403 with a \"Voight-Kampff Browser Test\" bot challenge page (saved in raw/ with SHA256SUMS), and WebFetch got 403 too. The title in the slug (\"actualizacion inmediata de vulnerabilidad critica en php\") points to \"immediate update\" advice, but we have NOT read the content. Another agent with different egress should retry.\n" }, { "slug": "ceomagazine-ko-kr-articles-35216", "url": "https://www.ceomagazine.co.kr/ko-kr/articles/35216", "publisher": "CEONEWS", "kind": "news", "title": "[핫이슈] PHP 취약점에 전 세계 비상…한국 정부·기업도 긴급 대응", "published": "2026-10-22T11:22:00+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c779eb54fe59848876b5b790632ea484d4267b0af8488774083ad9979103cf70", "bytes": 1385 }, "page.html": { "sha256": "e31478992a4049cc40eefb315965619fcf898a73d5137999d9eb869ca8ca1f8f", "bytes": 188060 }, "provenance.json": { "sha256": "b86df8f701e328106223bb30e30d39f7714d80c167732064faa86dba7568ca1e", "bytes": 1462 }, "text.txt": { "sha256": "6728c9b31ace994541c817a8bde30579b95ed84a8cd4a5e3d6c4aee4ac5fcdf3", "bytes": 19547 } }, "started_utc": "2026-10-23T16:21:04.635Z", "status": 200, "final_url": "https://www.ceomagazine.co.kr/ko-kr/articles/35216" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko-KR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CEONEWS (Korean), 22 October: worldwide emergency over the PHP flaws, with Korean government and companies responding urgently. It names the two CVEs,...", "raw_sha256": {}, "has_notes": true, "notes_md": "# [핫이슈] PHP 취약점에 전 세계 비상…한국 정부·기업도 긴급 대응\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/ceomagazine/ko-kr-articles-35216`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCEONEWS (Korean), 22 October: worldwide emergency over the PHP flaws, with Korean government and companies responding urgently. It names the two CVEs, both CVSS v4.0 9.2, and says KISA issued a PHP security update advisory on 21 October, while the Ministry of Science and ICT and KISA notified C-TAS member companies and companies subject to CISO reporting duties.\n\n> 한국인터넷진흥원(KISA)은 10월 21일 PHP 보안 업데이트 권고를 발표했다.\n\n_Curator's translation:_ \"The Korea Internet and Security Agency (KISA) announced a PHP security update advisory on 21 October.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ CEO News (Korea): KISA issued a PHP update advisory on 21 Oct. MSIT and KISA notified about 5,900 C-TAS members and about 30,000 CISO-obligated firms. Presidential AI Future Planning Secretary Lee Hae-min said agencies are responding, and MSIT is reviewing SME patch support. DC Inside blocked uploads, the Dutch football association went offline, and Everspin and Theori deployed protections.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"[핫이슈] PHP 취약점에 전 세계 비상…한국 정부·기업도 긴급 대응\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko-KR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "certeu-sa-2026-018", "url": "https://cert.europa.eu/publications/security-advisories/2026-018/", "publisher": "CERT-EU", "kind": "advisory", "title": "Security Advisory 2026-018: Critical Vulnerabilities in PHP", "published": "2026-10-21 15:20:18 (as stated; timezone not given)", "captures": [ { "stamp": "20261022T081329Z", "files": { "headers.json": { "sha256": "035d980d7924b86c61cd912c5ae8e55b5adbdf20e9f99f9c780d7b37e830e596", "bytes": 1370 }, "page.html": { "sha256": "1cc49d8c9b94ac2e09eb5f4e2bcb732a0d1fd4f630eaedad06da28a295978e53", "bytes": 24504 }, "provenance.json": { "sha256": "d5c1ea12a493fd9c195d90ee56eba85c93cd77d6131bce3ac08929d72f275820", "bytes": 999 }, "rendered.html": { "sha256": "abb92e1078d68ea54089f704855e78b2a71cee27a6244c2d3f26cd1b8c90b759", "bytes": 23744 }, "screenshot.png": { "sha256": "894baac8f7c1a2e25439f481a468e1c086cf4c783d11e7f020bb354120ef6c99", "bytes": 624274 }, "text.txt": { "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "bytes": 7105 } }, "started_utc": "2026-10-22T08:13:29.027Z", "status": 200, "final_url": "https://cert.europa.eu/publications/security-advisories/2026-018/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "v1.0 and v1.1 both 21/10/2026. States the PHP fixes were released '21 October 2026 at 13:30 UTC'. CVSS 9.2 each. Advice: 'patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.' Notes PoCs are circulating.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP\n\n- Stated \"Release Date: 21-10-2026 15:20:18\" (no timezone; CERT-EU is in Brussels, so probably CEST = 13:20Z, but that is not stated). History: v1.0 \"Initial publication\" and v1.1 \"Updates with additional information\", both 21/10/2026.\n- Captured 2026-10-22T08:13:29Z.\n- Key claims (verbatim):\n - \"On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP\"\n - \"The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35\"\n - \"Technical details are now being discussed publicly, and initial proofs of concept (PoCs) have begun to circulate. This raises the likelihood that attackers are already exploiting the vulnerabilities.\"\n - CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), CVSS 9.2, OOM memory corruption; CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), CVSS 9.2, stale global state.\n - \"The PHP team considers mod_php the highest-risk setup.\"\n- Exact advice: \"CERT-EU advises organisations to patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.\" Repeated under Recommendations as \"isolating internet-facing resources from public networks\".\n- Temporary mitigations: memory_limit=-1 set via php_admin_value; low post_max_size; proxy-level request limits; cgroup memory limit (not RLIMIT_AS); session.upload_progress.enabled=0 and restart workers; on 8.5 fatal_error_backtraces=0.\n- Notes \"rpms.remirepo.net ... will not have updates on release day\".\n- Its references include a Mastodon post by @GossiTheDog (cyberplace.social/@GossiTheDog/117474220875882526) and an X post by watchTowr (x.com/watchtowrcyber/status/2112611507749982605) as \"public reports\". Those are for the social/researcher collectors.\n- Differs from CERT-FR on the release time: CERT-FR quotes PHP's pre-announcement of 16:00 Paris (14:00 UTC); CERT-EU says released 13:30 UTC.\n" }, { "slug": "certfr-2026-ale-014", "url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/", "publisher": "CERT-FR (ANSSI)", "kind": "advisory", "title": "[Màj] Multiples vulnérabilités dans PHP (CERTFR-2026-ALE-014)", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081353Z", "files": { "headers.json": { "sha256": "96a5cd42d4ca38099fc910e8c06f10cfd15f15e6ca7bebdb699b3b7245d08d58", "bytes": 1075 }, "page.html": { "sha256": "91f474e2f0f414b2d8575b91cecd59d880e62f0179033baae665177100fc094a", "bytes": 26782 }, "provenance.json": { "sha256": "53ea7bfd63a634427908cc6846e7e974b45c9cdc7028b88d7e87d148408ecd59", "bytes": 989 }, "rendered.html": { "sha256": "f71933fcd112f86a98d8838cc53fa38dabffe5f27a6c4dc7bfc62f9ef6e9aa7c", "bytes": 27674 }, "screenshot.png": { "sha256": "e6ccac8825818ecc2cfd2223035c6c335a3de1c38fad734d7dd292215618cef7", "bytes": 502064 }, "text.txt": { "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "bytes": 5127 } }, "started_utc": "2026-10-22T08:13:53.978Z", "status": 200, "final_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "First and last version 21 Oct 2026. 'Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue...'. Affected: all 5.x, 6.x, 7.x, 8.0, 8.1, and 8.2-8.5 below the fixed versions. Workarounds: session.upload_progress off; block multipart Content-Type at WAF.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CERT-FR alert CERTFR-2026-ALE-014: [Màj] Multiples vulnérabilités dans PHP\n\n- New domain: cert.cyber.gouv.fr (the old www.cert.ssi.gouv.fr redirects with a 302).\n- \"Date de la première version 21 octobre 2026\"; \"Date de la dernière version 21 octobre 2026\". Two versions: the initial one, then \"Mises à jour des risques, des systèmes affectés et ajout des correctifs de sécurité\".\n- Captured 2026-10-22T08:13:53Z.\n- Key lines (verbatim, French):\n - \"L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC).\" (This is PHP's pre-announced time; CERT-EU says the fixes came out at 13:30 UTC.)\n - Advice: \"Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue et avec les derniers correctifs de sécurité dès publication du correctif éditeur.\" In English: CERT-FR recommends isolating affected equipment, then migrating to a maintained, patched version once the vendor fix is out.\n - Workarounds \"non qualifiés par le CERT-FR\": session.upload_progress.enabled = Off (plus php_admin_flag for FPM); \"bloquer toutes requêtes HTTP dont l'en-tête contient un Content-Type positionné à la valeur multipart\", or failing that, monitor such requests; can be done at a WAF.\n- Affected: \"PHP toutes versions 5.x, 6.x, 7.x, 8.0.x, 8.1.x\" plus 8.2 to 8.5 below the fixed versions.\n- Also references CERTFR-2026-AVI-1359 and the reflex sheet CERTFR-2025-RFX-002 (edge-device compromise containment).\n- Of all the agencies, CERT-FR's advice is the closest to \"isolate first\": isolate, THEN migrate.\n" }, { "slug": "certlv-php-preventive", "url": "https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus", "publisher": "CERT.LV (Latvia)", "kind": "government", "title": "Saistībā ar globāli atklātām PHP ievainojamībām Latvijā ievieš preventīvus pasākumus", "published": "2026-10-21T18:25 local (EEST, =15:25Z); updated 2026-10-21T23:00 local (=20:00Z)", "captures": [ { "stamp": "20261022T081354Z", "files": { "headers.json": { "sha256": "b75279eb611beef16c83a6ab4d307db8ec59d18614d4d21ea1c78320a4346166", "bytes": 737 }, "page.html": { "sha256": "de622b5e59bf43071dcb45655edbd42b337e97f28b3e41e801ebaacc64a33581", "bytes": 35634 }, "provenance.json": { "sha256": "e046187fdaa6dc172317abf6fa62152e1b5594b3c2d59c75c1de1baafa4667ba", "bytes": 1158 }, "rendered.html": { "sha256": "4f3a30ed3f755cd5965265ba1cc6f1cce9e514537463c1f9d2b87fdfceaaf514", "bytes": 35482 }, "screenshot.png": { "sha256": "504fd0c9b36378f8039c94b1157842426c17d95ab822429554c1bfc0cdbfb4d2", "bytes": 750435 }, "text.txt": { "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "bytes": 6579 } }, "started_utc": "2026-10-22T08:13:54.539Z", "status": 200, "final_url": "https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Latvia restricted access from abroad to several state digital resources (geo-blocking, possibly until Mon 26 Oct). Update 23:00: the TVP unified website platform is patched and reachable from Latvia; latvija.gov.lv is restricted only from abroad; lsm.lv and 112.lv restored. About 6000 potentially affected resources in Latvia, a few hundred of them public sector. Automated exploitation attempts seen, none successful so far.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CERT.LV: Latvia introduces preventive measures over the PHP vulnerabilities\n\n- Page date 2026-10-21. \"[Informācija publicēta 21.10.2026, plkst. 18:25]\" = published 18:25 local (EEST, UTC+3), so 15:25Z. \"[Informācija papildināta: 21.10.2026, plkst. 23:00]\" = updated 23:00 local, so 20:00Z. The UTC conversion is ours.\n- Captured 2026-10-22T08:13:54Z. The text is Latvian; the translations below are ours, so check them before publishing.\n- Original post (18:25): to protect state information systems, \"pieņemts lēmums uz laiku ierobežot piekļuvi vairākiem valsts digitālajiem resursiem no ārvalstīm\". A decision was made to temporarily restrict access to several state digital resources FROM ABROAD. Applied selectively. \"Piekļuves ierobežojumi varētu būt spēkā līdz pirmdienai, 26. oktobrim\". The restrictions may last until Monday 26 October. Residents in Latvia should not be affected. No known compromise in Latvia.\n- Advice: update to 8.5.12/8.4.27/8.3.36/8.2.35. \"Sistēmām, kuras nav iespējams atjaunināt uz drošu PHP versiju, ir jāierobežo piekļuve no interneta, nepieļaujot to publisku pieejamību līdz drošības risku novēršanai.\" Systems that cannot be updated MUST have internet access restricted, with no public availability until the risk is removed.\n- Update (23:00): the unified website platform (TVP) for state and municipal sites is patched and reachable again from Latvia. Latvija.gov.lv is reachable from Latvia and restricted only from abroad. lsm.lv (public broadcaster) and 112.lv have been restored. Other state resources keep their foreign-access restrictions. \"Kopumā Latvijā identificēti aptuveni 6000 potenciāli ietekmētu resursu, no kuriem tikai daži simti ir valsts sektorā.\" Around 6,000 potentially affected resources in Latvia, a few hundred of them in the state sector. \"Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības, taču līdz šim nav ziņu par sekmīgiem uzbrukumiem.\" Automated exploitation attempts have been seen in Latvia; no successful attacks reported so far.\n- This is a concrete case of government services being taken off the public internet: geo-blocked, not fully down. lsm.lv and 112.lv were evidently restricted too (they were \"restored\").\n" }, { "slug": "ch-bacs-warnung-php", "url": "https://www.bacs.admin.ch/en/warnung-php-en", "publisher": "Swiss Federal Office for Cyber Security (BACS / NCSC)", "kind": "advisory", "title": "Critical vulnerabilities in PHP: Install security updates immediately", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "603765d5dfe2bc360d0d8becb67c71a6a5810ad02fbe68f5d677488189ac7317", "bytes": 6406 }, "page.html": { "sha256": "bdef753f8a5972cd0d5af92574637f8edd425df0511ef469bf2c11ee39207e0f", "bytes": 160186 }, "provenance.json": { "sha256": "1574e8470bf5e04e0a830d2ee1ffd4d728872599f3828cba3399f0b095066f39", "bytes": 984 }, "rendered.html": { "sha256": "7400fa0917a78b8192f819815d7bddbc76a93e9ddb57e9ce574cb60b713b4e0b", "bytes": 174883 }, "screenshot.png": { "sha256": "b14b81a2939d7eafc4abdd581e6591629c66d8728ce4402a2c68421d788a9f63", "bytes": 846454 }, "text.txt": { "sha256": "99886a19aead8abe4faab9f41918c8654a2e070c816f856c0dd3e14a194d6890", "bytes": 4966 } }, "started_utc": "2026-10-22T08:17:00.344Z", "status": 200, "final_url": "https://www.bacs.admin.ch/en/warnung-php-en" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Published on 21 October 2026 (the home page teaser shows 20 October 2026). 'If an immediate update is not possible': restrict access; 'Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.' Says a WAF alone is not sufficient.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Swiss BACS (NCSC) warning\n\n- ncsc.admin.ch now redirects to bacs.admin.ch. The page says \"Published on 21 October 2026\", but the home-page teaser (`ch-ncsc-home`) is dated \"20 October 2026\", so the page was probably first posted on the 20th (pre-announcement) and rewritten after the patch. Captured 2026-10-22T08:17:00Z.\n- Verbatim: \"Install updates immediately\"; \"After the update, restart the affected PHP services ... Containers may need to be rebuilt\"; \"If an immediate update is not possible: Where possible, restrict access to the affected applications to only those people and systems that actually require it. Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.\"; \"Even a web application firewall alone is not sufficient.\" (This contrasts with CISA: \"A web application firewall may provide some protection\".)\n" }, { "slug": "ch-ncsc-home", "url": "https://www.ncsc.admin.ch/ncsc/en/home.html", "publisher": "Swiss BACS", "kind": "government", "title": "BACS home", "published": null, "captures": [ { "stamp": "20261022T081604Z", "files": { "headers.json": { "sha256": "80c563292cf0e8178e58809441cc65504b120a6299d27979fc429c606efaa3fd", "bytes": 6406 }, "page.html": { "sha256": "db63fa0b832d6e1c47503189a9e2dd40e5a0dc6e8aab560cae02e8db1f3806f4", "bytes": 683600 }, "provenance.json": { "sha256": "a459bb8ebb915fac015c2f06c8c45177516e9c968f132531f1d20fa7053e7c69", "bytes": 923 }, "rendered.html": { "sha256": "772da1668f48bd3c5a4f64e05a57da3b25759fb0029663257cdb7ffef85aec1f", "bytes": 739577 }, "screenshot.png": { "sha256": "0aaffb075e051c6b2ad0f9f8261010a963e502b32700d1fc07b0cdee4d9a835e", "bytes": 1095138 }, "text.txt": { "sha256": "29c1b2cfeb73db9702347d8cbb1b37690641e3abf5ddda16da0af6451f54e41b", "bytes": 11068 } }, "started_utc": "2026-10-22T08:16:04.981Z", "status": 200, "final_url": "https://www.bacs.admin.ch/en" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Redirects to bacs.admin.ch/en; the PHP teaser is dated 20 October 2026.", "raw_sha256": {}, "has_notes": true, "notes_md": "# BACS home\n\nncsc.admin.ch redirects to https://www.bacs.admin.ch/en. Captured 08:16Z. The PHP warning teaser is dated \"20 October 2026\".\n" }, { "slug": "ch-unige-down", "url": "https://www.unige.ch/", "publisher": "unige.ch", "kind": "government", "title": "Error 503", "published": null, "captures": [ { "stamp": "20261022T081939Z", "files": { "headers.json": { "sha256": "45d418c6a1e13df367e5e13dfedc3c3513a91092939f89a4eb322a8f42577c36", "bytes": 156 }, "page.html": { "sha256": "4588df31ba75c0a04c05e175d37f8cc5a25d23d6db540d28a36f66fec14254f9", "bytes": 19901 }, "provenance.json": { "sha256": "a570e18cd6797853524a4a28bb0f07494febd3045de07a5606b05023a7db03ec", "bytes": 874 }, "rendered.html": { "sha256": "3454bd4fa582794fc00a7bbbb8c4221bb4538f45a3a4bbeeca936dbc7d14ff23", "bytes": 19945 }, "screenshot.png": { "sha256": "74550933cbe68c3937fb109ad47c67a313c15e0a8a3be3d823cb57aebabb0158", "bytes": 41360 }, "text.txt": { "sha256": "103ffaac2e23754954ddd1bdaa2cc5d9afa05b829ba0fe1ccd4e5c701d982a6c", "bytes": 241 } }, "started_utc": "2026-10-22T08:19:39.659Z", "status": 503, "final_url": "https://www.unige.ch/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP 503, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "channelnewsasia-singapore-php-vulnerabilities-csa-singapore-firms-cybersecur", "url": "https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-singapore-firms-cybersecurity-6482006", "publisher": "CNA (Channel NewsAsia)", "kind": "news", "title": "Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat - CNA", "published": "2026-10-22T17:33 SGT (updated 17:44)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "8b9eb34defa1f7a92ae70f04ef00893f67f20c9c5ac0847ad36cba684751eb53", "bytes": 1010 }, "page.html": { "sha256": "47fe437151a88fb830ab716004bbc274b814571cfda942882c6eff62523e649b", "bytes": 514707 }, "provenance.json": { "sha256": "7b953ae928263f33c60d82149f349775c26ad55588e351467a8be9af338f98ce", "bytes": 1860 }, "rendered.html": { "sha256": "7257b6432a920652edf3485bffc58c39923a1cd8c23dc9053d4e2acf7a4a89d4", "bytes": 1027313 }, "screenshot.jpg": { "sha256": "4663c4fc897f033817bb0c5d9f267ef54a8db7f664e29411a13f13625d069bb8", "bytes": 453850 }, "text.txt": { "sha256": "099af28ae4a894d5bbbb7d057c8ae2a5ed96744cf3f55cae8539d03725bbf8c8", "bytes": 6109 } }, "started_utc": "2026-10-23T08:24:35.310Z", "status": 200, "final_url": "https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-singapore-firms-cybersecurity-6482006" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "0bb7ad8ef4cbac6b1cdfa833cdf94b852e6d4c3fcfab446c1df16630b23b3104", "bytes": 1011 }, "page.html": { "sha256": "3126534b4e5d0523314fc3e36ae96b36e2b0928ebd5cc4fcbbfbec3e181ca990", "bytes": 514574 }, "provenance.json": { "sha256": "cefab6ab48b8757dc4417242bf77b9f96de5e9ac581830f1338b90510c9fda1d", "bytes": 2009 }, "rendered.html": { "sha256": "fb6bcac9a4d987a74695588fa4ee5ae0481236402f60f556d170a2aa12b62099", "bytes": 1001298 }, "screenshot.jpg": { "sha256": "7063cfc73094d945916a6694a526b552f8b35dd6b3a7467a7fe65766375bb828", "bytes": 426765 }, "text.txt": { "sha256": "3193ae7b5ea47e45be15b3b6c0b6fefdb430a385e00ee042fab553b4c72034e7", "bytes": 5853 } }, "started_utc": "2026-10-23T16:24:46.174Z", "status": 200, "final_url": "https://www.channelnewsasia.com/singapore/php-vulnerabilities-csa-singapore-firms-cybersecurity-6482006" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Singapore organisations were urged to fix the two flaws immediately amid reports of widespread exploitation attempts; Singapore's Commissioner of Cybersecurity...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Singapore organisations urged to patch critical PHP flaws immediately amid cyberattack threat - CNA\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `sg/news/channelnewsasia/singapore-php-vulnerabilities-csa-singapore-firms-cybersecur`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSingapore organisations were urged to fix the two flaws immediately amid reports of widespread exploitation attempts; Singapore's Commissioner of Cybersecurity spoke on Thursday. The capture ends at the lede, so the rest of the advice is not in the text.\n\n> The two vulnerabilities could allow attackers to take control of affected web servers without login credentials, potentially exposing data and disrupting services.\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "channelpartner-article-4238964-php-sicherheitslucke-err", "url": "https://www.channelpartner.de/article/4238964/php-sicherheitslucke-erreicht-den-it-channel.html", "publisher": "ChannelPartner", "kind": "news", "title": "PHP-Sicherheitslücke erreicht den IT-Channel | ChannelPartner", "published": "October 22, 2026", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9dc2ba9ae924a4d4fd24350615b83a7026861880f6225aa2222b6bc3936fe496", "bytes": 1365 }, "page.html": { "sha256": "3a8329cd009bbcb389fe7360a6596d9c7ebcac9e6ac0c27729c3ab0960919366", "bytes": 233286 }, "provenance.json": { "sha256": "cde296d379918edb7475755086e1f8aaa8faba7d4b79830d507ce4e76ff718dd", "bytes": 1786 }, "rendered.html": { "sha256": "108097c0ba35a08e94e2d1ccfb578e8d1f02ff63b7cba2d5db8db9e38007e81e", "bytes": 361664 }, "screenshot.jpg": { "sha256": "74915907ac8a5159b3d9a6e1f1076ae8314ce3c533079a9d8f356fbf1a620abf", "bytes": 428542 }, "text.txt": { "sha256": "a5594d29ad3282b351a3cc2d5f751a5fce27fdc53da947f4c8d00c2055becc91", "bytes": 6205 } }, "started_utc": "2026-10-23T16:13:03.626Z", "status": 200, "final_url": "https://www.channelpartner.de/article/4238964/php-sicherheitslucke-erreicht-den-it-channel.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de-DE", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ChannelPartner (German), 22 October: the PHP flaw reaches the IT channel. Under the name PHP2Shell, security experts warn of two critical vulnerabilit...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Sicherheitslücke erreicht den IT-Channel | ChannelPartner\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/channelpartner/article-4238964-php-sicherheitslucke-erreicht-den-it-channel`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nChannelPartner (German), 22 October: the PHP flaw reaches the IT channel. Under the name PHP2Shell, security experts warn of two critical vulnerabilities in the core of the language; the danger potential is said to be extremely high.\n\n> Unter dem Namen “PHP2Shell” warnen Sicherheitsexperten vor gleich zwei kritischen Schwachstellen im Kern der Programmiersprache.\n\n_Curator's translation:_ \"Under the name 'PHP2Shell', security experts warn of two critical vulnerabilities in the core of the programming language.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ ChannelPartner reports how the German IT channel reacted: distributor Siewert & Kau took its shop and self-service portal offline, Munich's MVV online ticketing was unavailable, Thuringia's state chancellery, authorities and state police sites were offline, and Easybill briefly switched off its app. It also mentions the Dutch football association KNVB being offline and quotes a Bitkom warning.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Sicherheitslücke erreicht den IT-Channel | ChannelPartner\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de-DE`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "chinaz-ainews-31789-shtml", "url": "https://www.chinaz.com/ainews/31789.shtml", "publisher": "站长之家", "kind": "news", "title": "PHP 爆出\"PHP2Shell\"高危漏洞：影响约七成网站，OpenAI 牵头全球协防", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2b5b46986c092b5c567af8b518c8c878037ea689cf707d0ada9bc7bb50b6c7ad", "bytes": 498 }, "page.html": { "sha256": "e8bf6c95ad29c4e4ad01fd162ef0b5bd07e0e65e284d9768361d880d06e53f0a", "bytes": 110032 }, "provenance.json": { "sha256": "d5f4df92fadbfbd706371b1d0529af17ea0e10363838fa0260272d2fc3eb0060", "bytes": 1572 }, "rendered.html": { "sha256": "e1e82d58b5362dfb11c4149a49b3716f5158942298e52b87c3326a464de74108", "bytes": 150005 }, "screenshot.jpg": { "sha256": "77af3fdeaab31eb407f70dfcb6b61de514a25a319da67367b7c3a47d0b178d62", "bytes": 333038 }, "text.txt": { "sha256": "a0e6e63a1fa7ba44995721cf3b357235a3d037ae44aef02b2560b827aa828122", "bytes": 8310 } }, "started_utc": "2026-10-23T16:16:09.566Z", "status": 200, "final_url": "https://www.chinaz.com/ainews/31789.shtml" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Chinaz (Chinese): the headline says PHP has a high-risk 'PHP2Shell' flaw affecting about 70% of websites, with OpenAI leading a global joint defence....", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP 爆出\"PHP2Shell\"高危漏洞：影响约七成网站，OpenAI 牵头全球协防\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/chinaz/ainews-31789-shtml`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nChinaz (Chinese): the headline says PHP has a high-risk 'PHP2Shell' flaw affecting about 70% of websites, with OpenAI leading a global joint defence. It says the two flaws, CVE-2026-109618 and 109619, are CVSS v4.0 9.2; the security firm Calif used OpenAI's GPT-5.6 Sol model to find one key flaw while Google's Wiz reported independently; PHP's maintainers led verification, fixing and release, and OpenAI, Wiz and Cloudflare gave research, technical support and cross-organisation coordination.\n\n> 安全公司 Calif 借 OpenAI 的 GPT-5.6 Sol 模型发现其中一项关键缺陷，谷歌旗下 Wiz 则独立上报\n\n_Curator's translation:_ \"The security firm Calif used OpenAI's GPT-5.6 Sol model to find one of the key flaws, while Google's Wiz reported independently\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Chinaz summary of OpenAI's announcement: Calif found one flaw with GPT-5.6 Sol and Wiz reported independently, with two months of coordination. It also mentions OpenAI's version-checker tool and a USD 1 billion 'Daybreak for Frontline Defenders' fund.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP 爆出\"PHP2Shell\"高危漏洞：影响约七成网站，OpenAI 牵头全球协防\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "chip-news-wifi-dsl-internet-bsi-schlaegt-alar", "url": "https://www.chip.de/news/wifi-dsl-internet/bsi-schlaegt-alarm-zwei-php-luecken-bedrohen-millionen-webseiten-betreiber-muessen-handeln_a4293cda-dd0c-4ca9-afe9-fcf6e993b0a2.html", "publisher": "CHIP", "kind": "news", "title": "BSI schlägt Alarm: Zwei PHP-Lücken bedrohen Millionen Webseiten - Betreiber müssen handeln - CHIP", "published": "2026-10-22T09:32:00+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "5dd9d20e326692efc63992f35c5cb573233443d32d18d87deba91a388e01c613", "bytes": 774 }, "page.html": { "sha256": "3ca5fdb3f7bc84c4ee1c8ad57534216a4e9249827459694116407f84d51eb29b", "bytes": 156127 }, "provenance.json": { "sha256": "99f41a265d26dc2ae2348b10e8b622f7c8f79cf1044757f08e799af0221c87bb", "bytes": 1804 }, "text.txt": { "sha256": "fd2adaf6b44e5ea680447d54969c0315116f536363157d9786cb77ad792782ac", "bytes": 5558 } }, "started_utc": "2026-10-23T16:13:04.181Z", "status": 200, "final_url": "https://www.chip.de/news/wifi-dsl-internet/bsi-schlaegt-alarm-zwei-php-luecken-bedrohen-millionen-webseiten-betreiber-muessen-handeln_a4293cda-dd0c-4ca9-afe9-fcf6e993b0a2.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CHIP (German), 22 October: the BSI (Germany's federal cyber-security office) sounds the alarm over two PHP flaws that threaten millions of websites; o...", "raw_sha256": {}, "has_notes": true, "notes_md": "# BSI schlägt Alarm: Zwei PHP-Lücken bedrohen Millionen Webseiten - Betreiber müssen handeln - CHIP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/chip/news-wifi-dsl-internet-bsi-schlaegt-alarm-zwei-php-luecken-b`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCHIP (German), 22 October: the BSI (Germany's federal cyber-security office) sounds the alarm over two PHP flaws that threaten millions of websites; operators must act. CVSS 4.0 rates both 9.2, which suggests attackers could run malicious code remotely on web servers with PHP applications, and the flaws could probably be exploited automatically at scale. It gives short technical descriptions: CVE-2026-109618, an out-of-memory memory error that can leave internal request data incompletely initialised so later clean-up processes faulty data and allows code execution.\n\n> Die Schwachstellen namens „PHP2Shell“ dürften sich in großem Stil automatisiert ausnutzen lassen.\n\n_Curator's translation:_ \"The vulnerabilities named 'PHP2Shell' are likely to be exploitable on a large scale in an automated way.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ CHIP reports the BSI warning on the two PHP flaws, explains the bugs and recommends immediate updates or temporary disconnection. It says the BSI had no confirmation of active exploitation and that the City of Munich, Charité and several universities and state authorities switched off sites and services.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"BSI schlägt Alarm: Zwei PHP-Lücken bedrohen Millionen Webseiten - Betreiber müssen handeln - CHIP\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ciol-iot-india-php2shell-attacks-ai-driven-cy", "url": "https://www.ciol.com/iot/india-php2shell-attacks-ai-driven-cybersecurity-12750268", "publisher": "CIOL", "kind": "news", "title": "India Records 14% PHP2Shell Impact Rate, Above Global Average", "published": "2026-10-25 21:01 IST", "captures": [ { "stamp": "20261026T121439Z", "files": { "headers.json": { "sha256": "28ce001bbdea624e596db059a4d78c3def644c003939f2c24c44eb897474edf2", "bytes": 1581 }, "page.html": { "sha256": "45d082d5a199f1ba185ca642e7fc4f74d5fc49b4e8bd988a5e8a2f5cd8bd9eec", "bytes": 205996 }, "provenance.json": { "sha256": "802be790d42925c8e6684dfb32a6f758344155188462ef3073432dc2903f9468", "bytes": 1725 }, "rendered.html": { "sha256": "20520a7250bc6ae2af7e4194ea86e92fd88de7df63c413e92f5793efdd70f3a8", "bytes": 309708 }, "screenshot.jpg": { "sha256": "15a061fa1fd2a6e14bc3643842c2f85f061c993fb4c7bdac69319924291bd610", "bytes": 527198 }, "text.txt": { "sha256": "fd817de13849dba708ee4ab92033f28cf20ceee1c6bcab6d4a5129a509bac3e9", "bytes": 12818 } }, "started_utc": "2026-10-26T12:27:35.382Z", "status": 200, "final_url": "https://www.ciol.com/iot/india-php2shell-attacks-ai-driven-cybersecurity-12750268" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T121439Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CIOL (India, English), 25 October, by Deepali Jain: India recorded a 14% PHP2Shell impact rate against a global average of 10%. It cites Check Point R...", "raw_sha256": {}, "has_notes": true, "notes_md": "# India Records 14% PHP2Shell Impact Rate, Above Global Average\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `in/news/ciol/iot-india-php2shell-attacks-ai-driven-cybersecurity-12750268`, snapshot `20261026T121439Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T121439Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCIOL (India, English), 25 October, by Deepali Jain: India recorded a 14% PHP2Shell impact rate against a global average of 10%. It cites Check Point Research ranking India 11th among 18 countries with the highest reported impact rates after disclosure, and repeats Check Point's regional and sector figures (Europe 14%; Asia-Pacific, North America and Latin America 6% each; telecommunications 20%, education 18%). Check Point compares the incident with Log4Shell, says details leaked before the planned disclosure and that screenshots of an attack tool have begun circulating. Datadog's regional vice-president says flaws unnoticed for years are now being found with AI, attackers have the same tools and vulnerabilities are often exploited within a day; the article closes with patching advice.\n\n> India recorded a 14% PHP2Shell impact rate, above the global average of 10%.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"India Records 14% PHP2Shell Impact Rate, Above Global Average\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cisa-alert-log4j-2021", "url": "https://www.cisa.gov/news-events/alerts/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce-vulnerability-under-exploitation", "publisher": "CISA", "kind": "government", "title": "Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation | CISA", "published": "2021-12-10", "captures": [ { "stamp": "20261022T113354Z", "files": { "headers.json": { "sha256": "81c7dcf0ae8dbb9db7007301569c1098a3ef6556dd79a9630d630651daa84547", "bytes": 2869 }, "page.html": { "sha256": "96fb8cf20f99673da75e17b169ced8e990ef1852c39832a988ce04901089dd93", "bytes": 52975 }, "provenance.json": { "sha256": "3f51e4f7a62ee09109ff3dc36fcb8369a5ad5cc50b151b08368a863938e9bf91", "bytes": 1209 }, "rendered.html": { "sha256": "5badb6aa92a2948ebfdb3e6213117ffa468b50a21ae447dd975d608df7786007", "bytes": 76046 }, "screenshot.png": { "sha256": "181a9b4f1fb059019f1f42b3d6d7ec914a53307ae7276e8d10637cdd93807b1c", "bytes": 311343 }, "text.txt": { "sha256": "98840739d797dd49ca9582640f9a88007c32812ba8e49d2cc0492e54c138c9e5", "bytes": 2015 } }, "started_utc": "2026-10-22T11:33:54.579Z", "status": 200, "final_url": "https://www.cisa.gov/news-events/alerts/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce-vulnerability-under-exploitation" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical: CISA's alert on Log4j the day it was published.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation | CISA\n\nCaptured by claude-story-site. Status: captured. Historical: CISA's alert on Log4j the day it was published.\n\n- Comparator for the context page.\n" }, { "slug": "cisa-alert-php-20261021", "url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "publisher": "US Cybersecurity and Infrastructure Security Agency (CISA)", "kind": "advisory", "title": "Critical Vulnerabilities in PHP Require Immediate Patching", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081353Z", "files": { "headers.json": { "sha256": "30fb6764c792111ac226e0fb1ca4f574f5e2faadfc10d2150ae9dfa35ea0858d", "bytes": 2825 }, "page.html": { "sha256": "be6b410fc0da16de2c1b96dc3132a195632d636467ab7c859c343494fa7accfa", "bytes": 53868 }, "provenance.json": { "sha256": "ea18f4dbc502d3c87b5d9a6c83d49ff128544ad074140c502f37abff350d9f8a", "bytes": 1110 }, "rendered.html": { "sha256": "0e3e08492a52d48e8ccb18f836df984af4f15f251f6089697676b540458b3371", "bytes": 78116 }, "screenshot.png": { "sha256": "2724e9107ccae45a888b3531fdc43373b154be3eeadb78841791dcb6a60a34c1", "bytes": 384239 }, "text.txt": { "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "bytes": 3223 } }, "started_utc": "2026-10-22T08:13:53.254Z", "status": 200, "final_url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "CISA Alert, Release Date October 21, 2026. Names CVE-2026-109618/109619 'php2shell'. 'Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.' CISA 'has not observed exploitation ... as of the time of publication'. Not in KEV as of catalog 2026.10.21.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching\n\n- URL: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching. \"Release Date October 21, 2026\" (no time given).\n- Captured 2026-10-22T08:13:53Z with Playwright. Plain curl to www.cisa.gov returns 403 (Akamai), but the headless browser gets 200. The CISA home page (`cisa-home`) lists it at the top as \"OCT 21, 2026 ALERT\".\n- Exact advice, verbatim:\n - \"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.\"\n - \"Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35\"\n - \"Identify and inventory systems running any version of PHP across your organization.\"\n - \"Apply the patch immediately, prioritizing internet-facing systems.\"\n - \"Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.\"\n - \"A web application firewall may provide some protection until systems are updated or patched.\"\n - \"Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.\"\n- Exploitation: \"While CISA has not observed exploitation of these vulnerabilities as of the time of publication\".\n- The CISA offline advice is the most absolute (\"should take ... offline\"), and it explicitly covers EOL 8.1 and older. No emergency directive found (see `cisa-kev-json`).\n" }, { "slug": "cisa-ed-22-02-log4j", "url": "https://www.cisa.gov/news-events/directives/ed-22-02-mitigate-apache-log4j-vulnerability", "publisher": "CISA", "kind": "government", "title": "Page Not Found | CISA", "published": "2021-12-17", "captures": [ { "stamp": "20261022T113402Z", "files": { "headers.json": { "sha256": "1b3806dec260fe8e3a777ba86f9ee746b6edd19e249375bf255f7a5d9697921a", "bytes": 2712 }, "page.html": { "sha256": "601f61af5acf4d62056f2376b007d492c9f77dbc84557f9ea9f9f4a7834691da", "bytes": 47323 }, "provenance.json": { "sha256": "bdfcae4f97b12f4551a9070ae19917243e91048c4e13feb7fb06f939368c8d1c", "bytes": 1026 }, "rendered.html": { "sha256": "4e45e69f1aa1a5d929a2896dce31b78f23be1bbfd88195b6030c0e1a5b7761e5", "bytes": 66546 }, "screenshot.png": { "sha256": "d0899ef76fbd637495baf797c91303c02eaf04c8f12bdfafa20265b9052fe302", "bytes": 186488 }, "text.txt": { "sha256": "74b20e7dc5b8d12bb09978a2b9ab15941b343248ce65584eb76548fd8b68b0d2", "bytes": 1035 } }, "started_utc": "2026-10-22T11:34:02.805Z", "status": 404, "final_url": "https://www.cisa.gov/news-events/directives/ed-22-02-mitigate-apache-log4j-vulnerability" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical: Emergency Directive 22-02 on Log4j.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Page Not Found | CISA\n\nCaptured by claude-story-site. Status: captured. Historical: Emergency Directive 22-02 on Log4j.\n\n- Comparator: an emergency directive, which php2shell has not had.\n" }, { "slug": "cisa-home", "url": "https://www.cisa.gov/", "publisher": "CISA", "kind": "government", "title": "Home Page | CISA", "published": null, "captures": [ { "stamp": "20261022T081329Z", "files": { "headers.json": { "sha256": "a76ca34b24fba67b623a4b3e4b5748241af7aac12f07bb31b73a1f88445398b2", "bytes": 2712 }, "page.html": { "sha256": "24ba8c3fe3e00e4445bd9fbbbabf113099d53e872bb4d594e92c8575084cfe31", "bytes": 71972 }, "provenance.json": { "sha256": "364cc06b578cd41d9fc3e1155cd62c9694ca854bdfe27923863a3a00eb71ee53", "bytes": 877 }, "rendered.html": { "sha256": "06fa4013f8e36ab399d6cef932f7d506a073b84357e4e4c40627479b5a3a1fa5", "bytes": 92635 }, "screenshot.png": { "sha256": "ed352cf8665d21d75d282faefdb680a9c65965edae9b6cbf4541c84f9dcbba23", "bytes": 1291590 }, "text.txt": { "sha256": "ab2aa07bb46ba14c14a2f76a312ff7b81e2c8c19ca3588de9313236b10007a34", "bytes": 4261 } }, "started_utc": "2026-10-22T08:13:29.093Z", "status": 200, "final_url": "https://www.cisa.gov/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Home page at 08:13Z: the PHP alert (Oct 21, 2026) is top of the news list. No emergency directive is shown.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CISA home page\n\nCaptured at 08:13Z to show placement. The top news item is \"Critical Vulnerabilities in PHP Require Immediate Patching\", ALERT, OCT 21, 2026. Next is AA26-293A #StopRansomware: SafePay (Oct 20). No PHP emergency directive is visible.\n" }, { "slug": "cisa-kev-catalog", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "publisher": "CISA", "kind": "government", "title": "Known Exploited Vulnerabilities Catalog (JSON feed)", "published": "2026-10-21T14:04:39Z", "captures": [], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "raw/ only (JSON feed). catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39Z. Neither CVE-2026-109618 nor CVE-2026-109619 is listed as of fetch ~08:12Z on 22 Oct.", "raw_sha256": { "known_exploited_vulnerabilities.json": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b" }, "has_notes": true, "notes_md": "# CISA KEV catalog snapshot: notes\n- Fetched ~2026-10-22T08:12Z. catalogVersion \"2026.10.21\", dateReleased \"2026-10-21T14:04:39.8983Z\".\n- Neither CVE-2026-109618 nor CVE-2026-109619 appears. This is a negative finding as of that time. KEV listing would need evidence of exploitation; CISA's own ADP SSVC on 21 Oct 14:34Z said Exploitation \"none\".\n- Re-check later; this file is a point-in-time snapshot only.\n" }, { "slug": "cisa-kev-json", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "publisher": "CISA", "kind": "advisory", "title": "CISA Known Exploited Vulnerabilities catalog (JSON feed)", "published": "2026-10-21T14:04:39Z (catalogVersion 2026.10.21)", "captures": [], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "At 08:15Z on 22 Oct: catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39.8983Z, 1754 entries. CVE-2026-109618/109619 NOT in KEV. Raw JSON + headers + SHA256SUMS in raw/.", "raw_sha256": { "headers.20261022T0816Z.txt": "e3a7dc7610f87ca2b7829303cd01ef65a3d0d08be833334024807456cc943db9", "known_exploited_vulnerabilities.20261022T0816Z.json": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b" }, "has_notes": true, "notes_md": "# CISA KEV catalog (JSON)\n\n- Fetched with curl about 08:15Z on 22 Oct 2026 and saved in raw/ (headers, JSON, SHA256SUMS).\n- `catalogVersion` 2026.10.21, `dateReleased` 2026-10-21T14:04:39.8983Z, `count` 1754; last-modified Wed, 21 Oct 2026 14:04:39 GMT.\n- **Neither CVE-2026-109618 nor CVE-2026-109619 is in the catalog.** That fits CISA alert text \"has not observed exploitation\". The latest additions are dated 2026-10-20 (Plex, SiteGuard, Siemens).\n- Older PHP entries in the catalog: CVE-2024-4577, CVE-2019-11043, CVE-2012-1823.\n- No CISA emergency directive for PHP was found (the home page lists none). Re-check KEV later today.\n" }, { "slug": "cisco-sa-php-october26", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq", "publisher": "Cisco", "kind": "vendor", "title": "Vulnerabilities in PHP Affecting Cisco Products: October 2026", "published": null, "captures": [ { "stamp": "20261022T191727Z", "files": { "headers.json": { "sha256": "9284c87155511b2c471216e2096bb1e32f5357928e3cd57fc8d43df4a07370bb", "bytes": 2545 }, "page.html": { "sha256": "d5ac143be2171987bc719cac0f05a076fabe7a2d7943168014ff0d7ee05000d4", "bytes": 228863 }, "provenance.json": { "sha256": "5723badb3711c11909083e6771ff8d1b43cf871797a07e8ba2b3784f6c0e2dbd", "bytes": 1694 }, "rendered.html": { "sha256": "1cd58949d6a33eb4802ef0dbff15bd15ce7471bccfba710d79c9c5b9fca98b50", "bytes": 886276 }, "screenshot.jpg": { "sha256": "817ee2282f96dd868da4716cb46c821f57699aded67586674bbaf16363355b97", "bytes": 396794 }, "text.txt": { "sha256": "a8149d16b8912fdf12a0d16895c2c484226ca5744e048033c39c1f8d8d1e9cdb", "bytes": 7868 } }, "started_utc": "2026-10-22T19:17:28.032Z", "status": 200, "final_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq" } ], "status": "captured", "primary": true, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191727Z. Cisco investigation and product status (primary)", "raw_sha256": {}, "has_notes": true, "notes_md": "# Vulnerabilities in PHP Affecting Cisco Products: October 2026\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/security-vendor/cisco/sa-php-october26`, snapshot `20261022T191727Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191727Z/provenance.json`. Publisher: Cisco. Language: en. URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCisco security advisory cisco-sa-php-october26-Jj384Daq, \"Vulnerabilities in PHP Affecting Cisco Products: October 2026\" (version 1.2, interim, 2026-OCT-22). It references the PHP Foundation's release of 21 October and GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. Cisco is investigating; products under active investigation include Catalyst Center, Ultra Cloud Core - Converged Policy and Charging, Ultra-Reliable Wireless Backhaul, Unified Industrial Wireless Software, AppDynamics On-Premises Secure Application, Security Cloud Control and Vulnerability Management. Currently no products are known to be affected; AI Defense (hybrid on-prem), Ultra Cloud Core PCF and Subscriber Microservices Infrastructure are confirmed not affected. No workarounds. \"The Cisco PSIRT is not aware of any malicious use of the vulnerabilities.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Cisco investigation and product status (primary)\n\nSupports: cyber desk: appliances\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "clarin-us-news-php-security-vulnerabilities-how-ai-uncovered-massiv", "url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html", "publisher": "Clarin (English edition)", "kind": "news", "title": "PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet", "published": "2026-10-22T13:38", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "cd6b6aca27fd9b5ce029c92362dcfac6916560f42aa088e5feb9460625f7e32c", "bytes": 1002 }, "page.html": { "sha256": "b6e1695896fd63cd4b6f47aacb38c4e055346265c4aa327c9966eeaea8d4f9ea", "bytes": 310116 }, "provenance.json": { "sha256": "104cea664352abd14c008254d3d2eb0966a9edaaa0d656deda3fdea6c301b9a6", "bytes": 1846 }, "rendered.html": { "sha256": "42fab97cc7a7b08095ba8b783499fd89abc555bf82a764902d03235d313801f1", "bytes": 322974 }, "text.txt": { "sha256": "c11dd717273bac9546aaf433f103637af20d579a0fb1ba06943929d81a70e82d", "bytes": 11484 } }, "started_utc": "2026-10-23T08:12:07.876Z", "status": 200, "final_url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "1ed2c706aa0cf8e540f252ccb062a8c22ac0c29bc27cabbe51567449b510361d", "bytes": 1004 }, "page.html": { "sha256": "fb183bc9518a6532811c98a4a5e5fea0df058fd92b4cdfed88bbb7712ccf7ef3", "bytes": 310116 }, "provenance.json": { "sha256": "17c4c74191d706a3f7a113c99cb4c3f6ed8e99ac8a6276af6f81bd55351b7a4a", "bytes": 2073 }, "rendered.html": { "sha256": "9e45a8a7d379a8d9bea687b64466511b0845402a297bbc0959b59f44f8407e27", "bytes": 322371 }, "screenshot.jpg": { "sha256": "4ab9356d8a1fa03b9cbb4e08ffdd9bc7c7b5e42538fecc08a226fe67e6ad57f3", "bytes": 930810 }, "text.txt": { "sha256": "1afdd74e14120ea72e68bb67d88654c35a42cb69f4700c4015260d0f61ea2c1c", "bytes": 11512 } }, "started_utc": "2026-10-23T16:11:44.691Z", "status": 200, "final_url": "https://www.clarin.com/us-news/php-security-vulnerabilities-how-ai-uncovered-massive-14-year-old-flaw-threatening-70-of-the-internet_0_BPPGgn8KC7.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). An explainer: says GPT-5.6 Sol and Gemini 4 Argon uncovered the two flaws, calls it a 14-year-old flaw behind 70% of the internet, and describes government port...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP security vulnerabilities: How AI uncovered a massive 14-year-old flaw threatening 70% of the internet\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `ca/news/clarin/us-news-php-security-vulnerabilities-how-ai-uncovered-massiv`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAn explainer: says GPT-5.6 Sol and Gemini 4 Argon uncovered the two flaws, calls it a 14-year-old flaw behind 70% of the internet, and describes government portals in Europe going offline. Its framing is the outlet's own and is more sweeping than the primary sources.\n\n> the first internet-scale software crisis uncovered, verified, and mitigated through advanced artificial intelligence\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "clickx-fr-actualites-200877-des-failles-php-critiques-menace", "url": "https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/", "publisher": "www.clickx.be", "kind": "news", "title": "Des failles PHP critiques menacent les sites web du monde entier : DPG Media et les pouvoirs publics mettent leurs sites hors ligne | Clickx", "published": "2026-10-21T12:31:18+00:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "6b45cddbbf163b39958bc4b5094d18b3ce21d4e63996f705a5226ba95e34e3af", "bytes": 1189 }, "page.html": { "sha256": "0951c9c98dafd8cf5331802051ebb7efc8813177268131e37991aca794a95627", "bytes": 260560 }, "provenance.json": { "sha256": "ba8bf19e634d1001aa5abfddd06f26d51d7de6e0aa8d96e8f84b1adaa4afef32", "bytes": 2005 }, "rendered.html": { "sha256": "b997e23ea15f293a1a587e7c9fc7442b2bc1045a3289bc04fa6f9dbe0b7531c4", "bytes": 338306 }, "screenshot.jpg": { "sha256": "0f5569538118bb4b241b1f0e55b95d57301cea54e6500ec232837d0d7b8ce0fa", "bytes": 522688 }, "text.txt": { "sha256": "f1876f8dd43053e0c0b3e106e9409256b3487f7228617f8e2abf7aca5e6c053d", "bytes": 6290 } }, "started_utc": "2026-10-22T18:18:08.528Z", "status": 200, "final_url": "https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 4 new items in fr: Clickx reports that DPG Media and public authorities took sites offline. It names DPG Media's Tweakers and RTL Nieuws, Belgium's Smartschool, and Dutch government sites. Belgium's CCB had seen no attacks on Belgian sites", "raw_sha256": {}, "has_notes": true, "notes_md": "# Des failles PHP critiques menacent les sites web du monde entier : DPG Media et les pouvoirs publics mettent leurs sites hors ligne | Clickx\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `be/news/clickx/fr-actualites-200877-des-failles-php-critiques-menacent-les`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: www.clickx.be. Language: fr. URL: https://www.clickx.be/fr/actualites/200877/des-failles-php-critiques-menacent-les-sites-web-du-monde-entier-dpg-media-et-les-pouvoirs-publics-mettent-leurs-sites-hors-ligne/\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nClickx reports that DPG Media and public authorities took sites offline. It names DPG Media's Tweakers and RTL Nieuws, Belgium's Smartschool, and Dutch government sites. Belgium's CCB had seen no attacks on Belgian sites and urged patching.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/be/news/clickx/fr-actualites-200877-des-failles-php-critiques-menacent-les.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: DPG Media temporarily took several websites offline, including Tweakers and RTL Nieuws (whose app was also unavailable).\n\n> Par mesure de précaution, DPG Media a temporairement mis hors ligne plusieurs sites web. Il s’agit notamment de Tweakers et de RTL Nieuws, dont l’application est également temporairement indisponible.\n\n_Watch reader's translation:_ As a precaution, DPG Media temporarily took several websites offline, including Tweakers and RTL Nieuws, whose app is also temporarily unavailable.\n\n**offline**: The Belgian school platform Smartschool was temporarily inaccessible.\n\n> En Belgique, Smartschool est également temporairement inaccessible.\n\n_Watch reader's translation:_ In Belgium, Smartschool is also temporarily inaccessible.\n\n**agency**: The Centre for Cybersecurity Belgium (CCB) had not reported any attack on Belgian websites but recommended installing the updates.\n\n> Le Centre belge de cybersécurité (CCB) n’a pour l’instant signalé aucune attaque contre des sites web belges, mais a toutefois recommandé d’installer les mises à jour de sécurité nécessaires.\n\n_Watch reader's translation:_ The Centre for Cybersecurity Belgium (CCB) has so far reported no attack against Belgian websites, but has recommended installing the necessary security updates.\n\n**offline**: In the Netherlands the House of Representatives' website was taken offline, and per ANP several higher-education institutions' systems were disabled.\n\n> notamment ceux de la Chambre des députés, de MijnOverheid.nl et de DigiD. Par ailleurs, selon l’agence de presse ANP, les systèmes de plusieurs établissements d’enseignement supérieur ont été désactivés.\n\n_Watch reader's translation:_ notably those of the House of Representatives, MijnOverheid.nl and DigiD. In addition, according to the ANP news agency, the systems of several higher-education institutions were disabled.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 4 new items in fr: Clickx reports that DPG Media and public authorities took sites offline. It names DPG Media's Tweakers and RTL Nieuws, Belgium's Smartschool, and Dutch government sites. Belgium's CCB had seen no attacks on Belgian sites\n\nSupports: translations/be/news/clickx/fr-actualites-200877-des-failles-php-critiques-menacent-les.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "cloudflare-blog-php2shell-waf", "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "publisher": "Cloudflare", "kind": "vendor", "title": "Cloudflare deploys protections against php2shell vulnerability", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081216Z", "files": { "headers.json": { "sha256": "904849b322ddad92fccc55d4ce8527d9c4138d07d61937ce1da5602ea2bef244", "bytes": 7260 }, "page.html": { "sha256": "421005107f81d30d16850fdbf830446d6fd544746dfa7d201be9b4bd3f656e72", "bytes": 301730 }, "provenance.json": { "sha256": "7f98162527014e2989dfaa73146a26c079c634ddf24eff95ae99fad7ea43beb0", "bytes": 1045 }, "rendered.html": { "sha256": "a0d3c37cde7c1721a08b028748a412672817c45958d05cc7fedaede582b5537b", "bytes": 373881 }, "screenshot.png": { "sha256": "1784904e6fdda092941881d0e5c85d73801054f216295ca43b17f76e7f5cd34b", "bytes": 989488 }, "text.txt": { "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "bytes": 10205 } }, "started_utc": "2026-10-22T08:12:16.713Z", "status": 200, "final_url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c8d1046d5e15ec072fa3f8200f1b2e9345d25f2fa5c1ce0a5d50de4bc57c2434", "bytes": 7335 }, "page.html": { "sha256": "172e5df835d69af6d6694fe84442639f792a58b8925a1408e8d68921824a7d97", "bytes": 306061 }, "provenance.json": { "sha256": "b55c9fe97424debdba98dc1c1dca272d72f5ad2ff601542c5dfaa934de7ce34e", "bytes": 1798 }, "rendered.html": { "sha256": "9375a77287688e3c1d8718c25ce857c25caf62db2c3630e19d21da1c5bf24c48", "bytes": 373128 }, "screenshot.jpg": { "sha256": "16e9126356ed130c33ba0896333af9953971a4c4a4b31ad6f4823d6590d4d895", "bytes": 639665 }, "text.txt": { "sha256": "94476de6ec0b31e035ef97a1dbf9607bc81e7ddbb479c2d5217b8e8b0207ec02", "bytes": 11328 } }, "started_utc": "2026-10-23T16:27:35.260Z", "status": 200, "final_url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Dated OCTOBER 21, 2026. Says the vulnerability 'was leaked before the official release date and we observed attack traffic targeting our customers'. WAF protection live from Oct 21 03:02 UTC (~9h before disclosure). Lists disclosers as 'Calif.io, Wiz, OpenAI and Quarkslab'. 'PHP is used by almost 70% of websites.'", "raw_sha256": {}, "has_notes": true, "notes_md": "# Cloudflare blog: \"Cloudflare deploys protections against php2shell vulnerability\"\n\n- URL https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ ; dated \"OCTOBER 21, 2026\". Captured 2026-10-22T08:12:16Z.\n- Disclosers: \"Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities\" — the only researcher-beat source naming Quarkslab as a 2026 discloser (others credit Quarkslab for the 2024 audit only).\n- Probing / leak: \"Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections\".\n- Timing: WAF protections developed \"since early October 2026\", \"deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC\".\n- 70%: \"PHP is used by almost 70% of websites.\" (websites, not \"the internet\").\n- No attack volumes in the post. Volumes attributed to Matthew Prince (thousands -> millions) in secondary coverage are NOT in this post — find his X post.\n- Partners: \"working with PHP foundation, OpenAI and Wiz among others\".\n" }, { "slug": "cloudlinux-wikipedia-ref-17-php-cve-2026-109618-and", "url": "https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619/", "publisher": "CloudLinux", "kind": "news", "title": "PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection", "published": "2026-10-21T10:28:34+00:00", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "53dda7d8fe42cc34e04c046fe89c65c2e513762c0cbc6a54a23a132a50733197", "bytes": 1462 }, "page.html": { "sha256": "8baf713eabc8d20f7658385113ab92e59b0053d57812a3906103c4478e262dbd", "bytes": 537483 }, "provenance.json": { "sha256": "886c818a9ba34776eaa509b8312171b635dce945c243c0c03e23bdd36d5fde4c", "bytes": 1741 }, "rendered.html": { "sha256": "fa0ad6a66a6b3d6928bb6cbeaf281ef0e7ea32228acd4971a5eb2fea505f5d63", "bytes": 1239182 }, "screenshot.jpg": { "sha256": "d8d459d73952515f259844cfdfe4163110f9c0d1db8362e48a5379f7585b4c58", "bytes": 774928 }, "text.txt": { "sha256": "7b6cc3009fb6ee2e90456e46675809cd7bd3c1c8a9c41dea283e77656fa12bfc", "bytes": 24117 } }, "started_utc": "2026-10-25T11:46:41.794Z", "status": 200, "final_url": "https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CloudLinux blog, 21 October, updated after the fixes: PHP CVE-2026-109618 and CVE-2026-109619, CloudLinux package status and Imunify360 protection. It...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/cloud/cloudlinux/wikipedia-ref-17-php-cve-2026-109618-and-cve-2026-109619`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCloudLinux blog, 21 October, updated after the fixes: PHP CVE-2026-109618 and CVE-2026-109619, CloudLinux package status and Imunify360 protection. It restates PHP's advisory: two separate flaws, each allowing unauthenticated remote code execution (GHSA-w8hw-w9fx-j79w, out-of-memory handling; GHSA-6wmf-4rv5-p3rp, stale request state); the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP says updating is the only complete solution; the project gave advance notice on 20 October and CERT-EU also published an advisory. A hosting-vendor post, with an Imunify360 ruleset as an interim measure.\n\n> PHP states that updating is the only complete solution.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "clubic-actualite-635179-deux-failles-critiques", "url": "https://www.clubic.com/actualite-635179-deux-failles-critiques-menacent-des-millions-de-sites-php-une-mise-a-jour-d-urgence-arrive-ce-mercredi-apres-midi.html", "publisher": "Clubic", "kind": "news", "title": "Deux failles critiques menacent des millions de sites PHP, une mise à jour d’urgence arrive ce mercredi après-midi", "published": "2026-10-21T09:31:00+02:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "68db3b6b764b35a903ba82540af4702ff624d070b7e0723db4dfd9ab6c7115c8", "bytes": 1719 }, "page.html": { "sha256": "7bf62bca66711fcbc9275b3eb344c68e4aa0235065f8ddc9ebd822a785d7d260", "bytes": 557505 }, "provenance.json": { "sha256": "0894c076bd542d79a8a4faff959ca7d101beeeddd362799395d687896e39f73e", "bytes": 1793 }, "text.txt": { "sha256": "b134c1a3bfa65288771be5f10ec50b6f407d5683e21a3b7a2f18df9b971b7de3", "bytes": 8059 } }, "started_utc": "2026-10-24T08:43:04.168Z", "status": 200, "final_url": "https://www.clubic.com/actualite-635179-deux-failles-critiques-menacent-des-millions-de-sites-php-une-mise-a-jour-d-urgence-arrive-ce-mercredi-apres-midi.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Clubic (French), 21 October morning, before the patches: two critical flaws threaten millions of PHP sites and an emergency update was due that Wednes...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Deux failles critiques menacent des millions de sites PHP, une mise à jour d’urgence arrive ce mercredi après-midi\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/clubic/actualite-635179-deux-failles-critiques-menacent-des-million`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nClubic (French), 21 October morning, before the patches: two critical flaws threaten millions of PHP sites and an emergency update was due that Wednesday afternoon. It explains the CVE IDs for non-specialists and says the flaws would be remote code execution.\n\n> Les deux failles sont référencées CVE-2026-109618 et CVE-2026-109619.\n\n_Curator's translation:_ \"The two flaws are referenced CVE-2026-109618 and CVE-2026-109619.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Clubic's pre-release article (21 Oct morning) says PHP will ship an emergency fix at 16:00 Paris time after a Hacker News leak. It warns that PHP 5 and 7 sites may be left without a fix, citing W3Techs shares.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Deux failles critiques menacent des millions de sites PHP, une mise à jour d’urgence arrive ce mercredi après-midi\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cnbcindonesia-tech-20261022094711-37-778474-patch-php2", "url": "https://www.cnbcindonesia.com/tech/20261022094711-37-778474/patch-php2shell-sudah-terbit-ini-versi-aman-dan-cara-update", "publisher": "CNBC Indonesia", "kind": "news", "title": "Patch PHP2Shell Sudah Terbit, Ini Versi Aman dan Cara Update", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a03f42b67d1f9de9b63249cf584d974139cc745c4753f0b018d30dfd82025f68", "bytes": 812 }, "page.html": { "sha256": "0e97d4d5e97802b7fefe61bbacb5aff445585c9aa8c682ef972b6d6b4afe7920", "bytes": 142071 }, "provenance.json": { "sha256": "665aa8630628423749802d46715182c544290702fc9fb2e3162174dd25da894c", "bytes": 1828 }, "rendered.html": { "sha256": "6171c9538a527d8c93c7e9b36fcd72d05cb893c6d0e4b32313942a82ff8d2bed", "bytes": 168395 }, "screenshot.jpg": { "sha256": "5bee30e0fb5998156a8357c9c69e6e4f4ab51e6b1daea2a872fcaccdb85175a3", "bytes": 430542 }, "text.txt": { "sha256": "806fdcd92e6eab96304c63f573ee63d5b41bc527f98bfa1e964115a7cb59075e", "bytes": 4854 } }, "started_utc": "2026-10-23T16:16:22.742Z", "status": 200, "final_url": "https://www.cnbcindonesia.com/tech/20261022094711-37-778474/patch-php2shell-sudah-terbit-ini-versi-aman-dan-cara-update" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CNBC Indonesia, 22 October: the PHP developers officially released emergency security updates for PHP2Shell, which lets attackers run malicious code r...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Patch PHP2Shell Sudah Terbit, Ini Versi Aman dan Cara Update\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/cnbcindonesia/tech-20261022094711-37-778474-patch-php2shell-sudah-terbit-i`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCNBC Indonesia, 22 October: the PHP developers officially released emergency security updates for PHP2Shell, which lets attackers run malicious code remotely without a password or account. Both flaws score 9.2 out of 10 and can hit the server directly before page code runs; the Apache mod_php configuration is judged most at risk because a simple unauthenticated request is enough.\n\n> Tim pengembang PHP resmi merilis pembaruan keamanan darurat untuk menutup celah kritis yang dikenal sebagai PHP2Shell.\n\n_Curator's translation:_ \"The PHP development team officially released an emergency security update to close the critical hole known as PHP2Shell.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ CNBC Indonesia explainer: the PHP2Shell patch is out. It lists the safe versions and gives generic steps for checking and updating PHP (cPanel MultiPHP, php -v, backups, contacting the hosting provider).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Patch PHP2Shell Sudah Terbit, Ini Versi Aman dan Cara Update\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cnbctv18-technology-india-ranks-11th-among-18-cou", "url": "https://www.cnbctv18.com/technology/india-ranks-11th-among-18-countries-most-affected-by-php2shell-attacks-check-point-research-20018171.htm", "publisher": "CNBCTV18", "kind": "news", "title": "India ranks 11th among 18 countries most affected by PHP2Shell attacks: Check Point Research - CNBC TV18", "published": "2026-10-23T17:07:51+05:30", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "77a2d23ca5230222d50a353845c0b51872f4808a4a64f86ae451268160371716", "bytes": 679 }, "page.html": { "sha256": "781101a1cce80287676f704fc91e5c0fd893519539a82569b5dcfad2e569658c", "bytes": 414473 }, "provenance.json": { "sha256": "efe83e6a5452f105f238c4df280470599ab64170df8bb6d89318a2794fe3ece6", "bytes": 1898 }, "rendered.html": { "sha256": "5e37fd361dcb088b5d02b77fdea5042f8d7d7cd35e0751e1c071195915a12e4f", "bytes": 418961 }, "screenshot.jpg": { "sha256": "9df20f14f1ed1c0014d84177a007fd7fc9a85b1ee09b999b555ee10606fdb817", "bytes": 336097 }, "text.txt": { "sha256": "c587144444f75d076e75cdc9ef7fc34b4c5bf7b1d857bc691422f5a94a29262f", "bytes": 5254 } }, "started_utc": "2026-10-23T23:34:35.200Z", "status": 200, "final_url": "https://www.cnbctv18.com/technology/india-ranks-11th-among-18-countries-most-affected-by-php2shell-attacks-check-point-research-20018171.htm" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CNBC TV18, 23 October: India ranks 11th among the 18 countries most affected by PHP2Shell attacks, with an impact rate of 14% against a global average...", "raw_sha256": {}, "has_notes": true, "notes_md": "# India ranks 11th among 18 countries most affected by PHP2Shell attacks: Check Point Research - CNBC TV18\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `in/news/cnbctv18/technology-india-ranks-11th-among-18-countries-most-affected`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCNBC TV18, 23 October: India ranks 11th among the 18 countries most affected by PHP2Shell attacks, with an impact rate of 14% against a global average of 10%, according to Check Point Research. Hungary had the highest rate, 38% of organisations affected since disclosure, then Denmark 32% and Austria 28%. By sector, telecommunications was highest at 20%, then education 18%, and media and entertainment and associations and non-profits 16% each.\n\n> India ranks 11th among the 18 countries most affected by PHP2Shell attacks, with an impact rate of 14%, above the global average of 10%, according to Check Point Research.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"India ranks 11th among 18 countries most affected by PHP2Shell attacks: Check Point Research - CNBC TV18\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cncs-pt-alerta-136114", "url": "https://dyn.cncs.gov.pt/pt/alerta-detalhe/art/136114/alerta-de-vulnerabilidade-php", "publisher": "CNCS (Portugal)", "kind": "advisory", "title": "Alerta de Vulnerabilidade PHP (CNCS)", "published": null, "captures": [ { "stamp": "20261022T081354Z", "files": { "headers.json": { "sha256": "5c140f9296dcaee3311e6857332cd02f3ecef21ddea2f8e064632238f0723a07", "bytes": 411 }, "page.html": { "sha256": "edb193e6b70aacbf1578ad062b6fa5085bfef2f34cbf0fd97aa924338c502db7", "bytes": 1083 }, "provenance.json": { "sha256": "e1e0d3e656a7c6ebfab6919cf39d5574b3af7346b5b2a843039c2dbcb844b2e9", "bytes": 1028 }, "rendered.html": { "sha256": "ee72ee19cc622226439df3668a6e44283b40bf5c8a256279d4ca08a5381fe4ad", "bytes": 1094 }, "screenshot.png": { "sha256": "5950f00ba8371e122d55c0b80325546131c084d32f70aed1fdf1bafdbf9f5d27", "bytes": 39887 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:13:54.066Z", "status": 513, "final_url": "https://dyn.cncs.gov.pt/pt/alerta-detalhe/art/136114/alerta-de-vulnerabilidade-php" } ], "status": "blocked", "primary": true, "added_by": "collector-gov", "notes": "HTTP 513 'Verifying your browser | DiamWall' challenge to Playwright; curl got a 167-byte stub; WebFetch got a redirect loop. The URL comes from ENISA CNW-2026-04.", "raw_sha256": { "curl-body.20261022T0814Z.html": "9171fe017af37f1f055d8e8bac037fc72bf67dd77e534de433be05297a582b0f", "curl-headers.20261022T0814Z.txt": "b246a0bf67a34295b2bb54fc5724574f6176d92a46b05886076810bacd9a7e6c" }, "has_notes": true, "notes_md": "# CNCS Portugal alert 136114 (blocked)\n\nThe URL comes from ENISA CNW-2026-04. Playwright got HTTP 513 with \"Verifying your browser | DiamWall\" (that capture is kept as a record of the block). curl got a 167-byte body (in raw/). WebFetch hit a redirect loop. The content has NOT been read.\n" }, { "slug": "cnn-php2shell-ai", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "publisher": "cnn.com", "kind": "news", "title": "PHP2Shell: AI helped find a critical security flaw affecting 70% of the internet | CNN Business", "published": null, "captures": [ { "stamp": "20261022T080952Z", "files": { "headers.json": { "sha256": "b64d36e94223282247e008d1c8fac9c008a3af688e0aec349909e67073a0f99b", "bytes": 2395 }, "page.html": { "sha256": "d6d531efb9e3232aec5c2c74cdb854c9b4be45356e8b187001490e9ba5ed6a18", "bytes": 5605787 }, "provenance.json": { "sha256": "726278ecd313e258d9f1e8278775af8f14c75e895d2c4632e288314cdff80131", "bytes": 1045 }, "rendered.html": { "sha256": "66701f20de23dd4e5c1a9b4ddc55f38cff8552185314c84015ae9af8feb284ba", "bytes": 5827372 }, "screenshot.png": { "sha256": "2facb080dde6129efd10472048d29104b0b5321b0e43f755895240f244f8e398", "bytes": 144239 }, "text.txt": { "sha256": "81bf5a9a7a84ad06077d46e5c782bcd925860cc16ca9e696ebacf90832db3fef", "bytes": 6595 } }, "started_utc": "2026-10-22T08:09:52.241Z", "status": 200, "final_url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "7c2747376cb0c0381d9addb9870dba346922465a3626917c238b856a7be70588", "bytes": 2138 }, "page.html": { "sha256": "099addc537b8cb5b4bc419ae9f5ee485637e74e1d4dfab1b0e211af4dfa03b95", "bytes": 5628991 }, "provenance.json": { "sha256": "3494486a674e1c999ddd96dd28b26623fca127e4e0f671adbae585566465570f", "bytes": 1645 }, "screenshot.jpg": { "sha256": "4320a253df2bf1065952ccd1485b32cd9dc34da3e0f490f53a4b8aaeb8b847f4", "bytes": 115790 }, "text.txt": { "sha256": "4933a8479ff293ef0e78e573b1da82e55f0a0c9d684b06ddcfdffb8e5f3aca79", "bytes": 10376 } }, "started_utc": "2026-10-23T16:26:47.652Z", "status": 200, "final_url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "cnn-php2shell-websites-shut", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "publisher": "CNN", "kind": "news", "title": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112616Z", "files": { "headers.json": { "sha256": "ff524b7f55b3e2e8e2a9abaa229a6d5694a59dcdb7346d04d4e47af17c87dc26", "bytes": 2363 }, "page.html": { "sha256": "e194020ee0611e31ea5feb275ff76e19b40e03b3a1680e8e7e6ae37b1cdef60e", "bytes": 5623694 }, "provenance.json": { "sha256": "d46dfcb30fd93dcb98e4468deabbc7c3b555698dc2bcba8c6cbc81fea8306682", "bytes": 1074 }, "rendered.html": { "sha256": "9928b7deeb656b8f9d34f7844cf0e79c2e5a9ea2b05721c03e84a0bc404646d8", "bytes": 5844671 }, "screenshot.png": { "sha256": "a531b130b77be1e05bf3c9896abfc3abc4a70cc920a819eee04f7665c1a438e9", "bytes": 161563 }, "text.txt": { "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "bytes": 8896 } }, "started_utc": "2026-10-22T11:26:16.594Z", "status": 200, "final_url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "0a15aa96ae1cd6a3e1ca76543aaf7e6b776d0917080f6156b09d8ab1dd3c0d1f", "bytes": 2399 }, "page.html": { "sha256": "099addc537b8cb5b4bc419ae9f5ee485637e74e1d4dfab1b0e211af4dfa03b95", "bytes": 5628991 }, "provenance.json": { "sha256": "a0660d4ec26bb94384c8c7040ba159e683a70473440d042063b47706e142ee22", "bytes": 1694 }, "screenshot.jpg": { "sha256": "4320a253df2bf1065952ccd1485b32cd9dc34da3e0f490f53a4b8aaeb8b847f4", "bytes": 115790 }, "text.txt": { "sha256": "4933a8479ff293ef0e78e573b1da82e55f0a0c9d684b06ddcfdffb8e5f3aca79", "bytes": 10376 } }, "started_utc": "2026-10-23T16:26:47.961Z", "status": 200, "final_url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Wikimedia Foundation to CNN: systems 'taken down as a precautionary measure'; '70% of the internet' in the headline.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business\n\nCaptured by claude-story-site. Status: captured. Wikimedia Foundation to CNN: systems 'taken down as a precautionary measure'; '70% of the internet' in the headline.\n\n- Captured for the Wikimedia quote.\n" }, { "slug": "cnn-wikipedia-ref-39-26-10-21-tech-php2shell", "url": "https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai", "publisher": "CNN", "kind": "news", "title": "Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet | CNN Business", "published": "2026-10-21T16:36:24.575Z", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "0b04de527526c29dede8b3e419aabe004ab47d1e4fbb73df14def674506605ba", "bytes": 2143 }, "page.html": { "sha256": "60dc9ede83ee686710fad90791a701e79fde161de4315e1b149e78dd0b7657b0", "bytes": 5757686 }, "provenance.json": { "sha256": "4c48c73a188874ea2aecf6bddece083efe3f9a82ff140509577c679a21cc7857", "bytes": 1649 }, "screenshot.jpg": { "sha256": "990799d3fdae97509e76787a27e1b71c1037a1966315710c966455640f5ca1ce", "bytes": 113005 }, "text.txt": { "sha256": "49e4e143c4e7e878c3899ca0ecf1ccc4b95011aee8128f2c7c77968023c89c9a", "bytes": 10185 } }, "started_utc": "2026-10-25T11:46:47.076Z", "status": 200, "final_url": "https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). CNN Business, 21 October: websites shut down globally after AI finds a cybersecurity flaw affecting 70% of the internet. The bugs, called PHP2Shell, c...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet | CNN Business\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/news/cnn/wikipedia-ref-39-26-10-21-tech-php2shell-vulnerability-ai`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCNN Business, 21 October: websites shut down globally after AI finds a cybersecurity flaw affecting 70% of the internet. The bugs, called PHP2Shell, could let attackers break into websites and read memory that could contain passwords. Like Heartbleed, Wiz's researchers say PHP2Shell could be a turning point; the flaws existed for years but AI made them practical to use; exploiting them involved a complex set of steps 'at the edge of what human researchers could practically achieve', and researchers then used AI to adapt the techniques and analyse the results. The PHP Foundation released a patch and the Cloudflare CEO said on X that millions of attempts had been seen in a couple of days.\n\n> Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet | CNN Business\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cnnportugal-php", "url": "https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2", "publisher": "cnnportugal.iol.pt", "kind": "news", "title": "\"Um dos incidentes mais impactantes da memória recente\": o que se está a passar na Internet? - CNN Portugal", "published": null, "captures": [ { "stamp": "20261022T081548Z", "files": { "headers.json": { "sha256": "cd1f9101b255c06dcc65efa8a462262b0124e12dc78a4212e714e6f672957362", "bytes": 697 }, "page.html": { "sha256": "aabf9d1f6cb549ab9ef2affb4395b9e57fa37ef017602b4c3499aeb56e38f613", "bytes": 124957 }, "provenance.json": { "sha256": "2ab5eab908ae48f5311002b82ca343698ee994d045b30704d96111f99861d2e7", "bytes": 1260 }, "rendered.html": { "sha256": "881042229ef5a6897b016fce3e1a7bada7056865f7e3ebc594d760aeaf0059e0", "bytes": 1315826 }, "screenshot.png": { "sha256": "eb0fe8e63035865baa90a43ca5d367188e4d539217ac94e8c1f0daf65bf92ef6", "bytes": 1325277 }, "text.txt": { "sha256": "de3c730717888f1395fbb1acc2b293846e9b0bf90bc7104fec23d64aad5886c2", "bytes": 9295 } }, "started_utc": "2026-10-22T08:15:48.754Z", "status": 200, "final_url": "https://cnnportugal.iol.pt/php/internet/um-dos-incidentes-mais-impactantes-da-memoria-recente-o-que-se-esta-a-passar-na-internet/20261022/6ad9be61d34e53c759c776e2" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "coinacademy-actu-php-php2shell-frailles-critiques-ur", "url": "https://coinacademy.fr/actu/php-php2shell-frailles-critiques-urgence/", "publisher": "Coin Academy", "kind": "news", "title": "PHP2Shell : deux failles critiques PHP corrigées en urgence", "published": "2026-10-21T11:50:03+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f7d2e3ac2dd840128ed5ac087cb883eed0305cf54399ba5730ecfd6fe03f47f6", "bytes": 1302 }, "page.html": { "sha256": "dd0fcdb37cecd2a25cde8e35e00890e9e8bf44c1eb0a6651eb3472da95d72ec0", "bytes": 880640 }, "provenance.json": { "sha256": "cec84f837e7f9ffcbd6b4257e30ded7d95dcbf019f2b804736fa0d334fa6ea06", "bytes": 1693 }, "rendered.html": { "sha256": "04c86ac9d1ae9067533f91ee80390adc27589e92b585c8b914b3ab745c11c2d3", "bytes": 898783 }, "screenshot.jpg": { "sha256": "e1eaea9582fee9ad2fd66b215fcb060bf25dd0da69b95abe6b67392254b5f7fd", "bytes": 816782 }, "text.txt": { "sha256": "2592cf0c08c277858d6cda3b50a31cb0087cb8d01865f60b2ca7815ba8a1e712", "bytes": 11647 } }, "started_utc": "2026-10-23T16:14:48.092Z", "status": 200, "final_url": "https://coinacademy.fr/actu/php-php2shell-frailles-critiques-urgence/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Coin Academy (French), 21 October, before the patches: two critical PHP flaws and an emergency fix expected that Wednesday. It says watchTowr's resear...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : deux failles critiques PHP corrigées en urgence\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/coinacademy/actu-php-php2shell-frailles-critiques-urgence`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCoin Academy (French), 21 October, before the patches: two critical PHP flaws and an emergency fix expected that Wednesday. It says watchTowr's researchers state they are remote code execution flaws where an attacker could take control of a server without access, and that no exploitation had been reported at that stage.\n\n> Les chercheurs de watchTowr affirment qu’il s’agit de failles d’exécution de code à distance (RCE)\n\n_Curator's translation:_ \"watchTowr's researchers say these are remote code execution (RCE) flaws\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ CoinAcademy's pre-release explainer (21 Oct) covers the Hacker News leak, watchTowr's confirmation, unconfirmed version claims and the expected version numbers. It cites a Mallory/Shodan count of exposed servers running PHP 8.1 or older.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : deux failles critiques PHP corrigées en urgence\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "coingape-crypto-firms-say-they-dont-use-php-after", "url": "https://coingape.com/crypto-firms-say-they-dont-use-php-after-critical-php2shell-flaw/", "publisher": "Coingape", "kind": "news", "title": "Crypto Firms Say They Don't Use PHP After Critical PHP2Shell Flaw", "published": "2026-10-22T07:28:25+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "353041bd4fd246901fb76a7f9f080af1a20bff4c1e995d3b32d46e98b5acbf96", "bytes": 1330 }, "page.html": { "sha256": "bc64442be7ca302222fe2a56fd811773acecb04e6e37b90f8143f927df31a16f", "bytes": 553890 }, "provenance.json": { "sha256": "5ac2040b7561f6b81ca289b871372d07a1aa191f128c51e36488f638dad5baeb", "bytes": 1751 }, "rendered.html": { "sha256": "48b5d859a142b0df61e59728e28241959377deba6af79b6d8446fc0d0721b6ab", "bytes": 554246 }, "screenshot.jpg": { "sha256": "76c34316883ebd06ef09131a6a4559514539fdd370a24de939c5c8392adc569a", "bytes": 664467 }, "text.txt": { "sha256": "caf9bd5b4fba62c2775e1430af753a4fe91fd04c547a397f4ccc45243a741e56", "bytes": 10461 } }, "started_utc": "2026-10-23T16:26:17.469Z", "status": 200, "final_url": "https://coingape.com/crypto-firms-say-they-dont-use-php-after-critical-php2shell-flaw/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Coingape: crypto firms say they do not use PHP after the PHP2Shell flaws. Restates the two flaws, both CVSS 9.2, enabling unauthenticated remote code...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Crypto Firms Say They Don't Use PHP After Critical PHP2Shell Flaw\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ua/news/coingape/crypto-firms-say-they-dont-use-php-after-critical-php2shell`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCoingape: crypto firms say they do not use PHP after the PHP2Shell flaws. Restates the two flaws, both CVSS 9.2, enabling unauthenticated remote code execution on PHP servers. A crypto-news angle.\n\n> Two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), both rated CVSS 9.2, enable unauthenticated remote code execution on PHP servers.\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ CoinGape (English, crypto news) reports on PHP2Shell's crypto impact. Binance co-founder CZ urged caution; BNB Chain and Trust Wallet said their stacks don't use PHP; Kraken migrated its backend to Rust in 2025; SlowMist scanned the industry's PHP assets.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Crypto Firms Say They Don't Use PHP After Critical PHP2Shell Flaw\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "coinpedia-crypto-live-news-php-flags-third-unpatch", "url": "https://coinpedia.org/crypto-live-news/php-flags-third-unpatched-flaw-as-attacks-on-php2shell-bugs-reach-millions/", "publisher": "Coinpedia", "kind": "news", "title": "PHP Flags Third Unpatched Flaw As Attacks On PHP2Shell Bugs Reach Millions", "published": "2026-10-23T17:22:39+00:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "5165630c672323948c7b933895623d6ad08a2a462ac3c171d06d8f582e3cd472", "bytes": 9727 }, "page.html": { "sha256": "dd5884ae83bebd270bf5a07cb725166e54d365afb706889f372f82aa084635ce", "bytes": 712775 }, "provenance.json": { "sha256": "4c8161c8d6dc6572c4e2e570793ce5cdd174267500604592919577a41f76751b", "bytes": 1819 }, "rendered.html": { "sha256": "3bf7504b0903f1b512d837671e3a8aad6b0a2f0821d283246a3d8a68f7baab24", "bytes": 713636 }, "screenshot.jpg": { "sha256": "b4408b7bedeeaeac4b7fab0e05fc9ce3b95dbbd979dceb3479ab3e25b6eea4c9", "bytes": 214125 }, "text.txt": { "sha256": "c8f2ffd9650a73aecce66b34f389460d77edd8626d5c9c008d20e09da9da8c6a", "bytes": 3047 } }, "started_utc": "2026-10-24T09:01:28.503Z", "status": 200, "final_url": "https://coinpedia.org/crypto-live-news/php-flags-third-unpatched-flaw-as-attacks-on-php2shell-bugs-reach-millions/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Coinpedia, 23 October: PHP disclosed a new server vulnerability, CVE-2026-115560, two days after the emergency patches. It can allow attackers to take...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Flags Third Unpatched Flaw As Attacks On PHP2Shell Bugs Reach Millions\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ua/news/coinpedia/crypto-live-news-php-flags-third-unpatched-flaw-as-attacks-o`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCoinpedia, 23 October: PHP disclosed a new server vulnerability, CVE-2026-115560, two days after the emergency patches. It can allow attackers to take over web servers, but only on sites running a rare combination of PHP session settings; no attacks using it had been detected; PHP does not see it as a likely target and will fix it in the next scheduled update; until then administrators of affected sites should switch off the session upload progress feature. It also repeats Cloudflare's report that attempts on the earlier flaws have reached millions and says SlowMist urged crypto exchanges and wallet providers to patch.\n\n> PHP has disclosed a new server vulnerability, CVE-2026-115560, only two days after rushing out emergency patches for two critical PHP2Shell flaws.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP Flags Third Unpatched Flaw As Attacks On PHP2Shell Bugs Reach Millions\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cointelegraph-news-php-foundation-admits-structural-failure", "url": "https://cointelegraph.com.br/news/php-foundation-admits-structural-failure-delayed-critical-security-fix", "publisher": "Cointelegraph Brasil", "kind": "news", "title": "Fundação PHP admite que “falha estrutural” atrasou correção de segurança", "published": "2026-10-22T00:44:00.287Z", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "3056212e7d04339b43bd6477a993570d2e60bf22ba49c163f940e537aafd1cc3", "bytes": 2690 }, "page.html": { "sha256": "dbd36c7e29a293dae189773f136e4c767c33d3bc4eb4a2b07d8eb4947bfb3f0c", "bytes": 166544 }, "provenance.json": { "sha256": "ac3ba91b53d7b7cd66dc956319982ac0302cdd97b93467378eec92826cc8c03c", "bytes": 1823 }, "rendered.html": { "sha256": "3454035f5d3ffc1ce0a21a17266aab9c354cc5635b4b2d0156f8f93e4a426120", "bytes": 167236 }, "screenshot.jpg": { "sha256": "d838e687904086ebdf85e3aeb96963af9de712cbffaec80e02bf950b73eb5c5b", "bytes": 534711 }, "text.txt": { "sha256": "67d4e56887747e5353ee3c1417bdeba7fe00233e7aab9b158c69d6e2123296bb", "bytes": 8169 } }, "started_utc": "2026-10-22T18:18:33.812Z", "status": 200, "final_url": "https://cointelegraph.com.br/news/php-foundation-admits-structural-failure-delayed-critical-security-fix" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: Cointelegraph Brasil covers the PHP Foundation's admission that a 'structural failure' delayed the fix, and the worldwide shutdowns. It adds Australia's ASD, Japan's prime minister, crypto-sector exposure data from SlowM", "raw_sha256": {}, "has_notes": true, "notes_md": "# Fundação PHP admite que “falha estrutural” atrasou correção de segurança\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `br/news/cointelegraph/news-php-foundation-admits-structural-failure-delayed-critic`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: Cointelegraph Brasil. Language: pt. URL: https://cointelegraph.com.br/news/php-foundation-admits-structural-failure-delayed-critical-security-fix\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nCointelegraph Brasil covers the PHP Foundation's admission that a 'structural failure' delayed the fix, and the worldwide shutdowns. It adds Australia's ASD, Japan's prime minister, crypto-sector exposure data from SlowMist, and Cardano's Intersect taking its member area offline.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/br/news/cointelegraph/news-php-foundation-admits-structural-failure-delayed-critic.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: France's Interior Ministry temporarily took prefecture websites offline, and Germany's federal IT provider ITZBund disabled several sites (attributed to Reuters).\n\n> o Ministério do Interior da França temporariamente tirou do ar os sites das prefeituras. A provedora federal de TI da Alemanha, ITZBund, também desativou vários sites, segundo a Reuters.\n\n_Watch reader's translation:_ France's Interior Ministry temporarily took the prefecture websites offline. Germany's federal IT provider, ITZBund, also disabled several sites, according to Reuters.\n\n**offline**: Australia's Signals Directorate acknowledged that its cyber.gov.au site was among the government sites affected.\n\n> Na Austrália, a Diretoria de Sinais Australiana reconheceu que seu site de cibersegurança, cyber.gov.au, estava entre os sites governamentais afetados pelo problema do PHP.\n\n_Watch reader's translation:_ In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website, cyber.gov.au, was among the government sites affected by the PHP problem.\n\n**official**: Japan's Prime Minister Sanae Takaichi posted on X urging site operators to patch quickly and suggesting temporary suspension if they could not.\n\n> A primeira-ministra do Japão, Sanae Takaichi, publicou no X um apelo para que os operadores de sites se preparassem para aplicar o patch o mais rápido possível.\n\n_Watch reader's translation:_ Japan's Prime Minister, Sanae Takaichi, posted on X an appeal for site operators to prepare to apply the patch as quickly as possible.\n\n**number**: SlowMist's MistEye found 793 domains with direct PHP fingerprints among 1,488 crypto-sector domains assessed.\n\n> Foram identificados 793 domínios com impressões digitais diretas de PHP entre os 1.488 domínios avaliados.\n\n_Watch reader's translation:_ 793 domains with direct PHP fingerprints were identified among the 1,488 domains assessed.\n\n**offline**: Intersect, the Cardano governance member organisation, took its Member Area offline while assessing exposure; it was still down at time of writing.\n\n> A Intersect, uma organização associativa que apoia o desenvolvimento e a governança da blockchain Cardano, afirmou que havia temporariamente tirado do ar sua Área de Membros enquanto avaliava uma possível exposição.\n\n_Watch reader's translation:_ Intersect, a membership organisation supporting Cardano blockchain development and governance, said it had temporarily taken its Members Area offline while assessing possible exposure.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in pt: Cointelegraph Brasil covers the PHP Foundation's admission that a 'structural failure' delayed the fix, and the worldwide shutdowns. It adds Australia's ASD, Japan's prime minister, crypto-sector exposure data from SlowM\n\nSupports: translations/br/news/cointelegraph/news-php-foundation-admits-structural-failure-delayed-critic.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "computable-2026-10-21-kritiek-php-lek-zet-miljoenen", "url": "https://www.computable.be/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/", "publisher": "Computable.be", "kind": "news", "title": "Kritiek PHP-lek zet miljoenen websites onder druk - Computable.be", "published": "2026-10-21T12:55:03+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "34156009844095dbb666778b36617f7e81997aad150f05485560be6b0487541c", "bytes": 490 }, "page.html": { "sha256": "23da22969d92e0065044269841649fedbe583ed84907b2461ece8284bfd55bfd", "bytes": 651006 }, "provenance.json": { "sha256": "5d71cfec76deeb92794802da19c82034da2a750429cf2ba22d101d47a830ccf9", "bytes": 1759 }, "rendered.html": { "sha256": "7fe568d561bee11e0699a4133ada518991e68e750d8a764628388c2d8cc24b98", "bytes": 966959 }, "screenshot.jpg": { "sha256": "695fd4771a82671081c4b5e5035b28236559fce403a2ce8ee53a0a25010ee62c", "bytes": 318021 }, "text.txt": { "sha256": "179da944caa48e3c05c4639f3b3d6ee372a0ea814c069b2f7edfaef38824e74b", "bytes": 5301 } }, "started_utc": "2026-10-23T16:10:44.120Z", "status": 200, "final_url": "https://www.computable.be/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Computable.be (Dutch, Belgium), 21 October: the PHP Foundation issued emergency updates for two critical flaws after information leaked early; the sam...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Kritiek PHP-lek zet miljoenen websites onder druk - Computable.be\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/computable/2026-10-21-kritiek-php-lek-zet-miljoenen-websites-onder-druk`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nComputable.be (Dutch, Belgium), 21 October: the PHP Foundation issued emergency updates for two critical flaws after information leaked early; the same text as the Computable.nl capture already in the vault under another slug, on the Belgian site. Both flaws are rated 9.2, and watchTowr confirmed the flaws are real and at least one is reproducible.\n\n> De PHP Foundation heeft met spoed updates uitgebracht voor twee kritieke kwetsbaarheden in programmeertaal PHP\n\n_Curator's translation:_ \"The PHP Foundation has urgently released updates for two critical vulnerabilities in the PHP programming language\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Computable.be reports the emergency PHP updates after the leak, citing watchTowr and CERT-EU. It adds comments from Sebastiaan Kors, CEO of Dutch security firm Pinewood, that a vulnerability does not automatically mean every site can be hacked.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Kritiek PHP-lek zet miljoenen websites onder druk - Computable.be\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "computable-2026-10-21-kritiek-php-lek-zet-miljoenen-20261023", "url": "https://www.computable.nl/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/", "publisher": "Computable.nl", "kind": "news", "title": "Kritiek PHP-lek zet miljoenen websites onder druk - Computable.nl", "published": "2026-10-21T12:50:05+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "e1a1100482c1177dd71cec6f1c68bd814c7ca292b74e6620509f0c21d394785e", "bytes": 568 }, "page.html": { "sha256": "a01d22f30899d0bde83861403ecd6748daf017c9e84dba71af7c0cf57ae6afc1", "bytes": 666172 }, "provenance.json": { "sha256": "973da6c2aea04ce0e809d3e960c74674fdaffcdad7d9cc5fece43bc9d5d85298", "bytes": 1770 }, "rendered.html": { "sha256": "da697c76c8883eeee5f4338c844d0b5e327d01c92653ef480ab1a90a9b1d4a88", "bytes": 982175 }, "screenshot.jpg": { "sha256": "c121e11653edfb64d162eabd03c8e93dbecc6dbce12a37b6036269c9582d79b0", "bytes": 449159 }, "text.txt": { "sha256": "8af27b7e9cb1bf890cb08815bdc8e3b9f6db146f01fac7dd2d084bc6c6428532", "bytes": 6486 } }, "started_utc": "2026-10-23T16:22:59.872Z", "status": 200, "final_url": "https://www.computable.nl/2026/10/21/kritiek-php-lek-zet-miljoenen-websites-onder-druk/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Computable.nl (Dutch), 21 October: the PHP Foundation issued emergency updates for two critical flaws after information leaked early; both are rated 9...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Kritiek PHP-lek zet miljoenen websites onder druk - Computable.nl\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/news/computable/2026-10-21-kritiek-php-lek-zet-miljoenen-websites-onder-druk`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nComputable.nl (Dutch), 21 October: the PHP Foundation issued emergency updates for two critical flaws after information leaked early; both are rated 9.2. Researchers at watchTowr confirmed the vulnerabilities are real and that at least one of the two is reproducible.\n\n> Onderzoekers van beveiligingsbedrijf watchTowr bevestigden dat de kwetsbaarheden reëel zijn\n\n_Curator's translation:_ \"Researchers at the security company watchTowr confirmed that the vulnerabilities are real\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Computable.nl version of the Computable.be article (21 Oct 12:50): emergency PHP updates after the leak, watchTowr confirmation, CERT-EU warning, and comments by Pinewood CEO Sebastiaan Kors.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Kritiek PHP-lek zet miljoenen websites onder druk - Computable.nl\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "computerhoy-20minutos-ciberseguridad-que-es-php-php2shell-cual", "url": "https://computerhoy.20minutos.es/ciberseguridad/que-es-php-php2shell-cual-es-papel-ia-todo-esto-cuanto-tiempo-tardara-solucionarse-una-las-mayores-crisis-seguridad-historia-internet_7051873_0.html", "publisher": "computerhoy.20minutos", "kind": "news", "title": "Qué es PHP y PHP2Shell, cuál es el papel de la IA en todo esto y cuánto tiempo tardará en solucionarse una de las mayores crisis de seguridad en la historia de internet", "published": "2026-10-22T12:02:19+02:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "be4ebc1390bf8766a66ddf525bb05b2ae6961b4fdb252292a31a974871ee011a", "bytes": 675 }, "page.html": { "sha256": "096441ab9186b6415e28e02c7eea29c0ce1ac72778cef7d556ca7a3b6d660b1a", "bytes": 155785 }, "provenance.json": { "sha256": "58b241d04916c3a943c88b9a301eb343ca5e6802a5f942de1fe8268923f893bb", "bytes": 1969 }, "text.txt": { "sha256": "31876f7578b421d31530a72c9f2575b804fc60041d45a0a4a9eba4a8f0d3f1fe", "bytes": 5753 } }, "started_utc": "2026-10-24T08:46:17.508Z", "status": 200, "final_url": "https://computerhoy.20minutos.es/ciberseguridad/que-es-php-php2shell-cual-es-papel-ia-todo-esto-cuanto-tiempo-tardara-solucionarse-una-las-mayores-crisis-seguridad-historia-internet_7051873_0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Computer Hoy / 20minutos (Spanish), 22 October: what PHP and PHP2Shell are, the role of AI in it all and how long it will take to solve what it calls...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Qué es PHP y PHP2Shell, cuál es el papel de la IA en todo esto y cuánto tiempo tardará en solucionarse una de las mayores crisis de seguridad en la historia de internet\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/computerhoy-20minutos/ciberseguridad-que-es-php-php2shell-cual-es-papel-ia-todo-es`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nComputer Hoy / 20minutos (Spanish), 22 October: what PHP and PHP2Shell are, the role of AI in it all and how long it will take to solve what it calls one of the biggest security crises in the history of the internet. PHP2Shell is the common name of two critical vulnerabilities in PHP, the language behind almost 70% of the web.\n\n> PHP2Shell es el nombre con el que se han bautizado conjuntamente 2 vulnerabilidades críticas que afectan a PHP, el lenguaje de programación detrás de casi el 70% de la web.\n\n_Curator's translation:_ \"PHP2Shell is the name given jointly to 2 critical vulnerabilities affecting PHP, the programming language behind almost 70% of the web.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Computer Hoy explains what PHP and PHP2Shell are, the role of AI, and how long the fix will take: hours for well-run setups, weeks or months for neglected servers on unsupported versions.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Qué es PHP y PHP2Shell, cuál es el papel de la IA en todo esto y cuánto tiempo tardará en solucionarse una de las mayores crisis de seguridad en la historia de \". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "computerweekly-news-366652674-botched-php2shell-disclos", "url": "https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues", "publisher": "Computer Weekly", "kind": "news", "title": "Botched PHP2Shell disclosure revealed as panic continues | Computer Weekly", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "7424ee3c0ca4dbd5e22a2cebd1a5cc65ca127116a0e8e9171d8579344085f83d", "bytes": 715 }, "page.html": { "sha256": "d5954b08d373a7058260a3a671f23dc5d60ecc35db54fcceb2a18fd21ae8daeb", "bytes": 383707 }, "provenance.json": { "sha256": "a2d3a3df7c5f50ca7347cb32fcef369418254d30e17dcd9a81a5c778472065e3", "bytes": 1811 }, "rendered.html": { "sha256": "f519421f01650d017c88e6100b48447ad70ec8cc181fcda70ffd477b129aeb09", "bytes": 408600 }, "screenshot.jpg": { "sha256": "b713a9af3dc3349fecf59e8517f519fbb79a3195f3669fb84720768704f8f6c1", "bytes": 711491 }, "text.txt": { "sha256": "8c5ef3c6921c8db90001a45a4cecbcc172ebbad178e2dcb66d150a72029dbb4e", "bytes": 10778 } }, "started_utc": "2026-10-23T16:10:44.665Z", "status": 200, "final_url": "https://www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Computer Weekly: the PHP Foundation reveals how a carefully planned disclosure went horribly wrong while teams worldwide cope with the flaws, which si...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Botched PHP2Shell disclosure revealed as panic continues | Computer Weekly\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/computerweekly/news-366652674-botched-php2shell-disclosure-revealed-as-pani`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nComputer Weekly: the PHP Foundation reveals how a carefully planned disclosure went horribly wrong while teams worldwide cope with the flaws, which sit in core PHP code underpinning almost three-quarters of the world's websites, setting off wide debate in the security community.\n\n> the PHP Foundation reveals how a carefully planned vulnerability disclosure process went horribly wrong\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Botched PHP2Shell disclosure revealed as panic continues | Computer Weekly\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "computerworld-article-4238887-dos-fallos-criticos-de-p", "url": "https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html", "publisher": "COMPUTERWORLD ESPAÑA", "kind": "news", "title": "Dos fallos críticos de PHP ponen en alerta a Internet | Computerworld.es", "published": "October 22, 2026", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a08dc05d415171e1f4bbac6a41cef8e09ff5c471968dafc6e934209f77bd49f1", "bytes": 974 }, "page.html": { "sha256": "7d555a99926112835b695b6a1bc4f42ddf9a8132e27dc3eb70f773f57c6fb2b0", "bytes": 293875 }, "provenance.json": { "sha256": "9dbac40f846855c846fc44b0e7d1749473a8f2ce4fa53575f18d58696bc2d5f5", "bytes": 1741 }, "text.txt": { "sha256": "e008b157b0ff9821a0995ada3ad6e5895f5f361231721c4191868b050a77d886", "bytes": 14164 } }, "started_utc": "2026-10-23T16:14:16.069Z", "status": 200, "final_url": "https://www.computerworld.es/article/4238887/dos-fallos-criticos-de-php-ponen-en-alerta-a-la-red-mientras-llegan-los-parches-de-emergencia.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es-ES", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Computerworld España (Spanish): two critical PHP flaws put the Internet on alert. It relays the NCSC-NL description that the impact is not limited to...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Dos fallos críticos de PHP ponen en alerta a Internet | Computerworld.es\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/computerworld/article-4238887-dos-fallos-criticos-de-php-ponen-en-alerta-a`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nComputerworld España (Spanish): two critical PHP flaws put the Internet on alert. It relays the NCSC-NL description that the impact is not limited to websites, because PHP is embedded in appliances, network devices, management interfaces and vendors' products; and gives the two CVE descriptions (out-of-memory memory corruption for CVE-2026-109618, stale request state reused by a later request for CVE-2026-109619), both 9.2.\n\n> PHP también está integrado en aparatos, dispositivos de red, interfaces de gestión y otros productos de proveedores\n\n_Curator's translation:_ \"PHP is also built into appliances, network devices, management interfaces and other vendors' products\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Computerworld España reports the PHP Foundation patches and the European shutdowns. It quotes Spain's INCIBE-CERT critical alert and a Forrester analyst, and covers NCSC-NL's and CERT-EU's warnings about PHP embedded in appliances and products.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Dos fallos críticos de PHP ponen en alerta a Internet | Computerworld.es\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `es-ES`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "computing-news-2026-security-php-emergency-patches", "url": "https://www.computing.co.uk/news/2026/security/php-emergency-patches-for-critical-flaws", "publisher": "Computing", "kind": "news", "title": "PHP rushes out emergency fixes for critical flaws threatening millions of websites", "published": "not stated in the capture", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "815ef9f114f06a7d690ca50b925e5c9d3c9bc5f5cfa3ea31f8d609de0afdffda", "bytes": 1141 }, "page.html": { "sha256": "3cc01e451b7904986175ad725435e87cbd66de9c4aaa029407f16cee667af106", "bytes": 23452 }, "provenance.json": { "sha256": "058fdca30ac0588ce3b7f341c2adbcd1697d24c2efd7ef6639e6cf7ed39f51e7", "bytes": 1771 }, "rendered.html": { "sha256": "0e4d44dd23c7781d9dca5e2373c3a6f70754b0458959b63bcea1ac4a9abdbd44", "bytes": 26096 }, "screenshot.jpg": { "sha256": "61d34da7242d0dae910cd0147dc16e695fd4f1abdc2085a46ec853e8fa42e899", "bytes": 7597 }, "text.txt": { "sha256": "fd3c047d01cbfe2f15050923226b2bfcd27fdc0f0a28049c7c27e460cf347dbf", "bytes": 7179 } }, "started_utc": "2026-10-26T07:21:35.195Z", "status": 200, "final_url": "https://www.computing.co.uk/news/2026/security/php-emergency-patches-for-critical-flaws" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Computing (UK, English), undated in the capture but written the day after disclosure (it says 'yesterday we all heard about it'), so probably 22 Octob...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP rushes out emergency fixes for critical flaws threatening millions of websites\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/computing/news-2026-security-php-emergency-patches-for-critical-flaws`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nComputing (UK, English), undated in the capture but written the day after disclosure (it says 'yesterday we all heard about it'), so probably 22 October: PHP rushes out emergency fixes as governments and major organisations pull sites offline. It says the NSA warned that sites unable to patch at once should be taken offline, that Cloudflare saw thousands of exploitation attempts in the ten hours before disclosure and millions since, and that Oxford City Council, Edinburgh City Council and the Office for Budget Responsibility took sites down pre-emptively. It adds that PHP core developer Gina Peter Banyard warned mitigations alone cannot fully prevent attacks, that Calif used GPT-5.6 Sol (per OpenAI) and Wiz used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and quotes Red Helix, Sophos and Adaptavist commentators.\n\n> According to Cloudflare, in the 10 hours before they became public knowledge, there were thousands of attempts to exploit these vulnerabilities.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP rushes out emergency fixes for critical flaws threatening millions of websites\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cpomagazine-cyber-security-threat-actor-targeted-php", "url": "https://www.cpomagazine.com/cyber-security/threat-actor-targeted-php-vulnerabilities-days-before-php2shell-disclosure/", "publisher": "CPO Magazine", "kind": "news", "title": "Threat Actor Targeted PHP Vulnerabilities Days Before PHP2Shell Disclosure - CPO Magazine", "published": "2026-10-26T11:00:00+00:00", "captures": [ { "stamp": "20261026T144241Z", "files": { "headers.json": { "sha256": "74123de4a5eb41dde9725a259d23ca61e549f6dbc0762e9082f9b02fff215d62", "bytes": 1290 }, "page.html": { "sha256": "8706f116db23c908e869829b7d58e20794ea8f9e9ef6d9fb2a9e37309dcf18b2", "bytes": 175472 }, "provenance.json": { "sha256": "d957b39b54e6fc72b37a53de72ea3c1dadabde863037b7946657c3fe8ee5aec1", "bytes": 1848 }, "rendered.html": { "sha256": "8153091b61678869a8b056c21426a7692fdfd0228134abdbeba9ab308f79c362", "bytes": 516787 }, "screenshot.jpg": { "sha256": "e6b84f8bfd8e35021b83f43a88b0cd8b193da6587baaab6f0667e5ae59b7745d", "bytes": 569732 }, "text.txt": { "sha256": "069001b802811d269d4fb11306f0e65ff4e7eaac541273fcc4c23b842d867141", "bytes": 7500 } }, "started_utc": "2026-10-26T14:45:09.110Z", "status": 200, "final_url": "https://www.cpomagazine.com/cyber-security/threat-actor-targeted-php-vulnerabilities-days-before-php2shell-disclosure/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T144241Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). CPO Magazine (English), 26 October, by Scott Ikeda: Amazon's Threat Intelligence group reports probing of the PHP flaws as early as 17 October, three...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Threat Actor Targeted PHP Vulnerabilities Days Before PHP2Shell Disclosure - CPO Magazine\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/cpomagazine/cyber-security-threat-actor-targeted-php-vulnerabilities-day`, snapshot `20261026T144241Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T144241Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCPO Magazine (English), 26 October, by Scott Ikeda: Amazon's Threat Intelligence group reports probing of the PHP flaws as early as 17 October, three days before the leak and four before public disclosure, so the disclosure that was carefully coordinated to leave time for patching was already known to someone. It says the PHP Foundation had to release patches a day early after pre-release notices and videos reached the Hacker News comments, that Amazon caught multiple attempts on a MadPot honeypot from known anonymisation services with varied payloads, which it takes to mean several actors, and that it is unclear how they knew: either a quieter insider leak to attackers or independent discovery by advanced actors. It adds that the Hacker News leak is thought to have been an employee of a security company with insider access making an honest mistake with the embargo timeline.\n\n> The Hacker News leak is thought to be a case of an employee from a security company that had insider access making an honest mistake with the embargo timeline rather than a malicious effort.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Threat Actor Targeted PHP Vulnerabilities Days Before PHP2Shell Disclosure - CPO Magazine\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "criticarad-php2shell-cve-2026-109618-ghid-patch", "url": "https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/", "publisher": "Critic Arad", "kind": "news", "title": "PHP2Shell | Panică mondială și ghidul complet de patch", "published": "2026-10-22T12:02:38+03:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "387a34ae17de8562acfab2dbf2aed130fd620e4be2c843c544061eb1b59a2311", "bytes": 962 }, "page.html": { "sha256": "df96f9ecea949bb7067e25b8dd5abb86f8d9229d2c3f371bad400490884b8756", "bytes": 385267 }, "provenance.json": { "sha256": "620794875350fcf150a337cc942aaccfdb31396677a5efa39f4bdac1380d6d31", "bytes": 1652 }, "rendered.html": { "sha256": "ec06accfbe05459da12950feceabcd63eb453351f62918aef9970377025f33ff", "bytes": 354128 }, "screenshot.jpg": { "sha256": "862129757dc398c5e32f4986227eea89c8f48e896013541d0ca2a4492831bb17", "bytes": 974037 }, "text.txt": { "sha256": "2f3acccf122140590c9aec1ab56e7076bc1f9c3a6e5f0b693a80f742162a205c", "bytes": 33454 } }, "started_utc": "2026-10-23T16:24:19.867Z", "status": 200, "final_url": "https://www.criticarad.ro/php2shell-cve-2026-109618-ghid-patch/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ro-RO", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Critic Arad (Romanian): global panic and a full patch guide. It says PHP2Shell, found in August and made public on Wednesday, took government sites of...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell | Panică mondială și ghidul complet de patch\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ro/news/criticarad/php2shell-cve-2026-109618-ghid-patch`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCritic Arad (Romanian): global panic and a full patch guide. It says PHP2Shell, found in August and made public on Wednesday, took government sites offline on four continents: Canada withdrew some federal pages, the Netherlands shut DigiD and MijnOverheid, France took down prefecture sites, and in Romania the Romanian Police site was replaced with a maintenance page. It says the vulnerable code has existed since 2012. A long page (about 31,000 characters); the opening was read in full.\n\n> PHP2Shell nu e o problemă de plugin, de temă sau de cod scris prost. E în PHP însuși\n\n_Curator's translation:_ \"PHP2Shell is not a plugin problem, a theme problem or badly written code. It is in PHP itself\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ CriticaRad.ro gives a long timeline and patch guide. It says the Romanian Police website was replaced by a maintenance page and promises sections on Romania (Police, DNSC) and on Arad city hall running WordPress since 2021 (truncated). It also tabulates outages in Canada (ISED, Newfoundland and Labrador, STM, SAQ) and notes Red Hat scored the flaws 8.1 and NVD 9.8.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell | Panică mondială și ghidul complet de patch\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ro-RO`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "crn-news-security-2026-5-things-to-know-about-critical-php-vulne", "url": "https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation", "publisher": "CRN", "kind": "news", "title": "5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation", "published": "2026-10-21 or 22 (date not in the text; the page refers to Wednesday 21 October)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "ea917977ce1cc907be6710577f09f4f6fb7930fde089b9b561b16929a6cc5f29", "bytes": 1129 }, "page.html": { "sha256": "ad8778a2d65941aacd52ab7956825223c880e45dce2f520b8a306f4fa638777e", "bytes": 20501 }, "provenance.json": { "sha256": "1d1316087d11437f84575ac6924146390aeb14f6fe0a82a7a611303433b3bed7", "bytes": 1795 }, "rendered.html": { "sha256": "5b69e1301cecea73f059f3de8618d54f5e7fcca27a7438e9c1c9a765284d83b2", "bytes": 26203 }, "screenshot.jpg": { "sha256": "61d34da7242d0dae910cd0147dc16e695fd4f1abdc2085a46ec853e8fa42e899", "bytes": 7597 }, "text.txt": { "sha256": "7e2214693dddacf72cedf3f64ad2898acb80fbee6504be4f8122dd7ddb481ee5", "bytes": 5761 } }, "started_utc": "2026-10-23T08:10:26.323Z", "status": 200, "final_url": "https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a52c4edd6cf2301348db4cec9672a9b0fb7bcb13c6d3a31b78314f609b326633", "bytes": 1129 }, "page.html": { "sha256": "528bbf0ef5ce75006bd5e94b913b45700df4ae77705a3963609eeaaf1998563d", "bytes": 20508 }, "provenance.json": { "sha256": "a6d540748f65978d282b3e5320861b93d81a22559603d58214dcadca71371924", "bytes": 1931 }, "rendered.html": { "sha256": "bffe87329149352f6d910c41920965c0541d4519da14fbf53d6a4c676adcb3d1", "bytes": 27757 }, "screenshot.jpg": { "sha256": "61d34da7242d0dae910cd0147dc16e695fd4f1abdc2085a46ec853e8fa42e899", "bytes": 7597 }, "text.txt": { "sha256": "683aa11bc32c6b1012132894fc892d5321c56d9bb0fa24fef1ea74435e105a2b", "bytes": 5888 } }, "started_utc": "2026-10-23T16:10:05.576Z", "status": 200, "final_url": "https://www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). CRN's five things to know: two critical flaws, together called PHP2Shell, rated 9.2, allow unauthenticated remote code execution; PHP shipped updates on Wednesd...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/news/crn/news-security-2026-5-things-to-know-about-critical-php-vulne`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCRN's five things to know: two critical flaws, together called PHP2Shell, rated 9.2, allow unauthenticated remote code execution; PHP shipped updates on Wednesday after leaked details forced the release early; watchTowr said it was seeing active exploitation attempts against both; Huntress said it had not seen in-the-wild exploitation across its partners as of 10 a.m. Eastern on Wednesday. It notes that watchTowr's reporting did not identify the actors or how many organisations were compromised.\n\n> With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cryptoast-failles-critiques-php-php2shell-france-f", "url": "https://cryptoast.fr/failles-critiques-php-php2shell-france-freebox-que-faire/", "publisher": "Cryptoast", "kind": "news", "title": "Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?", "published": "2026-10-21T10:19:06+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "25cb83b8ab727a96e40ce9ac342ba0f8fd04868a7cbee2ac9b794ca4972f0567", "bytes": 1490 }, "page.html": { "sha256": "fbb4869ec546b9c3f7705381453c0902c483263b6eff5f333e7db1c3cc32df82", "bytes": 507386 }, "provenance.json": { "sha256": "b85e75f594ea82e06740d17bee3855347b33158ca7ab63c119bbd0fa734d877d", "bytes": 1625 }, "text.txt": { "sha256": "3555725ce40f48f75a5a97724389f85fcf69111a1417820913ceef24fd463208", "bytes": 8472 } }, "started_utc": "2026-10-23T16:14:49.267Z", "status": 200, "final_url": "https://cryptoast.fr/failles-critiques-php-php2shell-france-freebox-que-faire/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cryptoast (French), 21 October: two critical flaws threaten PHP servers; France appears especially exposed, notably because of Freebox devices. A firs...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/cryptoast/failles-critiques-php-php2shell-france-freebox-que-faire`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCryptoast (French), 21 October: two critical flaws threaten PHP servers; France appears especially exposed, notably because of Freebox devices. A first report placed France first among exposed countries with 60% of detected services worldwide, but the page says that figure was largely inflated by an error concerning the Freebox and must be put in perspective. It also asks what the real risks are and how to protect oneself. The page suggests readers check their exposure with the Infrawatch site or by asking an LLM such as Claude or ChatGPT; that is advice to human readers, noted as material and not acted on.\n\n> Mais ce chiffre, largement gonflé par une erreur concernant les Freebox, doit être relativisé.\n\n_Curator's translation:_ \"But this figure, largely inflated by an error concerning the Freeboxes, has to be put in perspective.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Cryptoast reports an Infrawatch study putting 6.62 million of 11 million detected PHP services worldwide in France (about 60%), mostly because of Freebox OS devices. It cautions that this does not mean French sites are vulnerable. A reader comment cites Numerama saying Freeboxes are not affected.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Faille php : 60% des sites impactés et la France en première ligne, que faire et faut-il s’inquiéter ?\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cryptoid-ciberseguranca-seguranca-da-informacao-i", "url": "https://cryptoid.com.br/ciberseguranca-seguranca-da-informacao/imperva-threat-research-analisa-falhas-criticas-do-php2shell/", "publisher": "CRYPTO ID", "kind": "news", "title": "Imperva Threat Research analisa falhas críticas do PHP2Shell", "published": "2026-10-22T20:32:18+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "adeb91fc07cd269b0243b727027e8a66bfd9ed5d0fa402be2c67072a908b2965", "bytes": 1047 }, "page.html": { "sha256": "adee6f36575ecdbd2f31b886048c90bd7cfb3dde48f36603e263a0dddcb9f4ac", "bytes": 398444 }, "provenance.json": { "sha256": "e91ee8962ce7a6a40f57f2c01f343ffcff27d63d9dc3e556c083f007b8cc82dd", "bytes": 1825 }, "rendered.html": { "sha256": "09c6e89be3da8655cb8afba92085a7d6fb4712e1bc7a9dc484e8882550f98696", "bytes": 505818 }, "screenshot.jpg": { "sha256": "1525fc69b16ad9b23139382d0e23ee5d34e05532c1505b9702d69a786083329e", "bytes": 1020900 }, "text.txt": { "sha256": "48a6133f8adb09ef37fa360f8a6bba01e64279bc2642ec7518562e9ede95c36d", "bytes": 26006 } }, "started_utc": "2026-10-23T16:11:19.291Z", "status": 200, "final_url": "https://cryptoid.com.br/ciberseguranca-seguranca-da-informacao/imperva-threat-research-analisa-falhas-criticas-do-php2shell/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt-BR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Crypto ID (Portuguese, Brazil), 22 October: Imperva Threat Research analyses the critical PHP2Shell flaws. It says researchers at Wiz, OpenAI and Cali...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Imperva Threat Research analisa falhas críticas do PHP2Shell\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/cryptoid/ciberseguranca-seguranca-da-informacao-imperva-threat-resear`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCrypto ID (Portuguese, Brazil), 22 October: Imperva Threat Research analyses the critical PHP2Shell flaws. It says researchers at Wiz, OpenAI and Calif disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the PHP runtime, and that Imperva's technical analysis describes five exploitation techniques. The curator did not copy the techniques into its notes; the capture itself holds the page.\n\n> Pesquisadores da Wiz, OpenAI e Calif divulgaram o PHP2Shell (CVE-2026-109618 e CVE-2026-109619), um conjunto de vulnerabilidades críticas de segurança de memória no ambiente de execução do PHP.\n\n_Curator's translation:_ \"Researchers from Wiz, OpenAI and Calif disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a set of critical memory-safety vulnerabilities in the PHP runtime.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Imperva Threat Research analisa falhas críticas do PHP2Shell\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt-BR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cumhuriyet-bilim-teknoloji-php-kaynakli-kritik-guve", "url": "https://www.cumhuriyet.com.tr/bilim-teknoloji/php-kaynakli-kritik-guvenlik-acigi-avrupa-da-devlet-okul-ve-hastanelerin-internet-siteleri-erisime-kapatildi-2549080", "publisher": "Cumhuriyet", "kind": "news", "title": "PHP kaynaklı kritik güvenlik açığı: Avrupa'da devlet, okul ve hastanelerin internet siteleri erişime kapatıldı - Son Dakika Bilim Teknoloji Haberleri | Cumhuriyet", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f8a224489e065398c4efc1aaecf9e6313360e39fe7a2addd045682f3683fe9f7", "bytes": 818 }, "page.html": { "sha256": "58b43f47ab4ed217db803d5819d42de2f96924849a15fc7c50cce5f8e3333950", "bytes": 314923 }, "provenance.json": { "sha256": "2d7662031f9f1a7661f47d77b9776fff3ed9bc3041f4e11a79717a7a283c13f0", "bytes": 2016 }, "rendered.html": { "sha256": "b3a9f728797d6304c43ee5b02146292fbb9f703fb156939fd74d5ab2f2b63d52", "bytes": 498126 }, "screenshot.jpg": { "sha256": "e82d974457c6267479da104f576f482b1f40781bfc73a611ad20b8bc5c318734", "bytes": 524648 }, "text.txt": { "sha256": "9b98d2728804d22f96b6fc43418e135bb46f1b70b6957bf8d245ef576f729f29", "bytes": 9603 } }, "started_utc": "2026-10-23T16:25:24.762Z", "status": 200, "final_url": "https://www.cumhuriyet.com.tr/bilim-teknoloji/php-kaynakli-kritik-guvenlik-acigi-avrupa-da-devlet-okul-ve-hastanelerin-internet-siteleri-erisime-kapatildi-2549080" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cumhuriyet (Turkish): the headline says the critical PHP flaw led to government, school and hospital websites in Europe being closed to access. The fl...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP kaynaklı kritik güvenlik açığı: Avrupa'da devlet, okul ve hastanelerin internet siteleri erişime kapatıldı - Son Dakika Bilim Teknoloji Haberleri | Cumhuriyet\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/cumhuriyet/bilim-teknoloji-php-kaynakli-kritik-guvenlik-acigi-avrupa-da`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCumhuriyet (Turkish): the headline says the critical PHP flaw led to government, school and hospital websites in Europe being closed to access. The flaws, called PHP2Shell, are assessed as high risk that can under certain conditions let attackers run code remotely without user authentication.\n\n> “PHP2Shell” olarak adlandırılan ve yüksek risk taşıyan güvenlik zafiyetlerinin, belirli koşullarda saldırganlara kullanıcı kimlik doğrulaması olmaksızın uzaktan kod çalıştırma imkânı sağlayabildiği değerlendiriliyor.\n\n_Curator's translation:_ \"The security vulnerabilities called 'PHP2Shell', which carry high risk, are assessed as able under certain conditions to give attackers the ability to run code remotely without user authentication.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Cumhuriyet relays Reuters' list of affected sites (Germany ITZBund, French prefectures, Belgian foreign ministry, Dutch organisations, Valtori, the Czech government, Wikimedia). It reports that Turkey's Cyber Security Presidency launched national preventive scans and sent an emergency notice via the SOME communication platform.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP kaynaklı kritik güvenlik açığı: Avrupa'da devlet, okul ve hastanelerin internet siteleri erişime kapatıldı - Son Dakika Bilim Teknoloji Haberleri | Cumhuriy\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cve-cve-2008-1447", "url": "https://cveawg.mitre.org/api/cve/CVE-2008-1447", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2008-1447 (DNS cache poisoning, Kaminsky)", "published": "2008-07-08T23:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2008-07-08.", "raw_sha256": { "cveawg-api.json": "4025bae38315c16e5ac26105365646c67c4bce58937a187a627274f023ff1501" }, "has_notes": true, "notes_md": "# CVE-2008-1447 (DNS cache poisoning, Kaminsky)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2008-07-08T23:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2012-1823", "url": "https://cveawg.mitre.org/api/cve/CVE-2012-1823", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2012-1823 (php-cgi query string)", "published": "2012-05-11T10:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2012-05-11.", "raw_sha256": { "cveawg-api.json": "fc02a593375ecc025b00f8c4ba49d3227cae19c5ed0c9b78f7771362355abdb0" }, "has_notes": true, "notes_md": "# CVE-2012-1823 (php-cgi query string)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2012-05-11T10:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2014-0160", "url": "https://cveawg.mitre.org/api/cve/CVE-2014-0160", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2014-0160 (Heartbleed)", "published": "2014-04-07T00:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-04-07.", "raw_sha256": { "cveawg-api.json": "b0b80e14890433984e302ac8c3e6fe5d1669bcd52dfd8bd52de6945a2d06dff9" }, "has_notes": true, "notes_md": "# CVE-2014-0160 (Heartbleed)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2014-04-07T00:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2014-6271", "url": "https://cveawg.mitre.org/api/cve/CVE-2014-6271", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2014-6271 (Shellshock)", "published": "2014-09-24T18:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-09-24.", "raw_sha256": { "cveawg-api.json": "5f9825de68cb0d172329bdc64da9bd93951aae29803454926d4be7d1ac6d609d" }, "has_notes": true, "notes_md": "# CVE-2014-6271 (Shellshock)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2014-09-24T18:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2017-5638", "url": "https://cveawg.mitre.org/api/cve/CVE-2017-5638", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2017-5638 (Apache Struts)", "published": "2017-03-11T02:11:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2017-03-11.", "raw_sha256": { "cveawg-api.json": "525b90b7605a6c18ccd4812dbc70dfdcf7f330374648173e0ade5fcb1e1b8d38" }, "has_notes": true, "notes_md": "# CVE-2017-5638 (Apache Struts)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2017-03-11T02:11:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2019-11043", "url": "https://cveawg.mitre.org/api/cve/CVE-2019-11043", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2019-11043 (PHP-FPM underflow)", "published": "2019-10-28T14:19:04.252Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2019-10-28.", "raw_sha256": { "cveawg-api.json": "e32115c5b48bca1c90fab5a125d64f9067e728bb3ac6e13939ee0886d267e526" }, "has_notes": true, "notes_md": "# CVE-2019-11043 (PHP-FPM underflow)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2019-10-28T14:19:04.252Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2021-44228", "url": "https://cveawg.mitre.org/api/cve/CVE-2021-44228", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2021-44228 (Log4Shell)", "published": "2021-12-10T00:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2021-12-10.", "raw_sha256": { "cveawg-api.json": "cae2ad45ea2739a59680c360555a538019b8f46199c797aed96fba49c073aa89" }, "has_notes": true, "notes_md": "# CVE-2021-44228 (Log4Shell)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2021-12-10T00:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2022-22965", "url": "https://cveawg.mitre.org/api/cve/CVE-2022-22965", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2022-22965 (Spring4Shell)", "published": "2022-04-01T22:17:30.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2022-04-01.", "raw_sha256": { "cveawg-api.json": "b38ff19768aa5757d264340669a3c06e4a78e5e2014c813bc509d052e2f267f3" }, "has_notes": true, "notes_md": "# CVE-2022-22965 (Spring4Shell)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2022-04-01T22:17:30.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2023-34362", "url": "https://cveawg.mitre.org/api/cve/CVE-2023-34362", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2023-34362 (MOVEit Transfer)", "published": "2023-06-02T00:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2023-06-02.", "raw_sha256": { "cveawg-api.json": "feae1a77086ce7533526a0f9d24afb4c67917deb3363569795ea4bbc57b2abbf" }, "has_notes": true, "notes_md": "# CVE-2023-34362 (MOVEit Transfer)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2023-06-02T00:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2024-4577", "url": "https://cveawg.mitre.org/api/cve/CVE-2024-4577", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2024-4577 (PHP-CGI argument injection)", "published": "2024-06-09T19:42:36.464Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2024-06-09.", "raw_sha256": { "cveawg-api.json": "e8cc1b1dcd1a3333776e9a0f08cd4543bc662e0ee60fc094bda0820f84b114eb" }, "has_notes": true, "notes_md": "# CVE-2024-4577 (PHP-CGI argument injection)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2024-06-09T19:42:36.464Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2026-109618", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109618", "publisher": "CVE Program (CNA: PHP Group)", "kind": "cve", "title": "CVE-2026-109618: RCE via OOM corruption", "published": "2026-10-21T13:48:34.845Z", "captures": [ { "stamp": "20261022T081218Z", "files": { "headers.json": { "sha256": "58be2c1dc484c3910605b35d9e612014fc4b6e0c9de9f605d6286d788fde6c7a", "bytes": 1500 }, "page.html": { "sha256": "a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50", "bytes": 880 }, "provenance.json": { "sha256": "adc09f106ba451478b387bb819c13df4cc15e0ac6f7ab6507a24175c8cc75458", "bytes": 952 }, "rendered.html": { "sha256": "37b9582087865e1776a98adadf13b2fd1cda169569affa0d7e113500697e5edb", "bytes": 146271 }, "screenshot.png": { "sha256": "bfb16ac90b930eabd692ee995fc41e848022b6b3ad486b96eaab255d08553229", "bytes": 341195 }, "text.txt": { "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "bytes": 3115 } }, "started_utc": "2026-10-22T08:12:18.626Z", "status": 200, "final_url": "https://www.cve.org/CVERecord?id=CVE-2026-109618" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVE record JSON in raw/ (cveawg API). dateReserved 2026-10-12T21:03:58Z, datePublished 2026-10-21T13:48:34Z, dateUpdated 2026-10-21T16:07:52Z at fetch. CISA ADP SSVC at 14:34Z: Exploitation none, Automatable no, Technical Impact total.", "raw_sha256": { "cveawg-api.json": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1" }, "has_notes": true, "notes_md": "# CVE-2026-109618 (cve.org record): notes\n- Page captured 08:12Z; raw/cveawg-api.json is the full CVE JSON 5.2 record, fetched 08:11Z.\n- CNA: PHP Group (assignerShortName \"php\"). Title \"RCE via OOM corruption\".\n- Description (verbatim): \"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\"\n- Affected: 8.2.* lessThan 8.2.35; 8.3.* lessThan 8.3.36; 8.4.* lessThan 8.4.27; 8.5.* lessThan 8.5.12; defaultStatus \"unaffected\".\n- CVSS v4.0 9.2, AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.\n- Reserved 2026-10-12T21:03:58Z; published 2026-10-21T13:48:34Z.\n- CISA ADP (Vulnrichment) SSVC 2026-10-21T14:34:39Z: Exploitation \"none\", Automatable \"no\", Technical Impact \"total\". ADP reference: https://www.wiz.io/blog/php2shell-php-rce.\n- Odd: defaultStatus \"unaffected\" means 7.4-8.1 read as unaffected in the record, though php.net published backports for 7.4/8.0/8.1 (see the oss-security reply from Greenbone).\n" }, { "slug": "cve-cve-2026-109619", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109619", "publisher": "CVE Program (CNA: PHP Group)", "kind": "cve", "title": "CVE-2026-109619: RCE via stale global state", "published": "2026-10-21T13:54:43.866Z", "captures": [ { "stamp": "20261022T081219Z", "files": { "headers.json": { "sha256": "03c46200ee6c4d6c0d0a06fdaae6fb0a376986fa48431cdc5543e5ae073ca8f7", "bytes": 1500 }, "page.html": { "sha256": "a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50", "bytes": 880 }, "provenance.json": { "sha256": "7de30cfb3eb2de89b08dcd062e6eee6c14efb0710ba248992dd2c1e2d3636335", "bytes": 952 }, "rendered.html": { "sha256": "83e446fe17d5717ad7f281973b506b4ba9e19b1b7cec8a4687132cd84419c71f", "bytes": 150334 }, "screenshot.png": { "sha256": "ae02d0aca995d93891d5bc181141c569b6b465a32272d727709884750ecdb50b", "bytes": 367927 }, "text.txt": { "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "bytes": 3351 } }, "started_utc": "2026-10-22T08:12:19.207Z", "status": 200, "final_url": "https://www.cve.org/CVERecord?id=CVE-2026-109619" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVE record JSON in raw/. dateReserved 2026-10-12T21:04:00Z, datePublished 2026-10-21T13:54:43Z, dateUpdated 2026-10-22T08:09:24Z (updated minutes before our fetch; CVE Program container lists oss-security refs incl. 22/2). CISA ADP SSVC: Exploitation none.", "raw_sha256": { "cveawg-api.json": "d045248b93425b1a6f5a0fc29ae36b5cfcd3c8188d969664a0d8e5f82ff05f61" }, "has_notes": true, "notes_md": "# CVE-2026-109619 (cve.org record): notes\n- Captured 08:12Z; raw/cveawg-api.json fetched 08:11Z.\n- CNA PHP Group. Title \"RCE via stale global state\".\n- Description (verbatim): \"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).\"\n- Affected ranges identical to 109618 (8.2 <8.2.35, 8.3 <8.3.36, 8.4 <8.4.27, 8.5 <8.5.12). CVSS v4.0 9.2, same vector.\n- Reserved 2026-10-12T21:04:00Z; published 2026-10-21T13:54:43Z; updated 2026-10-22T08:09:24Z.\n- CISA ADP SSVC 14:34:42Z: Exploitation \"none\". CVE Program container references oss-security 2026/10/21/7, /16, /17, /23, 2026/10/22/2.\n- Same 7.4-8.1 caveat as 109618.\n" }, { "slug": "cybelangel-php2shell", "url": "https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/", "publisher": "CybelAngel", "kind": "vendor", "title": "What We Know About php2shell [Critical update]", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112625Z", "files": { "headers.json": { "sha256": "434967eca3ae83ed546f2b8d4839eeb91ca1b11c8740be1e1e1f3864d5e4f809", "bytes": 1530 }, "page.html": { "sha256": "842333792c959891233e6290ecc0857bfd361fbc9dfb4b377a8325657855a025", "bytes": 169382 }, "provenance.json": { "sha256": "d2e13e8d5bd7b15ee078cbe727f55708366293caa3c4a68445ce1fbd5e206201", "bytes": 1070 }, "rendered.html": { "sha256": "538f2982edeb0859af905cbcf0dc02f6899dcd997e9a7245917ad53e04faa993", "bytes": 174398 }, "screenshot.png": { "sha256": "64c9ca6ef1602bd645b956fe272f9fcb7d3d50ec0f24b4af5b980edfc9e424d5", "bytes": 1631217 }, "text.txt": { "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "bytes": 12396 } }, "started_utc": "2026-10-22T11:26:25.691Z", "status": 200, "final_url": "https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/" }, { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "1a38444e12276d485a486ff2478223ca35a712bbd70cc396518429325a2c18a8", "bytes": 1589 }, "page.html": { "sha256": "539f25deb86fd869eff5280eb233aecdf91aadf766474642003997c12011d500", "bytes": 169023 }, "provenance.json": { "sha256": "316491b54670c17c085c97aa9f967c338bee879e696d92b7ebb62e8276da110c", "bytes": 1646 }, "text.txt": { "sha256": "b335c33cfede719c4c86aed963aaaf343c09a0cedb6aa6b6b169c806909e9222", "bytes": 12795 } }, "started_utc": "2026-10-24T08:48:02.601Z", "status": 200, "final_url": "https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer; Cloudflare CTO 07:43 UTC early attacks; Aikido reporting exploitation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# What We Know About php2shell [Critical update]\n\nCaptured by claude-story-site. Status: captured. Vendor explainer; Cloudflare CTO 07:43 UTC early attacks; Aikido reporting exploitation.\n\n- Captured for the 07:43 UTC reference.\n" }, { "slug": "cyber-gov-au-site", "url": "https://www.cyber.gov.au/", "publisher": "cyber.gov.au", "kind": "government", "title": null, "published": null, "captures": [ { "stamp": "20261022T081951Z", "files": { "provenance.json": { "sha256": "42c2c30f7de1649cf0873e3cf2759758856b8ebd94fa2254f3b4ca2961c3f876", "bytes": 447 } }, "started_utc": "2026-10-22T08:19:51.133Z", "error": "page.goto: net::ERR_ABORTED at https://www.cyber.gov.au/" } ], "status": "failed", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "cyberdaily-security-14335-php2shell-do-you-know-whe", "url": "https://www.cyberdaily.au/security/14335-php2shell-do-you-know-where-all-your-servers-are", "publisher": "Cyber Daily", "kind": "news", "title": "PHP2Shell: Do you know where all your servers are? - Cyber Daily", "published": "2026-10-21T23:34:41", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "90529666cfc152e4476c9634261af9c652683c426ba6fa206049e848733ffb72", "bytes": 957 }, "page.html": { "sha256": "f37018e53c1304d9a7d866bf09a81003673261315fffb3c9df07f099796dae8a", "bytes": 109990 }, "provenance.json": { "sha256": "0cfe1dda8a897600f65d34da0ec2caeaa4b798489d225d0fedf1b79c63f2daa9", "bytes": 1760 }, "rendered.html": { "sha256": "251224e691ba61314010b87923df6e8a8f21ebb89e4685b86c825b744d38babb", "bytes": 135788 }, "screenshot.jpg": { "sha256": "2b7285302943b6fe11665cf0902172032afc1ccbc995b44933b4c3742c3819d8", "bytes": 461720 }, "text.txt": { "sha256": "9e1c2a12df93c53f9d8ea8de8e7efe039f8fa8f900dc4f0e70ec69df692f5bfb", "bytes": 5456 } }, "started_utc": "2026-10-23T08:10:27.997Z", "status": 200, "final_url": "https://www.cyberdaily.au/security/14335-php2shell-do-you-know-where-all-your-servers-are" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-gb", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Daily (Australia), 21 October: do you know where all your servers are? It quotes watchTowr's head of threat intelligence that watchTowr Intel is...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Do you know where all your servers are? - Cyber Daily\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/cyberdaily/security-14335-php2shell-do-you-know-where-all-your-servers`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCyber Daily (Australia), 21 October: do you know where all your servers are? It quotes watchTowr's head of threat intelligence that watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities, with a variety of 'vibecoded' proofs of concept hitting its sensors with 'php2shell' user agents, and a CISA statement urging organisations to patch the two flaws immediately, which it says allow unauthenticated remote code execution and affect all PHP installations serving web requests.\n\n> CISA strongly urges organisations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Do you know where all your servers are? - Cyber Daily\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-gb`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cyberexpress-php2shell-gov-sites", "url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/", "publisher": "The Cyber Express", "kind": "news", "title": "PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112646Z", "files": { "headers.json": { "sha256": "12ba694e03c07c68e519eee401b1f3c26bbbf5e314d5681dd8dee8202a9ddc2b", "bytes": 1486 }, "page.html": { "sha256": "58d2d840bcff4c80b422282f8358fded7d8d4a8a0ae0005b66dd7ce51049222d", "bytes": 567233 }, "provenance.json": { "sha256": "b259cfb46f07df0edf091ae5b56f255c93846d9656a80d9adbe65e6aa496349f", "bytes": 1017 }, "rendered.html": { "sha256": "ed8d3c7588accfa0810ec2d054a01b00bf1c8783e9100bc6f46557783e623fa5", "bytes": 598469 }, "screenshot.png": { "sha256": "d80c357eed47fd016ffe1e5a7866573916c9044f011f6e0e3c7b2487c93d296a", "bytes": 18579851 }, "text.txt": { "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "bytes": 14589 } }, "started_utc": "2026-10-22T11:26:46.647Z", "status": 200, "final_url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "e2ada00fbdd0d42fbb924df1dfe2167b6d88f3feff9657a2396e6be27449c6d1", "bytes": 1564 }, "page.html": { "sha256": "e92663a6c78adba74cb4ca9a632159bd091e5570407b27e3d6b1c2865c6b0b70", "bytes": 566375 }, "provenance.json": { "sha256": "9fba84683d5840fa5780c5151f4e98e7f5edc33988a964cbc89be215aeecb71b", "bytes": 1790 }, "rendered.html": { "sha256": "ea5c41ea0cc5c6859e3176190e29af9fbdbbcab4a0a50482ed77579eae1d3cf0", "bytes": 573204 }, "screenshot.jpg": { "sha256": "2e75823faf50087d879d1f79ea0820136d1c83552570c7099a7ea02fd2e4fba3", "bytes": 418655 }, "text.txt": { "sha256": "a638610541cb7ce3d786cb0053e383e2f09cbdf5d6ed8f33fb1899421505ae71", "bytes": 7494 } }, "started_utc": "2026-10-23T16:28:23.166Z", "status": 200, "final_url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Wikimedia quote; government sites hit.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites\n\nCaptured by claude-story-site. Status: captured. Secondary: Wikimedia quote; government sites hit.\n\n- Captured for the Wikimedia quote.\n" }, { "slug": "cyberkendra-2026-10-php2shell-cve-2026-109618-cve-20", "url": "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "publisher": "cyberkendra.com", "kind": "news", "title": "PHP2Shell: Critical PHP Flaws Allow Remote Code Execution - Cyber Kendra", "published": "2026-10-21T17:11:07+05:30", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "7dad2c91f42ed630bf23e79a47c21e00141f045c6a40cdb04e3a57b6e5dc91ae", "bytes": 1204 }, "page.html": { "sha256": "d89dde81d5860f6910890f9273ade96fc531dcdf66682e30cb15f596829303d8", "bytes": 334670 }, "provenance.json": { "sha256": "3743bd1d229f0774d12ad1bc645074d0c76d73bea1c7e3c8eff34784432dc81c", "bytes": 1599 }, "text.txt": { "sha256": "c604df6084ae12123c45d972380fb4ef9be0d787f0ef685f9be4161ce9bf5065", "bytes": 13305 } }, "started_utc": "2026-10-23T08:11:02.424Z", "status": 200, "final_url": "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Kendra: an explainer on the two PHP flaws allowing remote code execution, organised as questions (what is PHP2Shell and how does it work, who di...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Critical PHP Flaws Allow Remote Code Execution - Cyber Kendra\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/cyberkendra/2026-10-php2shell-cve-2026-109618-cve-2026-109619-html`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCyber Kendra: an explainer on the two PHP flaws allowing remote code execution, organised as questions (what is PHP2Shell and how does it work, who discovered it). The opening headlines were read; the detailed sections were not read closely.\n\n> PHP2Shell: Critical PHP Flaws Allow Remote Code Execution\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Cyber Kendra (English-language text, though tagged nl) explains PHP2Shell, its disclosure timeline and the fixed versions. It lists vendor and distribution advisories (Ubuntu, Debian, Red Hat, AlmaLinux, Arch, Docker, Plesk) and exposure estimates, and cites the Dutch NCSC's tracker of affected PHP-dependent products.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Critical PHP Flaws Allow Remote Code Execution - Cyber Kendra\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cybernews-php2shell-millions", "url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/", "publisher": "Cybernews", "kind": "news", "title": "PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernews", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112703Z", "files": { "headers.json": { "sha256": "6be6626f1e9d0a6627adcf4b3cfe7e0e3fbc8107a1ef9772318e3b2f95ccfc6b", "bytes": 2119 }, "page.html": { "sha256": "c66a7d30501a36b114a61e46813ab2e0d7ec2dfa4d5fb106f8c5a9ff50ef69b6", "bytes": 264681 }, "provenance.json": { "sha256": "fd6fc60ea011e77252fb66fb924fa6ded42288362364dea1c51a872c9f0a80d3", "bytes": 1087 }, "rendered.html": { "sha256": "396bc3073c8b12fb2dc2ed624d0f38b6fc6dbf885f976267d2e1c0b5b47ef108", "bytes": 268472 }, "screenshot.png": { "sha256": "4593aadc41abb1ffd9875242e346506becf26679a960c352c74a1b52d2c5f956", "bytes": 2513246 }, "text.txt": { "sha256": "a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb", "bytes": 7502 } }, "started_utc": "2026-10-22T11:27:03.688Z", "status": 200, "final_url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "4e8e2efb43541e36370de273e301a9f0288f6c44ec1032da71cd8de7eecf1a85", "bytes": 2191 }, "page.html": { "sha256": "c4ed88ee4af3cc60dc4b43f9236d3b8042b9812d6c33e02158b28c0a8cd0bce2", "bytes": 263294 }, "provenance.json": { "sha256": "0465d653f19e978ef259a2e553fc0a5979e4909bf2a5e699dbc4ccd248dba0b0", "bytes": 1735 }, "rendered.html": { "sha256": "7f0a9563f66c95eb6c0a71a9392dedb45aaf5d4954364b304c9e9bfb35959560", "bytes": 255030 }, "text.txt": { "sha256": "0f0dd44e1980b36b9f39fb0783637f6ac2b9b5b382ca840f299c5c49cfaf990d", "bytes": 7503 } }, "started_utc": "2026-10-23T16:22:09.684Z", "status": 200, "final_url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Cloudflare and Amazon warnings; millions of attempts.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernews\n\nCaptured by claude-story-site. Status: captured. Secondary: Cloudflare and Amazon warnings; millions of attempts.\n\n- Captured for the record.\n" }, { "slug": "cyberpress-php2shell-exploits-predate-patches", "url": "https://cyberpress.org/php2shell-exploits-predate-patches/", "publisher": "Cyber Press", "kind": "news", "title": "Attackers Were Already Testing PHP2Shell Exploits Before Security Patches Arrived", "published": "2026-10-22", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "20c04a3d41af56d86347bb820ae1b3865f963eafe5fd3bb50b175cd0cc0bd4e0", "bytes": 776 }, "page.html": { "sha256": "001fe3a7eb405f7bf74d993215bc7a52d562588957aa9705bc0e07e910ca5157", "bytes": 359318 }, "provenance.json": { "sha256": "ea60f0b4e9e23765027dafd072ec31be85645474041e5e4f730ef9a9f5fc7180", "bytes": 1661 }, "rendered.html": { "sha256": "00e7c15d9a47cf033cb43272da3ba496ab76779223e5fff60dc4240ba78557ac", "bytes": 951809 }, "screenshot.jpg": { "sha256": "61cab329704a88f174646719bcd1551995d92a24acc0296662d58141c0a7cf28", "bytes": 548378 }, "text.txt": { "sha256": "89f109c027b1ff22badfe13405d7857d8b07cd088afa1d99799fcb33226cc3bc", "bytes": 7029 } }, "started_utc": "2026-10-23T08:10:28.012Z", "status": 200, "final_url": "https://cyberpress.org/php2shell-exploits-predate-patches/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). A secondary report of Amazon's honeypot findings: the earliest exploitation attempt hit Amazon's MadPot telemetry on 17 October, four days before disclosure, fr...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Attackers Were Already Testing PHP2Shell Exploits Before Security Patches Arrived\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/news/cyberpress/php2shell-exploits-predate-patches`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nA secondary report of Amazon's honeypot findings: the earliest exploitation attempt hit Amazon's MadPot telemetry on 17 October, four days before disclosure, from an IP linked to a commercial anonymisation network; the embargo was due to end at 14:00 UTC on 21 October; the first proof-of-concept exploits Amazon saw appeared around 02:00 UTC that day. Investigators have not established how the attacker got exploit information, nor whether the attempts would have compromised real systems.\n\n> investigators have not established how the attacker obtained exploit information before disclosure.\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cyberscoop-php-emergency-patches-php2shell-vulnerab", "url": "https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/", "publisher": "CyberScoop", "kind": "news", "title": "PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop", "published": "2026-10-21T13:40:02+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "132a87949576cdc8b3ac2069289946e817c17f1d514c1266576898c761f0b95b", "bytes": 1299 }, "page.html": { "sha256": "ebb0cbafb6697ef41f9e96f40eb2b03c2ff96ec9423d085309271547f11b19b7", "bytes": 123757 }, "provenance.json": { "sha256": "f3e09f446895f9f72670f284d28292ce6e9d5a5cf33c53a57974f6f9bf3105c1", "bytes": 1708 }, "rendered.html": { "sha256": "273a4a14c7b6895e3699b3018f98ca49723d3880b97537783f791cdab1c4cdcc", "bytes": 144434 }, "screenshot.jpg": { "sha256": "ece2fc2ced31eb8a6679c2f865eab8f6a330f61a70ddbef6fea93157169f4a88", "bytes": 915217 }, "text.txt": { "sha256": "b47b3a5031e3f0801e4df342b9542ec8aa684842f98b4f6b6c30920346d917af", "bytes": 11200 } }, "started_utc": "2026-10-23T16:17:03.537Z", "status": 200, "final_url": "https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). CyberScoop, 21 October: PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, both 9.2 on CVSS v4.0, described by researchers as remot...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ie/news/cyberscoop/php-emergency-patches-php2shell-vulnerabilities`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCyberScoop, 21 October: PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, both 9.2 on CVSS v4.0, described by researchers as remote code execution flaws that could let an attacker run code on a server and potentially take control. It says that, after 24 hours of alarm, there had been very little reported exploitation as of Wednesday afternoon.\n\n> there has been very little in terms of reported exploitation as of Wednesday afternoon\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP releases emergency fixes for 2 critical vulnerabilities | CyberScoop\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cybersecitalia-lalert-dellacn-in-italia-a-rischio-vulne", "url": "https://www.cybersecitalia.it/lalert-dellacn-in-italia-a-rischio-vulnerabilita-oltre-250mila-servizi-php-fare-subito-laggiornamento-php-e-uno-dei-linguaggi-per-far-funzionare-gran-pa/70850/", "publisher": "cybersecitalia", "kind": "news", "title": "PHP2Shell, alert di ACN: \"Aggiornare subito, l'ha fatto solo il 18%\"", "published": "2026-10-25T18:15:20+00:00", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "0d36b86d8495e6509f5cb48d3d255cbfb1611622f5799c804a69bc4ae5d5062d", "bytes": 674 }, "page.html": { "sha256": "ba3f6290ee593c628f93838ac386745620e214348f5b99532bf656e111e6373e", "bytes": 110945 }, "provenance.json": { "sha256": "47b2e25cb5fc6a0e284d2fa7d96809ee6384d5146a7cf09946a86e8d472223fd", "bytes": 1980 }, "rendered.html": { "sha256": "dc77814d7e318effa98da374b54c60cc472da467553f1c794af7dad9da20e563", "bytes": 111488 }, "screenshot.jpg": { "sha256": "b8cda17488cbeebd1305a7ac3bd4b6108f2e32c7f78574ecec1e2f8c6e52e90b", "bytes": 623112 }, "text.txt": { "sha256": "c5478d9c72c64e69317c156a7a30c0e6305950990b191fa8ebfcab2e4e4b08d9", "bytes": 8288 } }, "started_utc": "2026-10-26T07:25:29.151Z", "status": 200, "final_url": "https://www.cybersecitalia.it/lalert-dellacn-in-italia-a-rischio-vulnerabilita-oltre-250mila-servizi-php-fare-subito-laggiornamento-php-e-uno-dei-linguaggi-per-far-funzionare-gran-pa/70850/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). CyberSecItalia (Italian), 25 October, on an alert by Italy's National Cybersecurity Agency (ACN). From CSIRT Italia monitoring, ACN says 81.9% of PHP...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, alert di ACN: \"Aggiornare subito, l'ha fatto solo il 18%\"\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/cybersecitalia/lalert-dellacn-in-italia-a-rischio-vulnerabilita-oltre-250mi`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCyberSecItalia (Italian), 25 October, on an alert by Italy's National Cybersecurity Agency (ACN). From CSIRT Italia monitoring, ACN says 81.9% of PHP services with an identified version are potentially vulnerable; four days after the release, of 741,523 PHP services detected, 285,149 ran potentially vulnerable versions, and only about 18% of the Italian entities concerned had updated. ACN urges immediate updates, WAFs in blocking mode where rules exist, and taking services offline absent effective mitigations. The alert also names a further PHP flaw, CVE-2026-115560, with no patch yet; ACN says the fixes already issued for the first two do not resolve it and that the vendor has given a mitigation pending a patch. Exploitation conditions are left out of the notes.\n\n> emerge che l’81,9% dei servizi PHP con versione identificata risulta potenzialmente vulnerabile a PHP2Shell\n\n_Curator's translation:_ \"it emerges that 81.9% of PHP services with an identified version are potentially vulnerable to PHP2Shell.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, alert di ACN: \"Aggiornare subito, l'ha fatto solo il 18%\"\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cybersecurity360-nuove-minacce-php2shell-due-vulnerabilit", "url": "https://www.cybersecurity360.it/nuove-minacce/php2shell-due-vulnerabilita-critiche-in-php-come-proteggere-i-server-in-attesa-delle-patch/", "publisher": "Cyber Security 360", "kind": "news", "title": "PHP2Shell: due vulnerabilità critiche in PHP, cosa fare", "published": "2026-10-21T15:29:45+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9910a96dcb71c952c1036348a4eea7be6f29e39019625439c524d5c3cccbe103", "bytes": 1371 }, "page.html": { "sha256": "d7ebc69bddc8d2130edd2603681f9121c774f293f64dd4d14f41102fe1dd3bcb", "bytes": 269744 }, "provenance.json": { "sha256": "0c47216fa06fc1c1cfd3a714c0643d54f5d92657c4ff273d4aa0e846dd637a22", "bytes": 1870 }, "rendered.html": { "sha256": "a0dae4452ba2ee230c7e48872331e6b44239a3dfdecaed27ca6d6827a0a69f8e", "bytes": 291785 }, "screenshot.jpg": { "sha256": "77abb72e2d08e0bca4c352d08a7850f07643d38bf7e7ce1e22e5bcf0c0759def", "bytes": 282297 }, "text.txt": { "sha256": "fc26cae83a8229935b33de6b9e2b25fc7389acdafaccc99c480ee1d7e259e2a1", "bytes": 4312 } }, "started_utc": "2026-10-23T16:18:45.383Z", "status": 200, "final_url": "https://www.cybersecurity360.it/nuove-minacce/php2shell-due-vulnerabilita-critiche-in-php-come-proteggere-i-server-in-attesa-delle-patch/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Security 360 (Italian), 21 October: the PHP Security Team released emergency patches on 21 October 2026 for the two critical vulnerabilities, pu...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: due vulnerabilità critiche in PHP, cosa fare\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/cybersecurity360/nuove-minacce-php2shell-due-vulnerabilita-critiche-in-php-co`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCyber Security 360 (Italian), 21 October: the PHP Security Team released emergency patches on 21 October 2026 for the two critical vulnerabilities, publicly known as PHP2Shell; the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with advice on protecting servers.\n\n> Il PHP Security Team ha rilasciato il 21 ottobre 2026 le patch d’emergenza per due vulnerabilità critiche\n\n_Curator's translation:_ \"The PHP Security Team released the emergency patches on 21 October 2026 for two critical vulnerabilities\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Cybersecurity360 headline and standfirst: the PHP Security Team released emergency patches for two CVSS 9.2 vulnerabilities (PHP2Shell) on 21 October, with advice on protecting servers.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: due vulnerabilità critiche in PHP, cosa fare\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "cybersecuritynews-critical-php2shell-exploit-code", "url": "https://cybersecuritynews.com/critical-php2shell-exploit-code/", "publisher": "Cyber Security News", "kind": "news", "title": "Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware", "published": "2026-10-23T13:00:37+00:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "c2e8689358dbf7b38aa3ec2067e61aaeef9147c21d44015d423a884b38810a23", "bytes": 832 }, "page.html": { "sha256": "7f3dcbd4d3c7e25240082aa2e00fe20993ef586981503037c91f02447a353614", "bytes": 370240 }, "provenance.json": { "sha256": "f4dc56063e5c384685f772f851bd51d87de146e84b52cd6809e656df4f54dea4", "bytes": 1685 }, "rendered.html": { "sha256": "764d554a8bf9a1fb726baa71c11fc82fd5451a59bd869af79cb34da332b530ae", "bytes": 1268050 }, "screenshot.jpg": { "sha256": "750b488bb22505b3aab3df88474d497cd183672b54f865ef490e95b366cc87e8", "bytes": 786589 }, "text.txt": { "sha256": "bdf6e94a1a8a118b2f1a5546ec71c6eda552a7289fb2b15ed34885ddcbfa89ac", "bytes": 9743 } }, "started_utc": "2026-10-23T23:27:53.734Z", "status": 200, "final_url": "https://cybersecuritynews.com/critical-php2shell-exploit-code/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Cyber Security News, 23 October: exploit code has gone public and hackers are attempting to deploy botnet malware through PHP2Shell. One attempt tried...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/cybersecuritynews/critical-php2shell-exploit-code`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCyber Security News, 23 October: exploit code has gone public and hackers are attempting to deploy botnet malware through PHP2Shell. One attempt tried to drop a botnet variant; security controls blocked it, so the malware was not delivered, and analysis of the sample showed a larger, updated version of a Mirai-derived threat seen earlier in 2026. It says the Dutch NCSC notes Apache mod_php carries the highest risk because exploitation can occur before application code starts running, and that PHP, FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed installs are affected. The curator did not fetch the exploit code the page refers to; the capture only holds the article.\n\n> Security controls blocked the attempt, so the malware was not delivered.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "dailynews-news-6303237", "url": "https://www.dailynews.co.th/news/6303237/", "publisher": "เดลินิวส์", "kind": "news", "title": "“อ.นพดล” เตือนภัยไซเบอร์ “PHP2Shell” จี้รัฐอุดช่องโหว่เสี่ยงกระทบเว็บไซต์-แอปฯ | เดลินิวส์", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T120459Z", "files": { "headers.json": { "sha256": "286a01c3f15d12863bd497705e7d33304ba81a9c479202a6a76513fc1b618a95", "bytes": 577 }, "page.html": { "sha256": "722cbb8c85dfba2b8f33cbb61868471bddd31782292124e8b8af9645bd985960", "bytes": 406890 }, "provenance.json": { "sha256": "cf7dfcd7c7531721024991fc9469c8230736fd146f6c3f3048e296bbc6e725a4", "bytes": 1711 }, "rendered.html": { "sha256": "96b9342ad40f3fb1488e146d3d2ecf6be3b691bf3a3ab54d50e400e2aad88969", "bytes": 465760 }, "screenshot.jpg": { "sha256": "ff9b53252bc631c612be577e1515386bf6e56d9bec8c77ad95aa376176be459d", "bytes": 573006 }, "text.txt": { "sha256": "efb5d7c4f675b0604302224dcb8bf6fb6bb034017c07ae67aa10d64fc63be1aa", "bytes": 17511 } }, "started_utc": "2026-10-25T12:25:27.321Z", "status": 200, "final_url": "https://www.dailynews.co.th/news/6303237/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "th", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Daily News (Thai), 25 October: a Thai academic and former adviser to the Ombudsman warns of the PHP2Shell cyber threat and urges the state to close th...", "raw_sha256": {}, "has_notes": true, "notes_md": "# “อ.นพดล” เตือนภัยไซเบอร์ “PHP2Shell” จี้รัฐอุดช่องโหว่เสี่ยงกระทบเว็บไซต์-แอปฯ | เดลินิวส์\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `th/news/dailynews/news-6303237`, snapshot `20261025T120459Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T120459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDaily News (Thai), 25 October: a Thai academic and former adviser to the Ombudsman warns of the PHP2Shell cyber threat and urges the state to close the hole before websites and apps are affected. A commentary piece; the curator did not copy the academic's name.\n\n> เตือนภัยไซเบอร์ “PHP2Shell” จี้รัฐอุดช่องโหว่เสี่ยงกระทบเว็บไซต์-แอปฯ\n\n_Curator's translation:_ \"Cyber warning 'PHP2Shell': urges the state to plug the hole that risks affecting websites and apps\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"“อ.นพดล” เตือนภัยไซเบอร์ “PHP2Shell” จี้รัฐอุดช่องโหว่เสี่ยงกระทบเว็บไซต์-แอปฯ | เดลินิวส์\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `th`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "dailysecu-news-articleview-html", "url": "https://www.dailysecu.com/news/articleView.html?idxno=208979", "publisher": "데일리시큐", "kind": "news", "title": "[긴급] PHP2Shell 취약점에 웹서버 보안 비상…긴급 설정 점검과 업데이트 필수 < 긴급속보 < 이슈 < 기사본문 - 데일리시큐", "published": "2026-10-22T08:14:55+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c4d8b5fa4496115b9056cb891943b9464f988834ce34e1ef9ed0af5fe9f99786", "bytes": 354 }, "page.html": { "sha256": "7d12632c17f4eef5a36f1188c0f7fed81fbd6ef18d0dc1aad2fd56a6268a0afe", "bytes": 105584 }, "provenance.json": { "sha256": "05414c9fd58a572fc405110961ef9bafc2832f69b1fe274dae7a3e846640d24c", "bytes": 1550 }, "text.txt": { "sha256": "19d4370c2b96aaf5cdfaa3fe3ef54788933a7746232e61a19971e6a5b22c2fac", "bytes": 11927 } }, "started_utc": "2026-10-23T16:21:22.129Z", "status": 200, "final_url": "https://www.dailysecu.com/news/articleView.html?idxno=208979" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Daily Secu (Korean), 22 October: PHP2Shell puts web servers on emergency; urgent configuration checks and updates are essential. It cites the PHP proj...", "raw_sha256": {}, "has_notes": true, "notes_md": "# [긴급] PHP2Shell 취약점에 웹서버 보안 비상…긴급 설정 점검과 업데이트 필수 < 긴급속보 < 이슈 < 기사본문 - 데일리시큐\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/dailysecu/news-articleview-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDaily Secu (Korean), 22 October: PHP2Shell puts web servers on emergency; urgent configuration checks and updates are essential. It cites the PHP project's security advisory (from PHP's official GitHub) on the out-of-memory remote code execution flaw CVE-2026-109618, classed 'critical', with fixed versions listed for each supported branch.\n\n> PHP 프로젝트가 공개한 메모리 부족 처리 관련 원격 코드 실행 취약점(CVE-2026-109618) 보안 공지.\n\n_Curator's translation:_ \"The PHP project's security advisory on the out-of-memory-handling remote code execution vulnerability (CVE-2026-109618).\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ DailySecu (Korea) explainer of the official mitigations: disable session.upload_progress, restrict multipart uploads, update to the fixed versions.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"[긴급] PHP2Shell 취약점에 웹서버 보안 비상…긴급 설정 점검과 업데이트 필수 < 긴급속보 < 이슈 < 기사본문 - 데일리시큐\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "dantri-cong-nghe-doanh-nghiep-can-lam-gi-de-bao", "url": "https://dantri.com.vn/cong-nghe/doanh-nghiep-can-lam-gi-de-bao-ve-trang-web-truoc-lo-hong-php-20261022215438274.htm", "publisher": "Báo Dân trí", "kind": "news", "title": "Doanh nghiệp cần làm gì để bảo vệ trang web trước lỗ hổng PHP? | Báo Dân trí", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "63980333d23c590682e6da5af1c99616da099c94c5929145e1af3af845321a80", "bytes": 961 }, "page.html": { "sha256": "9aa26e3d298b998365b99aec161eb969b51a3c87057dff5174240e1020d93614", "bytes": 540691 }, "provenance.json": { "sha256": "e0bf707ad80dde9478336395d5879ec62e34af4c8fa42ca68b62ee48295af176", "bytes": 1835 }, "rendered.html": { "sha256": "236b4f8c0674ece42a78e37cab56c13679106c5c04fd98e5f18087a8ce964d42", "bytes": 560364 }, "screenshot.jpg": { "sha256": "31d1aa96c8fe2c5321564ee4bf7e24a84001ec1017860dcfda2f8dd68cae28cf", "bytes": 394408 }, "text.txt": { "sha256": "1272489402a4668bb5c1d97dbbe1c8ecc83a596ab269b1745d6e0aebe32a62ff", "bytes": 7540 } }, "started_utc": "2026-10-24T09:05:11.599Z", "status": 200, "final_url": "https://dantri.com.vn/cong-nghe/doanh-nghiep-can-lam-gi-de-bao-ve-trang-web-truoc-lo-hong-php-20261022215438274.htm" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "vi", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Dan Tri (Vietnamese): what businesses should do to protect their websites. It cites Vietnam's Cyber Security Department and National Cyber Security As...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Doanh nghiệp cần làm gì để bảo vệ trang web trước lỗ hổng PHP? | Báo Dân trí\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `vn/news/dantri/cong-nghe-doanh-nghiep-can-lam-gi-de-bao-ve-trang-web-truoc`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDan Tri (Vietnamese): what businesses should do to protect their websites. It cites Vietnam's Cyber Security Department and National Cyber Security Association (NCA) that the two flaws have official patches, and describes PHP2Shell as a group of problems with how PHP manages memory, exploitable in different ways, in some cases within seconds, to run unauthorised code on unpatched servers.\n\n> Theo thông tin từ Cục An ninh mạng và Hiệp hội An ninh mạng quốc gia (NCA), hai lỗ hổng bảo mật mang mã CVE-2026-109618 và CVE-2026-109619 trong ngôn ngữ lập trình PHP đã có bản vá chính thức.\n\n_Curator's translation:_ \"According to the Cyber Security Department and the National Cyber Security Association (NCA), the two vulnerabilities CVE-2026-109618 and CVE-2026-109619 in the PHP programming language now have official patches.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Doanh nghiệp cần làm gì để bảo vệ trang web trước lỗ hổng PHP? | Báo Dân trí\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `vi`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "darkreading-php2shell-red-alert", "url": "https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry", "publisher": "Dark Reading", "kind": "news", "title": "'PHP2Shell' Bugs Signal Red Alert for Security Industry", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112357Z", "files": { "headers.json": { "sha256": "285a1d8359a3246821411a25457fe0ebe5714a3f3b64d2b0d9594549c5e28ee8", "bytes": 1005 }, "page.html": { "sha256": "6a65a719cc37abf4198febfdb8afedb400656bbab8a87ecbf7979436acde2db7", "bytes": 451026 }, "provenance.json": { "sha256": "0f49ff38cf40ae508792e69a36322fd852a90a413670686eb09c7abc3bab0e2a", "bytes": 1078 }, "rendered.html": { "sha256": "94b8a23834d88b4202c8131505e4bb6abb7c27095cd873031af7f721a4d155f3", "bytes": 470067 }, "screenshot.png": { "sha256": "2672b1f34bea1f587b758b2d846512d528d66179b9c6267f491669fb7287326e", "bytes": 2410017 }, "text.txt": { "sha256": "6db30e279f5f38773c58ae71e0d753d7a7f90fcf4148ea65658c2f967de7f32d", "bytes": 10175 } }, "started_utc": "2026-10-22T11:23:57.547Z", "status": 200, "final_url": "https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "72df8aa89cbb5c7e5d5cbb6011981299458c74567325722bc52cc45474d4e485", "bytes": 744 }, "page.html": { "sha256": "0339585f258f5f1b4e38e7ebf78e4789002c2863cdf160f611515ba0cecd3a40", "bytes": 449301 }, "provenance.json": { "sha256": "603b7bb784d8a79413f128548bdb7962675410867f8242108a6992a839432553", "bytes": 1833 }, "rendered.html": { "sha256": "fd03859a9fd5ae77d423d8835b81ab8ef251537a45a05faabe957954a7d0f167", "bytes": 450077 }, "screenshot.jpg": { "sha256": "e03787b20402534a181cf1f864b5f2064f95e65856a3e1ecbffe574cc51eb679", "bytes": 660285 }, "text.txt": { "sha256": "9071d13624a159a9f371e546317ed92c7815d9423f092bd8c7defc2f8b0ef694", "bytes": 10195 } }, "started_utc": "2026-10-23T23:43:40.885Z", "status": 200, "final_url": "https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary coverage.", "raw_sha256": {}, "has_notes": true, "notes_md": "# 'PHP2Shell' Bugs Signal Red Alert for Security Industry\n\nCaptured by claude-story-site. Status: captured. Secondary coverage.\n\n- Captured for the record.\n" }, { "slug": "data-max-article-87622", "url": "https://www.data-max.co.jp/article/87622", "publisher": "データ・マックス", "kind": "news", "title": "PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "8df4fbe37278f6743b0a102d5dfc781000d076efb21b2edf5e767bc993ec6c86", "bytes": 481 }, "page.html": { "sha256": "a7530533f16fb33e58f71f79538ec1f2f401bb6fd421afbadfa0c062a9df3684", "bytes": 75084 }, "provenance.json": { "sha256": "ebdbf9616e6023bd5a40fd808759096ff5dc0a107da6c87f4ddbfa3a80b294ff", "bytes": 1612 }, "rendered.html": { "sha256": "66c6bc747270cdab603672bfb6383b9dcef2b20273dd0e4a573b3a362408abf9", "bytes": 121987 }, "screenshot.jpg": { "sha256": "e230aca7695d8112ecffdeb0c85686e6220f59bad8ed05b6067419a76c0a4dd2", "bytes": 869515 }, "text.txt": { "sha256": "d7145bababb0f5db514157ec8cc247cac9399a81962ee78d639a643a2e177d72", "bytes": 15510 } }, "started_utc": "2026-10-25T09:50:03.000Z", "status": 200, "final_url": "https://www.data-max.co.jp/article/87622" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). NetIB-News / Data Max (Japanese), part one of an explainer: what the serious PHP vulnerability PHP2Shell is, in terms anyone can follow, and what may...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/data-max/article-87622`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNetIB-News / Data Max (Japanese), part one of an explainer: what the serious PHP vulnerability PHP2Shell is, in terms anyone can follow, and what may happen next. It says a serious vulnerability was found in PHP that could let an outsider run arbitrary code on a server without authentication, and that the two flaws, CVE-2026-109618 and CVE-2026-109619, combined are called PHP2Shell.\n\n> 世界中のホームページやネットサービスを支えるプログラム言語「PHP」に、認証なしで外部からサーバー上で任意のコードを実行される恐れのある重大な脆弱性が見つかった。\n\n_Curator's translation:_ \"A serious vulnerability was found in the programming language PHP, which underpins homepages and net services around the world, that could allow arbitrary code to be run from outside on a server without authentication.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "datensicherheit-php2shell-informationen-patch-veroeffent", "url": "https://www.datensicherheit.de/php2shell-informationen-patch-veroeffentlichung/", "publisher": "datensicherheit.de", "kind": "news", "title": "php2shell: Informationen zu PHP-Lücken vor Patch-Veröffentlichung offengelegt | datensicherheit.de", "published": "2026-10-24T14:15:11+02:00", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "3bcca66d677eedcc50341a1a4b481235bb8511cbd055c750a951f48c0e62a1a2", "bytes": 493 }, "page.html": { "sha256": "95e5345f18176619727b7b65522553cf6b7c97b7362720abef536c8a928c27ec", "bytes": 98464 }, "provenance.json": { "sha256": "909b1a17470a38f615d4d5c2f71b3c0b8e2f45f5d0596f34220b01fb5dba1732", "bytes": 1767 }, "rendered.html": { "sha256": "07e7ad19fbeba7fca2b7cc824e7d3f96888a80857a8ffd3801c1252e47c4c0d1", "bytes": 105206 }, "screenshot.jpg": { "sha256": "3e2f592c2dbd8508d3a83437d1fdb5476ad8d9d51b218f2417d0e55ffa12a0f4", "bytes": 588165 }, "text.txt": { "sha256": "a15a70b65cb1b388203f50fa3a318935871af53654f047b1bc417709d3612ade", "bytes": 6556 } }, "started_utc": "2026-10-25T09:41:57.829Z", "status": 200, "final_url": "https://www.datensicherheit.de/php2shell-informationen-patch-veroeffentlichung/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). datensicherheit.de (German), 24 October: information on the PHP flaws was disclosed before the patches. The critical flaws allowed, under certain cond...", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell: Informationen zu PHP-Lücken vor Patch-Veröffentlichung offengelegt | datensicherheit.de\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/datensicherheit/php2shell-informationen-patch-veroeffentlichung`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\ndatensicherheit.de (German), 24 October: information on the PHP flaws was disclosed before the patches. The critical flaws allowed, under certain conditions, remote execution of malicious code and their details became public before the updates; companies should update affected systems at once, check for possible compromise and secure internal systems; virtual patching can bridge the gap until patching.\n\n> Details zu den Sicherheitslücken wurden bereits vor Veröffentlichung der entsprechenden Updates öffentlich.\n\n_Curator's translation:_ \"Details of the vulnerabilities became public before the corresponding updates were published.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"php2shell: Informationen zu PHP-Lücken vor Patch-Veröffentlichung offengelegt | datensicherheit.de\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "daubois-blog-php2shell-rumors", "url": "https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/", "publisher": "Alexandre Daubois (PHP security team / PHP Foundation)", "kind": "researcher", "title": "What the PHP2Shell rumors got wrong, from inside the PHP security team", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081256Z", "files": { "headers.json": { "sha256": "7f4da02c6bd4388f7475aed4c30ba66fbfd5e93f9e9b69537b21005081745afa", "bytes": 1049 }, "page.html": { "sha256": "8f85e508b569e07d58f4ab54611fc7bb886c13f58b8c0448198f44899bf54d10", "bytes": 22135 }, "provenance.json": { "sha256": "c86d302cfb9e3442fe758ce082c1015c8500db089f7e8350402efbd4b259241d", "bytes": 1046 }, "rendered.html": { "sha256": "8bc8f77f0b030a431c17cfb6048a516fae5d743bcf9af1d571e1a377dbe77fbd", "bytes": 21926 }, "screenshot.png": { "sha256": "c86032b5d2ce179ae664684fe600ba45c0b3ff7003c835716b5cce042a13e514", "bytes": 817325 }, "text.txt": { "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "bytes": 8821 } }, "started_utc": "2026-10-22T08:12:56.219Z", "status": 200, "final_url": "https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "623adbf1988184eb649cce8858aced007c5165ba6b98c43fcac0f6f8a553ecf2", "bytes": 1113 }, "page.html": { "sha256": "cc22de0d3ddaa04114949ea038bb07fa1d246179a302856380c2588aaec8db33", "bytes": 22135 }, "provenance.json": { "sha256": "407a98c95ce52c1483f3569b75eb4c2e34948836cc0da42e26d58572bf9d913d", "bytes": 1776 }, "rendered.html": { "sha256": "d1b60675fb382f85b3e100bba166f6ddcd6f6227bb577920e6ace8e38e0c86d4", "bytes": 21926 }, "screenshot.jpg": { "sha256": "b6d33a9fcad21d4a5e0492ffaff604c34cb5abed436db0c682cea86e24546adb", "bytes": 585832 }, "text.txt": { "sha256": "530fd6cb980feec08028f50c58a1631f903305d34a3319fe86c46f0f1d71588a", "bytes": 8821 } }, "started_utc": "2026-10-23T16:15:25.365Z", "status": 200, "final_url": "https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/" } ], "status": "captured", "primary": false, "added_by": "collector-researchers", "notes": "Personal blog of a PHP Foundation contractor on the PHP security team, dated 21 OCT 2026. Describes anonymous HN post Oct 20, leaked 'PHP2Shell tool' screenshot credited to Calif.IO, the short exploitation video, and watchTowr confirming the CVEs publicly. Gives GHSA advisory opened 2026-08-27 credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Alexandre Daubois: \"What the PHP2Shell rumors got wrong, from inside the PHP security team\"\n\n- URL https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/ ; \"BLOG · 21 OCT 2026\", \"REV 2026.10.21\". Author joined the PHP Foundation in July 2026 to help the security team (per the Foundation's post). Personal blog, not an official statement.\n- How the leak happened (verbatim): \"An anonymous Hacker News post citing a reliable source went up on October 20 and came down, but screenshots of it had already reached X and Mastodon. A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down the same way. Then watchTowr, writing that 'we were all supposed to wait until Thursday at 11am ET', confirmed in public that the bugs were real and posted both CVE numbers.\"\n- Says the CVSS 10.0 traces to \"Florian Roth's post, as Phoenix Security relayed it\" and to watchTowr via Cyber Daily.\n- Facts box: \"Advisory opened: 2026-08-27, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion\"; \"Fix PR opened: 2026-09-25, final commit 01a40e89fbfc authored 2026-10-18\"; \"Leak and advance notice: 2026-10-20\"; \"Published: 2026-10-21, 14:00 UTC\".\n- Contradiction: the PHP Foundation says \"No technical details leaked\" with the CVE IDs, yet Daubois describes a leaked tool screenshot and advisory. Also \"tomash-areion\" is a fourth credited reporter not named elsewhere on this beat.\n" }, { "slug": "defesaemfoco-php2shell-falhas-gravidade-92-ameacam-se", "url": "https://www.defesaemfoco.com.br/php2shell-falhas-gravidade-92-ameacam-servidores-internet/", "publisher": "Defesa em Foco", "kind": "news", "title": "PHP2Shell: falhas de gravidade 9,2 ameaçam servidores na internet", "published": "2026-10-21T13:30:45-03:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "9f708e106291751843ceb1a8c5cceadd368a2e6c6b39103d185d4baf3471f5d3", "bytes": 1373 }, "page.html": { "sha256": "2757fca153e5def1d029ef9e31e2e408c449616bb59343d3be6208fe7852a0c1", "bytes": 82633 }, "provenance.json": { "sha256": "f31392a0e518f5f8f565a5613a1d4a07b1517e95b4fad31d246a44178e33b1e1", "bytes": 1766 }, "rendered.html": { "sha256": "97c6f01bd344b6a99abaa9252b13834080f671085b1c03bd057efaa3990254c2", "bytes": 1205876 }, "screenshot.jpg": { "sha256": "64d9c72a0ed9763611e27fe3d43bd1d8bd241afb4ac262d48b722c0c07565009", "bytes": 907285 }, "text.txt": { "sha256": "d817f318eeea8098c746a75714f1077051ef1eca01bbf829f859cc372ecf6c94", "bytes": 10004 } }, "started_utc": "2026-10-24T08:41:44.275Z", "status": 200, "final_url": "https://www.defesaemfoco.com.br/php2shell-falhas-gravidade-92-ameacam-servidores-internet/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt-BR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Defesa em Foco (Portuguese, Brazil), 21 October: PHP2Shell, two critical PHP flaws with severity 9.2 out of 10, led European governments to take publi...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: falhas de gravidade 9,2 ameaçam servidores na internet\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/defesaemfoco/php2shell-falhas-gravidade-92-ameacam-servidores-internet`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDefesa em Foco (Portuguese, Brazil), 21 October: PHP2Shell, two critical PHP flaws with severity 9.2 out of 10, led European governments to take public sites offline as a precaution; the flaws could allow remote code execution.\n\n> Uma falha em um componente amplamente utilizado na internet levou governos europeus a retirar sites públicos do ar por precaução.\n\n_Curator's translation:_ \"A flaw in a widely used internet component led European governments to take public sites offline as a precaution.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: falhas de gravidade 9,2 ameaçam servidores na internet\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt-BR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "delfi-bizness-44467736-tehnologijas-120139480-certlv-novero", "url": "https://www.delfi.lv/bizness/44467736/tehnologijas/120139480/certlv-novero-atseviskus-meginajumus-izmantot-php-ievainojamibas-kiberuzbrukumos", "publisher": "DELFI", "kind": "news", "title": "\"Cert.lv\" novēro mēģinājumus izmantot PHP ievainojamības kiberuzbrukumos; pagaidām uzbrukumi nesekmīgi", "published": "2026-10-21T17:53:19.000Z", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "8a9ff64bb037e10f8619989dbdad6e8a5828d2b6423c7c915a14b4b9b4702ad4", "bytes": 745 }, "page.html": { "sha256": "5f491916b03eb65cb52c5711afea2cdff4ecb36a64fcca64eee7a7982a4a7c68", "bytes": 220811 }, "provenance.json": { "sha256": "7fb85d627bad83b9c7d1c065e9357ee85681b62068056c0fa16c3a22f9b19b58", "bytes": 1911 }, "rendered.html": { "sha256": "fa55bdf3cdc6fb68a654f1f8e30a74a99e796b353e92d5804e86a8aa83c1a580", "bytes": 231020 }, "screenshot.jpg": { "sha256": "592102c9b29d2d4f9d69f7964ad4afacd5671d68590d668c646aa458c41ad63e", "bytes": 288920 }, "text.txt": { "sha256": "916cc9c47bec9f4e9cb06de60da0d0b43a8f3251642b42825df581deaff221e8", "bytes": 4756 } }, "started_utc": "2026-10-22T18:26:30.597Z", "status": 200, "final_url": "https://www.delfi.lv/bizness/44467736/tehnologijas/120139480/certlv-novero-atseviskus-meginajumus-izmantot-php-ievainojamibas-kiberuzbrukumos" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "lv", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in lv: Delfi reports that CERT.LV deputy head Varis Teivāns told LTV's Panorāma that mostly automated, bot-driven exploitation attempts against private and state systems in Latvia have so far failed. He said about 6,000 resourc", "raw_sha256": {}, "has_notes": true, "notes_md": "# \"Cert.lv\" novēro mēģinājumus izmantot PHP ievainojamības kiberuzbrukumos; pagaidām uzbrukumi nesekmīgi\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `lv/news/delfi/bizness-44467736-tehnologijas-120139480-certlv-novero-atsevi`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: DELFI. Language: lv. URL: https://www.delfi.lv/bizness/44467736/tehnologijas/120139480/certlv-novero-atseviskus-meginajumus-izmantot-php-ievainojamibas-kiberuzbrukumos\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nDelfi reports that CERT.LV deputy head Varis Teivāns told LTV's Panorāma that mostly automated, bot-driven exploitation attempts against private and state systems in Latvia have so far failed. He said about 6,000 resources in Latvia could be affected, several hundred of them public sector. The Cabinet press secretary said the unified state and municipal website platform was suspended, making sites including president.lv unavailable; Latvian Radio's site and apps were also paused.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/lv/news/delfi/bizness-44467736-tehnologijas-120139480-certlv-novero-atsevi.json`), not the publisher's and not checked word for word by the curator.\n\n**exploitation**: CERT.LV deputy head Varis Teivāns said isolated, mostly automated attempts to exploit the PHP flaws against private and state systems in Latvia have not been successful.\n\n> Latvijā novēroti atsevišķi, pārsvarā automatizēti mēģinājumi izmantot PHP programmatūras ievainojamības uzbrukumos gan privātā sektora, gan valsts informācijas sistēmām, taču tie nav bijuši sekmīgi\n\n_Watch reader's translation:_ Isolated, mostly automated attempts to use PHP software vulnerabilities in attacks on both private-sector and state information systems have been observed in Latvia, but they have not been successful\n\n**offline**: The Cabinet press secretary said access to the unified website platform was suspended, so many state and municipal sites, including president.lv, were unavailable.\n\n> Tādējādi līdz ievainojamību novēršanai nebūs pieejamas virknes valsts un pašvaldību iestāžu mājaslapas, tai skaitā nav pieejama arī vietne \"president.lv\".\n\n_Watch reader's translation:_ Thus, until the vulnerabilities are fixed, a number of state and municipal institutions' websites will not be available, including the website president.lv.\n\n**offline**: The Latvian Radio website and mobile app were also temporarily suspended.\n\n> Latvijā uz laiku apturēta arī Latvijas Radio mājaslapas, mobilās lietotnes un Latvijas Sabiedriskā medija portāla \"Lsm.lv\" darbība.\n\n_Watch reader's translation:_ In Latvia, the Latvian Radio website, mobile app and the Latvian Public Media portal Lsm.lv have also been temporarily suspended.\n\n**number**: Teivāns said about 6,000 digital resources in Latvia could be affected, several hundred of them in the public sector.\n\n> Pēc viņa teiktā, Latvijā ir ap 6000 digitālo resursu, kurus minētās ievainojamības potenciāli varētu ietekmēt. Publiskajā sektorā tādu ir vairāki simti\n\n_Watch reader's translation:_ According to him, there are about 6,000 digital resources in Latvia that could potentially be affected by these vulnerabilities. In the public sector there are several hundred such\n\n**offline**: A related headline says CIREN and CSP also temporarily suspended their tools because of the PHP flaws (21:24).\n\n> PHP ievainojamību dēļ arī CIREN un CSP uz laiku aptur savu rīku darbību (plkst. 21.24)\n\n_Watch reader's translation:_ Because of the PHP vulnerabilities, CIREN and CSP also temporarily suspend operation of their tools (at 21:24)\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in lv: Delfi reports that CERT.LV deputy head Varis Teivāns told LTV's Panorāma that mostly automated, bot-driven exploitation attempts against private and state systems in Latvia have so far failed. He said about 6,000 resourc\n\nSupports: translations/lv/news/delfi/bizness-44467736-tehnologijas-120139480-certlv-novero-atsevi.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "denews-news-articleview-html", "url": "https://www.denews.co.kr/news/articleView.html?idxno=42856", "publisher": "디지털경제뉴스", "kind": "news", "title": "로그프레소, PHP 원격 코드 실행 취약점 진단 ‘PHP2Shell 스캐너’ 앱 공개 < IT&과학 < 기사본문 - 디지털경제뉴스", "published": "2026-10-26T09:40:41+09:00", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "34ff55b4654a998236cdf5e3cda18a5efe3c0468131dea826afbfea071f54b02", "bytes": 354 }, "page.html": { "sha256": "8b32787e4e9411f11b030df6dd3258a27b20bbc120de1b4d7d69f3bb43736dbe", "bytes": 90009 }, "provenance.json": { "sha256": "3c64443e70a34cd45e908328aa4050a9619103099a3869cfaab5eb8e176af805", "bytes": 1673 }, "rendered.html": { "sha256": "abfb660e906fd8aab2e055bc052fc6dfb3be14f9bb9c9aa396732c045b02bc7c", "bytes": 94557 }, "screenshot.jpg": { "sha256": "017597c9d19bacf2d436174dfd2fd1f4415e3bfda04d0927b1eb57fe7847534f", "bytes": 302851 }, "text.txt": { "sha256": "138f2ffb3fd83e7f6ecf40c156c1e8d8011d6b043a43e45d17559fc8e777bece", "bytes": 6111 } }, "started_utc": "2026-10-26T07:27:37.338Z", "status": 200, "final_url": "https://www.denews.co.kr/news/articleView.html?idxno=42856" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Digital Economy News (Korean), 26 October, by Park Si-hyun: the security firm Logpresso released a 'PHP2Shell Scanner' app in its Logpresso Store, to...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 로그프레소, PHP 원격 코드 실행 취약점 진단 ‘PHP2Shell 스캐너’ 앱 공개 < IT&과학 < 기사본문 - 디지털경제뉴스\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/denews/news-articleview-html`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDigital Economy News (Korean), 26 October, by Park Si-hyun: the security firm Logpresso released a 'PHP2Shell Scanner' app in its Logpresso Store, to be installed in its SIEM/XDR and run against registered URLs, including internal-network PHP assets (management tools, firewalls) that internet-based scanners cannot reach. It logs each asset's result and PHP version, allows re-scanning after patching and CSV export, and ships detection queries and rules. It recaps the two CVEs (9.2), the fixed versions (8.2.35, 8.3.36, 8.4.27, 8.5.12) and says versions from 5.4.0 (2012) are reported affected. Noted as material only: the vault does not run such tools.\n\n> 로그프레소는 PHP 원격 코드 실행 취약점 ‘PHP2Shell’을 진단하는 ‘PHP2Shell 스캐너’ 앱을 로그프레소 스토어에 공개했다.\n\n_Curator's translation:_ \"Logpresso has released, in the Logpresso Store, a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerability 'PHP2Shell'.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"로그프레소, PHP 원격 코드 실행 취약점 진단 ‘PHP2Shell 스캐너’ 앱 공개 < IT&과학 < 기사본문 - 디지털경제뉴스\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. The footer carries a copyright line ('무단전재 및 재배포, AI학습 및 활용 금지': no reproduction, redistribution, or AI training or use). It is a rights notice, not an instruction to act; recorded here and flagged to the editor. Nothing else addresses an AI or hides text from a reader.\n" }, { "slug": "detik-tag-php2shell", "url": "https://www.detik.com/tag/php2shell", "publisher": "detikcom", "kind": "news", "title": "Berita dan Informasi Php2shell Terkini dan Terbaru Hari ini - detikcom", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "eaacf7a47cb70de6ad7dc923eec7abb30236a7839458102097e759d574716652", "bytes": 1049 }, "page.html": { "sha256": "4746a87341cd6240b4a2b668b3af5953b2fa61bb1ed5c05f94be58af4dcb98e8", "bytes": 65500 }, "provenance.json": { "sha256": "48351941d45a4839b2f628c1621f0056f75a9e87ada92f8750a13ffd6bc0a430", "bytes": 1376 }, "text.txt": { "sha256": "b2a0e44281bdb0135391f7a7f9c7b3d710951a0079dc5e801b64f7485cafc302", "bytes": 4235 } }, "started_utc": "2026-10-23T16:16:23.506Z", "status": 200, "final_url": "https://www.detik.com/tag/php2shell" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id-ID", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). detikcom (Indonesian), a tag page of PHP2Shell news of 22 October: it lists 'Getting to know PHP2Shell: a 20-year-old dangerous hole that can be hacke...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Berita dan Informasi Php2shell Terkini dan Terbaru Hari ini - detikcom\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/detik/tag-php2shell`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\ndetikcom (Indonesian), a tag page of PHP2Shell news of 22 October: it lists 'Getting to know PHP2Shell: a 20-year-old dangerous hole that can be hacked thanks to AI' and 'Cloudflare records millions of attack attempts through the PHP2Shell hole', and says a wave of panic hit the internet after the discovery of two critical holes labelled PHP2Shell. A tag/index page, not one article.\n\n> Mengenal PHP2Shell: Celah Berbahaya 20 Tahun yang Bisa Di-Hack Berkat AI\n\n_Curator's translation:_ \"Getting to know PHP2Shell: A 20-Year-Old Dangerous Hole That Can Be Hacked Thanks to AI\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ detik.com tag page listing PHP2Shell headlines with short teasers: Cloudflare saw millions of attempts, Google Gemini's role, an expert on the impact on Indonesia, the FBI urging updates, and a head of state stepping in.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Berita dan Informasi Php2shell Terkini dan Terbaru Hari ini - detikcom\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id-ID`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "dexpose-php2shell-php-rce-exposure-response", "url": "https://www.dexpose.io/php2shell-php-rce-exposure-response/", "publisher": "dexpose.io", "kind": "news", "title": "PHP2Shell: How Security Teams Should Assess and Contain the Reported PHP RCEs - DeXpose", "published": "2026-10-21T04:03:07+00:00", "captures": [ { "stamp": "20261025T070559Z", "files": { "headers.json": { "sha256": "e191a10ed1f29afd2b4e54e2e7080bc92c2389d9f01cbca4461f8af687c6277a", "bytes": 842 }, "page.html": { "sha256": "f3ce966817b3e63ec5e8b35a357eaf1e2a587b15897518af249841d733f54491", "bytes": 43736 }, "provenance.json": { "sha256": "39fadaada557bd72e8d91093291df131442a0cf6ab3cf29d1a12ab661bf55b8f", "bytes": 1661 }, "rendered.html": { "sha256": "bba4ccd75e49e1fdb7e1ba567d6a674c3fb0c9dd75450fc46c6a122d6362ee9b", "bytes": 44163 }, "screenshot.jpg": { "sha256": "4c12bf4f7d4c11ab3c5a7b18433e4944ee96c072b870880aeffd730f2600acb1", "bytes": 758754 }, "text.txt": { "sha256": "d3c0199934656a96323b491a53c5d16deb2d6b8c26a9111e88eb4e1720e85c9f", "bytes": 14867 } }, "started_utc": "2026-10-25T07:10:34.511Z", "status": 200, "final_url": "https://www.dexpose.io/php2shell-php-rce-exposure-response/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T070559Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). DeXpose, 21 October: how security teams should assess and contain the reported PHP2Shell RCEs. Both flaws are scored 9.2 under CVSS v4.0; the piece is...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: How Security Teams Should Assess and Contain the Reported PHP RCEs - DeXpose\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/dexpose/php2shell-php-rce-exposure-response`, snapshot `20261025T070559Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T070559Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDeXpose, 21 October: how security teams should assess and contain the reported PHP2Shell RCEs. Both flaws are scored 9.2 under CVSS v4.0; the piece is defender guidance, advising teams to look for PHP worker crashes, abnormal restarts, process execution from PHP service accounts and unexpected outbound connections, and noting that a quiet log does not prove exploitation is impossible. The curator did not copy the page's description of how the flaws are reached.\n\n> In the same window, investigate PHP worker crashes, abnormal restarts, process execution from PHP service accounts, and unexpected outbound connections.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: How Security Teams Should Assess and Contain the Reported PHP RCEs - DeXpose\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "diariobitcoin-tecnologia-aws-detecto-un-intento-de-exp", "url": "https://www.diariobitcoin.com/tecnologia/aws-detecto-un-intento-de-explotar-php2shell-cuatro-dias-antes-de-su-divulgacion/", "publisher": "DiarioBitcoin", "kind": "news", "title": "AWS detectó un intento de explotar PHP2Shell cuatro días antes de su divulgación - DiarioBitcoin", "published": "2026-10-22T15:29:51+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c55939047aeb6995898d25f9e67a6eb9449f3cd9f87bc32bc121a81ce3e03660", "bytes": 474 }, "page.html": { "sha256": "cacc45206b8581a2101b39d27e2fabcca0941f4f78c50e36ca1176f7828c36c9", "bytes": 230333 }, "provenance.json": { "sha256": "fa9a3b88d337277192967a92c37c1f5aae14035c8cb0f77b1ded0def3b99b4ac", "bytes": 1874 }, "rendered.html": { "sha256": "855688bc96830017ef442f08bccf878eb30fd1ace78d404e7ec713acc5347636", "bytes": 257385 }, "screenshot.jpg": { "sha256": "75a1f033be6bcbeded7d4760d67e6f6df2798c1f73682c0a67326258cf428993", "bytes": 1104144 }, "text.txt": { "sha256": "bbe00e86009c74e82f0327e0e6bbc52302bb3504ec515ca98b4242515519a469", "bytes": 15102 } }, "started_utc": "2026-10-23T16:09:04.387Z", "status": 200, "final_url": "https://www.diariobitcoin.com/tecnologia/aws-detecto-un-intento-de-explotar-php2shell-cuatro-dias-antes-de-su-divulgacion/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). DiarioBitcoin (Spanish): restates Amazon's findings that its sensors recorded an attempt to exploit PHP2Shell on 17 October 2026, four days before the...", "raw_sha256": {}, "has_notes": true, "notes_md": "# AWS detectó un intento de explotar PHP2Shell cuatro días antes de su divulgación - DiarioBitcoin\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/diariobitcoin/tecnologia-aws-detecto-un-intento-de-explotar-php2shell-cuat`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDiarioBitcoin (Spanish): restates Amazon's findings that its sensors recorded an attempt to exploit PHP2Shell on 17 October 2026, four days before the public disclosure, and that the embargo did not prevent early activity; it advises patching quickly and reviewing logs from the earliest date. A restatement of the AWS blog post.\n\n> AWS identificó actividad contra sus honeypots desde el 17 de octubre de 2026\n\n_Curator's translation:_ \"AWS identified activity against its honeypots from 17 October 2026\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ DiarioBitcoin restates Amazon/AWS threat intelligence findings: a MadPot honeypot saw a PHP2Shell attempt on 17 October, four days before disclosure, from an anonymisation network, with more PoCs and attempts on 21 October. It repeats AWS's advice to patch and review logs.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"AWS detectó un intento de explotar PHP2Shell cuatro días antes de su divulgación - DiarioBitcoin\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "diepresse-41383717-die-php-sicherheitsluecke-ist-a", "url": "https://www.diepresse.com/41383717/die-php-sicherheitsluecke-ist-alt-die-ki-hat-sie-wieder-ausgegraben", "publisher": "Die Presse", "kind": "news", "title": "Die PHP-Sicherheitslücke ist alt, die KI hat sie wieder ausgegraben, was sie genau ist und was noch kommt – DiePresse.com", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "574e0801539b91f03762f81b7f604a4245ecbbc6a579284de248b28c363cc0cc", "bytes": 513 }, "page.html": { "sha256": "f5293180d42561f3df0b3ae6b7ea9256e7d80bb593a819a6e2d25ef77c485076", "bytes": 231454 }, "provenance.json": { "sha256": "32544ae55cf2198e0d5bf3c8fb3e91c2788bf802d0eedbc9e5357fcf626325ff", "bytes": 1847 }, "rendered.html": { "sha256": "a30e2627ac5497d4f6d20db2f0f70f7fb8aed992b2d39f562cbb736854c8139c", "bytes": 193523 }, "screenshot.jpg": { "sha256": "6a78fd561c24cca2005b6e47a701fef659bdb6ec6788640da7c5fd0b08212280", "bytes": 795233 }, "text.txt": { "sha256": "f6998ff009f030cc5aa035c7032038aa708ec871633b5604e0ba0b8f2bf46220", "bytes": 11280 } }, "started_utc": "2026-10-23T16:09:28.614Z", "status": 200, "final_url": "https://www.diepresse.com/41383717/die-php-sicherheitsluecke-ist-alt-die-ki-hat-sie-wieder-ausgegraben" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Die Presse (German, Austria), 23 October, 12:03: the PHP security hole is old and AI dug it up again; what it is and what is still to come. The two fl...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Die PHP-Sicherheitslücke ist alt, die KI hat sie wieder ausgegraben, was sie genau ist und was noch kommt – DiePresse.com\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `at/news/diepresse/41383717-die-php-sicherheitsluecke-ist-alt-die-ki-hat-sie-wi`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDie Presse (German, Austria), 23 October, 12:03: the PHP security hole is old and AI dug it up again; what it is and what is still to come. The two flaws caused uproar since Wednesday; in Austria no successful attacks were known so far.\n\n> In Österreich sind bisher keine erfolgreichen Angriffe bekannt.\n\n_Curator's translation:_ \"In Austria no successful attacks are known so far.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Die PHP-Sicherheitslücke ist alt, die KI hat sie wieder ausgegraben, was sie genau ist und was noch kommt – DiePresse.com\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "digitalpr-r-146712", "url": "https://digitalpr.jp/r/146712", "publisher": "デジタルPRプラットフォーム", "kind": "news", "title": "PHPの重大な脆弱性「PHP2shell」とは？ 企業サイトが今すぐ確認すべきこと　WACAが解説記事を公開 | 一般社団法人ウェブ解析士協会", "published": "2026-10-26 10:00 (page time zone not stated)", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "4ec8c25920775a0843ecba95bcf04850ae0e3a6d57abdb2349bcb05e71ccbd33", "bytes": 507 }, "page.html": { "sha256": "7ab1a22dbaa1bfdc8fafdde4aafee931f9b7e83056d7de49e5bd7438c89b00a8", "bytes": 36989 }, "provenance.json": { "sha256": "37525e0a02cc75c2fa73a38db86c47b811171ae2575f9d4fbebcd4c32ff13afd", "bytes": 1612 }, "rendered.html": { "sha256": "f3a5d1d693454406d3ffc65038a54deb11df9bb47114c9dc7a68ef56fa0ad6e3", "bytes": 36817 }, "screenshot.jpg": { "sha256": "5cd9b5e1db68755be7c0d6659e7d00edf14ecf8562ae25dc86a6b1b4dbfa3e34", "bytes": 372026 }, "text.txt": { "sha256": "9e59dbe4e8b70c51237003ec98a1e54fc5544de870e97dd1e4740383ad6e6ed0", "bytes": 9564 } }, "started_utc": "2026-10-26T07:26:15.489Z", "status": 200, "final_url": "https://digitalpr.jp/r/146712" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Digital PR Platform (Japanese), 26 October: a press release by WACA (the Web Analyst Association, Japan) pointing to an explainer it published on 24 O...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPの重大な脆弱性「PHP2shell」とは？ 企業サイトが今すぐ確認すべきこと　WACAが解説記事を公開 | 一般社団法人ウェブ解析士協会\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/digitalpr/r-146712`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDigital PR Platform (Japanese), 26 October: a press release by WACA (the Web Analyst Association, Japan) pointing to an explainer it published on 24 October about PHP2Shell for company sites. It says Prime Minister Takaichi Sanae urged action on X on the night of 21 October ('an urgent request that you act tonight') and that many sites, WACA's included, went into emergency maintenance. Its own observation: many small companies could not tell whether their WordPress site was at risk, and sites left unmaintained for years sometimes could not apply the fix in one step. Advice: ask the hosting or management company whether the PHP fix is applied (a normally displaying site does not show it), and for PHP 8.1 and earlier check for a vendor fix and plan a move to a supported version. The same release appears in Niigata Nippo (niigata-nippo-articles-930995).\n\n> これを受け高市早苗首相は10月21日、Xで「皆様に、今夜に対応して頂きたい大至急のお願いです」として対策を広く呼びかけました\n\n_Curator's translation:_ \"In response, Prime Minister Takaichi Sanae on 21 October called widely for action on X, with 'an urgent request that I ask everyone to act on tonight'.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHPの重大な脆弱性「PHP2shell」とは？ 企業サイトが今すぐ確認すべきこと　WACAが解説記事を公開 | 一般社団法人ウェブ解析士協会\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "digitaltoday-cn-view-118322-stealien-launches-free-ph", "url": "https://www.digitaltoday.co.kr/cn/view/118322/stealien-launches-free-php2shell-vulnerability-check-service", "publisher": "DigitalToday", "kind": "news", "title": "Stealien推出“PHP2Shell”免费在线检测服务", "published": "2026-10-22T15:46:42+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "8db91a3797df351435a741027fc60e684befcacaae542f2e1c93915894322633", "bytes": 546 }, "page.html": { "sha256": "cd110497566a7502d8eb09fd2ae28267b4205bd48e285a10381194cd27ffa2b0", "bytes": 48393 }, "provenance.json": { "sha256": "4b6d6bbb6f2b24c6c46471f0c4beb842cfe8a4148ae8aaaa54527a36c9d3dc63", "bytes": 1793 }, "rendered.html": { "sha256": "9b5ecde4c609cdfc16b6b47688b241f888126c778b75fec95006ea454a9125dc", "bytes": 204794 }, "screenshot.jpg": { "sha256": "ac8e483428f6d4007bde98e3aeab1bf5e43fa3206cf1dce627b39dd36445b6d2", "bytes": 250092 }, "text.txt": { "sha256": "7f84b5032782b4e06f6746e048d773e2586f5a11402bdec9fa11cbff0e1343fb", "bytes": 4036 } }, "started_utc": "2026-10-23T16:21:23.418Z", "status": 200, "final_url": "https://www.digitaltoday.co.kr/cn/view/118322/stealien-launches-free-php2shell-vulnerability-check-service" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-CN", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). DigitalToday (Chinese edition), 22 October: the AI security company Stealien announced a free online PHP2Shell check where users enter a site URL for...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Stealien推出“PHP2Shell”免费在线检测服务\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/digitaltoday/cn-view-118322-stealien-launches-free-php2shell-vulnerabilit`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDigitalToday (Chinese edition), 22 October: the AI security company Stealien announced a free online PHP2Shell check where users enter a site URL for a first indication of whether it has the related vulnerability risk; Stealien warns an online check cannot replace patching. The curator did not use the service: it would mean sending URLs to a third party.\n\n> AI安全公司Stealien宣布推出“PHP2Shell”免费在线检测服务，用户可在指定页面输入网站URL，初步判断网站是否存在相关漏洞风险。\n\n_Curator's translation:_ \"The AI security company Stealien announced it is launching a free online 'PHP2Shell' detection service where users enter a site URL on a designated page to make a preliminary judgement on whether the site has related vulnerability risk.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Stealien推出“PHP2Shell”免费在线检测服务\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-CN`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "distributique-actualites-lire-php-des-failles-critique", "url": "https://www.distributique.com/actualites/lire-php-des-failles-critiques-mettent-des-milliers-de-sites-sous-pression-37446.html", "publisher": "Distributique", "kind": "news", "title": "PHP : des failles critiques mettent des milliers de sites sous pression - Distributique", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T120459Z", "files": { "headers.json": { "sha256": "3cde57c6d7e4c9252324a3e12e0c87823ff502047e57422ce44c0534b598f79b", "bytes": 485 }, "page.html": { "sha256": "9bd4e2865046e42b3457cbd1603e0c81e12f60fdaa9ecec2d4cdb436c3aaf0eb", "bytes": 54035 }, "provenance.json": { "sha256": "15bed896ccde394db7eb391dfa48d3e24b27d4b53835766efd2f54143d9369ec", "bytes": 1868 }, "rendered.html": { "sha256": "81b381b78951dbf82fe3a1b383205ce731e43b0ec695c5544e604a2123c4a819", "bytes": 167918 }, "screenshot.jpg": { "sha256": "7e0a3d8213b8298f3370b1bb13aeb976cdb3c098d327717e420d161c6557d3de", "bytes": 325658 }, "text.txt": { "sha256": "dfe731b251504ae3962d90c095604261c3d0d22a0af05a59ecd00225caffa549", "bytes": 8971 } }, "started_utc": "2026-10-25T12:10:46.075Z", "status": 200, "final_url": "https://www.distributique.com/actualites/lire-php-des-failles-critiques-mettent-des-milliers-de-sites-sous-pression-37446.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Distributique (French): PHP's critical flaws put thousands of sites under pressure. It says CVE-2026-109618 and CVE-2026-109619 were found with the he...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP : des failles critiques mettent des milliers de sites sous pression - Distributique\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/distributique/actualites-lire-php-des-failles-critiques-mettent-des-millie`, snapshot `20261025T120459Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T120459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDistributique (French): PHP's critical flaws put thousands of sites under pressure. It says CVE-2026-109618 and CVE-2026-109619 were found with the help of AI by researchers at Calif and Wiz, according to the companies' information relayed by AFP and Reuters, and that the fixes were released on 21 October after coordination with the project's managers.\n\n> Les failles, référencées CVE-2026-109618 et CVE-2026-109619, ont été découvertes à l'aide de l'intelligence artificielle par des chercheurs de Calif et de Wiz, selon les informations publiées par les entreprises et relayées par l'AFP et Reuters.\n\n_Curator's translation:_ \"The flaws, referenced CVE-2026-109618 and CVE-2026-109619, were discovered with the help of artificial intelligence by researchers at Calif and Wiz, according to information published by the companies and relayed by AFP and Reuters.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP : des failles critiques mettent des milliers de sites sous pression - Distributique\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "donanimhaber-php-acigindan-etkilenen-ulkeler-ve-sitel", "url": "https://www.donanimhaber.com/php-acigindan-etkilenen-ulkeler-ve-siteler-aciklandi-iste-liste--211962", "publisher": "DonanımHaber", "kind": "news", "title": "PHP açığından etkilenen ülkeler ve siteler açıklandı: İşte liste | DonanımHaber", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a3d3da620ec6fb3fb4275717ded1278f0cccd30b79a6fc80ef7889743fb65f68", "bytes": 924 }, "page.html": { "sha256": "20a1964bb333c9dc8a818bb95472c52d98f0a5abd6fb6549ae020a0565474647", "bytes": 281529 }, "provenance.json": { "sha256": "cd021a455751f1a5bf0efe9c5a4905534175d454ce90e7069fc5f297b9433e25", "bytes": 1817 }, "rendered.html": { "sha256": "9aa1c51e007c242ab2a444dd4e18e6c695925443cb8fecfa37adf6a99215c179", "bytes": 369297 }, "screenshot.jpg": { "sha256": "f36db08bb99e0c78508660a0df942b843c79fc767d05f290c9b9557083a8d78f", "bytes": 595999 }, "text.txt": { "sha256": "b572fd822f1b7a9e49a4898e8a9fe84de0c1e17acfe9af1f13f1d6028a489b1a", "bytes": 11401 } }, "started_utc": "2026-10-23T16:25:40.302Z", "status": 200, "final_url": "https://www.donanimhaber.com/php-acigindan-etkilenen-ulkeler-ve-siteler-aciklandi-iste-liste--211962" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). DonanimHaber (Turkish): countries and sites affected by the PHP flaw, as a list. The PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for the t...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP açığından etkilenen ülkeler ve siteler açıklandı: İşte liste | DonanımHaber\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/donanimhaber/php-acigindan-etkilenen-ulkeler-ve-siteler-aciklandi-iste-li`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDonanimHaber (Turkish): countries and sites affected by the PHP flaw, as a list. The PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for the two critical flaws, CVE-2026-109618 and CVE-2026-109619, and site administrators should check their versions and apply the right update.\n\n> PHP ekibi, iki kritik güvenlik açığı için PHP 8.5.12, 8.4.27, 8.3.36 ve 8.2.35 sürümlerini yayımladı.\n\n_Curator's translation:_ \"The PHP team released versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for the two critical security flaws.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ DonanımHaber publishes a country list (sourced to an FT link) of sites taken offline: Netherlands, Finland, France, Belgium, UK, Japan and Australia. It says Japan's ANA suspended its website and app (affecting Apple Wallet boarding passes) and that cyber.gov.au was affected. A related headline says Turkey's e-Devlet had no outage.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP açığından etkilenen ülkeler ve siteler açıklandı: İşte liste | DonanımHaber\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "donews-news-detail-8-6750596-html", "url": "https://www.donews.com/news/detail/8/6750596.html", "publisher": "DoNews", "kind": "news", "title": "PHP曝出代号PHP2Shell高危漏洞- DoNews快讯", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "012ffd00fd0bfad1247511f7dd2d460ecd43ebc5ea56cc5d6c1fddf1d981dc16", "bytes": 868 }, "page.html": { "sha256": "d66e15abc46167aac3007be95149f213807d9324a3d8dc104f8bde2dffcc5a39", "bytes": 37575 }, "provenance.json": { "sha256": "46ad51ea69315112cedc7f2abda57ec97aa893dc6d5a352e99546448ab54caf2", "bytes": 1579 }, "rendered.html": { "sha256": "3f0fbb065286b14942f58c5a9fc5a1d1c3c4f8daaa40d214bed0ae430fea563c", "bytes": 37978 }, "screenshot.jpg": { "sha256": "8d174904138eb9df2b270da3d7c0fd01bc5a295a2fab3f4fa3b9503d134260c5", "bytes": 130160 }, "text.txt": { "sha256": "440a5d4e7eba94d37e25f2650e42a34ef75530ca6279f5b0f55c62ae9b08d089", "bytes": 1835 } }, "started_utc": "2026-10-23T23:33:49.067Z", "status": 200, "final_url": "https://www.donews.com/news/detail/8/6750596.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). DoNews (Chinese), a brief flash item: PHP disclosed a high-risk flaw codenamed PHP2Shell; the language underpins about 70% of websites; the flaw comes...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP曝出代号PHP2Shell高危漏洞- DoNews快讯\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/donews/news-detail-8-6750596-html`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDoNews (Chinese), a brief flash item: PHP disclosed a high-risk flaw codenamed PHP2Shell; the language underpins about 70% of websites; the flaw comes from memory management; after the official patch Europe and the US issued emergency warnings and shut some sites, and several Asian governments and companies are checking and hardening their sites.\n\n> PHP曝出代号PHP2Shell的高危漏洞，该语言支撑全球约70%网站，漏洞源于内存管理问题。\n\n_Curator's translation:_ \"PHP has disclosed a high-risk vulnerability codenamed PHP2Shell; the language supports about 70% of websites worldwide, and the flaw comes from a memory-management problem.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ DoNews page was down; the title only says PHP disclosed a high-risk flaw codenamed PHP2Shell.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP曝出代号PHP2Shell高危漏洞- DoNews快讯\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "dutchitleaders-websites-offline", "url": "https://www.dutchitleaders.nl/news/763189/diverse-websites-offline-door-kritieke-kwetsbaarheden-in-php", "publisher": "Dutch IT Leaders", "kind": "news", "title": "Just a moment...", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112724Z", "files": { "headers.json": { "sha256": "3d4ed9c4a01097923a5877669d569d5ef394a8cdbe10aac65675668a31143782", "bytes": 1537 }, "page.html": { "sha256": "15b89d416c1e20625b50003213b1a4360e6045761598fec254652a1b5f3873b8", "bytes": 6469 }, "provenance.json": { "sha256": "8cea400474f5ccc7e7b350c5c9cf809ccb654b95894cae6c78613d5ff0c04d1e", "bytes": 1061 }, "rendered.html": { "sha256": "2f12251c8ab3b803be5a1123525fe94ec19fd2e3ad6daa9bab26759a181be3fe", "bytes": 7234 }, "screenshot.png": { "sha256": "1e7419104eee208b5ba0cc5f6696749ef060e1608266268dffcbd5d925e8f5ad", "bytes": 20501 }, "text.txt": { "sha256": "28f6003be69e3a9719618a62764a55d30d9d28570363ffd8126d1ef0f32a5803", "bytes": 75 } }, "started_utc": "2026-10-22T11:27:24.402Z", "status": 403, "final_url": "https://www.dutchitleaders.nl/news/763189/diverse-websites-offline-door-kritieke-kwetsbaarheden-in-php" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "Dutch: various websites offline over the PHP flaws.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Just a moment...\n\nCaptured by claude-story-site. Status: blocked. Dutch: various websites offline over the PHP flaws.\n\n- Secondary Dutch coverage.\n" }, { "slug": "eadt-minister-budget-no-breach", "url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/", "publisher": "East Anglian Daily Times (PA)", "kind": "news", "title": "No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112742Z", "files": { "headers.json": { "sha256": "4262ef46e445ece7b451c5d9768be9e2c72be47dd23270284566f23c6429c24b", "bytes": 925 }, "page.html": { "sha256": "47c1d48da4a78b3172325945c56a5b1bbbdd826cc02ad5b208f097d735b8deb9", "bytes": 291406 }, "provenance.json": { "sha256": "b59efe28603612dd036d6a98ba25b7b39db79e7b4739b163b239131955e26cc7", "bytes": 1163 }, "rendered.html": { "sha256": "790f7f3108d2c3fc28b38ccd146871560b9b62412b719911f578da424f7d70df", "bytes": 451816 }, "screenshot.png": { "sha256": "5079181e1c5eb09fb0b82305b4599b7b3767e0da3fdd0263cb2fc25a3cd8c349", "bytes": 1490164 }, "text.txt": { "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "bytes": 7475 } }, "started_utc": "2026-10-22T11:27:42.075Z", "status": 200, "final_url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "83d0297c3a8f2f9c9347343b3ad37f66153be63c327a6681e2c01bc379c029d5", "bytes": 997 }, "page.html": { "sha256": "721e4e70a7442f2e7c44f60499e046ead870269d892af3506d5397ff8f86b799", "bytes": 291512 }, "provenance.json": { "sha256": "990e6caa5c809c803e1ca362650fce8303fa3f04e5a08fca2ad68699e5961154", "bytes": 1878 }, "rendered.html": { "sha256": "8dde1f7f3e326b63a3383d3e30183e58b0f72db5fe1b8fd105bac26f1dbe63f4", "bytes": 450448 }, "screenshot.jpg": { "sha256": "4715046af95fa2d43afadb38bf697e8a5308dbae8168f9b6b621087033db005e", "bytes": 539624 }, "text.txt": { "sha256": "d54c7a0607dc0f9ff795693656f451f517480ebf179a9055eead86766a0048bc", "bytes": 7891 } }, "started_utc": "2026-10-23T16:15:37.087Z", "status": 200, "final_url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "A minister: no breach of Budget security after the OBR site was affected.", "raw_sha256": {}, "has_notes": true, "notes_md": "# No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times\n\nCaptured by claude-story-site. Status: captured. A minister: no breach of Budget security after the OBR site was affected.\n\n- Captured for the OBR statement.\n" }, { "slug": "ebn-news-articleview-html", "url": "https://www.ebn.co.kr/news/articleView.html?idxno=1729017", "publisher": "www.ebn.co.kr", "kind": "news", "title": "PHP 취약점 악용한 대규모 사이버 공격 정황...北 라자루스 연계 가능성 < 정치/사회 < 기사본문 - 이비엔(EBN)뉴스센터", "published": "2026-10-24T10:14:56+09:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "8b310f192f02e997344dd3fe455e9c7a58d7396ea53a0a2d865e8b895f328177", "bytes": 354 }, "page.html": { "sha256": "ce462a211caa367b9e6c35732c8080871011d1048d07805ee33a181455de79e0", "bytes": 174948 }, "provenance.json": { "sha256": "1b0e99967ddd003c40d7411c6844de2cea5be5bba54ddbafb198ff033aa4bc33", "bytes": 1671 }, "rendered.html": { "sha256": "77c65f8080e5fd4c2ff7550a041b7b8d6e4b1eee849f168915e7db8101331d6c", "bytes": 1877502 }, "screenshot.jpg": { "sha256": "6f40ebbfe7836914791e84c8aec99eba4d0300e94ef43f444f918e03e6266130", "bytes": 615886 }, "text.txt": { "sha256": "cfb488e3e483ee86d1b316236b5c4f466cdafeeecb821016dd136676b2346982", "bytes": 14666 } }, "started_utc": "2026-10-24T13:52:11.769Z", "status": 200, "final_url": "https://www.ebn.co.kr/news/articleView.html?idxno=1729017" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). EBN (Korean), 24 October: signs of a large-scale cyberattack exploiting the PHP flaw, with a possible link to North Korea's Lazarus group. It reports...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP 취약점 악용한 대규모 사이버 공격 정황...北 라자루스 연계 가능성 < 정치/사회 < 기사본문 - 이비엔(EBN)뉴스센터\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/ebn/news-articleview-html`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEBN (Korean), 24 October: signs of a large-scale cyberattack exploiting the PHP flaw, with a possible link to North Korea's Lazarus group. It reports that the Singapore security firm Cyfirma saw attackers discussing, in Korean, reconnaissance and concrete plans to exploit PHP2Shell against web servers worldwide; Cyfirma named the activity the 'June 2026 Minjun' campaign and raised a possible Lazarus link at moderate confidence; targets named include government bodies and financial institutions, and countries including Korea, the US, Japan, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU. The article itself says direct proof of a North Korean link has not been confirmed and caution is needed.\n\n> 다만 북한과의 연관성에 대한 분석 신뢰도는 '중간'(moderate) 수준으로 평가했다.\n\n_Curator's translation:_ \"However, it rated its confidence in the analysis of a link to North Korea as 'moderate'.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP 취약점 악용한 대규모 사이버 공격 정황...北 라자루스 연계 가능성 < 정치/사회 < 기사본문 - 이비엔(EBN)뉴스센터\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "economedia-zitec-vulnerabilitatile-in-php-sunt-ampl", "url": "https://economedia.ro/zitec-vulnerabilitatile-in-php-sunt-amplificate-de-inteligenta-artificiala.html", "publisher": "Economedia", "kind": "news", "title": "Zitec: Vulnerabilitățile în PHP sunt amplificate de inteligența artificială", "published": "2026-10-23T11:03:29+00:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "0c9ce24c24951204c214ffc1f136463d76d0141e622d51e95018831579cbde21", "bytes": 1644 }, "page.html": { "sha256": "6deb3f336bbe8b1312c04b40a4edc6fcc9ba52aff99f221a552b8ef21b7f0c28", "bytes": 130725 }, "provenance.json": { "sha256": "1db6a03e3f4b129c380d022a950f5b75832d690859877332e41da18bf5f4e1b6", "bytes": 1802 }, "rendered.html": { "sha256": "d78f4cbb44de1c0679527f426f39872247d407007436b572c8246726fd97da79", "bytes": 190115 }, "screenshot.jpg": { "sha256": "024462c93e26ebddbc834c5b3f4855868af1a2c100526f0ff893fa31725d99d8", "bytes": 744610 }, "text.txt": { "sha256": "f3b1302f35845fa712621e8974a08d666b6c2b56135382753e3016f9f464da8a", "bytes": 14648 } }, "started_utc": "2026-10-23T23:39:50.754Z", "status": 200, "final_url": "https://economedia.ro/zitec-vulnerabilitatile-in-php-sunt-amplificate-de-inteligenta-artificiala.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ro", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Economedia (Romanian), 23 October: Zitec says the PHP vulnerabilities are amplified by AI. It says they have been in PHP for more than ten years and t...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Zitec: Vulnerabilitățile în PHP sunt amplificate de inteligența artificială\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ro/news/economedia/zitec-vulnerabilitatile-in-php-sunt-amplificate-de-inteligen`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEconomedia (Romanian), 23 October: Zitec says the PHP vulnerabilities are amplified by AI. It says they have been in PHP for more than ten years and that, per Calif, the behaviour behind the problem was flagged in a bug report back in 2020 with no follow-up; in 2024, during PHP's first external security audit, a core developer noticed early signs, as the PHP Foundation itself confirms, but no concrete exploitation path was found and the patch was delayed. This year AI models changed that: Wiz, Google, OpenAI and Calif found the flaws in August with AI help and kept them confidential until updates were ready. It also mentions a separate incident of the same week, the compromise of the private keys of eight certificates.\n\n> Wiz, Google, OpenAI și Calif au descoperit vulnerabilitățile în august, cu ajutorul AI, și le-au ținut confidențiale până când update-urile au fost pregătite.\n\n_Curator's translation:_ \"Wiz, Google, OpenAI and Calif discovered the vulnerabilities in August with the help of AI and kept them confidential until the updates were ready.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Zitec: Vulnerabilitățile în PHP sunt amplificate de inteligența artificială\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ro`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "economictimes-indiatimes-tech-technology-what-is-the-php-security", "url": "https://economictimes.indiatimes.com/tech/technology/what-is-the-php-security-vulnerability-the-ai-found-bug-that-made-governments-take-websites-offline/videoshow/135121300.cms", "publisher": "The Economic Times", "kind": "news", "title": "What is the PHP security vulnerability: The AI-found bug that made governments take websites offline - The Economic Times Video | ET Now", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "025281a6a4aa70d4482228847c2553790d30718646b251f1803c7cb635a6ebfe", "bytes": 3528 }, "page.html": { "sha256": "c4e3d17af794e4b993d3e39bdb701b1de505d4ef10f2c7e3a44ac61b6f9633b6", "bytes": 212750 }, "provenance.json": { "sha256": "679fc77c5e92c1a2d825d83cf9cc585df93526cf612cfad14fc0d66331182a6c", "bytes": 2050 }, "rendered.html": { "sha256": "22f73e18c439460c72b31d738e7da6317938321ca98eeff95dca7a38f57788e3", "bytes": 242825 }, "screenshot.jpg": { "sha256": "9588f50f7b8034f514ccb4aafc2a4a2ac9001b14f6a73bd23cec7c0072be0e73", "bytes": 470506 }, "text.txt": { "sha256": "a7048259754b30de972772d573a3eca368f8ee827b0acfdcc318ce64d0dce735", "bytes": 10959 } }, "started_utc": "2026-10-23T16:17:12.087Z", "status": 200, "final_url": "https://economictimes.indiatimes.com/tech/technology/what-is-the-php-security-vulnerability-the-ai-found-bug-that-made-governments-take-websites-offline/videoshow/135121300.cms" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). The Economic Times (a video explainer page, with a short text): a critical PHP flaw, the language behind roughly three in four websites, sent governme...", "raw_sha256": {}, "has_notes": true, "notes_md": "# What is the PHP security vulnerability: The AI-found bug that made governments take websites offline - The Economic Times Video | ET Now\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `in/news/economictimes-indiatimes/tech-technology-what-is-the-php-security-vulnerability-the-a`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Economic Times (a video explainer page, with a short text): a critical PHP flaw, the language behind roughly three in four websites, sent governments scrambling; the two flaws, nicknamed PHP2Shell, could let attackers take over sites without logging in, found with AI's help. The substance is in the video, which is not captured.\n\n> Researchers say the two vulnerabilities, nicknamed PHP2Shell, could let attackers take over websites without logging in.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"What is the PHP security vulnerability: The AI-found bug that made governments take websites offline - The Economic Times Video | ET Now\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "edinburgh-council-site", "url": "https://www.edinburgh.gov.uk/", "publisher": "edinburgh.gov.uk", "kind": "government", "title": "Home – The City of Edinburgh Council", "published": null, "captures": [ { "stamp": "20261022T081903Z", "files": { "headers.json": { "sha256": "3db91a541f2cf7c4f3d76752f43c56bef4372e62b4ac0b8f309810008b1d662b", "bytes": 664 }, "page.html": { "sha256": "2163dd11e33228af8669e2da021b61c265764eeb38647d58f7cd87e97ebf92c5", "bytes": 64820 }, "provenance.json": { "sha256": "f2805581fa9badaba2c438cbd97c178663d6cc1916480b895b8a226f492bbf06", "bytes": 928 }, "rendered.html": { "sha256": "409acf83e164b76627324f651cf203ea0e4bd0629fd3fe0344a5c2e7f66fe78f", "bytes": 85320 }, "screenshot.png": { "sha256": "8d784233c15729623423aec71e016f26af6a8e692efe968707933fbab42d2f50", "bytes": 935396 }, "text.txt": { "sha256": "a1add594e2848a98ce202e01007453d32f25473f0665e95b6b5412d81665524e", "bytes": 2792 } }, "started_utc": "2026-10-22T08:19:03.127Z", "status": 200, "final_url": "https://www.edinburgh.gov.uk/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "edinburghnews-council-offline", "url": "https://www.edinburghnews.scotsman.com/news/edinburgh-council-website-offline-as-operators-race-to-patch-critical-vulnerability-9302597", "publisher": "edinburghnews.scotsman.com", "kind": "news", "title": "Edinburgh council website offline as operators race to patch critical vulnerability", "published": null, "captures": [ { "stamp": "20261022T081124Z", "files": { "headers.json": { "sha256": "1eb9dcef9574ab7d6866c511237c9123ad009e29f3be926d53909e2d2f33707b", "bytes": 1508 }, "page.html": { "sha256": "ef17d1be8aea7718c5afb4d6d207e0201d954555fee4c8a73bf4dd17f9a51937", "bytes": 253961 }, "provenance.json": { "sha256": "c182f93fb8230419e2b79d3b764bb790a224188e58f63e52dd0ed1e21ab57287", "bytes": 1192 }, "rendered.html": { "sha256": "fbd4f185d407d87293e272b53090d6617a049d4f483075b6134bd6b176bde0f2", "bytes": 640085 }, "screenshot.png": { "sha256": "cc000383e04351c03cf813489d560f7e4214dccc32809ab492b5a9debfe0490a", "bytes": 1643684 }, "text.txt": { "sha256": "ec7b1d470016d4f655c747a0bcd2b1f77d65d6b3d9e69ccf0386e948a34178e0", "bytes": 9721 } }, "started_utc": "2026-10-22T08:11:24.705Z", "status": 200, "final_url": "https://www.edinburghnews.scotsman.com/news/edinburgh-council-website-offline-as-operators-race-to-patch-critical-vulnerability-9302597" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "eldebate-tecnologia-20261022-php2shell-vulnerabil", "url": "https://www.eldebate.com/tecnologia/20261022/php2shell-vulnerabilidad-masiva-descubierta-ia-amenaza-70-paginas-web-mundo-cns_472527.html", "publisher": "El Debate", "kind": "news", "title": "PHP2Shell: la vulnerabilidad masiva descubierta por IA que amenaza al 70 % de las páginas web del mundo", "published": "2026-10-22T09:07:33Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "dff48cf6e6525aa5d171c4b094ecdb4c587a281309266809e8b574855614f73f", "bytes": 545 }, "page.html": { "sha256": "f323883239e79314283d518267fbb9d7f2ca8eeaa5ffcad8f11081146069bc17", "bytes": 130146 }, "provenance.json": { "sha256": "b5964ff84c0d1afea8ba119bb989ab9c6d260c091f7ce8d40242a69fe2e3ce90", "bytes": 1891 }, "rendered.html": { "sha256": "02f77d3bc78557eb867e477176827aba956896be2dfb7568d9c8147369dd518d", "bytes": 188491 }, "screenshot.jpg": { "sha256": "7fb60021e38331de4d40dad9358a35344528da6280bd46566f0b689d3786ede3", "bytes": 480985 }, "text.txt": { "sha256": "2ea48e54e64b5684346929f4f02c4dc7ce17048f9f69d817c8ca3f5df0494ba9", "bytes": 3712 } }, "started_utc": "2026-10-23T16:09:04.387Z", "status": 200, "final_url": "https://www.eldebate.com/tecnologia/20261022/php2shell-vulnerabilidad-masiva-descubierta-ia-amenaza-70-paginas-web-mundo-cns_472527.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). El Debate (Spanish), 22 October: PHP2Shell, the massive AI-found vulnerability threatening 70% of the world's web pages. It also says the event coinci...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: la vulnerabilidad masiva descubierta por IA que amenaza al 70 % de las páginas web del mundo\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/eldebate/tecnologia-20261022-php2shell-vulnerabilidad-masiva-descubie`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEl Debate (Spanish), 22 October: PHP2Shell, the massive AI-found vulnerability threatening 70% of the world's web pages. It also says the event coincided with other technical failures at platforms such as Node.js, GitLab and Railway, but none of the three companies linked their incidents to PHP2Shell, treating them as independent failures at the same time.\n\n> ninguna de estas tres compañías ha vinculado estos incidentes con el problema de PHP2Shell, tratándose de fallos independientes que han ocurrido al mismo tiempo.\n\n_Curator's translation:_ \"none of these three companies has linked these incidents to the PHP2Shell problem, these being independent failures that happened at the same time.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ El Debate gives a simple explainer: PHP2Shell lets attackers take over servers without passwords, was found with AI tools, and the only real fix is updating PHP. It says authorities told sites that cannot patch to go offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: la vulnerabilidad masiva descubierta por IA que amenaza al 70 % de las páginas web del mundo\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "elmundo-economia-2026-10-21-6ad92780fc6c83a57e8b", "url": "https://www.elmundo.es/economia/2026/10/21/6ad92780fc6c83a57e8b45a4.html", "publisher": "EL MUNDO", "kind": "news", "title": "Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica", "published": "2026-10-21T21:05:33Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d11d72dedf488d63f338b220bf1e083a9cfc1231bb4110475e988078a75c1a29", "bytes": 610 }, "page.html": { "sha256": "6db702efb67e4fa11a991e973643047f7e8b7e9d2239b34ecdf0f14f38653a2d", "bytes": 317491 }, "provenance.json": { "sha256": "820360a0196ec29e84b026a844ac130042696c47d62cbb1c26d2b283e4da0b49", "bytes": 1723 }, "rendered.html": { "sha256": "2a8f67b0262ab69428c55fd46024af57ece81cc993d018a913b287dc5a7485dc", "bytes": 514340 }, "screenshot.jpg": { "sha256": "5ae361a6732ccc588f3f9c516e034ad36f23f8ce3af612af2a590f2b9dd3581a", "bytes": 689618 }, "text.txt": { "sha256": "3cb32b5c866117283422ed8245edd4c6d8d19e11e737e59bad70938792ccbfcf", "bytes": 14811 } }, "started_utc": "2026-10-23T16:14:20.435Z", "status": 200, "final_url": "https://www.elmundo.es/economia/2026/10/21/6ad92780fc6c83a57e8b45a4.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). El Mundo (Spanish), 21 October: PHP2Shell is the name the security community gave to two critical PHP flaws in the language behind about 70% of websit...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/elmundo/economia-2026-10-21-6ad92780fc6c83a57e8b45a4-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEl Mundo (Spanish), 21 October: PHP2Shell is the name the security community gave to two critical PHP flaws in the language behind about 70% of websites. The project published the fixed versions on Wednesday with an unusual message: no setting can fully protect, only the update does. It explains CVE-2026-109618 as arising when PHP runs out of memory mid-request and leaves internal structures half built, which the clean-up phase then treats as complete.\n\n> no hay ajuste posible que proteja del todo\n\n_Curator's translation:_ \"there is no possible setting that protects completely\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ El Mundo explains PHP2Shell and how the two memory-lifecycle bugs work. It stresses the project's message that no configuration fully protects and only updating does.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "elobservador-ciencia-y-tecnologia-sitios-del-estado-c", "url": "https://www.elobservador.com.uy/ciencia-y-tecnologia/sitios-del-estado-caidos-y-miles-servidores-expuestos-el-impacto-uruguay-la-falla-php-n6061404", "publisher": "El Observador", "kind": "news", "title": "Sitios del Estado caídos y miles de servidores expuestos: el impacto en Uruguay de la falla de PHP", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "9db90204dcaee8c3358e8f555b234a5bdbb1857b37ed8176c069e49ab9ab7baf", "bytes": 2615 }, "page.html": { "sha256": "85a0daffb900197c594a7c3122cfc7602a5fc793488084472c6b0e7610fdb6ff", "bytes": 185017 }, "provenance.json": { "sha256": "5f42c83cb0dcb7ef5110b8de0292b675d1127e989370cc547a58fa3ea1303bc7", "bytes": 1919 }, "rendered.html": { "sha256": "22b50b1d6502d24522d604b07faa6d4af3322eebc4f4a2f50582b524c2a242b2", "bytes": 228769 }, "screenshot.jpg": { "sha256": "50e46684df96042430e30bdfb2be36226f9ac2f1900400d53be28f8158a7c3f8", "bytes": 901080 }, "text.txt": { "sha256": "9aabf8b5b3239ac521c62e6814ec222c391c0f9b36f61f7d43bc1f5643d65f12", "bytes": 19805 } }, "started_utc": "2026-10-23T23:44:13.547Z", "status": 200, "final_url": "https://www.elobservador.com.uy/ciencia-y-tecnologia/sitios-del-estado-caidos-y-miles-servidores-expuestos-el-impacto-uruguay-la-falla-php-n6061404" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es-UY", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). El Observador (Spanish, Uruguay): state sites down and thousands of servers exposed, the impact in Uruguay of the PHP flaw. Citing analysts of Team Ca...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Sitios del Estado caídos y miles de servidores expuestos: el impacto en Uruguay de la falla de PHP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `uy/news/elobservador/ciencia-y-tecnologia-sitios-del-estado-caidos-y-miles-servid`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEl Observador (Spanish, Uruguay): state sites down and thousands of servers exposed, the impact in Uruguay of the PHP flaw. Citing analysts of Team Capybara, an independent Latin American cyber-intelligence group, it says the two flaws had been hidden in the code for 14 years; it adds that the researchers who found PHP2Shell used AI in August, within OpenAI's 'Patch the Planet' initiative.\n\n> las dos fallas, bautizadas como PHP2Shell, llevaban 14 años escondidas en el código.\n\n_Curator's translation:_ \"the two flaws, baptised PHP2Shell, had been hidden in the code for 14 years.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Sitios del Estado caídos y miles de servidores expuestos: el impacto en Uruguay de la falla de PHP\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es-UY`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "elotrolado-noticias-internet-php2shell-seguridad-cv", "url": "https://www.elotrolado.net/noticias/internet/php2shell-seguridad-cve", "publisher": "ElOtroLado.net", "kind": "news", "title": "Dos vulnerabilidades críticas en PHP afectan al 70 % de Internet", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "04b017d6841f2f14b03b04d768be367e380f16178f14b7625eed156cf9b056ea", "bytes": 498 }, "page.html": { "sha256": "92a6af8997170384d50bd567fadeddde0d25bf9559960901fda5fc99334e7f5a", "bytes": 37656 }, "provenance.json": { "sha256": "3d5e3644104a9977b671db8483d4352301cb8cc36bec22fd5dfbe68f36c5b3e2", "bytes": 1683 }, "rendered.html": { "sha256": "7b121d8b5cb647805efeecf7b2c5f7536c7947cd1c03b15b1b1de35d2b8763d3", "bytes": 105015 }, "screenshot.jpg": { "sha256": "956a757f9126ae2ab0ade68e4ab3cfbe8060fb9e92980ec8dcf7d7139dc90858", "bytes": 516330 }, "text.txt": { "sha256": "b6266f29e4a535fbeff017325a0ad5baa486e21ae801ac5579d897686ba8475a", "bytes": 9308 } }, "started_utc": "2026-10-25T09:41:19.411Z", "status": 200, "final_url": "https://www.elotrolado.net/noticias/internet/php2shell-seguridad-cve" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). ElOtroLado.net (Spanish): two critical vulnerabilities in PHP affect 70% of the Internet. PHP2Shell is the name of two critical flaws in PHP's core, C...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Dos vulnerabilidades críticas en PHP afectan al 70 % de Internet\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `co/news/elotrolado/noticias-internet-php2shell-seguridad-cve`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nElOtroLado.net (Spanish): two critical vulnerabilities in PHP affect 70% of the Internet. PHP2Shell is the name of two critical flaws in PHP's core, CVE-2026-109618 and CVE-2026-109619, both rated 9.2; both sit in core parts of PHP used to process requests; an attacker could take control of affected servers, steal credentials and modify the sites they host; it names WordPress, Joomla, Drupal and MediaWiki among PHP users.\n\n> PHP2Shell es el nombre con el que se conocen dos vulnerabilidades críticas en el núcleo de PHP, identificadas como CVE-2026-109618 y CVE-2026-109619.\n\n_Curator's translation:_ \"PHP2Shell is the name by which two critical vulnerabilities in the core of PHP are known, identified as CVE-2026-109618 and CVE-2026-109619.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Dos vulnerabilidades críticas en PHP afectan al 70 % de Internet\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "emarketerz-faille-majeure-dans-php-que-revele-la-vu", "url": "https://www.emarketerz.fr/faille-majeure-dans-php-que-revele-la-vulnerabilite-php2shell/", "publisher": "EmarketerZ", "kind": "news", "title": "Faille majeure dans PHP : Que révèle la vulnérabilité PHP2Shell ?", "published": "2026-10-22T10:02:14+00:00", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "6bdfbfd206cd23df0b1a064214545f199a3cc596cd0edf1995e236d0654fabe7", "bytes": 689 }, "page.html": { "sha256": "293afe937a2dfa362effdfaf0dc3229b89dd130add9a07794f95f7f97780b3b5", "bytes": 95945 }, "provenance.json": { "sha256": "c8748259b7c75ab58aed930e47eaea09053408a9daf37a08d7e8d2681b2153ba", "bytes": 1765 }, "rendered.html": { "sha256": "8e5376f6c447009f5ab767776e535e5161c7c4b2035a807b5fb85d2037ac3cad", "bytes": 1275403 }, "screenshot.jpg": { "sha256": "7488a969fad4e2d8268523590668b2b6cc6d62be66207165d6f18f59b9fb47eb", "bytes": 570780 }, "text.txt": { "sha256": "45604732e794a96d12610b70831841c1043e1c76377dbe2eea07caf393e249a1", "bytes": 9656 } }, "started_utc": "2026-10-23T08:16:17.433Z", "status": 200, "final_url": "https://www.emarketerz.fr/faille-majeure-dans-php-que-revele-la-vulnerabilite-php2shell/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). EmarketerZ (French), 22 October: a major PHP flaw; a critical vulnerability named PHP2Shell affects PHP and allows remote code execution; a general ex...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Faille majeure dans PHP : Que révèle la vulnérabilité PHP2Shell ?\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/emarketerz/faille-majeure-dans-php-que-revele-la-vulnerabilite-php2shel`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEmarketerZ (French), 22 October: a major PHP flaw; a critical vulnerability named PHP2Shell affects PHP and allows remote code execution; a general explainer of the global risk.\n\n> Une vulnérabilité critique nommée PHP2Shell impacte PHP, permettant l’exécution de code à distance.\n\n_Curator's translation:_ \"A critical vulnerability named PHP2Shell affects PHP, allowing remote code execution.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Faille majeure dans PHP : Que révèle la vulnérabilité PHP2Shell ?\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "encause-failles-php-critiques-php2shell-mise-a-j", "url": "https://encause.fr/failles-php-critiques-php2shell-mise-a-jour/", "publisher": "En cause", "kind": "news", "title": "Failles PHP critiques : versions corrigées à installer", "published": "2026-10-25", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "3fe4bc1dbf9cd1e4c1d5dc5ae6c3ce2f667ad1087ea870901592c91cdfe2143f", "bytes": 376 }, "page.html": { "sha256": "3a650735a4b0c9133744deff3e340a68e6c833d5a1e1dd1feae5b121d5e5acba", "bytes": 101569 }, "provenance.json": { "sha256": "95eab7956a8cf76455e860b2420a44b14f3ab4cfe092f13f770445fa88ec95c9", "bytes": 1659 }, "rendered.html": { "sha256": "6971e030517f98ccbc99bf3a35d955712f3139596141508cab4ec5f63147eac6", "bytes": 137383 }, "screenshot.jpg": { "sha256": "5ed4bf59e9a9a6adc8750f2e1dae48eb8597d50fa1d086f3280a87026e9a9616", "bytes": 178854 }, "text.txt": { "sha256": "1ecd0b24e1d4da884fad35618300be6cd6b1fa6fde1291afd13f4bca9382ee2f", "bytes": 2054 } }, "started_utc": "2026-10-26T07:20:39.634Z", "status": 200, "final_url": "https://encause.fr/failles-php-critiques-php2shell-mise-a-jour/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). En cause (French), 25 October, by Arnaud Virel. The capture holds the lead, the table of contents and the first section only (the rest sits behind a '...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Failles PHP critiques : versions corrigées à installer\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/encause/failles-php-critiques-php2shell-mise-a-jour`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEn cause (French), 25 October, by Arnaud Virel. The capture holds the lead, the table of contents and the first section only (the rest sits behind a 'read more'). The lead says two critical PHP flaws allow remote code execution without authentication under some conditions, that the PHP project, CISA and CERT-EU ask for an immediate update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and that CISA had not yet seen successful exploitation at its last update. The contents list a third vulnerability reported on 23 October and a section on no public proof of a successful attack at that hour; that text is not in the capture.\n\n> Le projet PHP, la CISA et le CERT-EU demandent une mise à jour immédiate vers PHP 8.5.12, 8.4.27, 8.3.36 ou 8.2.35.\n\n_Curator's translation:_ \"The PHP project, CISA and CERT-EU ask for an immediate update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Failles PHP critiques : versions corrigées à installer\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "enisa-cnw-2026-04-php", "url": "https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md", "publisher": "ENISA / EU CSIRTs Network (CNW)", "kind": "advisory", "title": "CSIRTs Network - php2shell (CNW-2026-04)", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081329Z", "files": { "headers.json": { "sha256": "4fddd3b1827235c9608b8a4c92566f15c7fde3ea496d7a74061d64b18fdd4072", "bytes": 5637 }, "page.html": { "sha256": "212f41dffb19edf392212f2ec2997428225cc9da6dbbcf1361dffc30f3ac163f", "bytes": 252581 }, "provenance.json": { "sha256": "ce33999aec2752cab53039232bb4a7da90a38f090b374d68f470a0f9c78f4c7a", "bytes": 1052 }, "rendered.html": { "sha256": "3d40c318822605660674e8a69d6a51d523c3df892b77cd2ccf520e51bb9ad552", "bytes": 295999 }, "screenshot.png": { "sha256": "0b9c0e94049921b40590086857c547bc0dea05461fad30201388de32c3f35c8e", "bytes": 451547 }, "text.txt": { "sha256": "dfcaa1afe1c4194c00ff2dc38b4fab496a900ce9b4e770a722b4bae96b886093", "bytes": 3930 } }, "started_utc": "2026-10-22T08:13:29.042Z", "status": 200, "final_url": "https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "EU CSIRTs Network index of national advisories (date 21-October-2026). Lists ~30 national CSIRT alert links. The 'Mitigation' field still holds unfilled template text. The title has a typo: 'CVE-2026-10961'. curl got 403 from GitHub; Playwright got 200.", "raw_sha256": {}, "has_notes": true, "notes_md": "# ENISA CSIRTs Network advisory CNW-2026-04 (php2shell)\n\n- On GitHub, enisaeu/CNW, advisories/2026/CNW-2026-04_php.md. Latest commit 5763905 \"Update CNW-2026-04_php.md\" by Ruhofw. Date field: \"21-October-2026\".\n- Captured 2026-10-22T08:13:29Z (curl got HTTP 403 from GitHub, but the Playwright capture worked).\n- Oddities: the heading reads \"CVE-2026-109618 en CVE-2026-10961\" (a truncated CVE, and Dutch \"en\"). The Mitigation field is still template placeholder text (\"Short description of confirmed mitigation ending with ...\"). It is clearly a work in progress.\n- Details text is quoted from advisories.ncsc.nl: \"believed to be present in all current versions of PHP, and at the very least in all versions from 5 onwards.\"\n- Its member alert list is the best index of national advisories: CERT-AT, CERT.bg, GovCERT.CZ (NUKIB), CFCS (DK), CERT-EE (RIA), CCN-CERT, INCIBE-CERT, CERT-EU, NCSC-FI, CERT-FR (CERTFR-2026-ALE-014), CERT.hr, CERT NCSC (HR), NCSC-HU, NCSC-IE (PDF), ACN/CSIRT Italia, CERT LT (NKSC), CIRCL TR-102, CERT-LV, NCSC-NL, CERT.PL, CNCS (PT), DNSC (RO), CERT-SE, SI-CERT, SK-CERT. The URLs are in the captured rendered.html.\n" }, { "slug": "epfl-site", "url": "https://www.epfl.ch/", "publisher": "epfl.ch", "kind": "government", "title": "EPFL", "published": null, "captures": [ { "stamp": "20261022T081913Z", "files": { "headers.json": { "sha256": "71e94789020c6c4c4865396b8083f9363945273387a12cf1b8099331557f7763", "bytes": 1985 }, "page.html": { "sha256": "4f32cdfa87dfcb2e8cefa3f66fa5fb1f7cbc051e4b857f87a6f0d17ad9def390", "bytes": 54622 }, "provenance.json": { "sha256": "de73766f9e91d943f5daf93228e41a6ebf70cf5e97f0b69b93a389a57e4647da", "bytes": 866 }, "rendered.html": { "sha256": "dddeb8e3424dceed5e931abc113b9e234e486bb6d4a862e10f41f2eceb3e4cee", "bytes": 309261 }, "screenshot.png": { "sha256": "9dffda66f8102b91cf8fd809c878f0efa917a63c2b0cb98488f453de43353425", "bytes": 1141176 }, "text.txt": { "sha256": "64c6b41680b8451e2b495d134a010f3ba099573dcb4896577174321e56fdcf39", "bytes": 2321 } }, "started_utc": "2026-10-22T08:19:13.285Z", "status": 200, "final_url": "https://www.epfl.ch/en/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "equixly-php2shell-what-we-know", "url": "https://equixly.com/blog/2026/10/21/cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell-and-how-to-prepare/", "publisher": "Equixly", "kind": "vendor", "title": "CVE-2026-109618 and CVE-2026-109619: What we know about PHP2Shell and how to prepare | Equixly", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112832Z", "files": { "headers.json": { "sha256": "f7cf1d20d42b031e13757abae43ca1755e99a6e9bb3c4924d4b4d4a220ecc177", "bytes": 916 }, "page.html": { "sha256": "850a5ee9c4cc603f0e67b5b759b07fd4fa2a58589e3a5ca3c118bb52bb137f1e", "bytes": 69255 }, "provenance.json": { "sha256": "9e7737082f0e4348bffb9bbee063d4618149ca26ce04c93ad349a82de0747038", "bytes": 1174 }, "rendered.html": { "sha256": "5f9daf95daffe64c7e40e58452326ecada0b2a45839cc411b569ccd3d8aa0152", "bytes": 137760 }, "screenshot.png": { "sha256": "4ff3a6bf1cf643f1beaea2676b32f6a8763bd97a1c958c2647e3613fdd247fde", "bytes": 2260486 }, "text.txt": { "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "bytes": 14172 } }, "started_utc": "2026-10-22T11:28:32.586Z", "status": 200, "final_url": "https://equixly.com/blog/2026/10/21/cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell-and-how-to-prepare/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer listing exploitation as disputed and KEV as not listing the CVEs.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CVE-2026-109618 and CVE-2026-109619: What we know about PHP2Shell and how to prepare | Equixly\n\nCaptured by claude-story-site. Status: captured. Vendor explainer listing exploitation as disputed and KEV as not listing the CVEs.\n\n- Captured for the record.\n" }, { "slug": "es-wired-articulos-hackers-aprovecharon-las-vulne", "url": "https://es.wired.com/articulos/hackers-aprovecharon-las-vulnerabilidades-de-php-dias-antes-de-que-se-corrigieran", "publisher": "WIRED en Español", "kind": "news", "title": "Hackers aprovecharon las vulnerabilidades de PHP días antes de que se corrigieran | WIRED", "published": "2026-10-22T15:12:46.767Z", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "69b2d63ee93a4bb43e387957092382f22a58505cc928c26ddc5182e8bb9ca2c9", "bytes": 1220 }, "page.html": { "sha256": "dee986650463c20f4424591eb018caa803bb2fab1f53b7e899460c27ec98edf6", "bytes": 797022 }, "provenance.json": { "sha256": "5396167f1cca37b286cdfd74e0c1c02acc2ea7866fe8ca4392fb5a54a6231f13", "bytes": 1830 }, "rendered.html": { "sha256": "2af4ff2e608ed6e4fc703769ea66c2f1b40bc1c43790fe255829d2277c529844", "bytes": 972052 }, "screenshot.jpg": { "sha256": "24d349dfcaa84dc2756b79cf08b1ec321412bbf29e4a2cd9534501e76c6b31ef", "bytes": 751948 }, "text.txt": { "sha256": "0a4f5041efb345a34ace2000a7cb2db85e3659a34d70ae2ff6ecec6669b315a9", "bytes": 10218 } }, "started_utc": "2026-10-24T13:36:16.175Z", "status": 200, "final_url": "https://es.wired.com/articulos/hackers-aprovecharon-las-vulnerabilidades-de-php-dias-antes-de-que-se-corrigieran" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es-MX", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). WIRED en Espanol (Spanish), 22 October: hackers took advantage of the PHP vulnerabilities days before they were fixed. It reports that Amazon Web Serv...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Hackers aprovecharon las vulnerabilidades de PHP días antes de que se corrigieran | WIRED\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/es-wired/articulos-hackers-aprovecharon-las-vulnerabilidades-de-php-d`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nWIRED en Espanol (Spanish), 22 October: hackers took advantage of the PHP vulnerabilities days before they were fixed. It reports that Amazon Web Services recorded attempts four days earlier, and that at least one actor started trying to exploit the flaws on 17 October, four days before the public disclosures; the first public proofs of concept began to appear on Wednesday, some apparently hours before the official disclosure; and the flaws are now said to be 'widely exploited'. A Spanish edition of the WIRED story already in the vault in English.\n\n> Amazon Web Services registró hace cuatro días intentos de aprovechar las vulnerabilidades de PHP2Shell que colapsaron internet.\n\n_Curator's translation:_ \"Amazon Web Services recorded, four days ago, attempts to exploit the PHP2Shell vulnerabilities that collapsed the internet.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ WIRED en Español (an adaptation of a WIRED.com article) reports AWS's finding that exploitation was attempted on 17 October, before disclosure, and quotes AWS CISO CJ Moses. It adds a comment from the PHP Foundation CEO.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Hackers aprovecharon las vulnerabilidades de PHP días antes de que se corrigieran | WIRED\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es-MX`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "estadao-tecmundo-ciberseguranca-brecha-no-php-ja", "url": "https://www.estadao.com.br/tecmundo/ciberseguranca/brecha-no-php-ja-gerou-milhoes-de-tentativas-de-exploracao-revela-ceo-da-cloudflare/", "publisher": "Estadão", "kind": "news", "title": "Brecha no PHP já gerou milhões de tentativas de exploração, diz CEO da Cloudflare - Estadão", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "cb470a53618700159216e87818987b137de4f8cf57cdc1eb9fce07df26461e6f", "bytes": 1896 }, "page.html": { "sha256": "f42945126f989e11cfc1297d28d263fa7b52cd2aff79337d5f553912485c3981", "bytes": 597210 }, "provenance.json": { "sha256": "84b1f2c9269f54aaf2f57681ac2b2114f2932efe094fae7b53fed36f45ecbb60", "bytes": 1879 }, "rendered.html": { "sha256": "abc900320e83cc8f416017315ccaca0a89131280509b4824d3a4f4edfb588faa", "bytes": 451595 }, "screenshot.jpg": { "sha256": "32d46253bb4bf8c2e8e6d307d7714ee3b0f7a1b2248a023bbe007dde97678c72", "bytes": 54287 }, "text.txt": { "sha256": "4bfa9ad84d1811f9d2339bfb91f1262762b3ccea6cdb41e51252a044e723323b", "bytes": 4521 } }, "started_utc": "2026-10-24T08:41:47.493Z", "status": 200, "final_url": "https://www.estadao.com.br/tecmundo/ciberseguranca/brecha-no-php-ja-gerou-milhoes-de-tentativas-de-exploracao-revela-ceo-da-cloudflare/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt-br", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Estadao (Portuguese, Brazil), a TecMundo piece: the PHP breach has already generated millions of exploitation attempts, says Cloudflare's CEO. It says...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Brecha no PHP já gerou milhões de tentativas de exploração, diz CEO da Cloudflare - Estadão\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/estadao/tecmundo-ciberseguranca-brecha-no-php-ja-gerou-milhoes-de-te`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEstadao (Portuguese, Brazil), a TecMundo piece: the PHP breach has already generated millions of exploitation attempts, says Cloudflare's CEO. It says the flaws, CVE-2026-109618 and CVE-2026-109619, are in the runtime of the PHP language itself, which supports almost 70% of the internet.\n\n> As vulnerabilidades encontradas no PHP foram classificadas como CVE-2026-109618 e CVE-2026-109619\n\n_Curator's translation:_ \"The vulnerabilities found in PHP were classified as CVE-2026-109618 and CVE-2026-109619\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Brecha no PHP já gerou milhões de tentativas de exploração, diz CEO da Cloudflare - Estadão\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt-br`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "estrelladigital-articulo-ciberseguridad-llave-maestra-in", "url": "https://www.estrelladigital.es/articulo/ciberseguridad/llave-maestra-internet-asi-rompio-secreto-php2shell/20261023071000452430.html", "publisher": "Estrella Digital", "kind": "news", "title": "La llave maestra de internet: así se rompió el secreto de PHP2Shell", "published": "2026-10-23T07:10:00+02:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "908470ea4974ba463a6bd50ed25ed6966de46ed6598c9f9e86c9df5568583f3e", "bytes": 925 }, "page.html": { "sha256": "120ba93cac25b5ed9a9467267b33cc3a22925fb0ff10fcac1f5972305c04e320", "bytes": 487367 }, "provenance.json": { "sha256": "64917684c4f395707d764fe2ef679848d139d6e8bdaadd6b284dc20d85e81241", "bytes": 1868 }, "rendered.html": { "sha256": "9c2b6ccbc03f7d4f3012d2db45a4fbe6ed2800493592155d8b9ba9d6446563c6", "bytes": 490401 }, "screenshot.jpg": { "sha256": "a2789836ef16b11ea4aef0a06e9056aa4d458e6da895ae954b935c65f8fb924c", "bytes": 566565 }, "text.txt": { "sha256": "2aa02084e3172fd9ca086b65c7bb965d9b2e8ae122cc75c10d41731bcf5dbacc", "bytes": 9874 } }, "started_utc": "2026-10-24T08:46:32.521Z", "status": 200, "final_url": "https://www.estrelladigital.es/articulo/ciberseguridad/llave-maestra-internet-asi-rompio-secreto-php2shell/20261023071000452430.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Estrella Digital (Spanish), 23 October: 'the master key of the internet: how the PHP2Shell secret was broken'. It says nobody had been hacked yet and...", "raw_sha256": {}, "has_notes": true, "notes_md": "# La llave maestra de internet: así se rompió el secreto de PHP2Shell\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/estrelladigital/articulo-ciberseguridad-llave-maestra-internet-asi-rompio-se`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEstrella Digital (Spanish), 23 October: 'the master key of the internet: how the PHP2Shell secret was broken'. It says nobody had been hacked yet and that it was about closing the door before anyone came in, and explains PHP as the invisible language behind WordPress, PrestaShop, Drupal, Joomla and Moodle, so a town council's blog, a small shop, a university's virtual campus or a newspaper's portal.\n\n> Nadie había sido hackeado todavía. Se trataba de cerrar la puerta antes de que alguien entrara.\n\n_Curator's translation:_ \"Nobody had been hacked yet. It was about closing the door before anyone came in.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"La llave maestra de internet: así se rompió el secreto de PHP2Shell\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "etnews-20261023000089", "url": "https://www.etnews.com/20261023000089", "publisher": "전자신문", "kind": "news", "title": "엔키화이트햇, 'PHP2Shell' 취약점 무료 진단 도구 공개 - 전자신문", "published": "2026-10-23T10:29:05+09:00", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "5033ae0c9dc914153d76f08d620ddba93afc50df52578ef751688f3c6fa72339", "bytes": 205 }, "page.html": { "sha256": "b274817afad90b7cabd6e2ec2e22a6bad81e4ee8d4f16cf631f2b63fce69bcef", "bytes": 52413 }, "provenance.json": { "sha256": "66fb0d499d4e2afab68bf5559cd5f2e16f2279e66784e15b996514b8517e547e", "bytes": 1548 }, "rendered.html": { "sha256": "b3d96f3f190a8f024122825de73758f3c4adc63e9b1b1db5714c735c1e189bb9", "bytes": 79448 }, "screenshot.jpg": { "sha256": "29db8f38436078a6712b932c7e9bc69aeb4c0a2f493ed1af6b09efed82388f63", "bytes": 356547 }, "text.txt": { "sha256": "e4c16a5b8242d2abef7b2f840ad3c983470265a64cfd8c9720ef0087938dc7a9", "bytes": 7946 } }, "started_utc": "2026-10-26T07:27:42.215Z", "status": 200, "final_url": "https://www.etnews.com/20261023000089" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Electronic Times (Korean), 23 October: the Korean firm Enki WhiteHat released a free diagnostic scanner and a vulnerability analysis report on PHP2She...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 엔키화이트햇, 'PHP2Shell' 취약점 무료 진단 도구 공개 - 전자신문\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/etnews/20261023000089`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nElectronic Times (Korean), 23 October: the Korean firm Enki WhiteHat released a free diagnostic scanner and a vulnerability analysis report on PHP2Shell. The scanner checks the PHP version and related settings to give a first judgement of exposure, without using attack code; users enter a URL on a diagnostic site with no login. The report covers how the flaw arises, affected versions, mitigations and how to apply the official patch (8.5.12, 8.4.27, 8.3.36, 8.2.35); the firm plans to publish more on exposed-asset management. Noted as material only: the vault does not run such tools.\n\n> 엔키화이트햇은 실제 공격 코드를 사용하지 않고 PHP 버전과 관련 설정을 확인해 취약점 노출 가능성을 1차 판별하는 스캐너를 개발했다.\n\n_Curator's translation:_ \"Enki WhiteHat developed a scanner that, without using actual attack code, checks the PHP version and related settings to make a first judgement of vulnerability exposure.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"엔키화이트햇, 'PHP2Shell' 취약점 무료 진단 도구 공개 - 전자신문\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "europapress-portaltic-ciberseguridad-noticia-amazon", "url": "https://www.europapress.es/portaltic/ciberseguridad/noticia-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105435.html", "publisher": "Europa Press", "kind": "news", "title": "Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche", "published": "2026-10-23T10:54:35+02:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "69bca1bdc9486e74b95a513051c6ee5b1a68d677f832461a32dcba0eacef3ad9", "bytes": 792 }, "page.html": { "sha256": "1861c2f91676e6ebd49f1d2a3106249afa2ef1091f1a9085ae744e3fc591cdaa", "bytes": 267771 }, "provenance.json": { "sha256": "b1e0e7394c4540fc1c0e6410f0a3a27a2a2ca5bbdeaa82ac094e2155d4866a45", "bytes": 1983 }, "rendered.html": { "sha256": "164da68d36f4a801d8bda3a4a1e69a45475628882b4a431955b395f8aa74cddc", "bytes": 625916 }, "screenshot.jpg": { "sha256": "2451b349fbd9f5a65d58f99b0f2239b0da5e74f2c7c90df73a76624fdc4bd9a6", "bytes": 607999 }, "text.txt": { "sha256": "a3d0f225217dc3a6578a656f30d6438fd0e87e35c0c54896e74e09ed2c7968a6", "bytes": 7999 } }, "started_utc": "2026-10-23T23:31:59.278Z", "status": 200, "final_url": "https://www.europapress.es/portaltic/ciberseguridad/noticia-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105435.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Europa Press (Spanish), 23 October: Amazon detected attempts to exploit PHP2Shell days before the vulnerabilities and their patch were disclosed, acco...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/europapress/portaltic-ciberseguridad-noticia-amazon-detecto-intentos-exp`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEuropa Press (Spanish), 23 October: Amazon detected attempts to exploit PHP2Shell days before the vulnerabilities and their patch were disclosed, according to an Amazon Threat Intelligence report; The PHP Group published the two critical flaws, CVE-2026-109618 and CVE-2026-109619, on 21 October and released the urgent security update that day.\n\n> Actores de amenazas intentaron explotar las vulnerabilidades críticas identificadas en el ecosistema PHP, conocidas como PHP2Shell, días antes de que se hicieran públicas el pasado miércoles, como se desprende de un informe de Amazon Threat Intelligence.\n\n_Curator's translation:_ \"Threat actors tried to exploit the critical vulnerabilities identified in the PHP ecosystem, known as PHP2Shell, days before they were made public last Wednesday, as an Amazon Threat Intelligence report shows.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "europe-infos-actualites-11979-php2shell-decryptage-d", "url": "https://www.europe-infos.fr/actualites/11979/php2shell-decryptage-d-une-double-faille-critique-dans-le-moteur-php/", "publisher": "europe-infos", "kind": "news", "title": "PHP2Shell : décryptage d’une double faille critique dans le moteur PHP | Europe Infos", "published": "2026-10-26", "captures": [ { "stamp": "20261026T170916Z", "files": { "headers.json": { "sha256": "d68eb7787058b9c90a8bf59ed4003ff412a9403ca43735f79b075d919599335b", "bytes": 844 }, "page.html": { "sha256": "f43a8c5940283b5359e579fd8b184adfa75b6bd4efd84e45b3a788f11631c9a6", "bytes": 497317 }, "provenance.json": { "sha256": "5cadc6ea10e4e6d53cad8f8744983126c38c004a11fe844c3e54557e4c5599bd", "bytes": 1841 }, "rendered.html": { "sha256": "9ae61f3c41d68ed5e0022bdb4adf3abb113837a4a304354ec018bbdfb41168b5", "bytes": 510306 }, "screenshot.jpg": { "sha256": "111522d5ad95908e468f69bae1153382229f2591291dd08dc75ae31b18efc2bf", "bytes": 725877 }, "text.txt": { "sha256": "130c70f3471fda072abbf79c0891f9f1a7a9aa55ffccfdc86a573dd2cb9d6f45", "bytes": 10515 } }, "started_utc": "2026-10-26T17:18:43.398Z", "status": 200, "final_url": "https://www.europe-infos.fr/actualites/11979/php2shell-decryptage-d-une-double-faille-critique-dans-le-moteur-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T170916Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Europe Infos (French), 26 October, by Michel Labise: an explainer on PHP2Shell, saying the flaws found with AI analysis stayed hidden in PHP's core si...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : décryptage d’une double faille critique dans le moteur PHP | Europe Infos\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/europe-infos/actualites-11979-php2shell-decryptage-d-une-double-faille-cr`, snapshot `20261026T170916Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T170916Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEurope Infos (French), 26 October, by Michel Labise: an explainer on PHP2Shell, saying the flaws found with AI analysis stayed hidden in PHP's core since 2012 and that early circulation of technical details led to near-immediate exploitation attempts. It relays one security researcher monitoring honeypots running PHP 8.4.26: 35 malicious PHP shells were launched by Apache processes on three test servers just three days after the patch was available. It adds that many European institutions temporarily disconnected PHP sites while they located PHP, with 'never so many European administrative and public sites made unreachable in one day', and gives a triple-check approach (locate instances, filter external access, audit logs). The page also carries unrelated 'Lire:' lines (about Boris Johnson and a lawyer's portrait) that look inserted by the site.\n\n> Selon un chercheur en cybersécurité ayant surveillé des pots de miel (honeypots) équipés de PHP 8.4.26, 35 shells PHP malveillants ont été lancés par des processus Apache sur trois serveurs tests, tout juste trois jours après la mise à disposition du patch de sécurité.\n\n_Curator's translation:_ \"According to a cyber-security researcher who monitored honeypots running PHP 8.4.26, 35 malicious PHP shells were launched by Apache processes on three test servers just three days after the security patch became available.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : décryptage d’une double faille critique dans le moteur PHP | Europe Infos\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. The article body contains unrelated 'Lire :' related-link lines (one about Boris Johnson, one a lawyer's portrait) that look inserted by the site. Nothing in the text addresses an AI or hides text from a reader.\n" }, { "slug": "expresscomputer-guest-blogs-understanding-php2shell-vuln", "url": "https://www.expresscomputer.in/guest-blogs/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch/140359/", "publisher": "expresscomputer", "kind": "news", "title": "Understanding PHP2Shell vulnerabilities and reducing risk while you patch - Express Computer", "published": "2026-10-24T04:22:21+00:00", "captures": [ { "stamp": "20261024T110459Z", "files": { "headers.json": { "sha256": "28c1f7ee3a190b6f3dcc2c6570123c9454fdde10696d8ec59504fa04a2b5c319", "bytes": 934 }, "page.html": { "sha256": "60cc2738338f2f05d839fdd99cf4d4dc608c7e6ce4d4766967a995c8e64f39a1", "bytes": 206760 }, "provenance.json": { "sha256": "2454d9918848dfd3b7176b1b0662f040b9b1ddb55067a31b6eb5b13e8d68d9b2", "bytes": 1875 }, "rendered.html": { "sha256": "4cfef4f02e7af3e75142a8892a616f9a4742cf4070d530e8b3a43e1cde4c7e8b", "bytes": 206047 }, "screenshot.jpg": { "sha256": "bdb41debd82528360145034c462b23e6920bcd16b1442c8e752228321d64a558", "bytes": 548924 }, "text.txt": { "sha256": "4ab671e782cbacdbbecffd151dc8db7e36d5d3d99047a8dca0f2c511b0b34480", "bytes": 6903 } }, "started_utc": "2026-10-24T11:18:26.787Z", "status": 200, "final_url": "https://www.expresscomputer.in/guest-blogs/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch/140359/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T110459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Express Computer (India), a guest blog of 24 October: two critical PHP vulnerabilities disclosed this week pose an urgent security and business-contin...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Understanding PHP2Shell vulnerabilities and reducing risk while you patch - Express Computer\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `in/news/expresscomputer/guest-blogs-understanding-php2shell-vulnerabilities-and-redu`, snapshot `20261024T110459Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T110459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nExpress Computer (India), a guest blog of 24 October: two critical PHP vulnerabilities disclosed this week pose an urgent security and business-continuity risk for organisations that depend on websites, customer portals and other web applications; collectively PHP2Shell, the flaws may let an unauthenticated attacker execute code on an affected server. A guest column, with advice on reducing risk while patching.\n\n> Two critical PHP vulnerabilities disclosed this week pose an urgent security and business continuity risk for organisations that depend on websites, customer portals, and other web applications.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Understanding PHP2Shell vulnerabilities and reducing risk while you patch - Express Computer\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "fastly-blog-php2shell", "url": "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618", "publisher": "Fastly", "kind": "vendor", "title": "Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastly", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111906Z", "files": { "headers.json": { "sha256": "6756cb0315f3eede874eb6e0c7c5bf69e9530954bc546eed72665c7d035f47a4", "bytes": 1049 }, "page.html": { "sha256": "811a842d39ce55fe1b7b9ef1e35c767deadda63bbf07044ac6d848812045d8fa", "bytes": 164855 }, "provenance.json": { "sha256": "ea10f0c918a09cb23072d0099d2a206b10c844041a8649ce45f3446a7229ccec", "bytes": 1117 }, "rendered.html": { "sha256": "beb13bda9a79b867d0b11deda470a987cd8f76186e6af59cb63333eb6d426839", "bytes": 327821 }, "screenshot.png": { "sha256": "259708a035d74a2d833a8fe3a555097ecee5678d854a5e5357b94bf20566b7e4", "bytes": 2470515 }, "text.txt": { "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "bytes": 20043 } }, "started_utc": "2026-10-22T11:19:06.288Z", "status": 200, "final_url": "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618" }, { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "2de448031ae90cd0f06fd44b637b55bdbfc8c26a1a2366b49d74ec3335313457", "bytes": 1084 }, "page.html": { "sha256": "38708b00ce5a632e41ce45d1af875df5dbfc9f080568ccd906fe81b7bfb20c86", "bytes": 164855 }, "provenance.json": { "sha256": "bb7539f14a97855d49b935b340e081d578ccc64f505a194cb1f30a4280d5772f", "bytes": 1684 }, "text.txt": { "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "bytes": 20043 } }, "started_utc": "2026-10-24T14:00:06.720Z", "status": 200, "final_url": "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Candid on exploitability (PoCs need the binary's layout on x86_64; 32-bit assume compromise), on WAF limits, on signals (segfault bursts, workers spawning /bin/sh) and on more bailout paths to come.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastly\n\nCaptured by claude-story-site. Status: captured. Candid on exploitability (PoCs need the binary's layout on x86_64; 32-bit assume compromise), on WAF limits, on signals (segfault bursts, workers spawning /bin/sh) and on more bailout paths to come.\n\n- 'the existing PoCs require knowledge of the specific, running PHP binary and address space layout on the server for an attack to yield code execution on x86_64, so most deployments may be \"safe\" from RCE. Do not assume this holds true for you. If you operate a 32-bit PHP application, you should likely assume compromise.'\n- 'The PHP source tree calls the zend_bailout mechanism many places'; 'Patching the specific paths that researchers demonstrated does not make the mechanism safe.'\n- 'assume active mitigation will only serve as partial protection and may require blocking a substantial portion of legitimate traffic'.\n- Signals: empty field names with deep nesting; PHP_SESSION_UPLOAD_PROGRESS field; clusters of Apache segfaults then one slow 200; mod_php worker executing /bin/sh -c.\n- Settings: max_input_nesting_level=4; session.upload_progress.enabled=0; pm.max_requests=50.\n- Says PHP published patches for 7.4, 8.0 and 8.1 'for integration by package distributors'.\n" }, { "slug": "faz-aktuell-wirtschaft-mehr-wirtschaft-php-s", "url": "https://www.faz.net/aktuell/wirtschaft/mehr-wirtschaft/php-sicherheitsluecken-die-wichtigsten-fragen-und-antworten-accg-201610624.html", "publisher": "FAZ", "kind": "news", "title": "PHP-Sicherheitslücken: Die wichtigsten Fragen und Antworten | FAZ", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "3626583e141da403bdada7458433a8cdaa8369bdf1a6ea0bdc2e3a7f3dcea740", "bytes": 1618 }, "page.html": { "sha256": "8d1440695e2849a7b2cddef9d4fc0034915b8df28da23457769851b1356022af", "bytes": 482336 }, "provenance.json": { "sha256": "247d860c7ef0a74a89cc01d8cad39f001a5e6f3f3e361d383c29529c708a962d", "bytes": 1833 }, "rendered.html": { "sha256": "a1759346d9c2d976bf219e78b138d383059318f2e15e2cc2a05165125397cdb4", "bytes": 975201 }, "screenshot.jpg": { "sha256": "8f760d1c2e0c6a54e1e6d8614ccedb3616738f0a86042d629488088501c2a99a", "bytes": 870664 }, "text.txt": { "sha256": "92fe267dca9b3449c0e31c9285a0462253b5c3e8a5100f8a88eb2089e6b14899", "bytes": 14150 } }, "started_utc": "2026-10-23T23:27:17.611Z", "status": 200, "final_url": "https://www.faz.net/aktuell/wirtschaft/mehr-wirtschaft/php-sicherheitsluecken-die-wichtigsten-fragen-und-antworten-accg-201610624.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). FAZ (German), a questions-and-answers explainer two days after the disclosure: the flaws are CVE-2026-109618 and CVE-2026-109619, together called PHP2...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Sicherheitslücken: Die wichtigsten Fragen und Antworten | FAZ\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `at/news/faz/aktuell-wirtschaft-mehr-wirtschaft-php-sicherheitsluecken-di`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFAZ (German), a questions-and-answers explainer two days after the disclosure: the flaws are CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell by specialists, each 9.2 out of 10 by the PHP security team's own rating; it explains why the name and that there are in fact two separate bugs. The curator did not copy the page's step-by-step description of how the bugs are triggered.\n\n> Vor zwei Tagen wurden die kritischen PHP-Schwachstellen öffentlich bekannt.\n\n_Curator's translation:_ \"Two days ago the critical PHP vulnerabilities became public.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Sicherheitslücken: Die wichtigsten Fragen und Antworten | FAZ\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "feuerwehrmagazin-nachrichten-dfv-warnt-vor-kritischen-php", "url": "https://www.feuerwehrmagazin.de/nachrichten/dfv-warnt-vor-kritischen-php-sicherheitsluecken-145590", "publisher": "Feuerwehr-Magazin", "kind": "news", "title": "PHP2Shell: DFV warnt Feuerwehren vor kritischen PHP-Sicherheitslücken", "published": "2026-10-21T20:14:17+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "4343e8e3c662d0643f15f711b1187fa0265f4e891e8fa1c793612975b64ac697", "bytes": 527 }, "page.html": { "sha256": "73deba67435638699d469df6d93bdbd45f051327bc4952eba809f7b210cdace0", "bytes": 127618 }, "provenance.json": { "sha256": "55232b6e109c589a7a42cb2623ec1f5441f9956f53ffe62ff209f64b5610b28b", "bytes": 1802 }, "rendered.html": { "sha256": "30d772b7c32017ee4cffa1a3d3b6c73b38f943be111861907da31d2a9282cf98", "bytes": 139803 }, "screenshot.jpg": { "sha256": "2279493055c685fe3147312919957eed42388c8bef83c97553cc1c35e21b5c96", "bytes": 552360 }, "text.txt": { "sha256": "2e4bb7c790153416a8a1a414e7b98254ac8c709a828daad75291ec627c9edcd4", "bytes": 6161 } }, "started_utc": "2026-10-23T16:13:09.114Z", "status": 200, "final_url": "https://www.feuerwehrmagazin.de/nachrichten/dfv-warnt-vor-kritischen-php-sicherheitsluecken-145590" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de-DE", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Feuerwehr-Magazin (German), 21 October: the German Fire Brigade Association (DFV) warns fire brigades of the critical PHP flaws, CVE-2026-109618 and C...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: DFV warnt Feuerwehren vor kritischen PHP-Sicherheitslücken\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/feuerwehrmagazin/nachrichten-dfv-warnt-vor-kritischen-php-sicherheitsluecken`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFeuerwehr-Magazin (German), 21 October: the German Fire Brigade Association (DFV) warns fire brigades of the critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, each 9.2, which can let attackers run their own code remotely on affected servers and read sensitive data without logging in.\n\n> Die unter dem Namen „PHP2Shell“ bekannten Schwachstellen können es Angreifern ermöglichen, ohne vorherige Anmeldung aus der Ferne eigenen Programmcode auf betroffenen Servern auszuführen und sensible Daten auszulesen.\n\n_Curator's translation:_ \"The vulnerabilities known as 'PHP2Shell' can allow attackers to run their own program code remotely on affected servers and read sensitive data without prior login.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: DFV warnt Feuerwehren vor kritischen PHP-Sicherheitslücken\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de-DE`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "fi-valtori", "url": "https://valtori.fi/", "publisher": "valtori.fi", "kind": "government", "title": null, "published": null, "captures": [ { "stamp": "20261022T081938Z", "files": { "provenance.json": { "sha256": "a524455c8bce437ef41ddd72da2d3bb7ef1b59eb1d510c54e71e0c256b484215", "bytes": 440 } }, "started_utc": "2026-10-22T08:19:38.707Z", "error": "page.evaluate: Target page, context or browser has been closed" } ], "status": "failed", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP None, page.evaluate: Target page, context or browser has been closed), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "finance-sina-tech-roll-2026-10-22-doc-iniwcaff5189430", "url": "https://finance.sina.com.cn/tech/roll/2026-10-22/doc-iniwcaff5189430.shtml", "publisher": "新浪财经", "kind": "news", "title": "OpenAI 发现 PHP「世纪漏洞」，全球 70% 网站都危险了_新浪科技_新浪网", "published": "2026-10-22T19:19:18+08:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "704ad2ca5b1bb257266951211d9ec5a3a61f767d4701535a1c9019766454ea06", "bytes": 1400 }, "page.html": { "sha256": "61af69bae7d24210c53e78ba76a05dab88d65073e91e0eee2e237a4cb5f3193c", "bytes": 121966 }, "provenance.json": { "sha256": "d960354ec8369469ead6219415f4b10797bbc4b4be6e55abae7475c73cab30b5", "bytes": 1741 }, "rendered.html": { "sha256": "fac3a680fb51175664d7428af47ca6602f1d3ae1e091326ac8f7f230238f5056", "bytes": 123166 }, "screenshot.jpg": { "sha256": "23954f5d351351e34b1bfc4366c16ece3569f5f70ab7e79b2e62b31d3de5cbd8", "bytes": 62232 }, "text.txt": { "sha256": "a474233db211afbb34f3aee62b3bd9a33bf9547a2321e7e8c1a93ce150443972", "bytes": 9943 } }, "started_utc": "2026-10-23T16:12:35.583Z", "status": 200, "final_url": "https://finance.sina.com.cn/tech/roll/2026-10-22/doc-iniwcaff5189430.shtml" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Sina Finance (Chinese), 22 October: OpenAI found a PHP 'flaw of the century' and 70% of websites worldwide are at risk. Two days earlier the informati...", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI 发现 PHP「世纪漏洞」，全球 70% 网站都危险了_新浪科技_新浪网\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `cn/news/finance-sina/tech-roll-2026-10-22-doc-iniwcaff5189430-shtml`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSina Finance (Chinese), 22 October: OpenAI found a PHP 'flaw of the century' and 70% of websites worldwide are at risk. Two days earlier the information on two high-risk remote-execution flaws codenamed PHP2Shell leaked unexpectedly; the PHP Foundation rates both 9.2 out of 10. It places the event among earlier incidents where a problem in system infrastructure affected many unrelated services.\n\n> 这次爆出的两个漏洞，对应编号分别为 CVE-2026-109618 和 CVE-2026-109619，PHP 基金会给它们定下的严重程度评分达到 9.2 分（满分 10 分）。\n\n_Curator's translation:_ \"The two vulnerabilities exposed this time have the identifiers CVE-2026-109618 and CVE-2026-109619, and the PHP Foundation gave them a severity score of 9.2 out of 10.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Page was down at capture; no text. The title says OpenAI found a 'century bug' in PHP that endangers 70% of websites worldwide.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"OpenAI 发现 PHP「世纪漏洞」，全球 70% 网站都危险了_新浪科技_新浪网\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "finance-yahoo-technology-articles-php-patches-critical", "url": "https://finance.yahoo.com/technology/articles/php-patches-critical-flaw-hitting-151052535.html", "publisher": "Yahoo Finance", "kind": "news", "title": "PHP patches critical flaw hitting 70% of websites; Cloudflare, others surge", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "01ae1bcf8baf3ccf182c4aac70f93aa13d374e1d5cf5ea957852fb640d7e8596", "bytes": 34236 }, "page.html": { "sha256": "377179150738d87537b9a1cc5f31e81e1920ea4c3002debed12d0cc6d55d8a04", "bytes": 884861 }, "provenance.json": { "sha256": "1bbf3e7d8ee54bb7190a0873a7e3a9c67aa95a1a70c65c0a79a4dab42894e3d1", "bytes": 1794 }, "rendered.html": { "sha256": "e68fce99fe71acb07e6be68a2c9001b0c223e647a28a05eed3f7683cbd401b40", "bytes": 970830 }, "screenshot.jpg": { "sha256": "47afc2589b5b03ca5da94428306a340aebce0a7e16cd8a22d8cce1a5a63e7961", "bytes": 289590 }, "text.txt": { "sha256": "6184216b6515747eacf47d15fc849c279be07c7171cb9f89bd4506bec27d4727", "bytes": 3867 } }, "started_utc": "2026-10-23T16:26:49.479Z", "status": 200, "final_url": "https://finance.yahoo.com/technology/articles/php-patches-critical-flaw-hitting-151052535.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Yahoo Finance: PHP patches the critical flaw hitting 70% of websites, and Cloudflare and other stocks rise. The flaws were patched in four simultaneou...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP patches critical flaw hitting 70% of websites; Cloudflare, others surge\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/news/finance-yahoo/technology-articles-php-patches-critical-flaw-hitting-151052`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nYahoo Finance: PHP patches the critical flaw hitting 70% of websites, and Cloudflare and other stocks rise. The flaws were patched in four simultaneous releases (8.5.12, 8.4.27, 8.3.36, 8.2.35). It adds, per sansec.io, that CVE-2026-109618 also carries a Heartbleed-style memory leak able to expose passwords, session tokens, API keys and TLS private keys from other server requests, so the combination of code execution and passive credential harvesting is particularly dangerous for shared hosting running WordPress, Drupal, Joomla and similar.\n\n> The flaws, collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were patched in four simultaneous releases: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP patches critical flaw hitting 70% of websites; Cloudflare, others surge\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "financiarul-tehnologie-vulnerabilitatea-php-este-viz", "url": "https://financiarul.ro/tehnologie/vulnerabilitatea-php-este-vizata-de-milioane-de-accesari-autoritati/", "publisher": "Financiarul", "kind": "news", "title": "Vulnerabilitatea PHP este vizată de milioane de accesări. Autorități europene au oprit preventiv site-uri", "published": "2026-10-22T13:30:16+03:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d168518e422747bcb1922b1a0809239d98a225ff0b3e8773518fa5114a08b231", "bytes": 1740 }, "page.html": { "sha256": "b55295da9cdb343766f532adabae3252f0c4e7f798a706e17d7a4efbed5736c0", "bytes": 81372 }, "provenance.json": { "sha256": "2fc9138a23b4ae04140de5c507e0422d5fa1f69a54a3b72182657d8b4b9c7dd9", "bytes": 1689 }, "text.txt": { "sha256": "f8b89d5d99ae3c99d87b1774f07ef25ed93a2ee1488d0d085a7bd426ff7ed3cd", "bytes": 5368 } }, "started_utc": "2026-10-23T16:24:22.039Z", "status": 200, "final_url": "https://financiarul.ro/tehnologie/vulnerabilitatea-php-este-vizata-de-milioane-de-accesari-autoritati/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ro-RO", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Financiarul (Romanian), 22 October: millions of accesses target the PHP vulnerability and European authorities shut down sites preventively. It reprod...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Vulnerabilitatea PHP este vizată de milioane de accesări. Autorități europene au oprit preventiv site-uri\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ro/news/financiarul/tehnologie-vulnerabilitatea-php-este-vizata-de-milioane-de-a`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFinanciarul (Romanian), 22 October: millions of accesses target the PHP vulnerability and European authorities shut down sites preventively. It reproduces Cloudflare's chief executive's post on X giving the ladder of exploitation attempts: thousands in the 10 hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions now.\n\n> Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Financiarul.ro says several European authorities suspended sites; on 22 October France's Justice Ministry and data-protection authority showed maintenance pages. It quotes Matthew Prince's attempt numbers and Dutch NCSC head Matthijs van Amelsfort. Headlines say Tulcea city hall (Romania) preventively closed its portal and the UK government is checking its services.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Vulnerabilitatea PHP este vizată de milioane de accesări. Autorități europene au oprit preventiv site-uri\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ro-RO`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "fnnews-news-202610230856366360", "url": "https://www.fnnews.com/news/202610230856366360", "publisher": "파이낸셜뉴스", "kind": "news", "title": "\"우리 홈페이지도 위험할까\"…파이오링크, PHP 취약점 점검 페이지 공개 - 파이낸셜뉴스", "published": "2026-10-23T08:56:37+09:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "b47b8454f3c993f13ba1a6c1f31e3ce9324dff6ab4158a439c394b6729bf32fe", "bytes": 1566 }, "page.html": { "sha256": "5047291144a180160a310a105732e860ece7ce9f59f2ab1c9acb24ef30c363af", "bytes": 71342 }, "provenance.json": { "sha256": "86e220bd6f389b8c7e733aa6b54d1e4e5468eb686c2d357034ee269a7414eb81", "bytes": 1626 }, "rendered.html": { "sha256": "c74b9eed4fd754a5a9e8147f7ca67d362afd7c556ae4411b6ca624640b52bb2f", "bytes": 100689 }, "screenshot.jpg": { "sha256": "5d4ad3b5e78d626540a90ac5ba8f192f6192514923fa012b691a1fd6751953a5", "bytes": 410968 }, "text.txt": { "sha256": "eb7a8f436f5a0a0d06e14fe2efb33a684440441a230eaad7f89ad73df08e8125", "bytes": 7331 } }, "started_utc": "2026-10-23T23:37:25.543Z", "status": 200, "final_url": "https://www.fnnews.com/news/202610230856366360" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko-KR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Financial News (Korean), 23 October, from Newsis: the Korean security vendor Piolink opened a 'php2shell emergency check' page on its website to help...", "raw_sha256": {}, "has_notes": true, "notes_md": "# \"우리 홈페이지도 위험할까\"…파이오링크, PHP 취약점 점검 페이지 공개 - 파이낸셜뉴스\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/fnnews/news-202610230856366360`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFinancial News (Korean), 23 October, from Newsis: the Korean security vendor Piolink opened a 'php2shell emergency check' page on its website to help respond to the two PHP flaws; the flaws let an unauthenticated outsider run arbitrary code on a server and score 9.2 out of 10. A vendor service; the curator did not use it.\n\n> 파이오링크는 공식 홈페이지에 'php2shell 긴급점검' 페이지를 열었다고 23일 밝혔다.\n\n_Curator's translation:_ \"Piolink said on the 23rd that it had opened a 'php2shell emergency check' page on its official website.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"\"우리 홈페이지도 위험할까\"…파이오링크, PHP 취약점 점검 페이지 공개 - 파이낸셜뉴스\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko-KR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "forbes-teknoloji-yapay-zekayla-kesfedildi-php-g", "url": "https://www.forbes.com.tr/teknoloji/yapay-zekayla-kesfedildi-php-guvenlik-acigi-neden-onemli", "publisher": "Forbes Türkiye", "kind": "news", "title": "Yapay zekayla keşfedildi: PHP güvenlik açığı neden önemli? - Forbes Türkiye", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "886390069e4e45a68f660aabdf5e0495b1d98d11ab0ae19a4e383dfc8dfb2421", "bytes": 355 }, "page.html": { "sha256": "5932d271eaf6f7a00fe0c77b1df7346c86cbb27eab009fd9105458c052f1c55f", "bytes": 175893 }, "provenance.json": { "sha256": "4c50996c818e3b67b5f64dc1b75f1cced2f79299c9e3f3b3fe9e167e8c7914cb", "bytes": 1625 }, "text.txt": { "sha256": "4f3904974e5da87fcc8f3c01f941500c942ea5b1ba6a7555dd9f040e054e13f1", "bytes": 8241 } }, "started_utc": "2026-10-24T13:57:33.154Z", "status": 200, "final_url": "https://www.forbes.com.tr/teknoloji/yapay-zekayla-kesfedildi-php-guvenlik-acigi-neden-onemli" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Forbes Turkiye (Turkish): found with AI, why the PHP flaw matters. It quotes Wiz's researchers in their blog that these findings are among the most se...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Yapay zekayla keşfedildi: PHP güvenlik açığı neden önemli? - Forbes Türkiye\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/forbes/teknoloji-yapay-zekayla-kesfedildi-php-guvenlik-acigi-neden`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nForbes Turkiye (Turkish): found with AI, why the PHP flaw matters. It quotes Wiz's researchers in their blog that these findings are among the most serious vulnerabilities found in PHP and possibly among the most serious in software history, and says the researchers named the AI-generated exploitation methods php2shell. It also says the Cybersecurity Directorate began national-scale scans, starting with public bodies.\n\n> Wiz araştırmacıları blog yazılarında, “Bu bulgular, PHP’de keşfedilen en ciddi güvenlik açıkları arasında ve muhtemelen yazılım tarihindeki en ciddi açıklar arasında yer alıyor” ifadelerini kullandı.\n\n_Curator's translation:_ \"In their blog post the Wiz researchers said: 'These findings are among the most serious vulnerabilities discovered in PHP and probably among the most serious in software history'.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Yapay zekayla keşfedildi: PHP güvenlik açığı neden önemli? - Forbes Türkiye\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "forest-watch-impress-docs-news-2150167-html", "url": "https://forest.watch.impress.co.jp/docs/news/2150167.html", "publisher": "窓の杜", "kind": "news", "title": "「PHP」の“致命的”な脆弱性2件が修正、ただちにアップデートを - 窓の杜", "published": "2026-10-22T00:00:00+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "1931d4ecc99161b29d3be9e6e430ab40b24897d28bfb7fd20271c008d20687a8", "bytes": 286 }, "page.html": { "sha256": "d4331c90de2ca208ccc03b262e4b9b72dedb07a5bb7da2254c0547cd3e500c47", "bytes": 140297 }, "provenance.json": { "sha256": "aba77746f77bcedc3e0180915ee1f9a0c15ebf309e31c814e649737e1d9dfa32", "bytes": 1583 }, "rendered.html": { "sha256": "c7a8b71a559ebdc6273ade7606c592d0ffa971028b6b16a314d1e403bf420f43", "bytes": 301846 }, "text.txt": { "sha256": "2d34bf9e8eb8f53f0c68b54cf568eb6366c896eed1cddea63c1a1be2110da52a", "bytes": 13325 } }, "started_utc": "2026-10-23T16:19:25.767Z", "status": 200, "final_url": "https://forest.watch.impress.co.jp/docs/news/2150167.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Forest Watch / Mado no Mori (Japanese), 22 October: the two critical PHP vulnerabilities are fixed and users should update at once. It gives the GHSA...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 「PHP」の“致命的”な脆弱性2件が修正、ただちにアップデートを - 窓の杜\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/forest-watch-impress/docs-news-2150167-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nForest Watch / Mado no Mori (Japanese), 22 October: the two critical PHP vulnerabilities are fixed and users should update at once. It gives the GHSA IDs (GHSA-w8hw-w9fx-j79w for CVE-2026-109618, GHSA-6wmf-4rv5-p3rp for CVE-2026-109619), a short description of each, and, for those who cannot update at once, mitigations for CVE-2026-109618: set memory_limit=-1 in a way the application cannot override, keep post_max_size small (8M, or 32M if uploads are needed), and cap request size and field counts at the web server or proxy. It also says minimal source backports were prepared for the end-of-life PHP 7.4, 8.0 and 8.1.\n\n> 「memory_limit=-1」をアプリケーションから上書きできない方法で設定する。\n\n_Curator's translation:_ \"Set \"memory_limit=-1\" in a way that the application cannot override.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Mado-no-Mori (Impress) report on the PHP security releases: version list, CVE descriptions and the official mitigations. Related-article links mention many sites stopped as a precaution and a company called Valtec halting service after a cyberattack targeting the PHP vulnerability.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"「PHP」の“致命的”な脆弱性2件が修正、ただちにアップデートを - 窓の杜\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "fortinet-fg-ir-26-186", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-186", "publisher": "Fortinet", "kind": "vendor", "title": "PSIRT | FortiGuard Labs", "published": null, "captures": [ { "stamp": "20261022T191713Z", "files": { "headers.json": { "sha256": "b5fc379c961afb5b761eec930d09fc2bca76fdfa529536804adf20b2c81bb962", "bytes": 2122 }, "page.html": { "sha256": "c9f8832a001bf9eb296b5d7d3b4796f4e34e2843d6ddd238f141993944c37b9b", "bytes": 103438 }, "provenance.json": { "sha256": "2da4895b7972284d959f5a12404efa148e8a9b638cf6c6621160b7bc09a7e053", "bytes": 1547 }, "rendered.html": { "sha256": "6032cffb5942e5d75091a6cc30d4c842d8206af5e4e64b1e89e928300459e3e8", "bytes": 96822 }, "screenshot.jpg": { "sha256": "64d162eaae299990dfa73cdda8a3e505228359e3aaeabb32e278ebb5b0f0a627", "bytes": 196340 }, "text.txt": { "sha256": "9143f822233ec0825da53d15f088af72cc826cdb87501af1322f4904dcf2ea9a", "bytes": 2650 } }, "started_utc": "2026-10-22T19:17:14.243Z", "status": 200, "final_url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-186" } ], "status": "captured", "primary": true, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191713Z. Fortinet investigation and product status (primary)", "raw_sha256": {}, "has_notes": true, "notes_md": "# PSIRT | FortiGuard Labs\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/security-vendor/fortinet/psirt-fg-ir-26-186`, snapshot `20261022T191713Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191713Z/provenance.json`. Publisher: Fortinet. Language: en. URL: https://fortiguard.fortinet.com/psirt/FG-IR-26-186\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFortiGuard PSIRT advisory FG-IR-26-186, \"PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)\", with the two CVE descriptions (longjmp() on OOM leaving request memory uninitialised; stale global state pointing into freed request memory). Fortinet is investigating: products under investigation are FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS; confirmed not impacted include FortiOS, FortiClient EMS (and Cloud), FortiADC (and Manager), FortiEndpoint, FortiSIEM and FortiMonitor, among others. OT IPS references 10009977 and 10009978 were added on 22 October.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Fortinet investigation and product status (primary)\n\nSupports: cyber desk: appliances\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "fortinet-fortiweb-php2shell", "url": "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750", "publisher": "Fortinet Community (FortiWeb knowledge base)", "kind": "vendor", "title": "How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community", "published": "2026-10-22T07:55 (article time, timezone not stated)", "captures": [ { "stamp": "20261022T112039Z", "files": { "headers.json": { "sha256": "a0454c866ef8c53658075dd181e88a1d6f0387b633b7e59fcf740b5254c0e7d0", "bytes": 823 }, "page.html": { "sha256": "d5bc4f5c0a9b665b7bdc4d37c6adebfca47aaab1f93795c3a0551393e25a2531", "bytes": 789605 }, "provenance.json": { "sha256": "ddfff2dafe3e00768857136f2f89239b03664e07eaf4a3282e1552b2b1d65ec1", "bytes": 1150 }, "rendered.html": { "sha256": "2d8aabfc30d2116425651b788f2c8e4d58122738b69721391022332ab628815b", "bytes": 1208805 }, "screenshot.png": { "sha256": "03a275af997e6093c4700503437ee405b77df000307b546eda109ddb0f40acff", "bytes": 826331 }, "text.txt": { "sha256": "66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4", "bytes": 6244 } }, "started_utc": "2026-10-22T11:20:39.481Z", "status": 200, "final_url": "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "53b226bb38f7e8750ac404fad4841b7110fc68e61e7677c40f634b572be20150", "bytes": 894 }, "page.html": { "sha256": "04063f9a65d03481164eeb0bf0ae0b4ea584df94bd87f1e919128fdcc8ff56b9", "bytes": 825162 }, "provenance.json": { "sha256": "dda6106dcb7d23ff42bf247988986832049169226171ecf8f0e4dfcaf6a40a76", "bytes": 1742 }, "text.txt": { "sha256": "d5dfb171e3d0266dfc385d0fe93d6547af86f2b0024bef8ba6e6a165247697a7", "bytes": 6392 } }, "started_utc": "2026-10-23T16:27:36.919Z", "status": 200, "final_url": "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.", "raw_sha256": {}, "has_notes": true, "notes_md": "# How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community\n\nCaptured by claude-story-site. Status: captured. FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.\n\n- Article 230750, created 10/22/2026 07:55. Signatures 'part of the Known Exploit category'; 'By default, the signatures are in Alert Only mode'.\n" }, { "slug": "fortune-ai-tools-php-vulnerability", "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/", "publisher": "Fortune", "kind": "news", "title": "AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune", "published": "2026-10-21 (URL date; updated 22 October per the page)", "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "02c444c26c3d0f3f1095630d1581deff98ab74328b387d4f28d8f55b6f7277ca", "bytes": 1256 }, "page.html": { "sha256": "cd967fa20c098c9ad5adc7efb498607c1cbaa17dabf496d151ee77c8ffb52fe7", "bytes": 468302 }, "provenance.json": { "sha256": "1f99d4968da56a802c82b84801d19d52733755fded99aea1c3d1b0cf120d2296", "bytes": 1874 }, "rendered.html": { "sha256": "e65edc6aefa8fb6f947050a3d812d9c5d66b6731c13e0846ea39417e8527ddfc", "bytes": 453260 }, "screenshot.jpg": { "sha256": "071bd30ee33cd70590c2d462392b28f9c974558bd7f95b7814f83a1956ed6fac", "bytes": 558797 }, "text.txt": { "sha256": "cdcba1b8c212b9e8d3928e5d5ea0a7e09ea4c719e7bef44139d3f9f2f0612808", "bytes": 11029 } }, "started_utc": "2026-10-23T01:37:11.005Z", "status": 200, "final_url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): an anonymous sta...", "raw_sha256": {}, "has_notes": true, "notes_md": "# AI helped discover the PHP vulnerability that could take down 70% of the internet | Fortune\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/news/fortune/ai-tools-php-vulnerability`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: Fortune. Language: en. URL: https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFortune on AI's role in finding php2shell (Calif under OpenAI's Patch the Planet, Wiz, OpenAI's and Wiz's statements) and the race to patch. An update of 22 October adds Cloudflare's counts of exploit attempts (tens of thousands within 45 minutes of the news, hundreds of thousands within two hours, millions by the evening of 21 October) and AWS's statement that the flaw is \"now being broadly exploited in the wild\". It also reports, linking to a post on X, that an unnamed startup owner said hackers \"allegedly stole their source code, exposed cookie data, and leaked legal documents\"; Fortune does not name the company or say how the link to php2shell was established. The curator has not named the person here.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): an anonymous startup owner alleges source code, cookie data and legal documents stolen; not attributed, not verified\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "fortuneidn-tech-apa-itu-php-celah-keamanan-buat-sit", "url": "https://www.fortuneidn.com/tech/apa-itu-php-celah-keamanan-buat-situs-web-terganggu-d7w02-00-fykp7-4pwn09", "publisher": "Fortune Indonesia", "kind": "news", "title": "Apa Itu PHP? Celah Keamanannya Membuat Situs Web Terganggu | FORTUNE Indonesia", "published": "2026-10-23", "captures": [ { "stamp": "20261026T170916Z", "files": { "headers.json": { "sha256": "750c8103d7511a338f0a42ef089955acc2f052ea0d64441b6254d0f42936299e", "bytes": 1121 }, "page.html": { "sha256": "f9bcfa624952f0ef6dee95c7136262281b46f4fbd68f759ca5fe3bf032578517", "bytes": 902701 }, "provenance.json": { "sha256": "65e34a1fa804c4a95624f2beeee431bce9a4679ff38248047aafce2057e668d5", "bytes": 1810 }, "rendered.html": { "sha256": "a013cd4076e5a7253ee5029d41211adc991fadbf60bdf085bdaf4f903a776fdb", "bytes": 892734 }, "screenshot.jpg": { "sha256": "c482389c2a0bb22cce6d4b455f1d0b55c5d7e7312cf324704419baeb4a7ed9a5", "bytes": 579168 }, "text.txt": { "sha256": "a1ab468b170563f67ba84f25d85acc8ec8f51755490409a5c7c7195195147c4e", "bytes": 10713 } }, "started_utc": "2026-10-26T17:21:17.026Z", "status": 200, "final_url": "https://www.fortuneidn.com/tech/apa-itu-php-celah-keamanan-buat-situs-web-terganggu-d7w02-00-fykp7-4pwn09" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T170916Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Fortune Indonesia (Indonesian), an explainer of what PHP is and why the flaw matters. It says the PHP Foundation disclosed two flaws in PHP's core rel...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Apa Itu PHP? Celah Keamanannya Membuat Situs Web Terganggu | FORTUNE Indonesia\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/fortuneidn/tech-apa-itu-php-celah-keamanan-buat-situs-web-terganggu-d7w`, snapshot `20261026T170916Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T170916Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFortune Indonesia (Indonesian), an explainer of what PHP is and why the flaw matters. It says the PHP Foundation disclosed two flaws in PHP's core relating to memory management and error handling, that the US NSA said the flaws could let attackers reach files and databases without credentials, that the PHP Foundation said the fix was a challenge because it touches the core, risking application compatibility, performance and third-party extensions, and that the NSA urged all PHP-using organisations to update at once or disable vulnerable systems, with similar warnings from Japan, Singapore, Australia and the EU.\n\n> NSA turut mengimbau semua organisasi yang menggunakan PHP untuk segera memperbarui sistem atau menonaktifkan sistem yang rentan.\n\n_Curator's translation:_ \"The NSA also urged all organisations that use PHP to update their systems at once or deactivate vulnerable systems.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Apa Itu PHP? Celah Keamanannya Membuat Situs Web Terganggu | FORTUNE Indonesia\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "fortuneita-2026-10-22-php2shell-il-bug-che-poteva-m", "url": "https://www.fortuneita.com/2026/10/22/php2shell-il-bug-che-poteva-mandare-in-tilt-il-70-dei-siti-mondiali-ecco-cosa-e-successo/", "publisher": "Fortune Italia", "kind": "news", "title": "PHP2Shell, il bug che poteva mandare in tilt il 70% dei siti mondiali. Ecco cosa è successo - Fortune Italia", "published": "2026-10-22T07:43:57+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "7329894ba31eb86608f9169abc6228d6bcca552910337d5977752923f1927918", "bytes": 1508 }, "page.html": { "sha256": "f8b5169e5a20fd9d70587f122ca324f45c30f525ccd8e31a7d15818f2cb650e5", "bytes": 250871 }, "provenance.json": { "sha256": "3ca4f42628d783a5e6681a5ee6754c57cbc829d8f65eb4bcbc9b1a4d3d8b2d1e", "bytes": 1883 }, "rendered.html": { "sha256": "c8902cac65780b70934d03fa8235dbead79d92882e5a2211c6eeb86ff058378f", "bytes": 251807 }, "screenshot.jpg": { "sha256": "fe59dffb1ffc5d2ba691c854557e58f7927c73bbbd9e54d57b02d9a16dc05d95", "bytes": 523800 }, "text.txt": { "sha256": "4014537ea808b1aa819511f5788459d3029e05e66f1d2ff1835b8176cf2d1911", "bytes": 5934 } }, "started_utc": "2026-10-23T16:18:45.642Z", "status": 200, "final_url": "https://www.fortuneita.com/2026/10/22/php2shell-il-bug-che-poteva-mandare-in-tilt-il-70-dei-siti-mondiali-ecco-cosa-e-successo/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Fortune Italia, 22 October: the bug that could have crashed 70% of the world's sites, what happened. Citing the Wall Street Journal, it says the vulne...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, il bug che poteva mandare in tilt il 70% dei siti mondiali. Ecco cosa è successo - Fortune Italia\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/fortuneita/2026-10-22-php2shell-il-bug-che-poteva-mandare-in-tilt-il-70`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFortune Italia, 22 October: the bug that could have crashed 70% of the world's sites, what happened. Citing the Wall Street Journal, it says the vulnerability concerns a series of problems in how PHP manages memory, can be exploited in several ways, some taking only seconds, and that in August, after the discovery, an informal working group of security researchers and software engineers was set up, with software distributors and cybersecurity companies, to work out how to fix PHP2Shell.\n\n> Ad agosto, dopo aver scoperto la vulnerabilità, è stato istituito un gruppo di lavoro informale composto da ricercatori di sicurezza e ingegneri del software.\n\n_Curator's translation:_ \"In August, after discovering the vulnerability, an informal working group was set up made up of security researchers and software engineers.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, il bug che poteva mandare in tilt il 70% dei siti mondiali. Ecco cosa è successo - Fortune Italia\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "fr-ants-down", "url": "https://www.ants.gouv.fr/", "publisher": "ants.gouv.fr", "kind": "government", "title": "Accueil - France Titres (ANTS)", "published": null, "captures": [ { "stamp": "20261022T081939Z", "files": { "headers.json": { "sha256": "3a8b686eaad61ad3c1166c5a557b643d60cf33b41d6f3b36da8500ba6f8df09a", "bytes": 448 }, "page.html": { "sha256": "0a3fbbc3089a9497aac6380d9ebe9a45effda4cb1339b1a03e0a16cfce2ce7f1", "bytes": 222 }, "provenance.json": { "sha256": "c823c1300f78d7baec58e9965ee9e7b5b8d7a2c69e363951f201833daf553c85", "bytes": 961 }, "rendered.html": { "sha256": "441259fbdac1ceaf407a56a24a7b5e8f5e5c86b846587c2a6e86a73bbab1fc24", "bytes": 2565821 }, "screenshot.png": { "sha256": "9149cf7d9bc4fdc8ee7c7413c754d4bc9d60e979eebfe736f13e2a232f95197b", "bytes": 526676 }, "text.txt": { "sha256": "7e5c2700ea66b9047b95730e581b84900e9a80c99e7f7aaba270f8840cd1db04", "bytes": 3337 } }, "started_utc": "2026-10-22T08:19:39.440Z", "status": 200, "final_url": "https://www.ants.gouv.fr/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "fr-interieur-down", "url": "https://www.interieur.gouv.fr/", "publisher": "interieur.gouv.fr", "kind": "government", "title": null, "published": null, "captures": [ { "stamp": "20261022T081938Z", "files": { "provenance.json": { "sha256": "7dc87fec965083beeac47ac408eaf6c86e405e70d4b393f3bccfc51a7583039e", "bytes": 458 } }, "started_utc": "2026-10-22T08:19:38.283Z", "error": "page.evaluate: Target page, context or browser has been closed" } ], "status": "failed", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP None, page.evaluate: Target page, context or browser has been closed), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "fr-ppolice-down", "url": "https://www.prefecturedepolice.interieur.gouv.fr/", "publisher": "prefecturedepolice.interieur.gouv.fr", "kind": "government", "title": null, "published": null, "captures": [ { "stamp": "20261022T081939Z", "files": { "provenance.json": { "sha256": "9230a0d6e075c2454a4e97c83ce614bc0bd184ba8af16c76ea5aea23a6325dc7", "bytes": 471 } }, "started_utc": "2026-10-22T08:19:39.526Z", "error": "page.goto: Target page, context or browser has been closed" } ], "status": "failed", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP None, page.goto: Target page, context or browser has been closed), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "fr-prefecture-nord-down", "url": "https://www.nord.gouv.fr/", "publisher": "nord.gouv.fr", "kind": "government", "title": "Site en maintenance | Les Services de l'État", "published": null, "captures": [ { "stamp": "20261022T081940Z", "files": { "headers.json": { "sha256": "29cb6331cf00cd335fa38386f85d1dd1812ecba458b235679f31f5793b2efa4c", "bytes": 94 }, "page.html": { "sha256": "ef6f28223628c5de2e03d6a6579bfb1298a9528970063f00fd96f464c5d06d94", "bytes": 4199 }, "provenance.json": { "sha256": "1f5059bc03a54444a169ce5d0ae12285bc1c92dd76bc2f3f504616729e130aca", "bytes": 928 }, "rendered.html": { "sha256": "271a758211ac1eed716bbc27902260eb62e7dea8b54e7856f2c3d76290ee2dc0", "bytes": 3893 }, "screenshot.png": { "sha256": "405a1f823fb044886b626bd8af9aa1931c7b93bcc850ac68c4e39cbbaac7fd89", "bytes": 30298 }, "text.txt": { "sha256": "72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678", "bytes": 140 } }, "started_utc": "2026-10-22T08:19:40.449Z", "status": 200, "final_url": "https://www.nord.gouv.fr/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "fr-prefecture-rhone-down", "url": "https://www.rhone.gouv.fr/", "publisher": "rhone.gouv.fr", "kind": "government", "title": "Site en maintenance | Les Services de l'État", "published": null, "captures": [ { "stamp": "20261022T081939Z", "files": { "headers.json": { "sha256": "29cb6331cf00cd335fa38386f85d1dd1812ecba458b235679f31f5793b2efa4c", "bytes": 94 }, "page.html": { "sha256": "ef6f28223628c5de2e03d6a6579bfb1298a9528970063f00fd96f464c5d06d94", "bytes": 4199 }, "provenance.json": { "sha256": "9a65cec4c7c60bd05a1e0f81e3bbbb8ebdfa841ad86f936ba481de0cff685dd3", "bytes": 931 }, "rendered.html": { "sha256": "271a758211ac1eed716bbc27902260eb62e7dea8b54e7856f2c3d76290ee2dc0", "bytes": 3893 }, "screenshot.png": { "sha256": "405a1f823fb044886b626bd8af9aa1931c7b93bcc850ac68c4e39cbbaac7fd89", "bytes": 30298 }, "text.txt": { "sha256": "72b685717874bab2691f10c9628e0e77dca37522ce5dbf2efdb20e12635ca678", "bytes": 140 } }, "started_utc": "2026-10-22T08:19:39.570Z", "status": 200, "final_url": "https://www.rhone.gouv.fr/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "freepressjournal-bhopal-mp-government-websites-vulnerable", "url": "https://www.freepressjournal.in/bhopal/mp-government-websites-vulnerable-to-php2shell-cyber-threat-nic-issues-critical-security-advisory-mp-cert-reports-no-damage-so-far", "publisher": "Free Press Journal", "kind": "news", "title": "MP Government Websites Vulnerable To 'PHP2Shell' Cyber Threat; NIC Issues Critical Security Advisory, MP CERT Reports No Damage So Far", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "9aec3612eb77dc808970ee319e7fde235a2f4ad53843bb5132c35df7a962aa86", "bytes": 631 }, "page.html": { "sha256": "a63d9c3c95e9f4b0424e13e2f2813418dbfa9c608d80d80df26845ce531411aa", "bytes": 107840 }, "provenance.json": { "sha256": "8871e0e5f035525c67ab1532f6563626ad35f3a13908ab937bd267bbba6f7ba7", "bytes": 2008 }, "rendered.html": { "sha256": "1df9e9b50831e0b35ac62399c3d7ed0adaf7fb36e7e320a632f3e71fe2406aa7", "bytes": 154686 }, "screenshot.jpg": { "sha256": "1271e303b2cf7b530262443b65574d8a02bb864a6094c356efe6160776f11915", "bytes": 431310 }, "text.txt": { "sha256": "4e22ee510279ded17cee486b6da5fda541000b4ae5faa53c533f509b4424e91f", "bytes": 5247 } }, "started_utc": "2026-10-24T13:48:11.137Z", "status": 200, "final_url": "https://www.freepressjournal.in/bhopal/mp-government-websites-vulnerable-to-php2shell-cyber-threat-nic-issues-critical-security-advisory-mp-cert-reports-no-damage-so-far" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Free Press Journal (India), 23 October: several Madhya Pradesh government websites face potential risk from the critical PHP flaws; the National Infor...", "raw_sha256": {}, "has_notes": true, "notes_md": "# MP Government Websites Vulnerable To 'PHP2Shell' Cyber Threat; NIC Issues Critical Security Advisory, MP CERT Reports No Damage So Far\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `in/news/freepressjournal/bhopal-mp-government-websites-vulnerable-to-php2shell-cyber`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nFree Press Journal (India), 23 October: several Madhya Pradesh government websites face potential risk from the critical PHP flaws; the National Informatics Centre issued an advisory urging immediate security patches; the flaws could allow unauthorised remote code execution and sensitive-data exposure; MP CERT says it remains alert with no damage reported yet.\n\n> MP CERT says it remains alert, with no damage reported yet.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"MP Government Websites Vulnerable To 'PHP2Shell' Cyber Threat; NIC Issues Critical Security Advisory, MP CERT Reports No Damage So Far\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "gamemeca-view-php", "url": "https://www.gamemeca.com/view.php?gid=1782184", "publisher": "게임메카", "kind": "news", "title": "PHP 취약점에 게임사들도 비상, 점검에 서비스 종료까지", "published": "2026-10-22T09:58:42+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "eb1c210458c6ba6031cb0accf2fa0e8e1a78c104822ce42779481ee969f3d648", "bytes": 572 }, "page.html": { "sha256": "e0febde2cf556a9e553732431b6de30248e6841b6d75cbc0e63dd5832f5e5ceb", "bytes": 86676 }, "provenance.json": { "sha256": "2645ad738ad6f60a96b42fccf8ee53994f8ec74405b02ea08ffc161555ccb4b7", "bytes": 1542 }, "rendered.html": { "sha256": "2f9e80d6f78cf11964cf0438e50773163552cfb7287c21231bbd701682e9c84b", "bytes": 694058 }, "screenshot.jpg": { "sha256": "310628b3aeab9cf0a32ae25ca8281ffc54bbbeeb89aa107871121d24feb1d05c", "bytes": 481639 }, "text.txt": { "sha256": "c47586fec7f1de5d6b6d62bffc73da995db772e9c1cfe79c02062003efc64003", "bytes": 7106 } }, "started_utc": "2026-10-23T16:21:23.613Z", "status": 200, "final_url": "https://www.gamemeca.com/view.php?gid=1782184" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko-KR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Gamemeca (Korean), 22 October: game companies on alert over the PHP flaws, from maintenance to ending service. It says the PHP team published fixed ve...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP 취약점에 게임사들도 비상, 점검에 서비스 종료까지\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/gamemeca/view-php`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nGamemeca (Korean), 22 October: game companies on alert over the PHP flaws, from maintenance to ending service. It says the PHP team published fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on the 21st and recommended updating at once, and a photo caption says one game, World Quest, chose to end its service because it could not respond to the PHP vulnerability.\n\n> PHP 취약점 대응을 할 수 없어 서비스 종료를 선택한 월드 퀘스트\n\n_Curator's translation:_ \"World Quest, which chose to end its service because it could not respond to the PHP vulnerability\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ GameMeca (Korea): game companies ran emergency maintenance or shut down because of the PHP flaw. Cygames (Umamusume, Japan) and SEGA's product site went into maintenance, Choice of Games paused its site, Final Fantasy XIV stopped patch servers so no new logins were possible, and the web game World Quest ended service. No game hacks have been reported.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP 취약점에 게임사들도 비상, 점검에 서비스 종료까지\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko-KR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "gazzettadelsud-articoli-cronaca-2026-10-22-allarme-php2", "url": "https://gazzettadelsud.it/articoli/cronaca/2026/10/22/allarme-php2shell-vulnerabilita-gravissime-cosa-rischiano-i-siti-web-d9a6ca69-af70-4a0e-8f28-ae2f0da7e1f0/", "publisher": "Gazzetta del Sud", "kind": "news", "title": "Allarme PHP2Shell, vulnerabilità gravissime: cosa rischiano i siti web - Gazzetta del Sud", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "909fbc20ac3ad45c7b3be5caf830d29a5a9acbbd0d283953eb22b446379f9e14", "bytes": 1336 }, "page.html": { "sha256": "681e98efe16cfa65cfa9ab515c794ba59c00fe06aa221c383120ec992dcd5ddd", "bytes": 86650 }, "provenance.json": { "sha256": "69f85d21514afcce414f637a1956a3f19e2d41f5ddb746f0507a8fb373efc0a6", "bytes": 1940 }, "rendered.html": { "sha256": "0e7de05c202f5c69250e9dd7b016f683eac38b892f220c4af79e29d79f3ec52d", "bytes": 260863 }, "screenshot.jpg": { "sha256": "69284764681ec20c3f0550ce067de5bf40f5dfb5db1c47c0e410b56b60aa0000", "bytes": 448898 }, "text.txt": { "sha256": "05b6ec66781b50c4b8eebbcfcb3ce3bf468040a437d5ccbc143d21d1327122d9", "bytes": 5591 } }, "started_utc": "2026-10-23T16:18:46.669Z", "status": 200, "final_url": "https://gazzettadelsud.it/articoli/cronaca/2026/10/22/allarme-php2shell-vulnerabilita-gravissime-cosa-rischiano-i-siti-web-d9a6ca69-af70-4a0e-8f28-ae2f0da7e1f0/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Gazzetta del Sud (Italian), 22 October: PHP2Shell alarm, very serious vulnerabilities, what websites risk. It says that on 21 October the European Com...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Allarme PHP2Shell, vulnerabilità gravissime: cosa rischiano i siti web - Gazzetta del Sud\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/gazzettadelsud/articoli-cronaca-2026-10-22-allarme-php2shell-vulnerabilita`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nGazzetta del Sud (Italian), 22 October: PHP2Shell alarm, very serious vulnerabilities, what websites risk. It says that on 21 October the European Commission, ENISA, CERT-EU, Europol EC3 and the network of national CSIRTs issued a joint advisory on CVE-2026-109618 and CVE-2026-109619, both able to allow unauthenticated remote code execution.\n\n> il 21 ottobre Commissione europea, ENISA, CERT-EU, Europol EC3 e la rete dei CSIRT nazionali hanno diffuso un avviso congiunto sulle vulnerabilità CVE-2026-109618 e CVE-2026-109619\n\n_Curator's translation:_ \"on 21 October the European Commission, ENISA, CERT-EU, Europol EC3 and the network of national CSIRTs circulated a joint advisory on the vulnerabilities CVE-2026-109618 and CVE-2026-109619\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Gazzetta del Sud reports a joint EU alert from the European Commission, ENISA, CERT-EU, Europol EC3 and the national CSIRTs network. It lists fixed versions, cites Help Net Security on mod_php, and mentions AWS's 17 October attempt and the leak.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Allarme PHP2Shell, vulnerabilità gravissime: cosa rischiano i siti web - Gazzetta del Sud\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "generation-nt-actualites-php-faille-securite-php2shell", "url": "https://www.generation-nt.com/actualites/php-faille-securite-php2shell-ia-cybersecurite-2083236", "publisher": "Génération NT", "kind": "news", "title": "PHP2Shell : l'IA est à l'origine de la découverte de la faille qui ébranle le Web", "published": "2026-10-22T09:12:15+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f5ada47e765e1695f676c3118763269c6476d9a39f7e93e63af7e07e942dbdc3", "bytes": 767 }, "page.html": { "sha256": "d05791a8849bf225d0acf8f04359dc30b276962a412e1a3632f49d05effa03c8", "bytes": 114235 }, "provenance.json": { "sha256": "cf1ec1e1d8fa0ab70e3377872e03f0ffb7b319f8000e827b4f8237828924db6f", "bytes": 1806 }, "rendered.html": { "sha256": "25365379e41c1e46a8b62b8f5371d444714aa319a448dc19648afe8e581691e8", "bytes": 334189 }, "screenshot.jpg": { "sha256": "bc0e0c91e346467304fd2b6ffef6272a22d019e6d1700af449643afcf746d3dc", "bytes": 580636 }, "text.txt": { "sha256": "4b8aee1bfcc45a92682822fe7c08bd162f7384267ddb4fab9329bd95ed29cf61", "bytes": 8126 } }, "started_utc": "2026-10-23T16:11:45.726Z", "status": 200, "final_url": "https://www.generation-nt.com/actualites/php-faille-securite-php2shell-ia-cybersecurite-2083236" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Generation NT (French), 22 October: AI is behind the discovery of the flaw shaking the Web. Security researchers armed with AI models uncovered the cr...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : l'IA est à l'origine de la découverte de la faille qui ébranle le Web\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/generation-nt/actualites-php-faille-securite-php2shell-ia-cybersecurite-20`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nGeneration NT (French), 22 October: AI is behind the discovery of the flaw shaking the Web. Security researchers armed with AI models uncovered the critical PHP2Shell vulnerability; the disclosure set off a worldwide mobilisation to deploy an emergency fix; PHP is behind up to 70% of websites.\n\n> C'est en étant armés de modèles d'IIA que des chercheurs en sécurité ont mis au jour la vulnérabilité critique PHP2Shell.\n\n_Curator's translation:_ \"It was by being armed with AI models that security researchers uncovered the critical PHP2Shell vulnerability.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Génération NT says PHP2Shell was found with AI models (GPT-5.6 Sol, Gemini 4 Argon) by Calif and Wiz. It covers the secret August working group, the leak forcing early disclosure, and the NSA's take-offline advice.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : l'IA est à l'origine de la découverte de la faille qui ébranle le Web\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "gigazine-news-20261023-cloudflare-stats-php2shell", "url": "https://gigazine.net/news/20261023-cloudflare-stats-php2shell-attempts/", "publisher": "GIGAZINE", "kind": "news", "title": "「PHP2Shell」脆弱性公表後に悪用試行が数百万件単位に増加したとCloudflareが報告、顧客向けには新ファイアウォールを開発して有効化 - GIGAZINE", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "838aa535d9edb86b22e9bab6c8e27a52ec60ea26239c8838e6fca408442cfeb4", "bytes": 747 }, "page.html": { "sha256": "c2b3e9b39260b423a4038133e28a2c9c30470b8913fda04ea6d4a5c84beb3519", "bytes": 106622 }, "provenance.json": { "sha256": "e441d768669f6d49174a8f4b29651c1402fc35d5b68f331fb6f0c334160bf345", "bytes": 1823 }, "rendered.html": { "sha256": "4516eedc8e37d930dd85b4b9fb0a25c4581dd497a0cff2db97ec97b565982cfb", "bytes": 140655 }, "screenshot.jpg": { "sha256": "1b75520a84e4644e5a6494a12fc8c33d8540c3366329fac42bc18bff26add82f", "bytes": 564983 }, "text.txt": { "sha256": "1900395d021799bc4584b9c1cfe73c7cbe1398b4400cbb028c250cf8a646eda8", "bytes": 11857 } }, "started_utc": "2026-10-24T08:53:13.538Z", "status": 200, "final_url": "https://gigazine.net/news/20261023-cloudflare-stats-php2shell-attempts/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). GIGAZINE (Japanese), 23 October: Cloudflare reported that exploitation attempts, only thousands before the disclosure, exploded afterwards and reached...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 「PHP2Shell」脆弱性公表後に悪用試行が数百万件単位に増加したとCloudflareが報告、顧客向けには新ファイアウォールを開発して有効化 - GIGAZINE\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/gigazine/news-20261023-cloudflare-stats-php2shell-attempts`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nGIGAZINE (Japanese), 23 October: Cloudflare reported that exploitation attempts, only thousands before the disclosure, exploded afterwards and reached the millions about 12 hours after it, and that it developed and switched on a new firewall protection for customers. It embeds the Cloudflare CEO's post of 22 October with the ladder of attempts and links Cloudflare's blog 'Cloudflare deploys protections against php2shell vulnerability'.\n\n> 公表前は数千件程度だった悪用試行が公表後は爆増し、公表から12時間ほどで数百万件という単位に増加していたことをCloudflareが報告しています。\n\n_Curator's translation:_ \"Cloudflare reports that exploitation attempts, which were only in the thousands before the disclosure, soared after it and grew to the millions within about 12 hours of the disclosure.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"「PHP2Shell」脆弱性公表後に悪用試行が数百万件単位に増加したとCloudflareが報告、顧客向けには新ファイアウォールを開発して有効化 - GIGAZINE\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ginjfo-actualites-politique-et-economie-failles", "url": "https://www.ginjfo.com/actualites/politique-et-economie/failles-critiques-de-php-des-millions-de-tentatives-dexploitation-ont-eu-lieu-20261022", "publisher": "GinjFo", "kind": "news", "title": "Failles critiques de PHP, des millions de tentatives d’exploitation ont eu lieu - GinjFo", "published": "2026-10-22T08:06:34+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9a43fa3bc52ae3266ec8da480e4ed443cf30f8b60d31d8a671b51b5bd511140f", "bytes": 593 }, "page.html": { "sha256": "f04231468c9a3f16683b53522c7ffcf856fa88889390bf8ed1ef1b5fd5df047c", "bytes": 153825 }, "provenance.json": { "sha256": "475541a6301f424321d5667024a78597f52620918b6807a2ef75c49488291474", "bytes": 1883 }, "rendered.html": { "sha256": "65760cb6c538efa6b5312aeadc94811d825d82ced951754258c39351784e1042", "bytes": 194135 }, "screenshot.jpg": { "sha256": "03ad6ffc8db4b3f2784479063a2bc411d652c098ef0cf8cde9cd1ab3bd01ab50", "bytes": 367524 }, "text.txt": { "sha256": "2f3ad2216d74d748ae145aeef7475257028d93e8d8c143a54817095503a2a28d", "bytes": 4360 } }, "started_utc": "2026-10-23T16:11:52.924Z", "status": 200, "final_url": "https://www.ginjfo.com/actualites/politique-et-economie/failles-critiques-de-php-des-millions-de-tentatives-dexploitation-ont-eu-lieu-20261022" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). GinjFo (French): the PHP2Shell patches did not stop attack attempts. Cloudflare observed thousands of attempts in the ten hours before the disclosure...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Failles critiques de PHP, des millions de tentatives d’exploitation ont eu lieu - GinjFo\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/ginjfo/actualites-politique-et-economie-failles-critiques-de-php-de`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nGinjFo (French): the PHP2Shell patches did not stop attack attempts. Cloudflare observed thousands of attempts in the ten hours before the disclosure and millions in total; the page stresses these are detected attempts, not successful intrusions. It lists the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) and says no mitigation replaces the update.\n\n> Cloudflare a observé des milliers de tentatives dans les dix heures précédant la divulgation des failles, puis des millions au total.\n\n_Curator's translation:_ \"Cloudflare observed thousands of attempts in the ten hours before the disclosure of the flaws, then millions in total.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ GinjFo summarises Cloudflare's report of millions of exploitation attempts and AWS's honeypot detection of an attempt dated 17 October. It notes the fixed versions and that no mitigation replaces patching.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Failles critiques de PHP, des millions de tentatives d’exploitation ont eu lieu - GinjFo\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "gist-blevene-detection-guide", "url": "https://gist.github.com/Blevene/472692937d05145d29d17dc3c6edc2a0", "publisher": "Blevene (GitHub gist)", "kind": "code", "title": "PHP2Shell: Detection Opportunities · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112029Z", "files": { "headers.json": { "sha256": "e515879745065efa3f6d82ddfddf934b4dd0528d08c9cd4686517a7909ad53a9", "bytes": 5398 }, "page.html": { "sha256": "638f078193990b68d231d7f9d70c8090f0fa5ea1c6f17144ce040e86005b0e0e", "bytes": 172916 }, "provenance.json": { "sha256": "b55dcda494ff7fa675bdade5d18cd9c720a7f4c91f3c8902067bb528fe41a621", "bytes": 1010 }, "rendered.html": { "sha256": "e632d2722b6bc2f11dae20c788c7c087967ff8b1617f9e49874b67f34f3ccbc7", "bytes": 171073 }, "screenshot.png": { "sha256": "40cb4bc63512079ac9f9922051f970143f708fe8f10a7839fdf8f3a8cebe109d", "bytes": 2916589 }, "text.txt": { "sha256": "e87c134fef2ac6dadce17cc4b2ede04888da65e4c1939814c3e2acc5683ddb81", "bytes": 28797 } }, "started_utc": "2026-10-22T11:20:29.810Z", "status": 200, "final_url": "https://gist.github.com/Blevene/472692937d05145d29d17dc3c6edc2a0" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "The most detailed detection guide found: verified ModSecurity tripwire on the upload-progress field, Sigma rules for the arm-phase fatal ('in Unknown on line 0'), FPM segfault correlation, Falco worker-exec rules, and the arm/fire success receipt in the access log.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Detection Opportunities · GitHub\n\nCaptured by claude-story-site. Status: captured. The most detailed detection guide found: verified ModSecurity tripwire on the upload-progress field, Sigma rules for the arm-phase fatal ('in Unknown on line 0'), FPM segfault correlation, Falco worker-exec rules, and the arm/fire success receipt in the access log.\n\n- 'ModSecurity leaves REQUEST_BODY empty for multipart requests, so that rule never fires. Use the field-name rule.'\n- 'a genuine memory-limit fatal cites the script ... in Unknown on line 0 means the bailout happened outside any script — the multipart parse.'\n- 'reliable exploitation needs several attempts per target ... a burst of fatal-then-fire pairs is a tuned attacker. The SUCCESS receipt is visible in the ACCESS LOG: an arm-fatal burst followed by a fire that returns 2xx'.\n- Reproduction ran on PHP 8.4.4's CLI server; nginx/FPM/Apache behaviour mapped, not observed.\n" }, { "slug": "gist-silascutler-censys-query", "url": "https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9", "publisher": "Silas Cutler (GitHub gist)", "kind": "code", "title": "PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 ) · GitHub", "published": null, "captures": [ { "stamp": "20261022T112841Z", "files": { "headers.json": { "sha256": "07517141f85eb8c967f82ff329f3ec582d07ba06c068b4f69137e6f1b1bbc2bd", "bytes": 5405 }, "page.html": { "sha256": "6efd8ea91d0aeff2abdb43f40fb4a5695eacdbc5720b7a18c6746858dc3e2b89", "bytes": 126486 }, "provenance.json": { "sha256": "bfd64368239f0a7cf7a26eac489eda86effc8c0e4c6b09653d8eaa7a838bc2aa", "bytes": 1044 }, "rendered.html": { "sha256": "d31d94a0e67d4acc2f75d4548fd7bc98b0259d143eb16ec35ff1181b6f3fc0c6", "bytes": 124729 }, "screenshot.png": { "sha256": "fdcd80585ae0e06e894d974485b23ecf187fa65cc7195ccf17f13486b9c5782a", "bytes": 122357 }, "text.txt": { "sha256": "5cea858eacc35a20d7943cf8334baad5fa8b37ed7f19ecbf3416f489935edd49", "bytes": 1361 } }, "started_utc": "2026-10-22T11:28:41.000Z", "status": 200, "final_url": "https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "A Censys query for php2shell exposure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 ) · GitHub\n\nCaptured by claude-story-site. Status: captured. A Censys query for php2shell exposure.\n\n- The query only; no counts.\n" }, { "slug": "github-darkfibr-php2shell-detect", "url": "https://github.com/darkfibr/php2shell-detect", "publisher": "darkfibr (Mike Haddock), GitHub", "kind": "code", "title": "GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111956Z", "files": { "headers.json": { "sha256": "0032162778e9e13e6056d409874d38d891d76817b61b685b8cac6978d0946ff1", "bytes": 5443 }, "page.html": { "sha256": "47a54e3191d2665698e13d8dd3b157f63a32f0565ae7755ea8bfb9634774ac91", "bytes": 287088 }, "provenance.json": { "sha256": "1d8350230abbd90feb1f18d64a3d02b15f7b35d71914d26d2207c18cb626d091", "bytes": 1143 }, "rendered.html": { "sha256": "e0597533f94146958614e519387471deb149af84b19ea359e01dbd50d4dddbcf", "bytes": 305777 }, "screenshot.png": { "sha256": "eb849fd1179b14a53199521fd46cca0b26c498292d2553acc0d976e79b0e03a7", "bytes": 748563 }, "text.txt": { "sha256": "3592ec9f3bb73cd3a91f3fd0c698fb45375984c5c0326bbcb4f7f7c36b2b8f73", "bytes": 7156 } }, "started_utc": "2026-10-22T11:19:56.952Z", "status": 200, "final_url": "https://github.com/darkfibr/php2shell-detect" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Community detection toolkit: Suricata/Snort rules keyed on request shape (upload-progress field + many array parts), YARA for the public PoC, estate checker.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub\n\nCaptured by claude-story-site. Status: captured. Community detection toolkit: Suricata/Snort rules keyed on request shape (upload-progress field + many array parts), YARA for the public PoC, estate checker.\n\n- 'The public PoC is polite — it announces itself: User-Agent: php2shell-109619'. Shape rules survive UA stripping: 'progress field + >=100 array-form parts'.\n- 'A log hit is an attempt, not a compromise.' 'nginx's default format never records Content-Type or bodies, so shape attempts are invisible there.'\n- Says 8.2 and older received no fix, which is wrong (8.2.35 exists).\n" }, { "slug": "github-ghsa-6wmf-4rv5-p3rp", "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp", "publisher": "PHP (php/php-src GitHub security advisory, published by bukka)", "kind": "advisory", "title": "RCE via stale global state (CVE-2026-109619)", "published": "2026-10-21T13:34:13Z", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "9474439a8ed75c50ba02584a2c67a564bf208b0caa8b2aefe0d7d2704e46c263", "bytes": 5440 }, "page.html": { "sha256": "93ff984c03081442f47f1c338683875fabf1741564d711e2a3862d71cef29fdd", "bytes": 221023 }, "provenance.json": { "sha256": "ab199ddc3636b44804bf4b7da3949fe9d22f000959f8fc04c7f00eb3e416a0bb", "bytes": 1039 }, "rendered.html": { "sha256": "89eb250785b0066130856745323cc48cd37a515b3264c10da91dfee64deb45cb", "bytes": 222855 }, "screenshot.png": { "sha256": "bb279a6b633c6e9d1de5a4778673aa4b3ed7dc5e1a1d9f08a3ba27c30f99820a", "bytes": 1024722 }, "text.txt": { "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "bytes": 13502 } }, "started_utc": "2026-10-22T08:09:01.710Z", "status": 200, "final_url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVSS v4 9.2, same vector as 109618. Use-after-free of worker global state across requests. Confirmed RCE mod_php (PHP 8.5 fatal_error_backtraces path) and session upload progress path on mod_php and FPM. GitHub API blocked; timestamp from page.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): notes\n\n- URL: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp. Title \"RCE via stale global state\". Published by bukka; page time element 2026-10-21T13:34:13Z. Captured 2026-10-22T08:09Z. GitHub API blocked for this session.\n\n## Key facts (verbatim)\n- Affected \"< 8.2.35 / < 8.3.36 / < 8.4.27 / < 8.5.12\"; patched 8.2.35, 8.3.36, 8.4.27, 8.5.12.\n- \"Critical 9.2 / 10\", \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"CVE-2026-109619\". CWE-416/755/824/1325/1419 (same list as 109618).\n- Credits: reporters sagitzadik-wiz, tomash-areion, lcfr-hax, amyb-oai; remediation developers arnaud-lb, iluuu1994, bukka, ndossche.\n- Class: worker global state referring to freed request memory, \"causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE).\" Needs a producer and a consumer in different requests on the same worker.\n- Confirmed cases: \"PHP 8.5 fatal error backtrace: confirmed ... the basis of the confirmed mod_php exploitation\"; \"Session upload progress lifecycle: confirmed\"; \"Session lifecycle RCE was validated against mod_php and FPM.\"\n- \"Session upload progress is enabled by default, and no application call to session_start() is required.\"\n- Mitigations: fatal_error_backtraces=0 (8.5), session.upload_progress.enabled=0, pm.max_requests=1; \"Updating ... is the only reliable mitigation.\"\n- \"The confirmed impact is unauthenticated heap use-after-free, memory disclosure and remote code execution with the web worker's privileges.\"\n" }, { "slug": "github-ghsa-w8hw-w9fx-j79w", "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "publisher": "PHP (php/php-src GitHub security advisory, published by bukka)", "kind": "advisory", "title": "RCE via OOM corruption (CVE-2026-109618)", "published": "2026-10-21T13:34:25Z", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "a5b68bac81984833a0df448856c563c0abaaf285f4eac25b6fc9a01c0b4d705f", "bytes": 5447 }, "page.html": { "sha256": "f429f17d81fee9dced4234a3f88772e1a7fdb87170b5bf5e3c6a016758b2a14e", "bytes": 212571 }, "provenance.json": { "sha256": "bb24fb081f4677b9fb91aac8bf728da3b708aec4d694572ccf432df9c0e5162b", "bytes": 1035 }, "rendered.html": { "sha256": "79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110", "bytes": 214403 }, "screenshot.png": { "sha256": "4e10459ced9f68c1f9fb25ce9f8c603fad05b9e1981b2b9de3c10c16ade86d77", "bytes": 535897 }, "text.txt": { "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "bytes": 6692 } }, "started_utc": "2026-10-22T08:09:01.427Z", "status": 200, "final_url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVSS v4 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Affected <8.2.35, <8.3.36, <8.4.27, <8.5.12. CWE-416/755/824/1325/1419. GitHub REST API was blocked for this session (repo not attached), so no JSON; timestamp from the page's relative-time element.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GHSA-w8hw-w9fx-j79w (CVE-2026-109618): notes\n\n- URL: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w. Title \"RCE via OOM corruption\". \"Critical bukka published\". Page time element: 2026-10-21T13:34:25Z. Captured 2026-10-22T08:09Z.\n- GitHub REST API (repos/php/php-src/security-advisories/..., /advisories/...) was refused for this session (repository not attached), so no JSON was saved.\n\n## Key facts (verbatim)\n- Affected versions: \"< 8.2.35 / < 8.3.36 / < 8.4.27 / < 8.5.12\". Patched: \"8.2.35 8.3.36 8.4.27 8.5.12\".\n- Severity \"Critical 9.2 / 10\", \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\". CVE ID \"CVE-2026-109618\".\n- Weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419.\n- Credits: reporters lcfr-hax, sagitzadik-wiz, tomash-areion, amyb-oai; remediation developers arnaud-lb, iluuu1994, bukka, ndossche.\n- Class: \"PHP uses longjmp() for out-of-memory (OOM) errors ... leaves the request memory in an invalid state ... lead to remote code execution (RCE).\"\n- SAPIs: mod_php unconditionally runs request shutdown even when startup failed: \"This happens entirely before any application-specific code begins execution.\" FPM: \"susceptible, though no complete FPM exploit has been demonstrated for this SAPI.\" FrankenPHP \"likely susceptible\"; LSAPI \"application-specific exploits being likely but unvalidated\".\n- Fix: removes longjmp() for OOM; \"delayed, graceful soft OOM\" at next VM safe point plus hard OOM via _exit() at a higher threshold.\n- \"Complete remote code execution was validated over HTTP against mod_php with default PHP input and memory limits\".\n\n## Contradiction\n- The Foundation blog says RCE \"was also confirmed on PHP-FPM through application-level code paths\"; this GHSA says \"no complete FPM exploit has been demonstrated for this SAPI\". (Possibly the blog conflates with the 109619 session path validated on FPM.)\n- The reporter handle \"tomash-areion\" is not named in the Foundation's thanks list.\n" }, { "slug": "github-lexsah-php2shell-detection", "url": "https://github.com/Lexsah/php2shell-detection", "publisher": "Lexsah, GitHub", "kind": "code", "title": "GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112009Z", "files": { "headers.json": { "sha256": "25e99ec6775270a84bcecf5a232634c2e640ef9246b469967311c1240df22dd7", "bytes": 5436 }, "page.html": { "sha256": "6151205973ed45a3e00af67742bf708f8d42f4caf1171c1b5671e024b730bdbb", "bytes": 288052 }, "provenance.json": { "sha256": "2560ba2b32e6f1ea7e5feb0e81a7b6db2855392524862a91661362e6410175ca", "bytes": 1077 }, "rendered.html": { "sha256": "14e642e4e762e427c9bd8be65bfd45e0d8e2a3289c65ab7c197e197cc9077a66", "bytes": 301999 }, "screenshot.png": { "sha256": "c5300a3f00d8c04d057f920a6e8ceb48282544a99c967bd855027483a7a4ffc9", "bytes": 779281 }, "text.txt": { "sha256": "10b6edf13054c98d5da298e7bdc04a654d2e0a7fa7fa820047a7996a4887c25e", "bytes": 7136 } }, "started_utc": "2026-10-22T11:20:09.792Z", "status": 200, "final_url": "https://github.com/Lexsah/php2shell-detection" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Blue-team rules (YARA, Sigma, Suricata SIDs 910961801-803, ModSecurity, Falco, auditd) and the server-level session.upload_progress.enabled=Off mitigation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub\n\nCaptured by claude-story-site. Status: captured. Blue-team rules (YARA, Sigma, Suricata SIDs 910961801-803, ModSecurity, Falco, auditd) and the server-level session.upload_progress.enabled=Off mitigation.\n\n- 'It is a PHP_INI_PERDIR setting: ini_set() / auto_prepend_file cannot change it, and the upload-progress handler runs while the request body is parsed, i.e. before any of your PHP code executes.'\n- 'User-Agent strings are trivially changed. Treat UA rules as a high-confidence/low-coverage signal and the body + process rules as the durable ones.'\n" }, { "slug": "github-php-src-branch-7.4-backport", "url": "https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619", "publisher": "php/php-src on GitHub", "kind": "code", "title": "Branch PHP-7.4-CVE-2026-109618-109619", "published": "2026-10-18T18:10:24Z", "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "a849a6e452711b855043ae9fe1fd0982b11d14633681acc628fa56e60ceb8323", "bytes": 5439 }, "page.html": { "sha256": "04dcda73bc626ce33da19b196795fd7c00b63b030f9fd6a530acedcbbe4f2b77", "bytes": 363416 }, "provenance.json": { "sha256": "b879f4cb8fe1d72fc30175af0e12496f9df0b4e09ce90b1de15b99d1e8ed29fc", "bytes": 1040 }, "rendered.html": { "sha256": "f6eba14e4661be71a25a3f70b5e988478a727cc6ea78f657fe86284d54d727fd", "bytes": 412706 }, "screenshot.png": { "sha256": "6a7c4e4d30f1cb137b32490feb57c7053ca293f0f59d4aada14082309c525f0a", "bytes": 759378 }, "text.txt": { "sha256": "bd71e98ee89b7c6ca97f0ec6029e0200f86d26f2528387a96c99ac93ea63dc1f", "bytes": 6550 } }, "started_utc": "2026-10-22T08:15:58.995Z", "status": 200, "final_url": "https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Unofficial minimal source backport for EOL 7.4. '1 commit ahead of ... master'; latest commit 'Avoid state corruption via bailout', commit date 2026-10-18T18:10:24Z. The 8.0 and 8.1 branches are not captured (same naming pattern).", "raw_sha256": {}, "has_notes": true, "notes_md": "# php-src branch PHP-7.4-CVE-2026-109618-109619: notes\n- Linked from the php.net advisory as a \"minimal source-backport\" for PHP 7.4 (EOL). The branch is \"1 commit ahead of and 34022 commits behind master\". Latest commit \"Avoid state corruption via bailout\", dated 2026-10-18T18:10:24Z.\n- The PHP-8.0- and PHP-8.1-CVE-2026-109618-109619 branches are linked the same way but were not captured.\n- Implication: PHP 7.4-8.1 are affected but are not listed in the CVE records (defaultStatus \"unaffected\").\n- curl to github.com returned 403 from the egress proxy. Playwright worked.\n" }, { "slug": "github-php-src-fix-commit-3584a98bd", "url": "https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19", "publisher": "php/php-src (git), read from a clone", "kind": "code", "title": "Commit 3584a98bd: Avoid state corruption via bailout (the php2shell fix) and the PHP-7.4 backport 712e60f9e", "published": "2026-10-18T15:26:39Z (authored); 2026-10-21T14:06:22Z (committed)", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "git show output of the fix commit (stat, file list, engine/main/session hunks), the 7.4 backport commit and patch, and the merge path to PHP-8.5, from a shallow clone made 22 Oct 2026. SHA256SUMS in raw/. 389 files, +10689/-976; authors Arnaud Le Blanc with Ilija Tovilo, Jakub Zelenka, Nora Dossche, Nicolas Grekas.", "raw_sha256": { "commit-3584a98bd.NEWS.diff": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "commit-3584a98bd.engine-main-session.patch": "26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84", "commit-3584a98bd.files.txt": "d9b8465ccfbd22fa5bcd5f1a8c58c11b4af70befe488051f843fd4f45bf559b5", "commit-3584a98bd.stat.txt": "0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4b", "commit-712e60f9e-PHP-7.4-backport.patch": "307e49f52c4f3829e75ce82697b81c6ab771deb7ce0c8ce961159e40026866da", "commit-712e60f9e-PHP-7.4-backport.stat.txt": "7f5e6289ca2d1a14b2be78ca230e2077f3d5f695bb9d52087773e3df2633e7f0", "merge-path-3584a98bd-to-PHP-8.5.txt": "81c3025511c2f4744d1fcbe1d18fe7da97cfd68b005a6a883efc229a3c91193f" }, "has_notes": true, "notes_md": "# The fix commit, read from the repository\n\n- Clone: `git clone --depth 1 https://github.com/php/php-src`, then tags php-8.5.11, php-8.5.12, php-8.4.26, php-8.4.27 and branches PHP-8.5, PHP-8.4 (depth 80) and PHP-7.4-CVE-2026-109618-109619 (depth 50).\n- Fix: 3584a98bda0f2c0d367255b046798b0d3a221a19, \"Avoid state corruption via bailout\", author Arnaud Le Blanc, authored 2026-10-18T17:26:39+02:00, committed 2026-10-21T16:06:22+02:00, parent 512c04e39f. Co-authors Ilija Tovilo, Jakub Zelenka, Nora Dossche, Nicolas Grekas. Body: \"Replace bailout on OOM with UnwindExit; Properly reset various globals that may be accessed during startup; Fix GHSA-w8hw-w9fx-j79w; Fix GHSA-6wmf-4rv5-p3rp\".\n- 389 files, 10689 insertions, 976 deletions; 113 non-test files; Zend/ 96, ext/standard 52, tests 34, ext/mbstring 30, ext/gd 19, ext/date 17, ext/soap 14, main/ 7, ext/session 5, sapi/ 5.\n- Merge path on PHP-8.5: Ilija Tovilo merges PHP-8.2 into PHP-8.3 at 2026-10-21T14:12:35Z, PHP-8.3 into PHP-8.4 at 14:27:03Z, PHP-8.4 into PHP-8.5 at 14:30:04Z; NEWS entry a34a205c2 authored 2026-10-18T15:34:31Z.\n- 7.4 backport: 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2, same title, authored 2026-10-18T18:09:54Z, \"Minimal mitigation for EOL version\", 17 files (Zend/zend_alloc.c +68, main/rfc1867.c +39, Zend/zend_types.h, Zend/zend_execute_API.c, Zend/zend_hash.c, Zend/zend_vm_def.h, main/php_variables.c, main/main.c, main/SAPI.c, ext/session/session.c, and headers).\n- Mechanism (from the diff): zend_mm_check_limit replaces the bailout; a soft limit queues a delayed OOM (zend_mm_delayed_error) handled at the next VM safe point by zend_handle_delayed_oom via zend_throw_unwind_exit; a hard limit (memory_hard_limit_percent) ends the process with _exit; fallible allocations return NULL; globals reset in shutdown_executor, php_request_shutdown and sapi_deactivate; new ini max_multipart_body_parts; rfc1867 keeps only Content-Disposition and Content-Type headers and ignores duplicates.\n- rjmendez's repository names the fix commit as 82f8f31b16a; not reconciled with 3584a98bd (possibly the PHP-8.2 commit before merge, or a cherry-pick).\n- Not reached: 2024 history (shallow clone).\n" }, { "slug": "github-php-src-tag-php-8.5.12", "url": "https://github.com/php/php-src/releases/tag/php-8.5.12", "publisher": "php/php-src on GitHub (release by adoy)", "kind": "code", "title": "Release PHP 8.5.12", "published": "2026-10-21T14:06:46Z", "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "5c5686f2496a1b93d144afdd699626ee85dc4af2813a242dbf615446ddb664eb", "bytes": 5448 }, "page.html": { "sha256": "67ce23eedb690c74470175cf0a56c7a573cbd02ec5f27120c3ced5d05fa5eb3b", "bytes": 207502 }, "provenance.json": { "sha256": "8e480c6bdb33a1d5e82ddf99493ac5149329b2ab40d2fe95c088ba4b9672832a", "bytes": 990 }, "rendered.html": { "sha256": "330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa", "bytes": 214534 }, "screenshot.png": { "sha256": "ca5cc2bad8c65a0a5325554ef804f2b83d3fc7a4b7e9c2750dfd7047e564208c", "bytes": 123213 }, "text.txt": { "sha256": "3fa0b4ca147ee06698f340ee959bf381aee7c0fda597bd687ff1f128f4978799", "bytes": 1184 } }, "started_utc": "2026-10-22T08:15:58.781Z", "status": 200, "final_url": "https://github.com/php/php-src/releases/tag/php-8.5.12" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "GitHub release published 2026-10-21T14:06:46Z by adoy; tag object 2026-10-21 13:35:38 UTC; tagged commit dated 2026-10-19T17:04:37Z.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub release php-8.5.12: notes\n- \"adoy released this\", relative-time 2026-10-21T14:06:46Z (about 7 minutes after the planned 14:00 UTC). Tag 2026-10-21 13:35:38 UTC; the tagged commit is from 2026-10-19T17:04:37Z (prepared under embargo).\n- Body repeats php.net: \"This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.\"\n" }, { "slug": "github-php-src-tags", "url": "https://github.com/php/php-src/tags", "publisher": "php/php-src on GitHub", "kind": "code", "title": "Tags · php/php-src", "published": null, "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "c1e8341353ae8ccbb1b8406734139fd6ade271a8ecb16de19cc396443719b543", "bytes": 5449 }, "page.html": { "sha256": "9dd05842513d6ae6569812a9aad0f4abef35733b14f8515c3b86b3d1fac53d49", "bytes": 279656 }, "provenance.json": { "sha256": "fb3a77d83afa6bbbffbf5b0dba33cf24208559ef6dafc50b4fe37998fd225316", "bytes": 928 }, "rendered.html": { "sha256": "ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9", "bytes": 281310 }, "screenshot.png": { "sha256": "9208f3cecdd6dd08a577e0172d3a114ac84322533de8e95591e5b0694b085eda", "bytes": 125085 }, "text.txt": { "sha256": "850531b6512cfe4d37a2bb6b7fdcd37ec9cbb42ed6ceea172d081be054e28c61", "bytes": 924 } }, "started_utc": "2026-10-22T08:15:58.646Z", "status": 200, "final_url": "https://github.com/php/php-src/tags" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Tags php-8.5.12, php-8.4.27, php-8.3.36, php-8.2.35 all show 'Verified' and tag dates of 2026-10-21 13:35:38 UTC; php-8.6.0RC4 at 14:57:44 UTC. php-8.5.12RC1 and php-8.4.27RC1 tags also exist.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php-src tags list: notes\n- Captured 08:15Z. php-8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 are \"Verified\" (signed). Tag timestamps 2026-10-21 13:35:38 UTC. Underlying commits 19 Oct (14:00Z-17:04Z).\n- RC tags php-8.5.12RC1 and php-8.4.27RC1 exist. Normal release practice; were they published before the embargo lifted? Not checked.\n" }, { "slug": "github-rjmendez-phpup-2026", "url": "https://github.com/rjmendez/phpup-2026", "publisher": "rjmendez, GitHub", "kind": "code", "title": "GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112003Z", "files": { "headers.json": { "sha256": "582bbe71ccaa5a3323db8d3d2caec68f5af4561fd8b8b29bd932cbea2126e5cf", "bytes": 5445 }, "page.html": { "sha256": "e7e78dc79587fcaf7eac2ce0b48d90575d55f6fdb4313b768f0637f7a5d8ff0c", "bytes": 275240 }, "provenance.json": { "sha256": "7500ba6175c9e2f09a379b74a283542b6e7e4e637714a2006f0e68a86c44b348", "bytes": 1048 }, "rendered.html": { "sha256": "7bb4a810ad56f4620b7e1f2b14591c31b935a76a017c72cae93435ef05b8d088", "bytes": 302107 }, "screenshot.png": { "sha256": "a69607bd90cb0667ecdd5ab2e0191ae6c1534b599824084514dbcc1055712cde", "bytes": 940580 }, "text.txt": { "sha256": "84742b6e86fb259d4db36361e86d4b739c6cd09184337f365f5e2958271f5379", "bytes": 9221 } }, "started_utc": "2026-10-22T11:20:03.281Z", "status": 200, "final_url": "https://github.com/rjmendez/phpup-2026" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Detection rules rewritten on 21 Oct after a lab reproduction showed the leaked PoC's mechanism did not match the fix; cites VulnCheck: none of the public PoCs has the correct mechanism.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub\n\nCaptured by claude-story-site. Status: captured. Detection rules rewritten on 21 Oct after a lab reproduction showed the leaked PoC's mechanism did not match the fix; cites VulnCheck: none of the public PoCs has the correct mechanism.\n\n- '2026-10-21 rewrite. This repo previously described a single-request, multipart-stall heap-spray mechanism ... derived from the leaked PoC artifact's own claims ... That mechanism is deleted, not caveated - it doesn't match the real fix, a real lab reproduction of its precondition produced a clean 200 OK, and VulnCheck independently reports that none of the public PoCs they reviewed have the correct mechanism.'\n- Names the fix commit as 82f8f31b16a (a different hash from the 3584a98bd this site found on PHP-8.5; likely the PHP-8.2 commit or a cherry-pick; not reconciled).\n- Suricata SIDs 9109627, 9109633, 9109637 active; others retired. 'the cross-request same worker requirement is not visible from any standard web/WAF/MDE log source'.\n" }, { "slug": "global-techradar-fr-fr-computing-internet-php2shell-cette", "url": "https://global.techradar.com/fr-fr/computing/internet/php2shell-cette-faille-majeure-menace-des-millions-de-sites-faut-il-sinquieter", "publisher": "TechRadar", "kind": "news", "title": "PHP2Shell : cette faille majeure menace des millions de sites, faut-il s'inquiéter ? | TechRadar", "published": "2026-10-23T12:55:00Z", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "c5d7212208026db20811af79cd1fb93080bd8ade932c0df05a922c26f0e8c423", "bytes": 2315 }, "page.html": { "sha256": "062cc391d9d36c3af94db6d708973ca63125e5523928b4b00f376dcb93bf6867", "bytes": 1236210 }, "provenance.json": { "sha256": "2fbee44c5225a23a159f88e37aed79043fba1048b96847a772c816dca791185c", "bytes": 1899 }, "rendered.html": { "sha256": "2d5a48eb011ad6f2b2e29b535f44f3f4809b11dae68661b268b1ebff8bf5a3c2", "bytes": 1368571 }, "screenshot.jpg": { "sha256": "3c108076144ac915904f6f32adf1558913e9c06c135a52382d069169545e8f6e", "bytes": 702542 }, "text.txt": { "sha256": "41a90ee3a9b2b60958d67f284d679ef26e56cba133e055b8cfa4a878cd2f7f8e", "bytes": 14452 } }, "started_utc": "2026-10-24T08:42:40.896Z", "status": 200, "final_url": "https://global.techradar.com/fr-fr/computing/internet/php2shell-cette-faille-majeure-menace-des-millions-de-sites-faut-il-sinquieter" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). TechRadar France, 23 October: 'this major flaw threatens millions of sites, should you worry?'. PHP2Shell means two recently discovered vulnerabilitie...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : cette faille majeure menace des millions de sites, faut-il s'inquiéter ? | TechRadar\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/global-techradar/fr-fr-computing-internet-php2shell-cette-faille-majeure-mena`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTechRadar France, 23 October: 'this major flaw threatens millions of sites, should you worry?'. PHP2Shell means two recently discovered vulnerabilities in PHP; administrators were warned to install the patches quickly.\n\n> PHP2Shell désigne deux vulnérabilités récemment découvertes dans le langage PHP, utilisé par une grande partie des sites web.\n\n_Curator's translation:_ \"PHP2Shell refers to two recently discovered vulnerabilities in the PHP language, used by a large share of websites.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : cette faille majeure menace des millions de sites, faut-il s'inquiéter ? | TechRadar\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "globalnews-ottawa-sites", "url": "https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/", "publisher": "globalnews.ca", "kind": "news", "title": "Ottawa taking down some federal websites over critical global vulnerability - National | Globalnews.ca", "published": null, "captures": [ { "stamp": "20261022T081641Z", "files": { "headers.json": { "sha256": "3ca16762cb530a7381a789bfc088e122e6def06f38e9ea491f51fa91b00d1039", "bytes": 1247 }, "page.html": { "sha256": "f8be121063104c5bba4690a17d1b54eb8ce9ea1281b3e164b1fc4fe7c9f86b87", "bytes": 328580 }, "provenance.json": { "sha256": "f9fbf0f2893919b24df4ffcee19026399d3510b4cb555b1e6668c573d7ed9e2b", "bytes": 1142 }, "rendered.html": { "sha256": "13874eedb62c81b7afcf3028b4c61858f5efe21fda76b7a02d53b631d4500085", "bytes": 357724 }, "screenshot.png": { "sha256": "c6264dead5508467c41b7c442d261bf34cf473033bbe6b342c780b59703429f0", "bytes": 1859701 }, "text.txt": { "sha256": "87d2ae5079c3620bd0b22f78e743865d283f1915fde2bc8badc1b1c56daf2ae8", "bytes": 7761 } }, "started_utc": "2026-10-22T08:16:41.445Z", "status": 200, "final_url": "https://globalnews.ca/news/12110881/government-sites-go-dark-vuln-in-code/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "greenbaypressgazette-press-release-story-197263-cyber-securit", "url": "https://www.greenbaypressgazette.com/press-release/story/197263/cyber-security-services-launches-free-php2shell-check-for-website-owners/", "publisher": "Green Bay Press-Gazette", "kind": "news", "title": "Cyber Security Services Launches Free PHP2Shell Check for Website Owners - Green Bay Press-Gazette", "published": "2026-10-23T17:14:02+00:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "9a39a333507fbcc5c89b01ac1fc10b013a60aa016976c8b4477284f81a0b1358", "bytes": 2527 }, "page.html": { "sha256": "7838a72da2d6d8c2f85ea77e9faa3ab5327cdab1f6234906188b8a00947256ee", "bytes": 51131 }, "provenance.json": { "sha256": "02c6a05dbfc740dda90559982c752ae5537d2041320602e35491551f590090ed", "bytes": 1920 }, "rendered.html": { "sha256": "acb30ccaf77b8d7c8d7532e2e2ae73d4de3693f08652880bab0eaba2fa411556", "bytes": 51460 }, "screenshot.jpg": { "sha256": "c1d596edbc9da2646e4ed6d85107a71c1897875f589f862451a83e7958779f7a", "bytes": 355875 }, "text.txt": { "sha256": "700ae7ce50163c9ad762a6411dca4389e83ef09725c2686ceaa80844a5d0c9d3", "bytes": 5319 } }, "started_utc": "2026-10-24T08:59:06.485Z", "status": 200, "final_url": "https://www.greenbaypressgazette.com/press-release/story/197263/cyber-security-services-launches-free-php2shell-check-for-website-owners/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Green Bay Press-Gazette, 23 October: a syndicated press release (EIN Presswire) from Cyber Security Services, a Columbus cybersecurity consulting firm...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Cyber Security Services Launches Free PHP2Shell Check for Website Owners - Green Bay Press-Gazette\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sg/news/greenbaypressgazette/press-release-story-197263-cyber-security-services-launches`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nGreen Bay Press-Gazette, 23 October: a syndicated press release (EIN Presswire) from Cyber Security Services, a Columbus cybersecurity consulting firm, announcing a free PHP2Shell check at its own site where owners enter their address and get an answer on exposure. Vendor marketing; the curator did not visit the site or enter any address.\n\n> Cyber Security Services, a Columbus cybersecurity consulting firm, today released a free PHP2Shell check at PHPCheckup.com.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Cyber Security Services Launches Free PHP2Shell Check for Website Owners - Green Bay Press-Gazette\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "guardian-wikipedia-ref-40-ge-flaw-causing-global", "url": "https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns", "publisher": "The Guardian", "kind": "news", "title": "What is PHP and how serious is the computer language flaw causing website shutdowns? | Data and computer security | The Guardian", "published": "2026-10-22T16:42:23.000Z", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "e3f3b89fd0fcf57d8f184ef95f69bd71d64a2f17536ea0f04c0c1099b8cc2432", "bytes": 3753 }, "page.html": { "sha256": "c8fbc745f9c6267a2cbf2a65cbab04ed49e93815f3647c1f568b3c05ccca5d4b", "bytes": 548842 }, "provenance.json": { "sha256": "583acebd1d1d1a99ada4329c9743b0a00579c907504ccc434dcb3554722e1e53", "bytes": 1871 }, "rendered.html": { "sha256": "8f8d7c88abb65102927d785b219b47f0db13a7fa7198c5683a79eca0cb2e82cf", "bytes": 575986 }, "screenshot.jpg": { "sha256": "abe9f1b91ffa3649f4eaee3276b915425b41859ce181aeb62053a204fb7edfb4", "bytes": 848074 }, "text.txt": { "sha256": "42e1b49234f03f2417c4a904de5f988c6c1fec4e61e8752e1a5605bf75534691", "bytes": 10747 } }, "started_utc": "2026-10-25T11:45:55.973Z", "status": 200, "final_url": "https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). The Guardian, 22 October: what PHP is and how serious the flaw causing website shutdowns is. It says sites in Canada, Japan and Germany were taken dow...", "raw_sha256": {}, "has_notes": true, "notes_md": "# What is PHP and how serious is the computer language flaw causing website shutdowns? | Data and computer security | The Guardian\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/guardian/wikipedia-ref-40-ge-flaw-causing-global-website-shutdowns`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Guardian, 22 October: what PHP is and how serious the flaw causing website shutdowns is. It says sites in Canada, Japan and Germany were taken down temporarily while a fix was applied; quotes the PHP Foundation that the issues 'sit in parts of PHP that nearly every request touches: memory management and error handling'; says the vendor Hadrian labelled the pair a 'PHP2Shell exploitation'; quotes the US NSA that the memory corruption could 'provide a direct path to the server's file system or database'; and says the PHP Foundation said a number of security companies broke the embargo after the leak, while Amazon identified an attempt dating to four days before disclosure. On discovery, it says the PHP Foundation worked with Anthropic's frontier model to scan its code and had PHP put into OpenAI's programme.\n\n> A number of security companies did break the embargo after the leak, according to the PHP Foundation\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"What is PHP and how serious is the computer language flaw causing website shutdowns? | Data and computer security | The Guardian\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "haber-teknoloji-siber-guvenlik-baskanligi-ndan", "url": "https://www.haber.com/teknoloji/siber-guvenlik-baskanligi-ndan-php2shell-aciklamasi-e-devlet-kapisi-guvende-hizmetler-kesintisiz-suruyor-29322", "publisher": "Haber.com", "kind": "news", "title": "Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor | Haber.com", "published": "2026-10-22T09:40:54.300Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "1abc5d38558f9c38852a8f79ccb5e80f7fdba10b2f57d703842a4e7eef8a6a8d", "bytes": 2605 }, "page.html": { "sha256": "68c81fad10eabeea9fd14eb051f14ea08ce3bc53c2480200b7dcd3e84a40359c", "bytes": 181974 }, "provenance.json": { "sha256": "98afb98a78ea0bbedf960ca4e620dbb66511a19177a372ed0fa732bf9d176d8e", "bytes": 1926 }, "rendered.html": { "sha256": "65672f53fd75c7e1d187995bfab8ed2ada2ddf5bdf9153d9eb4fa723d61103f2", "bytes": 353789 }, "screenshot.jpg": { "sha256": "c536ff88079d18729488673a8f62e1c91bd21aed0249909276ee3eb1a972abbc", "bytes": 677102 }, "text.txt": { "sha256": "2825ea23dc0ee99dad084b327460a78610b626aa1f93bcd95017881a08fbcea9", "bytes": 12513 } }, "started_utc": "2026-10-23T16:25:41.007Z", "status": 200, "final_url": "https://www.haber.com/teknoloji/siber-guvenlik-baskanligi-ndan-php2shell-aciklamasi-e-devlet-kapisi-guvende-hizmetler-kesintisiz-suruyor-29322" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr-TR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Haber.com (Turkish), 22 October: the Presidency's Cybersecurity Directorate says nationwide preventive measures against the PHP2Shell risks were put i...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor | Haber.com\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/haber/teknoloji-siber-guvenlik-baskanligi-ndan-php2shell-aciklamas`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHaber.com (Turkish), 22 October: the Presidency's Cybersecurity Directorate says nationwide preventive measures against the PHP2Shell risks were put into effect quickly, and announced that there was no security problem at e-Devlet Kapisi, the national e-government portal with more than 69 million users, and that its services continued uninterrupted.\n\n> Uluslararası alanda “PHP2Shell” olarak adlandırılan risklere karşı ülke genelinde önleyici tedbirlerin hızla devreye sokulduğunu belirten Başkanlık, 69 milyondan fazla kullanıcısı bulunan e-Devlet Kapısı’nda herhangi bir güvenlik sorunu bulunmadığını ve hizmetlerin kesintisiz sürdüğünü duyurdu.\n\n_Curator's translation:_ \"The Directorate, noting that preventive measures against the risks called 'PHP2Shell' internationally were rapidly put into effect across the country, announced that there was no security problem at the e-Devlet Gateway, which has more than 69 million users, and that services continued uninterrupted.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor | Haber.com\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr-TR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "haber7-teknoloji-haber-3670492-php-guvenlik-aci", "url": "https://www.haber7.com/teknoloji/haber/3670492-php-guvenlik-acigi-interneti-tehdit-ediyor-e-devlet-ve-bankalar-riskte-mi", "publisher": "Haber 7", "kind": "news", "title": "PHP güvenlik açığı interneti tehdit ediyor: e-Devlet ve bankalar riskte mi? - Haber 7 TEKNOLOJİ", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2ba1ddeea8f86b7f1eba34db6cc93b05d75f6a624af4959a209f88cef49d0a4d", "bytes": 522 }, "page.html": { "sha256": "b6e706b362e803625b876680bd6853f710caa9faeff1c66a4e1d9ebda4c3f51a", "bytes": 95810 }, "provenance.json": { "sha256": "6cc979e1ee167ab97d297067e61368589a69a05c4731ac3fe3517f8f676962bd", "bytes": 1848 }, "rendered.html": { "sha256": "c5317e309093c1030ba22faab1d45e421a3eba56e8e642a91d75af6da88ffdce", "bytes": 102513 }, "screenshot.jpg": { "sha256": "e076ecf23b3b3f7574d7286487976d170e6c38a68c83c9c63baf6475afc1fadd", "bytes": 338627 }, "text.txt": { "sha256": "e844eed779d6ace717bbe34e3cedbfcad31d51416cca0858119bfdcff899caba", "bytes": 4053 } }, "started_utc": "2026-10-23T16:25:41.950Z", "status": 200, "final_url": "https://www.haber7.com/teknoloji/haber/3670492-php-guvenlik-acigi-interneti-tehdit-ediyor-e-devlet-ve-bankalar-riskte-mi" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Haber 7 (Turkish): the PHP vulnerability threatens the internet, are e-Devlet and banks at risk? PHP2Shell alarms with a 9.2 risk score; the Cybersecu...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP güvenlik açığı interneti tehdit ediyor: e-Devlet ve bankalar riskte mi? - Haber 7 TEKNOLOJİ\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/haber7/teknoloji-haber-3670492-php-guvenlik-acigi-interneti-tehdit`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHaber 7 (Turkish): the PHP vulnerability threatens the internet, are e-Devlet and banks at risk? PHP2Shell alarms with a 9.2 risk score; the Cybersecurity Directorate completed its e-Devlet review, and experts shared warnings for bank and social media accounts.\n\n> PHP2Shell güvenlik açığı 9,2 risk puanıyla alarm veriyor.\n\n_Curator's translation:_ \"The PHP2Shell vulnerability is raising the alarm with a 9.2 risk score.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Haber7 returned 429 Too Many Requests.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP güvenlik açığı interneti tehdit ediyor: e-Devlet ve bankalar riskte mi? - Haber 7 TEKNOLOJİ\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "hankyung-article-2026102423207", "url": "https://www.hankyung.com/article/2026102423207", "publisher": "한국경제", "kind": "news", "title": "北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제", "published": "2026-10-24T11:02:46+09:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "4f66c884c3592b6701c47dd1d8a9bdb30e409bca8fab57f9887915f899546052", "bytes": 471 }, "page.html": { "sha256": "e4bffbd69eead0a1a760d581a330a26e6bc1ff7f711725841ad5dd6da448ed43", "bytes": 99338 }, "provenance.json": { "sha256": "bc1e3d4cdfc8562700fcac9e8f1ff65156ab4e2e574ffd1927b83ee8eabfc316", "bytes": 1615 }, "rendered.html": { "sha256": "e7a1561f51a0a6709558a29b4fff05e6e58015b8a5426cbf5cb0af359dc51c2b", "bytes": 218173 }, "screenshot.jpg": { "sha256": "bd1b4f549a4fdb7b177506b0ac650d0df994ef7f5b458d3366996d0f487e82ec", "bytes": 322131 }, "text.txt": { "sha256": "45e966bc2d1e536c2425f5330889db94abff79d1612b22589b95648277284a1c", "bytes": 7407 } }, "started_utc": "2026-10-24T13:52:24.595Z", "status": 200, "final_url": "https://www.hankyung.com/article/2026102423207" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Korea Economic Daily (Korean), 24 October: reconnaissance activity exploiting PHP2Shell spotted in a closed network. It reports that the Singapore thr...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/hankyung/article-2026102423207`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nKorea Economic Daily (Korean), 24 October: reconnaissance activity exploiting PHP2Shell spotted in a closed network. It reports that the Singapore threat-intelligence firm Cyfirma saw Korean-speaking members in a private channel on the anonymous I2P network planning attacks on web servers worldwide; a possible link to a North Korean hacking group is raised, but direct proof has not been obtained. This is the same Cyfirma report as the EBN piece in the vault, so the two Korean outlets are one source, not two.\n\n> 폐쇄망서 'PHP2Shell' 악용 정찰 활동 포착\n\n_Curator's translation:_ \"Reconnaissance activity exploiting 'PHP2Shell' spotted in a closed network\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "hardwarecooking-failles-php-critiques-php2shell-correcti", "url": "https://www.hardwarecooking.fr/failles-php-critiques-php2shell-correctifs-publies/", "publisher": "HardwareCooking", "kind": "news", "title": "Failles PHP critiques (PHP2Shell) : les correctifs sont sortis, mettez à jour maintenant", "published": "2026-10-21T20:13:55+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "b21f072b795a2b8e4167423a1973830f663064a5c7ead005c1a8d06fea14309e", "bytes": 477 }, "page.html": { "sha256": "e91867fd69d44228af43202e961742499efafaf8118213e77d81e33af50f830f", "bytes": 490127 }, "provenance.json": { "sha256": "111afb0f4dfae871149fcff33caa1e39492ffa8ad79d2ad7c66270bbdf9b4756", "bytes": 1770 }, "rendered.html": { "sha256": "ec8a965a17a6e1397c99696f1e601c027759943bf0ea24741a9df691b8841f03", "bytes": 496204 }, "screenshot.jpg": { "sha256": "1d132361237178b45fe2b95bbbf1db2e931834bc331c209dd6f8a114ed66c0b9", "bytes": 589171 }, "text.txt": { "sha256": "59df94f7bc6f0ab08f18933a41783a119fa2be0bf702dd62f4df164d7ed2bdc0", "bytes": 8728 } }, "started_utc": "2026-10-23T16:14:53.504Z", "status": 200, "final_url": "https://www.hardwarecooking.fr/failles-php-critiques-php2shell-correctifs-publies/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). HardwareCooking (French), update of 21 October: the PHP team published emergency fixes for two critical flaws nicknamed PHP2Shell; the fixed versions...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Failles PHP critiques (PHP2Shell) : les correctifs sont sortis, mettez à jour maintenant\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/hardwarecooking/failles-php-critiques-php2shell-correctifs-publies`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHardwareCooking (French), update of 21 October: the PHP team published emergency fixes for two critical flaws nicknamed PHP2Shell; the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and anyone running PHP should check their version and ask their host to update.\n\n> l’équipe PHP a publié des correctifs d’urgence pour deux failles critiques surnommées « PHP2Shell »\n\n_Curator's translation:_ \"the PHP team published emergency fixes for two critical flaws nicknamed \"PHP2Shell\"\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Failles PHP critiques (PHP2Shell) : les correctifs sont sortis, mettez à jour maintenant\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "hellot-mobile-article-html", "url": "https://www.hellot.net/mobile/article.html?no=115738", "publisher": "헬로티", "kind": "news", "title": "에버스핀, PHP 치명적 취약점 공격 차단 규칙 적용…“공식 패치 전 대응”", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "8f27567eebb8bd527620ba121c3ec4c1c421c1b76d91870f396e25656ebf6510", "bytes": 898 }, "page.html": { "sha256": "a9cd6fe2b739c3e610de66a8944e405b2ed509c434b8c098453975572f6f6736", "bytes": 60722 }, "provenance.json": { "sha256": "65b44057cf3c28e1d83343480a21c7fadfab02c9f5c27d12551c18b6b6e4c2ad", "bytes": 1607 }, "rendered.html": { "sha256": "b668310d0341a4cc301cca6f403626f02bba4fa364350d6d62eeec83ddfc3bcc", "bytes": 70511 }, "screenshot.jpg": { "sha256": "e99732f9ac0a29b0795e879d982e0bb22ebc21a761ab59d6b4824224fbf05616", "bytes": 403367 }, "text.txt": { "sha256": "ba8cd797bd851f3f42a88107c5be3afd9e5d3d6538e3e2d0f9a0ea46bf9c38a4", "bytes": 6226 } }, "started_utc": "2026-10-23T23:37:29.653Z", "status": 200, "final_url": "https://www.hellot.net/mobile/article.html?no=115738" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). HelloT (Korean): the Korean vendor Eversafe (Everspin) says it applied a blocking rule for CVE-2026-109618 and CVE-2026-109619 to its web-security Saa...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 에버스핀, PHP 치명적 취약점 공격 차단 규칙 적용…“공식 패치 전 대응”\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/hellot/mobile-article-html`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHelloT (Korean): the Korean vendor Eversafe (Everspin) says it applied a blocking rule for CVE-2026-109618 and CVE-2026-109619 to its web-security SaaS customers' services before the official PHP patch was released, blocking attack requests at the gateway. Vendor announcement.\n\n> 에버스핀은 PHP 취약점 CVE-2026-109618과 CVE-2026-109619에 대응해 자사 웹 보안 솔루션 ‘Eversafe for Web SaaS’ 고객 서비스에 차단 규칙을 적용했다고 밝혔다.\n\n_Curator's translation:_ \"Everspin said it applied a blocking rule to its customers' services on its web security solution 'Eversafe for Web SaaS' in response to the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"에버스핀, PHP 치명적 취약점 공격 차단 규칙 적용…“공식 패치 전 대응”\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "helpnetsecurity-2026-10-22-php2shell-scanner-tool", "url": "https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/", "publisher": "Help Net Security", "kind": "news", "title": "New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security", "published": "2026-10-22T12:03:17+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a5c5b62675013f65abaeaf35a391ecec4042c122ba7e6a0eca46d4e6b1947352", "bytes": 1070 }, "page.html": { "sha256": "36d3c37cbd30df62d85a0a399f4caf86ca4045067228eb27489e6cb5e3013174", "bytes": 86469 }, "provenance.json": { "sha256": "55c1045efe48516c97cf73863500e5ae2aaa7140cae91ebec2a19cb6f02e67b8", "bytes": 1557 }, "text.txt": { "sha256": "5af2786ae142ccb6bf69b7d7f2280c3cd37897cfd64aa72586b09b43c1532368", "bytes": 5011 } }, "started_utc": "2026-10-23T16:23:51.259Z", "status": 200, "final_url": "https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Help Net Security, 22 October: Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to the two flaws...", "raw_sha256": {}, "has_notes": true, "notes_md": "# New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nz/news/helpnetsecurity/2026-10-22-php2shell-scanner-tool`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHelp Net Security, 22 October: Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to the two flaws. The article says PHP2Shell gives pre-auth remote code execution against PHP applications on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento. The scanner was not fetched or run; it is a stranger's tool.\n\n> Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "helsinkitimes-finland-shutdown", "url": "https://www.helsinkitimes.fi/finland/finland-news/domestic/29412-government-websites-shut-down-in-finland-over-critical-security-flaws.html", "publisher": "Helsinki Times", "kind": "news", "title": "Government websites shut down in Finland over critical security flaws - Helsinki Times", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112845Z", "files": { "headers.json": { "sha256": "8cfe23a4571454de0ce2c8804eef8e57888689f139258fc400bc4074345e22c4", "bytes": 1424 }, "page.html": { "sha256": "aae25312014733334061a2a0cedc5e7a800cfd4d711717e78fe9f492a1923fb1", "bytes": 74712 }, "provenance.json": { "sha256": "616d5f35071adec7fda82e308c994ebebbe96580f9f0d09c2ca595e95eca3565", "bytes": 1204 }, "rendered.html": { "sha256": "86c43a2ba4b2b595bc14316aefdf8f5d08736e778a980690075033168a6258ec", "bytes": 155636 }, "screenshot.png": { "sha256": "9c23d876698ad3081c6ac7846ed601a071d01e5b57de834755b1ef846cc2d26a", "bytes": 701429 }, "text.txt": { "sha256": "524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118", "bytes": 6660 } }, "started_utc": "2026-10-22T11:28:45.384Z", "status": 200, "final_url": "https://www.helsinkitimes.fi/finland/finland-news/domestic/29412-government-websites-shut-down-in-finland-over-critical-security-flaws.html" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Valtori began restricting incoming public traffic at 12:45 local; patch scheduled 17:00 Finnish time; restore after checks.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Government websites shut down in Finland over critical security flaws - Helsinki Times\n\nCaptured by claude-story-site. Status: captured. Valtori began restricting incoming public traffic at 12:45 local; patch scheduled 17:00 Finnish time; restore after checks.\n\n- 12:45 EEST = 09:45 UTC (this site's conversion).\n" }, { "slug": "hirstart-hk-20261023-php2shell-teendok-nas-okon-t", "url": "https://www.hirstart.hu/hk/20261023_php2shell_teendok_nas-okon_tuzfalakon_es_kontenerekben", "publisher": "Hírstart", "kind": "news", "title": "Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek", "published": "2026-10-23T11:13:04Z", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "2db7370fdab40bc9a9a4acdae3c2c5b230c6e95413991805d84e27fd31d57978", "bytes": 465 }, "page.html": { "sha256": "1006cf7188a8ab3d687f180726d550bf2874a5272fa182a3041fc21735221d09", "bytes": 59671 }, "provenance.json": { "sha256": "d151f3c553342126780dbdc75d6aa359c820dddc2dcd4d14f6336af02b31e682", "bytes": 1802 }, "rendered.html": { "sha256": "c48ec79c64dae358f4aa21af151a988954dab1f40f721bc7242ba0ccd9166274", "bytes": 101084 }, "screenshot.jpg": { "sha256": "c41822fdf6b30319321b96b661bf4516286cdf9c834a48e9106708cda3613729", "bytes": 138042 }, "text.txt": { "sha256": "ab29456ac75278c1be923d0c72c710d4c6cf502363c548d622d8e48ce7a69fc2", "bytes": 1858 } }, "started_utc": "2026-10-24T16:17:36.452Z", "status": 200, "final_url": "https://www.hirstart.hu/hk/20261023_php2shell_teendok_nas-okon_tuzfalakon_es_kontenerekben" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "hu", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hirstart (Hungarian), 23 October: critical PHP vulnerabilities allow remote code execution and emergency fixes have arrived. The two flaws known as PH...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hu/news/hirstart/hk-20261023-php2shell-teendok-nas-okon-tuzfalakon-es-kontene`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHirstart (Hungarian), 23 October: critical PHP vulnerabilities allow remote code execution and emergency fixes have arrived. The two flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) can enable unauthenticated remote code execution and can also affect the interfaces of NAS devices, firewalls, Nextcloud containers and other systems running PHP; its headings mirror the Notebookcheck guide for QNAP, Nextcloud and OPNsense users.\n\n> A PHP2Shell néven ismert két kritikus sérülékenység (CVE-2026-109618 és CVE-2026-109619) hitelesítés nélküli távoli kódfuttatást tehet lehetővé.\n\n_Curator's translation:_ \"The two critical vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) may allow unauthenticated remote code execution.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `hu`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "homodigital-luka-w-php-myslisz-nie-mam-strony-jestem", "url": "https://homodigital.pl/luka-w-php-myslisz-nie-mam-strony-jestem-bezpieczny-to-mit/", "publisher": "HomoDigital", "kind": "news", "title": "Luka w PHP. Myślisz - nie ma strony, jestem bezpieczny. To mit!", "published": "2026-10-26T12:05:05+00:00", "captures": [ { "stamp": "20261026T144241Z", "files": { "headers.json": { "sha256": "d846dddef3a8019297ff8da53c59bcea11d3577dc1ac365b57c177f73c4d20f4", "bytes": 732 }, "page.html": { "sha256": "3a04c99275581674681a864788545db3ccc8a48ac2b3baa32b97def673371c6c", "bytes": 123299 }, "provenance.json": { "sha256": "e01015533c2eee5fc3fbdd0e690e8eb7eab9c69bc145c091c91bee3d5c93f17a", "bytes": 1747 }, "rendered.html": { "sha256": "2cc0f0ae62a7a000143888756be1c40b41fc7c3f50e25a7068235ffadffeab2a", "bytes": 124479 }, "screenshot.jpg": { "sha256": "1aac40e6a7c3ed42e3948097055a487420ad02f5d023476653e09ae5586f1663", "bytes": 649018 }, "text.txt": { "sha256": "0a7e9176ac571d680ab05810c76d99e15d93e12d9c23d9fa15cb9f4d1e2b070e", "bytes": 8326 } }, "started_utc": "2026-10-26T15:02:34.134Z", "status": 200, "final_url": "https://homodigital.pl/luka-w-php-myslisz-nie-mam-strony-jestem-bezpieczny-to-mit/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pl-PL", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T144241Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). HomoDigital (Polish), 26 October: an explainer for ordinary internet users, written during the European Cyber Security Month, saying that even people...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Luka w PHP. Myślisz - nie ma strony, jestem bezpieczny. To mit!\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pl/news/homodigital/luka-w-php-myslisz-nie-mam-strony-jestem-bezpieczny-to-mit`, snapshot `20261026T144241Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T144241Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHomoDigital (Polish), 26 October: an explainer for ordinary internet users, written during the European Cyber Security Month, saying that even people with no website are exposed because the sites they use may be hit. It quotes the BBC's technology editor Zoe Kleinman on the unprecedented public global reaction to a cyber event that had not yet happened, repeats the 9.2 scores and that about 70% of sites are affected, and gives general safe-use advice (two-step verification and the like). No new facts.\n\n> Podatność dotyczy ok. 70% stron www, choć szacuje się, że może być ich więcej.\n\n_Curator's translation:_ \"The vulnerability affects about 70% of websites, although it is estimated there may be more of them.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Luka w PHP. Myślisz - nie ma strony, jestem bezpieczny. To mit!\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pl-PL`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "howtogeek-sites-down", "url": "https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/", "publisher": "howtogeek.com", "kind": "news", "title": "Your favorite websites are down due to an internet-breaking PHP security flaw", "published": null, "captures": [ { "stamp": "20261022T081803Z", "files": { "headers.json": { "sha256": "ac1300d5bc9c199bf479be95f33a4939aba8b6f5d29bd87c5dd9f2bd7a1c7b4e", "bytes": 3627 }, "page.html": { "sha256": "60b8a3bd8b3a31dee5eb2f99f4cdce0153e463a0c7f5dcc79189ea108fc9f9ae", "bytes": 282466 }, "provenance.json": { "sha256": "2cbaf467287d1420c18817f1b1b4257ed2c58ec119d691654b1329b118e80881", "bytes": 1113 }, "rendered.html": { "sha256": "7285bee583a2028e859815011ff311cdc7cd58e833cd2db577fbf150f92e4889", "bytes": 291892 }, "screenshot.png": { "sha256": "c74fddd0b93069d97b4424669c834a62d22e29d7a49e65463c24cfcce3689f02", "bytes": 1518193 }, "text.txt": { "sha256": "fc428f513db5fdc848312aa42f77bb2464902cdfa826e007e7d23427a88a6a2b", "bytes": 5511 } }, "started_utc": "2026-10-22T08:18:03.167Z", "status": 200, "final_url": "https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "0b01abadd3f45a837d2687e0401b89e9ea8af1aa7fbd80e1f9962f2cd34e86d0", "bytes": 3627 }, "page.html": { "sha256": "458c67d8cda9735bce0d28b6cefe194768f0ecb7f2d9174bea5b36f41d151836", "bytes": 282202 }, "provenance.json": { "sha256": "6684042b125695ae4c9d676c5bceca540bb049802844f586d6073305bdad49cb", "bytes": 1676 }, "text.txt": { "sha256": "7e375f5c40040efb08b9809c1a0362d976bfa6e0930146a8920d79d1e06e3e66", "bytes": 5565 } }, "started_utc": "2026-10-23T16:28:23.525Z", "status": 200, "final_url": "https://www.howtogeek.com/your-favorite-websites-are-down-due-to-an-internet-breaking-security-failure/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "huntress-php2shell-rapid-response", "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "publisher": "Huntress", "kind": "vendor", "title": "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112853Z", "files": { "headers.json": { "sha256": "39dd8f8ed13d1e993a95f88bddf69702d0cd23e3aef38da50d65068f495d1cff", "bytes": 7379 }, "page.html": { "sha256": "39d79180c85ccbc63f3acbf3bb0f076d56933f94e5fa8a5be8dafc3ca3160c7a", "bytes": 913455 }, "provenance.json": { "sha256": "23031a4937921ef79d80fb4b2546b9d7054028e640b9babec2c44d9f66dee0a2", "bytes": 1102 }, "rendered.html": { "sha256": "41e5af59038a7155953c6809d743ca579e2eeb7cdc503f13f6e3550ea920d970", "bytes": 1115188 }, "screenshot.png": { "sha256": "a4d89c5787921c4fe23ea13f25dc2d0104756a669450c44aad83ad220d9bc3a7", "bytes": 1862920 }, "text.txt": { "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "bytes": 17843 } }, "started_utc": "2026-10-22T11:28:53.508Z", "status": 200, "final_url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress\n\nCaptured by claude-story-site. Status: captured. As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code.\n\n- Primary negative finding from a managed-detection vendor.\n" }, { "slug": "hurbra-php-sakerhetshal-2026-guide", "url": "https://hurbra.se/php-sakerhetshal-2026-guide/", "publisher": "hurbra", "kind": "news", "title": "PHP-säkerhetshålen 2026 – Så skyddar du din webbplats", "published": "2026-10-22T14:53:25+00:00", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "19067a6975a705a791b1fdc795ad42c5e391f548820bd8d19c56a6b5f28ed2f9", "bytes": 494 }, "page.html": { "sha256": "3cdffff33179169fcb9d522eed72db209f6dc6050b659e01192d6f24c271d6a5", "bytes": 360072 }, "provenance.json": { "sha256": "33de32f890517cdb9149f3d377d173538fde38cd9bfc44262d82b3368a9925f2", "bytes": 1584 }, "rendered.html": { "sha256": "3bcb2d77a52c7c1dd746d0f5dd1351be2dcf979fc08069ceb404e68317679583", "bytes": 370547 }, "screenshot.jpg": { "sha256": "42360f32ea42ee4deb279570af1021ada5a1d2b729f84e518441713b72bc3c99", "bytes": 40200 }, "text.txt": { "sha256": "99d0f54ec7049dd27c291e6ed2455327ac9172d5f5b0ec6510db7d007fbccf39", "bytes": 22447 } }, "started_utc": "2026-10-24T16:27:44.117Z", "status": 200, "final_url": "https://hurbra.se/php-sakerhetshal-2026-guide/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "sv-SE", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hurbra (Swedish), 22 October: how to protect your website against PHP2Shell. Two serious PHP flaws have triggered millions of attack attempts against...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-säkerhetshålen 2026 – Så skyddar du din webbplats\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `se/news/hurbra/php-sakerhetshal-2026-guide`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHurbra (Swedish), 22 October: how to protect your website against PHP2Shell. Two serious PHP flaws have triggered millions of attack attempts against web servers worldwide and could in the worst case let an attacker run malicious code or reach sensitive information on a server; WordPress sites can also be affected. A guide of about 21,000 characters; the opening was read.\n\n> Två allvarliga säkerhetshål i PHP har utlöst miljontals angreppsförsök mot webbservrar världen över.\n\n_Curator's translation:_ \"Two serious security holes in PHP have triggered millions of attack attempts against web servers worldwide.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-säkerhetshålen 2026 – Så skyddar du din webbplats\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `sv-SE`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "hurriyet-dunya-dunya-genelinde-siber-guvenlik-aci", "url": "https://www.hurriyet.com.tr/dunya/dunya-genelinde-siber-guvenlik-acigi-php-programlama-dilinde-sorunlar-tespit-edildi-kuresel-capta-devlet-siteleri-gecici-olarak-kapatildi-43350466", "publisher": "Hürriyet", "kind": "news", "title": "Dünya genelinde siber güvenlik açığı: PHP programlama dilinde sorunlar tespit edildi! Küresel çapta devlet siteleri geçici olarak kapatıldı - Hürriyet Son Dakika Güncel Haberler", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ed96f9d37b883eb52a7e8344e42b5ef245fcde11662b2d4ef95011f9a432fbff", "bytes": 1036 }, "page.html": { "sha256": "169d81bb84fd1ca1097d4f9721416ebecaf0b51f5b68fd80ff5e816400c621a3", "bytes": 133196 }, "provenance.json": { "sha256": "022d559710a8dd7a2fed83696a57857e8b414972dae2be106ffea566c1280bf7", "bytes": 2065 }, "rendered.html": { "sha256": "2336c6ca3be5d2171d640690eb6aa2d9eb0e54de376b400cee9e0334d500d5bf", "bytes": 169215 }, "screenshot.jpg": { "sha256": "59171c4cafd691562e89c6911c34fdb2e3d03aa2c81a2841ff478e7e8bce8cbf", "bytes": 636810 }, "text.txt": { "sha256": "b84776ce009e3dc2a206e9ad3ef22832948d4cd2d03b762e9069ec10e9d60934", "bytes": 13994 } }, "started_utc": "2026-10-23T16:25:45.936Z", "status": 200, "final_url": "https://www.hurriyet.com.tr/dunya/dunya-genelinde-siber-guvenlik-acigi-php-programlama-dilinde-sorunlar-tespit-edildi-kuresel-capta-devlet-siteleri-gecici-olarak-kapatildi-43350466" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hürriyet (Turkish): worldwide security hole in PHP; government sites were temporarily closed globally. It says security experts found the two flaws wi...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Dünya genelinde siber güvenlik açığı: PHP programlama dilinde sorunlar tespit edildi! Küresel çapta devlet siteleri geçici olarak kapatıldı - Hürriyet Son Dakika Güncel Haberler\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/hurriyet/dunya-dunya-genelinde-siber-guvenlik-acigi-php-programlama-d`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHürriyet (Turkish): worldwide security hole in PHP; government sites were temporarily closed globally. It says security experts found the two flaws with the help of AI models; researchers at Calif, working with OpenAI, reported the first flaw on 11 August, and Alphabet's Wiz reported the second on 24 August. Wiz says its findings are among the most serious in PHP and probably in software history, that the underlying flaws had existed for decades, and that proving they were exploitable took a chain of steps at the edge of what human researchers could practically do.\n\n> Güvenlik firması Calif'teki araştırmacılar, OpenAI ile çalışarak ilk açığı 11 Ağustos'ta bildirdi. Teknoloji devi Alphabet'e ait güvenlik firması Wiz ise ikinci açığı 24 Ağustos'ta raporladı.\n\n_Curator's translation:_ \"Researchers at the security firm Calif, working with OpenAI, reported the first flaw on 11 August. The security firm Wiz, owned by the tech giant Alphabet, reported the second flaw on 24 August.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Hürriyet summarises global reactions: the NSA public warning, German, French, Belgian, Dutch, Finnish and Czech shutdowns, and Japan's PM's warning. It reports that Turkey's Cyber Security Presidency started security scans across Turkey and told institutions to apply urgent measures.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Dünya genelinde siber güvenlik açığı: PHP programlama dilinde sorunlar tespit edildi! Küresel çapta devlet siteleri geçici olarak kapatıldı - Hürriyet Son Dakik\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "hwupgrade-news-sicurezza-software-falle-php-gia-so", "url": "https://www.hwupgrade.it/news/sicurezza-software/falle-php-gia-sotto-attacco-l-ia-le-ha-scoperte-e-ora-scrive-gli-exploit_160925.html", "publisher": "Hardware Upgrade", "kind": "news", "title": "Falle PHP già sotto attacco: l'IA le ha scoperte e ora scrive gli exploit | Hardware Upgrade", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "27e8635a3e062bdd27358070689843db524f6742546ff66110cabf769d50667d", "bytes": 1154 }, "page.html": { "sha256": "a83c6ca35f60eb8c579a47f4ce2479f26e7a197129fca967a67242e2b2b61203", "bytes": 138870 }, "provenance.json": { "sha256": "1d229c6ea14e186906db362f81b0e615c58e40909e36ce8f854ef108c3962200", "bytes": 1876 }, "rendered.html": { "sha256": "9c09ebadee15f7a80e25a06b7455d90de115b5542e8c08281bf8fe4f86ab831f", "bytes": 223740 }, "screenshot.jpg": { "sha256": "4c9548af895dae917cbf16f232bf30ff0847417c73af0bf845e1256e194a5e0a", "bytes": 569652 }, "text.txt": { "sha256": "27fe642106500ed29791f821c9e7932d5f7db99fe1be5df459fd977eb7db5114", "bytes": 13085 } }, "started_utc": "2026-10-23T16:18:49.463Z", "status": 200, "final_url": "https://www.hwupgrade.it/news/sicurezza-software/falle-php-gia-sotto-attacco-l-ia-le-ha-scoperte-e-ora-scrive-gli-exploit_160925.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hardware Upgrade (Italian): PHP flaws already under attack, AI found them and now writes the exploits. The PHP security team released PHP 8.5.12, 8.4....", "raw_sha256": {}, "has_notes": true, "notes_md": "# Falle PHP già sotto attacco: l'IA le ha scoperte e ora scrive gli exploit | Hardware Upgrade\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/hwupgrade/news-sicurezza-software-falle-php-gia-sotto-attacco-l-ia-le`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHardware Upgrade (Italian): PHP flaws already under attack, AI found them and now writes the exploits. The PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 the previous day to fix CVE-2026-109618 (GHSA-w8hw-w9fx-j79w, from out-of-memory handling) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, stale global state), both 9.2 and able to allow unauthenticated remote code execution. It adds that OpenAI says the researchers found the flaws before attackers and that the weaknesses already existed, while admitting AI 'can also help attackers exploit them', and quotes Wiz that the complexity of exploiting them is no longer an obstacle with AI, since LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.\n\n> Nel corso della giornata di ieri il team di sicurezza di PHP ha rilasciato PHP 8.5.12, 8.4.27, 8.3.36 e 8.2.35 per correggere due vulnerabilità critiche, CVE-2026-109618 e CVE-2026-109619, che possono consentire l'esecuzione di codice da remoto senza autenticazione.\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Hardware Upgrade covers the patch releases, the mitigations and the AI discovery story (Calif reported on 11 August and Wiz on 24 August, per Futurism). Citing The Record, it says hundreds of sites were unreachable and that Nintendo suspended services.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Falle PHP già sotto attacco: l'IA le ha scoperte e ora scrive gli exploit | Hardware Upgrade\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ia-acs-article-2026-govt-sites-go-down-after-ai-finds-critical-php", "url": "https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html", "publisher": "Information Age (ACS)", "kind": "news", "title": "Govt sites go down after AI finds 'critical' PHP vulnerabilities | Information Age | ACS", "published": "2026-10-22T12:09 local (per the page)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "6c7a0a24e1fe5637fc0128a9543df3a2bb5079a578d1571c5ee745e4b0a07a59", "bytes": 831 }, "page.html": { "sha256": "21df95872c121c2f672382dafd6d1ca89fe07372f8cd1a00e76f30b22811c993", "bytes": 34077 }, "provenance.json": { "sha256": "20685a3f6a08933f3b94c2edc57f79936c1349c7d626b8a007e74c089e57ef9d", "bytes": 1822 }, "rendered.html": { "sha256": "ff2da2f8b833dd56d03dc9c164f90f8933bf878549b26f126a4119d0572167cd", "bytes": 52058 }, "screenshot.jpg": { "sha256": "33e77e17b0f50d77bfb6a433b86dcaa84c12bf65b5146eb7db156b76fb780928", "bytes": 513879 }, "text.txt": { "sha256": "640f80b25de71eba27f0e3c27d8ff99a44a1fbfbff094fbba106b66ca99af2c5", "bytes": 6812 } }, "started_utc": "2026-10-23T08:10:31.066Z", "status": 200, "final_url": "https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "064c15b6236d2c86d950a588c8de3e704d626469895936dabc24c3be4c5b4995", "bytes": 832 }, "page.html": { "sha256": "86f824455c0efddf2fc2811d58413e3f8f696aeb12ecddaffd45d618e857a5bd", "bytes": 34077 }, "provenance.json": { "sha256": "ec2c14f52e7b9427f8a87e82849fb33ec92672d7e81c736581373b732927cd78", "bytes": 1962 }, "rendered.html": { "sha256": "c98c20a129793b26cce63c9bc9d8fa92fd072eadcc3d70c759dfec778d93468f", "bytes": 62604 }, "screenshot.jpg": { "sha256": "6ba539309f5c1427250b5adf86bde8fe3a089c87b037b88db004f3dd6af5591f", "bytes": 515725 }, "text.txt": { "sha256": "7676edbd67afa1a79ccd2d73396f65dd895b364ff7bcc60cfd7d1cff3612bff0", "bytes": 6806 } }, "started_utc": "2026-10-23T23:27:55.773Z", "status": 200, "final_url": "https://ia.acs.org.au/article/2026/govt-sites-go-down-after-ai-finds--critical--php-vulnerabilities.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Tom Williams: several Australian government sites were down or taken down for maintenance overnight, including the Australian Bureau of Statistics and Jobs and...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Govt sites go down after AI finds 'critical' PHP vulnerabilities | Information Age | ACS\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/news/ia-acs/article-2026-govt-sites-go-down-after-ai-finds-critical-php`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTom Williams: several Australian government sites were down or taken down for maintenance overnight, including the Australian Bureau of Statistics and Jobs and Skills Australia, which were back soon after. The ASD's ACSC issued a 'critical' alert and said it was not aware of active exploitation. The report says Calif found the bugs in August using a large language model and Wiz found them with its own tools, Gemini and GPT.\n\n> not aware of active exploitation related to these vulnerabilities\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ictjournal-news-2026-10-22-deux-failles-critiques-d", "url": "https://www.ictjournal.ch/news/2026-10-22/deux-failles-critiques-dans-php-provoquent-une-mobilisation-mondiale", "publisher": "ICTjournal", "kind": "news", "title": "PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "96cb671877675863e47283b7aa831e49e59f92e987abbaaffb9dff9f9f24fa8a", "bytes": 718 }, "page.html": { "sha256": "2d3d605f3ec7dac7a67f9f8a5af533342b09ddc97904163f4f7fa3e281b93ca6", "bytes": 61721 }, "provenance.json": { "sha256": "990cfa3359cd3f5ca8b695080c3ce572a5057a16d3669b9c10530ee178a763bd", "bytes": 1856 }, "rendered.html": { "sha256": "73da345102f334f7291a1d5e5da4b616bf72b1ca52f593496f4ebb15f666efd2", "bytes": 73106 }, "screenshot.jpg": { "sha256": "495b8e996db403400218a3d2c6d15b646a1ca330baafe4ef396c65bc073300f5", "bytes": 514029 }, "text.txt": { "sha256": "1eb6afcabd54c35bcf47b491733358b9cdb6263894dcd1fdfd8e17b0c0febb5f", "bytes": 7901 } }, "started_utc": "2026-10-23T16:12:13.901Z", "status": 200, "final_url": "https://www.ictjournal.ch/news/2026-10-23/php2shell-des-milliers-de-serveurs-vulnerables-des-attaques-deja-tentees-update" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). ICTjournal (French, Switzerland), updated 23 October: thousands of servers remained exposed on 22 October. The firm Risikomonitor examined nearly 690,...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/ictjournal/news-2026-10-22-deux-failles-critiques-dans-php-provoquent-u`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nICTjournal (French, Switzerland), updated 23 October: thousands of servers remained exposed on 22 October. The firm Risikomonitor examined nearly 690,000 servers linked to Switzerland on 22 October and found just over 23,000 (about 3.5%) still affected; the real number could be higher because the PHP version cannot always be determined, and VirusTotal data points the same way. Exploitation attempts were also observed.\n\n> Elle a identifié un peu plus de 23’000 serveurs encore concernés par PHP2Shell, soit environ 3,5%.\n\n_Curator's translation:_ \"It identified a little over 23,000 servers still affected by PHP2Shell, about 3.5%.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ ICTjournal summarises the global mobilisation: Cloudflare's attack numbers, Reuters on European takedowns, and the PHP Foundation's admission that the root defect was seen in 2024. It adds that Switzerland's OFCS warned and that UNIGE and EPFL went offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "idxchannel-playlists-jutaan-situs-terancam-usai-ai", "url": "https://www.idxchannel.com/playlists/jutaan-situs-terancam-usai-ai-temukan-celah-pada-bahasa-pemrograman-php", "publisher": "IDX Channel", "kind": "news", "title": "Jutaan Situs Terancam usai AI Temukan Celah pada Bahasa Pemrograman PHP", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "59c8203710dabee58479da2061b42dbf49b4775706bc773359b0682698390649", "bytes": 3968 }, "page.html": { "sha256": "6124ebee9907b740dc700285d264dd6e3905ce068654d4dddc0730f8f5b964f5", "bytes": 81430 }, "provenance.json": { "sha256": "8889c5a7576c54e6227324ce476acd73a4ee02cb30c3f3f2ccd45114badb6fdf", "bytes": 1808 }, "rendered.html": { "sha256": "da7a3707c79abd48f1faea87270a41a4f68e24fa6a52c80002d406cec8f491a3", "bytes": 1416412 }, "screenshot.jpg": { "sha256": "6f84791300ec03b3a4a653127a59366390b78abec5aa8e2040e290ecac1c2506", "bytes": 166461 }, "text.txt": { "sha256": "966c68b8c58b4f3dfa0e79e9dfba7f119ee6330f55948c065fc7b9d1a807cc85", "bytes": 31925 } }, "started_utc": "2026-10-23T16:16:25.095Z", "status": 200, "final_url": "https://www.idxchannel.com/playlists/jutaan-situs-terancam-usai-ai-temukan-celah-pada-bahasa-pemrograman-php" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id-ID", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). IDX Channel (Indonesian): millions of sites are threatened after AI found a flaw in PHP. It quotes Wiz Research that the flaw could let an unauthentic...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Jutaan Situs Terancam usai AI Temukan Celah pada Bahasa Pemrograman PHP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/idxchannel/playlists-jutaan-situs-terancam-usai-ai-temukan-celah-pada-b`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIDX Channel (Indonesian): millions of sites are threatened after AI found a flaw in PHP. It quotes Wiz Research that the flaw could let an unauthenticated attacker execute code or read sensitive process memory holding passwords, authentication tokens, API keys and certificates, and lists WordPress, Drupal, Joomla and Wikipedia as PHP-based. A long page (about 32,000 characters) with site navigation; the article text was read.\n\n> Wiz Research mengatakan bahwa celah keamanan tersebut dapat memungkinkan penyerang yang tidak terautentikasi untuk mengeksekusi kode atau membaca memori proses sensitif\n\n_Curator's translation:_ \"Wiz Research said the security hole could let an unauthenticated attacker execute code or read sensitive process memory\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ IDX Channel piece citing Newsweek: Wiz and Calif found the flaws with AI, PHP runs about 70% of sites, and the NSA advised preparing to update or disabling systems.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Jutaan Situs Terancam usai AI Temukan Celah pada Bahasa Pemrograman PHP\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `id-ID`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ijiwei-n-1122779", "url": "https://www.ijiwei.com/n/1122779", "publisher": "ijiwei", "kind": "news", "title": "全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "5ec30cc89903a98a18ce31d694e214f7557d14ee3a125ffa489c7f986bc6d027", "bytes": 900 }, "page.html": { "sha256": "046759baedb82af3710da90268e93e0acd32baeabff10e48a49119a69cdd7c81", "bytes": 61676 }, "provenance.json": { "sha256": "77ef7f748cf8427119071cf49933d2cd667c654a61c5ddd538303cad878b5995", "bytes": 1552 }, "rendered.html": { "sha256": "b3e02665079d0f7252efa4a5eff1a1b0bf54b892054d68dc7f3698d581b22861", "bytes": 60937 }, "screenshot.jpg": { "sha256": "4cc32df55be0c48a7ac54a1f61139756ebe69eb28558584d298189df7b883753", "bytes": 945195 }, "text.txt": { "sha256": "0f6f2bf8436c2b42a5258fe1041aa70afc7a0a8d8421ab76d174467df65b0d0f", "bytes": 17220 } }, "started_utc": "2026-10-25T09:46:12.431Z", "status": 200, "final_url": "https://www.ijiwei.com/n/1122779" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Ijiwei (Chinese): 'tonight's thunderclap' for the global internet: the AI-found PHP flaw PHP2Shell forced emergency site closures at government and co...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/ijiwei/n-1122779`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIjiwei (Chinese): 'tonight's thunderclap' for the global internet: the AI-found PHP flaw PHP2Shell forced emergency site closures at government and corporate sites in several countries. On 21 October 2026 a rare security storm swept the internet; the two flaws are rated 9.2 on CVSS v4.0 and let an attacker run code on a server with only a crafted request and no credentials; sites closed included those in Finland and the Netherlands. Summarising OpenAI's own blog, it says OpenAI led for two months a coalition of PHP maintainers, security researchers and vendors; that Calif's researchers found a key flaw in August 2026 with OpenAI's GPT-5.6 Sol in the 'Patch the Planet' open-source audit programme; that Wiz independently found and reported both flaws, verifying them with a combination of Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; that OpenAI called it one of the most impactful security issues in recent memory and warned similar findings will rise sharply in coming months; and that OpenAI announced a 'Daybreak' subscription programme with $1 billion of subsidy for organisations protecting critical infrastructure, with a PHP version-detection tool and a Codex skill. On the leak, it says PHP planned to disclose on 22 October, but on 20 October details and a proof-of-concept tool named PHP2Shell leaked online; watchTowr confirmed it and its CEO said the company had reproduced both flaws; PHP announced on 20 October an emergency update for 21 October 14:00 UTC, and heise reported the disclosure had been due on 22 October.\n\n> 2026年10月21日，一场罕见的安全风暴席卷全球互联网。\n\n_Curator's translation:_ \"On 21 October 2026 a rare security storm swept the global internet.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ilsole24ore-art-php2shell-quando-vulnerabilita-softw", "url": "https://www.ilsole24ore.com/art/php2shell-quando-vulnerabilita-software-diventa-un-emergenza-mondiale-AJIlhFrB", "publisher": "Il Sole 24 Ore", "kind": "news", "title": "PHP2Shell, quando una vulnerabilità del software diventa un’emergenza mondiale - Il Sole 24 ORE", "published": "2026-10-22T10:14:00.000Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f751dc7aa146a9af481664da2a4c17d7dedeb8e6f7384f80775fde771569cae2", "bytes": 1138 }, "page.html": { "sha256": "fd39496d01df1be37efdf34afab8d0669ca99edbd6e80b3d2c691a1dfd413120", "bytes": 984211 }, "provenance.json": { "sha256": "72e00b0c0ae59cf1ac83888e9efbe531d37de753c86233cc5ee904f7ffd2ea81", "bytes": 1693 }, "text.txt": { "sha256": "34e2f51bedae17519e0584f1cfae76f1f1b7f9dea752397141d8040ad2f49c89", "bytes": 14089 } }, "started_utc": "2026-10-23T16:18:52.719Z", "status": 200, "final_url": "https://www.ilsole24ore.com/art/php2shell-quando-vulnerabilita-software-diventa-un-emergenza-mondiale-AJIlhFrB" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Il Sole 24 Ore (Italian), 22 October: when a software vulnerability becomes a world emergency. A question-led explainer of why PHP2Shell is such a bro...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, quando una vulnerabilità del software diventa un’emergenza mondiale - Il Sole 24 ORE\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/ilsole24ore/art-php2shell-quando-vulnerabilita-software-diventa-un-emerg`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIl Sole 24 Ore (Italian), 22 October: when a software vulnerability becomes a world emergency. A question-led explainer of why PHP2Shell is such a broad threat to the world's websites and what the combination of the two flaws lets criminals do. Only the headings were read.\n\n> PHP2Shell, quando una vulnerabilità del software diventa un’emergenza mondiale\n\n_Curator's translation:_ \"PHP2Shell, when a software vulnerability becomes a world emergency\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Il Sole 24 Ore explains how the vulnerabilities, 'revealed by mistake', caused panic. It retells the PHP Foundation timeline (2024 audit; 11 August Calif/OpenAI; 24 August Wiz; 18 September new OpenAI vectors) and mentions the joint EU statement. It claims the BBC's site was among those that stopped.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, quando una vulnerabilità del software diventa un’emergenza mondiale - Il Sole 24 ORE\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "imperva-blog-php2shell", "url": "https://www.imperva.com/blog/php2shell-vulnerability-updates/", "publisher": "Imperva Threat Research (Nadav Avital, Bar Menachem)", "kind": "vendor", "title": "PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111855Z", "files": { "headers.json": { "sha256": "fa04ad94125d615ccc22bfe0f44544c8737419ff06a9d85acf2e5e4776931849", "bytes": 3102 }, "page.html": { "sha256": "b659e89f8fb17c9833c2b8d60454655d038e41bd867043684aff25984c3bf6e2", "bytes": 243832 }, "provenance.json": { "sha256": "a2f25ae502d617f41375750794a46ff83e8a433361944da98d0daab48bd962ec", "bytes": 1022 }, "rendered.html": { "sha256": "cb3120b21b6f0c89f3af549534f6b8ce3e381a19e5c6eecce3ec513cb1d18d5a", "bytes": 301023 }, "screenshot.png": { "sha256": "1f96ba16ce949cfd1d6f4051df3dd2b7910754612bb6fae060c14d96950f9c9e", "bytes": 1932384 }, "text.txt": { "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "bytes": 15842 } }, "started_utc": "2026-10-22T11:18:55.149Z", "status": 200, "final_url": "https://www.imperva.com/blog/php2shell-vulnerability-updates/" }, { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "007d70044b574554e6ab8cdb298d07a9ebb684af433ca2c6cddfdc30af531b23", "bytes": 3175 }, "page.html": { "sha256": "6ef087834881447bfdf1f2e5aee88bbe3672e5915fc1d25307a4873e154ef5f7", "bytes": 243352 }, "provenance.json": { "sha256": "14aafdeae68884459eb7993892c91bb643a6dd7a68ffd0f548be9d03cbc24495", "bytes": 1595 }, "text.txt": { "sha256": "c8db3bc67fda0e55dd0a5434c423f099cb6872dfb584273d348f4c21e12861aa", "bytes": 15819 } }, "started_utc": "2026-10-23T08:27:12.231Z", "status": 200, "final_url": "https://www.imperva.com/blog/php2shell-vulnerability-updates/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Five demonstrated techniques, three via session upload progress; attack complexity high; ~67 KB memory disclosure; no matching traffic in pre-disclosure monitoring; '69% of websites whose server-side language is known'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva\n\nCaptured by claude-story-site. Status: captured. Five demonstrated techniques, three via session upload progress; attack complexity high; ~67 KB memory disclosure; no matching traffic in pre-disclosure monitoring; '69% of websites whose server-side language is known'.\n\n- 'Researchers from Wiz, OpenAI, and Calif jointly disclosed PHP2Shell'; involves 'session handling, OPcache class caching, and fatal-error backtrace generation'.\n- 'Triggering the bug is much easier than turning it into code execution.' 'A later request must reach the same Apache worker and place carefully shaped data'.\n- 'Three of the five demonstrated exploitation techniques use PHP's session upload-progress feature'; 'An attack can expose approximately 67 KB of process memory'.\n- 'During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.'\n- Settings: disable OPcache and upload progress as temporary measures; least privilege; IR checklist (child processes, file changes, outbound connections).\n" }, { "slug": "impress-watch-valtec", "url": "https://internet.watch.impress.co.jp/docs/news/2150396.html", "publisher": "INTERNET Watch (Impress)", "kind": "news", "title": "バルテック、サイバー攻撃によりサービス停止、情報流出の可能性（記事訂正） - INTERNET Watch", "published": "2026-10-22 (corrected later the same day)", "captures": [ { "stamp": "20261022T191433Z", "files": { "headers.json": { "sha256": "58df97fc9062fc234eef8d1d1582710ea444eb72b939acee668cee7c988492b9", "bytes": 286 }, "page.html": { "sha256": "54dca16481319543e0f7f4de7c4bfffb04af2e3ea7b963baa4ea5b6dd06212e0", "bytes": 112513 }, "provenance.json": { "sha256": "29864193cb9702d80c121e6d555f57f9562b46db8d07df01587de8e5986dbc2e", "bytes": 1664 }, "rendered.html": { "sha256": "f241ae871799c4086033623f373f304027ad469bdaad5687cf3e21e58e636e88", "bytes": 408910 }, "screenshot.jpg": { "sha256": "d0eb4e865c0189bf912fa7f318a5e994d85516c9b51f582289ae00be950d916a", "bytes": 829142 }, "text.txt": { "sha256": "8eb3458dda2e5e8f5ae7763944d9c1d9fe1733285b87b6b21481c02b28d7fd76", "bytes": 12992 } }, "started_utc": "2026-10-22T19:14:33.696Z", "status": 200, "final_url": "https://internet.watch.impress.co.jp/docs/news/2150396.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191433Z. Valtec blamed php2shell, then corrected: its own service's flaw (resolved, not PHP)", "raw_sha256": {}, "has_notes": true, "notes_md": "# バルテック、サイバー攻撃によりサービス停止、情報流出の可能性（記事訂正） - INTERNET Watch\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `jp/tech-press/impress-watch/valtec-php-attack`, snapshot `20261022T191433Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191433Z/provenance.json`. Publisher: INTERNET Watch (Impress). Language: ja. URL: https://internet.watch.impress.co.jp/docs/news/2150396.html\n\n## What the page says\n\n_Curator's reading of the capture._\n\nINTERNET Watch (Impress) reports that Valtec (バルテック), which provides business telephone services, announced on 22 October that it suffered unauthorised access, halted part of its services and that users' personal data may have leaked. The article was corrected: Valtec issued a correction saying its first statement that the cause was \"a cyberattack targeting the PHP vulnerability\" was wrong, and that \"a vulnerability in our own service\" was exploited; it had confused the two because it was handling the PHP vulnerability at the time. INTERNET Watch changed the article's title accordingly. Valtec planned recovery within 26 October.\n\n> バルテックでは訂正発表を行い、第一報時点で原因としていた「PHPの脆弱性を標的としたサイバー攻撃」は誤報であり、「我々のサービス自体の脆弱性」を突かれたものであると訂正した。PHPの脆弱性に関する対応を行っていたため混同したとしている。\n\n_Curator's translation:_ Valtec issued a correction: the \"cyberattack targeting the PHP vulnerability\" given as the cause in its first report was wrong; \"a vulnerability in our service itself\" was exploited. It says it confused the two because it was handling the PHP vulnerability.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Valtec blamed php2shell, then corrected: its own service's flaw (resolved, not PHP)\n\nSupports: contradictions/compromise-valtec.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "in-mashable-tech-115245-fbi-releases-php2shell-advisory-as-the-internet", "url": "https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on", "publisher": "Mashable India", "kind": "news", "title": "FBI Releases PHP2Shell Advisory As The Internet Explodes In Hilarious PHP Memes; Here Are The Best Ones", "published": "2026-10-22", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "5c21b63cab11f946e21274a6a3fea9146896b3662d93ba850f40c3a3acec2897", "bytes": 798 }, "page.html": { "sha256": "2faf7c00dcf7b63fd7a47989e9e17267500f049a0ea9663843b7130151a79804", "bytes": 117616 }, "provenance.json": { "sha256": "4e182d5e5155a0660e9b6081712cfcd9869b7cdbe1c4fdd5e9b3f01462d70879", "bytes": 1915 }, "rendered.html": { "sha256": "498c483ee86a3ff90100dbed274edc5c4caf72cb7808dffb8146f9cbb7508965", "bytes": 124258 }, "screenshot.jpg": { "sha256": "49b8df288c07b8c45cb979d76f73601d3c7b90ffeee3f2a72320012eab2a2fd7", "bytes": 559197 }, "text.txt": { "sha256": "072bc5f150b26f629c58d74b6a3e20e8f6b35a9e8d53fdcc2ce072df0ac34acb", "bytes": 7013 } }, "started_utc": "2026-10-23T08:18:12.241Z", "status": 200, "final_url": "https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "53af284293b57eae4f44a32cba2edfa37f9ac9770886a1e0f7365f7030a63b09", "bytes": 798 }, "page.html": { "sha256": "f8403b7bba2c6793b960879bbc601453bd99b836a9cdd1e14266043dfa315db2", "bytes": 117480 }, "provenance.json": { "sha256": "a30c2b190b6291979b626291b6750b1b9d450353191ad54978086accb2fb4dda", "bytes": 2061 }, "rendered.html": { "sha256": "87a6ef5412e4d0c3d8a912f9213bc466630a65a5ff77eb91ecc83cc3b06bae0a", "bytes": 125549 }, "screenshot.jpg": { "sha256": "e8526f4f62767bbc0809bc5c6dc7223d6eca69aaed1ff19b088a0b53a2251c60", "bytes": 546771 }, "text.txt": { "sha256": "9ae6bd023957e0f9fb23dfa13378ea0670a771d701d8ad250640c4ec5a15ec66", "bytes": 6859 } }, "started_utc": "2026-10-23T16:17:17.707Z", "status": 200, "final_url": "https://in.mashable.com/tech/115245/fbi-releases-php2shell-advisory-as-the-internet-explodes-in-hilarious-php-memes-here-are-the-best-on" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). A meme roundup with a short news lead: the FBI cyber division posted an advisory on X on the two flaws; Wiz Research is credited with finding them and with the...", "raw_sha256": {}, "has_notes": true, "notes_md": "# FBI Releases PHP2Shell Advisory As The Internet Explodes In Hilarious PHP Memes; Here Are The Best Ones\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `in/news/in-mashable/tech-115245-fbi-releases-php2shell-advisory-as-the-internet`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nA meme roundup with a short news lead: the FBI cyber division posted an advisory on X on the two flaws; Wiz Research is credited with finding them and with the 70% estimate. It says the bug was 'allegedly first spotted in the wild in 2024', unsourced. Low evidential value except for the FBI advisory.\n\n> The FBI warned of the two flaws involved in the PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619.\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "inc42-features-php2shell-who-is-at-risk-and-ho", "url": "https://inc42.com/features/php2shell-who-is-at-risk-and-how-can-businesses-stay-safe/", "publisher": "Inc42", "kind": "news", "title": "PHP2Shell: Who Is At Risk And How Can Businesses Stay Safe?", "published": "2026-10-24T16:49:18+05:30", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "65127c501f11f1aea3b745e81af1f3fba77c5f52012906fe5ac8a25e3539aa60", "bytes": 1633 }, "page.html": { "sha256": "d605dfe16f73ea5c0b59186b4e49a4482dbd2d9fbd4e676be26c93a1e0c5291c", "bytes": 597279 }, "provenance.json": { "sha256": "96b4db2e45175ba16d0ff9cbbb76892d202f0d19d6bb699b8e289b3e7444f303", "bytes": 1734 }, "rendered.html": { "sha256": "5156991e4499f82ba4f4bc3dc5fa8ccd92532e9b27aaf944e2a292462da4b374", "bytes": 842406 }, "screenshot.jpg": { "sha256": "d919f8844f9878c89040ef554614552e1ebfdb9c52edf8558521887a71a66d91", "bytes": 944749 }, "text.txt": { "sha256": "aa979376d7d804efc3a819cef821b5d72039af7b7caf8bf7fac85c143045faf9", "bytes": 10895 } }, "started_utc": "2026-10-24T16:09:37.332Z", "status": 200, "final_url": "https://inc42.com/features/php2shell-who-is-at-risk-and-how-can-businesses-stay-safe/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Inc42 (India), 24 October: who is at risk from PHP2Shell and how businesses stay safe. Because the flaws are in PHP itself, website-level security alo...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Who Is At Risk And How Can Businesses Stay Safe?\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `bg/news/inc42/features-php2shell-who-is-at-risk-and-how-can-businesses-sta`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nInc42 (India), 24 October: who is at risk from PHP2Shell and how businesses stay safe. Because the flaws are in PHP itself, website-level security alone is not enough. On discovery it says Calif credited a pseudonymous researcher, LCFR, with first discovering PHP2Shell and developing a working exploit; separately OpenAI said Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities.\n\n> Security firm Calif credited pseudonymous researcher LCFR with first discovering PHP2Shell and developing a working exploit.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Who Is At Risk And How Can Businesses Stay Safe?\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "indianexpress-article-technology-cert-in-php-vulnerability-alert-india-cyb", "url": "https://indianexpress.com/article/technology/cert-in-php-vulnerability-alert-india-cybersecurity-warning-us-nsa-php-alert-10931962/", "publisher": "The Indian Express", "kind": "news", "title": "PHP security alert: What US and Indian government warnings mean for websites | Technology News - The Indian Express", "published": "2026-10-23T09:18 IST (updated, per the page)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "932309cea1f97c544e3de604320a561a7da6f22f1e108743c16fd9c45bc961c8", "bytes": 1378 }, "page.html": { "sha256": "058ec4dbb5d6a3fa49dc78990fad2fe11c4fbc684b60041cfb03d749a8b8c431", "bytes": 718734 }, "provenance.json": { "sha256": "ab2492f5d688f0ff70f04dba27854b676e2e4efc9c4f3f93f83d90ab08d8e6ac", "bytes": 1931 }, "rendered.html": { "sha256": "37d117de1e907a919f03ab4bdaa3efbbac556f26a4f7dcab5bac5606463dded9", "bytes": 1019780 }, "screenshot.jpg": { "sha256": "06ea44dd972d4f2311fb756dbd60f11347382c525ae34568c489dcc92e951182", "bytes": 657045 }, "text.txt": { "sha256": "ba9bf5143edd15b370ca0e1de90deb11671d6932c4a155d306e2daeda8420046", "bytes": 8424 } }, "started_utc": "2026-10-23T08:18:12.561Z", "status": 200, "final_url": "https://indianexpress.com/article/technology/cert-in-php-vulnerability-alert-india-cybersecurity-warning-us-nsa-php-alert-10931962/" }, { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "895756200378691b1ec103b2fdd2fd4d7c74512be022d351fc648d403f07db2d", "bytes": 1379 }, "page.html": { "sha256": "48efc29afdaed234e85347146e50696950a80d2042bf36253fb8866b2ad74b32", "bytes": 748889 }, "provenance.json": { "sha256": "f409ba04e5b314cadeb30783a64907c1e1e71726c6bfd1674552517654696fa6", "bytes": 2082 }, "rendered.html": { "sha256": "dbbcdf5dcd5ec52e72a953af2d25cd54af16aeed6b77da31dcdcbd2df75eb47e", "bytes": 755892 }, "screenshot.jpg": { "sha256": "91414b6a424bc50841b7c83b1b6427ba30068c6c71399b8944eaa5652863ac31", "bytes": 461881 }, "text.txt": { "sha256": "44decc95cc32f48618d51f1b609b26f8875444cee1a05aebf7158f42a4bab020", "bytes": 19842 } }, "started_utc": "2026-10-24T13:48:12.044Z", "status": 200, "final_url": "https://indianexpress.com/article/technology/cert-in-php-vulnerability-alert-india-cybersecurity-warning-us-nsa-php-alert-10931962/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Bijin Jose: explains the flaws for website owners and summarises the US and Indian government warnings. It says the flaws were identified on Tuesday 20 October...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP security alert: What US and Indian government warnings mean for websites | Technology News - The Indian Express\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `in/news/indianexpress/article-technology-cert-in-php-vulnerability-alert-india-cyb`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBijin Jose: explains the flaws for website owners and summarises the US and Indian government warnings. It says the flaws were identified on Tuesday 20 October and the PHP team released fixes after.\n\n> were identified on Tuesday, October 20, triggering a global cybersecurity response\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "indiatvnews-technology-news-us-nsa-issues-urgent-php2shell-warning-advis", "url": "https://www.indiatvnews.com/technology/news/us-nsa-issues-urgent-php2shell-warning-advises-taking-unpatched-servers-offline-2026-10-22-1057597", "publisher": "India TV News", "kind": "news", "title": "US NSA warns of PHP security flaw that could let hackers take over servers: How to stay safe - India TV News", "published": "2026-10-22T11:29 IST (updated 12:17)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "f00bac1eb7ab38bcdf017eb95abdb9dab29050ee4081236e1f18b86e9feddd46", "bytes": 846 }, "page.html": { "sha256": "a9966c9deeb3fa0f6dedd780da09bc4cec9ad738eaf3132b0d94f8c54c71d0b6", "bytes": 289578 }, "provenance.json": { "sha256": "8ec6e9b1a8eae8da38e5d1ce6cf313cf38619ca19f57dc539cb44ce736ce2030", "bytes": 1935 }, "rendered.html": { "sha256": "d071e2876cbbff0c90275e29f5ed2a795acec972f8ab646616457bb23aef8c0d", "bytes": 309893 }, "screenshot.jpg": { "sha256": "08b95827e5b2f4513fb8ea6921110b3dd51c238910171e895500cbc3ba189061", "bytes": 540427 }, "text.txt": { "sha256": "5890d993ee5bdcb670bd405641ec3e763a82c5c3e1a78695e174b4ea4362430f", "bytes": 6646 } }, "started_utc": "2026-10-23T08:18:18.462Z", "status": 200, "final_url": "https://www.indiatvnews.com/technology/news/us-nsa-issues-urgent-php2shell-warning-advises-taking-unpatched-servers-offline-2026-10-22-1057597" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Saumya Nigam: the US NSA issued an urgent warning on PHP2Shell, recommending that unpatched servers be taken offline if immediate patching is not feasible. PHP...", "raw_sha256": {}, "has_notes": true, "notes_md": "# US NSA warns of PHP security flaw that could let hackers take over servers: How to stay safe - India TV News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `in/news/indiatvnews/technology-news-us-nsa-issues-urgent-php2shell-warning-advis`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSaumya Nigam: the US NSA issued an urgent warning on PHP2Shell, recommending that unpatched servers be taken offline if immediate patching is not feasible. PHP shipped the emergency update on 21 October.\n\n> If immediate patching is not feasible, the NSA recommends taking affected systems offline.\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "indigodergisi-2026-10-php-guvenlik-acigi-php2shell", "url": "https://indigodergisi.com/2026/10/php-guvenlik-acigi-php2shell/", "publisher": "İndigo Dergisi", "kind": "news", "title": "PHP güvenlik açığı (PHP2Shell): Ne oldu, ne yapmalı? Adım adım rehber", "published": "2026-10-21T21:45:07+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c409b2bc890f7dd4473de64a24a662c722a35a99229f521645d293c78a0653e0", "bytes": 1245 }, "page.html": { "sha256": "9285154c3176f5b64a1f5c8aefd446a8e56cfa2139122c0c85cb961804abd85a", "bytes": 278088 }, "provenance.json": { "sha256": "367d9a52a3671a03c070aa8d6211e027f8e9981c461536f3fd82cbdf82b3e869", "bytes": 1533 }, "text.txt": { "sha256": "c8c3d3e1225d10240ee19544a6a5ea7348bb2b494766b93b515df926c687f53f", "bytes": 25357 } }, "started_utc": "2026-10-23T16:25:46.583Z", "status": 200, "final_url": "https://indigodergisi.com/2026/10/php-guvenlik-acigi-php2shell/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Indigo Dergisi (Turkish), 21 October: what happened and what to do, a step-by-step guide. PHP2Shell is two critical flaws in the language behind about...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP güvenlik açığı (PHP2Shell): Ne oldu, ne yapmalı? Adım adım rehber\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/indigodergisi/2026-10-php-guvenlik-acigi-php2shell`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIndigo Dergisi (Turkish), 21 October: what happened and what to do, a step-by-step guide. PHP2Shell is two critical flaws in the language behind about 70% of websites that could let an attacker run their own code on a server without entering any username or password; the PHP team published the fixes on the evening of 21 October.\n\n> “PHP2Shell” adı verilen iki kritik zafiyet, saldırganın hiçbir kullanıcı adı ya da parola girmeden sunucuda kendi kodunu çalıştırmasına imkan tanıyabiliyor.\n\n_Curator's translation:_ \"The two critical vulnerabilities called 'PHP2Shell' can allow an attacker to run their own code on the server without entering any username or password.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ İndigo Dergisi gives a step-by-step guide and timeline. It names Calif CEO Thai Duong and PHP security engineer Volker Dusch, says the Hacker News leak came on 20 October, and says Turkey's Cyber Security Presidency issued notice TR-26-1372. It reports that Turkish hosting companies began informing customers and making temporary configuration changes on 21-22 October.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP güvenlik açığı (PHP2Shell): Ne oldu, ne yapmalı? Adım adım rehber\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "inet-detik-security-d-8718436-saking-bahayanya-php2", "url": "https://inet.detik.com/security/d-8718436/saking-bahayanya-php2shell-kepala-negara-sampai-turun-tangan", "publisher": "detikInet", "kind": "news", "title": "Saking Bahayanya PHP2Shell, Kepala Negara Sampai Turun Tangan", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "23a7512169ea272c06d6268c84531c130bace8b486de937a8ab671cfd58ed443", "bytes": 1050 }, "page.html": { "sha256": "926417bcfa4613473196d08b2df54fc63e9f54df5b8172ccc1866e48361550bd", "bytes": 319310 }, "provenance.json": { "sha256": "2b4e64fcb5c2195ab8df32108c9b4adf9a5d553076966684a65ba3b560d405e8", "bytes": 1784 }, "rendered.html": { "sha256": "dd10feb5862c7ed64b5794e8ceb5baa6d297ad27c7dfb41fd3ee23cdd1ca937e", "bytes": 349384 }, "screenshot.jpg": { "sha256": "5ce6cabb906c802b23be82668166488026ffd30416b82030f29008b06355c4c3", "bytes": 471268 }, "text.txt": { "sha256": "356402f97052a4c24981e92e04e1b206d98eb08502e29da334023fa23ba49475", "bytes": 7014 } }, "started_utc": "2026-10-23T16:16:27.011Z", "status": 200, "final_url": "https://inet.detik.com/security/d-8718436/saking-bahayanya-php2shell-kepala-negara-sampai-turun-tangan" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id-ID", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). detikInet (Indonesian), 22 October: because of how dangerous PHP2Shell is, heads of state had to step in. It says the sudden vulnerability of digital...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Saking Bahayanya PHP2Shell, Kepala Negara Sampai Turun Tangan\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/inet-detik/security-d-8718436-saking-bahayanya-php2shell-kepala-negara`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\ndetikInet (Indonesian), 22 October: because of how dangerous PHP2Shell is, heads of state had to step in. It says the sudden vulnerability of digital infrastructure made senior officials and heads of state give urgent warnings; it names Japan's Prime Minister Sanae Takaichi as publicly posting a special warning on her social media account urging system administrators and the public to watch for the risk, and the US NSA as taking an unusual step in publishing an advisory.\n\n> Perdana Menteri Jepang, Sanae Takaichi, secara terbuka mengunggah peringatan khusus di akun media sosialnya guna mengimbau para pengelola sistem dan masyarakat untuk mewaspadai risiko keamanan siber ini.\n\n_Curator's translation:_ \"Japan's Prime Minister, Sanae Takaichi, publicly posted a special warning on her social media account to urge system administrators and the public to be aware of this cyber security risk.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ detikINET article citing Al Jazeera: heads of government intervened. Japan's PM Takaichi posted a warning, the NSA issued an advisory, and several European ministries took sites down (Germany, France, Belgium, Netherlands, Finland, Czechia).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Saking Bahayanya PHP2Shell, Kepala Negara Sampai Turun Tangan\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id-ID`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "infobae-estados-unidos-2026-10-23-php2shell-como", "url": "https://www.infobae.com/estados-unidos/2026/10/23/php2shell-como-actuar-ante-la-alerta-del-fbi-que-pide-desconectar-sitios-web-vulnerables-en-estados-unidos/", "publisher": "Infobae", "kind": "news", "title": "PHP2Shell: cómo actuar ante la alerta del FBI que pide desconectar sitios web vulnerables en Estados Unidos - Infobae", "published": "2026-10-23T00:21:13.551Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a77240a075c52a46b20f5c59abb1e4dd06e81fe61c4831c11edd5e48ff1b9b44", "bytes": 1535 }, "page.html": { "sha256": "eec41642b23d1bf466fb71d3c3ec3fa9712fddb6194d1a84d1aeebdce9838500", "bytes": 229867 }, "provenance.json": { "sha256": "2d70ca3cc93cb9a2dd7c962ec4d3871d8a11e3f161238501b02bf9fda4547ad0", "bytes": 1945 }, "rendered.html": { "sha256": "95e2a910fba32dbd567f200af32318fc3f2dc2cfa7ba8a98783cdc3768153901", "bytes": 288481 }, "screenshot.jpg": { "sha256": "57e65b45f75c1fbe6b5eca7c4aedadf242c606cdc141ed727670d0dd53a66664", "bytes": 740965 }, "text.txt": { "sha256": "4c4d254cffdbe8820bc107264abe10c11bf472693915876bab0ed70d0af7ba68", "bytes": 12780 } }, "started_utc": "2026-10-23T16:12:35.011Z", "status": 200, "final_url": "https://www.infobae.com/estados-unidos/2026/10/23/php2shell-como-actuar-ante-la-alerta-del-fbi-que-pide-desconectar-sitios-web-vulnerables-en-estados-unidos/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Infobae (Spanish, US edition), 22 to 23 October: how to act on the FBI alert asking people to disconnect vulnerable websites in the United States. It...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: cómo actuar ante la alerta del FBI que pide desconectar sitios web vulnerables en Estados Unidos - Infobae\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `cl/news/infobae/estados-unidos-2026-10-23-php2shell-como-actuar-ante-la-aler`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nInfobae (Spanish, US edition), 22 to 23 October: how to act on the FBI alert asking people to disconnect vulnerable websites in the United States. It says, citing CBS News, that the FBI issued an alert on Wednesday 21 October asking every US organisation running PHP websites to update at once and, if they cannot, to disconnect them from the internet, and that the FBI, NSA and CISA agreed that organisations that cannot apply the fix immediately should remove their systems from the internet until it is resolved.\n\n> El FBI emitió el miércoles 21 de octubre una alerta para que todas las organizaciones en Estados Unidos que operan sitios web con PHP actualicen sus sistemas de inmediato.\n\n_Curator's translation:_ \"The FBI issued an alert on Wednesday 21 October for all organisations in the United States that operate PHP websites to update their systems immediately.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: cómo actuar ante la alerta del FBI que pide desconectar sitios web vulnerables en Estados Unidos - Infobae\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "infomoney-mundo-php-falha-ameaca-tirar-sites-ar", "url": "https://www.infomoney.com.br/mundo/php-falha-ameaca-tirar-sites-ar/", "publisher": "InfoMoney", "kind": "news", "title": "PHP: falha em uma linguagem de programação ameaça tirar sites do ar; entenda", "published": "2026-10-21T15:20:00+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "40d358ae2c0532a329b8874c7ee11f2db9fcb41fa43cadf001cec99cdb34be00", "bytes": 8329 }, "page.html": { "sha256": "51c34491478f8de90e0236f8ac0a90921b6d6a606810c4693613a2b4cbd3cc91", "bytes": 347997 }, "provenance.json": { "sha256": "896cfe23d05a86e99707febd55e76bdc770006fd21adc462508442e7234388b7", "bytes": 1683 }, "rendered.html": { "sha256": "e7b98ed56850b4e7d553e7c388e6b79c2ff3d7ca4b21f406ea1f87b3909f9c6d", "bytes": 426745 }, "screenshot.jpg": { "sha256": "5759c290398a1a15d06c43282ec9b8b47eacb1d5c7a9abdb847b3fc135e1a19d", "bytes": 449582 }, "text.txt": { "sha256": "8f9667fa92ab7592adf69c52549d9447680c8bf106d0576ca6ae86057d060b60", "bytes": 7101 } }, "started_utc": "2026-10-23T16:11:21.401Z", "status": 200, "final_url": "https://www.infomoney.com.br/mundo/php-falha-ameaca-tirar-sites-ar/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt-BR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). InfoMoney (Portuguese, Brazil), 21 October: a flaw in a programming language threatens to take sites offline. It describes CVE-2026-109618 as memory-e...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP: falha em uma linguagem de programação ameaça tirar sites do ar; entenda\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/infomoney/mundo-php-falha-ameaca-tirar-sites-ar`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nInfoMoney (Portuguese, Brazil), 21 October: a flaw in a programming language threatens to take sites offline. It describes CVE-2026-109618 as memory-exhaustion corruption, where PHP can enter an inconsistent internal state and treat partially initialised data as valid in clean-up, and CVE-2026-109619 as stale global state, where internal request data can stay in memory after being freed and be reused by a later request on the same worker.\n\n> CVE-2026-109619 — estado global obsoleto: informações internas de uma requisição podem permanecer na memória depois de ela ser liberada.\n\n_Curator's translation:_ \"CVE-2026-109619 — stale global state: a request's internal information can remain in memory after it is freed.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ InfoMoney explains the PHP security team's emergency update: the affected versions, the two CVEs, the at-risk SAPIs and the backports for 7.4–8.1.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP: falha em uma linguagem de programação ameaça tirar sites do ar; entenda\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt-BR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "infopoint-security-php2shell-chaos-ein-tag-der-die-sicherhe", "url": "https://www.infopoint-security.de/php2shell-chaos-ein-tag-der-die-sicherheitswelt-in-alarmbereitschaft-versetzte/a46856/", "publisher": "Infopoint Security", "kind": "news", "title": "PHP2Shell-Chaos: Ein Tag der Security-Teams in Alarmbereitschaft versetzte", "published": "2026-10-22 08:29:53", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "06af9663658e3edfdbedc5b581d2185f0179dc5d573958a4998578c6142f36fb", "bytes": 653 }, "page.html": { "sha256": "c1b3c072565e35194daef226096a85ca70b0c8a3264475e6e2a4eef37cfd0e92", "bytes": 86204 }, "provenance.json": { "sha256": "a229b18a060002e5ef1d1d3f3fc21b0390d6657cd5237b6e5f405cbafec0c1d5", "bytes": 1859 }, "rendered.html": { "sha256": "0a50151936da88bb6c73658ed60885f9f3ec6656391fb3ed3a82b2e6bba1bd1d", "bytes": 88487 }, "screenshot.jpg": { "sha256": "3404ba0037347ba00126afe167367af1bb71b16b4556aee7f7fd31c93bd08b1b", "bytes": 531860 }, "text.txt": { "sha256": "ac365d692cf74dd8c1139c2c5d3847bbcf20f617e1364191be5e07c9ca5cafe3", "bytes": 7488 } }, "started_utc": "2026-10-23T16:13:16.092Z", "status": 200, "final_url": "https://www.infopoint-security.de/php2shell-chaos-ein-tag-der-die-sicherheitswelt-in-alarmbereitschaft-versetzte/a46856/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Infopoint Security (German), 22 October: an account of the day security teams were put on alert: two critical flaws, information that leaked early, an...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell-Chaos: Ein Tag der Security-Teams in Alarmbereitschaft versetzte\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/infopoint-security/php2shell-chaos-ein-tag-der-die-sicherheitswelt-in-alarmbere`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nInfopoint Security (German), 22 October: an account of the day security teams were put on alert: two critical flaws, information that leaked early, and millions of potentially exposed web servers, with the consequences for companies. The opening was read; the detail further down was not.\n\n> Der 21. Oktober 2026 entwickelte sich für die Cybersecurity-Branche zu einem Tag im Ausnahmezustand.\n\n_Curator's translation:_ \"21 October 2026 became a day of emergency for the cybersecurity industry.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell-Chaos: Ein Tag der Security-Teams in Alarmbereitschaft versetzte\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "infosecurity-magazine-news-php2shell-exploitation-attempt", "url": "https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/", "publisher": "Infosecurity Magazine", "kind": "news", "title": "PHP2Shell Exploitation Attempt Detected Four Days Before Disclosure - Infosecurity Magazine", "published": "2026-10-22T10:10:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "96c00222dcfb3afd69716fa9e68623a44587a39773564846c0f1c677cc9e4dc0", "bytes": 1651 }, "page.html": { "sha256": "7b80b5a632605b9ecae554c24290303adf32f5cb2ccb374868bade98189d2c95", "bytes": 108868 }, "provenance.json": { "sha256": "00e7ad7ece63f87dec66d5082cf7a547cbe3789b000a88604c0dd421b5ccb07b", "bytes": 1739 }, "rendered.html": { "sha256": "2c72a43d49ed4fe485eaa6ab7e6f291809b7634ec9f69cc59eb7bb8de3ae7f90", "bytes": 118692 }, "screenshot.jpg": { "sha256": "b9c095ec113af118bf53544c99f06298253e49dfa5924012d8fb9779e540ebfc", "bytes": 489006 }, "text.txt": { "sha256": "723f0a0bfb538e435f2f44a92033c7e84a12742ff11daff23cba69a7ddf1df8d", "bytes": 7569 } }, "started_utc": "2026-10-23T16:15:46.826Z", "status": 200, "final_url": "https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-gb", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Infosecurity Magazine, 22 October: Amazon detected a PHP2Shell exploitation attempt four days before the disclosure. The flaws could allow unauthentic...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Exploitation Attempt Detected Four Days Before Disclosure - Infosecurity Magazine\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/infosecurity-magazine/news-php2shell-exploitation-attempt`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nInfosecurity Magazine, 22 October: Amazon detected a PHP2Shell exploitation attempt four days before the disclosure. The flaws could allow unauthenticated remote code execution and server takeover on websites using any PHP version of the last decade, back to 5.4.\n\n> could allow unauthenticated remote code execution (RCE) and server takeover on any websites relying on any PHP version released in the last decade – going back to version 5.4\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Exploitation Attempt Detected Four Days Before Disclosure - Infosecurity Magazine\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-gb`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "inibalikpapan-pemprov-kaltim-waspadai-php2shell-celah", "url": "https://www.inibalikpapan.com/pemprov-kaltim-waspadai-php2shell-celah-siber-kritis-ancam-server-pemerintahan/", "publisher": "IniBalikpapan.Com", "kind": "news", "title": "Pemprov Kaltim Waspadai PHP2Shell, Celah Siber Kritis Ancam Server Pemerintahan - IniBalikpapan.Com", "published": "2026-10-24T20:30:00+00:00", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "5081a5cc5a97296279ee0e2c330fbe2db992bd1566e53aa99f0ddb188aff943b", "bytes": 1029 }, "page.html": { "sha256": "892fb9bef9b62b109a7b90b1bd99f78f88abacc868c2ab177570dbf2dbd7583c", "bytes": 133282 }, "provenance.json": { "sha256": "a992aaaa44b0abd6fa613161f14738b4ab1c7e115c23aad555fe4ffcc3f46a12", "bytes": 1845 }, "rendered.html": { "sha256": "dab5b1d01ac4b1fd6a9f2f0cd95da311b20c84793192480fe1f8948b7de643d1", "bytes": 149471 }, "screenshot.jpg": { "sha256": "b78e6c1fcd969f51dc97b16c93652056b0698ff8ab26742495c1eceddd841ae4", "bytes": 500949 }, "text.txt": { "sha256": "308b7d4ed87e6bacd051e9d7cb31466cce51d92f630a99a0138d15cc5f466069", "bytes": 8114 } }, "started_utc": "2026-10-25T09:46:48.535Z", "status": 200, "final_url": "https://www.inibalikpapan.com/pemprov-kaltim-waspadai-php2shell-celah-siber-kritis-ancam-server-pemerintahan/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IniBalikpapan.com (Indonesian), 24 October: East Kalimantan's provincial government is on guard against PHP2Shell. It tightened the security of its di...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Pemprov Kaltim Waspadai PHP2Shell, Celah Siber Kritis Ancam Server Pemerintahan - IniBalikpapan.Com\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/inibalikpapan/pemprov-kaltim-waspadai-php2shell-celah-siber-kritis-ancam-s`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIniBalikpapan.com (Indonesian), 24 October: East Kalimantan's provincial government is on guard against PHP2Shell. It tightened the security of its digital systems after the two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (9.2 on CVSS 4.0), which could let attackers take over servers without logging in; the PHP team announced the security update on 21 October 2026.\n\n> Pemerintah Provinsi Kalimantan Timur memperketat pengamanan sistem digital di lingkungan pemerintahan menyusul temuan dua kerentanan kritis pada bahasa pemrograman PHP yang dikenal sebagai PHP2Shell.\n\n_Curator's translation:_ \"The East Kalimantan Provincial Government is tightening the security of digital systems within government following the discovery of two critical vulnerabilities in the PHP programming language known as PHP2Shell.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Pemprov Kaltim Waspadai PHP2Shell, Celah Siber Kritis Ancam Server Pemerintahan - IniBalikpapan.Com\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "insiderpaper-archive-wikipedia", "url": "https://insiderpaper.com/internet-archive-wikipedia-down-php/", "publisher": "insiderpaper.com", "kind": "news", "title": "Internet Archive down, Wikipedia hit by outages amid PHP issues - Insider Paper", "published": null, "captures": [ { "stamp": "20261022T081314Z", "files": { "headers.json": { "sha256": "5adf01bc00583d1a001661e4324a94447f30fc180f9172d640bd9b20031debac", "bytes": 843 }, "page.html": { "sha256": "6c34cea33f4415eef2040587c46e31fef1f843bd25cbfd3bd08f7245207fb2db", "bytes": 105403 }, "provenance.json": { "sha256": "55b2f4e9919b640d8b8d086f609f0f07506af08b29b2f1442230cc2ce0f99a7c", "bytes": 1041 }, "rendered.html": { "sha256": "c0a05a9cf251c8172dfbde3ba3cfaf240b14263a4e1dd9ea5e6ecb4f8d661bcf", "bytes": 120653 }, "screenshot.png": { "sha256": "238bd10edbbac79827d10be4d221864096a471909266507d8f4c9963268f14fe", "bytes": 1361810 }, "text.txt": { "sha256": "dba4741ae1b287deea2eafb352e4943ec73bc0fc0e568707b6083cdf1baade63", "bytes": 4921 } }, "started_utc": "2026-10-22T08:13:14.360Z", "status": 200, "final_url": "https://insiderpaper.com/internet-archive-wikipedia-down-php/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "insurance-business-au-asiapac-attacks-begin", "url": "https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx", "publisher": "Insurance Business", "kind": "news", "title": "Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business", "published": "2026-10-22T11:59:56Z (modified 15:52:31Z, per the page's metadata)", "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "d7c6037a3d486dcfea6be77442fd206f61bc6906e70e92270a8041eb3f5543cb", "bytes": 1441 }, "page.html": { "sha256": "98d4b6426324d21a0f86b027448e1edb42f7f14f078cb666b8c2fb7df882f03e", "bytes": 103632 }, "provenance.json": { "sha256": "6e01812fd9981745cf7bddb9cfe50b700144a4470cdc9291f482f5a82c1dde8f", "bytes": 1838 }, "rendered.html": { "sha256": "4017fbe931ba3e838695e7ab60fc4c3b0b9976750eb6b68b958bc939e4bac0d7", "bytes": 275204 }, "screenshot.jpg": { "sha256": "e3b290e88f04e0036da577427acade1fa7f0aaee342ce10de8c8f2d2aa846d00", "bytes": 823298 }, "text.txt": { "sha256": "8d88bddde485e36f27c001a80e9ad0506055b64f3879347345be5ad336a10cad", "bytes": 9469 } }, "started_utc": "2026-10-23T01:23:43.296Z", "status": 200, "final_url": "https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): Patchstack \"conf...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/tech-press/insurance-business/au-asiapac-attacks-begin`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: Insurance Business. Language: en. URL: https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx\n\n## What the page says\n\n_Curator's reading of the capture._\n\nInsurance Business (Australia) on Asia-Pacific agency warnings. An update at 1pm AEDT on 22 October says security vendors report exploitation beyond honeypots \"though official agencies have yet to confirm it\": Hadrian sees PHP2Shell exploited at scale, mostly through PHP's session upload-progress path; Patchstack \"has confirmed multiple active exploitation incidents\"; Cloudflare reports early attacks; against that, Huntress had not observed exploitation across its partner systems. It also says watchTowr's decoy servers recorded attempts and \"No breach at a real organisation had been confirmed by the time the fixes were released\", that exploit code circulates and that the Dutch NCSC expects large-scale attacks. It adds the insurance angle: the memory-disclosure impact (Wiz) could make a data leak notifiable without any outage, and tells clients to get written confirmation of patching and to check unpatched servers for a break-in. No organisation is named as compromised.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): Patchstack \"confirmed multiple active exploitation incidents\"; \"no victim organisation has been named\"\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "insurancebusiness-uk-councils", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "publisher": "insurancebusinessmag.com", "kind": "news", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "published": null, "captures": [ { "stamp": "20261022T081252Z", "files": { "headers.json": { "sha256": "30acd0390cc491cfdaf72982b9c580d022f1401872425588f56eac11e5d46509", "bytes": 1441 }, "page.html": { "sha256": "7a49498f54bbb46f5db660369044e8443b338c2d46bf6c6077f3cbcfd609163b", "bytes": 222907 }, "provenance.json": { "sha256": "207911ae60de17b7791b5892a7782f1555d7f31014f6487bb6b8f460b41fdf1f", "bytes": 1196 }, "rendered.html": { "sha256": "8df24098f293286c5fc875108d9d11e344de84a882116093920e43ceff9e1608", "bytes": 401343 }, "screenshot.png": { "sha256": "76be0be292fecd0fd681fc80c534f4e1464d412dc5f68cd11ef02942386b54fd", "bytes": 1999104 }, "text.txt": { "sha256": "daa04c79edfb56f49761d38fa7ce81c2aa1828f78a0b0b4694519818e4e507ca", "bytes": 7092 } }, "started_utc": "2026-10-22T08:12:52.168Z", "status": 200, "final_url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "insurancebusiness-uk-councils-met", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "publisher": "Insurance Business (Matthew Sellers)", "kind": "news", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112225Z", "files": { "headers.json": { "sha256": "3d07c50bb43d9b0530e97433ee53da60ac0afc3cb28ee547618e5cce5e68d8d0", "bytes": 1370 }, "page.html": { "sha256": "3cf31852fd2bdd575e2b3cb127faa507e947fbd823c16befeaca3901daa676a4", "bytes": 223253 }, "provenance.json": { "sha256": "3d2dc87a1364e14f154fb92ea66b98c53bcf8b335f6ab4488be62bf869fe6071", "bytes": 1200 }, "rendered.html": { "sha256": "2db316644de0dc7e608587a786f6571e83708d928733ae4a8a227c5b31f3b1cd", "bytes": 400028 }, "screenshot.png": { "sha256": "143c99a16e7b571c7069d3cc0b3396802d75971d4ec8a883b902db2b02a15061", "bytes": 2153476 }, "text.txt": { "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "bytes": 7188 } }, "started_utc": "2026-10-22T11:22:25.194Z", "status": 200, "final_url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "e4918aebc93de796d0004aa9c592dcb96b71d3b6fcaa67fbb1195bbefa28563e", "bytes": 1439 }, "page.html": { "sha256": "8735471661303d0f7c21f3318333059ed32a0b65305a459f22a238045ffe4c09", "bytes": 225142 }, "provenance.json": { "sha256": "469615d4724ce097804eb8e80950d12ba7be9a3ae7dd49a1699c47803a90b846", "bytes": 1978 }, "rendered.html": { "sha256": "7657708ca2a91a072929110c703c9a14469a57cf19073e7086c6959da5138bc4", "bytes": 394152 }, "screenshot.jpg": { "sha256": "e78ced0dce01243b0d52a290b7e79bbafbea6770bce5801c24dfb09e952723ae", "bytes": 693294 }, "text.txt": { "sha256": "8a97c447cf02381c719100eabb24e9f484d68bcfd4a143a764425dd3af00e1ab", "bytes": 7173 } }, "started_utc": "2026-10-23T16:15:59.839Z", "status": 200, "final_url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "e6f1f12746bde369562bcc82e470f9338b299d07c8cbf3a64c982aa9c7fe7067", "bytes": 1441 }, "page.html": { "sha256": "2e7cf44382a31a9c30808366e2cd6af835aebcc3e848fc75d962e9978dc3e6e5", "bytes": 225217 }, "provenance.json": { "sha256": "257a837c4d1c19da47b97dd17fbac817c28a7a19373946853b39ec952cece6fc", "bytes": 1817 }, "text.txt": { "sha256": "3876631293f8dad80be19c44d9a9dbeb794f6d0a3d978addc493800dc2399536", "bytes": 7190 } }, "started_utc": "2026-10-23T23:33:30.934Z", "status": 200, "final_url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Edinburgh and Oxford councils and the Met Police unavailable; Bristol, Lambeth and Barnet errors; Dutch NCSC offline; Valtori; Cloudflare CTO 'STOPGAP only'; Unit 42 22.6 million systems; W3Techs Aug 2026 ~70%.", "raw_sha256": {}, "has_notes": true, "notes_md": "# UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business\n\nCaptured by claude-story-site. Status: captured. Edinburgh and Oxford councils and the Met Police unavailable; Bristol, Lambeth and Barnet errors; Dutch NCSC offline; Valtori; Cloudflare CTO 'STOPGAP only'; Unit 42 22.6 million systems; W3Techs Aug 2026 ~70%.\n\n- 'Palo Alto Networks' Unit 42 has counted more than 22.6 million internet-facing systems that could be vulnerable.' Method not given.\n- 'According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified.' The one page on this beat that names the survey.\n- Insurance angle: aggregation event; business-interruption cover for precautionary shutdowns depends on wording.\n" }, { "slug": "iphonesoft-2026-10-22-faille-php-5-8-5-savoir-situa", "url": "https://iphonesoft.fr/2026/10/22/faille-php-5-8-5-savoir-situation-urgence", "publisher": "iPhoneSoft", "kind": "news", "title": "Faille PHP 5 à 8.5 : tout savoir sur la situation d'urgence - iPhoneSoft", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "47c98ddd98aa796db0d7c8c8bfabe389f54733d5cb9f0628dcc180f144bae1a6", "bytes": 863 }, "page.html": { "sha256": "8beab37b32c4ee9d00bc07098ab56d121b1970a21e9d5264dd0ca6b4c12bef13", "bytes": 44602 }, "provenance.json": { "sha256": "40ed8f1941510f17330002040ba72a4d6ee57c7be1345ce437a09f3951169111", "bytes": 1726 }, "rendered.html": { "sha256": "d7fbb000a9ef96a79a5091efd4008f78c5bd568dfd25b8a00c3dd45130c17c8c", "bytes": 818728 }, "screenshot.jpg": { "sha256": "605f912976b484e490fa7787be3929a4f0c39a6f72fbf8c4d1ae2f9754833ad2", "bytes": 529737 }, "text.txt": { "sha256": "fe00635f4b0e1b6878a5b861b9c51451ce7a8ecbb379bc4f56a2cd576902769e", "bytes": 6398 } }, "started_utc": "2026-10-23T16:14:55.489Z", "status": 200, "final_url": "https://iphonesoft.fr/2026/10/22/faille-php-5-8-5-savoir-situation-urgence" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). iPhoneSoft (French), 22 October: PHP flaw from 5 to 8.5, everything about the emergency. Two critical PHP vulnerabilities caused the preventive shutdo...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Faille PHP 5 à 8.5 : tout savoir sur la situation d'urgence - iPhoneSoft\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/iphonesoft/2026-10-22-faille-php-5-8-5-savoir-situation-urgence`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\niPhoneSoft (French), 22 October: PHP flaw from 5 to 8.5, everything about the emergency. Two critical PHP vulnerabilities caused the preventive shutdown of many sites on 21 October 2026; they allow unauthenticated remote code execution and are rated 9.2 out of 10; the headline's 5 to 8.5 indicates the affected PHP range as this outlet gives it.\n\n> Deux vulnérabilités critiques dans PHP, le langage qui alimente une large partie du web, ont provoqué le 21 octobre 2026 la mise hors ligne préventive de nombreux sites.\n\n_Curator's translation:_ \"Two critical vulnerabilities in PHP, the language that powers a large part of the web, caused the preventive taking offline of many sites on 21 October 2026.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Faille PHP 5 à 8.5 : tout savoir sur la situation d'urgence - iPhoneSoft\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "istanbulticaretgazetesi-siber-guvenlik-baskanligindan-php2shell", "url": "https://istanbulticaretgazetesi.com/siber-guvenlik-baskanligindan-php2shell-acigi-uyarisi-kritik-sistemler-icin-tarama-baslatildi", "publisher": "İstanbul Ticaret Gazetesi", "kind": "news", "title": "Siber Güvenlik Başkanlığı'ndan PHP2Shell açığı uyarısı: Kritik sistemler için tarama başlatıldı", "published": "2026-10-22T08:58:20+03:00", "captures": [ { "stamp": "20261025T120459Z", "files": { "headers.json": { "sha256": "eef6a4de66ea3b43df713a7935031b0af4128f66e79e8a75e8c38768a772db58", "bytes": 2739 }, "page.html": { "sha256": "910c7abbacd7659ef9bc0b0a5583d3b04d156ba01264cebe99905550c07417d3", "bytes": 142852 }, "provenance.json": { "sha256": "3ad0469e65270fe5fbcdf2d23ad6e3bbc9226ee27743f755043ee58eeb488882", "bytes": 1926 }, "rendered.html": { "sha256": "07750140aa19a3436206ee810ae054fb9a00139a3d87412b649550b59ce736eb", "bytes": 143557 }, "screenshot.jpg": { "sha256": "6ccdfd799e6ab831dcb9c6cdfca8faf9495a560b2445b3b50f270e6785657505", "bytes": 410479 }, "text.txt": { "sha256": "d02caee1e5ef8352d524a1635e38e144e8a6e9892073cfed5a8ac13843972e60", "bytes": 6069 } }, "started_utc": "2026-10-25T12:26:32.947Z", "status": 200, "final_url": "https://istanbulticaretgazetesi.com/siber-guvenlik-baskanligindan-php2shell-acigi-uyarisi-kritik-sistemler-icin-tarama-baslatildi" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Istanbul Ticaret Gazetesi (Turkish), 22 October: Turkey's Presidency Cybersecurity Directorate started a national-scale scan against the PHP2Shell fla...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Siber Güvenlik Başkanlığı'ndan PHP2Shell açığı uyarısı: Kritik sistemler için tarama başlatıldı\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/istanbulticaretgazetesi/siber-guvenlik-baskanligindan-php2shell-acigi-uyarisi-kritik`, snapshot `20261025T120459Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T120459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIstanbul Ticaret Gazetesi (Turkish), 22 October: Turkey's Presidency Cybersecurity Directorate started a national-scale scan against the PHP2Shell flaw, which lets attackers run code remotely, with a scan for critical systems. Another Turkish outlet for the same Directorate announcement.\n\n> Cumhurbaşkanlığı Siber Güvenlik Başkanlığı, yaygın kullanılan PHP yazılım altyapısında tespit edilen ve saldırganlara uzaktan kod çalıştırma imkanı tanıyan \"PHP2Shell\" zafiyetine karşı ulusal ölçekte tarama başlattı.\n\n_Curator's translation:_ \"The Presidency's Cybersecurity Directorate has started a national-scale scan against the 'PHP2Shell' vulnerability, found in the widely used PHP software infrastructure, which gives attackers the ability to run code remotely.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Siber Güvenlik Başkanlığı'ndan PHP2Shell açığı uyarısı: Kritik sistemler için tarama başlatıldı\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "it-daily-shortnews-php2shell-die-aktuelle-lage", "url": "https://www.it-daily.net/shortnews/php2shell-die-aktuelle-lage", "publisher": "it-daily.net", "kind": "news", "title": "PHP2Shell: Die aktuelle Lage nach dem Patch", "published": "2026-10-22T15:15:59+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9695e41002663a335827fe97a13367472f6f5d5fbf6128ac40c78df5da90e84a", "bytes": 789 }, "page.html": { "sha256": "338bd29498bcff507575707c84fa37e15021afcef73df8b236cdcc92f5c1eae4", "bytes": 281033 }, "provenance.json": { "sha256": "cacb79068f8c5c16802c4064721916bb9a4e3cfaa15367f1c6b67212c8ec9c00", "bytes": 1637 }, "rendered.html": { "sha256": "64a48e283828bd2220d218801eefab5572919479833a0280971d85c1105d05c6", "bytes": 352665 }, "screenshot.jpg": { "sha256": "acc9df37231bcffd2200f1a4b79143d8394539ca34b082567d5a717ae6df9498", "bytes": 555457 }, "text.txt": { "sha256": "540025f0b24a94f3b5314f48cc78559c29526be1eae033198e15eb38c72efa6a", "bytes": 8207 } }, "started_utc": "2026-10-23T16:12:16.666Z", "status": 200, "final_url": "https://www.it-daily.net/shortnews/php2shell-die-aktuelle-lage" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). it-daily.net (German), 22 October: PHP2Shell, the current situation after the patch. According to Cloudflare's chief executive, criminal actors began...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Die aktuelle Lage nach dem Patch\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/it-daily/shortnews-php2shell-die-aktuelle-lage`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nit-daily.net (German), 22 October: PHP2Shell, the current situation after the patch. According to Cloudflare's chief executive, criminal actors began scanning the worldwide network for unprotected servers immediately after the details became known, and within a few hours the access attempts rose exponentially.\n\n> Laut Prince hatten kriminelle Akteure unmittelbar nach Bekanntwerden der Details zur Schwachstelle (bekannt als «PHP2Shell») begonnen, das weltweite Netz gezielt nach ungeschützten Servern zu scannen.\n\n_Curator's translation:_ \"According to Prince, criminal actors began, immediately after the details of the vulnerability (known as 'PHP2Shell') became known, to scan the worldwide network specifically for unprotected servers.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Die aktuelle Lage nach dem Patch\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "it-finance-yahoo-notizie-avviso-per-gli-exchange-di-22423", "url": "https://it.finance.yahoo.com/notizie/avviso-per-gli-exchange-di-224238845.html", "publisher": "Yahoo Finanza", "kind": "news", "title": "Avviso per gli exchange di crypto: una grave vulnerabilità PHP mette a rischio i siti di pagamento", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "14b530caf70b8055757198eed4edac7690c7aa2ab491e7e8687687bf1a1d5f8a", "bytes": 31973 }, "page.html": { "sha256": "8d4fdce54a79d0278bce072fd149868819c27fba111211d83f0878f2ca31493e", "bytes": 358322 }, "provenance.json": { "sha256": "cae9669db6a1998cee4738ab882a555767e3b79a45818e2d512863857dbc0984", "bytes": 1773 }, "rendered.html": { "sha256": "4daec8f5f4250e80489c770ce967ea917c187f814840da3dd4bd19e62d47dec1", "bytes": 426581 }, "screenshot.jpg": { "sha256": "44a38b539889ea4a8d4cd4905314c8ed3ffb686fe1a749e4937159c7ff6934ee", "bytes": 327943 }, "text.txt": { "sha256": "e51ded94e469d4867f3136a2efadb8261a9e7849aa31e73bb75fca0b05243c07", "bytes": 4330 } }, "started_utc": "2026-10-23T16:18:53.968Z", "status": 200, "final_url": "https://it.finance.yahoo.com/notizie/avviso-per-gli-exchange-di-224238845.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Yahoo Finanza (Italian), a notice for crypto exchanges: a serious PHP vulnerability puts payment sites at risk. On Wednesday 21 October the PHP develo...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Avviso per gli exchange di crypto: una grave vulnerabilità PHP mette a rischio i siti di pagamento\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/it-finance-yahoo/notizie-avviso-per-gli-exchange-di-224238845-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nYahoo Finanza (Italian), a notice for crypto exchanges: a serious PHP vulnerability puts payment sites at risk. On Wednesday 21 October the PHP developers released emergency patches for two vulnerabilities known as PHP2Shell, rated 9.2 out of 10; the page stresses these are assessments of potential exposure and that it has not been verified that the payment providers cited or the main exchanges were compromised through PHP2Shell.\n\n> Non è stato verificato che i provider di pagamento citati o i principali exchange siano stati compromessi tramite PHP2Shell.\n\n_Curator's translation:_ \"It has not been verified that the payment providers cited or the main exchanges were compromised through PHP2Shell.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Yahoo Finanza (a BeInCrypto translation) says PHP2Shell puts crypto payment gateways, small exchanges and DeFi front-ends at risk. It names WooCommerce integrations of Binance Pay, Crypto.com Pay, BitPay, CoinGate and CoinPayments as potential exposure.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Avviso per gli exchange di crypto: una grave vulnerabilità PHP mette a rischio i siti di pagamento\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "it-finanzmagazin-php2shell-sicherheitsluecken-bedrohen-we", "url": "https://www.it-finanzmagazin.de/php2shell-sicherheitsluecken-bedrohen-weiterhin-auch-banken-und-finanzdienstleister-252814/", "publisher": "IT Finanzmagazin", "kind": "news", "title": "PHP2Shell-Sicherheitslücken bedrohen auch Banken und Finanzdienstleister", "published": "2026-10-23T05:30:07+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "151e327491bd02691fbac079064d65a43f92aba097351319275c4c83184c3bf0", "bytes": 796 }, "page.html": { "sha256": "1dcb38424cbf19d0e581165c98d5edbbfca5c5e3630a051e774ab8d84566d5c7", "bytes": 322282 }, "provenance.json": { "sha256": "4963156ab7e6c51dceb4b591341db04ce2f3e6266eaf2444ce20787f1096dff6", "bytes": 1855 }, "rendered.html": { "sha256": "5e573606a9c82794efc2db5e9285b27d565fb9b2864c4f127c2e78680923e56a", "bytes": 329897 }, "screenshot.jpg": { "sha256": "12180c5b1670a95f056382e7d90e71bb1fb2510718042919a59e37105b4c9154", "bytes": 859107 }, "text.txt": { "sha256": "9c370ea0d223e2c82ed93afc8e2f860d4089df88fcb3cf3fc0e9904cc1ef516b", "bytes": 11625 } }, "started_utc": "2026-10-23T16:13:16.423Z", "status": 200, "final_url": "https://www.it-finanzmagazin.de/php2shell-sicherheitsluecken-bedrohen-weiterhin-auch-banken-und-finanzdienstleister-252814/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IT Finanzmagazin (German), 23 October: the PHP2Shell vulnerabilities also threaten banks and financial service providers. They let attackers run malic...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell-Sicherheitslücken bedrohen auch Banken und Finanzdienstleister\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/it-finanzmagazin/php2shell-sicherheitsluecken-bedrohen-weiterhin-auch-banken`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIT Finanzmagazin (German), 23 October: the PHP2Shell vulnerabilities also threaten banks and financial service providers. They let attackers run malicious code on web servers without logging in, read confidential information and possibly take full control; for bank customers the flaw does not directly affect their accounts or online banking, nor their own phones and computers, but attackers could through vulnerable web applications possibly obtain credentials and session keys. It names the Shizuoka Bank in Japan as announcing a precautionary, temporary shutdown of its website and banking app, and adds that such shutdowns, in any sector, are not proof of successful attacks but rather of a sensible IT security strategy.\n\n> Für Bankkunden heißt das, dass die Sicherheitslücke nicht unmittelbar ihre Konten oder das Online-Banking in Mitleidenschaft zieht.\n\n_Curator's translation:_ \"For bank customers this means that the vulnerability does not directly affect their accounts or online banking.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell-Sicherheitslücken bedrohen auch Banken und Finanzdienstleister\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "itdaily-blogs-logiciel-php2shell-bug-php", "url": "https://itdaily.fr/blogs/logiciel/php2shell-bug-php/", "publisher": "ITdaily", "kind": "news", "title": "PHP2Shell : une faille majeure dans PHP activement exploitée avant la disponibilité du correctif - ITdaily", "published": "2026-10-21T13:55:56+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "fc4bc78b399501edb3e7dd3f60cfb24d8be4d1959cf9a4020fb9070fed077262", "bytes": 643 }, "page.html": { "sha256": "f2a5fe735d6b54ca798a1765dd09f96268a6c756ad9d2aa4e15d35810f599e8e", "bytes": 114364 }, "provenance.json": { "sha256": "3ad577b312b0a9b49db5d0b776e849ec361aaf334e878e3d8bf2977880d7ac29", "bytes": 1661 }, "rendered.html": { "sha256": "6cb2162cb57181e8d106383d80e3e5e38d93ca7960293df9e8140b28c9be6bb6", "bytes": 116843 }, "screenshot.jpg": { "sha256": "a2f5c873be763d078f711b06703760c141a7b90d3470c610f546aa4f9e14a0b1", "bytes": 641339 }, "text.txt": { "sha256": "6f61aceea38ee7638b3c7ebf0e1e0a2c4b868cfb0b7bb53ad9e6319e8603a45b", "bytes": 11129 } }, "started_utc": "2026-10-23T16:14:57.783Z", "status": 200, "final_url": "https://itdaily.fr/blogs/logiciel/php2shell-bug-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ITdaily (French edition), 21 October, updated 16:38: a major PHP flaw actively exploited before the fix was available. PHP shared the patches slightly...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : une faille majeure dans PHP activement exploitée avant la disponibilité du correctif - ITdaily\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/itdaily/blogs-logiciel-php2shell-bug-php`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nITdaily (French edition), 21 October, updated 16:38: a major PHP flaw actively exploited before the fix was available. PHP shared the patches slightly earlier than planned for the vulnerabilities that had leaked earlier; nearly 70% of all websites are concerned; the two critical flaws were already being actively abused; the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\n\n> L’exploitation active a commencé avant même la disponibilité du correctif, lequel est désormais publié.\n\n_Curator's translation:_ \"Active exploitation began even before the fix was available, which has now been published.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ ITdaily (Belgium) explains the flaws and quotes Eye Security's Vaisha Bernard. It reports that Belgian host Combell patched before public release, and that DPG Media, the VUB and some hospitals went offline. The CCB recommended going offline and put its own site into maintenance.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : une faille majeure dans PHP activement exploitée avant la disponibilité du correctif - ITdaily\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "itdaily-blogs-software-php2shell-bug-php", "url": "https://itdaily.be/blogs/software/php2shell-bug-php/", "publisher": "ITdaily", "kind": "news", "title": "PHP2Shell: groot lek in PHP actief misbruikt, nog voor beschikbaarheid patch - ITdaily", "published": "2026-10-21T13:55:56+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "704b2c806f55d1fd2bad5be2e33261b1f464d6714dab72bec03f9c7cf30ff94a", "bytes": 643 }, "page.html": { "sha256": "4f3981bd2831a7022c6766d3e93b1774bcad5574ddd2a9a282cf5eaf3aadb3fd", "bytes": 111628 }, "provenance.json": { "sha256": "c0028f3e2add5656f16a1eb46a2dbbcee099d2b281f004a6aff327db8a45c06a", "bytes": 1489 }, "text.txt": { "sha256": "7ffb5c6722658267e9f24f45b8bd5951573aeae5d425577b334f1eefff67fda7", "bytes": 9511 } }, "started_utc": "2026-10-23T16:10:59.552Z", "status": 200, "final_url": "https://itdaily.be/blogs/software/php2shell-bug-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ITdaily (Dutch edition), 21 October: the Dutch-language version of the same article as the French ITdaily capture, headlined that a big PHP leak was a...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: groot lek in PHP actief misbruikt, nog voor beschikbaarheid patch - ITdaily\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/itdaily/blogs-software-php2shell-bug-php`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nITdaily (Dutch edition), 21 October: the Dutch-language version of the same article as the French ITdaily capture, headlined that a big PHP leak was actively exploited even before the patch was available.\n\n> PHP2Shell: groot lek in PHP actief misbruikt, nog voor beschikbaarheid patch\n\n_Curator's translation:_ \"PHP2Shell: big hole in PHP actively abused, even before the patch was available\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ ITdaily (Belgium) explains PHP2Shell, the fixed versions and the backports for 7.4 to 8.1. It quotes Vaisha Bernard of Eye Security, reports that Belgian hoster Combell patched before the public release, and that DPG Media, the VUB, several hospitals and the Belgian CCB's own website went offline, with the CCB recommending taking sites offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: groot lek in PHP actief misbruikt, nog voor beschikbaarheid patch - ITdaily\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "itdaily-news-articleview-html", "url": "https://www.itdaily.kr/news/articleView.html?idxno=242392", "publisher": "아이티데일리", "kind": "news", "title": "스틸리언, ‘PHP2Shell’ 취약점 무료 점검 서비스 공개 < 보안 < AI/ICT < 기사본문 - 아이티데일리", "published": "2026-10-22T17:23:25+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "6f23ede504ae1bb70503ca0091b132b288ba0def8c9e3a1be5ccb05e11ab0032", "bytes": 343 }, "page.html": { "sha256": "1f9f3df5c5af583a85f178cb4e29038ec750a3992ac29167bf406cef59d06521", "bytes": 144635 }, "provenance.json": { "sha256": "91f0193e71862029bc93fd3e96550b5f8a8dbfb6371092953ccf0c097811f2f1", "bytes": 1652 }, "rendered.html": { "sha256": "d5afcf8928b89f59268d20f9f649f4f06880e8157e2ee008803207b621319fcf", "bytes": 165212 }, "screenshot.jpg": { "sha256": "06109396873508333882174a66c794042e43c9d292563e5efd6ebc16352ff0c6", "bytes": 434636 }, "text.txt": { "sha256": "4cc6406a7d9f2fdcdfb6f5d76eda72dfff7f3131cc812850a2ff8bcdcae06023", "bytes": 9542 } }, "started_utc": "2026-10-23T16:21:24.223Z", "status": 200, "final_url": "https://www.itdaily.kr/news/articleView.html?idxno=242392" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IT Daily (Korean), 22 October: the Korean firm Stealien released a free 'PHP2Shell' vulnerability check service; the caption describes the php2shell c...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 스틸리언, ‘PHP2Shell’ 취약점 무료 점검 서비스 공개 < 보안 < AI/ICT < 기사본문 - 아이티데일리\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/itdaily/news-articleview-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIT Daily (Korean), 22 October: the Korean firm Stealien released a free 'PHP2Shell' vulnerability check service; the caption describes the php2shell check service made free by Stealien. The same announcement as the DigitalToday item; vendor service, not used by the curator.\n\n> 스틸리언이 무료 공개한 php2shell 점검 서비스.\n\n_Curator's translation:_ \"The php2shell check service that Stealien released for free.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"스틸리언, ‘PHP2Shell’ 취약점 무료 점검 서비스 공개 < 보안 < AI/ICT < 기사본문 - 아이티데일리\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "itdaily-php-clumsy-announcement", "url": "https://itdaily.com/blogs/software/php-angry-clumsy-announcement/", "publisher": "ITdaily (Jens Jonkers)", "kind": "news", "title": "PHP Foundation angered by ‘clumsy’ disclosure of vulnerabilities - ITdaily", "published": "2026-10-22T09:36 (local, Belgium)", "captures": [ { "stamp": "20261022T112142Z", "files": { "headers.json": { "sha256": "9c96a4285eed59d7470a9a983facb2964a82b6539cf0dd85887c0cb4b2fb0740", "bytes": 606 }, "page.html": { "sha256": "c93c7d6384ee8c4a47a08e5ac9e9aa9dc1d96089fc05044a194b1220e7c9d4ed", "bytes": 130955 }, "provenance.json": { "sha256": "ebec1bc848714c197d387275d82b755dbb12649df06083c9d18633217827d2a5", "bytes": 1049 }, "rendered.html": { "sha256": "b634233f4e687df8538e68d9f0af3af145ab15dc5bbe966f7a1457f2350eaf4a", "bytes": 134246 }, "screenshot.png": { "sha256": "5a11124ea720acd8ae8b3af6b0df0a3925b72abfa059d3db627464c578ae2700", "bytes": 1036421 }, "text.txt": { "sha256": "27772c396e4bd60e2e200b2ba8db0273291060cad355f3927bdcd0ee9c2aa7ad", "bytes": 6719 } }, "started_utc": "2026-10-22T11:21:42.604Z", "status": 200, "final_url": "https://itdaily.com/blogs/software/php-angry-clumsy-announcement/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d4183de402614ab3cb0b3389affe6454e514b1d6b12da33f12503a873da95397", "bytes": 642 }, "page.html": { "sha256": "8d38db371f615891a74b891f10fa77d0fd3de5dfb6d19e08fffc359688d1a1c0", "bytes": 109401 }, "provenance.json": { "sha256": "78d3a00092f6a0e89be4ed32fc77d1f99b7f0d97f8dfa034a92f42c9fb295b86", "bytes": 1788 }, "rendered.html": { "sha256": "566da57232a6d2f8319c1043ddd06a4b84edf4f952cdce055268dae2e94f39f9", "bytes": 111971 }, "screenshot.jpg": { "sha256": "b21044eab2552799adf4388bb39fc8cced84bfc7cf12d8b58a7939e71ad5a0f9", "bytes": 443657 }, "text.txt": { "sha256": "53476db4c95635cba0849f88b3273310ef0809efbe986864a7b56a0054183a72", "bytes": 7031 } }, "started_utc": "2026-10-23T16:11:07.756Z", "status": 200, "final_url": "https://itdaily.com/blogs/software/php-angry-clumsy-announcement/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: the Foundation 'caught off guard'; 'aware for two years of at least one vulnerability'; Ecosystem Security Team since May 2026; a VUB professor on the disclosure window.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Foundation angered by ‘clumsy’ disclosure of vulnerabilities - ITdaily\n\nCaptured by claude-story-site. Status: captured. Secondary: the Foundation 'caught off guard'; 'aware for two years of at least one vulnerability'; Ecosystem Security Team since May 2026; a VUB professor on the disclosure window.\n\n- 'In 2024, an audit by Quarkslab found the first signs of the memory issue. At the time, there was no known attack path'. 'the delay was a structural failure'. Quotes Vincent Ginis (VUB) via vrtnws on the public-but-unmitigated window.\n" }, { "slug": "ithome-1-016-980-htm", "url": "https://www.ithome.com/1/016/980.htm", "publisher": "IT之家", "kind": "news", "title": "360安全云发布PHP2Shell应急防护方案，助力政企网站抢修窗口期 - IT之家", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "96ed96501f87024261ed73feb08307622b1f1ea3c56bbc826a57c5973be4318d", "bytes": 480 }, "page.html": { "sha256": "3ca5e75716670afe7395fcfade59df2b0d4d01c682cc6357dda71faad213b432", "bytes": 29303 }, "provenance.json": { "sha256": "2aa57d913ce0b073757f96d79a187c2e73edcd42c0e91b376ed67ba8d4cf83bb", "bytes": 1551 }, "rendered.html": { "sha256": "848001c36ed2ed66193e920a03d05b0414acff8038b6350ba9634bd74a5992e5", "bytes": 49645 }, "screenshot.jpg": { "sha256": "ae9dcb375cfcce508de56f6cdc85d7496871a45c10575cea3376e01f2a10afda", "bytes": 540044 }, "text.txt": { "sha256": "6031329574e60ccca2f5ef8b6105c001e11d921e2e88bbd476ef56902c1220d0", "bytes": 11251 } }, "started_utc": "2026-10-23T16:16:15.941Z", "status": 200, "final_url": "https://www.ithome.com/1/016/980.htm" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-cn", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IT Home (Chinese): 360 Security Cloud released an emergency protection plan for PHP2Shell to help government and enterprise websites during the repair...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 360安全云发布PHP2Shell应急防护方案，助力政企网站抢修窗口期 - IT之家\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/ithome/1-016-980-htm`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIT Home (Chinese): 360 Security Cloud released an emergency protection plan for PHP2Shell to help government and enterprise websites during the repair window. It says that, per W3Techs, about 70.5% of sites with an identifiable server-side language use PHP, that WordPress, Joomla, Drupal and Wikipedia's MediaWiki are PHP-based, and that PHP officially issued a security update on 21 October fixing the two serious flaws. Vendor announcement.\n\n> 据 W3Techs 统计，在可识别服务端语言的网站中，约 70.5% 使用 PHP。\n\n_Curator's translation:_ \"According to W3Techs statistics, among websites whose server-side language can be identified, about 70.5% use PHP.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"360安全云发布PHP2Shell应急防护方案，助力政企网站抢修窗口期 - IT之家\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-cn`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "itsocial-cybersecurite-cybersecurite-articles-php", "url": "https://itsocial.fr/cybersecurite/cybersecurite-articles/php2shell-la-mise-a-jour-ferme-la-faille-mais-oblige-a-traquer-les-compromissions-possibles/", "publisher": "IT Social", "kind": "news", "title": "PHP2Shell, la mise à jour ferme la faille, mais oblige à traquer les compromissions possibles - IT SOCIAL", "published": "2026-10-23T07:58:01+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "dc4fcd9e93f05f21e466beaf11c106f736bd1683dd6027ea697b4cd9f556c476", "bytes": 880 }, "page.html": { "sha256": "7b87fccd00ca774f5357da48c1c26180992bb5f584e6a1b257f38340474fa313", "bytes": 360599 }, "provenance.json": { "sha256": "1475378758653e01c69ddd63ad965d6d1bb1da125c39740623868dc787fa6b81", "bytes": 1919 }, "rendered.html": { "sha256": "b798e757871bfc8f6f9028b0f7a4df92dfbb6fcb1fbf4422745e6d569ce00c15", "bytes": 359599 }, "screenshot.jpg": { "sha256": "ca7d82ca3ed331cf943625541100023f459ff78ed579076fe731751016a73a28", "bytes": 908893 }, "text.txt": { "sha256": "192f86a7b6081dfb7c2813799068d074cef0b3c931f3957262fe715c09001b70", "bytes": 13533 } }, "started_utc": "2026-10-23T16:14:59.716Z", "status": 200, "final_url": "https://itsocial.fr/cybersecurite/cybersecurite-articles/php2shell-la-mise-a-jour-ferme-la-faille-mais-oblige-a-traquer-les-compromissions-possibles/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). IT Social (French), 23 October: the first exploitation attempts came four days before the coordinated disclosure, which shifts a company's response fr...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, la mise à jour ferme la faille, mais oblige à traquer les compromissions possibles - IT SOCIAL\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/itsocial/cybersecurite-cybersecurite-articles-php2shell-la-mise-a-jou`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIT Social (French), 23 October: the first exploitation attempts came four days before the coordinated disclosure, which shifts a company's response from patching to investigating. Applying the 21 October update closes the door without saying whether someone got in meanwhile, so hunting for traces becomes the next step. It lists the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\n\n> Appliquer la mise à jour du 21 octobre ferme la porte sans dire si quelqu’un est entré entre-temps\n\n_Curator's translation:_ \"Applying the 21 October update closes the door without saying whether someone has come in in the meantime\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, la mise à jour ferme la faille, mais oblige à traquer les compromissions possibles - IT SOCIAL\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "itweb-article-php2shell-alarm-a-major-cyber-se", "url": "https://www.itweb.co.za/article/php2shell-alarm-a-major-cyber-security-wake-up-call/WnpNgM21VmP7VrGd", "publisher": "ITWeb", "kind": "news", "title": "PHP2Shell alarm a major cyber security wake-up call | ITWeb", "published": "2026-10-23T13:27:00+02:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "521c2fcfffd785f8a7f6bf54b2be6eee90974cc80cfea0cc58e3e9d7f4efe1aa", "bytes": 724 }, "page.html": { "sha256": "88a432a074182a21c6f9cd1b123d248b5b36bb057a9d144cf44ebd115b005f23", "bytes": 289364 }, "provenance.json": { "sha256": "037e5dabc035e5b2b87a63acc0649f4dee1e9723262911e49822d8ba999dccac", "bytes": 1762 }, "rendered.html": { "sha256": "e1dffabbcf4eb7f6842867d176192a879ab46c554160c3d4a57a251061264ff1", "bytes": 320723 }, "screenshot.jpg": { "sha256": "8a55008b57824b72bbac1036c97e097c56b8fad3cff7b35de229c219290e110d", "bytes": 726058 }, "text.txt": { "sha256": "1fdfcf3735d1e77ac407b63c2a46f51b907cdaa426ace7f70aba86e5210e6ed9", "bytes": 12005 } }, "started_utc": "2026-10-23T23:44:38.410Z", "status": 200, "final_url": "https://www.itweb.co.za/article/php2shell-alarm-a-major-cyber-security-wake-up-call/WnpNgM21VmP7VrGd" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-ZA", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). ITWeb (Johannesburg), 23 October: PHP2Shell alarm a major cyber security wake-up call. Two critical PHP vulnerabilities, in a language powering about...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell alarm a major cyber security wake-up call | ITWeb\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `za/news/itweb/article-php2shell-alarm-a-major-cyber-security-wake-up-call`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nITWeb (Johannesburg), 23 October: PHP2Shell alarm a major cyber security wake-up call. Two critical PHP vulnerabilities, in a language powering about three-quarters of the web, triggered a global alert after details reportedly leaked before the planned disclosure. It relays the BBC's cyber correspondent that researchers had identified a potential flaw in 2024 but could not establish how it could be exploited until AI-assisted research produced a viable attack.\n\n> Two critical vulnerabilities in PHP, a programming language powering about three-quarters of the web, have triggered a global cyber security alert after details of the flaws, dubbed PHP2Shell, reportedly leaked before their planned disclosure and patching.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell alarm a major cyber security wake-up call | ITWeb\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-ZA`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "itwire-business-it-news-security-php2shell-the", "url": "https://itwire.com/business-it-news/security/php2shell-the-14-year-old-bugs-that-pulled-cyber-gov-au-and-government-sites-worldwide-offline", "publisher": "itwire", "kind": "news", "title": "PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline | iTWire", "published": "2026-10-23T06:22:09.021Z", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "0eeeddfae657c2b18f8450c7ee4d54502ddb5697452c121ce4b100c64d851882", "bytes": 1217 }, "page.html": { "sha256": "8ad68c5fa0817aebd8621a311d609c3fbe6323bffae7242d89540655ddfccd2a", "bytes": 89747 }, "provenance.json": { "sha256": "bf1a8855f708bb076589ce458cbcfad84ab6f36e7746e77fee75725cae16b383", "bytes": 1889 }, "rendered.html": { "sha256": "198722ddb7d84ddfe5e51fefd454516beb90ca1132faa997707ca6427a8443b2", "bytes": 95215 }, "screenshot.jpg": { "sha256": "e2ef147959aea6261471e4b18289ad8609f1b0da7037b8161e495fb16d727674", "bytes": 1012633 }, "text.txt": { "sha256": "172a5231d5923072febae5278aaf4bda3a02684c33054b2bd6f6fe8989f480c0", "bytes": 19030 } }, "started_utc": "2026-10-24T16:08:25.425Z", "status": 200, "final_url": "https://itwire.com/business-it-news/security/php2shell-the-14-year-old-bugs-that-pulled-cyber-gov-au-and-government-sites-worldwide-offline" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-AU", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). iTWire (Australia), 23 October: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline. It says Australia's own cyber se...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline | iTWire\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/itwire/business-it-news-security-php2shell-the-14-year-old-bugs-tha`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\niTWire (Australia), 23 October: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline. It says Australia's own cyber security agency took its website offline this week, as did government sites in France, Finland, Denmark and the Netherlands, along with Wikipedia systems, 4chan, Something Awful and the Port of Rotterdam; GovCMS, the Drupal platform behind much of Australia's federal web presence, is named as affected. It quotes W3Techs for PHP's share and watchTowr's founder on the flaws. It also gives a disclosure timeline: the release was meant for 22 October; the CVE numbers leaked online on 20 October and PHP brought its release forward by a day; that evening Calif accidentally published a video of its exploits working against several targets (deleted, but copies spread); at 07:41 UTC on 21 October Chainguard published patched PHP container images more than six hours early, which the PHP Foundation said 'unilaterally broke the embargo'; Chainguard's CEO apologised for the stress on maintainers but defended the call, made 'when exploits hit in the wild'.\n\n> Australia's own cyber security agency took its website offline this week.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline | iTWire\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-AU`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "japan-zdnet-article-35253966", "url": "https://japan.zdnet.com/article/35253966/", "publisher": "ZDNET Japan", "kind": "news", "title": "「PHP2Shell」のリスク低減に向けて直ちに実行すべき手順は - ZDNET Japan", "published": "2026-10-26T12:38:00+09:00", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "bccf53bf421f73d95153618650117acdc5d97c16045a3cef27ce2a6e5281d1a4", "bytes": 932 }, "page.html": { "sha256": "c3b07c455c7ebfe248b54484262cc8c38ea4c5cb421abd721d9e2686f22b3876", "bytes": 108661 }, "provenance.json": { "sha256": "a544b4b96752173ff9b1bc27fb38b37283220f9a362fadbcf0194a49de70ca92", "bytes": 1585 }, "rendered.html": { "sha256": "dd562c4d2e88102202d501bb9a50cd91d27b027067df53de8a6d5274f894c7d9", "bytes": 125866 }, "screenshot.jpg": { "sha256": "551138deb3d32860c542fd4f3eefa72e55726e5361e8d3f7cb3dc4c89b762503", "bytes": 680800 }, "text.txt": { "sha256": "69cd6d8278c13c4014d5cddb43d6338fb0e193acc6501d8d46c750209c584b6f", "bytes": 12038 } }, "started_utc": "2026-10-26T09:48:24.359Z", "status": 200, "final_url": "https://japan.zdnet.com/article/35253966/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ZDNET Japan (Japanese translation of Charlie Osborne's ZDNET piece), 26 October: steps to reduce the risk now. It says the PHP Project has published a...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 「PHP2Shell」のリスク低減に向けて直ちに実行すべき手順は - ZDNET Japan\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/japan-zdnet/article-35253966`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nZDNET Japan (Japanese translation of Charlie Osborne's ZDNET piece), 26 October: steps to reduce the risk now. It says the PHP Project has published an extra measure against an 'unlikely' remote-code-execution path, registered as CVE-2026-115560, in an advisory dated 23 October (US time), which the 21 October release had already listed as a mitigation, and that this path needs unusual configuration and application code, so the project regards the mitigation as sufficient until its normal release cycle. It quotes Wiz that attackers could run code or read sensitive process memory, that the attack chain took an 'extremely complex series of steps' near what humans can realistically achieve, which frontier AI lowered. It says Amazon Threat Intelligence saw attempts four days before disclosure and, hours later, proof-of-concept code, that threat actors in the attack chain are trying to deploy Mirai-family botnets, and that Cloudflare's CEO Matthew Prince says millions of attempts have been logged. The translated text calls the flaw 'P2P2Shell' in two places, a typo in the capture.\n\n> P2P2Shellの攻撃チェーンに関与する脅威アクターは、「Mirai」系のボットネットを展開しようとしている。\n\n_Curator's translation:_ \"Threat actors involved in the 'P2P2Shell' attack chain are trying to deploy 'Mirai'-family botnets.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"「PHP2Shell」のリスク低減に向けて直ちに実行すべき手順は - ZDNET Japan\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "jawapos-teknologi-2610230446-celah-php2shell-anc", "url": "https://www.jawapos.com/teknologi/2610230446/celah-php2shell-ancam-server-peretas-bisa-ambil-alih-sistem-tanpa-login", "publisher": "Jawa Pos", "kind": "news", "title": "Celah PHP2Shell Ancam Server, Peretas Bisa Ambil Alih Sistem Tanpa Login", "published": "2026-10-23T19:33:41+07:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "346c2a44446ea359003944df14704ec17e051fc1b445bddf3d04230fc0fa8aa3", "bytes": 671 }, "page.html": { "sha256": "b7eadea750ad30bf6412311c3de384f05674389ce50ad0bf28d2e3a0e76f7dca", "bytes": 246465 }, "provenance.json": { "sha256": "f46fd0b1e18c9e308aef0df49b5a877072c2add435b273232523a85aeb22f9ca", "bytes": 1815 }, "rendered.html": { "sha256": "f5cf7e4cbe73de23bf5b5031ecf851f369e459815ef0511fb24c36c1831f128a", "bytes": 290351 }, "screenshot.jpg": { "sha256": "10c41738af26768a836605d7b9828eed0fe940cd7d2898bf02294107b171a9cb", "bytes": 352162 }, "text.txt": { "sha256": "2754c8748f2b7f9f29581bbb88cb2c6a26211bcaeb2e2b32d67600fc4407d983", "bytes": 4615 } }, "started_utc": "2026-10-24T13:47:03.272Z", "status": 200, "final_url": "https://www.jawapos.com/teknologi/2610230446/celah-php2shell-ancam-server-peretas-bisa-ambil-alih-sistem-tanpa-login" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Jawa Pos (Indonesian), 23 October: the PHP2Shell flaw threatens servers; hackers can take over a system without logging in. It is a serious threat to...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Celah PHP2Shell Ancam Server, Peretas Bisa Ambil Alih Sistem Tanpa Login\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/jawapos/teknologi-2610230446-celah-php2shell-ancam-server-peretas-bi`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nJawa Pos (Indonesian), 23 October: the PHP2Shell flaw threatens servers; hackers can take over a system without logging in. It is a serious threat to website and server managers because it lets hackers run malicious code remotely without an account or password; it covers vulnerable PHP versions, the RCE risk and mitigation steps.\n\n> Baru-baru ini, ditemukan kalau celah keamanan PHP2Shell menjadi ancaman serius bagi pengelola situs web dan server karena memungkinkan peretas menjalankan kode berbahaya dari jarak jauh tanpa harus memiliki akun atau kata sandi.\n\n_Curator's translation:_ \"Recently it was found that the PHP2Shell security hole is a serious threat to website and server managers because it lets hackers run malicious code remotely without needing an account or password.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Celah PHP2Shell Ancam Server, Peretas Bisa Ambil Alih Sistem Tanpa Login\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "jeuxvideo-news-2110338-une-faille-critique-dans-ph", "url": "https://www.jeuxvideo.com/news/2110338/une-faille-critique-dans-php-fait-trembler-la-moitie-du-web-mondial.htm", "publisher": "JeuxVideo.com", "kind": "news", "title": "Une faille critique dans PHP fait trembler la moitié du web mondial - JVTECH by jeuxvideo.com", "published": "2026-10-23T12:40:08+02:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "151883387ea3cc14358929da7810f392e4db7cd139bb8bcae34f44856e022549", "bytes": 1599 }, "page.html": { "sha256": "9d40e3b2537a7197163e770f3de2e35d7fe22890bec3aa38e247a2d41a988162", "bytes": 77947 }, "provenance.json": { "sha256": "0c95f5670ed3a65458dbc6453e6e113e648dbbd068962b1eb4b0f7b7f61c7585", "bytes": 1831 }, "rendered.html": { "sha256": "43ca263f7f48a6ded278d1cc501025f3af8a69aa0c241d643fb6a72394079f48", "bytes": 328753 }, "screenshot.jpg": { "sha256": "5fa218edab424b7aa204e4235b3d28195372611b5d329b2a0ffe1ccd21eb5aea", "bytes": 724539 }, "text.txt": { "sha256": "c2857e0dbbfe71aa57d9922accfe7900e893fb300499d35f2abfd523ed3fc5e6", "bytes": 14973 } }, "started_utc": "2026-10-23T23:29:21.922Z", "status": 200, "final_url": "https://www.jeuxvideo.com/news/2110338/une-faille-critique-dans-php-fait-trembler-la-moitie-du-web-mondial.htm" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). JVTech by jeuxvideo.com (French), 23 October: a critical PHP flaw makes half the world's web tremble. It says the origin of the serial outages is now...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Une faille critique dans PHP fait trembler la moitié du web mondial - JVTECH by jeuxvideo.com\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/jeuxvideo/news-2110338-une-faille-critique-dans-php-fait-trembler-la-m`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nJVTech by jeuxvideo.com (French), 23 October: a critical PHP flaw makes half the world's web tremble. It says the origin of the serial outages is now known: PHP had to publish emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and the cybersecurity authorities' instruction was simple: update without waiting.\n\n> On connaît désormais l’origine de ces interruptions en série.\n\n_Curator's translation:_ \"We now know the origin of these serial interruptions.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Une faille critique dans PHP fait trembler la moitié du web mondial - JVTECH by jeuxvideo.com\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "jiji-jc-article", "url": "https://www.jiji.com/jc/article?k=000000015.000171490&g=prt", "publisher": "時事ドットコム", "kind": "news", "title": "PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開：時事ドットコム", "published": "2026-10-22T14:46:00+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "3a7c26173c44dadb0ce4f73843adab98336b95bd86166a76b56626852f711df7", "bytes": 359 }, "page.html": { "sha256": "7cfc83a3ba8ba4cb99a51eba1a5ab1551fe215306f52ba4b498c4da39d7a1f73", "bytes": 77436 }, "provenance.json": { "sha256": "632c22765aa964517dcdfef7a14a7941a16b884454c94cadb02ea099448c599c", "bytes": 1579 }, "rendered.html": { "sha256": "4c9088c25ac07d98fa0795f07702225b46ba14c50179343dcc7b31bf8e9bb1d4", "bytes": 89743 }, "text.txt": { "sha256": "5c39d0948e9da32377635406b5acb52c9c6e82dcbe210a724ebf5dd3daafeaab", "bytes": 14731 } }, "started_utc": "2026-10-23T16:19:34.198Z", "status": 200, "final_url": "https://www.jiji.com/jc/article?k=000000015.000171490&g=prt" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Jiji.com (Japanese), a press release of 22 October: the Japanese firm TorchUp made a free white paper available, a checklist for companies that run Wo...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開：時事ドットコム\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/jiji/jc-article`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nJiji.com (Japanese), a press release of 22 October: the Japanese firm TorchUp made a free white paper available, a checklist for companies that run WordPress sites, on the urgent PHP vulnerability php2shell (severity 9.2), with immediate emergency measures and preparation. Vendor release distributed by Jiji; the curator did not copy the executive's name.\n\n> PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開\n\n_Curator's translation:_ \"Urgent PHP vulnerability 'php2shell' of severity 9.2 found; TorchUp releases a free countermeasure checklist for companies running WordPress sites\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開：時事ドットコム\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "jn-pt-sites-desligados", "url": "https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512", "publisher": "jn.pt", "kind": "news", "title": "Erro crítico em PHP obriga desligação de vários sites", "published": null, "captures": [ { "stamp": "20261022T081616Z", "files": { "headers.json": { "sha256": "f37963c01b0139ff38b53cefb27705bfda717ce5793706d747faaa8251270e42", "bytes": 1688 }, "page.html": { "sha256": "7473d16b8275d2fd7f7ed70f9ef63386cb0b64e5594c7dd07bc7f89efc6bab20", "bytes": 223187 }, "provenance.json": { "sha256": "181d49aac38478ace922953fb01e53d6401909aac8bd9a47082cd18e25d965ed", "bytes": 1119 }, "rendered.html": { "sha256": "2bd81ec1cd9612b7e6a085664d7cbd5133934d10fe8502c9368b777ab59d6f1e", "bytes": 295643 }, "screenshot.png": { "sha256": "0790304d2c70e0946039f7f9e21b42041558a80c19bb4048a54356cdcc297b01", "bytes": 929926 }, "text.txt": { "sha256": "d0ab599600817fabee6ab55163b27b2738e2ac00ac5659cd0bac26dfa4eafd2e", "bytes": 4337 } }, "started_utc": "2026-10-22T08:16:16.680Z", "status": 200, "final_url": "https://www.jn.pt/inovacao/artigo/internet-em-alarme-com-erro-detetado-que-obrigou-a-desligar-varios-sites/18139512" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "journalducanada-php2shell-des-serveurs-exposes-a-une-cyb", "url": "https://www.journalducanada.com/php2shell-des-serveurs-exposes-a-une-cybermenace-mondiale-10652-2026/", "publisher": "Journal Du Canada", "kind": "news", "title": "PHP2Shell : des serveurs exposés à une cybermenace mondiale", "published": "2026-10-22T10:25:00+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9b6bd90936afd3c6bf459bd6c7773a384224d895568844ed9b481b5164ac7528", "bytes": 1113 }, "page.html": { "sha256": "0061563c9005736293dda0ce2fb1d521be7e644d6ba14fdbedaca9f35ae414d9", "bytes": 292979 }, "provenance.json": { "sha256": "7935db814ad5eac2198a00773d4c8fd25a8528a753134025ffe6e00a367c9ee7", "bytes": 1799 }, "rendered.html": { "sha256": "e53b1a4006bd5c91eabd459e296b7870942aec4d4d6f1913699fb49aca15058c", "bytes": 577991 }, "screenshot.jpg": { "sha256": "2fbf376f129a803edc83e77d751f9db9393675d79d97313b73fc09230f57d5e4", "bytes": 548264 }, "text.txt": { "sha256": "b1f54b031a82e34ba149916a3182b1c143120b900264ad5cc0dfb9e64c57da1f", "bytes": 6792 } }, "started_utc": "2026-10-23T16:11:54.855Z", "status": 200, "final_url": "https://www.journalducanada.com/php2shell-des-serveurs-exposes-a-une-cybermenace-mondiale-10652-2026/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Journal du Canada (French): PHP2Shell exposes servers to a global cyberthreat. On 21 October several European administrations cut access to their plat...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : des serveurs exposés à une cybermenace mondiale\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/journalducanada/php2shell-des-serveurs-exposes-a-une-cybermenace-mondiale-10`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nJournal du Canada (French): PHP2Shell exposes servers to a global cyberthreat. On 21 October several European administrations cut access to their platforms temporarily before the fixes. In Morocco, the Maghreb Arabe Presse (MAP) site was put into maintenance and Bank Al-Maghrib's site was unavailable.\n\n> Au Maroc, le site de la Maghreb Arabe Presse (MAP) a été placé en maintenance\n\n_Curator's translation:_ \"In Morocco, the Maghreb Arabe Presse (MAP) website was put into maintenance\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : des serveurs exposés à une cybermenace mondiale\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "journalducoin-technologies-php2shell-prefectures-impots-berc", "url": "https://journalducoin.com/technologies/php2shell-prefectures-impots-bercy-sites-coupes-anssi/", "publisher": "Journal Du Coin", "kind": "news", "title": "PHP2Shell : préfectures, impôts, Bercy et Météo-France coupés sur demande de l'ANSSI - Journal du Coin", "published": "2026-10-21T16:21:30+00:00", "captures": [ { "stamp": "20261022T171501Z", "files": { "headers.json": { "sha256": "548212ff886ff3e26dbf1be6a11113740680f437ced5e3352ff1e4dffc8a50e1", "bytes": 831 }, "page.html": { "sha256": "d403208aaab2bfa0dbc4a2873934b14868837429df1440d72ed7d2f7311b86fd", "bytes": 202949 }, "provenance.json": { "sha256": "b22d029fbfb73d857b4d7ddacdb5c35906e80b7366b8e03752acb4afd81bc5cc", "bytes": 1816 }, "rendered.html": { "sha256": "a34e7562e8bc7a71b521f209620af9bf6441b12c7496accf5bc547d1aa50cd36", "bytes": 215834 }, "screenshot.jpg": { "sha256": "8f4cecf99f8f4a4aa2efbc24a71011d299a101f8dbe013400ecccb1ce2a955d6", "bytes": 526874 }, "text.txt": { "sha256": "ca7e51715f8e31ec5e851af199a5f139eed1ae54b1e2449cc52b39e20f7137a5", "bytes": 9675 } }, "started_utc": "2026-10-22T17:16:52.155Z", "status": 200, "final_url": "https://journalducoin.com/technologies/php2shell-prefectures-impots-bercy-sites-coupes-anssi/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T171501Z. 4 new items in fr: Journal du Coin reports that, at ANSSI's request, French prefecture sites, parts of the tax portal, the Economy ministry, Météo-France and Les Echos were cut off on 21 October. It cites the Interior Ministry's statement ", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : préfectures, impôts, Bercy et Météo-France coupés sur demande de l'ANSSI - Journal du Coin\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `be/news/journalducoin/technologies-php2shell-prefectures-impots-bercy-sites-coupes`, snapshot `20261022T171501Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T171501Z/provenance.json`. Publisher: Journal Du Coin. Language: fr. URL: https://journalducoin.com/technologies/php2shell-prefectures-impots-bercy-sites-coupes-anssi/\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nJournal du Coin reports that, at ANSSI's request, French prefecture sites, parts of the tax portal, the Economy ministry, Météo-France and Les Echos were cut off on 21 October. It cites the Interior Ministry's statement to franceinfo and CERT-FR alert CERTFR-2026-ALE-014. It also relays the Reuters factbox on other European takedowns.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/be/news/journalducoin/technologies-php2shell-prefectures-impots-bercy-sites-coupes.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: From mid-afternoon on 21 Oct, the sites of the Paris Préfecture de police and the prefectures of Seine-Saint-Denis, Hauts-de-Seine, Val-de-Marne, Essonne, Gironde, Bouches-du-Rhône and Savoie showed maintenance messages, as did the Economy ministry, Météo-France and Les Echos.\n\n> les sites de la préfecture de police, de la Seine-Saint-Denis, des Hauts-de-Seine, du Val-de-Marne, de l’Essonne, de la Gironde, des Bouches-du-Rhône ou de la Savoie affichent un message de maintenance.\n\n_Watch reader's translation:_ the sites of the Préfecture de police, Seine-Saint-Denis, Hauts-de-Seine, Val-de-Marne, Essonne, Gironde, Bouches-du-Rhône and Savoie display a maintenance message.\n\n**official**: The Interior Ministry told franceinfo that, at ANSSI's request, it put all its websites exposed to the vulnerability into preventive maintenance.\n\n> « à la demande de l’ANSSI, le ministère de l’Intérieur a procédé à la mise en maintenance préventive de l’ensemble de ses sites internet exposés à une vulnérabilité critique de sécurité »\n\n_Watch reader's translation:_ \"at ANSSI's request, the Ministry of the Interior has placed all of its websites exposed to a critical security vulnerability into preventive maintenance\"\n\n**offline**: Some sections of the French tax portal were inaccessible, and Météo-France's warnings site was offline, with alerts moved to social media.\n\n> certaines rubriques du portail des impôts sont inaccessibles. Météo-France, dont le site d’alertes est lui aussi hors ligne, continue de diffuser ses vigilances sur les réseaux sociaux.\n\n_Watch reader's translation:_ some sections of the tax portal are inaccessible. Météo-France, whose warnings site is also offline, continues to issue its alerts on social media.\n\n**agency**: CERT-FR published alert CERTFR-2026-ALE-014 on the two CVEs.\n\n> Le CERT-FR, bras opérationnel de l’agence, a publié dans la journée l’alerte CERTFR-2026-ALE-014\n\n_Watch reader's translation:_ CERT-FR, the agency's operational arm, published alert CERTFR-2026-ALE-014 during the day\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 4 new items in fr: Journal du Coin reports that, at ANSSI's request, French prefecture sites, parts of the tax portal, the Economy ministry, Météo-France and Les Echos were cut off on 21 October. It cites the Interior Ministry's statement \n\nSupports: translations/be/news/journalducoin/technologies-php2shell-prefectures-impots-bercy-sites-coupes.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "jpcert-at260033", "url": "https://www.jpcert.or.jp/at/2026/at260033.html", "publisher": "JPCERT/CC (Japan)", "kind": "advisory", "title": "PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (JPCERT-AT-2026-0033)", "published": "2026-10-22", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "cbc1e287bde3882e41d91bfa7315dcbaccf9a996c0a383acc62f9095fbe921eb", "bytes": 605 }, "page.html": { "sha256": "85db7a09e865158643525fef5aa5cfc69513aaf896fcb2da4562189d43decf44", "bytes": 31008 }, "provenance.json": { "sha256": "4ba4d01fa5ebe5235184ed530cedbac6cd8985446a10845775da38efa45aa5b9", "bytes": 1013 }, "rendered.html": { "sha256": "c4ba52d8393f4189aade005389d1b8c2923eeb29f0d917a7221b5330cff3bf91", "bytes": 30690 }, "screenshot.png": { "sha256": "99789e60674ab7b0d3f01afbc2012337348a1434417d4820d6c89133f2d6ff64", "bytes": 722717 }, "text.txt": { "sha256": "1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5", "bytes": 8327 } }, "started_utc": "2026-10-22T08:17:00.449Z", "status": 200, "final_url": "https://www.jpcert.or.jp/at/2026/at260033.html" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "JPCERT-AT-2026-0033, published 2026-10-22, updated 2026-10-22 (wording fix in section V). Advice: apply fixed versions promptly 'after sufficient testing' and investigate for compromise. No offline advice. Says PHP is widely used in Japan. JVN entry also listed 2026-10-22 14:20 JST.", "raw_sha256": {}, "has_notes": true, "notes_md": "# JPCERT/CC alert JPCERT-AT-2026-0033\n\n- \"2026-10-22（公開）\"; \"2026-10-22（更新）\". Revision log: \"2026-10-22 「V. 侵害調査」の一部の表現を修正\" (a wording fix in the compromise-investigation section). Captured 2026-10-22T08:17:00Z. The JPCERT home page (`jpcert-home`) also lists a JVN entry at \"2026-10-22 14:20\" JST (=05:20Z).\n- Advice (JA, verbatim): \"速やかに対策の適用および侵害有無の調査を実施してください\" (apply countermeasures promptly and investigate whether you have been compromised). Also: \"十分なテストを実施の上、速やかに修正済みバージョンを適用してください\" (after sufficient testing, apply the fixed version promptly). Upgrade from 8.1 and older is recommended.\n- No offline advice. JPCERT also warns that there are several exploit paths, so one detection rule may miss attacks, and a lack of traces does not prove no compromise.\n" }, { "slug": "jpcert-home", "url": "https://www.jpcert.or.jp/", "publisher": "JPCERT/CC", "kind": "government", "title": "JPCERT home", "published": null, "captures": [ { "stamp": "20261022T081606Z", "files": { "headers.json": { "sha256": "ffa0d53fc7fd1c2d4339dd045991caa54d31c4515face33fcad2b50bfbfdb00f", "bytes": 605 }, "page.html": { "sha256": "07612f480101608a837f0a0dfff30db2d1f5091eabb55fe048bf6546979e25f7", "bytes": 31630 }, "provenance.json": { "sha256": "deeeef14fce691e60314064b4efa728667689e9676e5263b880005c0cdcc5ca3", "bytes": 917 }, "rendered.html": { "sha256": "b41d0ff975f9a0815c4626b027f239c76e939b2070f0e7221fdeef67c9615d21", "bytes": 32010 }, "screenshot.png": { "sha256": "0870f642b705aeed4116685bb2897f814fff8eb758a665a969b80be60f36dc81", "bytes": 1483609 }, "text.txt": { "sha256": "0e3188607f06a768281c4dd19a88acecbe0e7fe6b5c20a312e9095a2a498dfba", "bytes": 6293 } }, "started_utc": "2026-10-22T08:16:06.057Z", "status": 200, "final_url": "https://www.jpcert.or.jp/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Home page at 08:16Z: the PHP alert (2026-10-22) and a JVN item at 2026-10-22 14:20.", "raw_sha256": {}, "has_notes": true, "notes_md": "# JPCERT home\n\nCaptured 08:16Z for context. It lists the PHP 注意喚起 dated 2026-10-22 and a JVN vulnerability note at 2026-10-22 14:20 JST.\n" }, { "slug": "kathmandupost-science-technology-2026-10-25-php2shell", "url": "https://kathmandupost.com/science-technology/2026/10/25/php2shell-security-flaw-forces-thousands-of-nepali-websites-offline", "publisher": "The Kathmandu Post", "kind": "news", "title": "PHP2Shell security flaw forces thousands of Nepali websites offline", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "7506560d25e320827ba16b5cb46e7a32de2f0f41f0f052334d4cb9cea459599d", "bytes": 1191 }, "page.html": { "sha256": "d9b63ae1d3d45f780d5599d10ce1beef57c3d4ee2e1892de3dd13ae31d1a8614", "bytes": 72783 }, "provenance.json": { "sha256": "2e7a756110d5e11b8e5843ecc284ae16dffd50495643b9d41164a693ba90e419", "bytes": 1841 }, "rendered.html": { "sha256": "1819d744256c53be3890eca8589b436bfa9cba48dd3d17d62882ff0283495b98", "bytes": 248007 }, "screenshot.jpg": { "sha256": "5dcd532e293ed5b16bdd764c43f6dba745e32891a2b53fce0db79079f643ef44", "bytes": 684896 }, "text.txt": { "sha256": "b8a541ead3bd8295625877c330bbc21a09e8eb6f77fd70c94881d1c06b38e32e", "bytes": 12495 } }, "started_utc": "2026-10-25T09:52:37.416Z", "status": 200, "final_url": "https://kathmandupost.com/science-technology/2026/10/25/php2shell-security-flaw-forces-thousands-of-nepali-websites-offline" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). The Kathmandu Post, 25 October: PHP2Shell forced thousands of Nepali websites offline. The PHP Foundation disclosed the two flaws on the evening of 21...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell security flaw forces thousands of Nepali websites offline\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `my/news/kathmandupost/science-technology-2026-10-25-php2shell-security-flaw-forces`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Kathmandu Post, 25 October: PHP2Shell forced thousands of Nepali websites offline. The PHP Foundation disclosed the two flaws on the evening of 21 October; a Nepali official explains that distributing and activating an update across servers, cloud systems and user environments can take from a few hours to a week, which slowed the restoration of sites taken offline as a precaution; a centre patched its website on the night of 21 October and brought it back, other systems such as non-PHP mail servers were restored the next day and the rest were being audited; installing the patch alone is not enough on older systems, and some legacy source code had not been audited.\n\n> On the evening of October 21, the PHP Foundation disclosed two security vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell security flaw forces thousands of Nepali websites offline\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "khabaragency-news254841-html", "url": "https://www.khabaragency.net/news254841.html", "publisher": "وكالة خبر للأنباء", "kind": "news", "title": "ثغرات PHP2Shell: تهديد أمني حرج يضرب خوادم الإنترنت | وكالة خبر للأنباء", "published": "2026-10-25T19:48:05+03:00", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "68906a7462e0330e41a7586831ef1b2877247ac1924b96cd319d5f6b6485221b", "bytes": 1934 }, "page.html": { "sha256": "2de3a4b141834cd746d37c9d633fe92fdb710547295880ea049557fd5911892b", "bytes": 72381 }, "provenance.json": { "sha256": "638d372a4dbb4aed3a663211385241f319a525c73a876c71df29be03de2ebcbb", "bytes": 1619 }, "rendered.html": { "sha256": "376e0f5c71a19cd719b939ba252bfd76cb06994af8d74bcf886f180f41c7fe89", "bytes": 78135 }, "screenshot.jpg": { "sha256": "d5dde4fff2c6fa5fc1b19355eb3ca3df94c052644c8a41e257d9f95f68fa74ab", "bytes": 288667 }, "text.txt": { "sha256": "def674a40a74cf63a767c2f4365791ce5f6ea0bb483b90cb303c0aaa9f542cea", "bytes": 6409 } }, "started_utc": "2026-10-26T10:00:49.620Z", "status": 200, "final_url": "https://www.khabaragency.net/news254841.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Khabar Agency (Yemen, Arabic), 25 October, an agency-wire style explainer: two critical flaws in PHP let attackers run commands on servers remotely wi...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثغرات PHP2Shell: تهديد أمني حرج يضرب خوادم الإنترنت | وكالة خبر للأنباء\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sa/news/khabaragency/news254841-html`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nKhabar Agency (Yemen, Arabic), 25 October, an agency-wire style explainer: two critical flaws in PHP let attackers run commands on servers remotely without credentials; PHP issued urgent updates (including 8.5.12 and 8.4.27) rated 9.2 out of 10; reports say attempts to exploit them were seen even before the official announcement; and administrators should also review server logs, especially as additional flaws such as CVE-2026-115560 appeared that need careful settings. Ordinary users face no direct risk from browsing. No source is named for any figure.\n\n> أثار اكتشاف ثغرتين أمنيتين حرجتين في لغة البرمجة الشهيرة PHP مخاوف واسعة بشأن أمن المواقع الإلكترونية\n\n_Curator's translation:_ \"The discovery of two critical security vulnerabilities in the popular PHP programming language has raised wide concern about website security.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثغرات PHP2Shell: تهديد أمني حرج يضرب خوادم الإنترنت | وكالة خبر للأنباء\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "knews-news-7898c3112ba7f79b25f7a44622d2e7d4", "url": "https://www.knews.com.tw/news/7898C3112BA7F79B25F7A44622D2E7D4", "publisher": "知新聞", "kind": "news", "title": "PHP2Shell出現第3個漏洞　但因這原因不急著修補｜知新聞", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T120459Z", "files": { "headers.json": { "sha256": "4d1975d8440f2dcb627e4f39bd7703a8cfb6bb9f4ef826d3a8b469720dc22307", "bytes": 494 }, "page.html": { "sha256": "5caeeebf27ab7a74907faedabcf7d1eba266f3ef37d772ac9c58c9cdf395c0b9", "bytes": 200730 }, "provenance.json": { "sha256": "f9dcd74aab18e5357578bef73b468c79c59fd06bfb03635cfb78a19011f617ca", "bytes": 1653 }, "rendered.html": { "sha256": "86e809c3918fec1b4af3adfbe59f1bc09c85286bf874b704291722dfe2ca1f41", "bytes": 232835 }, "screenshot.jpg": { "sha256": "6974ed051c68c3873d7b0731d6c18be8461de8cac48dc6e8a36ad653c8461f78", "bytes": 634998 }, "text.txt": { "sha256": "d0f203fc01e344c26f21afe667ef61034b636d88bfab7b1071c24ada428c1879", "bytes": 8819 } }, "started_utc": "2026-10-25T12:27:07.162Z", "status": 200, "final_url": "https://www.knews.com.tw/news/7898C3112BA7F79B25F7A44622D2E7D4" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-TW", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Knews (Traditional Chinese): PHP2Shell has a third vulnerability, but it is not being rushed. A compilation from foreign news: bad things come in thre...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell出現第3個漏洞　但因這原因不急著修補｜知新聞\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tw/news/knews/news-7898c3112ba7f79b25f7a44622d2e7d4`, snapshot `20261025T120459Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T120459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nKnews (Traditional Chinese): PHP2Shell has a third vulnerability, but it is not being rushed. A compilation from foreign news: bad things come in threes; PHP2Shell has a third flaw, which will not be patched urgently. This is the report of the CVE-2026-115560 disclosure; the captured text is short.\n\n> PHP2Shell出現第3個漏洞，但不會緊急修補。\n\n_Curator's translation:_ \"PHP2Shell has a third vulnerability, but it will not be patched urgently.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell出現第3個漏洞　但因這原因不急著修補｜知新聞\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-TW`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "kocpc-archives-700486", "url": "https://www.kocpc.com.tw/archives/700486", "publisher": "電腦王阿達", "kind": "news", "title": "PHP2Shell漏洞來勢洶洶！趨勢科技TrendLife推「PHP漏洞急救包」將威脅擋在網站前 - 電腦王阿達", "published": "2026-10-24T00:53:04+08:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "62cd165c0e77bcdd169f340f3eaca496613b2628341f093374833a525ca697f6", "bytes": 394 }, "page.html": { "sha256": "50c7f2792395d3cd876b19b3806436c029fb8e968e3c5c8194d4d85f3f2cabdc", "bytes": 294200 }, "provenance.json": { "sha256": "4c9e3e55bddc52fc6eb16eeabac9d34d46873777828582c15ff1a747b95916d6", "bytes": 1591 }, "rendered.html": { "sha256": "ba2205c388a2a7b1120f8791ab426fd7d19d80a69d66d97fd540209294526cb3", "bytes": 707460 }, "screenshot.jpg": { "sha256": "50025c1ab6c0284407b3fc4e2752a5cb0995620b26f5bbac711924a4009edb27", "bytes": 488321 }, "text.txt": { "sha256": "4117951cf369b94d81741e8ac73eedf95a3dc8bf6b9360deb9c9478fb59a0fc4", "bytes": 7602 } }, "started_utc": "2026-10-24T13:58:20.443Z", "status": 200, "final_url": "https://www.kocpc.com.tw/archives/700486" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-TW", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Kocpc / Computer King Ada (Traditional Chinese), 24 October: Trend Micro's TrendLife launches a 'PHP vulnerability first-aid kit' to block the threat...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell漏洞來勢洶洶！趨勢科技TrendLife推「PHP漏洞急救包」將威脅擋在網站前 - 電腦王阿達\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tw/news/kocpc/archives-700486`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nKocpc / Computer King Ada (Traditional Chinese), 24 October: Trend Micro's TrendLife launches a 'PHP vulnerability first-aid kit' to block the threat in front of websites. It says almost all PHP sites were hit by the PHP2Shell flaws, taking many government and large-company sites offline, and that the PHP team released four versions at once the day after the news broke, fixing CVE-2026-109618 and CVE-2026-109619, although some small businesses may struggle even to update PHP. A vendor product announcement.\n\n> PHP2Shell漏洞來勢洶洶！趨勢科技TrendLife推「PHP漏洞急救包」將威脅擋在網站前\n\n_Curator's translation:_ \"The PHP2Shell vulnerability comes on strong! Trend Micro TrendLife launches a 'PHP vulnerability first-aid kit' to block the threat before the website\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell漏洞來勢洶洶！趨勢科技TrendLife推「PHP漏洞急救包」將威脅擋在網站前 - 電腦王阿達\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-TW`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "koran-jakarta-2026-10-22-upaya-global-perbaiki-celah-keamana", "url": "https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang", "publisher": "Koran Jakarta ®", "kind": "news", "title": "Upaya Global Perbaiki Celah Keamanan Siber PHP, dari Amazon hingga Kementerian Jepang", "published": null, "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "9766db410658d31c0e988a0716096bfaf3c67ca7d4ea2d25e2e1b720f2560ea7", "bytes": 1641 }, "page.html": { "sha256": "213c59ab19f11c47162fa098d33aad2f9718ed4f8c44cf3b35c218b6111f30cf", "bytes": 359208 }, "provenance.json": { "sha256": "8fe27bd61bbf013f723fc63def6e6f9c351768d464a79fb81ba8b7718656de09", "bytes": 1862 }, "rendered.html": { "sha256": "ed53485564de5f215f4ce3b8076dc529fe9bc575ae2a7836685f7c95575883ed", "bytes": 427173 }, "screenshot.jpg": { "sha256": "69d5c1a1ca7c639ee0fa500448849ef25b036a55ebb315f535036025594063ca", "bytes": 569373 }, "text.txt": { "sha256": "f5c3e92816a8aaf3d21543436c76aa52fac6863eada37a37eb37b0618a5f987d", "bytes": 8548 } }, "started_utc": "2026-10-22T18:23:23.642Z", "status": 200, "final_url": "https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in id: Koran Jakarta round-up from BBC and Kyodo. A photo caption shows the Keihan Holdings website suspended. Danish IT firm Kombit closed services including the national school platform. Several Japanese ministry pages, inclu", "raw_sha256": {}, "has_notes": true, "notes_md": "# Upaya Global Perbaiki Celah Keamanan Siber PHP, dari Amazon hingga Kementerian Jepang\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `id/news/koran-jakarta/2026-10-22-upaya-global-perbaiki-celah-keamanan-siber-php-da`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: Koran Jakarta ®. Language: id. URL: https://koran-jakarta.com/2026-10-22/upaya-global-perbaiki-celah-keamanan-siber-php-dari-amazon-hingga-kementerian-jepang\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nKoran Jakarta round-up from BBC and Kyodo. A photo caption shows the Keihan Holdings website suspended. Danish IT firm Kombit closed services including the national school platform. Several Japanese ministry pages, including Finance and Health/Labour, were partly suspended, and Chief Cabinet Secretary Kihara reported no damage.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/id/news/koran-jakarta/2026-10-22-upaya-global-perbaiki-celah-keamanan-siber-php-da.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: Japanese company Keihan Holdings temporarily suspended its website on 21 Oct (photo caption).\n\n> situs web perusahaan Jepang Keihan Holding Co. untuk sementara ditangguhkan\n\n_Watch reader's translation:_ the website of Japanese company Keihan Holding Co. was temporarily suspended\n\n**offline**: Japan's Ministry of Finance and Ministry of Health, Labour and Welfare partly suspended web pages as a precaution (citing Kyodo).\n\n> Penangguhan tersebut termasuk untuk Kementerian Keuangan dan Kementerian Kesehatan, Tenaga Kerja, dan Kesejahteraan.\n\n_Watch reader's translation:_ The suspensions included the Ministry of Finance and the Ministry of Health, Labour and Welfare.\n\n**official**: Chief Cabinet Secretary Minoru Kihara said no damage to government websites linked to the PHP flaw had been reported.\n\n> tidak ada kerusakan pada situs web pemerintah yang terkait dengan celah keamanan PHP yang dilaporkan\n\n_Watch reader's translation:_ no damage to government websites related to the PHP security flaw has been reported\n\n**offline**: Danish IT company Kombit shut several services, including the national school communication platform.\n\n> Perusahaan IT Denmark, Kombit, menutup sejumlah layanan, termasuk platform komunikasi sekolah nasional.\n\n_Watch reader's translation:_ Danish IT company Kombit shut down several services, including the national school communication platform.\n\n**number**: An expert told the BBC that about 30 million websites could be affected.\n\n> Masalah ini dapat mempengaruhi sekitar 30 juta situs web\n\n_Watch reader's translation:_ This problem could affect around 30 million websites\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in id: Koran Jakarta round-up from BBC and Kyodo. A photo caption shows the Keihan Holdings website suspended. Danish IT firm Kombit closed services including the national school platform. Several Japanese ministry pages, inclu\n\nSupports: translations/id/news/koran-jakarta/2026-10-22-upaya-global-perbaiki-celah-keamanan-siber-php-da.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "kursors-2026-10-21-atklatas-kritiskas-ievainojam", "url": "https://kursors.lv/2026/10/21/atklatas-kritiskas-ievainojamibas-php-programmesanas-valoda-un-tas-skar-lielako-dalu-publisko-timekla-vietnu/", "publisher": "kursors", "kind": "news", "title": "Atklātas kritiskas ievainojamības “PHP” programmēšanas valodā un tas skar lielāko daļu publisko tīmekļa vietņu | Kursors.lv", "published": "2026-10-21T15:00:00+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "7c7da5a0ed2ef1b6dacef0a8fcd2960d7bb70786d81386239c57b4345b7d61fc", "bytes": 1307 }, "page.html": { "sha256": "902472dfe5c955e45e9c22f6abc99f94caf358290ce933879bdf59768f4d0e46", "bytes": 749033 }, "provenance.json": { "sha256": "daa3bb0132927e330cf6b92a190c101cb7ec759ad3fd3c4ce6278adfbdb3dea8", "bytes": 1928 }, "rendered.html": { "sha256": "b6b37cbc1672e566ceb489509b2a745d18d76b0edbb7fd5625af8abf6102b976", "bytes": 740425 }, "screenshot.jpg": { "sha256": "7bef0479e261a47a37490d20a6b0d0b8d8730325442b18c422c3c593b7410fd2", "bytes": 413672 }, "text.txt": { "sha256": "d3537127f9f0e750383fb12abf7d470004d43c951574a9fec666743a4f95f4ec", "bytes": 6929 } }, "started_utc": "2026-10-23T16:22:28.654Z", "status": 200, "final_url": "https://kursors.lv/2026/10/21/atklatas-kritiskas-ievainojamibas-php-programmesanas-valoda-un-tas-skar-lielako-dalu-publisko-timekla-vietnu/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Kursors.lv (Latvian), 21 October: critical vulnerabilities found in PHP affecting most public websites. Two critical remote code execution vulnerabili...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Atklātas kritiskas ievainojamības “PHP” programmēšanas valodā un tas skar lielāko daļu publisko tīmekļa vietņu | Kursors.lv\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `lv/news/kursors/2026-10-21-atklatas-kritiskas-ievainojamibas-php-programmesa`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nKursors.lv (Latvian), 21 October: critical vulnerabilities found in PHP affecting most public websites. Two critical remote code execution vulnerabilities, codenamed php2shell, whose information first leaked on social networks and was later confirmed by independent researchers and PHP itself; its description of the affected component comes from an early write-up by the vendor Zafran, and the curator did not copy it.\n\n> Kiberdrošības jomā izcēlusies nopietna trauksme – atklātas divas kritiskas attālinātas koda izpildes (RCE) ievainojamības programmēšanas valodā PHP, kurām piešķirts apzīmējums “php2shell”.\n\n_Curator's translation:_ \"A serious alarm has arisen in cybersecurity: two critical remote code execution (RCE) vulnerabilities have been discovered in the PHP programming language, designated 'php2shell'.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Kursors.lv (Latvia) explains php2shell based on a Zafran write-up, saying the leak started on social media and affects versions back to PHP 5. It cites public data of about 1.5 million servers with exposed PHP, more than half on PHP 8.1 or older.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Atklātas kritiskas ievainojamības “PHP” programmēšanas valodā un tas skar lielāko daļu publisko tīmekļa vietņu | Kursors.lv\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lalibre-economie-digital-2026-10-21-une-faille-critique-mena", "url": "https://www.lalibre.be/economie/digital/2026/10/21/une-faille-critique-menace-des-milliers-de-sites-internet-plusieurs-plateformes-belges-concernees-Q3XDVDBQEJGXLJMEVDSHWNRQHU/", "publisher": "La Libre.be", "kind": "news", "title": "Une faille critique menace des milliers de sites internet : plusieurs plateformes belges concernées, un correctif publié - La Libre", "published": null, "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "7def206a8427e76a9a77b82ecc63f8856f763f90db0c5deaeb192b11faef8291", "bytes": 1112 }, "page.html": { "sha256": "0ebcecda232383168fe35812770704692fc72c1147d2ad701401ce7782b0be9b", "bytes": 699483 }, "provenance.json": { "sha256": "61e4d3306274d69bf7d8ed83a79b8e460269884a1480f881a3704ac7b3ad4c2f", "bytes": 2008 }, "rendered.html": { "sha256": "b0d149422f2695bb5599c0e0816ace3df42630195015c7dc8d39f5d3c74e8df9", "bytes": 859999 }, "screenshot.jpg": { "sha256": "e3e73da31b8e6317627b63188ba51038f7dceb0d37fc52fe3abb7087f8552c46", "bytes": 285740 }, "text.txt": { "sha256": "49a06a7962f4ad397daaf732e939f6d92d6cd72aef024115b5e9f7c5c58eeca1", "bytes": 8410 } }, "started_utc": "2026-10-22T18:18:19.963Z", "status": 200, "final_url": "https://www.lalibre.be/economie/digital/2026/10/21/une-faille-critique-menace-des-milliers-de-sites-internet-plusieurs-plateformes-belges-concernees-Q3XDVDBQEJGXLJMEVDSHWNRQHU/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in fr: La Libre lists Belgian platforms taken offline: Flemish Region sites (on Minister-President Matthias Diependaele's order), the Flemish Parliament, FPS Finance informational sites, DPG Media and Roularta titles, Smartscho", "raw_sha256": {}, "has_notes": true, "notes_md": "# Une faille critique menace des milliers de sites internet : plusieurs plateformes belges concernées, un correctif publié - La Libre\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `be/news/lalibre/economie-digital-2026-10-21-une-faille-critique-menace-des-m`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: La Libre.be. Language: fr. URL: https://www.lalibre.be/economie/digital/2026/10/21/une-faille-critique-menace-des-milliers-de-sites-internet-plusieurs-plateformes-belges-concernees-Q3XDVDBQEJGXLJMEVDSHWNRQHU/\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nLa Libre lists Belgian platforms taken offline: Flemish Region sites (on Minister-President Matthias Diependaele's order), the Flemish Parliament, FPS Finance informational sites, DPG Media and Roularta titles, Smartschool, Antwerp hospitals, VRT and the CCB's own site. It also reports that Schiphol suspended its app and the Port of Rotterdam took its portal offline.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/be/news/lalibre/economie-digital-2026-10-21-une-faille-critique-menace-des-m.json`), not the publisher's and not checked word for word by the curator.\n\n**official**: Flemish Minister-President Matthias Diependaele had the Flemish Region's official PHP-based websites taken offline; the Flemish Parliament portal was also offline.\n\n> c'est notamment le cas des sites web officiels de la Région flamande fonctionnant sous PHP, comme l'a demandé le ministre-président Matthias Diependaele.\n\n_Watch reader's translation:_ this is notably the case for the Flemish Region's official websites running on PHP, as requested by Minister-President Matthias Diependaele.\n\n**offline**: FPS Finance's informational sites (finances.belgium.be, ruling.be, garantiefonds, geregistreerdkassasysteem.be) were temporarily unavailable; MyMinfin, not built on PHP, stayed up.\n\n> Les sites informatifs du SPF Finances sont également désormais et temporairement indisponibles (finances.belgium.be, ruling.be, garantiefonds, geregistreerdkassasysteem.be). My Minfin, qui ne fonctionne pas sur cette technologie, reste accessible.\n\n_Watch reader's translation:_ FPS Finance's informational sites are also now temporarily unavailable (finances.belgium.be, ruling.be, garantiefonds, geregistreerdkassasysteem.be). My Minfin, which does not run on this technology, remains accessible.\n\n**offline**: Roularta's magazine websites (Le Vif, Trends Tendances, Flair, Femmes d'aujourd'hui) were temporarily offline.\n\n> Les sites web des magazines de l'éditeur Roularta (Le Vif, Trends Tendances, Flair, Femmes d'aujourd'hui, etc.) étaient également temporairement hors ligne.\n\n_Watch reader's translation:_ The websites of publisher Roularta's magazines (Le Vif, Trends Tendances, Flair, Femmes d'aujourd'hui, etc.) were also temporarily offline.\n\n**offline**: Smartschool, Antwerp hospital websites and broadcaster VRT's site were inaccessible on Wednesday.\n\n> La plateforme pédagogique Smartschool était, elle aussi, inaccessible mercredi, pour les mêmes raisons, tout comme les sites internet d'hôpitaux anversois ou celui de la VRT.\n\n_Watch reader's translation:_ The Smartschool education platform was also inaccessible on Wednesday for the same reasons, as were Antwerp hospital websites and VRT's.\n\n**offline**: The Centre for Cybersecurity Belgium's own website was offline because of the flaw; the CCB advised those unable to patch to go offline.\n\n> Le site internet du CCB lui-même est hors ligne en raison de cette faille de sécurité.\n\n_Watch reader's translation:_ The CCB's own website is offline because of this security flaw.\n\n**offline**: Amsterdam Schiphol suspended its mobile app as a precaution, and the Port of Rotterdam Authority took its web portal offline with no operational impact.\n\n> l'aéroport d'Amsterdam Schiphol a temporairement suspendu son application mobile en raison de cette faille. Son site web reste en revanche accessible pour l'instant. L'Autorité portuaire de Rotterdam a temporairement mis son portail internet hors ligne\n\n_Watch reader's translation:_ Amsterdam Schiphol airport temporarily suspended its mobile app because of this flaw. Its website, however, remains accessible for now. The Port of Rotterdam Authority temporarily took its web portal offline\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 6 new items in fr: La Libre lists Belgian platforms taken offline: Flemish Region sites (on Minister-President Matthias Diependaele's order), the Flemish Parliament, FPS Finance informational sites, DPG Media and Roularta titles, Smartscho\n\nSupports: translations/be/news/lalibre/economie-digital-2026-10-21-une-faille-critique-menace-des-m.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "lampost-teknologi-celah-php2shell-ancam-website", "url": "https://lampost.co/teknologi/celah-php2shell-ancam-website/", "publisher": "LAMPOST.CO", "kind": "news", "title": "Celah PHP2Shell Ancam Website, Pengelola Wajib Waspada", "published": "2026-10-23T10:59:00+07:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "ab145f320367ec1070bda11dea36b4cfe3bd0f3f8708dba9b0add8d4a0dc0190", "bytes": 742 }, "page.html": { "sha256": "ec31fb32e02215dc1010bd590f25e05f5001139941d6b991ff14d7b808283003", "bytes": 61494 }, "provenance.json": { "sha256": "88a31d9a3626af863af563f3ecbf579dfbf4166fc8e65d8a777c0e057d86e946", "bytes": 1639 }, "rendered.html": { "sha256": "6de9dd269ef67db567de3ef7259fc81c5cd9f98c9f36d267a7b72318cf117217", "bytes": 847790 }, "screenshot.jpg": { "sha256": "ef8492581922c119897f357d841a09b4afa6c133a52038f6d7978cf19d9ffa2e", "bytes": 714490 }, "text.txt": { "sha256": "f92f07ed7bfdde52c620728b8dc214ec3bef74dee3c8ed5578ff2b7af45f02ad", "bytes": 8115 } }, "started_utc": "2026-10-23T23:34:08.214Z", "status": 200, "final_url": "https://lampost.co/teknologi/celah-php2shell-ancam-website" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Lampost (Indonesian), 23 October: the PHP2Shell hole is a warning to site managers not to ignore server security updates. Two critical PHP vulnerabili...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Celah PHP2Shell Ancam Website, Pengelola Wajib Waspada\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/lampost/teknologi-celah-php2shell-ancam-website`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLampost (Indonesian), 23 October: the PHP2Shell hole is a warning to site managers not to ignore server security updates. Two critical PHP vulnerabilities could let an attacker run code remotely without logging in to a user account first.\n\n> Dua kerentanan kritis pada PHP berpotensi membuka jalan bagi penyerang untuk menjalankan kode dari jarak jauh tanpa harus masuk melalui akun pengguna terlebih dahulu.\n\n_Curator's translation:_ \"Two critical vulnerabilities in PHP could open the way for attackers to run code remotely without first having to log in through a user account.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Celah PHP2Shell Ancam Website, Pengelola Wajib Waspada\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "larazon-tecnologia-consumo-php-nuevo-fallo-segur", "url": "https://www.larazon.es/tecnologia-consumo/php-nuevo-fallo-seguridad-sin-parche-ataques-cloudflare-amazon_202610236adb95e23eef771e1ac4e56e.html", "publisher": "La Razón", "kind": "news", "title": "PHP descubre otro fallo de seguridad sin parche apenas dos días después de una actualización urgente: Cloudflare y Amazon ya detectan ataques contra los anteriores", "published": "2026-10-23T17:15:49+00:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "8abfc8b45f8c988e4e5c754e734e6bf24116938bbd0eb9a9cae069a55d473b3d", "bytes": 838 }, "page.html": { "sha256": "2d01c16a6491b0c53f79c2c973626d6cf19018aa46b5231a69faed969fdce005", "bytes": 615549 }, "provenance.json": { "sha256": "92a7e948802c1f2415a5b318c4e9d21819a6617f35e70b602a9506a0cae39fcf", "bytes": 1961 }, "rendered.html": { "sha256": "27954200233f94acd5657e9978c5116f70f744c98343a47b4805ebc3c2ecd095", "bytes": 735115 }, "screenshot.jpg": { "sha256": "7155c825d9a124af886162f0f337664c90c3c885cf2fd9bd99c83dd64d0a7750", "bytes": 573348 }, "text.txt": { "sha256": "21b72816e736ca309b04551b94e2e98a6bb02d5619415a05d7e31db3c15ee71e", "bytes": 8515 } }, "started_utc": "2026-10-24T08:46:35.957Z", "status": 200, "final_url": "https://www.larazon.es/tecnologia-consumo/php-nuevo-fallo-seguridad-sin-parche-ataques-cloudflare-amazon_202610236adb95e23eef771e1ac4e56e.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). La Razon (Spanish), 23 October: PHP discovers another security flaw without a patch just two days after an urgent update; Cloudflare and Amazon alread...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP descubre otro fallo de seguridad sin parche apenas dos días después de una actualización urgente: Cloudflare y Amazon ya detectan ataques contra los anteriores\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/larazon/tecnologia-consumo-php-nuevo-fallo-seguridad-sin-parche-ataq`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLa Razon (Spanish), 23 October: PHP discovers another security flaw without a patch just two days after an urgent update; Cloudflare and Amazon already detect attacks on the earlier ones. Attacks on PHP2Shell are counted in the millions; PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were published on Wednesday; and although the attempts are real, no successful code execution has yet been demonstrated in the investigations cited.\n\n> Eso sí, aunque los intentos son reales, todavía no se han acreditado ejecuciones de código satisfactorias en las investigaciones citadas.\n\n_Curator's translation:_ \"However, although the attempts are real, no successful code executions have yet been established in the investigations cited.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP descubre otro fallo de seguridad sin parche apenas dos días después de una actualización urgente: Cloudflare y Amazon ya detectan ataques contra los anterio\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "latercera-tecnologia-noticia-php2shell-ia-falla-de", "url": "https://www.latercera.com/tecnologia/noticia/php2shell-ia-falla-de-seguridad/", "publisher": "La Tercera", "kind": "news", "title": "PHP2Shell: una IA descubre una falla de seguridad que amenaza a millones de sitios web en todo el mundo - La Tercera", "published": "2026-10-21T15:37:12.933Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "8f65f544f9b6365c2c5d30064623650e43391199ab82d3b7fb2f344d6ab24018", "bytes": 2064 }, "page.html": { "sha256": "890c96e25abbaae39fd214199b8aa090714310ddc83ee0b937c152fd5bc11dfe", "bytes": 450765 }, "provenance.json": { "sha256": "4f92bdd1697f8537a928d433283e6a29a03f1a99bc8ba63faf58122cbfc234e3", "bytes": 1769 }, "rendered.html": { "sha256": "c8fc5b5abd7b6e2de015226884302e960a35b65d675302d32305f10d2ad30536", "bytes": 468095 }, "screenshot.jpg": { "sha256": "1df1235e7b5dd13c4f01d7ee4823575cc19e7a7cd3b524436e17fdafd29525c7", "bytes": 760807 }, "text.txt": { "sha256": "ed964d00af00f08579020f9bf7d0e3d9bd44db6ea7f2e789c083ae2a30de818b", "bytes": 12449 } }, "started_utc": "2026-10-23T16:09:04.387Z", "status": 200, "final_url": "https://www.latercera.com/tecnologia/noticia/php2shell-ia-falla-de-seguridad/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). La Tercera (Spanish, Chile), 21 October: an AI discovers a security flaw that threatens millions of websites worldwide. A general explainer on PHP2She...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: una IA descubre una falla de seguridad que amenaza a millones de sitios web en todo el mundo - La Tercera\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/latercera/tecnologia-noticia-php2shell-ia-falla-de-seguridad`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLa Tercera (Spanish, Chile), 21 October: an AI discovers a security flaw that threatens millions of websites worldwide. A general explainer on PHP2Shell and the role of AI in finding it.\n\n> PHP2Shell: una IA descubre una falla de seguridad que amenaza a millones de sitios web en todo el mundo\n\n_Curator's translation:_ \"PHP2Shell: an AI discovers a security flaw that threatens millions of websites around the world\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ La Tercera (Chile) retells the Wall Street Journal and Wiz account: two decade-old PHP memory-handling flaws were found and exploited with AI (GPT-5.6 Sol), and every PHP version back to 5.4 is affected. It cites W3Techs/Reuters for the roughly 75% share.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: una IA descubre una falla de seguridad que amenaza a millones de sitios web en todo el mundo - La Tercera\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "latintimes-php2shell-ai-found-bug-hiding-70-web-mil", "url": "https://www.latintimes.com/php2shell-ai-found-bug-hiding-70-web-millions-attacked-patch-now-600515", "publisher": "Latin Times", "kind": "news", "title": "PHP2Shell: AI Found the Bug Hiding in 70% of the Web. Millions Attacked. Patch Now", "published": "2026-10-23T22:39:03-04:00", "captures": [ { "stamp": "20261024T110459Z", "files": { "headers.json": { "sha256": "d7d96cc5916ca7a58b9f8be2d762ffeec529d074cfe723bb02a2b14682c72f81", "bytes": 1444 }, "page.html": { "sha256": "fbc1316508f012a2141a83990f7596caab147505af59b1ef4668b2dfc967e17b", "bytes": 442562 }, "provenance.json": { "sha256": "9d7aacd9a4858445e677e925a66162418af08a0992e22eee4643cf6f53359ef3", "bytes": 1798 }, "rendered.html": { "sha256": "9400e892134fb739c12422bf611f846708e287bf52d23e0cb82d1027bffd5797", "bytes": 448066 }, "screenshot.jpg": { "sha256": "12e9a260592d98fd38f5008866d0e298ca4379859a1dade7c46f1c0436752d64", "bytes": 753610 }, "text.txt": { "sha256": "34b8464dbf35f8b371680e885dade6485d134d7209956e657f661be932ae9b65", "bytes": 11515 } }, "started_utc": "2026-10-24T11:10:08.759Z", "status": 200, "final_url": "https://www.latintimes.com/php2shell-ai-found-bug-hiding-70-web-millions-attacked-patch-now-600515" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T110459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Latin Times, 23 October: PHP2Shell, the two flaws CVE-2026-109618 and CVE-2026-109619, were discovered in August 2026 by Calif and Wiz using AI tools...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: AI Found the Bug Hiding in 70% of the Web. Millions Attacked. Patch Now\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/latintimes/php2shell-ai-found-bug-hiding-70-web-millions-attacked-patch`, snapshot `20261024T110459Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T110459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLatin Times, 23 October: PHP2Shell, the two flaws CVE-2026-109618 and CVE-2026-109619, were discovered in August 2026 by Calif and Wiz using AI tools and patched on 21 October after details leaked a day early; it describes millions of attack attempts, emergency patches and precautionary shutdowns.\n\n> Two critical PHP flaws — CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell — were discovered in August 2026 by security firms Calif and Wiz using AI tools, then patched October 21 after details leaked a day ahead of schedule.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: AI Found the Bug Hiding in 70% of the Web. Millions Attacked. Patch Now\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lavanguardia-vida-20261021-11664852-alerta-mundial-do", "url": "https://www.lavanguardia.com/vida/20261021/11664852/alerta-mundial-dos-fallos-lenguaje-php-programan-webs.html", "publisher": "La Vanguardia", "kind": "news", "title": "Alerta mundial por dos fallos en el lenguaje PHP con el que se programan las webs", "published": "2026-10-21T19:20:00+02:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "e7e65b4bf75a8f2154ff6f1cefe264963b513868b567c493e26e861318effb5e", "bytes": 695 }, "page.html": { "sha256": "b4781a9f65fcdf5ba8aeded507ebdc57d53bd717b24ef75a03f30b08872a3037", "bytes": 69674 }, "provenance.json": { "sha256": "15f3c6dd785b8c55a50f8652feb2deb68e5e2cd886df7e9765ae494d7e026bf8", "bytes": 1827 }, "rendered.html": { "sha256": "0e45424067c0b2101ebbef7add24a78a5bc49f4bdbf7721b21197203f18c242e", "bytes": 182369 }, "screenshot.jpg": { "sha256": "ec8f1a86ac0edddd710c3e72017362a5caf6dec347360d84948af1b0335697b3", "bytes": 397930 }, "text.txt": { "sha256": "f43c0c7c9506357a424c30c3f98e21419ce514b61663c0dba5c46a0656c81d78", "bytes": 7088 } }, "started_utc": "2026-10-23T23:30:14.982Z", "status": 200, "final_url": "https://www.lavanguardia.com/vida/20261021/11664852/alerta-mundial-dos-fallos-lenguaje-php-programan-webs.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). La Vanguardia (Spanish), 21 October: world alert over two flaws in the PHP language used to program websites. The vulnerabilities could let attackers...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Alerta mundial por dos fallos en el lenguaje PHP con el que se programan las webs\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `co/news/lavanguardia/vida-20261021-11664852-alerta-mundial-dos-fallos-lenguaje-ph`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLa Vanguardia (Spanish), 21 October: world alert over two flaws in the PHP language used to program websites. The vulnerabilities could let attackers run their own code on affected servers, take control to alter sites maliciously or steal data, although so far nobody had reported exploiting them.\n\n> aunque de momento no se ha reportado que nadie haya explotado estos fallos\n\n_Curator's translation:_ \"although for the moment nobody has been reported to have exploited these flaws\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Alerta mundial por dos fallos en el lenguaje PHP con el que se programan las webs\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lbc-uk-websites-offline", "url": "https://www.lbc.co.uk/article/uk-internet-outage-php-websites-tech-5HjdkDd_2/", "publisher": "LBC", "kind": "news", "title": "Websites taken offline as ‘critical’ security flaw hits Met Police, Traitors and government sites | LBC", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112915Z", "files": { "headers.json": { "sha256": "61fade0ae97f79d231f97a5777f63b2e81a66ef6baadd7a7099a825dd6c29ef2", "bytes": 971 }, "page.html": { "sha256": "d4ed63db00e26889d772c2570efda5fb8fa6cce84a1d5826b8876ade8bf939bb", "bytes": 95257 }, "provenance.json": { "sha256": "e04ec30a201ba0f120a5f1c48aafef2c90f871816cde4084454cdc63c5244456", "bytes": 1094 }, "rendered.html": { "sha256": "e14de8389551e0d0109667c7b79786b3489c9cfa31c36fac97a71f6cf5398cb7", "bytes": 107817 }, "screenshot.png": { "sha256": "72e82d8825a1870d48523fc0b7ecfd8f99a8f2f981f64bb572699545b7dfd811", "bytes": 1602728 }, "text.txt": { "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "bytes": 6376 } }, "started_utc": "2026-10-22T11:29:15.399Z", "status": 200, "final_url": "https://www.lbc.co.uk/article/uk-internet-outage-php-websites-tech-5HjdkDd_2/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Met Police, The Traitors, government sites offline; fixes 'around 3pm UK time'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Websites taken offline as ‘critical’ security flaw hits Met Police, Traitors and government sites | LBC\n\nCaptured by claude-story-site. Status: captured. Met Police, The Traitors, government sites offline; fixes 'around 3pm UK time'.\n\n- Captured for the UK list.\n" }, { "slug": "learn-microsoft-nl-nl-answers-questions-6045412-web-app", "url": "https://learn.microsoft.com/nl-nl/answers/questions/6045412/web-app-linux-php-patch-php2shell-critical-vulnera", "publisher": "learn", "kind": "news", "title": "Web App (Linux): PHP Patch php2shell — Critical Vulnerability in PHP Runtime - Microsoft Q&A", "published": "2026-10-21 15:58 (page time zone not stated)", "captures": [ { "stamp": "20261026T170916Z", "files": { "headers.json": { "sha256": "51218e8ab0f6c97b0fbb904ee11250ad7ab452f0c1ab32d3cd094c5550f18a79", "bytes": 2969 }, "page.html": { "sha256": "7f08e789a1048b413860363e317cefd3ca7e5d650cc187f466854aea7b5d2f13", "bytes": 86965 }, "provenance.json": { "sha256": "6671a34cf3d3c310b2fdaca09622e545fc9b01f1878bd4a61f1243cb0c26222b", "bytes": 1848 }, "rendered.html": { "sha256": "a857ca65fb0a85cbd44761d4682ff15dcfe19342ef0a53a8e45ff65cc4b62bed", "bytes": 119574 }, "screenshot.jpg": { "sha256": "1b890f4b7319574041d59ca53b23742ad7b67267dbe996a1335b6e98fb641a02", "bytes": 153520 }, "text.txt": { "sha256": "d73399825bfbedd1b8f7e4cea2bc4b4f2fcde6612e94b7a1f817862ce8b800a6", "bytes": 2097 } }, "started_utc": "2026-10-26T17:28:29.009Z", "status": 200, "final_url": "https://learn.microsoft.com/nl-nl/answers/questions/6045412/web-app-linux-php-patch-php2shell-critical-vulnera" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl-nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T170916Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Microsoft Q&A (Dutch locale), 21 October: a forum question from a user of an Azure Web App (Linux) whose production site was down as a precaution over...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Web App (Linux): PHP Patch php2shell — Critical Vulnerability in PHP Runtime - Microsoft Q&A\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/news/learn-microsoft/nl-nl-answers-questions-6045412-web-app-linux-php-patch-php2`, snapshot `20261026T170916Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T170916Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMicrosoft Q&A (Dutch locale), 21 October: a forum question from a user of an Azure Web App (Linux) whose production site was down as a precaution over 'a critical php2shell leak' and who was waiting for the PHP patch to be pushed to the platform. The only reply, from a moderator on 23 October, says Azure questions are out of scope of the Dutch Q&A and suggests reposting in the English Microsoft Q&A for Azure. A user's self-report, it carries no verified facts about the platform.\n\n> My production site is currently down as a precaution due to a critical php2shell leak, and I need to ensure that the PHP runtime is patched promptly.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Web App (Linux): PHP Patch php2shell — Critical Vulnerability in PHP Runtime - Microsoft Q&A\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `nl-nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lebigdata-php2shell-des-millions-dattaques-frappen", "url": "https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant", "publisher": "LEBIGDATA.FR", "kind": "news", "title": "PHP2Shell : comment protéger votre site des attaques PHP", "published": "2026-10-22T17:52:24+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "325a1699312af0056c6128f5688997429c86982b84b985e1be4b16a541761eac", "bytes": 1558 }, "page.html": { "sha256": "117c392c1899b61bddfb4642c4c1b0c8312cd994d4f77609d015e03ce30dabae", "bytes": 263406 }, "provenance.json": { "sha256": "1e935583c9e1973d5ee043c4d4dec87ec9f734eca4858f4ceb84abd62a61167c", "bytes": 1800 }, "rendered.html": { "sha256": "4515761b754428c4749c875d693d19e09cdacb187f20a99bd1c736998fb6259f", "bytes": 375980 }, "screenshot.jpg": { "sha256": "5849301e17ec6c999acfa4580b39b6e74ad2df2446a4862ac716272ff21d9328", "bytes": 872376 }, "text.txt": { "sha256": "e2295f56852e6bb0a72ce660e7a5be199cf097dfdd19e09a4a5b7cc649ad5f13", "bytes": 38147 } }, "started_utc": "2026-10-23T16:15:13.242Z", "status": 200, "final_url": "https://www.lebigdata.fr/php2shell-des-millions-dattaques-frappent-les-sites-php-comment-vous-proteger-maintenant" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). LeBigData (French), 22 October: millions of attacks hit PHP sites. On 21 October the PHP team published 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two c...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : comment protéger votre site des attaques PHP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/lebigdata/php2shell-des-millions-dattaques-frappent-les-sites-php-comm`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLeBigData (French), 22 October: millions of attacks hit PHP sites. On 21 October the PHP team published 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical engine flaws, CVE-2026-109618 and CVE-2026-109619; affected are installations serving web requests, including PHP-FPM, Apache and mod_php, php-cgi, FrankenPHP and LiteSpeed. The scale of attempts is said to have arrived within hours. A long page (about 36,000 characters); the opening was read.\n\n> Le 21 octobre 2026, l’équipe PHP publie en urgence les versions 8.5.12, 8.4.27, 8.3.36 et 8.2.35.\n\n_Curator's translation:_ \"On 21 October 2026 the PHP team urgently published versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : comment protéger votre site des attaques PHP\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "leiphone-category-industrynews-9dejmhebinubut49-h", "url": "https://www.leiphone.com/category/industrynews/9DeJmHEbinuBUT49.html", "publisher": "雷峰网", "kind": "news", "title": "“PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案 | 雷峰网", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d752b49e5621bb72671a2f7d8befec91ef85f5e3a427337111a932bf7c0b17c4", "bytes": 973 }, "page.html": { "sha256": "91a62b9977e64a00f20692dcb70e2c9fc1d6384e739d18c1aeb2d20318ea5d1b", "bytes": 55870 }, "provenance.json": { "sha256": "edd7c65306d9c9e45aea86da9ca37357084ac74dbcd3884ac6c3fedcb48ae506", "bytes": 1709 }, "rendered.html": { "sha256": "378cd0a617e5b89c34d63c8f45cc3258fbfb017539266a05cc278bc635b68463", "bytes": 83868 }, "screenshot.jpg": { "sha256": "bc109ed43d991b64a815bb7fd8467e6eda542c173157a9cf0abd9904d0c8a793", "bytes": 481959 }, "text.txt": { "sha256": "296adb9a9c94826ad410ede7c0981b0b98eb1c748e3cf7f926a5ac61f0a33eed", "bytes": 9726 } }, "started_utc": "2026-10-23T16:14:01.664Z", "status": 200, "final_url": "https://www.leiphone.com/category/industrynews/9DeJmHEbinuBUT49.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Leiphone (Chinese), a vendor-sponsored item: Qi An Xin's Tianji offers a one-click check for 'PHP2Shell'. On 21 October PHP was reported to have two s...", "raw_sha256": {}, "has_notes": true, "notes_md": "# “PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案 | 雷峰网\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/leiphone/category-industrynews-9dejmhebinubut49-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLeiphone (Chinese), a vendor-sponsored item: Qi An Xin's Tianji offers a one-click check for 'PHP2Shell'. On 21 October PHP was reported to have two serious vulnerabilities, CVE-2026-109618 and CVE-2026-109619; Qi An Xin's experts say they verified unauthenticated remote arbitrary command execution, that the exploitation barrier is very low, and that the potential impact on China exceeds a million assets. A vendor claim, not an independent count.\n\n> 对我国的潜在影响超百万级资产\n\n_Curator's translation:_ \"the potential impact on China exceeds a million assets\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"“PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案 | 雷峰网\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lemondeinformatique-actualites-lire-deux-failles-critiques-d", "url": "https://www.lemondeinformatique.fr/actualites/lire-deux-failles-critiques-dans-php-les-entreprises-sous-pression-100866.html", "publisher": "Le Monde Informatique", "kind": "news", "title": "Deux failles critiques dans PHP : les entreprises sous pression - Le Monde Informatique", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "580d3fc32cc273b5d800ac4c5badb761ac24b60dfae67daf0d133f94642d6a3c", "bytes": 801 }, "page.html": { "sha256": "1b00b13fae80298f17c5fa16dd7c34a28c63ccc8b0da3ab5b75e04f7c96f8a4b", "bytes": 78575 }, "provenance.json": { "sha256": "65b37f7657e8f3c4756b52e08f4876d5ef97bb2aaef9691bcf9fc714fc2ab008", "bytes": 1882 }, "rendered.html": { "sha256": "27b2b28d575893a70d4f10f53fea0537191f6f7032fe9fb755f683a836d88008", "bytes": 199789 }, "screenshot.jpg": { "sha256": "9ba613377962c1c07af25564d9f8714a7f8b2eca5c5012a1acf4c41be6f124d2", "bytes": 747109 }, "text.txt": { "sha256": "234ef1dec5114b7a83e4d827dc3664326bb52a85406ba3172ebab5f8057b4102", "bytes": 13477 } }, "started_utc": "2026-10-23T08:16:34.498Z", "status": 200, "final_url": "https://www.lemondeinformatique.fr/actualites/lire-deux-failles-critiques-dans-php-les-entreprises-sous-pression-100866.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Le Monde Informatique (French): two critical PHP flaws put companies under pressure. Both are CVSS 9.2 and could let an attacker run arbitrary code on...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Deux failles critiques dans PHP : les entreprises sous pression - Le Monde Informatique\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/lemondeinformatique/actualites-lire-deux-failles-critiques-dans-php-les-entrepri`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLe Monde Informatique (French): two critical PHP flaws put companies under pressure. Both are CVSS 9.2 and could let an attacker run arbitrary code on a vulnerable server without prior credentials.\n\n> sans disposer au préalable d’identifiants de connexion\n\n_Curator's translation:_ \"without first having login credentials\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Deux failles critiques dans PHP : les entreprises sous pression - Le Monde Informatique\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "leptidigital-securite-informatique-cybersecurite-fail", "url": "https://www.leptidigital.fr/securite-informatique/cybersecurite-failles-php-importantes-detectees-versions-php-installer-urgence-sites-94382/", "publisher": "LEPTIDIGITAL", "kind": "news", "title": "Cybersécurité : des failles PHP importantes ont été détectées, voici les versions de PHP à installer d’urgence sur vos sites", "published": "2026-10-22T11:35:21+00:00", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "c47c8c902945e65c5bb0611e398b59e5f24c40c5987c73347d5eee2a8a24dcf7", "bytes": 2159 }, "provenance.json": { "sha256": "b172afd4f878e0dcf2e2e1b39ded2ccfe9b396e9c5d7333d5afa5c9b84b96ce7", "bytes": 1870 }, "rendered.html": { "sha256": "91764d40e10b9de094c33bd357f4591385e91258436c6c6fd0683342094b6fba", "bytes": 92924 }, "screenshot.jpg": { "sha256": "dc828706018aba1c0ee89a7cfb87a08ecaab10325775ffb7a0e6fadd683d8125", "bytes": 582743 }, "text.txt": { "sha256": "aee0269fe33f98cbb9879855b451f4fb49718b192d0ed54c3f5778b71343ce68", "bytes": 8279 } }, "started_utc": "2026-10-26T09:50:04.452Z", "status": 200, "final_url": "https://www.leptidigital.fr/securite-informatique/cybersecurite-failles-php-importantes-detectees-versions-php-installer-urgence-sites-94382/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). LEPTIDIGITAL (French), 22 October: a guide to the fixed PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35, published 21 October), saying the flaws sit in t...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Cybersécurité : des failles PHP importantes ont été détectées, voici les versions de PHP à installer d’urgence sur vos sites\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/leptidigital/securite-informatique-cybersecurite-failles-php-importantes`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLEPTIDIGITAL (French), 22 October: a guide to the fixed PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35, published 21 October), saying the flaws sit in the PHP engine so updating WordPress, Drupal or Joomla is not enough, that only a PHP update fully fixes both, and that PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed set-ups are affected with the highest risk under mod_php. It cites Wiz as saying it took control of recent WordPress, Drupal and Joomla images and demonstrated reading the PHP process's memory, which can hold passwords, tokens and API keys, and notes that php.net did not confirm active exploitation although Cloudflare says it sees attack traffic aimed at its customers.\n\n> Le CMS ne vous protège pas : Wiz, qui a révélé les failles, dit avoir pris le contrôle d’images récentes de WordPress, Drupal et Joomla.\n\n_Curator's translation:_ \"The CMS does not protect you: Wiz, which disclosed the flaws, says it took control of recent WordPress, Drupal and Joomla images.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Cybersécurité : des failles PHP importantes ont été détectées, voici les versions de PHP à installer d’urgence sur vos sites\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lequotidien-article-societe-2026-10-22-web-mondial-e", "url": "https://www.lequotidien.re/article/societe/2026/10/22/web-mondial-et-failles-php2shell-des-sites-internet-menaces-a-la-reunion", "publisher": "Le Quotidien de la Réunion", "kind": "news", "title": "PHP2Shell : alerte sur des failles critiques à La Réunion", "published": "2026-10-22T13:55:00+04:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "64af3de466b48788e9c1207b5de79cfe3a16cf3e3546719126ec06a44c0c3ae0", "bytes": 935 }, "page.html": { "sha256": "f7e95376d31b8f227451c5615ef7a6918c3bf6730e62198a89ed8869519e7723", "bytes": 89695 }, "provenance.json": { "sha256": "0b3c18585afc07c99c2733dc96919f7c3e95a750b2bcc3b91a8a688d72fd65a9", "bytes": 1833 }, "rendered.html": { "sha256": "3473c4c168692407eeb14af8a492239eddf27bca860fc7811787c67adbee4906", "bytes": 127768 }, "screenshot.jpg": { "sha256": "7d5a2f52eac159c73ccb8ed8c07d2828333e2f2ffd8237a453f8b05693e0a40b", "bytes": 500273 }, "text.txt": { "sha256": "efd85dcad5b917b3e186a9f4e114e1378bc73e5bfff5ddfaff3bb55275aa80f3", "bytes": 5926 } }, "started_utc": "2026-10-23T16:24:12.572Z", "status": 200, "final_url": "https://www.lequotidien.re/article/societe/2026/10/22/web-mondial-et-failles-php2shell-des-sites-internet-menaces-a-la-reunion" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Le Quotidien de la Reunion (French), 22 October: PHP2Shell alert on critical flaws in La Reunion. The alert relayed by Cyber Reunion concerns two crit...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : alerte sur des failles critiques à La Réunion\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `re/news/lequotidien/article-societe-2026-10-22-web-mondial-et-failles-php2shell`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLe Quotidien de la Reunion (French), 22 October: PHP2Shell alert on critical flaws in La Reunion. The alert relayed by Cyber Reunion concerns two critical security flaws grouped under the name PHP2Shell; PHP is used to run many websites, notably those showing personalised information or talking to a database; a deputy director for cybersecurity at La Reunion connectee explains the particularity of PHP2Shell is that it hits a language used by a very large share of the world's websites.\n\n> L’alerte relayée par Cyber Réunion concerne deux failles de sécurité critiques regroupées sous le nom de « PHP2Shell ».\n\n_Curator's translation:_ \"The alert relayed by Cyber Reunion concerns two critical security flaws grouped under the name 'PHP2Shell'.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Le Quotidien de La Réunion relays a Cyber Réunion alert urging local businesses, associations and local authorities to check their PHP systems. It quotes Matthieu Druilhe of La Réunion connectée and gives the regional CSIRT's phone number. A subheading says the Réunion prefecture and rectorat went offline to apply patches.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : alerte sur des failles critiques à La Réunion\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lesaffaires-opinions-php2shell-ce-quil-faut-en-reten", "url": "https://www.lesaffaires.com/opinions/php2shell-ce-quil-faut-en-retenir/", "publisher": "Les Affaires", "kind": "news", "title": "PHP2Shell: ce qu’il faut retenir des failles révélées cette semaine - Les Affaires", "published": "2026-10-22T15:14:06+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "20480ea8071f664acb13baed9d166c77c3fe25350c1cb5e83f06456fc6430a0b", "bytes": 774 }, "page.html": { "sha256": "bb7ff172157c321fc08bfc2c3831759c8b27e933408fee9abdbbf49f8f5fc90e", "bytes": 188966 }, "provenance.json": { "sha256": "105fbdf4291eafca04675bba483e4787518dbf30c18557b0641b6e9d8951d436", "bytes": 1782 }, "rendered.html": { "sha256": "fcbad751f78579aa8a71561ae93e5a0a21135a558761932d24d55135a86b3ee6", "bytes": 512237 }, "screenshot.jpg": { "sha256": "d501d6457d4adbaf9c227df9d4b22c7f8c837b0795a45aef2415c297f032786f", "bytes": 868924 }, "text.txt": { "sha256": "d70540e1f61d216bb6281a083b5e728524b4ec3f55e1bfe492fda10fedf69ab8", "bytes": 17245 } }, "started_utc": "2026-10-23T16:11:01.794Z", "status": 200, "final_url": "https://www.lesaffaires.com/dossiers/intelligence-artificielle-le-marketing-au-temps-des-algorithmes/php2shell-ce-quil-faut-en-retenir/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-CA", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Les Affaires (French, Quebec), an opinion piece of 22 October: PHP2Shell is a reminder of technical debt, which can be put off until it comes due all...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: ce qu’il faut retenir des failles révélées cette semaine - Les Affaires\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/lesaffaires/opinions-php2shell-ce-quil-faut-en-retenir`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLes Affaires (French, Quebec), an opinion piece of 22 October: PHP2Shell is a reminder of technical debt, which can be put off until it comes due all at once; large organisations will fix it within days, small players will be hit, and another flaw will follow faster. Opinion, not reporting.\n\n> PHP2Shell nous rappelle la vraie nature de cette dette.\n\n_Curator's translation:_ \"PHP2Shell reminds us of the true nature of this debt.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ An opinion piece in Les Affaires (Quebec) by Martin Berthiaume explains PHP2Shell for business leaders, framing it as technical debt and calling for SBOMs. It credits Google's Gemini with a key role and cites Patchstack and Palo Alto Networks figures.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: ce qu’il faut retenir des failles révélées cette semaine - Les Affaires\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-CA`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lessentiel-fr-story-mondeluxembourg-une-faille-de-s", "url": "https://www.lessentiel.lu/fr/story/mondeluxembourg-une-faille-de-securite-permet-de-prendre-le-controle-des-serveurs-103653466", "publisher": "L'essentiel", "kind": "news", "title": "Faille PHP «PHP2Shell»: des millions de sites web menacés dans le monde - L'essentiel", "published": "2026-10-21T14:19:09.172Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ae43c12ad7d8d3a8293d7639a8201481370a2fce9bfd8a21bad9ce7e2ef4a945", "bytes": 1030 }, "page.html": { "sha256": "31e15e6524d2900eda8e21231662630b24e0036c6417971d2be590d02073eb58", "bytes": 245809 }, "provenance.json": { "sha256": "eb2afec0b67b9fd6c4c9e88bc4afc54711aa66f8194d996f84e6508244bb7f48", "bytes": 1712 }, "text.txt": { "sha256": "82df6852e10f2d10229cba85651287220137ad1512a5570e2f8538ae2150524e", "bytes": 10311 } }, "started_utc": "2026-10-23T16:22:19.007Z", "status": 200, "final_url": "https://www.lessentiel.lu/fr/story/mondeluxembourg-une-faille-de-securite-permet-de-prendre-le-controle-des-serveurs-103653466" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). L'essentiel (French, Luxembourg), 21 October, from a dpa wire report: under the name PHP2Shell, security experts warn of two critical vulnerabilities...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Faille PHP «PHP2Shell»: des millions de sites web menacés dans le monde - L'essentiel\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `lu/news/lessentiel/fr-story-mondeluxembourg-une-faille-de-securite-permet-de-pr`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nL'essentiel (French, Luxembourg), 21 October, from a dpa wire report: under the name PHP2Shell, security experts warn of two critical vulnerabilities at the core of the PHP language, CVE-2026-109618 and CVE-2026-109619, which let attackers run malicious code remotely on servers, with an extremely high danger potential.\n\n> Sous le nom de «PHP2Shell», les experts en sécurité mettent en garde contre deux vulnérabilités critiques au cœur du langage de programmation\n\n_Curator's translation:_ \"Under the name \"PHP2Shell\", security experts warn of two critical vulnerabilities at the heart of the programming language\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ L'essentiel (Luxembourg) reports that Luxembourg's HCPN/GOVCERT confirmed awareness and the cyber-risk evaluation cell (CERC) met to coordinate precautions. CIRCL rated the flaws critical. In Germany, the BSI issued a level 3/Orange warning and the city of Mainz disabled mainz.de and several municipal web services.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Faille PHP «PHP2Shell»: des millions de sites web menacés dans le monde - L'essentiel\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "letemps-php-sites-debranches", "url": "https://letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php", "publisher": "letemps.ch", "kind": "news", "title": "Alerte sur le Web: des millions de sites sont débranchés en urgence à cause de failles majeures au cœur de PHP - Le Temps", "published": null, "captures": [ { "stamp": "20261022T081413Z", "files": { "headers.json": { "sha256": "5007331df9736e8ac4b73506dda7fdd2ae63f582c30c5dd68d79778b99102a1d", "bytes": 3689 }, "page.html": { "sha256": "d3a65e2fd0737ae7ab9132c8a84956cfb69749c94b3db910f7ebb3cb25a9192d", "bytes": 240147 }, "provenance.json": { "sha256": "acb4558f59f74d9c45deb47a41342784dc02f034806942b610e559b72ac56652", "bytes": 1237 }, "rendered.html": { "sha256": "4d516cac6cb2207d7a2c0ce63b755be7d4b8aabd358d4725d56d681d239d5f89", "bytes": 423533 }, "screenshot.png": { "sha256": "8cbde5fe818acba1bff61e838a4829c20afca0b4dc09f1e65ff54cc1ac9c716e", "bytes": 752564 }, "text.txt": { "sha256": "4330f33c3b6763a95df44d21cfc602ec5f9bfd9df6141e863545c6a9a276cf4e", "bytes": 4953 } }, "started_utc": "2026-10-22T08:14:13.315Z", "status": 200, "final_url": "https://www.letemps.ch/cyber/alerte-sur-le-web-des-millions-de-sites-sont-debranches-en-urgence-a-cause-de-failles-majeures-au-coeur-de-php" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "libertatea-stiri-ce-este-vulnerabilitatea-php-care", "url": "https://www.libertatea.ro/stiri/ce-este-vulnerabilitatea-php-care-loveste-70percent-din-site-urile-lumii-si-expune-platformele-wordpress-la-atacuri-masive-0e14ssx", "publisher": "Libertatea", "kind": "news", "title": "Ce este vulnerabilitatea critică din PHP care lovește 70% din site-urile lumii și expune platformele WordPress la atacuri masive", "published": "2026-10-22T12:20:01+03:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "3f1f24d54b10bb7044557d969d7b517ccae644598baa87b297708c1b936fe741", "bytes": 1516 }, "page.html": { "sha256": "972a7b473fc7707266b0e4ada7dc8f2c1afe232c62336afe8864b2518d0232bd", "bytes": 279137 }, "provenance.json": { "sha256": "8d86b18cd01cd1cccd11b2306884e75f59d88c0cccf567fecc67ce19e5494166", "bytes": 1988 }, "rendered.html": { "sha256": "c0c89e79c533d9cc3f90c3fb4beccdac9672d5fb5d698c9c9068cd4b092a8fee", "bytes": 346129 }, "screenshot.jpg": { "sha256": "d1e77b084a964a3484f1cc6b52a1a95bc823736b55424986eefcacf688ac46d3", "bytes": 868491 }, "text.txt": { "sha256": "858b409c48780b09224ef5ba5116ca105bea53c71d0db7b28391d2ceb1041d16", "bytes": 19392 } }, "started_utc": "2026-10-24T13:56:10.918Z", "status": 200, "final_url": "https://www.libertatea.ro/stiri/ce-este-vulnerabilitatea-php-care-loveste-70percent-din-site-urile-lumii-si-expune-platformele-wordpress-la-atacuri-masive-0e14ssx" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ro", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Libertatea (Romanian), 22 October: what the critical PHP flaw hitting 70% of the world's sites is and why WordPress platforms are exposed to mass atta...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Ce este vulnerabilitatea critică din PHP care lovește 70% din site-urile lumii și expune platformele WordPress la atacuri masive\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ro/news/libertatea/stiri-ce-este-vulnerabilitatea-php-care-loveste-70percent-di`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLibertatea (Romanian), 22 October: what the critical PHP flaw hitting 70% of the world's sites is and why WordPress platforms are exposed to mass attacks. It says the security firm Hadrian named the two flaws 'PHP2Shell', that per the PHP Foundation the vulnerable code is in critical parts of the language (memory management and error handling), and, citing Amazon Threat Intelligence, that an exploitation attempt was detected as early as 18 October, four days before the official announcement; Amazon's own date elsewhere in the vault is 17 October.\n\n> Potrivit Amazon Threat Intelligence, o tentativă de exploatare PHP2Shell a fost detectată încă din 18 octombrie, cu patru zile înainte de anunțul oficial.\n\n_Curator's translation:_ \"According to Amazon Threat Intelligence, a PHP2Shell exploitation attempt was detected as early as 18 October, four days before the official announcement.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Libertatea returned 429 Too Many Requests.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Ce este vulnerabilitatea critică din PHP care lovește 70% din site-urile lumii și expune platformele WordPress la atacuri masive\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ro`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lineaedp-rubriche-sicurezza-php2shell-lia-acceler", "url": "https://www.lineaedp.it/rubriche/sicurezza/php2shell-lia-accelera-gli-attacchi-informatici/", "publisher": "LineaEDP", "kind": "news", "title": "PHP2Shell, l’IA accelera gli attacchi informatici - LineaEDP", "published": "2026-10-23T12:00:22+00:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "31c50e0835383e4b4a21b1ecb84bbeea08334b6d7f367a04bd89db4872f11110", "bytes": 716 }, "page.html": { "sha256": "7954cd299716d20bc027391065da2bff2bd045b131516ef26a96ce0d322ef16b", "bytes": 424369 }, "provenance.json": { "sha256": "867afec79c0eedbc07ed10653e3b4bf22230af669448e56227621fd397998c0b", "bytes": 1758 }, "rendered.html": { "sha256": "8d284df5c3b6a0005b6d42b55b33ddb06ae6179a3152e42c63eac06a7be4e027", "bytes": 513944 }, "screenshot.jpg": { "sha256": "6b036c468812eaeea4091e37dfd7bce8c7af79eefb2325f4b0436fcc6a0d91df", "bytes": 844146 }, "text.txt": { "sha256": "78c698994f0c0f6fbde417a21efc2dd4a3f5856d49712d03a73d7493965d5f8d", "bytes": 14206 } }, "started_utc": "2026-10-23T23:35:58.955Z", "status": 200, "final_url": "https://www.lineaedp.it/rubriche/sicurezza/php2shell-lia-accelera-gli-attacchi-informatici/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). LineaEDP (Italian), 23 October: PHP2Shell, AI accelerates cyberattacks. Critical PHP vulnerabilities and AI-boosted attacks, with the priorities for c...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, l’IA accelera gli attacchi informatici - LineaEDP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/lineaedp/rubriche-sicurezza-php2shell-lia-accelera-gli-attacchi-infor`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLineaEDP (Italian), 23 October: PHP2Shell, AI accelerates cyberattacks. Critical PHP vulnerabilities and AI-boosted attacks, with the priorities for corporate cybersecurity.\n\n> PHP2Shell, vulnerabilità critiche in PHP e attacchi potenziati dall’IA: le priorità per la cybersecurity aziendale\n\n_Curator's translation:_ \"PHP2Shell, critical vulnerabilities in PHP and AI-boosted attacks: the priorities for corporate cybersecurity\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, l’IA accelera gli attacchi informatici - LineaEDP\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "linternaute-hightech-internet-11310057-panne-interne", "url": "https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/", "publisher": "Linternaute.com", "kind": "news", "title": "Failles PHP : c'est quoi ? On vous explique la panique mondiale sur internet, l'IA au coeur du problème", "published": "2026-10-22T19:36:04+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "0383413630ba5ede138ccc6a78815d0e51975378dfe9c571a9303f4dfd9f836c", "bytes": 932 }, "page.html": { "sha256": "eae3f2f79f90528b21c3a965f21c4810d712358930108548001942f73fb7a373", "bytes": 178748 }, "provenance.json": { "sha256": "6671eb274ea3273dc89d7968970d6495b6cf9a4507fe28cafb76f7a25b41e244", "bytes": 1965 }, "rendered.html": { "sha256": "c501436c513066066667ad7af7b5a399e7d92acf10c8a1ebe92ed7ccc9f9bfe8", "bytes": 536951 }, "screenshot.jpg": { "sha256": "ee40c9e60b0550992b282c3907130a8092af27fa1e7b9a94b4d2651a0d877fbd", "bytes": 717622 }, "text.txt": { "sha256": "940e7811d3ae55de70fd3dac417e2c383c58e2a555b36c27a5e1a39140fa0a6b", "bytes": 13096 } }, "started_utc": "2026-10-23T16:15:19.734Z", "status": 200, "final_url": "https://www.linternaute.com/hightech/internet/11310057-panne-internet-on-vous-explique-la-faille-php-qui-a-fait-trembler-internet-l-ia-au-coeur-de-la-panique-mondiale/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Linternaute (French), 22 October: a lay explainer of the worldwide panic. It says the cause is two PHP flaws, CVE-2026-109618 and CVE-2026-109619 ('PH...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Failles PHP : c'est quoi ? On vous explique la panique mondiale sur internet, l'IA au coeur du problème\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/linternaute/hightech-internet-11310057-panne-internet-on-vous-explique-l`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLinternaute (French), 22 October: a lay explainer of the worldwide panic. It says the cause is two PHP flaws, CVE-2026-109618 and CVE-2026-109619 ('PHP2Shell'), in a language behind about 70% of websites. It explains CVE-2026-109618 as a memory flaw (a request interrupted while its memory space is half-prepared, forced to continue on bad data) and CVE-2026-109619 as a clean-up flaw (data from the previous request stays in memory and the next request can use it), and gives AI's role in the discovery.\n\n> La cause de cette panne sur Internet est l'identification de deux failles de sécurité dans PHP\n\n_Curator's translation:_ \"The cause of this Internet outage is the identification of two security flaws in PHP\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Linternaute explains the outage. All French prefecture sites went offline, impots.gouv.fr went into maintenance mid-afternoon, and Météo France, the CNIL and the City of Paris were inaccessible, as were Le Parisien, Les Echos and 4chan. Météo France and Paris were back Thursday morning. The Netherlands, Finland, the UK, Germany, Denmark and Belgium took similar steps.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Failles PHP : c'est quoi ? On vous explique la panique mondiale sur internet, l'IA au coeur du problème\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lisanews-internacional-un-fallo-en-php-detectado", "url": "https://www.lisanews.org/internacional/un-fallo-en-php-detectado-con-ia-expone-hasta-el-70-de-las-webs-del-mundo/", "publisher": "LISA News", "kind": "news", "title": "PHP2Shell: el fallo crítico de PHP hallado con IA", "published": "2026-10-22T08:18:18+00:00", "captures": [ { "stamp": "20261025T120459Z", "files": { "headers.json": { "sha256": "d3d4bcdb3965b08bd35f5acc94bed646b8fb61ecf8b46dd912ca54132cb4ae0d", "bytes": 686 }, "page.html": { "sha256": "62987245a8313e619860136d525a196b836b1c878b51c911731ead962bc9939c", "bytes": 673223 }, "provenance.json": { "sha256": "40b52d4f6ea17bf3898441ada272c7d93391c679194ef971294d8991c66b92a3", "bytes": 1787 }, "rendered.html": { "sha256": "f94802221e1d25b7cacc26d5bf252f8457b88a41419a2674ba2eb7d5a276b26d", "bytes": 700070 }, "screenshot.jpg": { "sha256": "74ec1ea328183ffbbf1ffbd67e304171333d6dc1696a33ab92474f5c0b501ef8", "bytes": 725329 }, "text.txt": { "sha256": "28c2321adc32ccdd2a2937d66f2a49d747f5455a93fff446da9a9a887e11a1da", "bytes": 10637 } }, "started_utc": "2026-10-25T12:13:53.723Z", "status": 200, "final_url": "https://www.lisanews.org/internacional/un-fallo-en-php-detectado-con-ia-expone-hasta-el-70-de-las-webs-del-mundo/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). LISA News (Spanish), 22 October: PHP2Shell, the critical PHP flaw found with AI. PHP's makers announced a critical flaw on Wednesday 21 October that e...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: el fallo crítico de PHP hallado con IA\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/lisanews/internacional-un-fallo-en-php-detectado-con-ia-expone-hasta`, snapshot `20261025T120459Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T120459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLISA News (Spanish), 22 October: PHP2Shell, the critical PHP flaw found with AI. PHP's makers announced a critical flaw on Wednesday 21 October that experts compare to Heartbleed; it relates to how PHP manages memory. It names Ryan Austin of Calif as having found it with OpenAI's GPT-5.6 Sol during an August audit of PHP's code that OpenAI financed within an initiative of AI companies to help open-source projects. The curator did not record the page's description of how quickly the attack could be run.\n\n> Ryan Austin, investigador de la empresa de seguridad Calif, lo encontró con GPT-5.6 Sol, un modelo avanzado de OpenAI, durante una auditoría del código de PHP en agosto, financiada por OpenAI dentro de una iniciativa de empresas de IA para ayudar a proyectos de código abierto.\n\n_Curator's translation:_ \"Ryan Austin, a researcher at the security firm Calif, found it with GPT-5.6 Sol, an advanced OpenAI model, during an August audit of PHP's code, financed by OpenAI within an initiative of AI companies to help open-source projects.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: el fallo crítico de PHP hallado con IA\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lite-almasryalyoum-technolight-396865", "url": "https://lite.almasryalyoum.com/technolight/396865/", "publisher": "المصري لايت", "kind": "news", "title": "حكاية لغة PHP المستخدمة في المواقع الإلكترونية: ثغرة فيها تهدد بريطانيا بالجوع والعطش - المصري لايت", "published": "2026-10-25T09:52:44+00:00", "captures": [ { "stamp": "20261025T144008Z", "files": { "headers.json": { "sha256": "6210a8cb42c7f92f59e07f12ac90bbc856c3e79072d64579c4ecf77460a5186a", "bytes": 776 }, "page.html": { "sha256": "4f7894e81d3df1f32232f2e861743d1e5f76aeab33cadf07e3f7ba1deacd3655", "bytes": 105472 }, "provenance.json": { "sha256": "10065185dd4c0fc4addaef13cd5e2555fcf631b6c07d9c56ecc1e006cc41d680", "bytes": 1716 }, "rendered.html": { "sha256": "8a06e5d566a2e29ad919f72dfd59bc1a2b6e4e80ffdbca75880c53e059b76c8f", "bytes": 162982 }, "screenshot.jpg": { "sha256": "3e54bb43264afba3585b09462265757ab04bd879c76710a76ce75c8cef2f61b3", "bytes": 419017 }, "text.txt": { "sha256": "8e606154af8cb7e815068d80e0dae887e6ab64160b583d639c230c1acffdd26c", "bytes": 12832 } }, "started_utc": "2026-10-25T14:48:06.557Z", "status": 200, "final_url": "https://lite.almasryalyoum.com/technolight/396865/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T144008Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Al-Masry Lite (Arabic), 25 October: the story of the PHP language used on websites, a flaw in which it says threatens Britain with hunger and thirst....", "raw_sha256": {}, "has_notes": true, "notes_md": "# حكاية لغة PHP المستخدمة في المواقع الإلكترونية: ثغرة فيها تهدد بريطانيا بالجوع والعطش - المصري لايت\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/lite-almasryalyoum/technolight-396865`, snapshot `20261025T144008Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T144008Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAl-Masry Lite (Arabic), 25 October: the story of the PHP language used on websites, a flaw in which it says threatens Britain with hunger and thirst. A sensational headline over a roundup of what the Guardian, the Independent and the BBC reported about PHP2Shell, why it is dangerous and its effect on sites and government services.\n\n> يستعرض «المصري لايت» أبرز المعلومات عن ثغرة «PHP2Shell»، وأسباب خطورتها وتأثيرها على المواقع والخدمات الحكومية، وفقًا لما أوردته صحف «الغارديان» و«الإندبندنت» وهيئة الإذاعة البريطانية «BBC».\n\n_Curator's translation:_ \"Al-Masry Lite reviews the main information about the 'PHP2Shell' vulnerability, why it is dangerous and its effect on websites and government services, according to what the Guardian, the Independent and the BBC reported.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"حكاية لغة PHP المستخدمة في المواقع الإلكترونية: ثغرة فيها تهدد بريطانيا بالجوع والعطش - المصري لايت\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lorikeet-php2shell", "url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities", "publisher": "Lorikeet Security", "kind": "vendor", "title": "php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112438Z", "files": { "headers.json": { "sha256": "b7888c7584d4891b481a804cc3243ec9dff82d301a8ac2c7070c6b7f25bd5fe2", "bytes": 1727 }, "page.html": { "sha256": "b74c194ddfc61843d47bd6ffa9d691718fab73fa370cf3c82d1cd24ea3f3f998", "bytes": 343430 }, "provenance.json": { "sha256": "38298cededb4b803f1214bfa4a6a30e1cdf06ddc417f0771577affd057d13e5a", "bytes": 1123 }, "rendered.html": { "sha256": "38608a412a2fb2a979d5821ccb1a9764037d3d2bbad075a509f0d25884973ae5", "bytes": 904734 }, "screenshot.png": { "sha256": "281038d16371213c89c2ce9df773de5a82e6eac69bdfe5c855e3975b02ac6387", "bytes": 8419643 }, "text.txt": { "sha256": "db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349", "bytes": 37837 } }, "started_utc": "2026-10-22T11:24:38.602Z", "status": 200, "final_url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities" }, { "stamp": "20261025T070559Z", "files": { "headers.json": { "sha256": "82feef81471d7a64e77b264ed3eb78fe370fdda1a8288764e82829db34e928e2", "bytes": 1801 }, "page.html": { "sha256": "cda45109ff195af2678c38806de8c847cf5b6189c9cdf92963d0bfeb789bfc33", "bytes": 342196 }, "provenance.json": { "sha256": "81947b8457c3011818e533361765f04e4d2c051642f123947dcf76c2c69de4ac", "bytes": 1688 }, "text.txt": { "sha256": "f3b4827ebfeb5db8d6a63dec4b198e257ec210434bca837c1c8f55444d86989b", "bytes": 36965 } }, "started_utc": "2026-10-25T07:29:06.240Z", "status": 200, "final_url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security\n\nCaptured by claude-story-site. Status: captured. Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence.\n\n- Captured for the record of the rule.\n" }, { "slug": "lupa-aktuality-php2shell-kriticke-zranitelnos", "url": "https://www.lupa.cz/aktuality/php2shell-kriticke-zranitelnosti-v-php-davaji-utocnikum-moznost-spustit-kod-na-serverech/", "publisher": "Lupa.cz", "kind": "news", "title": "PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům možnost spustit kód na serverech - Lupa.cz", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "7133032f5910a35f204981976cab53074792f28cd28d5328ccbf3983a4f04409", "bytes": 663 }, "page.html": { "sha256": "6c9811efb3e7d3b9dc6b88db55a01fb8696ee83987a7221c51e5bd1eaa99da5d", "bytes": 245222 }, "provenance.json": { "sha256": "d432bfe81d2ef0ceaf23de6468218a7d3792e33b727be355cb1700b5f24dbae6", "bytes": 1849 }, "rendered.html": { "sha256": "c8fe494ed7f9790f4a61aab062cd9f1fa4403ca7394f5e8889c357fa84767b44", "bytes": 433202 }, "screenshot.jpg": { "sha256": "af42ed223d6ae4cf4df0eeb141bee7c6fa0848f678a758f89f908f5a79a109a1", "bytes": 351303 }, "text.txt": { "sha256": "4f0699a22c3469b046a76e228284b73af8cb96749bd629a3cd85c57045ede0f5", "bytes": 4193 } }, "started_utc": "2026-10-23T16:12:46.461Z", "status": 200, "final_url": "https://www.lupa.cz/aktuality/php2shell-kriticke-zranitelnosti-v-php-davaji-utocnikum-moznost-spustit-kod-na-serverech/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "cs", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Lupa.cz (Czech): PHP2Shell, critical vulnerabilities in PHP give attackers the ability to run code on servers. The two flaws are CVE-2026-109618 and C...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům možnost spustit kód na serverech - Lupa.cz\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `cz/news/lupa/aktuality-php2shell-kriticke-zranitelnosti-v-php-davaji-utoc`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLupa.cz (Czech): PHP2Shell, critical vulnerabilities in PHP give attackers the ability to run code on servers. The two flaws are CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\n\n> Konkrétně se jedná o dvě zranitelnosti CVE-2026–109618 a CVE-2026–109619. Chyby jsou opraveny ve verzích PHP 8.5.12, 8.4.27, 8.3.36 a 8.2.35.\n\n_Curator's translation:_ \"Specifically these are two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The bugs are fixed in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Lupa.cz reports that the Czech Government Office (Úřad vlády) took its website offline from 19:00 on 21 October on NÚKIB's advice, and that it was back online by 08:00 on 22 October. It quotes NÚKIB and links a related story saying Czech Technical University (ČVUT) faced a cyber attack reportedly linked to the PHP flaw.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: kritické zranitelnosti v PHP dávají útočníkům možnost spustit kód na serverech - Lupa.cz\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `cs`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "lupa-cvut-cyber-attack", "url": "https://www.lupa.cz/aktuality/cvut-celi-kybernetickemu-utoku-doplatilo-na-kritickou-chybu-v-php", "publisher": "Lupa.cz", "kind": "news", "title": "ČVUT čelí kybernetickému útoku, údajně doplatilo na kritickou chybu v PHP - Lupa.cz", "published": "2026-10-22 (\"Dnes\"; updated 19:30 local time per the page)", "captures": [ { "stamp": "20261022T191510Z", "files": { "headers.json": { "sha256": "9e7cddcd02817e76193919fd96d24ce3c3b47557f4590a79a23862eac5fb3baf", "bytes": 662 }, "page.html": { "sha256": "d5195979b8f5922d4b2052e2e8954a827aedff331c6794e8d7561328e6a41210", "bytes": 248530 }, "provenance.json": { "sha256": "b9993f69e78c56602b3d1be9b434d914f1451bb132d2dbac462d607cfd8fddb6", "bytes": 1686 }, "rendered.html": { "sha256": "d8db6b3b2b9b40c2b7d02632307aa6e8708644578ba1c95010426737f51175b8", "bytes": 538864 }, "screenshot.jpg": { "sha256": "bff2dc81e08976b5179f030294b31342fdca68d987b547e8568c7343bc383718", "bytes": 340215 }, "text.txt": { "sha256": "0a0abb12fccb6fbccc2b675a8f1b26cc2ab83cfceb120010a8b4cb27effdd337", "bytes": 6923 } }, "started_utc": "2026-10-22T19:15:10.578Z", "status": 200, "final_url": "https://www.lupa.cz/aktuality/cvut-celi-kybernetickemu-utoku-doplatilo-na-kritickou-chybu-v-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "cs", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191510Z. ČVUT says it faces an attack \"part of worldwide attempts against PHP sites\", active attack stopped; success unconfirmed", "raw_sha256": {}, "has_notes": true, "notes_md": "# ČVUT čelí kybernetickému útoku, údajně doplatilo na kritickou chybu v PHP - Lupa.cz\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `cz/tech-press/lupa/cvut-cyber-attack`, snapshot `20261022T191510Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191510Z/provenance.json`. Publisher: Lupa.cz. Language: cs. URL: https://www.lupa.cz/aktuality/cvut-celi-kybernetickemu-utoku-doplatilo-na-kritickou-chybu-v-php\n\n## What the page says\n\n_Curator's reading of the capture._\n\nLupa.cz (Iva Brejlová) reports that Czech Technical University in Prague (ČVUT) is facing a cyber attack on its IT infrastructure. It quotes ČVUT's own statement from social media: the attack is \"part of worldwide attempts to hit websites using PHP\", the active attack was stopped, recovery is under way, and some systems were taken offline as a precaution. Lupa adds that ČVUT gave no more detail, that it is not yet clear whether the outage really relates to PHP2Shell, and that the international security community has so far found no evidence of real exploitation. An update at 19:30 added information on monitoring of possible PHP2Shell exploitation. The article also recaps NÚKIB's advice to update, the leak via Hacker News, and shutdowns in the Netherlands, Finland, France, Germany and of the Czech Government Office's website.\n\n> „ČVUT v současnosti řeší kybernetický útok na svou IT infrastrukturu. Jedná se o součást celosvětových pokusů zasáhnout weby s technologií PHP. Aktivní útok se podařilo zastavit a probíhají práce na řešení a obnově. Do vyřešení byly preventivně odstaveny některé systémy,“ popisuje ČVUT.\n\n_Curator's translation:_ \"ČVUT is currently dealing with a cyber attack on its IT infrastructure. It is part of worldwide attempts to hit websites using PHP technology. The active attack was stopped and work on resolution and recovery is under way. Some systems have been taken offline as a precaution until it is resolved,\" ČVUT says.\n\n> Není tak zatím jasné, zda nedostupnost jejích stránek opravdu s PHP2Shell souvisí. Mezinárodní bezpečnostní komunita, která situaci monitoruje, zatím nenašla důkazy o žádném reálném zneužití zranitelností.\n\n_Curator's translation:_ So it is not yet clear whether the unavailability of its pages really relates to PHP2Shell. The international security community monitoring the situation has so far found no evidence of any real exploitation of the vulnerabilities.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): ČVUT says it faces an attack \"part of worldwide attempts against PHP sites\", active attack stopped; success unconfirmed\n\nSupports: contradictions/compromise-cvut.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "lv-latvija-gov", "url": "https://www.latvija.gov.lv/", "publisher": "latvija.gov.lv", "kind": "government", "title": null, "published": null, "captures": [ { "stamp": "20261022T081939Z", "files": { "provenance.json": { "sha256": "c46e7265217bfc48f378b0011538b59f3e51a97263219d7ca72ed0fd55a3cfb5", "bytes": 465 } }, "started_utc": "2026-10-22T08:19:39.490Z", "error": "page.goto: net::ERR_CERT_COMMON_NAME_INVALID at https://www.latvija.gov.lv/" } ], "status": "failed", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP None, page.goto: net::ERR_CERT_COMMON_NAME_INVALID at https://www.latvija.gov.lv/), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "m-ddaily-page-view-2026102611404279049", "url": "https://m.ddaily.co.kr/page/view/2026102611404279049", "publisher": "디지털데일리", "kind": "news", "title": "[PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리", "published": "2026-10-26 13:04:22 (page time zone not stated)", "captures": [ { "stamp": "20261026T144241Z", "files": { "headers.json": { "sha256": "574bc5122d6c9e37bb2774023ecf1925bc2b379e8a5d56d3e0e8bb956b1ebf72", "bytes": 526 }, "page.html": { "sha256": "8dae8d2947592cdb21dc8d37513fbe6d6848379bb13177910a75523bc7a7fdc2", "bytes": 51187 }, "provenance.json": { "sha256": "cae04ebe4c01ffe473e20c9a7eef9c6b16eec3bbffcad39b6589ad8fbf528db1", "bytes": 1662 }, "rendered.html": { "sha256": "0bc02faad92091b2edf2d30003f3d580356f200c3908f138fa79f1a472f3222c", "bytes": 382190 }, "screenshot.jpg": { "sha256": "6c122d0886b317c0df57e0a8a2076351e54f3a97db3cb838e9a11edd33376438", "bytes": 500772 }, "text.txt": { "sha256": "b23973093bf2a28f25c412e1c2da9c17bbb502376bbc53788e513ae5fac76925", "bytes": 10232 } }, "started_utc": "2026-10-26T14:59:54.521Z", "status": 200, "final_url": "https://m.ddaily.co.kr/page/view/2026102611404279049" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T144241Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Digital Daily (Korean), 26 October, by Kim Bo-min: 'PHP emergency: now Node.js', a second runtime flaw a week later. It says Theori announced a Node.j...", "raw_sha256": {}, "has_notes": true, "notes_md": "# [PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/m-ddaily/page-view-2026102611404279049`, snapshot `20261026T144241Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T144241Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDigital Daily (Korean), 26 October, by Kim Bo-min: 'PHP emergency: now Node.js', a second runtime flaw a week later. It says Theori announced a Node.js vulnerability, 'Node2Shell' (CVE-2026-111497), a Brotli decoder out-of-bounds write that can cause denial of service, memory disclosure or remote code execution, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1; this is a separate flaw from PHP2Shell, which TTMChange's report summarises (CVSS 9.2, mod_php the most exposed, code back to PHP 5.4). It gives a sequence of events: Amazon's honeypot saw an attempt on 17 October, details leaked on 20 October, Cloudflare applied emergency firewall rules and PHP published its advisory on 21 October, watchTowr and SOCRadar then reported exploit tools used in real environments, and on 24 October Palo Alto Networks warned its devices were affected. It also says the cyber-security firm Cyfirma found Korean-speaking members of a closed I2P network simulating attacks on the PHP flaws, aimed at government bodies, banks and other sectors in many countries, and raised the possibility of a link to the Lazarus group ecosystem with 'moderate' confidence.\n\n> 사이버보안 기업 사이퍼마에 따르면, 익명성이 보장되는 폐쇄형 네트워크인 I2P 내부에서 한국어를 사용하는 특정 조직원들이 PHP 취약점을 악용한 사이버 공격을 모의한 것으로 나타났다.\n\n_Curator's translation:_ \"According to the cyber-security firm Cyfirma, certain Korean-speaking members inside I2P, a closed network that guarantees anonymity, were found to have simulated cyber attacks exploiting the PHP vulnerabilities.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"[PHP 비상] 이번엔 Node.js…연이은 대형 취약점에 웹서버 보안 `빨간불` - 디지털데일리\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "macitynet-php2shell-vulnerabilita-php-siti-offline", "url": "https://www.macitynet.it/php2shell-vulnerabilita-php-siti-offline/", "publisher": "macitynet.it", "kind": "news", "title": "PHP2Shell: siti offline e aggiornamenti urgenti per PHP - macitynet.it", "published": "2026-10-22T12:42:16+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "99cf9bddafc701ec034763bd3c09a6c16557ad3b615bf010e47a1b71430961a7", "bytes": 1648 }, "page.html": { "sha256": "36ac8367462c24c14617aed19841c480404e0d5978d0664de19e5e6c774c7eda", "bytes": 260495 }, "provenance.json": { "sha256": "2af0225322381f2468693e028a3290d471cd4ded9683645d94306b9a38168999", "bytes": 1681 }, "rendered.html": { "sha256": "f0e8dc03096a319edafa4975337f5b857116e2a79699c695325039c6bb5f7cb3", "bytes": 263664 }, "screenshot.jpg": { "sha256": "188acb086ac2716931f85f01a2265ace26ca1746c84cc619fd759dd2569f1a19", "bytes": 711614 }, "text.txt": { "sha256": "578fcf6b9feec91190e40e26fd91e75e869712a60862023673bb5f60b739d0e1", "bytes": 9078 } }, "started_utc": "2026-10-23T16:18:55.611Z", "status": 200, "final_url": "https://www.macitynet.it/php2shell-vulnerabilita-php-siti-offline/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Macitynet (Italian), 22 October: PHP2Shell, sites offline also in Italy, what WordPress users should do. On 21 October GARR, the Italian research netw...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: siti offline e aggiornamenti urgenti per PHP - macitynet.it\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/macitynet/php2shell-vulnerabilita-php-siti-offline`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMacitynet (Italian), 22 October: PHP2Shell, sites offline also in Italy, what WordPress users should do. On 21 October GARR, the Italian research network, announced it had isolated some of its platforms to apply fixes, as a precaution; the fixes have been available since 21 October; updating only WordPress, the theme or plugins does not remove the flaws, so owners should check with their host that PHP itself was fixed.\n\n> il 21 ottobre GARR ha annunciato di aver isolato alcune delle proprie piattaforme per applicare le correzioni.\n\n_Curator's translation:_ \"on 21 October GARR announced that it had isolated some of its platforms to apply the fixes.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Macitynet says PHP2Shell sites went offline in Italy too: the GARR research and education network isolated some platforms on 21 October to apply patches. It explains what WordPress users must do and cites CERT-AGID advice.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: siti offline e aggiornamenti urgenti per PHP - macitynet.it\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "mainichi-articles-20261023-pr2-00m-020-690000c", "url": "https://mainichi.jp/articles/20261023/pr2/00m/020/690000c", "publisher": "毎日新聞デジタル", "kind": "news", "title": "プレスリリース：HBLAB、PHPの重大脆弱性「PHP2Shell」の影響範囲を調査するアセスメントサービスの提供を開始（PR TIMES） | 毎日新聞", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "4082fa4d40b82b30dcedc831b3ede60f52b9916a15519bca8ab511cb2b119786", "bytes": 957 }, "page.html": { "sha256": "63967065edfb137409b6bcbfb3cf8d2937c6c926e0dc956a56f3ccb5f7132fd9", "bytes": 88612 }, "provenance.json": { "sha256": "31a95fbcbfbee5e87e6b09f433cedc963637af647c37ea1f44fc0e0fd2384539", "bytes": 1754 }, "rendered.html": { "sha256": "99b28bfa65b195402990ce93f5e4cad9fbba2ffa697f2d7ad7acdfa0f002768e", "bytes": 124040 }, "screenshot.jpg": { "sha256": "618aeb473bb25714e07712ae51cc35218140a0c288b11ae1dfc2642cc03307a7", "bytes": 605537 }, "text.txt": { "sha256": "a0d3946b2a22cd7f6aa6655a334f916b3cfef4a34697c5aef718ba2f794519ea", "bytes": 11488 } }, "started_utc": "2026-10-23T16:19:34.451Z", "status": 200, "final_url": "https://mainichi.jp/articles/20261023/pr2/00m/020/690000c" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Mainichi Digital (Japanese), a PR TIMES press release: HBLAB Japan begins offering 'PHP2Shell Assessment', a service to investigate the scope of impac...", "raw_sha256": {}, "has_notes": true, "notes_md": "# プレスリリース：HBLAB、PHPの重大脆弱性「PHP2Shell」の影響範囲を調査するアセスメントサービスの提供を開始（PR TIMES） | 毎日新聞\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/mainichi/articles-20261023-pr2-00m-020-690000c`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMainichi Digital (Japanese), a PR TIMES press release: HBLAB Japan begins offering 'PHP2Shell Assessment', a service to investigate the scope of impact of the PHP flaws from 23 October, with the fix patch public since 21 October; the page restates CVSS v4.0 9.2 and that the flaw lies in the PHP runtime itself. A vendor service announcement; the curator did not copy the company's representative's name.\n\n> HBLAB、PHPの重大脆弱性「PHP2Shell」の影響範囲を調査するアセスメントサービスの提供を開始（PR TIMES）\n\n_Curator's translation:_ \"HBLAB begins offering an assessment service to investigate the scope of impact of the serious PHP vulnerability 'PHP2Shell' (PR TIMES)\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"プレスリリース：HBLAB、PHPの重大脆弱性「PHP2Shell」の影響範囲を調査するアセスメントサービスの提供を開始（PR TIMES） | 毎日新聞\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "malaymail-news-singapore-2026-10-23-singapore-warn", "url": "https://www.malaymail.com/news/singapore/2026/10/23/singapore-warns-of-critical-php-vulnerabilities-that-could-expose-web-servers-to-hackers/240275", "publisher": "Malay Mail", "kind": "news", "title": "Singapore warns of critical PHP vulnerabilities that could expose web servers to hackers | Malay Mail", "published": "2026-10-23 10:52:13 MYT", "captures": [ { "stamp": "20261026T121439Z", "files": { "headers.json": { "sha256": "e01a638648d1bda4670da88501a62d870bc2e1b927df00097e6a8b5969fc80a4", "bytes": 1147 }, "page.html": { "sha256": "80bf298e16b3ec6d040b7912872ebcaae29518d9880d11dcc084a18c27cfab3d", "bytes": 143400 }, "provenance.json": { "sha256": "839bc936a5198372a4c6f3e83d5093f487eeee9b351ae725d82ff520961db8cd", "bytes": 1912 }, "rendered.html": { "sha256": "e2ee66cd24e069bca54f9732bfea9becde23859f168fd696e44e340e1fe177db", "bytes": 242239 }, "screenshot.jpg": { "sha256": "4eb8538336a622279d1f1520edfc732f5fd17ca752493b4e0db892daddc55f56", "bytes": 398537 }, "text.txt": { "sha256": "c4bf19dca315cad337a06ebe35b3b2cb33839c81e0ef88bebfbe072c247ffa6a", "bytes": 7563 } }, "started_utc": "2026-10-26T12:36:01.830Z", "status": 200, "final_url": "https://www.malaymail.com/news/singapore/2026/10/23/singapore-warns-of-critical-php-vulnerabilities-that-could-expose-web-servers-to-hackers/240275" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T121439Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Malay Mail (Malaysia, English), 23 October: the Cyber Security Agency of Singapore (CSA) urges organisations to act on the two PHP flaws. Its chief ex...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Singapore warns of critical PHP vulnerabilities that could expose web servers to hackers | Malay Mail\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sg/news/malaymail/news-singapore-2026-10-23-singapore-warns-of-critical-php-vu`, snapshot `20261026T121439Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T121439Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMalay Mail (Malaysia, English), 23 October: the Cyber Security Agency of Singapore (CSA) urges organisations to act on the two PHP flaws. Its chief executive Gwenda Fong says the threat is immediate, working exploits having been demonstrated and patches released on 21 October, and that CSA is working with government agencies, critical information infrastructure owners, major enterprises and industry partners to speed up patching, and reaching smaller organisations through business associations, security providers and technology partners. The CSA advisory tells organisations to find every system running PHP, prioritise internet-facing ones, and check web servers for PHP, including in third-party applications, even where the main site does not use it.\n\n> She said the threat was immediate, with working exploits having been demonstrated and security patches released on Oct 21.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Singapore warns of critical PHP vulnerabilities that could expose web servers to hackers | Malay Mail\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "malwarebytes-nl-blog-bugs-2026-10-php2shell-why-websi", "url": "https://www.malwarebytes.com/nl/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "publisher": "malwarebytes", "kind": "news", "title": "PHP2Shell: Waarom veel websites offline moesten gaan | Malwarebytes", "published": "2026-10-21T16:14:18+00:00", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "c127e590c1c1662737cb2831dc61804a86978d46cbf4dc01bb46e059b1f4bf1c", "bytes": 997 }, "page.html": { "sha256": "8c66de54dda6b304ce8e0b514223a7c0a4a991f685a1bbf91cfd7328ca0137b3", "bytes": 393530 }, "provenance.json": { "sha256": "1856aed02753cb762932f941386efc095ea4573c26904168e3a90ae84aaeee1e", "bytes": 1835 }, "rendered.html": { "sha256": "e7fb7ef452a667caeb3517d6e835732d4b42deef8e494c97bd76e6d89e2e3e23", "bytes": 404565 }, "screenshot.jpg": { "sha256": "37f8cdd60f58e859a7325c208335e452daeb6345a3ef7aa783f5ccdf2bd07ee1", "bytes": 699867 }, "text.txt": { "sha256": "d3098f85c2acf8ef34f5002519916d5f4c17364c6ebf48d06334c9a012984b65", "bytes": 9514 } }, "started_utc": "2026-10-25T09:38:44.629Z", "status": 200, "final_url": "https://www.malwarebytes.com/nl/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Malwarebytes (Dutch edition), 21 October: why many websites had to go offline. The flaws, known as PHP2Shell, are CVE-2026-109618 and CVE-2026-109619,...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Waarom veel websites offline moesten gaan | Malwarebytes\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `be/news/malwarebytes/nl-blog-bugs-2026-10-php2shell-why-websites-are-going-offlin`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMalwarebytes (Dutch edition), 21 October: why many websites had to go offline. The flaws, known as PHP2Shell, are CVE-2026-109618 and CVE-2026-109619, both 9.2 out of 10. It warns consumers to take extra care because a 'trusted website' may no longer be trustworthy, not only because of PHP2Shell but also because of eight compromised TLS certificates, a separate incident.\n\n> De kwetsbaarheden, bekend als PHP2Shell, worden geregistreerd onder de nummers CVE-2026-109618 en CVE-2026-109619.\n\n_Curator's translation:_ \"The vulnerabilities, known as PHP2Shell, are registered under the numbers CVE-2026-109618 and CVE-2026-109619.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Waarom veel websites offline moesten gaan | Malwarebytes\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "mansethaber-bilim-teknoloji-php2shell-nedir-kimleri", "url": "https://mansethaber.com/bilim-teknoloji/php2shell-nedir-kimleri-etkiliyor-site-sahipleri-ne-yapmali", "publisher": "mansethaber", "kind": "news", "title": "PHP2Shell nedir? Kimleri etkiliyor, site sahipleri ne yapmalı? - Manşet Haber", "published": "2026-10-22T00:45:00+03:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "646e2d109d75f26899af2bf91efea4649c357bf74b5d07f5f1f0e19813b7a33c", "bytes": 3397 }, "page.html": { "sha256": "90732bb1fe902deb1f8873cb098b7974b35fc8bcb864a360fa9a07e6a05b3bc3", "bytes": 233226 }, "provenance.json": { "sha256": "fccb535b6654d036a786341c80d97aaad7529c28d6b1deb63f93b701216a1788", "bytes": 1800 }, "rendered.html": { "sha256": "56c6d6d0ef663b576fe86010167d2665c544948b1361df08430eb47b5794f03a", "bytes": 234583 }, "screenshot.jpg": { "sha256": "00825040bcd1efac27ed8074cf6332d5c1023d7a97ec7fdb3a0f74732f5b5a1c", "bytes": 658308 }, "text.txt": { "sha256": "b45e8fcedbc9b60ca53f8eebe87ff081eeb8cbfe8316344ee7a1a479f04f3072", "bytes": 8680 } }, "started_utc": "2026-10-23T16:25:48.200Z", "status": 200, "final_url": "https://mansethaber.com/bilim-teknoloji/php2shell-nedir-kimleri-etkiliyor-site-sahipleri-ne-yapmali" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Manset Haber (Turkish), 22 October: what PHP2Shell is, who it affects and what site owners should do. Two critical flaws in PHP, used across millions...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell nedir? Kimleri etkiliyor, site sahipleri ne yapmalı? - Manşet Haber\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/mansethaber/bilim-teknoloji-php2shell-nedir-kimleri-etkiliyor-site-sahip`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nManset Haber (Turkish), 22 October: what PHP2Shell is, who it affects and what site owners should do. Two critical flaws in PHP, used across millions of sites worldwide, are considered high-risk because they can let attackers run code remotely without user authentication on some systems; developers urged an update.\n\n> PHP2Shell nedir, hangi PHP sürümleri etkileniyor ve site sahipleri ne yapmalı?\n\n_Curator's translation:_ \"What is PHP2Shell, which PHP versions are affected and what should site owners do?\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell nedir? Kimleri etkiliyor, site sahipleri ne yapmalı? - Manşet Haber\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "marketing4ecommerce-crisis-seguridad-php", "url": "https://marketing4ecommerce.net/crisis-seguridad-php/", "publisher": "Marketing4eCommerce", "kind": "news", "title": "La crisis de seguridad en PHP, explicada para dummies", "published": "2026-10-22T11:40:23+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "7e11526ab71fc85e828c42c880ad8bf9a1f50c547b04a7a0f69cb92c4ef2be18", "bytes": 619 }, "page.html": { "sha256": "fe6cada937dd531d6462eb940acbf26739669197a8288566686d16440bf63616", "bytes": 292655 }, "provenance.json": { "sha256": "1115e0a3e14bb33d6be84d6226a7a88416ec1d84d40bd27f3e2e4841e18eba1d", "bytes": 1608 }, "rendered.html": { "sha256": "9757567561fc958b3c6fabad239d77e483292b31602b75f583507cb674fa9539", "bytes": 252529 }, "screenshot.jpg": { "sha256": "c0aff27a85cf0d3d81ee06ca78ab79f51144b09a9e367ddb71c4f09becf15aa1", "bytes": 769700 }, "text.txt": { "sha256": "f6697167654f81fa7d28a48e73539bfc43e7c2851bae6a17daabc65ab7caea36", "bytes": 13422 } }, "started_utc": "2026-10-23T16:09:04.387Z", "status": 200, "final_url": "https://marketing4ecommerce.net/crisis-seguridad-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es-ES", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Marketing4eCommerce (Spanish), 22 October: 'the PHP security crisis explained for dummies' for people who run websites or online shops. It says it has...", "raw_sha256": {}, "has_notes": true, "notes_md": "# La crisis de seguridad en PHP, explicada para dummies\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/marketing4ecommerce/crisis-seguridad-php`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMarketing4eCommerce (Spanish), 22 October: 'the PHP security crisis explained for dummies' for people who run websites or online shops. It says it has also been nicknamed PHPcalipsis and PHPgate, and advises asking the hosting provider or system administrator whether the servers are protected against CVE-2026-109618 and CVE-2026-109619.\n\n> contacta con tu proveedor de hosting o administrador de sistemas, ellos sabrán lo que hacer\n\n_Curator's translation:_ \"contact your hosting provider or system administrator, they will know what to do\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Marketing4eCommerce gives an explainer for e-commerce operators: PHP's history and market share, the PHP Foundation timeline and the NSA advice. It lists shutdowns in Europe and says Spain's CCN-CERT put its own website into maintenance mode.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"La crisis de seguridad en PHP, explicada para dummies\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `es-ES`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "matricedigitale-2026-10-25-php2shell-italia-csirt-serviz", "url": "https://www.matricedigitale.it/2026/10/25/php2shell-italia-csirt-servizi-php-vulnerabili/", "publisher": "Matrice Digitale", "kind": "news", "title": "PHP2Shell, allarme CSIRT Italia: l’81,9% dei servizi PHP risulta vulnerabile - Matrice Digitale", "published": "2026-10-25T19:00:32+01:00", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "7a1305bf666e6a2771e96c700bb39be9136880208ee0d1a0abaed3c8fc16fb2d", "bytes": 1385 }, "page.html": { "sha256": "12f2aaa6aa46c1691bb3e05988bc51116b218b240dbcf842937a484c8787667b", "bytes": 226540 }, "provenance.json": { "sha256": "297069294036d662a4f9a1297215bd23090736123f582af42734d7964dded715", "bytes": 1804 }, "rendered.html": { "sha256": "aca3a00dcea719e4cb2e996afdeb5b9fac55bf84aaf4ac1721903e66c17b3392", "bytes": 572517 }, "screenshot.jpg": { "sha256": "586a260e0692044a27d57404ba870f4022765cd42598a5fb36f4f4e78ce2a9f4", "bytes": 754405 }, "text.txt": { "sha256": "d54477d226a71e71e9289195b5a9bcb4070e477413f90c63c2ff40b513d5acbc", "bytes": 14393 } }, "started_utc": "2026-10-26T09:54:52.537Z", "status": 200, "final_url": "https://www.matricedigitale.it/2026/10/25/php2shell-italia-csirt-servizi-php-vulnerabili/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Matrice Digitale (Italian), 25 October: CSIRT Italia's alert (AL01/1025/PHP2Shell) puts 285,149 PHP services on potentially vulnerable versions, 81.9%...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, allarme CSIRT Italia: l’81,9% dei servizi PHP risulta vulnerabile - Matrice Digitale\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/matricedigitale/2026-10-25-php2shell-italia-csirt-servizi-php-vulnerabili`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMatrice Digitale (Italian), 25 October: CSIRT Italia's alert (AL01/1025/PHP2Shell) puts 285,149 PHP services on potentially vulnerable versions, 81.9% of the 348,130 services with an identified version. It recaps the two CVEs (9.2) and a third, CVE-2026-115560, for which no patch exists and the CSIRT recommends a vendor-published mitigation, and tells administrators, hosting providers and infrastructure managers to act at once. It notes the picture is mainly one of delay in updating internet-exposed installations. Same alert as the CyberSecItalia item (cybersecitalia-lalert-dellacn-in-italia-a-rischio-vulne), which gives the 741,523 total.\n\n> Il CSIRT Italia rileva 285.149 servizi PHP con versioni potenzialmente vulnerabili a PHP2Shell, pari all’81,9% dei 348.130 servizi con versione identificata.\n\n_Curator's translation:_ \"CSIRT Italia detects 285,149 PHP services with versions potentially vulnerable to PHP2Shell, equal to 81.9% of the 348,130 services with an identified version.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, allarme CSIRT Italia: l’81,9% dei servizi PHP risulta vulnerabile - Matrice Digitale\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "medcom-teknologi-news-teknologi-en442w3n-bssn-p", "url": "https://www.medcom.id/teknologi/news-teknologi/eN442w3N-bssn-peringatkan-celah-php2shell-jutaan-website-berisiko-diserang", "publisher": "Medcom.id", "kind": "news", "title": "BSSN Peringatkan Celah PHP2Shell, Jutaan Website Berisiko Diserang", "published": "2026-10-22T23:03:00+0700", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "526a962ae0b8236e4aa56e42859bae7123af2ed59fc62ab73dc7e1da4240860a", "bytes": 361 }, "page.html": { "sha256": "af1add52dd3742d353822df96632c7d0542dd68f293d4781c992176606189ab5", "bytes": 82389 }, "provenance.json": { "sha256": "cee23246b61dc37b31f2a0a545e1940599da7100f3a7929d5b57dab7c8139e4d", "bytes": 1668 }, "text.txt": { "sha256": "855fcadf4fce89cba83f30ec7908f40eae370f9e4f3e50b826ddee04c74662f0", "bytes": 5543 } }, "started_utc": "2026-10-23T16:16:33.026Z", "status": 200, "final_url": "https://www.medcom.id/teknologi/news-teknologi/eN442w3N-bssn-peringatkan-celah-php2shell-jutaan-website-berisiko-diserang" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id-ID", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Medcom.id (Indonesian), 22 October: BSSN, Indonesia's National Cyber and Crypto Agency, warns of the two PHP2Shell flaws, which could allow remote cod...", "raw_sha256": {}, "has_notes": true, "notes_md": "# BSSN Peringatkan Celah PHP2Shell, Jutaan Website Berisiko Diserang\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/medcom/teknologi-news-teknologi-en442w3n-bssn-peringatkan-celah-php`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMedcom.id (Indonesian), 22 October: BSSN, Indonesia's National Cyber and Crypto Agency, warns of the two PHP2Shell flaws, which could allow remote code execution without authentication. It lists PHP 8.2 to 8.5 as potentially affected, recommends the fixed versions, and asks site managers to update PHP, restart services or restrict network access as a temporary mitigation.\n\n> BSSN memperingatkan dua celah PHP2Shell yang berpotensi memungkinkan eksekusi kode jarak jauh tanpa autentikasi.\n\n_Curator's translation:_ \"BSSN warns of two PHP2Shell flaws that could potentially allow remote code execution without authentication.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Medcom: Indonesia's National Cyber and Crypto Agency (BSSN) issued a security warning on 22 Oct and posted on X. It names the CVEs, lists PHP 8.2 to 8.5 as affected, recommends the patched versions and a service restart, and says to restrict network access or isolate internet-facing services if patching is not yet possible.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"BSSN Peringatkan Celah PHP2Shell, Jutaan Website Berisiko Diserang\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id-ID`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "mediaindonesia-teknologi-947268-celah-keamanan-php-dite", "url": "https://mediaindonesia.com/teknologi/947268/celah-keamanan-php-ditemukan-ai-pemerintah-dan-situs-global-lakukan-pemadaman", "publisher": "Media Indonesia", "kind": "news", "title": "Celah Keamanan PHP Ditemukan AI, Pemerintah dan Situs Global Lakukan Pemadaman", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "4d62a0152431c3031665bb89a594dce2ce44b4267b69ba67a989bd5ad539381f", "bytes": 1183 }, "page.html": { "sha256": "c598431bdbebe5f0133f370e49ab8c27bb4e28bd39e5f01fb2098bdadf88bbd3", "bytes": 87820 }, "provenance.json": { "sha256": "9115ba0e1e6e559bd57d130d068c762f7730ca5d6bc0f7a71f609e30541b8925", "bytes": 1852 }, "rendered.html": { "sha256": "81725165b34fb73d4c3b28b3bb6e69ee9b52a98b70365f4f8b94d8411fbd5302", "bytes": 338886 }, "screenshot.jpg": { "sha256": "1997abde87a46bbd470646b07a49e9186f41c3a3c867b0f33e75fd8150525691", "bytes": 470168 }, "text.txt": { "sha256": "cf7d08e38622b59aa531459fce47543a1f1d52a0b3b39eb8f82a1d178a4824a5", "bytes": 7230 } }, "started_utc": "2026-10-23T16:16:33.028Z", "status": 200, "final_url": "https://mediaindonesia.com/teknologi/947268/celah-keamanan-php-ditemukan-ai-pemerintah-dan-situs-global-lakukan-pemadaman" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Media Indonesia, a PHP2Shell piece: a security hole in PHP found by AI, governments and global sites carry out shutdowns. It says the PHP2Shell vulner...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Celah Keamanan PHP Ditemukan AI, Pemerintah dan Situs Global Lakukan Pemadaman\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/mediaindonesia/teknologi-947268-celah-keamanan-php-ditemukan-ai-pemerintah`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMedia Indonesia, a PHP2Shell piece: a security hole in PHP found by AI, governments and global sites carry out shutdowns. It says the PHP2Shell vulnerability found by AI threatens millions of websites and that experts call it the worst cybersecurity crisis since Heartbleed.\n\n> Kerentanan PHP2Shell yang ditemukan AI mengancam jutaan situs web.\n\n_Curator's translation:_ \"The PHP2Shell vulnerability found by AI threatens millions of websites.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Media Indonesia rewrite of BBC coverage: governments urged patching or temporary shutdowns. Finland, Dutch RIVM and the Tweede Kamer, Wikimedia, Edinburgh council, DeviantArt and BBC programme pages went offline. Japan's PM Takaichi urged the public to check sites, and Sophos and Huntress are quoted.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Celah Keamanan PHP Ditemukan AI, Pemerintah dan Situs Global Lakukan Pemadaman\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "medianama-2026-10-223-php-vulnerabilities-global-rush-update", "url": "https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/", "publisher": "MediaNama", "kind": "news", "title": "What are the two PHP vulnerabilities behind a global rush to update", "published": "2026-10-22", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "ee157858bcb602c0c1ce9b7372c50ba7d675acd38b035c7cf8d465dcf3f48c2e", "bytes": 991 }, "page.html": { "sha256": "11383a14b16bc87a3cc06ec7634aeb3baf026b2cc373ad339f5c2a089cfa441a", "bytes": 95061 }, "provenance.json": { "sha256": "a10e2b5d071b21abd84e83601f2d4bafc27985668bb9f35ec7e43f5ebfcbb2e6", "bytes": 1728 }, "rendered.html": { "sha256": "784c7da38952ea9ba7b2a655e2e41fcbf0ed138188bfd74f7861e9a2931cf29f", "bytes": 99545 }, "screenshot.jpg": { "sha256": "e6084674816cdad668b6e423b809d50a32e464c382d5286130604b537a41748a", "bytes": 735737 }, "text.txt": { "sha256": "b30b86dc910dc8d60cbb6deaf6383d04f99c68b984c5d04673dd949e1cb4f04d", "bytes": 10521 } }, "started_utc": "2026-10-23T08:18:23.413Z", "status": 200, "final_url": "https://www.medianama.com/2026/10/223-php-vulnerabilities-global-rush-update/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). AZDHAN: the flaws were disclosed on 21 October with patches and named 'php2shell' by Ryan Austin at Calif, who published a paper. It says PHP 5.4 through 8.5.11...", "raw_sha256": {}, "has_notes": true, "notes_md": "# What are the two PHP vulnerabilities behind a global rush to update\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `in/news/medianama/2026-10-223-php-vulnerabilities-global-rush-update`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAZDHAN: the flaws were disclosed on 21 October with patches and named 'php2shell' by Ryan Austin at Calif, who published a paper. It says PHP 5.4 through 8.5.11 are vulnerable, India's CERT-In rates the risk high, and CERT-EU and CISA also issued advisories.\n\n> remote code execution and complete system compromise.\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "miltonkeynes-must-read-astra-security-launches-free-t", "url": "https://www.miltonkeynes.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867", "publisher": "Milton Keynes Citizen", "kind": "news", "title": "Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities", "published": "2026-10-23T14:57:09.000Z", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "55198ccc5170c3b3d540f1cc158507a7564a9a1894a705f4f7f8546f8e4ebdf1", "bytes": 1509 }, "page.html": { "sha256": "4f56247754677abaa151428c7ac908cc2d1d683f7ea05e9fe74a3d5cd75da6b1", "bytes": 231359 }, "provenance.json": { "sha256": "2d9e12ba2172fd1ca6f46b6d5244945530fb3a37fd81de23d88bf98a6b22a795", "bytes": 1897 }, "rendered.html": { "sha256": "0462f2d1a075fec4568e57fbaa0251eef9d5e2fb7958e0235c29b8dc4ba507a0", "bytes": 237625 }, "screenshot.jpg": { "sha256": "2b637f018b47e9ca86864363bc3305dfa3d88183a5786c6839beaf525477567c", "bytes": 344391 }, "text.txt": { "sha256": "c4a894f10da9042e9411c86a9764e204e4510e468ca0973fffc813c10155e9bb", "bytes": 6927 } }, "started_utc": "2026-10-23T23:33:14.492Z", "status": 200, "final_url": "https://www.miltonkeynes.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Milton Keynes Citizen, 23 October: a syndicated press release from Astra Security, a security vendor, announcing two free tools to help organisations...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/miltonkeynes/must-read-astra-security-launches-free-tools-to-help-organis`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMilton Keynes Citizen, 23 October: a syndicated press release from Astra Security, a security vendor, announcing two free tools to help organisations assess their exposure to PHP2Shell and support remediation. Vendor marketing, repeated by several local news sites with the same text (also in the Peterborough Telegraph, Sunderland Echo and SussexWorld captures). The curator did not fetch or run the tools.\n\n> Astra Security has released two free tools to help organisations assess their exposure to the recently disclosed PHP2Shell vulnerabilities and support remediation efforts.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "moncloa-2026-10-22-vulnerabilidad-php2shell-fall", "url": "https://www.moncloa.com/2026/10/22/vulnerabilidad-php2shell-fallo-critico-ia-3453167/", "publisher": "MONCLOA.COM", "kind": "news", "title": "La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial", "published": "2026-10-22T09:55:12+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "43425b1dbaa35825bffd5af2d6c40ecf455de6acb0c0f380c999f15a33c1e6a0", "bytes": 3015 }, "page.html": { "sha256": "a218ae80394ff14f952df41dbe2190a8453767a9809e136d6a63a95513e8ea42", "bytes": 836913 }, "provenance.json": { "sha256": "9e0107b70d9d92bcadeebd216ff30a4fcc520affdf6724a2c4047bdae0b3421d", "bytes": 1786 }, "rendered.html": { "sha256": "61bc44b62bef2214661ea769e869132d05fc419dbbcaefb8495d77aff9fe489a", "bytes": 836519 }, "screenshot.jpg": { "sha256": "26c53f68097b0952bbe0c13d10af60373e00d3c30e7193a0233f91d1d7c6e35f", "bytes": 540124 }, "text.txt": { "sha256": "b6c5efbb52b2517a92d8c5f05ccf4f3df911394881bc73fef1287e6822f69626", "bytes": 8169 } }, "started_utc": "2026-10-23T16:09:13.243Z", "status": 200, "final_url": "https://www.moncloa.com/2026/10/22/vulnerabilidad-php2shell-fallo-critico-ia-3453167/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Moncloa.com (Spanish), 22 October: the AI discovers the PHP2Shell vulnerability, the critical PHP flaw that exposes 70% of the world's web. It says an...", "raw_sha256": {}, "has_notes": true, "notes_md": "# La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/moncloa/2026-10-22-vulnerabilidad-php2shell-fallo-critico-ia-3453167`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMoncloa.com (Spanish), 22 October: the AI discovers the PHP2Shell vulnerability, the critical PHP flaw that exposes 70% of the world's web. It says an OpenAI model found the flaw, that it affects banks, shops and public services, and that the coordinated patch arrives 'this Thursday 22 October' after a Chainguard leak, following two months of work under embargo. The patch was in fact released on Wednesday 21 October; the outlet's date is wrong, and its 'Chainguard leak' wording is its own.\n\n> El parche coordinado llega este jueves 22 de octubre tras una filtración de Chainguard.\n\n_Curator's translation:_ \"The coordinated patch arrives this Thursday 22 October after a Chainguard leak.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Moncloa.com explains PHP2Shell, the AI discovery and the Chainguard leak. It then gives a generic Spanish angle: SMEs, online shops and administration portals are exposed, and INCIBE and CCN-CERT are the bodies expected to issue alerts.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "morgenpost-politik-article413475223-weltweite-siche", "url": "https://www.morgenpost.de/politik/article413475223/weltweite-sicherheitsluecke-zahlreiche-webseiten-werden-abgeschaltet.html", "publisher": "Berliner Morgenpost", "kind": "news", "title": "PHP-Sicherheitslücke und Hacker-Angriffe: Viele Websites wieder online", "published": "2026-10-22T12:32:41.000Z", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "6932a2fce0d33d0deabcbdd76a371593f894435e90175c9458d1bb1f6455b975", "bytes": 711 }, "page.html": { "sha256": "c99b082464f9e8666d2dfd752dc3ad6a50701d99675aab2ab2bb61cd7301229a", "bytes": 365980 }, "provenance.json": { "sha256": "4d524cf800f97e5bb620fc71475d2e28930effa00e6dd9c8c2bc5784c004ed16", "bytes": 1691 }, "text.txt": { "sha256": "d74246f0d89bb48b410f6da43dec7b755f8f15b3a3cee7d07858fc4f7592ad9e", "bytes": 10139 } }, "started_utc": "2026-10-24T08:44:59.815Z", "status": 200, "final_url": "https://www.morgenpost.de/politik/article413475223/weltweite-sicherheitsluecke-zahlreiche-webseiten-werden-abgeschaltet.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Berliner Morgenpost (German), 22 October: many websites back online; the PHP2Shell vulnerability triggered millions of attack attempts worldwide. Acco...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Sicherheitslücke und Hacker-Angriffe: Viele Websites wieder online\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/morgenpost/politik-article413475223-weltweite-sicherheitsluecke-zahlrei`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBerliner Morgenpost (German), 22 October: many websites back online; the PHP2Shell vulnerability triggered millions of attack attempts worldwide. According to Cloudflare's chief executive, criminal actors began scanning the worldwide network for unprotected servers immediately after the details became known, and within a few hours access attempts rose exponentially.\n\n> PHP2Shell-Sicherheitslücke löst weltweit Millionen Angriffsversuche aus\n\n_Curator's translation:_ \"PHP2Shell vulnerability triggers millions of attack attempts worldwide\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Berliner Morgenpost says many sites that went offline are back, while a wave of attacks continues, citing Cloudflare's Matthew Prince. It cites the BSI warning, states, municipalities, universities and hospitals going offline, and Digital Minister Karsten Wildberger seeing no sign that federal sites were affected.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Sicherheitslücke und Hacker-Angriffe: Viele Websites wieder online\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "moroccoworldnews-2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu", "url": "https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/", "publisher": "Morocco World News", "kind": "news", "title": "Morocco’s DGSSI Warns of Critical ‘PHP2Shell’ Vulnerabilities", "published": "2026-10-22", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "f51d49ff2934353321b804f16536cfec7fc66697ee3b305572c023d2c6c2d6dd", "bytes": 863 }, "page.html": { "sha256": "f9e9d6407bc111b7b2ded3ebe5c64bcdcdba311441620104c6fa326a2d032bde", "bytes": 262781 }, "provenance.json": { "sha256": "f129b2291c1142a9ea132fdd0bc5623f37d49ab5c8dae870e4a48fe92458dbd6", "bytes": 1839 }, "rendered.html": { "sha256": "9f8a8f67c9fcedbe8ec73019b15f00e4f3ad9ca3b0510a542397bd411941291c", "bytes": 314791 }, "screenshot.jpg": { "sha256": "24f9199e5f1dc3934486d5b71a33c1d4e497e3e1192e667a20afc1fc9a5a7515", "bytes": 394771 }, "text.txt": { "sha256": "56b8e97d863b6884f74d8af7f5d2b7cae0e071eb875027895e35e8c483eaacdc", "bytes": 4275 } }, "started_utc": "2026-10-23T08:17:03.859Z", "status": 200, "final_url": "https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "96afc786c13047fabbbb8ddd87df4db936471b5c46a0d67d8149b76fd174b045", "bytes": 864 }, "page.html": { "sha256": "ce5cd0fc6fe7b74599506c6d8b91c9b6bee9f09c61754925b3f591862be4e718", "bytes": 276203 }, "provenance.json": { "sha256": "58e5bf80ec39e90fc46df548e21b3f21fd78a94976f7397baf625ebb31902729", "bytes": 1840 }, "text.txt": { "sha256": "384fd855e0fa5ebcfd79a4253dc6b8c75891247e15ca6ccb7a8ca34414c7ba58", "bytes": 4756 } }, "started_utc": "2026-10-23T16:15:47.409Z", "status": 200, "final_url": "https://www.moroccoworldnews.com/2026/10/343335/moroccos-dgssi-warns-of-critical-php2shell-vulnerabilities/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Oumaima Moho Amer: Morocco's DGSSI issued a critical bulletin, reference 69782110/26, on the two flaws, saying proof-of-concept code is available. PHP is used b...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Morocco’s DGSSI Warns of Critical ‘PHP2Shell’ Vulnerabilities\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `gb/news/moroccoworldnews/2026-10-343335-moroccos-dgssi-warns-of-critical-php2shell-vu`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nOumaima Moho Amer: Morocco's DGSSI issued a critical bulletin, reference 69782110/26, on the two flaws, saying proof-of-concept code is available. PHP is used by 75.4% of .ma sites whose server language is identifiable, per W3Techs.\n\n> published the bulletin on Wednesday under reference number 69782110/26\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "mt-tech-2026-10-24-2026102414170377166", "url": "https://www.mt.co.kr/tech/2026/10/24/2026102414170377166", "publisher": "머니투데이", "kind": "news", "title": "PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이", "published": "2026-10-24T14:26:36+09:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "78f7a8b030886216969762f32bc1d809c0a474a33892878583c433cdb45c737c", "bytes": 1516 }, "page.html": { "sha256": "41ff83151d4b3d797c3d6fde55f50ccbe4375c3bdba2aadb694844b52cb76e50", "bytes": 76145 }, "provenance.json": { "sha256": "b68e30f647833828851f0a85a2e813a13417c62d914523908882dc9ade73993d", "bytes": 1504 }, "text.txt": { "sha256": "c4b5b04752433be6012bd4ac2637ae2b30e7fc9b49dc10d66a21be5efc0e6ef9", "bytes": 6796 } }, "started_utc": "2026-10-24T13:52:44.640Z", "status": 200, "final_url": "https://www.mt.co.kr/tech/2026/10/24/2026102414170377166" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Money Today (Korean), 24 October: signs of North Korean hacking planning exploiting the PHP vulnerability, with South Korea, the US and Japan as core...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/mt/tech-2026-10-24-2026102414170377166`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMoney Today (Korean), 24 October: signs of North Korean hacking planning exploiting the PHP vulnerability, with South Korea, the US and Japan as core targets. It says the global cybersecurity firm Cyfirma reported in a security report the day before that Korean-speaking hackers were seen planning attacks exploiting the flaw, suspected to be North Korean, in an activity it named 'June 2026 Minjun'; no actual intrusion has been found. The same single Cyfirma report as the EBN and Korea Economic Daily items.\n\n> 다만 실제 침해 사례가 발견되진 않았다.\n\n_Curator's translation:_ \"However, no actual intrusion case has been found.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "muycomputer-2026-10-21-php2shell-el-fallo-de-php-que", "url": "https://www.muycomputer.com/2026/10/21/php2shell-el-fallo-de-php-que-ha-puesto-en-jaque-a-internet/", "publisher": "MuyComputer", "kind": "news", "title": "PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet", "published": "2026-10-21T17:21:39+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "57a9d2a059d52772b3ffb5aabd3d1fb49e679144ed83562468d751d4fbb63cb3", "bytes": 1125 }, "page.html": { "sha256": "12342e01d2cb41cd40ee5aae407a9f1b731c14f50756d61e4f7c9422ebc82b27", "bytes": 198655 }, "provenance.json": { "sha256": "23bc37bbc4efb9bf93dfbdf82320b401cd05295b63c21ad9bd021a8a45dbb350", "bytes": 1780 }, "rendered.html": { "sha256": "e628fee8b55ecdda4144f2a4a171d626bd22eceee7cfd360a665479ac565ed8b", "bytes": 265171 }, "screenshot.jpg": { "sha256": "60e0a43871f2c79e7663ddedb9cd647a946a6290d308a079cd21aa42f93b5208", "bytes": 1070763 }, "text.txt": { "sha256": "61c7b6c00f7eeb0477aa0a315fea86c01b786193082188d18a15becbd98e4099", "bytes": 21496 } }, "started_utc": "2026-10-23T16:09:13.889Z", "status": 200, "final_url": "https://www.muycomputer.com/2026/10/21/php2shell-el-fallo-de-php-que-ha-puesto-en-jaque-a-internet/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). MuyComputer (Spanish), 21 October: PHP2Shell, the PHP flaw that has put the Internet in check. The incident has its origin in two vulnerabilities in P...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/muycomputer/2026-10-21-php2shell-el-fallo-de-php-que-ha-puesto-en-jaque`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMuyComputer (Spanish), 21 October: PHP2Shell, the PHP flaw that has put the Internet in check. The incident has its origin in two vulnerabilities in PHP's engine, CVE-2026-109618 and CVE-2026-109619, severity 9.2, which under certain conditions allow remote code execution without authentication, even when the affected applications themselves are secure. A long page (about 21,000 characters); the opening was read.\n\n> El incidente, conocido como PHP2Shell, tiene su origen en dos vulnerabilidades del motor de PHP, identificadas como CVE-2026-109618 y CVE-2026-109619, con una gravedad de 9,2 sobre 10.\n\n_Curator's translation:_ \"The incident, known as PHP2Shell, originates in two vulnerabilities in PHP's engine, identified as CVE-2026-109618 and CVE-2026-109619, with a severity of 9.2 out of 10.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ MuyComputer gives a long technical explainer of CVE-2026-109618/109619, which SAPIs are exposed, and how the problem first identified in 2024 grew into a global emergency. It mentions precautionary disconnections only in general terms.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "mynet-php-guvenlik-acigi-alarmi-iki-kritik-aci", "url": "https://www.mynet.com/php-guvenlik-acigi-alarmi-iki-kritik-acik-bulundu-php-nedir-ne-ise-yarar-190101302483", "publisher": "Mynet", "kind": "news", "title": "PHP güvenlik açığı alarmı! İki kritik açık bulundu: PHP nedir, ne işe yarar? - TREND", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2ba13f4cc0e6ecc51e2b3c9279fe083ac9198d9c969ddc313d76656239d619ff", "bytes": 765 }, "page.html": { "sha256": "0225305288ac670a973acd5e47b7b0d8c2135c7a36266648795c9a45d3205a34", "bytes": 151189 }, "provenance.json": { "sha256": "19dd8cd3cff169c8bf7ffc6efc92ad1e3aea748b51b20c1df635f3295ba0c3b0", "bytes": 1664 }, "text.txt": { "sha256": "526ad8cca6bc26bb43d83c72029e335adf3b6fe69a95ba2af3280736b9c4399e", "bytes": 15701 } }, "started_utc": "2026-10-23T16:25:54.300Z", "status": 200, "final_url": "https://www.mynet.com/php-guvenlik-acigi-alarmi-iki-kritik-acik-bulundu-php-nedir-ne-ise-yarar-190101302483" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Mynet / Trend (Turkish): PHP security alarm, two critical flaws found; what PHP is and what it does. The two flaws, named PHP2Shell, may let attackers...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP güvenlik açığı alarmı! İki kritik açık bulundu: PHP nedir, ne işe yarar? - TREND\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/mynet/php-guvenlik-acigi-alarmi-iki-kritik-acik-bulundu-php-nedir`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMynet / Trend (Turkish): PHP security alarm, two critical flaws found; what PHP is and what it does. The two flaws, named PHP2Shell, may let attackers run code without authorisation on servers under certain conditions; each is rated 9.2 on CVSS v4.0; the PHP developers released the fixes on 21 October.\n\n> CVE-2026-109618 ve CVE-2026-109619 kodlarıyla tanımlanan güvenlik açıklarının her biri, CVSS v4.0 değerlendirme sisteminde 10 üzerinden 9,2 önem derecesine sahip.\n\n_Curator's translation:_ \"The vulnerabilities identified by the codes CVE-2026-109618 and CVE-2026-109619 each have a severity of 9.2 out of 10 on the CVSS v4.0 scoring system.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Mynet explainer on what PHP is and what PHP2Shell does, based on the official advisory. It notes that Turkey's Cyber Security Presidency activated national preventive measures.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP güvenlik açığı alarmı! İki kritik açık bulundu: PHP nedir, ne işe yarar? - TREND\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ncsc-news-php", "url": "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "publisher": "UK National Cyber Security Centre (NCSC)", "kind": "advisory", "title": "Critical security issue affecting PHP", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080903Z", "files": { "headers.json": { "sha256": "642ad2462903a32f7050dae5e198654e710dadc0a6225333d96370031c7ede4c", "bytes": 852 }, "page.html": { "sha256": "2d8e9e72ec5efa695b2d587a4af1bcb75662ead0add90b964cf767e8023ff4f8", "bytes": 225168 }, "provenance.json": { "sha256": "fe3daad10ed2709f256ce5547b2a21d8b35120fe041248d698a63d75652a19fb", "bytes": 1025 }, "rendered.html": { "sha256": "0b839c8974dc2310cc6f85d334620ae5b5cd944842d6de180bf76938f5b6dcf5", "bytes": 761056 }, "screenshot.png": { "sha256": "260b9c91a3bf1a838fd1a81633415032eacd24ccaf249c11227903c6038b4544", "bytes": 542775 }, "text.txt": { "sha256": "a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339", "bytes": 5135 } }, "started_utc": "2026-10-22T08:09:03.936Z", "status": 200, "final_url": "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "NCSC Alert. Page: PUBLISHED 21 October 2026; JSON-LD dateModified 2026-10-22; HTTP last-modified Thu, 22 Oct 2026 07:30:02 GMT. Names CVE-2026-109618 and CVE-2026-109619. Advice: update; else PHP Foundation temporary mitigations; 'If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.' Wording differs from BBC's quote.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC (UK) alert: Critical security issue affecting PHP\n\n- URL: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (NEWS TYPE: Alert)\n- Stated: \"PUBLISHED 21 October 2026\". JSON-LD `datePublished` 2026-10-21, `dateModified` 2026-10-22. HTTP `last-modified: Thu, 22 Oct 2026 07:30:02 GMT`. The NCSC all-feed RSS lists it as `Wed, 21 Oct 2026 12:00:00 +0000`, but every item in that feed is 12:00, so the time is a placeholder and only the date counts.\n- Captured 2026-10-22T08:09Z (capture 20261022T080903Z).\n- CVEs named: CVE-2026-109618 and CVE-2026-109619. Links to GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w (php/php-src), and to NCSC-NL's php2shell repo (https://github.com/NCSC-NL/php2shell).\n\n## Exact advice (priority actions, verbatim)\n1. \"Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions...\"\n2. \"Update to the latest version of PHP and continue to monitor for future updates.\"\n3. \"If you are unable to update to a version with the security update applied, the PHP Foundation have provided temporary mitigations.\"\n4. \"If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.\"\n5. \"If you are unable to update or disable the system immediately then you should assess the system for any evidence of compromise ... and look for backdoors installed by an attacker.\"\n6. Monitor third-party vendors that bundle PHP; points to the NCSC-NL inventory.\n\n## Oddities\n- The BBC live page quotes the NCSC as saying \"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.\" That sentence is NOT on the page as captured at 08:09Z. The page carries the offline advice as step 4 (quoted above). The page was modified on 22 Oct (last-modified 07:30:02 GMT), so the BBC may have quoted an earlier version, or a different NCSC note. Open question: find an earlier copy (Wayback?).\n- \"Organisations using any version of PHP are affected\".\n" }, { "slug": "ncsc-nl-advisories", "url": "https://advisories.ncsc.nl/advisories", "publisher": "NCSC-NL", "kind": "advisory", "title": "NCSC NL | Security Advisories (PHP banner: Ernstige kwetsbaarheden in PHP: bereid je voor op patchen)", "published": null, "captures": [ { "stamp": "20261022T081605Z", "files": { "headers.json": { "sha256": "3e389f62cb8a1de496ebc873bbcfb98ccf729f22e1ec56c94d0893bba1bef324", "bytes": 884 }, "page.html": { "sha256": "c0c4e5aa82e2eaec26497f7eb201c72888ecdcb1361964f73aab7b5dcc046c5f", "bytes": 240 }, "provenance.json": { "sha256": "cd3655ebd5a05e5e7a94cfc0438e17c9f78418f1c570bf5097613f30ba7612ca", "bytes": 980 }, "rendered.html": { "sha256": "f008b1f5da4c00459105f979db89eebc16702be90d3a6de1656acfab41951cc6", "bytes": 69813 }, "screenshot.png": { "sha256": "9bd5b7a047aff8b7f81e8c61b6f1ccc1475f7be1ad89a7d9d32a6f2aee84abbe", "bytes": 611099 }, "text.txt": { "sha256": "b7e4ac6caf7d177d8b7e55fa8c587da75a1e78fafc951012d2d2595a6dfa5e8b", "bytes": 8130 } }, "started_utc": "2026-10-22T08:16:05.152Z", "status": 200, "final_url": "https://advisories.ncsc.nl/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Final URL advisories.ncsc.nl/. A banner is still the pre-patch text: 'bereid je voor op patchen', patch expected '21 oktober 16:00 Nederlandse tijd'; 'Er is een publieke Proof of Concept (PoC)- code beschikbaar, maar het NCSC heeft nog geen actief misbruik gesignaleerd.' Affects 'alle versies vanaf versie 5'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC-NL advisories portal (PHP banner)\n\nCaptured 08:16Z. The PHP banner is still the pre-patch version: \"Ernstige kwetsbaarheden in PHP: bereid je voor op patchen\" (serious PHP flaws: prepare to patch). It advises preparing for \"een komende patch op 21 oktober 16:00 Nederlandse tijd\" (=14:00Z) and says \"Dit tijdstip kan eventueel worden vervroegd\" (that time may be brought forward). It says a public PoC exists but NCSC-NL has seen no active abuse (\"nog geen actief misbruik gesignaleerd\"). It names WordPress, Joomla, Drupal, Zabbix and Roundcube as PHP-based. ENISA CNW quotes this text. No offline advice was seen in the captured part. We did not identify the individual NCSC-2026-xxxx advisory URL.\n" }, { "slug": "ncsc-nl-php2shell", "url": "https://github.com/NCSC-NL/php2shell", "publisher": "NCSC-NL (Netherlands National Cyber Security Centre)", "kind": "advisory", "title": "NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilities", "published": "2026-10-21T15:25:00Z", "captures": [ { "stamp": "20261022T080925Z", "files": { "headers.json": { "sha256": "dbef75c6f088a0a21eeac77ab2178aead9e625d6ed750dd4894fc7fb9537f297", "bytes": 5443 }, "page.html": { "sha256": "4e1f8dc6dd2c6d494b9d1229a0de601b0e1096e81337d8a4b5b06fa7c3c293ce", "bytes": 261528 }, "provenance.json": { "sha256": "939b683f13402c1f5d315ff79800619b30e3780d4eb31bfc2b17282148c8e03a", "bytes": 1005 }, "rendered.html": { "sha256": "323e0a19a3dd13c2b214ff7b1a8553eacac4c17bdfb8b8c1a9bf2032781934db", "bytes": 273849 }, "screenshot.png": { "sha256": "a27d227bafcdfbc38ca5c431a5fb525aa95eeac6e7bfbe31c98ae8057c2e4d64", "bytes": 494937 }, "text.txt": { "sha256": "8944dd45c25fa7c1fc1c6f3e2a646d86fe0849a83248fe1f91cec791a58589e6", "bytes": 4852 } }, "started_utc": "2026-10-22T08:09:25.035Z", "status": 200, "final_url": "https://github.com/NCSC-NL/php2shell" }, { "stamp": "20261022T084815Z", "files": { "headers.json": { "sha256": "dc374a245415e7981501c8d9adea6d18ac20101116a21380bafe62b351dba7c0", "bytes": 5453 }, "page.html": { "sha256": "556efff0dd62f6bdf88e3ed5566f6f2213e828b2bbfeba7eef0b3cd3ac622057", "bytes": 261276 }, "provenance.json": { "sha256": "7544f40915d6c5cb74cdc60621deee2e3d7773de3a0191201caf4089fbd5d094", "bytes": 1005 }, "rendered.html": { "sha256": "42194f5b28315e862789c25ed7c3a2bbbfa3244da3bb68e8e3ff284f321ccd38", "bytes": 275802 }, "screenshot.png": { "sha256": "c6a14bc8234e3b2b5692240e1f2821e9e80e51e52bd5bec2e89dcf3a7a8a1764", "bytes": 497834 }, "text.txt": { "sha256": "f3eec24a226910fb8440714b4f44c40db5c5f7826f3c23b65aece1cc5775712e", "bytes": 4854 } }, "started_utc": "2026-10-22T08:48:15.774Z", "status": 200, "final_url": "https://github.com/NCSC-NL/php2shell" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "README: 'Readme last significant change: 21 October 2026 17:25 CEST TLP:CLEAR' (=15:25Z). Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Links to CERT-EU SA 2026-018 and ENISA CNW-2026-04. Holds the software inventory list (the NCSC UK cites it). Does NOT advise taking systems offline.", "raw_sha256": { "commits-cca173c64ec5.txt": "4d4f80bd9da0076e2bd74323e947a05f1e0f1a246a5a25b2874dd9370b4a2ea9", "php2shell-cca173c64ec5.bundle": "4a72bcc9bbc58e886df6eee7cc875bd5deab547f1028f7525a7e7e808859411f", "software-list-cca173c64ec5.json": "f0a17e96a336a8782231290acf4ba4a4f4fa469270c59a7c87a95da2207dad01" }, "has_notes": true, "notes_md": "# NCSC-NL php2shell GitHub repository\n\n- https://github.com/NCSC-NL/php2shell (EUPL-1.2). At the 08:09Z capture: 145 stars, 40 forks, 6 contributors.\n- \"Readme last significant change: 21 October 2026 17:25 CEST TLP:CLEAR\"\n- It says the CVEs are \"tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619\".\n- Fixed releases: \"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35\". Source backports for 7.4, 8.0 and 8.1. Affected SAPIs: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed, with the \"risk highest for mod_php\".\n- Recommended actions (verbatim): \"Identify PHP-based applications and their runtime versions...\"; \"Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply vendor-provided backported packages.\"; \"If immediate patching is not possible, follow PHP's temporary mitigations, including disabling session.upload_progress, restarting workers, and reviewing the official memory_limit, post_max_size and PHP 8.5 fatal_error_backtraces guidance. PHP states that these measures are not complete fixes.\"\n- NCSC-NL does NOT advise taking systems offline, which sets it apart from the NCSC (UK) and the NSA.\n- Links: CERT-EU SA 2026-018, ENISA CNW advisories/2026/CNW-2026-04_php.md, and php.net archive #2026-10-21-5.\n\n## Added by claude-newsroom-lead, 2026-10-22T08:48Z (the editor pointed to this repo for affected systems)\n- `raw/php2shell-cca173c64ec5.bundle`: a git bundle of the whole repository, all refs, with 52 commits (`git clone php2shell-cca173c64ec5.bundle`). HEAD is cca173c64ec5db9211fcbd0fcf3a57c22cfbc2fb, committed 2026-10-22T10:40:58+02:00 (the merge of PR #10).\n- `raw/tree-cca173c64ec5/`: the files at that commit. `raw/commits-cca173c64ec5.txt`: the log.\n- `raw/software-list-cca173c64ec5.json`: software/software_list_*.md parsed into rows (supplier, product, version, a status per CVE, notes, links). 674 entries: 206 Vulnerable, 46 Fix, 418 Investigation, 3 Not vuln, and 1 runtime anchor with no status. The list is generated from software/spdx/PHP_Downstream_Inventory.spdx3.json (VEX). NCSC-NL says entries are \"investigation leads\" until a vendor or upstream source backs them.\n- The README calls the CVEs CVE-2026-109618 and CVE-2026-109619. The repo holds cPanel detection and mitigation (detection_mitigation/cpanel/php2shell-mitigate.sh).\n- Licence EUPL-1.2.\n" }, { "slug": "ncsc-nl-php2shell-software-list", "url": "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md", "publisher": "NCSC-NL (Netherlands National Cyber Security Centre)", "kind": "government", "title": "List of software with PHP dependency potentially affected by php2shell CVEs", "published": "generated from the repo's SPDX inventory; commit cca173c64ec5 at 2026-10-22T08:40:58Z", "captures": [ { "stamp": "20261022T084807Z", "files": { "headers.json": { "sha256": "ced0e6933669176a62c459545b9b58df2ecd44f502200c04ac548e8bf513cf2d", "bytes": 5624 }, "page.html": { "sha256": "b6810b0801213bba67b7fff83b519ffc971c4271b217cf2ab4083ecee77d2c81", "bytes": 223836 }, "provenance.json": { "sha256": "d02a4a269f2919ede5233e84a57e72d3dc9adb56e4d98d2ca23fb319384925b9", "bytes": 1059 }, "rendered.html": { "sha256": "ed0e84fc69079d5df2c192b657719a25a29e9ce62aae2034ece866b27ee6c079", "bytes": 288875 }, "screenshot.png": { "sha256": "c610a27540c7c58e4e02cc90bc268c1a5f5b8bd8295fd543badb47cfcdad0e3c", "bytes": 137355 }, "text.txt": { "sha256": "83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004", "bytes": 1255 } }, "started_utc": "2026-10-22T08:48:07.746Z", "status": 200, "final_url": "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md" } ], "status": "captured", "primary": true, "added_by": "claude-newsroom-lead", "notes": "Pointed out by the editor as the source for affected systems. 674 entries at commit cca173c64ec5. CVE-2026-109618: Fix 46, Investigation 418, Vulnerable 206, Not vuln 3. The parsed list, the repo bundle and the tree are in ../ncsc-nl-php2shell/raw/.", "raw_sha256": {}, "has_notes": false }, { "slug": "ncsc-nl-php2shell-software-list-letters", "url": "https://github.com/NCSC-NL/php2shell/tree/main/software", "publisher": "NCSC-NL", "kind": "government", "title": "NCSC-NL php2shell software inventory, all 27 per-letter files (snapshot 18:36 UTC, 22 October 2026)", "published": "the files as served by raw.githubusercontent.com at 2026-10-22T18:36:24Z", "captures": [ { "stamp": "20261022T183624Z", "files": { "provenance.json": { "sha256": "96fefbdceedc7a77392ab4eb02113b66e1fe23086cee94e7d5915e8d4ba83529", "bytes": 27536 }, "software_list_0-9.headers.json": { "sha256": "8b6c3861a446ab0e235a94c6fe581a8a8c29d07766d05ad27d1081395b00183f", "bytes": 1084 }, "software_list_0-9.md": { "sha256": "e90872af6f1fdb008813a09c19cf47ac5e35273f1b62b22de7f98689543d447e", "bytes": 994 }, "software_list_a.headers.json": { "sha256": "7a031d8aeaabee81d6e88e92327a4ffcc255bc9782d25eabdac5bea4c86839c1", "bytes": 1088 }, "software_list_a.md": { "sha256": "662945741f0143d43f56c10f20b46a595e9e10e3880199fb2b2311b0c89e504a", "bytes": 12423 }, "software_list_b.headers.json": { "sha256": "a5fe813f15d6cfb9a849d51d1f508944ef2049dfe5bd999ab6b8ccbbbb0066d1", "bytes": 1086 }, "software_list_b.md": { "sha256": "cb1e67ea7608987077b79a4681f35965afa555b6592cc5cd8bec8f3c271fd9fb", "bytes": 8636 }, "software_list_c.headers.json": { "sha256": "2942f75360df0abc6202f2202939b60a2e413694c35e62f5e04cf927ae309a3a", "bytes": 1086 }, "software_list_c.md": { "sha256": "43013c1e1db1e111976262680a9e3cda0f4fd17a79352b2db8240528524187fc", "bytes": 40915 }, "software_list_d.headers.json": { "sha256": "ffea5957977ad9253169a44a1bd6143972eda64c577a32f1eb760433b481872f", "bytes": 1087 }, "software_list_d.md": { "sha256": "f56d6989bb7d533935ce59f47ec623db4fd40bc0fb4fcff4b50c35e4b6df9f20", "bytes": 12025 }, "software_list_e.headers.json": { "sha256": "18deb3e0c81d2cfc91bbda13945bca9b5c614d2a0832decd6ff85a09daf61cbd", "bytes": 1085 }, "software_list_e.md": { "sha256": "bc44010fd79ae3c0fb75d072a4fe1eb48b980b4e25a67b6dc5307b052fc9a446", "bytes": 7385 }, "software_list_f.headers.json": { "sha256": "13883536787fbb42283db2b451051ea1e894650295f2ab4a6ca37b427167712d", "bytes": 1087 }, "software_list_f.md": { "sha256": "839e816c660e9b5a6660b8b904d9220919312db233bdb781684934c707164568", "bytes": 18502 }, "software_list_g.headers.json": { "sha256": "ae66666fc2a6dce8318687792be825299dcd76b50f3140572352ce377dc0db3b", "bytes": 1089 }, "software_list_g.md": { "sha256": "a1de1b0e10dd759cd2e3493b78555b76e37eab2e51b99fe9465a54235e29fe6f", "bytes": 9783 }, "software_list_h.headers.json": { "sha256": "19700f8b2fd8516f4356d22200cb19793541f6e547bab91fb4961267b5584ab1", "bytes": 1088 }, "software_list_h.md": { "sha256": "28b2a1ca72e63781edf9d40243b845792217f14d2b24f9faf1e50d3799e3d042", "bytes": 6127 }, "software_list_i.headers.json": { "sha256": "14e4a0a8cdceb3c4488f20c81082c88f53e4f784cb49749d01197631c59f38cb", "bytes": 1086 }, "software_list_i.md": { "sha256": "f25e5ef68d476c053abd638b75441aa462fd630a83d7059696ff675f53fa55eb", "bytes": 9544 }, "software_list_j.headers.json": { "sha256": "9a3a89932a8136873d2329df111b302a69a125a2eea210d176e5c18c5b49c3a9", "bytes": 1084 }, "software_list_j.md": { "sha256": "1fece5bf0287178a9830d55a417ae41064449dc8b07c15145e3dfb21b0e0255f", "bytes": 4328 }, "software_list_k.headers.json": { "sha256": "d6f8dee8005fba048c718ec7143cda2c461dccea10e5a39876e32e7c2d444bd2", "bytes": 1085 }, "software_list_k.md": { "sha256": "50ff337adf97f4e309944fc6e88ca0d2319c5fec10670a4c2c05f2f650fc1399", "bytes": 4978 }, "software_list_l.headers.json": { "sha256": "db1c368cbf02cfa10e902e7b9926ffd976c0caa6258da644484a8218afcf2822", "bytes": 1087 }, "software_list_l.md": { "sha256": "0250e097e5e08cb8ec83f1bbd7c670838111746a0670c1005a4ad3d9e6462115", "bytes": 10711 }, "software_list_m.headers.json": { "sha256": "79ffa6f42f1d8b23efe0a5da78cd4afaa03d00a6ed86090cc5ec423c14e90214", "bytes": 1087 }, "software_list_m.md": { "sha256": "5cbd54517c4d4f0c7ea4c0ef47d368fc2a639d91b9ceb10280b0235887f8e222", "bytes": 16116 }, "software_list_n.headers.json": { "sha256": "e1af67c61abf4be0cf4f59ff84a1b0278e8de116baab69f8982f4bbb12fc3829", "bytes": 1087 }, "software_list_n.md": { "sha256": "dc21e57314a4f89399576af7e9f0587e3f25dd585d610881b84fc1e252b3239f", "bytes": 18152 }, "software_list_o.headers.json": { "sha256": "1e3b2c062c0a4c739e0e9ce939b185c096423057767d8a802be897d363d48973", "bytes": 1086 }, "software_list_o.md": { "sha256": "3ae25cad7f40224327009357d83d9ae970f05cedc3e7a877b763307f165edfef", "bytes": 14380 }, "software_list_p.headers.json": { "sha256": "c967aab44c297b58ff8112c62a249d4b0c767c28a069403049c2b4d6118b7061", "bytes": 1089 }, "software_list_p.md": { "sha256": "ad665b8c782cbf7225359bcca0f1ae51d320c0b76138401803899d0239cbdab7", "bytes": 36990 }, "software_list_q.headers.json": { "sha256": "a820ff9846f76569cb042649ceb3de18a0317b2d8968a962f4e5406f34ed7096", "bytes": 1086 }, "software_list_q.md": { "sha256": "0c2f85c6cc5203850206c1a6e1d6495b2207b2a52152259871379a74795cf40d", "bytes": 6289 }, "software_list_r.headers.json": { "sha256": "548df3d986e6c7f1a0fbdcb2efaa33fe266854d5c4fba1fbe4e713f9fd9b231c", "bytes": 1087 }, "software_list_r.md": { "sha256": "cf5264700a6574d02b6c446aa88faf87506af68581e0bccf1cd3bccc25eaaab2", "bytes": 6473 }, "software_list_s.headers.json": { "sha256": "bfcff85e346870ec70c5ecf2887aea4136f74d1eb06c318cc6be6fbcbbb13da7", "bytes": 1086 }, "software_list_s.md": { "sha256": "d77663690cb40c3130a659ecce4929ddacbaaad90261e1be317ae78ee54f9661", "bytes": 32086 }, "software_list_t.headers.json": { "sha256": "82bac062177772af480d8b3831bfaa423eac771d1dc843c1b209e9142a28bb1b", "bytes": 1087 }, "software_list_t.md": { "sha256": "6d3c76f3348ab1ab6d7d3518ab81fb9677b7b43d8901b4186efac826b0350e5e", "bytes": 54594 }, "software_list_u.headers.json": { "sha256": "154b0a19184c0cbca223d090a6c71782d60bbf568c96f193452d139604d304e3", "bytes": 1084 }, "software_list_u.md": { "sha256": "2314ce9b13c2b0739abb64cc0e130eee4233e5704ea03d9c698e3f1a4eecdb24", "bytes": 3417 }, "software_list_v.headers.json": { "sha256": "6b25a8a110a18aa9a436d2d0bca8536f5f75f669b5fd7b18c8be85ac5ada0282", "bytes": 1089 }, "software_list_v.md": { "sha256": "6bb20eaf53eea2e2b5373700830a143488d34b4ac155d15bbf1625b9c044b8da", "bytes": 5264 }, "software_list_w.headers.json": { "sha256": "3353748d1be69cd5270077a030af25dc8bd196cbeb2ed11b8d21fe4744c27d55", "bytes": 1086 }, "software_list_w.md": { "sha256": "e8c883dc89ea18181d4dcc983e9f9a61a3cdc36a9735222913a5d147f68bd7fb", "bytes": 13362 }, "software_list_x.headers.json": { "sha256": "8206f477c2e723b9a1a65b7bdffeb9198c5a127a022be7dffc2c3492a7e07252", "bytes": 1086 }, "software_list_x.md": { "sha256": "7b4c34711d7e953b33d23f35aeba6ce69af769b058630b525d514d4f81ab8aa7", "bytes": 3021 }, "software_list_y.headers.json": { "sha256": "35e0724c27915b35eb5a552757c58d4a7546aec7a5e489f4ec3f7017f5f88538", "bytes": 1085 }, "software_list_y.md": { "sha256": "78990fac6d7071a22f609957976a7e9c9a9e1876b97822430fd7be92c1537fa0", "bytes": 2828 }, "software_list_z.headers.json": { "sha256": "152b1ab0a8509afb6ac913c65e14454560dda814767397c43232cae20b3f8f29", "bytes": 1086 }, "software_list_z.md": { "sha256": "25c393e4f1f8ebbf10b320f3cd9f4ec816c332e0e53e3d381e80a670defe4dea", "bytes": 2454 } }, "started_utc": "2026-10-22T18:36:24Z", "final_url": "https://github.com/NCSC-NL/php2shell/tree/main/software" } ], "status": "captured", "primary": true, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T183624Z. The inventory now lives in 27 per-letter files (724 products at 18:36 UTC: 61 Fix, 216 Vulnerable, 440 Investigation per CVE); one evidence source holding all 27 as one capture", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC-NL php2shell software inventory, all 27 per-letter files (snapshot 18:36 UTC, 22 October 2026)\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `nl/cert/ncsc-nl/software-list-*`, snapshot `20261022T183624Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T183624Z/provenance.json`. Publisher: NCSC-NL. Language: en. URL: https://github.com/NCSC-NL/php2shell/tree/main/software\n\n## What the page says\n\nNCSC-NL's inventory of software with a PHP dependency potentially affected by php2shell, which on 22 October moved from one `software_list.md` into 27 per-letter files (`software_list_0-9.md` and `software_list_a.md` to `software_list_z.md`). Each is a Markdown table: Supplier, Product, Version, Status CVE-2026-109618, Status CVE-2026-109619, Notes, Links. Counted by curator@php.newsroom from these files: 724 product rows; for each CVE, 440 Investigation, 216 Vulnerable, 61 Fix, 6 Not vuln and 1 blank (the two CVE columns agree row for row in total). This supersedes, by time, the 674-row count at commit cca173c64ec5 (08:40 UTC) recorded on `ncsc-nl-php2shell-software-list`.\n\nEach letter file is stored as `software_list_.md` with its response headers as `software_list_.headers.json`; `provenance.json` lists the URL, fetch times, watch snapshot and sha256 of each.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): The inventory now lives in 27 per-letter files (724 products at 18:36 UTC: 61 Fix, 216 Vulnerable, 440 Investigation per CVE); one evidence source holding all 27 as one capture\n\nSupports: board 052/053; series/products-by-status\n\n## Capture notes\n\nOne evidence capture holding all 27 per-letter files of the NCSC-NL inventory, each fetched from raw.githubusercontent.com by the source watch. Each .md is the file as served (the watch page.html, gunzipped; identical to its text.txt); each .headers.json is that fetch's response headers.\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "ncsc-nl-site", "url": "https://www.ncsc.nl/", "publisher": "ncsc.nl", "kind": "government", "title": "Home | NCSC", "published": null, "captures": [ { "stamp": "20261022T081919Z", "files": { "headers.json": { "sha256": "6cbf05984f4a5ced5bbdf7a66efdeb3593bc31f42d8e5ece3b2374243aa4c93a", "bytes": 2626 }, "page.html": { "sha256": "56e85c916a4374a807a48b56f862a59b3fcdc40d9bc7b2ab509da69c6839d3d4", "bytes": 388144 }, "provenance.json": { "sha256": "a65f48250e2eed9d26f87eeda6ebdd8b6400d508cb3c3af7da02f79073db395a", "bytes": 873 }, "rendered.html": { "sha256": "e377634251464e2e41da76f3a2aa2fffafaa487377a619551dd90482c0692911", "bytes": 400426 }, "screenshot.png": { "sha256": "c606a866a453a17b8d6b58e4063e53825d2579eb38cea185a68df21786517ec3", "bytes": 1096351 }, "text.txt": { "sha256": "4cff0c7ba341429e99659d7404208300de0c4a702c9c28da82b183c71d30bd32", "bytes": 2387 } }, "started_utc": "2026-10-22T08:19:19.330Z", "status": 200, "final_url": "https://www.ncsc.nl/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "ncsc-nz-alert-php", "url": "https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/", "publisher": "NCSC New Zealand", "kind": "advisory", "title": "UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP", "published": "2026-10-22T09:15+13:00 (=2026-10-21T20:15Z); updated 10:20am 22-10-26 NZDT (=21:20Z)", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "5e5b7ef0258116f0d6925dab7f8189e2223e414a58521729043ca4f399ceabcc", "bytes": 1992 }, "page.html": { "sha256": "9f3205c8338c598bedc1fa1f1b0726243fd7cce324d6d0a797a7c55fbd277915", "bytes": 49604 }, "provenance.json": { "sha256": "7536377248a3645980d9a70e1d2e6c3bb2f1c0e799ff9ccd12b4320bd1724b01", "bytes": 1049 }, "rendered.html": { "sha256": "32cdd5364dd2c631a73c0c834763cf3cb9b776145d2ebf5e4f3376e25e89758e", "bytes": 41928 }, "screenshot.png": { "sha256": "4dd2cb007efcf0696650ebca1087f184c6ed83297bc6f80dd678d9f6954146ac", "bytes": 528343 }, "text.txt": { "sha256": "992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301", "bytes": 3799 } }, "started_utc": "2026-10-22T08:17:00.193Z", "status": 200, "final_url": "https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "TLP:CLEAR. 'The NCSC is aware of reports of active exploitation.' The only agency so far to say this. Advice: update to fixed versions 'as soon as possible'; investigate compromise. No offline advice.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC NZ alert\n\n- \"9:15AM, 22 October 2026\" (NZDT, UTC+13, so 2026-10-21T20:15Z; our conversion). \"(Updated 10:20am, 22-10-26)\" = 21:20Z. TLP Clear. Captured 2026-10-22T08:17:00Z.\n- **\"The NCSC is aware of reports of active exploitation.\"** Every other agency says no exploitation has been seen (CISA, CCCS, ACSC in Australia, CERT.LV \"no successful\"). NZ does not say whose reports. Flag this as a discrepancy.\n- Advice: \"Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.\" / \"apply the remediation as soon as possible\" / \"investigate unauthorised access or compromise\". The update notes that firewalls, edge devices and embedded platforms need separate vendor remediation. No offline advice.\n" }, { "slug": "ncsc-nz-alerts", "url": "https://www.ncsc.govt.nz/alerts/", "publisher": "NCSC New Zealand", "kind": "government", "title": "Alerts listing", "published": null, "captures": [ { "stamp": "20261022T081605Z", "files": { "headers.json": { "sha256": "74c848feb39a21fb80f489bb294b8d8a697fe6fdae03a6c61098de514241564c", "bytes": 2034 }, "page.html": { "sha256": "328191a093edcb0fb9ff08b20687f3c271db0b69eb58c770700dbfdfa080da96", "bytes": 75111 }, "provenance.json": { "sha256": "1e8d90e0d23cf4b63e37636b005fac4be349ebd5ce37cd39f3e8e921d84644fb", "bytes": 894 }, "rendered.html": { "sha256": "ccc94fffbb92d25658fbb11c5935488c45109113a44b5ec6bf775ad2240cea3f", "bytes": 53664 }, "screenshot.png": { "sha256": "f9033cc86d53addc1cf8ed9db6855d4e30e30eec050db17bec1d47beb99651ee", "bytes": 226803 }, "text.txt": { "sha256": "d1c97bbc45ba4cc7861035a6f606f1bc1c7b782b44ce8bdc279c7143640f4a5f", "bytes": 1276 } }, "started_utc": "2026-10-22T08:16:05.652Z", "status": 200, "final_url": "https://www.ncsc.govt.nz/alerts/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Listing at 08:16Z: the PHP alert, dated 22 October 2026.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC NZ alerts listing\n\nCaptured 08:16Z. Top item: \"CVE-2026-109618 and CVE-2026-109619 affecting PHP\", 22 OCTOBER 2026.\n" }, { "slug": "netzpolitik-2026-wir-stehen-auf-den-schultern-vieler", "url": "https://netzpolitik.org/2026/wir-stehen-auf-den-schultern-vieler-kleiner-giganten/", "publisher": "Netzpolitik.org", "kind": "news", "title": "PHP-Sicherheitslücken: Wir stehen auf den Schultern vieler kleiner Giganten - netzpolitik.org", "published": "2026-10-23T12:21:04+02:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "cd95491c2b87084cde8da6847aeebb3fa67f634655eee7eace72fa55f0b3753d", "bytes": 1174 }, "page.html": { "sha256": "02c47b6b89e3d22c5d088274626290eae47d09e22ca93f80a70fe83e88f435ef", "bytes": 166957 }, "provenance.json": { "sha256": "0c4265539dc17a6306bdf7b20fb7921102e671941a978ab4979aa4a9b6a01939", "bytes": 1627 }, "text.txt": { "sha256": "70b03cc81aa541d878e6919549a8c30a55c6da170c4842b14905860192cf4d81", "bytes": 16684 } }, "started_utc": "2026-10-24T13:42:28.836Z", "status": 200, "final_url": "https://netzpolitik.org/2026/wir-stehen-auf-den-schultern-vieler-kleiner-giganten/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). netzpolitik.org (German), a commentary of 23 October: 'We stand on the shoulders of many small giants'. It says the PHP2Shell exploit recalls Log4Shel...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Sicherheitslücken: Wir stehen auf den Schultern vieler kleiner Giganten - netzpolitik.org\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/netzpolitik/2026-wir-stehen-auf-den-schultern-vieler-kleiner-giganten`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nnetzpolitik.org (German), a commentary of 23 October: 'We stand on the shoulders of many small giants'. It says the PHP2Shell exploit recalls Log4Shell in its drama, where a small team that provided a seemingly simple logging library 'broke the internet', and argues the reactions from political circles, such as the chair of the Parliamentary Control Panel for the intelligence services calling PHP2Shell a 'turning point', are very far from the maintainers behind the projects. An opinion piece.\n\n> Der als PHP2Shell titulierte Exploit der Sicherheitslücken in PHP erinnert in seiner Dramatik auch frappierend an Log4Shell.\n\n_Curator's translation:_ \"The exploit of the security holes in PHP, dubbed PHP2Shell, also strikingly recalls Log4Shell in its drama.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Sicherheitslücken: Wir stehen auf den Schultern vieler kleiner Giganten - netzpolitik.org\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "news-bitcoin-es-security-coinbase-y-bitgo-niegan-impa", "url": "https://news.bitcoin.com/es/security/coinbase-y-bitgo-niegan-impacto-por-vulnerabilidad-de-php-cz-alerta/", "publisher": "Bitcoin News", "kind": "news", "title": "Coinbase y Bitgo niegan impacto por vulnerabilidad de PHP; CZ alerta - Bitcoin News", "published": "2026-10-22T11:00:54+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "07bb1a804ba13a6885ef7e4d585d923bc4db2db97d6d383334ee7df128656069", "bytes": 3112 }, "page.html": { "sha256": "bc163640ffdf1aa4236e3cfb4d0e7529ecc1cb8f3e6c2976e24c9f62ebfa9400", "bytes": 1014415 }, "provenance.json": { "sha256": "4b343660959bce3e9f5cc9e9d523cc8ab1afc283e5f0454f9f0c2ff349c056b0", "bytes": 1821 }, "rendered.html": { "sha256": "f36b9c9b68c0dae24ad7b1957c6c72c8ecadfc3aa9a1207c62f5e597e0524a37", "bytes": 1017595 }, "screenshot.jpg": { "sha256": "031d2ebed543f4293f3ea357c77c28522bf3fbc4ff9dc67e34065ec87b212306", "bytes": 671442 }, "text.txt": { "sha256": "218d24d1a495bce6fa39a4fd68a75c8eb05c05ea46524df26babce4c21ffb1a7", "bytes": 12341 } }, "started_utc": "2026-10-23T16:09:15.715Z", "status": 200, "final_url": "https://news.bitcoin.com/es/security/coinbase-y-bitgo-niegan-impacto-por-vulnerabilidad-de-php-cz-alerta/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bitcoin News (Spanish), 22 October: Coinbase and BitGo deny impact from the PHP vulnerability; CZ alerts. Several large crypto firms, among them Coinb...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Coinbase y Bitgo niegan impacto por vulnerabilidad de PHP; CZ alerta - Bitcoin News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/news-bitcoin/es-security-coinbase-y-bitgo-niegan-impacto-por-vulnerabilid`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBitcoin News (Spanish), 22 October: Coinbase and BitGo deny impact from the PHP vulnerability; CZ alerts. Several large crypto firms, among them Coinbase, BitGo, Bitget Wallet and PancakeSwap, said they were not affected by the PHP flaws; Binance 'implemented proactive protective measures'; users are urged to harden their online security, since an eMudhra vulnerability also remains exploitable. It also notes that fixing the flaw on 21 October does not mean attackers had not exploited it earlier, citing Amazon's attempt from 17 October.\n\n> varias empresas importantes del sector de los criptoactivos, entre ellas Coinbase, Bitgo, Bitget Wallet y Pancakeswap, han afirmado que no se han visto afectadas por los fallos de PHP\n\n_Curator's translation:_ \"several important companies in the crypto-asset sector, among them Coinbase, BitGo, Bitget Wallet and PancakeSwap, have stated that they have not been affected by the PHP flaws\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Bitcoin.com (Spanish) reports how crypto firms responded: Coinbase and BitGo say they were not affected, Binance took proactive measures, and others say they do not use PHP. It quotes CZ's warning to users and Cloudflare/AWS exploitation figures, and also covers the separate eMudhra certificate issue.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Coinbase y Bitgo niegan impacto por vulnerabilidad de PHP; CZ alerta - Bitcoin News\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "news-clearancejobs-2026-10-23-php2shell-could-put-millions", "url": "https://news.clearancejobs.com/2026/10/23/php2shell-could-put-millions-of-websites-at-risk-nsa-urges-immediate-patching/", "publisher": "ClearanceJobs News", "kind": "news", "title": "PHP2Shell Could Put Millions of Websites at Risk: NSA Urges Immediate Patching - ClearanceJobs", "published": "2026-10-23T11:30:57+00:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "b2cf579e1a8c7f47e034d6d65d63476e05069776adf028dac6ff11196f97381d", "bytes": 1236 }, "page.html": { "sha256": "403fa2a20375a9dddd8a4ef89a95142f0398d53c780c9b8c6abf095c89d400f2", "bytes": 103549 }, "provenance.json": { "sha256": "4b4a30d41b42794c2fda747cac31b17891167b0763005652b04241f6343f05ab", "bytes": 1875 }, "rendered.html": { "sha256": "e15d2a2170c69a24a7b30a8f9c4d04ea3cc7bf2b4c5ea6caafccb3c20815c366", "bytes": 103510 }, "screenshot.jpg": { "sha256": "1130b32c31a85efb71431b6202e0a125c104e00cc9a4a31e9a582f898491e56b", "bytes": 414729 }, "text.txt": { "sha256": "f21aea405a7ef7da976c401d0fe72dd075f352583917145b0d5fbb8065876070", "bytes": 7956 } }, "started_utc": "2026-10-23T23:32:11.251Z", "status": 200, "final_url": "https://news.clearancejobs.com/2026/10/23/php2shell-could-put-millions-of-websites-at-risk-nsa-urges-immediate-patching/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fi", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). ClearanceJobs, 23 October: the NSA issued an advisory on Wednesday recommending critical patches for the PHP vulnerability. It quotes the NSA that all...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Could Put Millions of Websites at Risk: NSA Urges Immediate Patching - ClearanceJobs\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fi/news/news-clearancejobs/2026-10-23-php2shell-could-put-millions-of-websites-at-risk`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nClearanceJobs, 23 October: the NSA issued an advisory on Wednesday recommending critical patches for the PHP vulnerability. It quotes the NSA that all users should prioritise vendor patches tied to the PHP2Shell issues and immediately inventory the hardware and software services that rely on now-vulnerable PHP versions.\n\n> It is essential for all to prioritize incorporating vendor patches that may be explicitly tied to the PHP2Shell issues.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Could Put Millions of Websites at Risk: NSA Urges Immediate Patching - ClearanceJobs\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fi`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "news-jkn-editions-thai-post-1040742", "url": "https://news.jkn.co.kr/editions/thai/post/1040742", "publisher": "재경일보", "kind": "news", "title": "เตือนภัยช่องโหว่ความปลอดภัย PHP เสี่ยงถูกรันโค้ดระยะไกลโดยไม่ต้องยืนยันตัวตน : 테크/과학 : JKN", "published": "2026-10-21T18:35:36.000Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "4085318bae4a5d377c2c9f925adc4385ed7307f4d901784ae426780dd03b1c63", "bytes": 493 }, "page.html": { "sha256": "07bcd63e65e926bac6675d4ed298458d10e8bda908b761d65430b7fba621efa0", "bytes": 155486 }, "provenance.json": { "sha256": "4e59deb6a448c2dc3e54284a1c44738c541cc49e030d888b208ed1470d43488c", "bytes": 1772 }, "rendered.html": { "sha256": "943a7df3537903ba1b1e7aeebec8b188845e4dada31ae08593742fc3533e9a3a", "bytes": 155831 }, "screenshot.jpg": { "sha256": "42327458fc6cda4766985292136d1f56e6a276d8ac8295fd50a0f6b042276726", "bytes": 341502 }, "text.txt": { "sha256": "20dc3ca671aae1a2bcfda397a14a25faea7d1dd86f7ae2c726e9729be3dbca75", "bytes": 17531 } }, "started_utc": "2026-10-23T16:21:41.250Z", "status": 200, "final_url": "https://news.jkn.co.kr/editions/thai/post/1040742" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "th", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). JKN / Jaeil Ilbo (Thai edition), 21 October: warning about a PHP security flaw with the risk of remote code running without authentication. The PHP te...", "raw_sha256": {}, "has_notes": true, "notes_md": "# เตือนภัยช่องโหว่ความปลอดภัย PHP เสี่ยงถูกรันโค้ดระยะไกลโดยไม่ต้องยืนยันตัวตน : 테크/과학 : JKN\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/news-jkn/editions-thai-post-1040742`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nJKN / Jaeil Ilbo (Thai edition), 21 October: warning about a PHP security flaw with the risk of remote code running without authentication. The PHP team announced an emergency new version on the 21st (local time) to fix two security flaws; PHP is a server-side language widely used on sites worldwide, though the statistics differ between survey bodies.\n\n> ทีมพัฒนา PHP ได้ประกาศเผยแพร่เวอร์ชันใหม่ฉุกเฉินเมื่อวันที่ 21 (ตามเวลาท้องถิ่น)\n\n_Curator's translation:_ \"The PHP development team announced the release of an emergency new version on the 21st (local time)\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ JKN (Korean outlet, Thai edition) translation of a Yonhap story. Covers the flaw and versions, AI discovery by Calif and Wiz (Ami Luttwak quote), the leak forcing an early patch, Cloudflare WAF rules from 03:02 UTC on 21 Oct, and Dutch and Finnish sites offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"เตือนภัยช่องโหว่ความปลอดภัย PHP เสี่ยงถูกรันโค้ดระยะไกลโดยไม่ต้องยืนยันตัวตน : 테크/과학 : JKN\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `th`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "news-qq-rain-a-20261021a0eq4p00", "url": "https://news.qq.com/rain/a/20261021A0EQ4P00", "publisher": "腾讯网", "kind": "news", "title": "PHP2Shell 高危漏洞补丁紧急发布，我在流量设备里发现了什么？_腾讯新闻", "published": "2026-10-21 23:00 (Beijing)", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "aea7e3b72758e817dd7ec1dfc1f18bb6a491138d6d9f31143df458dd1229c106", "bytes": 490 }, "page.html": { "sha256": "3924aece8436a9564869859985b05ac51d74e685daf781492eb27e750caee9d2", "bytes": 323379 }, "provenance.json": { "sha256": "1ebe765a6beef1e1cba4146e4ef0117ffbcf11c81ec9aab45914fb4829e85f39", "bytes": 1603 }, "rendered.html": { "sha256": "3fc819bce68ccd1b21de17fa52229f5e66ba2ea8f41592240c2b2459b0bae2fe", "bytes": 415882 }, "screenshot.jpg": { "sha256": "c79dbc57516d1b8e35417109984d1f2a98036d6597a40a4b37831436073aef29", "bytes": 112150 }, "text.txt": { "sha256": "a95c73b30f448263e41a4385719b08cc015a889b427b7dc33381cce5fa05f974", "bytes": 12164 } }, "started_utc": "2026-10-23T16:16:19.300Z", "status": 200, "final_url": "https://news.qq.com/rain/a/20261021A0EQ4P00" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-CN", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Tencent News (Chinese), 21 October, by the creator account 荣姐聊AI (the page's disclaimer says creator content does not represent Tencent). A security p...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell 高危漏洞补丁紧急发布，我在流量设备里发现了什么？_腾讯新闻\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/news-qq/rain-a-20261021a0eq4p00`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTencent News (Chinese), 21 October, by the creator account 荣姐聊AI (the page's disclaimer says creator content does not represent Tencent). A security practitioner describes what a traffic threat-detection appliance caught on the day the patch came out: several suspicious requests, one of which carried the User-Agent 'php2shell-scan/1.0'. The author is careful: the first requests looked like older, unrelated session-forgery attempts, a User-Agent can be set by anyone, there was no command-execution payload and no host-side evidence, so successful remote code execution cannot be inferred. The rest recaps the PHP advisory (versions 8.2.35, 8.3.36, 8.4.27, 8.5.12; Apache mod_php the most exposed) and the stopgap measures PHP published, which are not repeated here.\n\n> 最后，流量中没有出现明显的命令执行载荷，也没有后端主机行为证据，因此无法据此判断攻击者已经实现远程代码执行。\n\n_Curator's translation:_ \"Finally, no obvious command-execution payload appeared in the traffic and there is no back-end host evidence, so it cannot be concluded that the attacker achieved remote code execution.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Tencent News first-person write-up by a SOC analyst. On 22 Oct they used ThreatBook (Weibu) TDP traffic sensors to catch suspicious requests that abuse PHP's session upload-progress feature, including a scanner whose User-Agent was 'php2shell-scan/1.0'. They give a careful analysis of what is a scan versus a real exploit. A sidebar headline says MIIT issued a risk alert and Tencent Cloud and Alibaba Cloud published advisories.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell 高危漏洞补丁紧急发布，我在流量设备里发现了什么？_腾讯新闻\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-CN`. The page has an 'Ask AI' button and ads/recommendation links (site chrome). Nothing in the article text addresses an AI or hides text from a reader. The request details the author shows are left out of the notes.\n" }, { "slug": "news-yahoo-articles-d953e2a13109253ae974bf2a64ebe94", "url": "https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6", "publisher": "Yahoo!ニュース", "kind": "news", "title": "【図解】重大な脆弱性が見つかった「PHP」とは？（Yahoo!ニュース オリジナル THE PAGE）", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "8e38c9dabae0c22eb10b65080334789ac9ae4bfbb14c14d8f3d935fc87ac2c59", "bytes": 1350 }, "page.html": { "sha256": "f5809005f7712b639f7f24d92d83b1ef60a309160b562bc68dca7953a0946a36", "bytes": 141487 }, "provenance.json": { "sha256": "759ce75eb93948dc8233e2f1c0744244521e9810be168b3325225ca11052bfa5", "bytes": 1763 }, "rendered.html": { "sha256": "dbc84b8a484fb6645519a9c8976fc08606425c3b7fbec041d59f1be59d758a6f", "bytes": 345740 }, "screenshot.jpg": { "sha256": "d24acfe25228d4843e7a2965dd22f89e9f380065ec75cbd3a1b91458b71a45b1", "bytes": 620052 }, "text.txt": { "sha256": "3f6309ea905ada2a3609b89da18be043419e1e2c246a6acd26772a44a06cdee3", "bytes": 15798 } }, "started_utc": "2026-10-23T16:19:35.394Z", "status": 200, "final_url": "https://news.yahoo.co.jp/articles/d953e2a13109253ae974bf2a64ebe9408d2de2e6" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Yahoo! News Japan (a graphic explainer made from Jiji Press articles), 22 October: two serious PHP vulnerabilities were found, both at the highest 'em...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 【図解】重大な脆弱性が見つかった「PHP」とは？（Yahoo!ニュース オリジナル THE PAGE）\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/news-yahoo/articles-d953e2a13109253ae974bf2a64ebe9408d2de2e6`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nYahoo! News Japan (a graphic explainer made from Jiji Press articles), 22 October: two serious PHP vulnerabilities were found, both at the highest 'emergency' level, and sites could be taken over; in Japan companies and others suspended services as a precaution. The Jiji source headlines it names are 'PHP flaw: companies and organisations take precautionary measures, bank service suspended' and 'Vulnerability in the programming language PHP puts 70% of the world's sites at risk'.\n\n> 重大な脆弱（ぜいじゃく）性が2件見つかりました\n\n_Curator's translation:_ \"two serious vulnerabilities were found\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Yahoo! Japan explainer (Jiji-based) saying Japanese companies suspended services. Related headlines are rich: a bank service stopped; the JMA, Sukiya and MUFG Bank scrambling; PM Takaichi's 'urgent request' post; GMO FX login data possibly leaked; NICT analysis; FBI alert; Cloudflare's attack counts.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"【図解】重大な脆弱性が見つかった「PHP」とは？（Yahoo!ニュース オリジナル THE PAGE）\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "news9live-technology-tech-news-what-is-php2shell-c", "url": "https://www.news9live.com/technology/tech-news/what-is-php2shell-critical-php-vulnerabilities-websites-hacking-risk-3018004", "publisher": "News9Live", "kind": "news", "title": "What is PHP2Shell? Critical PHP flaws put millions of websites on emergency patch alert", "published": "2026-10-22T11:54:37+05:30", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "b9f7895e448e41949e0ec262457aa3a3112a56b7dccaadb942569d3848b13dcf", "bytes": 809 }, "page.html": { "sha256": "8014ac6a2042e8b55294d6bbee18e3aeb82b2de08806339c48a0c9da0b50bac9", "bytes": 267955 }, "provenance.json": { "sha256": "6b94a2dba7e0f560c82f50ead01f31667fb4310821ed0f44ec210b2663c4e926", "bytes": 1703 }, "text.txt": { "sha256": "b2105e78dcc0bd5fe87b6b6721da7f139577d91e413440943e4530f81dea8b9c", "bytes": 10360 } }, "started_utc": "2026-10-23T16:19:38.850Z", "status": 200, "final_url": "https://www.news9live.com/technology/tech-news/what-is-php2shell-critical-php-vulnerabilities-websites-hacking-risk-3018004" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). News9Live (India), 22 October: what PHP2Shell is, which PHP versions need updates, how AI helped the researchers and what website owners should do. Th...", "raw_sha256": {}, "has_notes": true, "notes_md": "# What is PHP2Shell? Critical PHP flaws put millions of websites on emergency patch alert\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/news9live/technology-tech-news-what-is-php2shell-critical-php-vulnerab`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNews9Live (India), 22 October: what PHP2Shell is, which PHP versions need updates, how AI helped the researchers and what website owners should do. The two flaws were publicly disclosed on 21 October 2026 and both carry a 9.2 out of 10 severity score.\n\n> Both carry a critical severity score of 9.2 out of 10\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ News9 Live (Indian, English) explainer. It embeds PM Takaichi's X post in Japanese (urgent request to prepare for the 23:00 JST patch, consider stopping sites) and the FBI Cyber Division's X post urging updates or taking systems offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"What is PHP2Shell? Critical PHP flaws put millions of websites on emergency patch alert\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "newscast-smart-news-4327997", "url": "https://newscast.jp/smart/news/4327997", "publisher": "NEWSCAST", "kind": "news", "title": "PHPセキュリティ延長保守サービス、 PHP2Shellの修正を保守終了版PHP 5.3～8.1に提供 | NEWSCAST", "published": "2026-10-26 15:15 (page time zone not stated)", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "265213f6d88a54c9f8ab39cb1e607715257ccb7b07b226c8ff0a2a62480612e6", "bytes": 908 }, "page.html": { "sha256": "edfaa4348f2a12093628f165e71e95acb55c8a56eb040177ff2b8daf21911a0e", "bytes": 69889 }, "provenance.json": { "sha256": "8abce7ce196ff5873e17fe0e19a6537394c7374f5ee0fe9a9b914d6be6c5e94b", "bytes": 1602 }, "rendered.html": { "sha256": "34e55f5998b2a83df31183df51173491529a2853738737dd0592b26bda2f6ba7", "bytes": 63894 }, "screenshot.jpg": { "sha256": "a1e0ed750a0b96e3cf87862223a0cca5f9b24748fe67e754e602a6193a31d4a6", "bytes": 296506 }, "text.txt": { "sha256": "a1a091050c738ac23fb15c5e66c448c8a98ebb6fad82da6cd4dbba615cf65556", "bytes": 5574 } }, "started_utc": "2026-10-26T09:55:38.551Z", "status": 200, "final_url": "https://newscast.jp/smart/news/4327997" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). NEWSCAST (Japanese): the same Electronic Service Initiative (ESI) press release recorded in full as atpress-ne-news-644147 (AtPress): extended-support...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPセキュリティ延長保守サービス、 PHP2Shellの修正を保守終了版PHP 5.3～8.1に提供 | NEWSCAST\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/newscast/smart-news-4327997`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNEWSCAST (Japanese): the same Electronic Service Initiative (ESI) press release recorded in full as atpress-ne-news-644147 (AtPress): extended-support backports of the two PHP2Shell fixes for end-of-life PHP 5.3 to 8.1, released 23 October, and ESI's statement that the underlying flaw exists in all those versions. The claim is recorded on that record.\n\n> 上流のアドバイザリは、影響を受けるバージョンとして上流がサポートを続けるPHP 8.2以降だけを挙げていますが、ESIの調査で、原因となる作りが保守終了版のPHP 5.3～8.1のすべてにあることを確認しました。\n\n_Curator's translation:_ \"The upstream advisory lists only PHP 8.2 and later, which upstream continues to support, as affected versions, but ESI's investigation confirmed that the underlying construction exists in all the end-of-life PHP versions 5.3 to 8.1.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHPセキュリティ延長保守サービス、 PHP2Shellの修正を保守終了版PHP 5.3～8.1に提供 | NEWSCAST\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "newscj-news-articleview-html", "url": "https://www.newscj.com/news/articleView.html?idxno=3442485", "publisher": "천지일보", "kind": "news", "title": "PHP 취약점 발견에 비상대응 가동… 정부 전산망엔 이상 없어 < IT·전자·과학 < 경제 < 기사본문 - 여론조사에 강한 신문- 천지일보", "published": "2026-10-22T21:00:00+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "cf901085536ad5fd93c222fd39821561272ff1f1ab041bd1983ecba852b234bf", "bytes": 354 }, "page.html": { "sha256": "8e62ca582362b711598387c0ec51f519469b26cd688740c73c8119a6d528d5ca", "bytes": 200854 }, "provenance.json": { "sha256": "ff399952dab7920f260531d4903540688fe39b9b693daeebfc6be47530f55a2d", "bytes": 1700 }, "rendered.html": { "sha256": "1370f7065671f23d05a7dc290efdeb075323ce5f97f256b64139f878376e928d", "bytes": 234958 }, "screenshot.jpg": { "sha256": "18177cd5e52ce0f2be1354c139a68fd5fa77e535d240e75666adbf841b79eb82", "bytes": 540913 }, "text.txt": { "sha256": "08f16dcd9f988d5c3ea9363e9c9b8ce6138aac4777bd222e35730fa2bc5fcdab", "bytes": 10008 } }, "started_utc": "2026-10-23T16:21:42.269Z", "status": 200, "final_url": "https://www.newscj.com/news/articleView.html?idxno=3442485" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Cheonji Ilbo (Korean), 22 October, citing the Ministry of the Interior and Safety (MOIS): government networks such as Government24 showed no problems;...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP 취약점 발견에 비상대응 가동… 정부 전산망엔 이상 없어 < IT·전자·과학 < 경제 < 기사본문 - 여론조사에 강한 신문- 천지일보\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/newscj/news-articleview-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nCheonji Ilbo (Korean), 22 October, citing the Ministry of the Interior and Safety (MOIS): government networks such as Government24 showed no problems; none of the 217 information systems under MOIS was found to be built on PHP, but emergency letters went to local governments, whose systems may use it. The Ministry of Science and ICT raised the private-sector cyber crisis alert to 'Caution' (second of four levels) from noon on 22 October after an assessment meeting with KISA. It names the two CVEs, the fixed versions (8.2.35, 8.3.36, 8.4.27, 8.5.12), says PHP 8.1 and earlier are out of support, and says some European governments (the Netherlands, Finland) took sites offline as a precaution.\n\n> 정부24나 지방세 시스템 등 행안부 소관의 정보시스템 217개 중 PHP를 사용해 개발한 시스템은 없는 것으로 확인됐다.\n\n_Curator's translation:_ \"Of the 217 information systems under the Ministry of the Interior and Safety, including Government24 and local-tax systems, none was confirmed to have been developed with PHP.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP 취약점 발견에 비상대응 가동… 정부 전산망엔 이상 없어 < IT·전자·과학 < 경제 < 기사본문 - 여론조사에 강한 신문- 천지일보\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "newstap-news-articleview-html", "url": "https://www.newstap.co.kr/news/articleView.html?idxno=336342", "publisher": "뉴스탭", "kind": "news", "title": "인증 없이 서버 장악 가능…티오리, 치명적 PHP 취약점 ‘PHP2Shell’ 대응책 공개 < no_feed < 컴퓨팅/AI < 뉴스 < 기사본문 - 뉴스탭", "published": "2026-10-23T09:53:36+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "877b6208e6a762bc3a864fdf106e64fe28a2c2a3c643a67dc66407fa39f2e4d9", "bytes": 354 }, "page.html": { "sha256": "4f5fb1d84159ce68c8f06ed561f664bc26a0c058b316f256f3013e44b48d1ca6", "bytes": 103230 }, "provenance.json": { "sha256": "8172e4b28f9816cc75d94cd0d8ce638d3344fdd272ac89ba682535624061e11b", "bytes": 1699 }, "rendered.html": { "sha256": "6eb3d670e2553add61e39aa806d13f8ada4adaaabd1bab3c4143f6b79bd1d1a1", "bytes": 108882 }, "screenshot.jpg": { "sha256": "86754063e5f6b1d7848c9c89c715f3499f66ffd0c6a0a97fb0354b68fb20d4ce", "bytes": 428778 }, "text.txt": { "sha256": "64a75bd0ba92687680c4e6284239e65b9dc2f4bd40074d98a74d98cf26bd3f71", "bytes": 6631 } }, "started_utc": "2026-10-23T16:21:42.472Z", "status": 200, "final_url": "https://www.newstap.co.kr/news/articleView.html?idxno=336342" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Newstap (Korean), 23 October. The Korean security firm Theori says it has reproduced and verified exploit code for PHP2Shell itself and published an e...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 인증 없이 서버 장악 가능…티오리, 치명적 PHP 취약점 ‘PHP2Shell’ 대응책 공개 < no_feed < 컴퓨팅/AI < 뉴스 < 기사본문 - 뉴스탭\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/newstap/news-articleview-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNewstap (Korean), 23 October. The Korean security firm Theori says it has reproduced and verified exploit code for PHP2Shell itself and published an emergency response guide with interim mitigations and a check script. It says a proof-of-concept video and security-patched binaries leaked before the official advisory and that PoC code is spreading quickly, and it expects others to build the same exploit. Affected versions are given as PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 and below, plus unsupported 8.1 and older (7.x, 5.x). Theori stresses that interim measures cannot fully block the flaws and may cause side effects such as session-function errors, and that patching comes first.\n\n> 특히 이번 취약점은 공식 보안 권고가 발표되기 전부터 개념증명(PoC) 시연 영상과 보안 패치가 적용된 바이너리가 유출되면서 보안 위협이 확산하고 있다.\n\n_Curator's translation:_ \"In particular, the threat is spreading because a proof-of-concept (PoC) demonstration video and security-patched binaries leaked before the official security advisory was published.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"인증 없이 서버 장악 가능…티오리, 치명적 PHP 취약점 ‘PHP2Shell’ 대응책 공개 < no_feed < 컴퓨팅/AI < 뉴스 < 기사본문 - 뉴스탭\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. The footer carries a copyright line ('무단전재 및 재배포, AI학습 및 활용 금지': no reproduction, redistribution, or AI training or use). It is a rights notice, not an instruction to act; recorded here and flagged to the editor. Nothing else addresses an AI or hides text from a reader.\n" }, { "slug": "newsweek-php2shell-list", "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "publisher": "newsweek.com", "kind": "news", "title": "PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek", "published": null, "captures": [ { "stamp": "20261022T081350Z", "files": { "headers.json": { "sha256": "7732bbe45a2c2ac0eb9414f511a971483a2ff33927c5b2591150a5578b57774d", "bytes": 2439 }, "page.html": { "sha256": "02014f6004d880e2069129f15e86dde9bc0690358b12879271104aa686ed7af0", "bytes": 559900 }, "provenance.json": { "sha256": "ae0d237da8f695dc44b28ffcd2fb2e36cac58cecad93ed3b5666d6c7871c5f9b", "bytes": 1102 }, "rendered.html": { "sha256": "2f4d6beb749cd4010729eff950983514ed19755c1b44915b56ddb7f31c8debb3", "bytes": 804597 }, "screenshot.png": { "sha256": "b13b1042a450751a2cb5a722defaa60f78a4012c987c02e2549a0b9b5e82e299", "bytes": 2054746 }, "text.txt": { "sha256": "dc7ff69a1e38d3d6a18e69e19cca63a0b086601d4ae1fb2fe1c77654b30957be", "bytes": 11452 } }, "started_utc": "2026-10-22T08:13:50.041Z", "status": 200, "final_url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "newsweek-php2shell-websites", "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "publisher": "Newsweek", "kind": "news", "title": "PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112237Z", "files": { "headers.json": { "sha256": "b6ede4c5fe94adc6fedb71cb10b74af567162d6452ec0218be0bb8c7b17748dd", "bytes": 2453 }, "page.html": { "sha256": "02014f6004d880e2069129f15e86dde9bc0690358b12879271104aa686ed7af0", "bytes": 559900 }, "provenance.json": { "sha256": "3924e8c0bcf61c3ac2c4018ed3883377b700cd1ff8b1868e156d09adbb78ffc1", "bytes": 1106 }, "rendered.html": { "sha256": "ba7e1618e4d6808ff4982067fda5725d0e4c5a6fcfd94dc91b4b6bd65068189d", "bytes": 815834 }, "screenshot.png": { "sha256": "3d81fb9fa70f4b8446dc70da529dd38f40b9e9caf64fd826a7c1fd282de0d3b0", "bytes": 2773005 }, "text.txt": { "sha256": "323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294", "bytes": 11698 } }, "started_utc": "2026-10-22T11:22:37.989Z", "status": 200, "final_url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "faf61f64516867ad47751a3be3203baca24c2053db187112aa86c124a10e7645", "bytes": 2103 }, "page.html": { "sha256": "840b1860e8f20027b239264055ea0d5fb6d33a16935a383c48a35a96d3f38e45", "bytes": 558757 }, "provenance.json": { "sha256": "63c6db9ff77248c1a38ac59726acbec980b22a666dc3cd368252da1b68c20be2", "bytes": 1663 }, "text.txt": { "sha256": "943f76081090db5de7270a1d6cf276a50ae13472e60014f6d4387bfbde55da13", "bytes": 10844 } }, "started_utc": "2026-10-23T16:26:54.434Z", "status": 200, "final_url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "9bf306696c932407cb1b726e549ae41153193f0352a309f9d1d3db2dd9546ce4", "bytes": 2057 }, "page.html": { "sha256": "c7f33ed1ceef33ef0d61bcb61d5bb757337a2f3034197ea7974528abc65b7923", "bytes": 558756 }, "provenance.json": { "sha256": "16adf17467a02821f8a0cbc8774ecf10e4d3846004bb7cc6750c707b06d38a89", "bytes": 1675 }, "text.txt": { "sha256": "bc1065d2b5f8a874cc4f4df68f0734771fcba3ea0e9e2a1ff3e08fdff91496b9", "bytes": 11003 } }, "started_utc": "2026-10-23T23:42:06.564Z", "status": 200, "final_url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Wikimedia Foundation quote 'taken down a number of other systems as a precautionary measure'; no evidence of US federal sites compromised or offline.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek\n\nCaptured by claude-story-site. Status: captured. Secondary: Wikimedia Foundation quote 'taken down a number of other systems as a precautionary measure'; no evidence of US federal sites compromised or offline.\n\n- Captured for the Wikimedia quote and the federal-sites line.\n" }, { "slug": "nguoiquansat-lo-hong-php2shell-de-doa-70-website-toan", "url": "https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html", "publisher": "nguoiquansat.vn", "kind": "news", "title": "Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ", "published": "10/23/2026 10:02:01 AM", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "570a39341d28feba0b8b6198f6b4eb2d510321cd2b23b40ffc251f97e1cd83bd", "bytes": 805 }, "page.html": { "sha256": "55b9bdacd024871a75d2f59f0ae9101a1fae3592a855167a05c8927429efce65", "bytes": 145838 }, "provenance.json": { "sha256": "fcab0e17849f10d7aacdd9cea46f069598e422c3b2e728f3c1ed0c04327608a0", "bytes": 1933 }, "rendered.html": { "sha256": "a4b33b682d6194dd69f507f7f8cfcbc1150f2666bd4cc6feb56908d69ffd80fb", "bytes": 229340 }, "screenshot.jpg": { "sha256": "a88e85bc8441bc40a63edf1c446a0163fcf78f77b407023dc551f092c5df991a", "bytes": 753491 }, "text.txt": { "sha256": "176d23d05dee09bd3ec76145b7258bdc602945e0ae56615e62e4164b7e2def48", "bytes": 19627 } }, "started_utc": "2026-10-23T16:29:04.736Z", "status": 200, "final_url": "https://nguoiquansat.vn/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat-ban-thuc-trang-dem-phat-lenh-bao-dong-do-323658.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "vi", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Nguoi Quan Sat (Vietnamese), 23 October: the php2shell flaws, leaked early on Hacker News, threaten 70% of websites worldwide. The headline and lead s...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `vn/news/nguoiquansat/lo-hong-php2shell-de-doa-70-website-toan-cau-thu-tuong-nhat`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNguoi Quan Sat (Vietnamese), 23 October: the php2shell flaws, leaked early on Hacker News, threaten 70% of websites worldwide. The headline and lead say that in Japan the Prime Minister stayed up all night and issued an emergency order that forced many large platforms to close for maintenance. The Japanese claim comes from this outlet alone in the vault and needs a Japanese source.\n\n> Tại Nhật Bản, Thủ tướng đã phải phát lệnh khẩn cấp, ép hàng loạt nền tảng lớn đóng cửa bảo trì.\n\n_Curator's translation:_ \"In Japan, the Prime Minister had to issue an emergency order, forcing a number of major platforms to close for maintenance.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Lỗ hổng php2shell đe dọa 70% website toàn cầu: Thủ tướng Nhật Bản thức trắng đêm phát lệnh báo động đỏ\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `vi`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "niigata-nippo-articles-930995", "url": "https://www.niigata-nippo.co.jp/articles/-/930995", "publisher": "新潟日報デジタルプラス", "kind": "news", "title": "PHPの重大な脆弱性「PHP2shell」とは？ 企業サイトが今すぐ確認すべきこと　WACAが解説記事を公開 | 新潟日報", "published": "not stated in the capture", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "23b85b5bc34e42763a4734d80073eec18b762db260d20157322650f5f05a47bd", "bytes": 629 }, "page.html": { "sha256": "e5bbce52f53535c2a687b20d5fc03cc1821b21ca1211e4f7fc70e851076a954c", "bytes": 99302 }, "provenance.json": { "sha256": "c654703f42ce6aae17afadc9142c91aa5b8e21655bf80256855ab1c9765dac2d", "bytes": 1655 }, "rendered.html": { "sha256": "7ad4f51fee50112776b9d9d311829e5e26412698d120de5f033eeebd9ad70570", "bytes": 224099 }, "screenshot.jpg": { "sha256": "830d304dccd0458db082cc5b78a730d1da6deb3c71f8cfe76613311ad1ce901f", "bytes": 544874 }, "text.txt": { "sha256": "b1ba39dd3a298bdf4dd761494be2c3eabc2a0cb2c34ee410c732ec88f4eeee9d", "bytes": 11487 } }, "started_utc": "2026-10-26T07:26:31.260Z", "status": 200, "final_url": "https://www.niigata-nippo.co.jp/articles/-/930995" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Niigata Nippo Digital Plus (Japanese): carries the WACA press release about PHP2Shell that is recorded in full as digitalpr-r-146712 (Digital PR Platf...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPの重大な脆弱性「PHP2shell」とは？ 企業サイトが今すぐ確認すべきこと　WACAが解説記事を公開 | 新潟日報\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/niigata-nippo/articles-930995`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNiigata Nippo Digital Plus (Japanese): carries the WACA press release about PHP2Shell that is recorded in full as digitalpr-r-146712 (Digital PR Platform): the association's 24 October explainer, Prime Minister Takaichi's 21 October call on X, and advice to confirm the PHP fix with the hosting company. The claim is recorded on that record.\n\n> WACA（一般社団法人ウェブ解析士協会）は2026年10月24日、同月21日に修正版が公開されたPHPの重大な脆弱性「PHP2shell」について、企業が確認すべきことを整理した解説記事を公開しました。\n\n_Curator's translation:_ \"On 24 October 2026, WACA (the Web Analyst Association) published an explainer on what companies should check about the serious PHP vulnerability 'PHP2shell', for which fixed versions were released on the 21st of the same month.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHPの重大な脆弱性「PHP2shell」とは？ 企業サイトが今すぐ確認すべきこと　WACAが解説記事を公開 | 新潟日報\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "nl-beincrypto-crypto-exchange-hack-waarschuwing-php2sh", "url": "https://nl.beincrypto.com/crypto-exchange-hack-waarschuwing-php2shell-risico/", "publisher": "BeInCrypto", "kind": "news", "title": "Crypto-exchange waarschuwing: kritieke PHP-kwetsbaarheid brengt betaalwebsites in gevaar", "published": "2026-10-21T22:42:38Z", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "c5177f36cf9b1233bc511eeacc3d4ecc792f7c5ee787dde0ac9ebfd74c4e2bc2", "bytes": 3096 }, "page.html": { "sha256": "2cf4bda1d5bc4b7895bb5d12c0a263a2432d798d3dbbf077ab56b711a911cb00", "bytes": 488805 }, "provenance.json": { "sha256": "5dbfac167e17ab7aafc76bfbbd66c03a007c14d06d7ec7476f2e07b9bc8391ba", "bytes": 1765 }, "rendered.html": { "sha256": "290c8329420a512959a1c4689c865a4c8c24305ece57b3c5323b8d4c132a9090", "bytes": 414582 }, "screenshot.jpg": { "sha256": "3bd51559d901f26237bf28c5960bccfd5b8d4c533f761ba3e581274c7ef91740", "bytes": 448751 }, "text.txt": { "sha256": "6829ef8bd0166b88fffce8734030327bee8cc3a9d976f61af96a2b8195fffdb8", "bytes": 8058 } }, "started_utc": "2026-10-24T13:54:27.442Z", "status": 200, "final_url": "https://nl.beincrypto.com/crypto-exchange-hack-waarschuwing-php2shell-risico/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). BeInCrypto Nederland (Dutch), 21 October, by Mohammad Shahid. It explains that the PHP2Shell patches (score 9.2) matter to crypto users, particularly...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Crypto-exchange waarschuwing: kritieke PHP-kwetsbaarheid brengt betaalwebsites in gevaar\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/news/nl-beincrypto/crypto-exchange-hack-waarschuwing-php2shell-risico`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBeInCrypto Nederland (Dutch), 21 October, by Mohammad Shahid. It explains that the PHP2Shell patches (score 9.2) matter to crypto users, particularly small exchanges and payment services built on PHP, says Cloudflare has confirmed attackers already tried to exploit the flaws against its customers and that several European government sites went offline as a precaution, and quotes Wiz Research that a successful attack could expose passwords, authentication tokens and API keys. It lists categories it considers at risk (PHP payment gateways, smaller exchanges, DeFi and wallet front-ends) and says SlowMist's MistEye scanned PHP assets across the crypto industry. It states that no confirmed evidence shows the named services or major exchanges were hacked.\n\n> Er is geen bevestigd bewijs dat de genoemde betaaldiensten of grote exchanges daadwerkelijk via PHP2Shell gehackt zijn.\n\n_Curator's translation:_ \"There is no confirmed evidence that the named payment services or major exchanges were actually hacked via PHP2Shell.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ BeInCrypto (NL) Cloudflare bot challenge; no text.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Crypto-exchange waarschuwing: kritieke PHP-kwetsbaarheid brengt betaalwebsites in gevaar\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "note-gay-egret4207-n-n2c2499dc2998", "url": "https://note.com/gay_egret4207/n/n2c2499dc2998?hl=ko", "publisher": "note", "kind": "news", "title": "何年も使われたソフトのバグは、もう見つかっていると思っていないか——PHP2Shellで変わったのは「コード」ではなく「調べる力」だった｜yoshi", "published": "2026-10-22 20:53 (page time zone not stated)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "3fb41a7e7a06dd3e25aab49ce88293e319110eb3dbd340336ec54cd1f76c8328", "bytes": 3233 }, "page.html": { "sha256": "a864e73d2b66e453f06b446dd626b20141b759ee17906cbbd2a49bd20429f67a", "bytes": 260111 }, "provenance.json": { "sha256": "1a0d9a1dfaeaddc552ee13d737124ef556f19b222b6622bb56faa0651e8f2a83", "bytes": 1729 }, "rendered.html": { "sha256": "fe07040977b984a619c11ea884476764b681586c958bab14747a505fdbd8ea26", "bytes": 263190 }, "screenshot.jpg": { "sha256": "d4de44f88d0e17a9681fa65ae69bffc0211cca7ba1fef3bdf1e858b63c4629f2", "bytes": 735691 }, "text.txt": { "sha256": "9e7a9149ff59f8fe5acf35027097b969f3ea3035e7b3a6fa86ec64660fa7dd48", "bytes": 12707 } }, "started_utc": "2026-10-23T08:21:51.786Z", "status": 200, "final_url": "https://note.com/gay_egret4207/n/n2c2499dc2998?hl=ko" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja-JP", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A personal essay on note.com (Japanese) by the author 'yoshi', 22 October, arguing that AI shortened not the discovery of the PHP flaw but the time to...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 何年も使われたソフトのバグは、もう見つかっていると思っていないか——PHP2Shellで変わったのは「コード」ではなく「調べる力」だった｜yoshi\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/note/gay-egret4207-n-n2c2499dc2998`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nA personal essay on note.com (Japanese) by the author 'yoshi', 22 October, arguing that AI shortened not the discovery of the PHP flaw but the time to demonstrate it was exploitable. Drawing on what it says are the Wiz Research, Calif and PHP primary pages, it says the weakness traces to PHP 5.4 (2012); that a related bug (PHP bug #78876, CVE-2019-11048) was reported in 2019 and handled as a disk-filling denial of service; and that a 2024 OSTIF/Quarkslab audit found a related out-of-memory issue but did not prove it exploitable, so it went unfixed. It quotes Wiz that AI cut the work from months by a world-class team to about one researcher-week, and says Calif and Wiz found the issue independently in August. It says it leaves out attack steps.\n\n> AIが縮めたのは「発見」ではなく「悪用できると実証するまでの時間」だった。\n\n_Curator's translation:_ \"What AI shortened was not 'discovery' but the time until exploitability was demonstrated.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ note.com essay (Korean translation of a Japanese author, 'yoshi'). It argues AI shortened the time to prove exploitability rather than the discovery itself, tracing bug #78876/CVE-2019-11048 (2019), the 2024 OSTIF/Quarkslab audit and the Calif/Wiz timelines.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"何年も使われたソフトのバグは、もう見つかっていると思っていないか——PHP2Shellで変わったのは「コード」ではなく「調べる力」だった｜yoshi\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja-JP`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "note-masaland-n-n1bda3e5bc53f", "url": "https://note.com/masaland/n/n1bda3e5bc53f?hl=en", "publisher": "note", "kind": "news", "title": "[October 2026] What is PHP2Shell? How Generative AI is Shortening the 'Time' of Security｜Masaland", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "615b8ec663bdce29c123e7b77d217c73e106e63523f3652f11ceeea338597d8e", "bytes": 3233 }, "page.html": { "sha256": "7e68ad5aeb82d284e91a868d6ff441b7ad9132c17cb749a7a03de992fb98cce7", "bytes": 286015 }, "provenance.json": { "sha256": "509ca4b4e941e0d652e051633a0ac8879ee6fbaeb7a52a6522dc1c770b7fa03a", "bytes": 1607 }, "rendered.html": { "sha256": "3cf1ab452ddcca5fb8ea83aafe33a5688e548a8b5d3c22c5251b7ee201c047ac", "bytes": 290236 }, "screenshot.jpg": { "sha256": "51eab516be9c432f8e1cd6f34582c9a432986257cb6091b449372bbf646f644d", "bytes": 673497 }, "text.txt": { "sha256": "23c1454f28f47beeacf55737af352da53ed6bfc3040e6ef7588abad291661127", "bytes": 15881 } }, "started_utc": "2026-10-24T13:37:44.921Z", "status": 200, "final_url": "https://note.com/masaland/n/n1bda3e5bc53f?hl=en" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Masaland (Japanese blog, English edition), October 2026: what PHP2Shell is and how generative AI is shortening security's time. It says preventive shu...", "raw_sha256": {}, "has_notes": true, "notes_md": "# [October 2026] What is PHP2Shell? How Generative AI is Shortening the 'Time' of Security｜Masaland\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/note/masaland-n-n1bda3e5bc53f`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMasaland (Japanese blog, English edition), October 2026: what PHP2Shell is and how generative AI is shortening security's time. It says preventive shutdowns hit sites from online banking to airlines and that Prime Minister Takaichi used her X account to urge preparations to apply the patch immediately. There have been millions of attempted attacks, but as of 23 October there are no confirmed or reported intrusions via PHP2Shell, and the page stresses that being attacked and being intruded upon are different things.\n\n> There have been millions of attempted attacks. However, as of October 23, there are no confirmed or reported cases of intrusion via PHP2Shell.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"[October 2026] What is PHP2Shell? How Generative AI is Shortening the 'Time' of Security｜Masaland\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-cn-php2shell-php-1433819-0-html", "url": "https://www.notebookcheck-cn.com/PHP2Shell-PHP.1433819.0.html", "publisher": "notebookcheck-cn", "kind": "news", "title": "PHP2Shell 波及数百万台服务器，所用 PHP 版本无官方修复补丁 - Notebookcheck-cn.com News", "published": "2026-10-26", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "8f10e4c35946cd0b2212286160701084c7b8e245612c08d07baf17d052e79ecf", "bytes": 983 }, "page.html": { "sha256": "bdd1e960e6bd4b32572c1f15188d9af84422bec1d68a1301fd16256561c0faea", "bytes": 105695 }, "provenance.json": { "sha256": "255ee9a1e5f7756842bb57e442f43afe7f253901c9699b218cee21bfa3512e8f", "bytes": 1690 }, "rendered.html": { "sha256": "b40ef69529e009f370e7627db019b6ffccbd24882b574efe1caa101c5f80c98e", "bytes": 116097 }, "screenshot.jpg": { "sha256": "93ca2731d4ac0e5a9382e5d121c6098494bef0894ecbdf8ccf6a0361e6ef3061", "bytes": 315425 }, "text.txt": { "sha256": "fd81eb1c26ed745aeb4359a460f2818de48e0b21fc6ae026047042ff79a409ee", "bytes": 5726 } }, "started_utc": "2026-10-26T09:51:47.404Z", "status": 200, "final_url": "https://www.notebookcheck-cn.com/PHP2Shell-PHP.1433819.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "cn", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck China edition (Chinese, DeepL translation of Darryl Linington's article), 26 October: the same article recorded in French as notebookche...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell 波及数百万台服务器，所用 PHP 版本无官方修复补丁 - Notebookcheck-cn.com News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/notebookcheck-cn/php2shell-php-1433819-0-html`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck China edition (Chinese, DeepL translation of Darryl Linington's article), 26 October: the same article recorded in French as notebookcheck-php2shell-laisse-des-millions-de-serveur (Shodan counts of about 884,000 exposed hosts on unsupported PHP, banner-based; minimal backports only for 7.4, 8.0 and 8.1; version strings can mislead; CISA advice to take unpatched PHP systems offline). The claims are recorded on the French edition.\n\n> PHP2Shell 的修复仅覆盖 PHP 8.2 至 8.5，这意味着大量面向互联网的 PHP 主机所运行的版本从未获得包含修复的官方发行版。\n\n_Curator's translation:_ \"The PHP2Shell fixes cover only PHP 8.2 to 8.5, which means a large number of internet-facing PHP hosts run versions that never received an official fix release.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell 波及数百万台服务器，所用 PHP 版本无官方修复补丁 - Notebookcheck-cn.com News\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `cn`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-info-php2shell-deixa-milhoes-de-servidores-em", "url": "https://www.notebookcheck.info/PHP2Shell-deixa-milhoes-de-servidores-em-versoes-do-PHP-sem-correcao-oficial.1433721.0.html", "publisher": "notebookcheck", "kind": "news", "title": "PHP2Shell deixa milhões de servidores em versões do PHP sem correção oficial - NotebookCheck.info News", "published": "2026-10-26", "captures": [ { "stamp": "20261026T121439Z", "files": { "headers.json": { "sha256": "cb965a37227ae94c02160deaa8edb6fde91e4299b6154832b09fd404bf0694d6", "bytes": 976 }, "page.html": { "sha256": "c258a708bee1cdd1725621eacf9527db023fe4dfb7d4fe9a13b780aaa17495ee", "bytes": 110891 }, "provenance.json": { "sha256": "00a694d9a2001d73b20324a904eb74b75b50f74dd5b793b37b3fe82e72d36e07", "bytes": 1892 }, "rendered.html": { "sha256": "26fc2a03916f1e6e96b4cc1388e041112bbe5b9f96eadc21b15c038896f4312c", "bytes": 122332 }, "screenshot.jpg": { "sha256": "9fa3a5f4a8d4d4d33bbc942a43507b04dc9b7ee208b0418a1eff5e67f18c851e", "bytes": 376886 }, "text.txt": { "sha256": "222c99da4021fffb47332fde2aeeea69a09ddfc9fe8a006e8bea5e1ab483119f", "bytes": 6278 } }, "started_utc": "2026-10-26T12:19:02.091Z", "status": 200, "final_url": "https://www.notebookcheck.info/PHP2Shell-deixa-milhoes-de-servidores-em-versoes-do-PHP-sem-correcao-oficial.1433721.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T121439Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck (Portuguese edition, DeepL translation of Darryl Linington's article), 26 October: the same article recorded in French as notebookcheck-...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell deixa milhões de servidores em versões do PHP sem correção oficial - NotebookCheck.info News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/notebookcheck-info/php2shell-deixa-milhoes-de-servidores-em-versoes-do-php-sem`, snapshot `20261026T121439Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T121439Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck (Portuguese edition, DeepL translation of Darryl Linington's article), 26 October: the same article recorded in French as notebookcheck-php2shell-laisse-des-millions-de-serveur (Shodan counts by Mallory of about 884,000 exposed hosts on unsupported PHP versions, banner-based; CybelAngel's split by version; minimal source backports only for 7.4, 8.0 and 8.1; version strings can mislead). The claims are recorded on the French edition.\n\n> As correções do PHP2Shell abrangem apenas o PHP 8.2 a 8.5, o que deixa uma grande parte dos hosts PHP expostos à internet em versões que nunca receberam uma versão oficial com as correções.\n\n_Curator's translation:_ \"The PHP2Shell fixes cover only PHP 8.2 to 8.5, leaving a large share of internet-exposed PHP hosts on versions that never received an official fix release.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell deixa milhões de servidores em versões do PHP sem correção oficial - NotebookCheck.info News\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-php2shell-co-powinni-sprawdzic-uzytkowni", "url": "https://www.notebookcheck.pl/PHP2Shell-Co-powinni-sprawdzic-uzytkownicy-QNAP-Nextcloud-i-OPNsense.1431990.0.html", "publisher": "notebookcheck", "kind": "news", "title": "PHP2Shell: Co powinni sprawdzić użytkownicy QNAP, Nextcloud i OPNsense - Notebookcheck.pl", "published": "2026-10-23", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "db46b62351f71ed17d81e3aa8cf83b1216addebb3e8e25c710a638489a545521", "bytes": 1033 }, "page.html": { "sha256": "5dcfc7087636e648756e3bc4d65bccdd0cf332e25838157b7a2f3dbc85b818fd", "bytes": 121126 }, "provenance.json": { "sha256": "1b4a052cf3113bb805237b99ca4e79fbfe70fc209401bb310a693bdd4441a375", "bytes": 1842 }, "rendered.html": { "sha256": "07811fb4db4453efc7b2c6f4e65fdea393e7816e63f596b28dcd1bd6a1291244", "bytes": 143898 }, "screenshot.jpg": { "sha256": "3728d66b438d91a4fb6cbe7c5962d139f62a7b39ab27e89dfeaef44708fdea06", "bytes": 722905 }, "text.txt": { "sha256": "81ec3617b11f4004c29cd90ed7e3d22555680012ec10730dfa3fed3c35f5d535", "bytes": 11124 } }, "started_utc": "2026-10-23T23:39:26.817Z", "status": 200, "final_url": "https://www.notebookcheck.pl/PHP2Shell-Co-powinni-sprawdzic-uzytkownicy-QNAP-Nextcloud-i-OPNsense.1431990.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck Poland, 23 October: the Polish edition (translated with DeepL) of the German Notebookcheck guide to PHP2Shell for home labs and NAS, fir...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Co powinni sprawdzić użytkownicy QNAP, Nextcloud i OPNsense - Notebookcheck.pl\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pl/news/notebookcheck/php2shell-co-powinni-sprawdzic-uzytkownicy-qnap-nextcloud-i`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck Poland, 23 October: the Polish edition (translated with DeepL) of the German Notebookcheck guide to PHP2Shell for home labs and NAS, firewalls, Nextcloud and Pi-hole (Steffen Zahn). The facts and the claims are recorded on the German original (notebookcheck-php2shell-im-homelab-qnap-nextcloud-und); this record exists so the vault holds the capture of each edition.\n\n> Nie ma jeszcze wersji z poprawkami, a status brzmi „Fixing”.\n\n_Curator's translation:_ \"There is not yet a fixed version, and the status is 'Fixing'.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Co powinni sprawdzić użytkownicy QNAP, Nextcloud i OPNsense - Notebookcheck.pl\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-php2shell-im-homelab-qnap-nextcloud-und", "url": "https://www.notebookcheck.com/PHP2Shell-im-Homelab-QNAP-Nextcloud-und-OPNsense-jetzt-pruefen.1430521.0.html", "publisher": "Notebookcheck", "kind": "news", "title": "PHP2Shell im Homelab: QNAP, Nextcloud und OPNsense jetzt prüfen - Notebookcheck News", "published": "2026-10-23", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "b01da97be5afb160c7ee5dec6745f649db859f0ccc803e443af5f900f1a5b172", "bytes": 1126 }, "page.html": { "sha256": "7996535183f090225392c7c1e0d277ad1851b706aa93dc407ae0ea69a7c1dc2d", "bytes": 136810 }, "provenance.json": { "sha256": "de7b349d5b6622f24cdf5d85821664dda1c1e9e9358a7fc173d15117694afe91", "bytes": 1739 }, "rendered.html": { "sha256": "9663e33bd283392efb6ee72e85f195314a8a4910924aee905a9889a02b32d2bb", "bytes": 154680 }, "text.txt": { "sha256": "0b475e957e8ad759a8b5414ebe6f67ea8e3e7ff504f7b0600339fda7d083eacb", "bytes": 11247 } }, "started_utc": "2026-10-23T16:09:29.385Z", "status": 200, "final_url": "https://www.notebookcheck.com/PHP2Shell-im-Homelab-QNAP-Nextcloud-und-OPNsense-jetzt-pruefen.1430521.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck (German), 23 October, by Steffen Zahn: a guide to finding and patching the PHP2Shell flaws in home-lab software. QNAP published bulletin...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell im Homelab: QNAP, Nextcloud und OPNsense jetzt prüfen - Notebookcheck News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `at/news/notebookcheck/php2shell-im-homelab-qnap-nextcloud-und-opnsense-jetzt-pruef`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck (German), 23 October, by Steffen Zahn: a guide to finding and patching the PHP2Shell flaws in home-lab software. QNAP published bulletin QSA-26-18 on 22 October with no fixed version yet and advises taking the NAS off the internet; Download Station and PHP Extensions will get no fix at all (support ended 30 September). OPNsense released 26.7.7 (Community, PHP 8.5.12) and 26.4.2p3 (Business, PHP 8.3.36) on Wednesday evening; Netgate shipped new PHP for pfSense, installable only by SSH or console. Synology had published no bulletin by 22 October. The article says watchTowr has seen active attempts since Wednesday but reported no successful break-ins, that the German BSI knew of no confirmed exploitation in its 21 October warning, and that QNAP says it knows of no attacks on its own devices. It also appears as a Polish edition (notebookcheck-php2shell-co-powinni-sprawdzic-uzytkowni).\n\n> Fertige Updates gibt es noch nicht, der Status lautet „Fixing“.\n\n_Curator's translation:_ \"There are no finished updates yet; the status is 'Fixing'.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell im Homelab: QNAP, Nextcloud und OPNsense jetzt prüfen - Notebookcheck News\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-php2shell-kritieke-php-kwetsbaarheden-tr", "url": "https://www.notebookcheck.nl/PHP2Shell-Kritieke-PHP-kwetsbaarheden-treffen-mod_php-servers-het-hardst.1430631.0.html", "publisher": "notebookcheck", "kind": "news", "title": "PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws", "published": "2026-10-22", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "6d8119c1614093dfc87e6eda0d1b27ca9b42884395d0e7adf24a95011224640d", "bytes": 980 }, "page.html": { "sha256": "1d3748e0f07ee8524e56559ee3e0b686ee1c40753acad97b72940ebc210b4cc4", "bytes": 108257 }, "provenance.json": { "sha256": "563593746c42d0f64fc88934f5d0e0f5babec711fbcb419bb7a2826398705032", "bytes": 1860 }, "rendered.html": { "sha256": "4c458801868b07f44700f25579050a53be37b591861d1fe45dee82cc6910221f", "bytes": 108245 }, "screenshot.jpg": { "sha256": "7b789eaf2ab2ffbf7d97f1072c91480446d2ae97619b9a22c64dd73fdbe6d157", "bytes": 512753 }, "text.txt": { "sha256": "2f5f55ec2c0146e3c450bf8f7bccdb681d712ae050b0b9a5ad18c8a2ed24015f", "bytes": 8826 } }, "started_utc": "2026-10-25T09:53:15.367Z", "status": 200, "final_url": "https://www.notebookcheck.nl/PHP2Shell-Kritieke-PHP-kwetsbaarheden-treffen-mod_php-servers-het-hardst.1430631.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck Nederland (Dutch, DeepL translation of Steffen Zahn's German piece), 22 October. PHP brought its security release forward to Wednesday 2...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/news/notebookcheck/php2shell-kritieke-php-kwetsbaarheden-treffen-mod-php-server`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck Nederland (Dutch, DeepL translation of Steffen Zahn's German piece), 22 October. PHP brought its security release forward to Wednesday 21 October, 14:00 UTC, after details of two flaws leaked on Hacker News the day before; the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, both flaws are in the interpreter, both score 9.2 on CVSS 4.0, and PHP confirmed code execution without authentication. It explains why Apache with mod_php is the most exposed set-up, and that PHP-FPM is less so for the first flaw. It reports watchTowr seeing active attempts and Cloudflare seeing attacks before the patch, with no successful break-in confirmed yet; Dutch government services including DigiD and MijnOverheid went offline as a precaution and the UK NCSC advises taking unpatched systems offline as a last resort. It says Wiz Research found the flaws and reported them on 24 August, with Gemini 4 Argon and GPT-5.6 Sol helping.\n\n> PHP heeft zijn beveiligingsrelease vervroegd naar woensdag 21 oktober om 14.00 uur UTC, nadat een dag eerder details over twee kwetsbaarheden waren uitgelekt op Hacker News.\n\n_Curator's translation:_ \"PHP moved its security release forward to Wednesday 21 October at 14:00 UTC, after details of the two vulnerabilities leaked on Hacker News a day earlier.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Kritieke PHP-kwetsbaarheden treffen mod_php-servers het hardst - Notebookcheck.nl Nieuws\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-php2shell-laisse-des-millions-de-serveur", "url": "https://www.notebookcheck.biz/PHP2Shell-laisse-des-millions-de-serveurs-sous-des-versions-de-PHP-sans-correctif-officiel.1433758.0.html", "publisher": "Notebookcheck", "kind": "news", "title": "PHP2Shell laisse des millions de serveurs sous des versions de PHP sans correctif officiel - NotebookCheck.biz News", "published": "2026-10-26", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "360cbc07f59a0abfddd99295dd0de0456e00bf1229f3f9a789bf68d433a14760", "bytes": 1033 }, "page.html": { "sha256": "bafda66bb412634f1b935c3c82d65da88fa9533c48c7ca394761b12c3a1caeec", "bytes": 112413 }, "provenance.json": { "sha256": "013003cf372cd2b53c1863d9255c878acfc758c8706d26fbc4bf9bd769f92a10", "bytes": 1912 }, "rendered.html": { "sha256": "a7ff6ef1a63125ddea5b59c6faf48dcfff063173d604d72efde1fa36da930d4f", "bytes": 125599 }, "screenshot.jpg": { "sha256": "5ae019437d3dd0f74695bd288680ea0b9fe7b7c8d2179f4d0c43e34fd8a22558", "bytes": 429828 }, "text.txt": { "sha256": "0002440a5cd32c18d09e484692ce35f531b131f80afcd8c80188db66a1505d3b", "bytes": 6824 } }, "started_utc": "2026-10-26T07:21:08.246Z", "status": 200, "final_url": "https://www.notebookcheck.biz/PHP2Shell-laisse-des-millions-de-serveurs-sous-des-versions-de-PHP-sans-correctif-officiel.1433758.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck (French edition, DeepL translation of Darryl Linington's article), 26 October: the fixes cover only PHP 8.2 to 8.5, leaving many interne...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell laisse des millions de serveurs sous des versions de PHP sans correctif officiel - NotebookCheck.biz News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/notebookcheck/php2shell-laisse-des-millions-de-serveurs-sous-des-versions`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck (French edition, DeepL translation of Darryl Linington's article), 26 October: the fixes cover only PHP 8.2 to 8.5, leaving many internet-exposed hosts on versions that never got an official fix. A Shodan count published by Mallory on 20 October found about 884,000 exposed hosts declaring an unsupported PHP version, 59% of the roughly 1.5 million hosts that reveal a version, with about 740,000 more hiding it; CybelAngel's split is about 369,000 on PHP 5.x, 329,000 on 7.x and 186,000 on 8.0 and 8.1, against 612,000 on 8.2 to 8.5; Palo Alto Networks separately counted over 22.6 million potentially vulnerable instances. The article stresses these are banner counts, not confirmed vulnerable sites. It says PHP issued no numbered releases for end-of-life branches but minimal source backports for 7.4, 8.0 and 8.1, nothing for 5.6 or 7.3 and earlier; that distributions can ship the fix under an old version string; and that CISA advised taking PHP-based systems offline if they cannot be updated.\n\n> Les correctifs de PHP2Shell ne couvrent que PHP 8.2 à 8.5, ce qui laisse une grande partie des hôtes PHP exposés à Internet sur des versions qui n’ont jamais bénéficié d’une publication officielle de correctifs.\n\n_Curator's translation:_ \"The PHP2Shell fixes cover only PHP 8.2 to 8.5, which leaves a large share of internet-exposed PHP hosts on versions that never received an official fix release.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell laisse des millions de serveurs sous des versions de PHP sans correctif officiel - NotebookCheck.biz News\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-php2shell-le-falle-critiche-di-php-colpi", "url": "https://www.notebookcheck.it/PHP2Shell-le-falle-critiche-di-PHP-colpiscono-soprattutto-i-server-mod_php.1430599.0.html", "publisher": "Notebookcheck.it", "kind": "news", "title": "PHP2Shell: le falle critiche di PHP colpiscono soprattutto i server mod_php - NotebookCheck.it News", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c95e2c73ec72ba8ca67b45f79042c5cb33e3a682fafe627f90bd1a425f2f3e08", "bytes": 963 }, "page.html": { "sha256": "97b616e2c905233496da1acaf9b44616a2b7c1ee69667948fd38c29016eb4298", "bytes": 117432 }, "provenance.json": { "sha256": "e40e82b4ebee5918fdfff0a967357c41f5624d0ca95a50d360cdcf075b2b9cdc", "bytes": 1776 }, "rendered.html": { "sha256": "71b1a624e2811d2afb57e028419d78d2027bc2567f74d4a73c533abd5b0f70ff", "bytes": 136833 }, "text.txt": { "sha256": "e511e7a4fd8faed0bd00e00fc3f87c957049cd80ffe909d7caae3ed02a623b2d", "bytes": 9274 } }, "started_utc": "2026-10-23T16:18:56.400Z", "status": 200, "final_url": "https://www.notebookcheck.it/PHP2Shell-le-falle-critiche-di-PHP-colpiscono-soprattutto-i-server-mod_php.1430599.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck.it (Italian): the critical PHP flaws hit mod_php servers most. PHP brought the security release forward to Wednesday 21 October at 14:00...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: le falle critiche di PHP colpiscono soprattutto i server mod_php - NotebookCheck.it News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/notebookcheck/php2shell-le-falle-critiche-di-php-colpiscono-soprattutto-i`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck.it (Italian): the critical PHP flaws hit mod_php servers most. PHP brought the security release forward to Wednesday 21 October at 14:00 UTC after details of the two vulnerabilities leaked on Hacker News the day before; fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both bugs are in the interpreter itself, not in a CMS. It quotes the PHP advisory title for CVE-2026-109618: RCE through corruption caused by OOM.\n\n> PHP ha anticipato il rilascio di sicurezza a mercoledì 21 ottobre, alle 14:00 UTC, dopo che i dettagli di due vulnerabilità erano trapelati su Hacker News il giorno prima.\n\n_Curator's translation:_ \"PHP brought the security release forward to Wednesday 21 October, at 14:00 UTC, after the details of two vulnerabilities had leaked on Hacker News the day before.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Notebookcheck (machine-translated from German via DeepL) gives a detailed technical description of both bugs, which SAPIs are exposed, exploitation reports, and mitigations (memory_limit=-1, upload progress off).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: le falle critiche di PHP colpiscono soprattutto i server mod_php - NotebookCheck.it News\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notebookcheck-php2shell-what-qnap-nextcloud-and-opnsen", "url": "https://www.notebookcheck.net/PHP2Shell-What-QNAP-Nextcloud-and-OPNsense-users-should-check.1431047.0.html", "publisher": "Notebookcheck", "kind": "news", "title": "PHP2Shell: What QNAP, Nextcloud and OPNsense users should check - Notebookcheck Review", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "5109a72b4d1c55cf0dd66e9c2a4d1d48bb8cc5e1b30e0d90ae5793b8674ba8ae", "bytes": 1134 }, "page.html": { "sha256": "058416cdd6d4042309b2cb1969e2976f6bc8b8dcd9ea65ae295151f33daf41df", "bytes": 135876 }, "provenance.json": { "sha256": "d7bd3901e0a3760e68118ae2ac1f359dda3dafe8f28cd4e97172720501a61600", "bytes": 1827 }, "rendered.html": { "sha256": "fdc95027a30c2618daa5c538dc1c1fb239c8554a20f3addafaa59e6ddce62e3e", "bytes": 180440 }, "screenshot.jpg": { "sha256": "f587668cf3e59f25e0832ec55f78095446273971cd96470cee97fb1cb98083ae", "bytes": 694915 }, "text.txt": { "sha256": "d376c84ec11bb7cce3865735ad55ff97ba64cbf82daf7f9a8b7aebe19fe1a2c5", "bytes": 10843 } }, "started_utc": "2026-10-23T23:33:57.381Z", "status": 200, "final_url": "https://www.notebookcheck.net/PHP2Shell-What-QNAP-Nextcloud-and-OPNsense-users-should-check.1431047.0.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Notebookcheck (English), a guide for home and small-office users: PHP2Shell is not only a web-hosting problem, because PHP also runs NAS interfaces, f...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: What QNAP, Nextcloud and OPNsense users should check - Notebookcheck Review\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hu/news/notebookcheck/php2shell-what-qnap-nextcloud-and-opnsense-users-should-chec`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotebookcheck (English), a guide for home and small-office users: PHP2Shell is not only a web-hosting problem, because PHP also runs NAS interfaces, firewalls, Nextcloud containers and older Pi-hole installs. QNAP is still working on a fix, OPNsense and pfSense are already patched and Docker images are being rebuilt; it explains how to find PHP on a network and close the holes.\n\n> QNAP is still working on a fix, OPNsense and pfSense are already patched, and Docker images are being rebuilt.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: What QNAP, Nextcloud and OPNsense users should check - Notebookcheck Review\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "notimerica-ciencia-tecnologia-noticia-portaltic-ama", "url": "https://www.notimerica.com/ciencia-tecnologia/noticia-portaltic-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105527.html", "publisher": "Notimérica", "kind": "news", "title": "Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche", "published": "2026-10-23T10:55:27+02:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "4d87a5d7012173d3a0a14574839c0c0870961edc1ac5c3d3f9719aef0ed51498", "bytes": 787 }, "page.html": { "sha256": "ef688027f5bd149a3893bedbb4cb0d67f5ecd13b0efc4d5d1b905ed3099a1d13", "bytes": 256794 }, "provenance.json": { "sha256": "c725dc351b21f0d0249c2b928765f343475391709a5908e1c8cf32b21ea737d8", "bytes": 2000 }, "rendered.html": { "sha256": "acb522f90cf22cda42821308f578068b804c4a64bbc4c9e04e49dd184ab67c03", "bytes": 281320 }, "screenshot.jpg": { "sha256": "95858a7410aa6d568d4ce99801f99007c75ea7674065145b204b5bec42850a20", "bytes": 322739 }, "text.txt": { "sha256": "a2b57b3982d09f3b4ab88f8df56be5a2bf330bc5c8d469970e2b957e567918a1", "bytes": 3927 } }, "started_utc": "2026-10-24T08:56:08.330Z", "status": 200, "final_url": "https://www.notimerica.com/ciencia-tecnologia/noticia-portaltic-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105527.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notimérica (Spanish), 23 October, a Portaltic (Europa Press) item on Amazon Threat Intelligence's report. Amazon identified an exploitation attempt on...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `mx/news/notimerica/ciencia-tecnologia-noticia-portaltic-amazon-detecto-intentos`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNotimérica (Spanish), 23 October, a Portaltic (Europa Press) item on Amazon Threat Intelligence's report. Amazon identified an exploitation attempt on 17 October, caught in its MadPot honeypot telemetry and coming from an IP address on a commercial anonymising network; on disclosure day it also saw several proof-of-concept exploits and further attempts from other anonymised infrastructure, with payloads and infrastructure varying, which it says suggests multiple actors. The piece adds that Cloudflare reported early attacks, that the EU's emergency response team advised isolating internet-facing applications that cannot be updated at once, and that the Netherlands, Belgium and France confirmed voluntary suspensions of official services while Japan recommended disabling pages in extreme cases. It corroborates the 17 October date held in cur2-madpot-17-oct.\n\n> En concreto, el equipo de Amazon Threat Intelligence identificó un intento de explotación el 17 de octubre.\n\n_Curator's translation:_ \"Specifically, the Amazon Threat Intelligence team identified an exploitation attempt on 17 October.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "npr-2026-10-24-nx-s1-6012327-ai-found-the-fl", "url": "https://www.npr.org/2026/10/24/nx-s1-6012327/ai-found-the-flaw-hackers-found-the-leak-the-race-to-save-php2shell", "publisher": "NPR", "kind": "news", "title": "AI found the flaw. Hackers found the leak: The race to save 'PHP2SHELL' : NPR", "published": "2026-10-24", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "88c882526a105e2c74b0ca633212869fafb713901d48eda13fd47907d3c3463a", "bytes": 2264 }, "page.html": { "sha256": "b7d6897b763fa5caf987506f780a716dd725fd1393ac77cadbf93a34ac46b557", "bytes": 152155 }, "provenance.json": { "sha256": "c3cf99b2d9f7d9c622a5469c4531e3c4a637607bcdefa157e1ea717909ce9003", "bytes": 1800 }, "rendered.html": { "sha256": "e1620bfdeaed5b3cbc052fa44351853e1dbf8b936aa7c5108138e281921c85d5", "bytes": 204940 }, "screenshot.jpg": { "sha256": "48637ca708c62d29a99e32be0dc3fc9953ac138d7d2278b2a0a84b93f4bf0728", "bytes": 98585 }, "text.txt": { "sha256": "b084acb5154c7d07abe579b9821eebe55dc9feb891a71c6e43ac0c096fc53d7c", "bytes": 1092 } }, "started_utc": "2026-10-24T16:16:42.061Z", "status": 200, "final_url": "https://www.npr.org/2026/10/24/nx-s1-6012327/ai-found-the-flaw-hackers-found-the-leak-the-race-to-save-php2shell" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). NPR (English), Weekend Edition Saturday, 24 October, with Scott Simon and Kevin Roose. The capture holds only the segment's blurb, not a transcript or...", "raw_sha256": {}, "has_notes": true, "notes_md": "# AI found the flaw. Hackers found the leak: The race to save 'PHP2SHELL' : NPR\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/npr/2026-10-24-nx-s1-6012327-ai-found-the-flaw-hackers-found-the`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNPR (English), Weekend Edition Saturday, 24 October, with Scott Simon and Kevin Roose. The capture holds only the segment's blurb, not a transcript or audio: it says AI discovered the vulnerability, that security researchers rushed to fix it, but that news of the vulnerability leaked and hackers have swooped in.\n\n> AI discovered a vulnerability in part of the internet's architecture, called PHP2SHELL. Security researchers rushed to fix it, but news of the vulnerability leaked and hackers have swooped in.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"AI found the flaw. Hackers found the leak: The race to save 'PHP2SHELL' : NPR\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "nsa-press-php-4630238", "url": "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/", "publisher": "US National Security Agency (NSA)", "kind": "government", "title": "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080954Z", "files": { "headers.json": { "sha256": "97a8c93336e9eaf70c80dd55bf2a30afda4f796323bb1e628388046b2d71ff58", "bytes": 671 }, "page.html": { "sha256": "18db3cea62d9017227ca3bc12cc73fe965e84f2a0d946dbc0278c4772dd415f3", "bytes": 98539 }, "provenance.json": { "sha256": "246b632f5be873be48cc8894fb4abdb03858ee784e155a5f703c690e0c937495", "bytes": 1286 }, "rendered.html": { "sha256": "0e42d4e7ce3e0af33f09f09b458d895320523102285301139861be8ba95f5889", "bytes": 122356 }, "screenshot.png": { "sha256": "1bc158a28beb2de8ef2533cca0ddffbec42a196ae7094ca2d019ff076cd27725", "bytes": 992031 }, "text.txt": { "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "bytes": 4995 } }, "started_utc": "2026-10-22T08:09:54.641Z", "status": 200, "final_url": "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Press release dated Oct. 21, 2026 (no time given). Nicknames the bugs 'PHP2Shell'. Recommends patching, inventory, enhanced logging, replacing EOL PHP; 'If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.' Says the risks 'require immediate patching across United States Government departments and agencies'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA press release: Critical Patches Recommended for PHP Vulnerabilities\n\n- Dated Oct. 21, 2026 (meta datePublished \"Oct. 21, 2026\"); no time given. The X UPDATE post linking to it went out 2026-10-22T00:43:58Z, so the release was presumably up by then.\n- Captured 2026-10-22T08:09:54Z.\n- Key verbatim lines:\n - \"vulnerabilities, collectively nicknamed “PHP2Shell,”\"\n - \"PHP released their open-source software patch Wednesday, October 21, 2026.\"\n - \"All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions.\"\n - Mitigations: \"Adding enhanced logging within network/operational environments\"; \"Replacing end-of-life PHP services which will not be compatible with patching\"\n - \"If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.\"\n - \"“PHP2Shell” could allow attackers to take control of affected web servers without prior access or authentication.\"\n - \"These risks are serious enough to require immediate patching across United States Government departments and agencies.\"\n - \"NSA will continue to work with experts across the intelligence community (IC), including CISA\"\n- No CVE IDs are named in the release.\n" }, { "slug": "nsa-x-2112903220209098897", "url": "https://x.com/NSACyber/status/2112903220209098897", "publisher": "NSA Cybersecurity (@NSACyber)", "kind": "social", "title": "NSA Cyber on X: Effective Immediately ... two critical vulnerabilities", "published": "2026-10-21T13:45:58Z", "captures": [ { "stamp": "20261022T080954Z", "files": { "headers.json": { "sha256": "2b72f04731267bb06c6ed80fb9fab697c55697ef2b83303924c315720ed63729", "bytes": 9020 }, "page.html": { "sha256": "49362e7db1112702cb4586ed77daa898c86293d85b5ebe33b7a7dca7db1396a2", "bytes": 139058 }, "provenance.json": { "sha256": "569e1386915c3d850f140375196be63051f6099dd3eaa803bee46f3d014e8984", "bytes": 1240 }, "rendered.html": { "sha256": "a95403e3cb7230cb93a3aad7f6f4a09998596f2636f7516355cf3d52bb8fcf58", "bytes": 162779 }, "screenshot.png": { "sha256": "f9e02ad5c04f114f4ab6cc0cd14b556924d445869fb512f4306683da40d50564", "bytes": 452042 }, "text.txt": { "sha256": "92ebce791a7b35429d2fee94427932a19b1629de3821a52201648a58298d52e7", "bytes": 1811 } }, "started_utc": "2026-10-22T08:09:54.553Z", "status": 200, "final_url": "https://x.com/NSACyber/status/2112903220209098897" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "First NSA post (pinned). Time from tweet snowflake ID = 2026-10-21T13:45:58Z; the page shows '13:45 · 21 Oct 2026' (UTC browser). 10.1M views at capture. 'If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.'", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA Cyber X post 1 (the \"two critical vulnerabilities\" post)\n\n- URL: https://x.com/NSACyber/status/2112903220209098897. Also pinned on the profile (captured as `nsa-x-nsacyber`).\n- Posted 2026-10-21T13:45:58Z (decoded from the snowflake ID: (id>>22)+1288834974657 ms). The page shows \"13:45 · 21 Oct 2026\"; the capture browser ran in UTC.\n- Captured 2026-10-22T08:09:54Z. Counts at capture: 10.1M views, 1.1K replies, 9.5K reposts, 63K likes, 15K bookmarks.\n- Full text, verbatim (the typo \"it is recommend\" is in the original):\n > Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.\n- Note the timing. The post says \"be prepared for an update\", so it reads as if it came before the patch, or with it. The NSA press release says PHP released its patch \"Wednesday, October 21, 2026\".\n- Mirrors: nitter.net now serves only a shutdown notice (X C&D letters, update dated 10 Oct 2026), captured as `nsa-x-nsacyber-nitter`. xcancel.com returned HTTP 451 to curl.\n" }, { "slug": "nsa-x-2113068811058622971", "url": "https://x.com/NSACyber/status/2113068811058622971", "publisher": "NSA Cybersecurity (@NSACyber)", "kind": "social", "title": "NSA Cyber on X: UPDATE: Specific mitigation guidance ... now available", "published": "2026-10-22T00:43:58Z", "captures": [ { "stamp": "20261022T080954Z", "files": { "headers.json": { "sha256": "9292b5863f63684cb58479f72ed4579062a1ff66108183ddfd21a51a34f25f60", "bytes": 9022 }, "page.html": { "sha256": "8b2c9d9cbd6c8cfa6e5614e7900653b6bcddb21e5d8e4a0a880b9613ae9d1bfe", "bytes": 166142 }, "provenance.json": { "sha256": "0931b8c67b66649c978bd87fd385c5c0e597b091e5e840db5dc9d4d1e1b63c9d", "bytes": 1154 }, "rendered.html": { "sha256": "3a297e1972ba61e2d78a5ca5842af0507e79e8d8b04aa8c7dcfa311794d9242c", "bytes": 167035 }, "screenshot.png": { "sha256": "846daf6b3e0004aee5355c16bf1ad5d57544d6b38547e5cf26d513a0dc8d168a", "bytes": 224980 }, "text.txt": { "sha256": "899e5ba4af69c5311210a846d98721e674abded497de292dfdc4af17b2ff1bd3", "bytes": 2052 } }, "started_utc": "2026-10-22T08:09:54.577Z", "status": 200, "final_url": "https://x.com/NSACyber/status/2113068811058622971" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Second NSA post, from the snowflake ID: 2026-10-22T00:43:58Z. It links (t.co/nuXgQ10Fzc) to the NSA press release 4630238. 206.4K views at capture.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA Cyber X post 2 (UPDATE)\n\n- URL: https://x.com/NSACyber/status/2113068811058622971. Posted 2026-10-22T00:43:58Z (snowflake). The page shows \"0:43 · 22 Oct 2026\".\n- Verbatim: \"UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: https://t.co/nuXgQ10Fzc\". It links to nsa.gov press release Article/4630238 (`nsa-press-php-4630238`).\n- 206.4K views at the 08:09Z capture. The replies are unverified chatter (e.g. one claims GoDaddy reseller support said its servers are unpatched). Do not use them.\n" }, { "slug": "nsa-x-nsacyber", "url": "https://x.com/NSACyber", "publisher": "NSA Cybersecurity (@NSACyber)", "kind": "social", "title": "NSA Cyber (@NSACyber) / X profile timeline", "published": null, "captures": [ { "stamp": "20261022T080925Z", "files": { "headers.json": { "sha256": "9fa8661bfa8f332a71ed3f88de6e09033b05073ba537b3d891f1b4209bf1c757", "bytes": 9022 }, "page.html": { "sha256": "35b05885b38c909cd06bc0f6617a32454843249a5c4d5c92274ca3a543b98310", "bytes": 160043 }, "provenance.json": { "sha256": "0680efdf34c9fb08e25e730dbadcc178f7f0a02d64d82260f9802d4fdaf70a00", "bytes": 893 }, "rendered.html": { "sha256": "ae4abd70be7db953acec8f33cae64b339eb2729b8661c3191dc88e62eb17ee1d", "bytes": 198521 }, "screenshot.png": { "sha256": "20541dc8b918cda68c8be3b4a94e4698a53f3edb149d38ba9d8344210189f384", "bytes": 1255100 }, "text.txt": { "sha256": "5889a1c26173dac8ee58b5269e4f78aeb57dc93520afa220d496e634b5e5b7c0", "bytes": 2388 } }, "started_utc": "2026-10-22T08:09:25.014Z", "status": 200, "final_url": "https://x.com/NSACyber" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Profile timeline at 08:09Z: the pinned PHP post plus the UPDATE post; 201.8K followers.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA Cyber X profile\n\nThe timeline at capture shows the pinned post 2112903220209098897 (18h) and the UPDATE post 2113068811058622971 (7h). No other PHP posts. Captured to keep the profile context.\n" }, { "slug": "nsa-x-nsacyber-nitter", "url": "https://nitter.net/NSACyber", "publisher": "nitter.net", "kind": "social", "title": "nitter.net (shutdown notice, no tweets)", "published": null, "captures": [ { "stamp": "20261022T080925Z", "files": { "headers.json": { "sha256": "ab425e76be267227a6680e0572e20c30271e2d99585b0cb665f948349e7e5e22", "bytes": 700 }, "page.html": { "sha256": "846a9048bdd79311b1c92ef549dc68d73a61edd0f9832264cea107686a3f53cc", "bytes": 12341 }, "provenance.json": { "sha256": "5866931f9bcffc1f87e58582a3b73e4fd0fe9414f675213c27278464589fa4c8", "bytes": 895 }, "rendered.html": { "sha256": "21e41f57eb9abbe1a4b2db26e202689f711d079cff963c4af7c549714eccd108", "bytes": 12292 }, "screenshot.png": { "sha256": "d179e4f97e7b7e0371b33c4fc9e9dd245980aa3bf0ef5add188775144552c848", "bytes": 162950 }, "text.txt": { "sha256": "f4e954159062308642561f65d6f65c068c8ee1001bcafdf6e9388181a78d2d93", "bytes": 1513 } }, "started_utc": "2026-10-22T08:09:25.054Z", "status": 200, "final_url": "https://nitter.net/NSACyber" } ], "status": "failed", "primary": false, "added_by": "collector-gov", "notes": "Mirror is dead: it serves only the maintainer's 10 Oct 2026 notice about X Corp cease-and-desist letters. xcancel.com/NSACyber returned HTTP 451 via curl (not captured).", "raw_sha256": {}, "has_notes": true, "notes_md": "# nitter mirror attempt\n\nnitter.net/NSACyber returned 200, but the page is only a shutdown/legal notice (\"UPDATE Oct 10th ... X Corp. sent cease and desist letters\"). It holds no NSA content. xcancel.com/NSACyber returned HTTP 451 (Unavailable For Legal Reasons) to curl. X itself was reachable directly, so the posts were captured from x.com.\n" }, { "slug": "nukib-aktuality-2470", "url": "https://nukib.gov.cz/cs/infoservis/aktuality/2470-nukib-upozornuje-na-kriticke-zranitelnosti-v-php/", "publisher": "NÚKIB", "kind": "government", "title": "Národní úřad pro kybernetickou a informační bezpečnost - NÚKIB upozorňuje na kritické zranitelnosti v PHP - jediným řešením je aktualizace", "published": "2026-10-21 (as stated on the page)", "captures": [ { "stamp": "20261022T191421Z", "files": { "headers.json": { "sha256": "f5321ce1db92227c40357773a8d05918af0f96b576298cee99e949176aba079e", "bytes": 668 }, "page.html": { "sha256": "296b1217f2035ac2359eb3d9a8d23272cab5d92b1b094e9b90bd30f3cb0e4921", "bytes": 20034 }, "provenance.json": { "sha256": "1509e228b9e5bebec20f205996a0547bc6bbe773ca72bccbff27386e40813b57", "bytes": 1746 }, "rendered.html": { "sha256": "f2efe7588603ad22543871e1961496198708b432f02e180222490ab263ff8235", "bytes": 25310 }, "screenshot.jpg": { "sha256": "dee3d09770a0ff852d171814fe7f059ff4ac7ba21ef138be0e08120f2f33ec79", "bytes": 153675 }, "text.txt": { "sha256": "6bd4d3066e7caa885325cee2a95e81530c916bc62bc45b78f676430944dfbbbb", "bytes": 3868 } }, "started_utc": "2026-10-22T19:14:21.449Z", "status": 200, "final_url": "https://nukib.gov.cz/cs/infoservis/aktuality/2470-nukib-upozornuje-na-kriticke-zranitelnosti-v-php/" } ], "status": "captured", "primary": true, "added_by": "curator@php.newsroom", "lang": "cs", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191421Z. NÚKIB's own notice (Czech national agency, primary)", "raw_sha256": {}, "has_notes": true, "notes_md": "# Národní úřad pro kybernetickou a informační bezpečnost - NÚKIB upozorňuje na kritické zranitelnosti v PHP - jediným řešením je aktualizace\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `cz/cert/nukib/aktuality-2470-php`, snapshot `20261022T191421Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191421Z/provenance.json`. Publisher: NÚKIB. Language: cs. URL: https://nukib.gov.cz/cs/infoservis/aktuality/2470-nukib-upozornuje-na-kriticke-zranitelnosti-v-php/\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNÚKIB, the Czech National Cyber and Information Security Agency, warns of two critical PHP vulnerabilities known as php2shell, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution. Fixes have been released in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and NÚKIB recommends updating immediately (\"the only solution is to update\"); it says information enabling exploitation is publicly available. As a possible indicator of compromise it names unusual processes spawned by PHP services. It links to a detailed notice on the NÚKIB portal.\n\n> Pro dvě kritické zranitelnosti označované jako php2shell už byly zveřejněny bezpečnostní opravy a veřejně jsou dostupné také informace umožňující jejich zneužití.\n\n_Curator's translation:_ Security fixes have already been published for the two critical vulnerabilities known as php2shell, and information enabling their exploitation is also publicly available.\n\n> Opravené verze jsou PHP 8.2.35, 8.3.36, 8.4.27 a 8.5.12. Doporučení je aktualizovat okamžitě.\n\n_Curator's translation:_ The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The recommendation is to update immediately.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): NÚKIB's own notice (Czech national agency, primary)\n\nSupports: agencies\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "nvd-cve-2026-109618", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618", "publisher": "NIST National Vulnerability Database", "kind": "cve", "title": "NVD - CVE-2026-109618", "published": "2026-10-21T14:17:09.357Z", "captures": [ { "stamp": "20261022T081218Z", "files": { "headers.json": { "sha256": "f81072c6a6dc3dda5884e2b701c37879b7d8762357ffa7bd4ea88ab95f9e5d6a", "bytes": 1414 }, "page.html": { "sha256": "5218b57d88785ba853fce0de8804f8994d73d4cb3209339fa458c4a5cbb9881f", "bytes": 2453 }, "provenance.json": { "sha256": "f9105904aa37fc65ae54d1cb66b08b59b354c3eb7b20bf7cc925bd7ff4cfce78", "bytes": 935 }, "rendered.html": { "sha256": "b4880a9e6a29cbee557232a66f9db3531b225dd95a517433c6e326be8bb41e87", "bytes": 2827 }, "screenshot.png": { "sha256": "442aa587ff9ee582c291e7c7a8bca102504856b7a4db838cb313226e016f993e", "bytes": 106759 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:12:18.530Z", "status": 200, "final_url": "https://nvd.nist.gov/vuln/detail/cve-2026-109618" }, { "stamp": "20261022T081302Z", "files": { "headers.json": { "sha256": "5d77eaec3eb1fe5d7fb3a76a35571380e31671576d24b40c26f0f87d75f2c610", "bytes": 1414 }, "page.html": { "sha256": "f372c9f8983a6331efb78d85ea53abc653d4bbe75457c02c9a25d9cc1ec2086e", "bytes": 2453 }, "provenance.json": { "sha256": "578b5687fe8afa3ad4f74ab69b8ca2471a0b0ee0a650e832021623cf9e346931", "bytes": 935 }, "rendered.html": { "sha256": "2aa4037a7f7c9c97111573860083b648f53df74a60cea8fc7f9205b76d01f36e", "bytes": 2827 }, "screenshot.png": { "sha256": "8d848319be976cd91ac761f8f5b19ff3d8547393428ff570f273a774b5094d39", "bytes": 106512 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:13:02.594Z", "status": 200, "final_url": "https://nvd.nist.gov/vuln/detail/cve-2026-109618" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "NVD page did not render in two Playwright captures (empty text); the authoritative copy is raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 17:18:24Z, status Modified. Only CNA (security@php.net, Secondary) CVSS v4 9.2; no NIST primary score yet. NVD CWEs: 416, 755, 824, 1325 (no 1419). No CISA KEV fields.", "raw_sha256": { "nvd-api-2.0.json": "dd864fa6ed53d4b549d2429fad6a22878ddb5a6def44b80cac0628cf4fdab438" }, "has_notes": true, "notes_md": "# NVD CVE-2026-109618: notes\n- The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / \"Loading CVE Information\"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).\n- See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type \"Secondary\", baseScore 9.2, \"CRITICAL\"). There is no NIST primary assessment and no CPE configuration yet.\n- NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.\n- No cisaExploitAdd field (not in KEV at fetch time).\n" }, { "slug": "nvd-cve-2026-109619", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619", "publisher": "NIST National Vulnerability Database", "kind": "cve", "title": "NVD - CVE-2026-109619", "published": "2026-10-21T14:17:09.823Z", "captures": [ { "stamp": "20261022T081219Z", "files": { "headers.json": { "sha256": "fc8d0ec5d6feaed052fd64b49abaebe2394f7ef3bc2ce70aee91e20e1306822e", "bytes": 1413 }, "page.html": { "sha256": "fbdf9ac8177380bc8093bab92baaa18402cc52721b3aaa5b037cb507c15a3bf3", "bytes": 2453 }, "provenance.json": { "sha256": "bad76168518f8666d20502a4cb32e9b3425e785e7abbf63160cbd9081db807b5", "bytes": 944 }, "rendered.html": { "sha256": "3784d224686072278cb9ed34c55c7390353818b2d9b35535eb289099d5bb536f", "bytes": 31323 }, "screenshot.png": { "sha256": "56539f358f1226f93c35cc6828cee0c2edbcda7da8a3fce9e8deaad68f133fea", "bytes": 106528 }, "text.txt": { "sha256": "fbcf781e4294ea8f1f693ce52cf0e7c6ff9e8dff930df337294d54fb9f849466", "bytes": 839 } }, "started_utc": "2026-10-22T08:12:19.279Z", "status": 200, "final_url": "https://nvd.nist.gov/vuln/detail/cve-2026-109619" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Page rendered only as 'Loading CVE Information'; use raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 21:17:52Z. CNA CVSS v4 9.2 only; no NIST score. No KEV fields.", "raw_sha256": { "nvd-api-2.0.json": "627fdaed31c96626e2dcc8af24a6acab1b2da1658bb32b5cf627e30149a0b61c" }, "has_notes": true, "notes_md": "# NVD CVE-2026-109619: notes\n- The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / \"Loading CVE Information\"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).\n- See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type \"Secondary\", baseScore 9.2, \"CRITICAL\"). There is no NIST primary assessment and no CPE configuration yet.\n- NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.\n- No cisaExploitAdd field (not in KEV at fetch time).\n" }, { "slug": "nw-nachrichten-zwischen-weser-und-rhein-244", "url": "https://www.nw.de/nachrichten/zwischen_weser_und_rhein/24445654_Gravierende-Sicherheitsluecke-bei-PHP-Auch-Webseiten-aus-OWL-teils-noch-vom-Netz-genommen.html", "publisher": "Neue Westfälische", "kind": "news", "title": "Gravierende Sicherheitslücke bei PHP: Viele Webseiten aus OWL wieder online | nw.de", "published": "2026-10-23 17:59", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9ef9be8357ae7df7eb6603e2d123c9a27bb90e520a331e634dcc5f9ca846a8d1", "bytes": 927 }, "page.html": { "sha256": "c1f8bb8b5219708bf4ae805ca66acfc67501248803b6d87dad055b9f6dcca756", "bytes": 295235 }, "provenance.json": { "sha256": "2f4de9e68d4be909cef2d66f4d407d72d44dd426960da5418a3c7fe0441b8208", "bytes": 1734 }, "text.txt": { "sha256": "ae2f5139f7f6a0678a7a02833a2f847b7d88ed314739a461103a9bfd7586f43b", "bytes": 9142 } }, "started_utc": "2026-10-23T16:13:25.685Z", "status": 200, "final_url": "https://www.nw.de/nachrichten/zwischen_weser_und_rhein/24445654_Gravierende-Sicherheitsluecke-bei-PHP-Viele-Webseiten-aus-OWL-wieder-online.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Neue Westfälische (German), 23 October, regional report from East Westphalia-Lippe. Since Wednesday afternoon (21 October) websites of public bodies a...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Gravierende Sicherheitslücke bei PHP: Viele Webseiten aus OWL wieder online | nw.de\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/nw/nachrichten-zwischen-weser-und-rhein-24445654-gravierende-si`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nNeue Westfälische (German), 23 October, regional report from East Westphalia-Lippe. Since Wednesday afternoon (21 October) websites of public bodies and companies were in 'maintenance' or unreachable; by 23 October many were back, including the Hochschule für Musik Detmold, Hochschule Bielefeld, Universität Paderborn, Stadtwerke Bielefeld, Bielefeld's service portal, Stadt Gütersloh, Klinikum Bielefeld, the Lippe road-traffic office and Polizei NRW. Still offline at 18:00 on 23 October: the Kreis Paderborn and the Bielefeld fire brigade. It cites the BSI, Huntress, the federal CERT and the PHP security team, an IT expert's call to take unpatched systems off the network, the Cloudflare chief's statement to Sky News that there had been 'millions' of exploitation attempts worldwide, and a German parliamentary intelligence-oversight chair, Marc Henrichmann, calling it 'a turning point'.\n\n> Offline sind derzeit unter anderem noch die Internetseiten des Kreises Paderborn und der Feuerwehr Bielefeld (Stand: 23. Oktober, 18 Uhr).\n\n_Curator's translation:_ \"Among others, the websites of the Paderborn district and the Bielefeld fire brigade are still offline (as of 23 October, 18:00).\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Neue Westfälische lists East Westphalia-Lippe (OWL) sites that went offline and are back (HfM Detmold, Hochschule Bielefeld, Uni Paderborn, Stadtwerke Bielefeld, City of Gütersloh, Klinikum Bielefeld, Lippe vehicle registration office, NRW Police, Herford). As of 22 Oct 19:00, Westfalenwind, Kreis Paderborn, the Bielefeld fire brigade and Bitel webmail/webhosting were still offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Gravierende Sicherheitslücke bei PHP: Viele Webseiten aus OWL wieder online | nw.de\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "okaz-technology-na-2272170", "url": "https://www.okaz.com.sa/technology/na/2272170", "publisher": "عكاظ", "kind": "news", "title": "ثغرتان خطيرتان في «PHP» تهددان ملايين المواقع على الإنترنت - أخبار السعودية | صحيفة عكاظ", "published": "2026-10-24 07:14", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "0b83ee1237c181e0dd3c1882ab37cf84fb44daa9e00f0b647259a5abbc71bea2", "bytes": 1216 }, "page.html": { "sha256": "49f1a1d4561caa819f5a15d6e5ac262eef2dee20218c8192bb59feb06307b135", "bytes": 255050 }, "provenance.json": { "sha256": "7ddcb49b66b7e42f08ed666d7d6c418eb7771904aa6f4e54286f82b8ec12408a", "bytes": 1504 }, "text.txt": { "sha256": "96418a450b7047c0de58ef2d64cf229e17bebe9c4fbfb51842b843eb4903c595", "bytes": 9065 } }, "started_utc": "2026-10-24T13:56:22.090Z", "status": 200, "final_url": "https://www.okaz.com.sa/technology/na/2272170" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Okaz (Arabic, Saudi Arabia), 24 October, a general explainer. It says, citing the Associated Press, that the two flaws, which AI helped to find the ri...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثغرتان خطيرتان في «PHP» تهددان ملايين المواقع على الإنترنت - أخبار السعودية | صحيفة عكاظ\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sa/news/okaz/technology-na-2272170`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nOkaz (Arabic, Saudi Arabia), 24 October, a general explainer. It says, citing the Associated Press, that the two flaws, which AI helped to find the risks of, caused disruptions to some government websites and services in the UK, Finland and Japan; that the FBI warned of remote code execution; that PHP's fixes shipped on 21 October (8.2.35, 8.3.36, 8.4.27, 8.5.12) and ENISA urged organisations to inventory PHP systems and prioritise internet-facing servers. It also says early signs of one of the problems had been known since 2024 and that the PHP project acknowledged the delay in handling it reflects a weakness in how security reports are processed and prioritised; no source is named for that last statement.\n\n> وتسببت الثغرتان، اللتان ساعد الذكاء الاصطناعي في اكتشاف مخاطرهما، في اضطرابات طالت بعض المواقع والخدمات الحكومية في بريطانيا وفنلندا واليابان، بالتزامن مع إجراءات عاجلة لتثبيت التحديثات الأمنية ووفقاً لوكالة «أسوشيتد برس».\n\n_Curator's translation:_ \"The two flaws, whose risks AI helped to uncover, caused disruption to some government sites and services in the UK, Finland and Japan, alongside urgent patching, according to the Associated Press.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثغرتان خطيرتان في «PHP» تهددان ملايين المواقع على الإنترنت - أخبار السعودية | صحيفة عكاظ\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. The lead image is captioned as AI-generated (site chrome). Nothing in the article text addresses an AI or hides text from a reader.\n" }, { "slug": "openaccessgovernment-ncsc-issues-warning-over-critical-php-re", "url": "https://www.openaccessgovernment.org/ncsc-issues-warning-over-critical-php-remote-code-execution-vulnerabilities/215806/", "publisher": "Open Access Government", "kind": "news", "title": "NCSC issues warning over critical PHP remote code execution vulnerabilities", "published": "2026-10-23T08:13:02+00:00", "captures": [ { "stamp": "20261024T110459Z", "files": { "headers.json": { "sha256": "337a54d14a98383111a3574b9ddd9bd6936e16f172f3ac483dc6ff5643b07ede", "bytes": 1332 }, "page.html": { "sha256": "fac236061bd8cbec7c2c07ab1a3971ed62b049d7e1df230c38ba3af925ca5dad", "bytes": 327373 }, "provenance.json": { "sha256": "4005f560dbb864735773556748fffd7d63391f4abbd579c787bb123d9bd6618e", "bytes": 1863 }, "rendered.html": { "sha256": "6bde993c96d1e6039d6110e0ec078d237daf91643d09c03e0f0eecdde57d3c92", "bytes": 401611 }, "screenshot.jpg": { "sha256": "31b52f6755cab88b156cc80a3147e89340bd2e42cf91d9daa0ee11893e8d3c61", "bytes": 585160 }, "text.txt": { "sha256": "9e971974c7995f7f24d076c5ad6674fd405b32f5b0233e213dce35b99017abc7", "bytes": 6493 } }, "started_utc": "2026-10-24T11:34:29.672Z", "status": 200, "final_url": "https://www.openaccessgovernment.org/ncsc-issues-warning-over-critical-php-remote-code-execution-vulnerabilities/215806/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-GB", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T110459Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Open Access Government (UK), 23 October: the NCSC released an urgent advisory urging all UK organisations to act at once on the two PHP vulnerabilitie...", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC issues warning over critical PHP remote code execution vulnerabilities\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `za/news/openaccessgovernment/ncsc-issues-warning-over-critical-php-remote-code-execution`, snapshot `20261024T110459Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T110459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nOpen Access Government (UK), 23 October: the NCSC released an urgent advisory urging all UK organisations to act at once on the two PHP vulnerabilities, which permit unauthenticated remote code execution on web servers. It names them by mechanism: CVE-2026-109618 'Partial Request Initialisation' and CVE-2026-109619 'Stale State Reuse', both stemming from improper memory management during out-of-memory conditions.\n\n> The UK’s National Cyber Security Centre (NCSC) has released an urgent security advisory urging all UK organisations to take immediate action against two critical vulnerabilities affecting PHP\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"NCSC issues warning over critical PHP remote code execution vulnerabilities\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-GB`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "openai-blog-coordinated-disclosure", "url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/", "publisher": "OpenAI", "kind": "researcher", "title": "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081113Z", "files": { "headers.json": { "sha256": "7b02609d3cb8321fcd39f1fb944357b1becd2b3914b213682188380e551a576e", "bytes": 1912 }, "page.html": { "sha256": "fdf2d9f575486a9ace314ca2636c5ddac6e6cbe0cb71fbd74c561248b86caef2", "bytes": 10672 }, "provenance.json": { "sha256": "044271cf8e68e02415a432222e0036e63e3bc6ba426046d653313c6cf329a96e", "bytes": 1012 }, "rendered.html": { "sha256": "582d07e3d24a3e25bdb6f9515a3ecee4de66710e90c88b8fe2bb35f6457f1387", "bytes": 11479 }, "screenshot.png": { "sha256": "c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc", "bytes": 13108 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:11:13.594Z", "status": 403, "final_url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/" }, { "stamp": "20261022T112413Z", "files": { "headers.json": { "sha256": "e4f85b63820ea6efd08d11267c2b64182f40b903e674511097639f35151ff850", "bytes": 1914 }, "page.html": { "sha256": "db092a078bc5df2a4c7258208dd350e18d58597541c27492bb6085ddc605b519", "bytes": 10672 }, "provenance.json": { "sha256": "adbd882dc23ca47f5c3ce16c95f07213ed270f28011521f7beade694144a3cb0", "bytes": 1012 }, "rendered.html": { "sha256": "727b7be84beefe987e85a9a6d99200779878441c04443791f3ee6aa992118351", "bytes": 11479 }, "screenshot.png": { "sha256": "c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc", "bytes": 13108 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T11:24:13.137Z", "status": 403, "final_url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/" } ], "status": "blocked", "primary": true, "added_by": "collector-researchers", "notes": "openai.com served a Cloudflare 'Just a moment...' challenge (HTTP 403) to capture.mjs, curl and WebFetch at 2026-10-22T08:11Z. The 403 capture folder is kept as the record. Content known only via secondary quotes; another agent should retry. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked.", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI: \"Patch the Planet: global response coordination as agents uncover critical vulnerabilities\" — BLOCKED\n\n- URL https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ (found via web search; title as indexed). Every fetch at 2026-10-22T08:11Z got a Cloudflare challenge page (\"Just a moment...\", HTTP 403): capture.mjs, curl and WebFetch. The 403 capture is kept as the record of the attempt.\n- archive.org was also unreachable (TLS connection reset via proxy), so no Wayback copy could be checked.\n- What is known only second-hand (search-result snippets, unverified wording):\n - Published Oct 21, 2026.\n - \"Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities.\"\n - OpenAI X post (x.com/OpenAI/status/2112907856018309586): \"OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and s[ecurity providers]...\"\n - Launched patchtheplanet.org and a \"php2shell-checker\" (Codex skill + Node script) on GitHub.\n - \"one of the most impactful security issues in recent memory\" (quoted by The Hacker News and the BBC).\n- Contradiction to chase: the PHP Foundation says \"OpenAI independently reported the same root cause on the same day\" (Aug 11) and further vectors Sept 18 (OpenAI Codex Security, Amy Burnett). Secondary reports of OpenAI's post reportedly credit only Calif and Wiz with discovery.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n" }, { "slug": "openai-community-php-flaws", "url": "https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490", "publisher": "OpenAI Developer Community (user 'sps', Leader)", "kind": "forum", "title": "OpenAI models help researchers uncover critical PHP security flaws", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081721Z", "files": { "headers.json": { "sha256": "86f75f0dcbf3bc611bd0c24cc8c87f49138270eaac36ff55f379acd57638d537", "bytes": 1273 }, "page.html": { "sha256": "9b1e1cbea269bc3fe068f7344d39a81937b9ec473044047d9d0700cb653af679", "bytes": 296980 }, "provenance.json": { "sha256": "1394b5dabf1a6c5064c6bd0a2a0750815ffb787cf14f7155f7a1c680a5566c8d", "bytes": 1153 }, "rendered.html": { "sha256": "f20e90bdf364618ef6f4900343a7e3abbdb5e6006e628ae4e80a8b92bd8bdf47", "bytes": 624051 }, "screenshot.png": { "sha256": "e3138cd2f1d4e9539051514491c494acd19c7c4afffabe913081dd1ef8d3a691", "bytes": 370209 }, "text.txt": { "sha256": "43afe7a0a3b96a86e52cbeea1c6ae41560bab1566da848fc4f9067152f739cd5", "bytes": 3504 } }, "started_utc": "2026-10-22T08:17:21.331Z", "status": 200, "final_url": "https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490" } ], "status": "captured", "primary": false, "added_by": "collector-researchers", "notes": "Forum repost of OpenAI's announcement text, Oct 21; links https://github.com/openai/php2shell-checker (Codex skill).", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI Developer Community repost (Oct 21)\n\n- User \"sps\" (Leader badge) reposts OpenAI's announcement text, tagged gpt-5.6-sol. Adds: \"If you are wondering whether your website is affected, we have packaged a Codex skill to help check... https://github.com/openai/php2shell-checker\". Secondary to the X post; useful as an accessible copy while openai.com is blocked.\n" }, { "slug": "openai-patch-the-planet-launch", "url": "https://openai.com/index/patch-the-planet/", "publisher": "OpenAI", "kind": "researcher", "title": "Patch the Planet (launch announcement)", "published": null, "captures": [ { "stamp": "20261022T081658Z", "files": { "headers.json": { "sha256": "dabb6d316b2a9ca13a6a49cd3d11a59538e1df05d7bd684ec04dd3ff4a830c61", "bytes": 1920 }, "page.html": { "sha256": "1debac9983b263577c7488d66e2818ce992f602955f908219aa39abff4854500", "bytes": 10484 }, "provenance.json": { "sha256": "eecdf8db164ee1e68d9f8e7f6c9705554227dbe3f65fa9ddf547d56f2aa0fb54", "bytes": 940 }, "rendered.html": { "sha256": "80b0289e281954fb599df1170766a5d6f8a6bdecad2a5b444dd54e0a109542ab", "bytes": 11291 }, "screenshot.png": { "sha256": "c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc", "bytes": 13108 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:16:58.833Z", "status": 403, "final_url": "https://openai.com/index/patch-the-planet/" }, { "stamp": "20261022T112430Z", "files": { "headers.json": { "sha256": "cb97f3646fc464783030ad6f26b7191a2153e7964501252ae1fd40d86db2fbb7", "bytes": 3536 }, "page.html": { "sha256": "ad9f31cd0180d78e020821254328f835f4aa9b45f55d380ac5c4ba0e0fbd0a12", "bytes": 471833 }, "provenance.json": { "sha256": "a4668895879d2911dd924db2f462ac177db64b7dd8c7343b68e6f57540c78da8", "bytes": 1007 }, "rendered.html": { "sha256": "66a7a5d479dc9553dcba734583b2b1a930f2ea9a4284417125fb1ec24ff54088", "bytes": 471423 }, "screenshot.png": { "sha256": "d24aaf68ae28b9ffd320d4f4bec241764fe84587ae5932454b99c3780aafe6b2", "bytes": 1532182 }, "text.txt": { "sha256": "1bc9a32356688dd3f82be20cb4c54b29c9d9d1fd3d04278dcdccb0fe504c2db4", "bytes": 13908 } }, "started_utc": "2026-10-22T11:24:30.611Z", "status": 200, "final_url": "https://openai.com/index/patch-the-planet/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Cloudflare challenge (403) at 2026-10-22T08:17Z. Launch date reported by secondary sources as June 2026 (unverified); Calif says invitation came by July 30 2026; BBC says PHP Foundation joined in July 2026. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured.", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI \"Patch the Planet\" launch post — BLOCKED\n\n- https://openai.com/index/patch-the-planet/ — Cloudflare challenge 403 at 2026-10-22T08:16:58Z. The 403 capture is kept.\n- Secondary (unverified, search snippets): a Daybreak initiative built with Trail of Bits, with HackerOne and Calif as partners; early projects cURL, Python, Go, aiohttp, Sigstore, pyca/cryptography; model \"GPT-5.5-Cyber\". Launch reportedly June 22, 2026 (one snippet). This differs from the BBC framing that the PHP Foundation \"joined\" in July: the Foundation says it \"got the PHP project into the Patch the Planet program\", and Calif says \"OpenAI invited us\".\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n" }, { "slug": "openwall-oss-security-109619-thread", "url": "https://www.openwall.com/lists/oss-security/2026/10/21/16", "publisher": "oss-security list (replies: Aaron Rainbolt, Yves-Alexis Perez/Debian, Christian Fischer/Greenbone)", "kind": "forum", "title": "Re: CVE-2026-109619 thread (21/16, 21/17, 21/23, 22/2)", "published": "2026-10-21T15:24:37Z", "captures": [], "status": "captured", "primary": false, "added_by": "collector-primary", "notes": "raw/ curl copies of four replies. Fediverse report (fedi.katze.sh/@elise) that the 8.5.12 fix may be incomplete or a different new bug; Canonical reportedly told by PHP 'unrelated and not a real issue' (second-hand, via Matrix). Greenbone notes 7.4-8.1 are implicitly affected.", "raw_sha256": { "oss-security-2026-10-21-16.html": "6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccf", "oss-security-2026-10-21-17.html": "059317aa4a1f458e19196e6add44a6b3106632b82c82f104a5b83d0df6fbe09f", "oss-security-2026-10-21-23.html": "39555f34a419becc6a47480eabb369e05f4bac6ce06e9e3843e4dfcb5c99801b", "oss-security-2026-10-22-2.html": "bbc0f0fc06953b13308925334e39e7808796e46ea9505630917762502996bea2" }, "has_notes": true, "notes_md": "# oss-security replies to the CVE-2026-109619 announcement: notes\n- Captured with curl only (raw/), ~08:14Z on 22 Oct. These are third-party replies, not PHP statements.\n- 21/16, Aaron Rainbolt, 21 Oct 10:24:37 -0500 (15:24Z): \"While not yet fully confirmed, the Fediverse is reporting that the fix to at least PHP 8.5.12 may be incomplete: https://fedi.katze.sh/@elise/117479383739450605\"\n- 21/17, Yves-Alexis Perez (Debian), 17:41:56 +0200 (15:41Z): @elise also said it seems to be a *different* vulnerability: \"there's no way this is the same vuln, this is another one.\" (https://fedi.katze.sh/@elise/117478655339557825)\n- 21/23, Rainbolt, 12:29:01 -0500 (17:29Z): per #security:ubuntu.com Matrix, Canonical asked PHP and \"was told that it's 'unrelated and not a real issue'\". Second-hand and unconfirmed on-list.\n- 22/2, Christian Fischer (Greenbone), 22 Oct 08:45:47 +0200 (06:45Z): the subject \"PHP 8.2-8.5\" could imply that older versions are unaffected, but the php.net backports to 7.4/8.0/8.1 imply that \"at least versions down to 7.4 are affected as well\".\n- OPEN: is there a third PHP bug, or an incomplete fix in 8.5.12? Not confirmed by PHP on-list as of capture. The fedi.katze.sh posts should be captured by the social collector.\n" }, { "slug": "openwall-oss-security-2026-10-20-34", "url": "https://www.openwall.com/lists/oss-security/2026/10/20/34", "publisher": "oss-security list (Alan Coopersmith, Oracle)", "kind": "advisory", "title": "Upcoming Critical PHP Security Release", "published": "2026-10-20T20:22:51Z", "captures": [ { "stamp": "20261022T081408Z", "files": { "headers.json": { "sha256": "716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114", "bytes": 239 }, "page.html": { "sha256": "46a94f610255e2ee75ab240c658666ef2589e34e4dd4fcb93b5c5e45fc9917d4", "bytes": 5800 }, "provenance.json": { "sha256": "04ff8e63e2b72caeb3d48ed4a44ecc28434a0414db9f8d59022e7b75af8ccb40", "bytes": 1012 }, "rendered.html": { "sha256": "5c80dc74b7328496b9f3ee62eef06aa707db7327bd0bcdd7ab9aa4f0c5a5a5d8", "bytes": 6056 }, "screenshot.png": { "sha256": "c03f4fc0fefe0485485685cdf28d3e439a4b167b3022a946ee928be55cd4ee0d", "bytes": 120872 }, "text.txt": { "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "bytes": 1415 } }, "started_utc": "2026-10-22T08:14:08.402Z", "status": 200, "final_url": "https://www.openwall.com/lists/oss-security/2026/10/20/34" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Date header Tue, 20 Oct 2026 13:22:51 -0700 (= 20:22:51Z). Quotes the php.net pre-announcement verbatim: scheduled 21 Oct 14:00 UTC, two vulns CVSS v4.0 9.2.", "raw_sha256": {}, "has_notes": true, "notes_md": "# oss-security 2026/10/20/34: notes\n- Posted by Alan Coopersmith (Oracle). Date: Tue, 20 Oct 2026 13:22:51 -0700 = 20:22:51Z.\n- Relays the php.net pre-announcement verbatim: \"It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.\" \"It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.\" \"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.\"\n- Timing evidence: the php.net pre-announcement was public by 20:22Z on 20 Oct. That fits the Foundation's \"19:30 UTC\" and contradicts php.net's own feed timestamp of 20:32:00+00:00.\n" }, { "slug": "openwall-oss-security-2026-10-21-6", "url": "https://www.openwall.com/lists/oss-security/2026/10/21/6", "publisher": "oss-security list (Jakub Zelenka, PHP security team)", "kind": "advisory", "title": "CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption", "published": "2026-10-21T14:41:54Z", "captures": [ { "stamp": "20261022T081408Z", "files": { "headers.json": { "sha256": "716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114", "bytes": 239 }, "page.html": { "sha256": "d43a7569e9b4ff185814a61ed2a17e0b058d4554558a9fee8e3a7a29810169c5", "bytes": 6170 }, "provenance.json": { "sha256": "9ab3756501428b0a77ed30c1d7ef15298f6a8edb131b1dc1436043a045609b4b", "bytes": 1024 }, "rendered.html": { "sha256": "0686ceff1b17dfaad334b167b4f0fbb9dc9cbcdc897203d210b9a1d7a9630269", "bytes": 6426 }, "screenshot.png": { "sha256": "6604c447fd5c7db94e64b0c9eeb75cd7301d461bd4f903890db31f9971d20236", "bytes": 146765 }, "text.txt": { "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "bytes": 1805 } }, "started_utc": "2026-10-22T08:14:08.516Z", "status": 200, "final_url": "https://www.openwall.com/lists/oss-security/2026/10/21/6" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Date header Wed, 21 Oct 2026 16:41:54 +0200. Official PHP security team announcement.", "raw_sha256": {}, "has_notes": true, "notes_md": "# oss-security 2026/10/21/6: notes\n- From Jakub Zelenka (PHP security team; GitHub handle bukka, who published both GHSAs). Date 21 Oct 2026 16:41:54 +0200 = 14:41:54Z.\n- Verbatim: \"CVE: CVE-2026-109618 / Severity: Critical (CVSS v4.0: 9.2)\". \"Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, and PHP 8.5 before 8.5.12.\"\n- \"Unauthenticated RCE has been demonstrated over HTTP against Apache mod_php, before application code executes. Source analysis also indicates FPM susceptibility, although a complete FPM exploit has not been demonstrated.\"\n- \"Updating is the only complete mitigation.\"\n" }, { "slug": "openwall-oss-security-2026-10-21-7", "url": "https://www.openwall.com/lists/oss-security/2026/10/21/7", "publisher": "oss-security list (Jakub Zelenka, PHP security team)", "kind": "advisory", "title": "CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state", "published": "2026-10-21T14:44:06Z", "captures": [ { "stamp": "20261022T081407Z", "files": { "headers.json": { "sha256": "ffb76440772a63ed2186c00ea575b6e673ca3c7222ae89205c2bbb9de07e38ae", "bytes": 239 }, "page.html": { "sha256": "81caae4759a5e9cd8e501221e12f31928874e9d16d7f7e8523e8cb1d36aa69fd", "bytes": 6323 }, "provenance.json": { "sha256": "deeabe8cb21005c2d60c6ffcca6537969877e4411a8d1bbc88503109265756ce", "bytes": 1028 }, "rendered.html": { "sha256": "b797761c288a2b59dad8b9bf3c0f4810af1b669a685b93013a7d6edc0e688638", "bytes": 6579 }, "screenshot.png": { "sha256": "d6c5ab360073ebc5769973dc76493c74acf62cdc6e099f668ebffae91de551fa", "bytes": 154322 }, "text.txt": { "sha256": "ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384", "bytes": 1934 } }, "started_utc": "2026-10-22T08:14:07.371Z", "status": 200, "final_url": "https://www.openwall.com/lists/oss-security/2026/10/21/7" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Date header Wed, 21 Oct 2026 16:44:06 +0200. Replies at 21/16, 21/17, 21/23, 22/2 are in openwall-oss-security-109619-thread.", "raw_sha256": {}, "has_notes": true, "notes_md": "# oss-security 2026/10/21/7: notes\n- From Jakub Zelenka. Date 21 Oct 2026 16:44:06 +0200 = 14:44:06Z. (A reply at 21/16 quotes it as sent \"10:11 AM\" -0500 = 15:11Z. The quoted time does not match the Date header; it may be the reply client's own receive or display time.)\n- Verbatim: \"CVE: CVE-2026-109619 / Severity: Critical (CVSS v4.0: 9.2)\", same affected ranges.\n- \"Unauthenticated RCE has been demonstrated against Apache mod_php and PHP-FPM. Exploitability depends on the affected state, configuration, and application behavior.\"\n- \"Updating is the only reliable mitigation; there is no complete generic configuration workaround.\"\n" }, { "slug": "orf-stories-3445806", "url": "https://orf.at/stories/3445806/", "publisher": "ORF", "kind": "news", "title": "PHP-Lücke: Millionen Angriffsversuche im Netz - news.ORF.at", "published": null, "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "7dda938522a9e06e23db8ac07a637b7a5e71391b0c097f4a60436e8eddd13bbf", "bytes": 970 }, "page.html": { "sha256": "fe941fbb4ff6eab5be2d373b56a1d21596fd1f7da019c049d5130aad097fa7e8", "bytes": 28555 }, "provenance.json": { "sha256": "ef992ab43c609302291f8ae584725bba3392ef237c0056ddc12f7a8c826e13a6", "bytes": 1506 }, "rendered.html": { "sha256": "beb03fcd0e185c838e137f6b81d3908667a6a8d3ec13468cae9670ac96ef050d", "bytes": 1051193 }, "screenshot.jpg": { "sha256": "4bb4a201278373d57af25912a623e595853d5a34d407f448b8231da8f6a1cb3c", "bytes": 377054 }, "text.txt": { "sha256": "e88c6f39edbd6d1c325ec7cc18abe50a9b8ad94010b2d5a425ba59e4252b2d0d", "bytes": 7659 } }, "started_utc": "2026-10-22T18:17:29.393Z", "status": 200, "final_url": "https://orf.at/stories/3445806/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in de: ORF reports Cloudflare's 'millions' of attack attempts and that institutions worldwide took sites offline. It names Austrian sites offline (Uni Wien, TU Wien, NÖN), quotes BSI vice-president Thomas Caspers and expert Chr", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Lücke: Millionen Angriffsversuche im Netz - news.ORF.at\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `at/news/orf/stories-3445806`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: ORF. Language: de. URL: https://orf.at/stories/3445806/\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nORF reports Cloudflare's 'millions' of attack attempts and that institutions worldwide took sites offline. It names Austrian sites offline (Uni Wien, TU Wien, NÖN), quotes BSI vice-president Thomas Caspers and expert Christoph Fischer, CERT.at's warning coordinated with the new Federal Office for Cyber Security, and Anexia's CEO confirming attack attempts.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/at/news/orf/stories-3445806.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: In Austria the websites of the University of Vienna, TU Wien and the newspaper NÖN were temporarily unreachable.\n\n> In Österreich waren unter anderem die Websites der Uni Wien, TU Wien und der „Niederösterreichischen Nachrichten“ („NÖN“) vorübergehend nicht erreichbar.\n\n_Watch reader's translation:_ In Austria, among others, the websites of the University of Vienna, TU Wien and the 'Niederösterreichische Nachrichten' ('NÖN') were temporarily unreachable.\n\n**offline**: In Belgium the foreign ministry's website was offline; in the Netherlands the parliament website was also affected.\n\n> In Belgien war unter anderem die Website des Außenministeriums offline. In den Niederlanden waren der digitale Identitätsdienst DigiD, die Parlamentswebsite und der Internetauftritt des nationalen Cybersicherheitszentrums betroffen.\n\n_Watch reader's translation:_ In Belgium, among others, the foreign ministry's website was offline. In the Netherlands, the digital identity service DigiD, the parliament website and the website of the national cyber security centre were affected.\n\n**agency**: CERT.at spread the warning in coordination with Austria's new Federal Office for Cyber Security, according to the Interior Ministry.\n\n> In Österreich verbreitete unter anderem das nationale Computer Emergency Response Team (CERT.at), laut Innenministerium in Abstimmung mit dem neuen Bundesamt für Cybersicherheit, die Warnung\n\n_Watch reader's translation:_ In Austria, the national Computer Emergency Response Team (CERT.at), according to the Interior Ministry in coordination with the new Federal Office for Cyber Security, spread the warning\n\n**exploitation**: The CEO of Austrian cloud provider Anexia, Alexander Windbichler, confirmed attack attempts on websites operated by Anexia and said bank data was not affected.\n\n> Auch Windbichler bestätigte Angriffsversuche auf die von Anexia betriebenen Websites.\n\n_Watch reader's translation:_ Windbichler also confirmed attack attempts on the websites operated by Anexia.\n\n**official**: BSI vice-president Thomas Caspers warned consumers to expect attempts in coming days to install malware via compromised websites.\n\n> Allerdings sollten Verbraucher darauf achten „und auch damit rechnen“, dass in den nächsten Tagen über möglicherweise kompromittierte Webseiten versucht werden könnte, „Schadgut auch auf ihren Systemen“ zu installieren, warnte BSI-Vizepräsidenten Thomas Caspers.\n\n_Watch reader's translation:_ However, consumers should watch out 'and also expect' that in the coming days attempts could be made via possibly compromised websites to install 'malware on their systems too', warned BSI vice-president Thomas Caspers.\n\n**official**: The BSI, alongside the NSA, said unprotected websites must be shut down immediately.\n\n> müssten ungeschützte Websites nach Ansicht des US-Geheimdienstes National Security Agency (NSA) und des deutschen Bundesamts für Sicherheit in der Informationstechnik (BSI) sofort abgeschaltet werden.\n\n_Watch reader's translation:_ unprotected websites must be shut down immediately in the view of the US National Security Agency (NSA) and the German Federal Office for Information Security (BSI).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 6 new items in de: ORF reports Cloudflare's 'millions' of attack attempts and that institutions worldwide took sites offline. It names Austrian sites offline (Uni Wien, TU Wien, NÖN), quotes BSI vice-president Thomas Caspers and expert Chr\n\nSupports: translations/at/news/orf/stories-3445806.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "ot-2026-10-23-texnologia-php2shell-enas-sto", "url": "https://www.ot.gr/2026/10/23/texnologia/php2shell-enas-stous-deka-organismous-pagkosmios-exei-idi-epireastei/", "publisher": "Οικονομικός Ταχυδρόμος", "kind": "news", "title": "PHP2Shell: Ένας στους δέκα οργανισμούς παγκοσμίως έχει ήδη επηρεαστεί - Οικονομικός Ταχυδρόμος - ot.gr", "published": "2026-10-23T13:15:10+00:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "78864a8daf0827ebbc0cf036123c1a8a894a02d1ad28f0b6f3be107f7bdcaf7d", "bytes": 1664 }, "page.html": { "sha256": "f5824beaddb99dafc9cd0feaeb0cc363fae84b25c409d01a29d5624b67a2359c", "bytes": 248863 }, "provenance.json": { "sha256": "35f9fe49e54f75a378bd3afa35a564c9b61fbf770381836288c24ba7fe219668", "bytes": 1886 }, "rendered.html": { "sha256": "1806fd47e3f97ff0bdc4bf81228afef4737cb95c75475ce9b3f37e5f6f777df0", "bytes": 268536 }, "screenshot.jpg": { "sha256": "c9f05ce0a0dec4494a5b6633a1c17696a270296830a527edb3f4907ed78ce7b5", "bytes": 853240 }, "text.txt": { "sha256": "face65e352940db24a6731a58063624a799c1899fa95197af1f0f09240b20b34", "bytes": 24323 } }, "started_utc": "2026-10-23T23:33:43.600Z", "status": 200, "final_url": "https://www.ot.gr/2026/10/23/texnologia/php2shell-enas-stous-deka-organismous-pagkosmios-exei-idi-epireastei/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "el", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Oikonomikos Tachydromos, ot.gr (Greek), 23 October, reporting a Check Point briefing. It says 10% of organisations worldwide have been affected since...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Ένας στους δέκα οργανισμούς παγκοσμίως έχει ήδη επηρεαστεί - Οικονομικός Ταχυδρόμος - ot.gr\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gr/news/ot/2026-10-23-texnologia-php2shell-enas-stous-deka-organismous`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nOikonomikos Tachydromos, ot.gr (Greek), 23 October, reporting a Check Point briefing. It says 10% of organisations worldwide have been affected since disclosure, with exploitation attempts continuous and strongest around midnight; Europe is the most exposed region (14% of organisations affected, more than double North America, Latin America and Asia-Pacific at 6%), Africa the lowest (4%). By sector: telecommunications 20%, education 18%, media/entertainment and non-profits 16%, agriculture and transport/logistics 14%, software and healthcare 13%, IT 12%, biotech/pharma lowest at 5% of the 23 sectors examined. By country: Hungary 38%, Denmark 32%, Austria 28%, then Sweden and Romania 22%; 13 of the top 15 countries are in Europe.\n\n> Η Ευρώπη αναδεικνύεται ως η πλέον εκτεθειμένη περιοχή, σύμφωνα με ενημερωτικό σημείωμα της εταιρείας κυβερνοασφάλειας Checkpoint, καθώς το 14% των οργανισμών που δραστηριοποιούνται στην ήπειρο έχει επηρεαστεί από τις ευπάθειες.\n\n_Curator's translation:_ \"Europe emerges as the most exposed region, according to a briefing note from the cybersecurity company Check Point, with 14% of organisations operating on the continent affected by the vulnerabilities.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Ένας στους δέκα οργανισμούς παγκοσμίως έχει ήδη επηρεαστεί - Οικονομικός Ταχυδρόμος - ot.gr\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `el`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "ototekno-harianjogja-r-1276080-php2shell-bisa-curi-data-websi", "url": "https://ototekno.harianjogja.com/r-1276080/php2shell-bisa-curi-data-website-kenali-tanda-server-diretas", "publisher": "Berita Oto Tekno - Harianjogja.com", "kind": "news", "title": "PHP2Shell Bisa Curi Data Website, Kenali Tanda Server Diretas", "published": "2026-10-23T10:47:23+07:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "cbafae73ecac80985d68f55ea581c7e2e0ee7006b7051b876fc9d7cd44674092", "bytes": 1552 }, "page.html": { "sha256": "4a1c5ad08835ee6b511a4661a45f962c5bf8569ba6f14264822c18435b90606e", "bytes": 124786 }, "provenance.json": { "sha256": "758996285bd25506418f1d941ba3f818dbacbae5032e08ef231430528e73cb8a", "bytes": 1818 }, "rendered.html": { "sha256": "94ec302bbc6b4ff08c7d06877d30dd2194242c47d456eaf91e8d907b7bf4bdbb", "bytes": 120640 }, "screenshot.jpg": { "sha256": "a41a458c76369ad149c3f6789fc71bae67901ef621e1b5efba7dc095b56aa749", "bytes": 881899 }, "text.txt": { "sha256": "6c47b3ae262b5f79baeedf0202654ea00bfed03d6b434e11d040ab69ed1b38c1", "bytes": 12345 } }, "started_utc": "2026-10-24T13:47:21.720Z", "status": 200, "final_url": "https://ototekno.harianjogja.com/r-1276080/php2shell-bisa-curi-data-website-kenali-tanda-server-diretas" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Harian Jogja (Indonesian), 23 October: PHP2Shell could steal website data; know the signs of a hacked server. Website managers should check server sec...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Bisa Curi Data Website, Kenali Tanda Server Diretas\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/ototekno-harianjogja/r-1276080-php2shell-bisa-curi-data-website-kenali-tanda-serv`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nHarian Jogja (Indonesian), 23 October: PHP2Shell could steal website data; know the signs of a hacked server. Website managers should check server security at once after PHP2Shell, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both 9.2) that could let attackers run code remotely without an account or password; PHP has released updates, but managers should still check for intrusions that happened before updating.\n\n> Pengelola website perlu segera memeriksa keamanan server setelah ditemukannya PHP2Shell\n\n_Curator's translation:_ \"Website managers need to check server security straight away after the discovery of PHP2Shell\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Bisa Curi Data Website, Kenali Tanda Server Diretas\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "overheid-nl-site", "url": "https://www.overheid.nl/", "publisher": "overheid.nl", "kind": "government", "title": "Homepage | Overheid.nl", "published": null, "captures": [ { "stamp": "20261022T081927Z", "files": { "headers.json": { "sha256": "bf5d6a65737591b5c4ae5c9f0b4ab31b0f86d83a9eb676f1573f7a8ec4b7117b", "bytes": 1659 }, "page.html": { "sha256": "35c79d57cc23f2a234e8501c31e556531a3176023c58ec67115742617270cd93", "bytes": 18228 }, "provenance.json": { "sha256": "b4e3d33bfcf26c6daeb90bacf96d905882f526c1925c8fbeb1be25a39d54c0d0", "bytes": 896 }, "rendered.html": { "sha256": "018fe9effcbc10e7d76127ec98e1fab7ebfa67830ab994cc643fc9bc7ac2ceee", "bytes": 19560 }, "screenshot.png": { "sha256": "1162ac68eaaeb8ff7a05376c48939f345186554ffa661e62b4cca355e4be7749", "bytes": 776840 }, "text.txt": { "sha256": "93278f942198c318881e84d7d62b8bf6f6613b8ed5da0dc5f37bd9f658d11c13", "bytes": 2216 } }, "started_utc": "2026-10-22T08:19:27.560Z", "status": 200, "final_url": "https://www.overheid.nl/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "oxfordchronicle-councils-offline", "url": "https://www.oxfordchronicle.co.uk/2026/10/21/oxfordshire-council-websites-offline-amid-critical-global-security-issue/", "publisher": "Oxford Chronicle", "kind": "news", "title": "Oxfordshire council websites offline amid critical global security issue | Oxford Chronicle", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112935Z", "files": { "headers.json": { "sha256": "ffb2fca308d4c4c89c5593350a364a6121becb966829713a17b3a99c2669d99b", "bytes": 1048 }, "page.html": { "sha256": "7603fb4868cc7b8a8fa437b7e2a8500726acf1332fd3f2252489e8f71471e5a2", "bytes": 472071 }, "provenance.json": { "sha256": "94eda260baf0d2faf05d45a4bb93b717ed498b664f3b724444bb046dba9ec628", "bytes": 1169 }, "rendered.html": { "sha256": "e1614eeb5b71eb2bebf826c3131167eed9cefd83826c53632ff386d1a1a90afa", "bytes": 477225 }, "screenshot.png": { "sha256": "6e1d23c7119672f3ed76f38b59112885b43f6961b77abd0009ea77015e7ec42d", "bytes": 1579440 }, "text.txt": { "sha256": "35c847290193f872826f6d65f370bcb6863fafe692817cc449f97431f350ae73", "bytes": 6281 } }, "started_utc": "2026-10-22T11:29:35.741Z", "status": 200, "final_url": "https://www.oxfordchronicle.co.uk/2026/10/21/oxfordshire-council-websites-offline-amid-critical-global-security-issue/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'; Oxfordshire County Council also down.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Oxfordshire council websites offline amid critical global security issue | Oxford Chronicle\n\nCaptured by claude-story-site. Status: captured. Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'; Oxfordshire County Council also down.\n\n- Quotes the council's social post.\n" }, { "slug": "paloalto-psirt-cve-2026-109618", "url": "https://security.paloaltonetworks.com/CVE-2026-109618", "publisher": "Palo Alto Networks", "kind": "vendor", "title": "CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products", "published": null, "captures": [ { "stamp": "20261022T191713Z", "files": { "headers.json": { "sha256": "dbb0d97e793d1ab43471679575bd42cdcfe25371f3539b641bfc4e4b8134c45f", "bytes": 633 }, "page.html": { "sha256": "2223f8cf00418cf2174e08ad35e9e6113921fbfad65643a49eabc34f65ff7305", "bytes": 26484 }, "provenance.json": { "sha256": "9f7ef8ede1978405b5d95d06ec70b54a29fee6138e5e29d45c3b52e92486877e", "bytes": 1688 }, "rendered.html": { "sha256": "16f631fe00f8a74a26da4a70fd8b0e6874030910dd0913dd7a31024756e01d6f", "bytes": 27036 }, "screenshot.jpg": { "sha256": "eaa6bf9b8c388263b12fb52e625c80308697f89df7fcd7a8675bf516eacee049", "bytes": 364463 }, "text.txt": { "sha256": "16cb7bd74aeeac250781e98cc4d8574d338480ada1651de0e53572d0e7bb760f", "bytes": 6603 } }, "started_utc": "2026-10-22T19:17:14.244Z", "status": 200, "final_url": "https://security.paloaltonetworks.com/CVE-2026-109618" } ], "status": "captured", "primary": true, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191713Z. PAN-OS 10.2 to 12.2 affected: PHP inside firewalls (primary)", "raw_sha256": {}, "has_notes": true, "notes_md": "# CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/security-vendor/palo-alto-networks/psirt-cve-2026-109618`, snapshot `20261022T191713Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191713Z/provenance.json`. Publisher: Palo Alto Networks. Language: en. URL: https://security.paloaltonetworks.com/CVE-2026-109618\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPalo Alto Networks' security advisory on the impact of CVE-2026-109618 and CVE-2026-109619 on its products. PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are listed as vulnerable (CPE ranges). The issue strictly affects the PAN-OS management web interface (HTTPS web UI and XML API), and a dataplane interface only if a management profile is attached; GlobalProtect portal and gateway and the captive portal are not affected. Palo Alto rates it Severity HIGH, urgency MODERATE, with CVSS-B 8.7 when the management interface is reachable from the internet and 7.1 when access is restricted to a jump box. Both of Palo Alto's product vectors score availability impact only (VC:N/VI:N/VA:H), against the vendor (PHP) score it also shows, CVSS-B 9.2 with high confidentiality, integrity and availability impact, while its own text describes the CVEs as remote code execution. Fixes will come in upcoming PAN-OS releases; until then: restrict management access to trusted internal IPs or a jump box, and Threat Prevention IDs 543004, 97622-97625 (content 9162+). Frontier Virtual Patching customers on PAN-OS 12.2.4+ received coverage via Threat ID 543004 at 10:21 PM PT on 20 October. \"Palo Alto Networks is not aware of any malicious exploitation of this issue against our products.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): PAN-OS 10.2 to 12.2 affected: PHP inside firewalls (primary)\n\nSupports: cyber desk: appliances\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "paperjam-article-php2shell-des-milliers-de-sites", "url": "https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg", "publisher": "Paperjam", "kind": "news", "title": "PHP2Shell: des milliers de sites exposés au Luxembourg | Paperjam News", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2224804391f9039f9c3b3b8f9e69bfc0078a9b68b20731ea3536d5de439e6cc6", "bytes": 1049 }, "page.html": { "sha256": "0e5257c13c396617b977794021ed67914b1b48fe67e99643852efc8abcaa4e5e", "bytes": 162673 }, "provenance.json": { "sha256": "fd1670a04f377f14d3fa93b4017bed37541143fbb9bac35e6fa7ddb7cf5a06f8", "bytes": 1598 }, "text.txt": { "sha256": "73aed7ccd645b7172699b36b2e9dd8540c0300f2ff6c3de8ad218d7aeb29b20e", "bytes": 14203 } }, "started_utc": "2026-10-23T16:22:21.862Z", "status": 200, "final_url": "https://paperjam.lu/article/php2shell-des-milliers-de-sites-exposes-au-luxembourg" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Paperjam (French, Luxembourg): thousands of sites are exposed in Luxembourg. The two flaws are rated 9.2 out of 10 and sit in the PHP engine itself, n...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: des milliers de sites exposés au Luxembourg | Paperjam News\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `lu/news/paperjam/article-php2shell-des-milliers-de-sites-exposes-au-luxembour`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPaperjam (French, Luxembourg): thousands of sites are exposed in Luxembourg. The two flaws are rated 9.2 out of 10 and sit in the PHP engine itself, not in a WordPress extension or a badly kept site; WordPress, Drupal, Joomla, Magento, WooCommerce, Symfony, Laravel, Nextcloud and Roundcube can be affected. No Luxembourg financial institution, public service or operator had announced it had actually been infiltrated; authorities ask operators to look back for traces of compromise and to preserve evidence.\n\n> Aucun établissement financier, service public ou opérateur luxembourgeois n’a cependant annoncé avoir été effectivement infiltré par PHP2Shell.\n\n_Curator's translation:_ \"No Luxembourg financial institution, public service or operator has however announced having been actually infiltrated by PHP2Shell.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Paperjam reports that Luxembourg's state IT centre (CTIE) preventively made some services unavailable and that the cyber-risk cell met twice. The CSSF told financial entities to treat all PHP services as exposed. Local exposure estimates range from over 5,000 sites (per the LHC director) to about 10,600 PHP and 15,177 WordPress sites (per BuiltWith).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: des milliers de sites exposés au Luxembourg | Paperjam News\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "patchtheplanet-org", "url": "https://patchtheplanet.org/", "publisher": "OpenAI (Patch the Planet / Daybreak)", "kind": "researcher", "title": "Patch the Planet — OpenAI", "published": null, "captures": [ { "stamp": "20261022T081652Z", "files": { "headers.json": { "sha256": "2efe5a08cc256108fdb7a72a5bdeb92c7596564181f1d63e2e31fd2b71e2a321", "bytes": 563 }, "page.html": { "sha256": "280b5c18a8bb8c6254841014830e299d803e1d21ffd98141296156a2b5423bda", "bytes": 2325 }, "provenance.json": { "sha256": "e6def2821be82e7593e0ea8682f9c24fdf763a48424e1814e65b815a1db3a78f", "bytes": 909 }, "rendered.html": { "sha256": "d347cfa4c1e9dc2c990b725259875a732e38470560bfc51b6bb21da3419d2662", "bytes": 7680 }, "screenshot.png": { "sha256": "0872d96463aabdeccdeb873b9cb455601fe9cdea8cb6b15f45c65a9e85f1bb75", "bytes": 285779 }, "text.txt": { "sha256": "3e32706fb7c0ed83bb988da8372dbca5e70dbdfebc6135060f3f777805f852ae", "bytes": 1053 } }, "started_utc": "2026-10-22T08:16:52.643Z", "status": 200, "final_url": "https://patchtheplanet.org/" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "bef5ad2305cc911064e3220ea40101ea93808644720426b1ba89f104134316b7", "bytes": 622 }, "page.html": { "sha256": "a98d556b82b60f2f0bbe54986d03c73d64af0ca025e64785f43cba2fc5ab07ee", "bytes": 2325 }, "provenance.json": { "sha256": "f37266b025b2e6402f394ebc1fc8c6ec7f9bf1838fd23a90eb3ff1c75f0c272f", "bytes": 1629 }, "rendered.html": { "sha256": "6c1494423baff5a3e35188574e221186ede298bb90b42c2964ddcb5e3bbf631b", "bytes": 8032 }, "screenshot.jpg": { "sha256": "ffd3e34781095497e36d6aa4ef318de85c038de8ffc12d6bf9e9140bc36fbaf3", "bytes": 146354 }, "text.txt": { "sha256": "63821bd00a0a9f37db0eb0068d039bbfe8fb7d27dce1623dc0c66386b394ad5f", "bytes": 1218 } }, "started_utc": "2026-10-23T23:41:44.922Z", "status": 200, "final_url": "https://patchtheplanet.org/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "OpenAI microsite. 'An OpenAI Daybreak initiative'; 'In collaboration with Trail of Bits, Calif, HackerOne'. Latest disclosure php2shell links to https://php2shell.com/. No date on page.", "raw_sha256": {}, "has_notes": true, "notes_md": "# patchtheplanet.org (OpenAI)\n\n- Title \"Patch the Planet — OpenAI\". \"An OpenAI Daybreak initiative\". \"In collaboration with Trail of Bits, Calif, HackerOne\". \"Every finding is reviewed by a person, and maintainers stay in control of their code and releases.\"\n- \"Latest disclosure: php2shell\", \"CVE-2026-109618 · CVE-2026-109619\", linking https://php2shell.com/ (not yet captured — whose site is it?). \"Read the announcement\" links https://openai.com/index/patch-the-planet/ (blocked). Trail of Bits page https://trailofbits.com/patch-the-planet/.\n- No dates on the page.\n" }, { "slug": "pc-watch-impress-docs-news-2150338-html", "url": "https://pc.watch.impress.co.jp/docs/news/2150338.html", "publisher": "PC Watch", "kind": "news", "title": "深刻度9.2のPHP脆弱性「PHP2Shell」、OpenAIが影響確認ツール公開 - PC Watch", "published": "2026-10-22T13:59:59+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ef54ff09cd8670eeff7106b801f8d7e88dcb74271e0e22dc0e04742d63cae362", "bytes": 286 }, "page.html": { "sha256": "152e866797f57bc33b75dfa2640aaa23aa0e3ef33bb1486d748ce510d8b39320", "bytes": 173434 }, "provenance.json": { "sha256": "4340e78c6a6c783f7723ccdfcfa17b456e769c9f832e7f3b267ded7ffcd1999f", "bytes": 1554 }, "rendered.html": { "sha256": "f8f05ac6ecf711538279044827bb65054e3fbbb56e5312dc610473814fd8920a", "bytes": 408465 }, "text.txt": { "sha256": "491e54d11503658d0610f93a9b9588a998e97a327640805aa02e6d12265e164e", "bytes": 10089 } }, "started_utc": "2026-10-23T16:19:46.025Z", "status": 200, "final_url": "https://pc.watch.impress.co.jp/docs/news/2150338.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). PC Watch (Impress, Japanese), 22 October. It reports that the PHP project brought forward its fixed releases and that OpenAI published, on 21 October...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 深刻度9.2のPHP脆弱性「PHP2Shell」、OpenAIが影響確認ツール公開 - PC Watch\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/pc-watch-impress/docs-news-2150338-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPC Watch (Impress, Japanese), 22 October. It reports that the PHP project brought forward its fixed releases and that OpenAI published, on 21 October on GitHub under Apache-2.0, a tool called 'PHP Version Checker' that reads the PHP version from a site's HTTP response headers and says whether it is older than the fixed versions; it can also check a local PHP and is offered as a Codex skill. The tool only compares version numbers, does not verify that a fix is applied, and cannot judge sites that do not expose the version. It dates PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to 21 October, says PHP 5.4 and later before the fixed versions are affected, and says Wiz Research found it using Gemini 4 Argon, GPT-5.6 Sol and others. Noted here as material only: the vault does not run such tools against live sites.\n\n> ただし、同ツールはバージョン番号を比較するだけで、修正の適用そのものは検証しない。\n\n_Curator's translation:_ \"However, the tool only compares version numbers and does not verify that a fix has actually been applied.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"深刻度9.2のPHP脆弱性「PHP2Shell」、OpenAIが影響確認ツール公開 - PC Watch\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "pcgamer-wikipedia-ref-22-dates-to-plug-leaked-hi", "url": "https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-start-within-15-minutes-of-the-release-web-admins-braced-for-emergency-php-updates-to-plug-leaked-high-severity-holes/", "publisher": "PC Gamer", "kind": "news", "title": "'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes | PC Gamer", "published": "2026-10-21T10:39:05Z", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "a106136c02629ba272f29d730cb3f4f0165db550f599465bebd86294e07ebfcc", "bytes": 2292 }, "page.html": { "sha256": "6b190de262fca4752ff400fda8199ce015888049624aeb36f6006539ade6f616", "bytes": 1950300 }, "provenance.json": { "sha256": "8d0becc43dfe13c46c483962982bc3aef5399064a162fb83d8eb5465746fa123", "bytes": 2046 }, "rendered.html": { "sha256": "5e61aa30a8577a2d152ea2ad8e0eabf372da38be11c027c82adcb58caaf97cc8", "bytes": 2279333 }, "screenshot.jpg": { "sha256": "2e3c9f005176150d7036562425a94847479e042f3ab6ed389afbf1bfb19aeb8a", "bytes": 434958 }, "text.txt": { "sha256": "9f4704be7c19e9f2562aaddef5d8a2048db1d5120debb7084a9fa5d73b4a6ace", "bytes": 6101 } }, "started_utc": "2026-10-25T11:46:18.998Z", "status": 200, "final_url": "https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-start-within-15-minutes-of-the-release-web-admins-braced-for-emergency-php-updates-to-plug-leaked-high-severity-holes/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). PC Gamer (English), 21 October, by Andy Edser, written the morning of the release. It says the PHP security team gave advance notice of two critical f...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes | PC Gamer\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/tech-press/pcgamer/wikipedia-ref-22-dates-to-plug-leaked-high-severity-holes`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPC Gamer (English), 21 October, by Andy Edser, written the morning of the release. It says the PHP security team gave advance notice of two critical flaws each rated 9.2; that a video reportedly showing a tool called PHP2Shell executing code on web servers is circulating (via Ars Technica), so details seem to have leaked ahead of disclosure; that Sansec researchers say all web servers on PHP 5.4 or later are affected and expect mass attacks within 15 minutes of the release (due 14:00 UTC); that Cloudflare's CTO Dane Knecht said it was already updating firewall rules for early attacks, a stopgap only; and that watchTowr's CEO Benjamin Harris told BleepingComputer the two flaws had leaked from embargo and were 'CVSS10' and understood to affect PHP 5, 6, 7 and 8. Advice: inventory every PHP install, plan a maintenance window and back up.\n\n> Researchers from cybersecurity firm Sansec say the vulnerabilities affect all web servers running PHP 5.4 or later, and that \"we expect mass attacks to start within 15 minutes of the release.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes | PC Gamer\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw", "url": "https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw", "publisher": "PCMag", "kind": "news", "title": "Hackers Already Trying to Exploit Serious PHP Flaw | PCMag", "published": "2026-10-21", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "a4c60087b9dadf6ce73051690a2912ee969a4a57c4edf252d7e96c6cd05a023d", "bytes": 658 }, "page.html": { "sha256": "9634154ceca3930e61ef3c720663e361e9fb03690d3d765e90d8d58d2cad88b2", "bytes": 770407 }, "provenance.json": { "sha256": "eac54b3d5931c2d6e9a98bf73e9419d41265cc9a4a2089c77434a2eabeacbd85", "bytes": 1722 }, "rendered.html": { "sha256": "c0541438d0fa5ea4c569d63693e3755501968267907e8ed90840ee454b381571", "bytes": 794429 }, "screenshot.jpg": { "sha256": "5b39ba74ac4faa6aac845254d931f7aaa68265f214d3fdbf11e4fc4cefd6ad8a", "bytes": 478513 }, "text.txt": { "sha256": "82ef905cd2201bd4507643ba274b135e32b1e440606b1ded976617c782b28166", "bytes": 10926 } }, "started_utc": "2026-10-23T08:17:08.184Z", "status": 200, "final_url": "https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2b9c03883f70f1faabe082d41d9fcbe6092c52767ee752e93f89755969f261fe", "bytes": 658 }, "page.html": { "sha256": "fe493cc63c77e8e83b384a2cd2fbfe3e8d967b7600095f9697e78d3af62f86c3", "bytes": 770596 }, "provenance.json": { "sha256": "5d35f51515acb289a88cbfd15c74448b4d5d9c8c9960ed6301cebd1ec0a977d0", "bytes": 1712 }, "text.txt": { "sha256": "aed5a180dbdb800e3b610efd1721f668f58e7935fa393d6adbbc3efb4493beea", "bytes": 10839 } }, "started_utc": "2026-10-23T16:15:49.959Z", "status": 200, "final_url": "https://www.pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Michael Kan: hackers quickly probed and tried to exploit the PHP flaws; VulnCheck traced one attempt to an IP address in China; Amazon found signs of an attempt...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Hackers Already Trying to Exploit Serious PHP Flaw | PCMag\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `gb/news/pcmag/news-hackers-already-trying-to-exploit-serious-php-flaw`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMichael Kan: hackers quickly probed and tried to exploit the PHP flaws; VulnCheck traced one attempt to an IP address in China; Amazon found signs of an attempt four days before the flaw was public; the PHP Foundation released patches that morning. The IP's location is not attribution.\n\n> One exploitation attempt was sourced to an IP address based in China, says security provider VulnCheck.\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "pcmag-wikipedia-ref-31-s-should-consider-going", "url": "https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-consider-going-offline-nsa-says", "publisher": "PCMag", "kind": "news", "title": "This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says | PCMag", "published": "2026-10-21T15:08:23+00:00", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "3d27faf2a77514adfba4cc608ae62fdc986beb54145d8b9cd626538381a3fc91", "bytes": 658 }, "page.html": { "sha256": "4c13581487efae8ddc12b29dd529ccd742aab6a7b12d5311fa4b26b7918b4174", "bytes": 770744 }, "provenance.json": { "sha256": "97097a71c53b8341bf578a477b47ab19d78cc86a1301a2cc1e8b5b414d26fd87", "bytes": 1773 }, "rendered.html": { "sha256": "ede02de1c70cbaf3e452b906e45b119e566ad3e232ba619c11c6f4f29d760666", "bytes": 900132 }, "screenshot.jpg": { "sha256": "1fec68968bec0ff53949365533ec7aab222a428fef3f3933fa54a2fd774977b4", "bytes": 591896 }, "text.txt": { "sha256": "afb256d6323403bdc244f3599639aef775e3aa0c4d06934c6529c347c182dda9", "bytes": 11733 } }, "started_utc": "2026-10-25T11:46:10.683Z", "status": 200, "final_url": "https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-consider-going-offline-nsa-says" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). PCMag, 21 October: this flaw is so serious websites should consider going offline, the NSA says. It says the threat emerged on Tuesday when an anonymo...", "raw_sha256": {}, "has_notes": true, "notes_md": "# This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says | PCMag\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/pcmag/wikipedia-ref-31-s-should-consider-going-offline-nsa-says`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPCMag, 21 October: this flaw is so serious websites should consider going offline, the NSA says. It says the threat emerged on Tuesday when an anonymous user warned of two newly discovered PHP vulnerabilities that can be exploited to run rogue code; quotes Wiz that the findings 'rank among the most severe vulnerabilities discovered in PHP, and arguably in software history' and that the vulnerable code had been present for more than a decade; says the PHP Foundation confirmed unauthenticated remote code execution; notes an OpenAI model helped uncover the flaw; and points out the patches were released only for PHP 8.2 and up, although the flaws affect versions back to PHP 5.4 according to the UK NCSC.\n\n> The PHP Foundation has released patches, but only for PHP 8.2 and up.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says | PCMag\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "peterboroughtoday-must-read-astra-security-launches-free-t", "url": "https://www.peterboroughtoday.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867", "publisher": "Peterborough Telegraph", "kind": "news", "title": "Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities", "published": "2026-10-23T14:57:09.000Z", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "b68ad7f752d93dc6a0bf9ad4880408a52a93ee9ba390ed6725c6945329c3a86d", "bytes": 1515 }, "page.html": { "sha256": "ddcd21b8ed1f7f6d440e23e10d8bbdd6947af1f9854f0d5c5bb0f30228e9cff9", "bytes": 234865 }, "provenance.json": { "sha256": "797fd66d0131ede7b9f9288b8c694f0ba029e430eb5cd7facff025183653ce71", "bytes": 1922 }, "rendered.html": { "sha256": "f6efd090bd67b12bbc93ddaccd396301336fa77afeef2353d64586932578cd30", "bytes": 231525 }, "screenshot.jpg": { "sha256": "341c84faf52d48591ff55438d64bd89e5815dcb2dbfa7a1766e716c238d38ef1", "bytes": 337064 }, "text.txt": { "sha256": "0a9f92c40ee353320783f8d267aaa563ee55416c31a14fb5b9d5a0001eaf9ef2", "bytes": 5430 } }, "started_utc": "2026-10-24T08:48:39.909Z", "status": 200, "final_url": "https://www.peterboroughtoday.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Peterborough Telegraph, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tool...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/peterboroughtoday/must-read-astra-security-launches-free-tools-to-help-organis`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPeterborough Telegraph, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tools to assess exposure to PHP2Shell. Vendor marketing; the tools were not fetched.\n\n> Astra Security has released two free tools to help organisations assess their exposure to the recently disclosed PHP2Shell vulnerabilities and support remediation efforts.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "php-foundation-blog-security-release", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "publisher": "The PHP Foundation", "kind": "advisory", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "c18914982a4c07d0a15b76e052d18c5f77f345016e356ea5cb65e766f0096b0f", "bytes": 857 }, "page.html": { "sha256": "6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223", "bytes": 40324 }, "provenance.json": { "sha256": "2acdcc9ae9ee9e14a8960ed26727dee21b5561915fc6632378e78c9ae27a3f1b", "bytes": 1218 }, "rendered.html": { "sha256": "874a78d766936a3c9d375512a1882ac83f25921f0a1050ed8169c5f37ea72cf2", "bytes": 126413 }, "screenshot.png": { "sha256": "f6eb5d0b42048f1570880df5c5e38adea3d5ee8635a98b8fef51f6234e5d2089", "bytes": 2631098 }, "text.txt": { "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "bytes": 31882 } }, "started_utc": "2026-10-22T08:09:01.670Z", "status": 200, "final_url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Foundation's account of discovery, 2024 audit origin, leak timeline (20 Oct 15:00Z), Calif video, Chainguard embargo break (21 Oct 07:41Z). Page embeds an r/PHP comment thread (third-party, not Foundation).", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Foundation blog: notes\n\n- URL: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/\n- \"Published on Oct 21, 2026\", by \"The PHP Foundation\". Captured 2026-10-22T08:09Z.\n- The rendered page also embeds an r/PHP thread (third-party comments, e.g. a claim that the first in-the-wild exploit was at 08:36 UTC citing ellio.tech). That is not Foundation content.\n\n## Key wording (verbatim)\n- \"CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption ... On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.\"\n- \"CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state ... A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.\"\n- 2024 audit: Sovereign Tech Agency funding, via OSTIF, carried out by Quarkslab; a Foundation-contracted core developer \"found the first signs of the OOM problem behind CVE-2026-109618\". \"the delay was a structural failure\".\n- \"security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution ... OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th.\"\n- Also mentions scanning with \"Anthropic's Claude Mythos\" via Alpha-Omega, and \"OpenAI's Daybreak Red\" for validation; Trail of Bits also auditing.\n- \"On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.\" Pre-announcement \"published it at 19:30 UTC\". Release moved \"from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.\"\n- \"As a result of the leak and pre-announcement around 20:00 UTC, Calif ... mistakenly published a video.\"\n- \"Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well.\" \"did not identify any functional exploits at the time of release/public disclosure.\"\n- \"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.\"\n- Thanks: \"Calif, especially Ryan A, Wiz, OpenAI Codex Security, especially Amy Burnett, OSTIF, and Quarkslab\".\n\n## Contradictions\n- BBC: Calif found it in August, OpenAI and Wiz \"shortly after\". Foundation: OpenAI reported the same root cause the same day (11 Aug); Wiz 24 Aug.\n- Pre-announcement 19:30 UTC here vs php.net feed timestamp 20:32 UTC.\n- The note's order of OpenAI 18 Sep then Wiz 24 Aug is as written (non-chronological).\n" }, { "slug": "php-net-advisory", "url": "https://www.php.net/archive/2026.php#2026-10-21-5", "publisher": "PHP Group (php.net)", "kind": "advisory", "title": "Security advisory: Critical remote code execution vulnerabilities, update now", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "42812c4d4f151d93b62d63d08b84b83e50a94a9e2ab79427924d5b5df582cc72", "bytes": 899 }, "page.html": { "sha256": "3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555", "bytes": 99388 }, "provenance.json": { "sha256": "b1c9672106ace3646ee3912d7e4e87d94dc91cc5b60b9acc1066295675ce5014", "bytes": 948 }, "rendered.html": { "sha256": "a8cbeb0c17b3646681217db64cce0e0beb6dc71765bd1bad550f8e20170ef7d0", "bytes": 238404 }, "screenshot.png": { "sha256": "4727eaed5a4a5a90eb95aed5c3c0093702f427e1aae4bc63ed9ccfea2ca92da4", "bytes": 3983360 }, "text.txt": { "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "bytes": 35947 } }, "started_utc": "2026-10-22T08:09:01.544Z", "status": 200, "final_url": "https://www.php.net/archive/2026.php#2026-10-21-5" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Official php.net advisory (archive anchor 2026-10-21-5) plus the 8.2.35/8.3.36/8.4.27/8.5.12 release posts and the 20 Oct pre-announcement on the same page. Feed timestamps (00:05-00:35Z on 21 Oct; 20:32Z on 20 Oct) do not match the Foundation's stated times (release 14:00Z, pre-announcement 19:30Z). raw/ holds feed.atom and a curl copy.", "raw_sha256": { "archive-2026.curl.html": "3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555", "feed.atom": "79c12996a433f66b2e2422e32d1dd5d4251c7c24531f75c3a0611f58dc1894a8" }, "has_notes": true, "notes_md": "# php.net security advisory: notes\n\n- URL: https://www.php.net/archive/2026.php#2026-10-21-5 (news archive; the same page holds the four release posts and the 20 Oct pre-announcement)\n- Captured 2026-10-22T08:09Z (capture.mjs); raw/feed.atom and raw/archive-2026.curl.html fetched with curl ~08:07-08:12Z.\n- Publisher: the PHP Group / php.net. Date on the page: \"21 Oct 2026\".\n\n## Key wording (verbatim)\n- \"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.\"\n- \"Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.\"\n- \"RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)\"\n- \"RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)\"\n- \"PHP 8.1 and older no longer receive updates from the PHP project.\" Minimal source backports were published as branches PHP-7.4/8.0/8.1-CVE-2026-109618-109619 on php/php-src.\n- remirepo: \"The repo will not have updates today.\"\n- Mitigations: memory_limit=-1, low post_max_size (8M / 32M), session.upload_progress.enabled=0, on 8.5 fatal_error_backtraces=0. \"only an update is a complete solution\".\n- Pre-announcement (anchor 2026-10-20-1, \"Upcoming Critical PHP Security Release\"): \"It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.\" \"It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.\"\n\n## Oddities\n- Atom feed timestamps: advisory 2026-10-21T00:35:26+00:00; 8.2.35 00:05:37; 8.3.36 00:14:54; 8.4.27 00:20:54; 8.5.12 00:24:52; pre-announcement 2026-10-20T20:32:00+00:00. The Foundation blog says the pre-announcement went out at 19:30 UTC and the release at 14:00 UTC on 21 Oct, and GHSAs show 13:34Z. The php.net timestamps are the entry-creation times written by the authoring script, not verified publish times; do not use them as publication times without checking the php/web-php commit history.\n- php.net's own date is 21 Oct; the BBC frames disclosure as 22 Oct (UK morning coverage). The original target date was 22 Oct 14:00 UTC (per Foundation blog).\n" }, { "slug": "php-net-changelog-8", "url": "https://www.php.net/ChangeLog-8.php", "publisher": "PHP Group (php.net)", "kind": "advisory", "title": "PHP 8 ChangeLog", "published": null, "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "7e0f775cb09c408472e389bec122b0fc703a450df430b26aca98e4539caf6f4f", "bytes": 892 }, "page.html": { "sha256": "8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68", "bytes": 752126 }, "provenance.json": { "sha256": "08d9493b6d1480061ad20e23c5ea875c121bb9741f79ccf69dd923284133f1c9", "bytes": 919 }, "rendered.html": { "sha256": "03ecb3465829e89ba578ae7bc7f36881fbbd37d9bc77ae5bb3c74bdd15e2d36a", "bytes": 751162 }, "screenshot.png": { "sha256": "0954e33d2a52ac1470b5c204eaaeea8d8fe811854486542ece88541cf7dbc526", "bytes": 15023593 }, "text.txt": { "sha256": "e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70", "bytes": 417190 } }, "started_utc": "2026-10-22T08:15:58.596Z", "status": 200, "final_url": "https://www.php.net/ChangeLog-8.php" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "8.5.12, 8.4.27, 8.3.36, 8.2.35 entries dated '22 Oct 2026' (the original target date), although they were released 21 Oct. Core entry: 'Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).' 8.5.12 and 8.4.27 also carry unrelated bug fixes.", "raw_sha256": { "ChangeLog-8.curl.html": "8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68" }, "has_notes": true, "notes_md": "# php.net PHP 8 ChangeLog: notes\n- Captured 08:15Z (and curl copy in raw/).\n- Each of \"Version 8.5.12\", \"Version 8.4.27\", \"Version 8.3.36\" and \"Version 8.2.35\" is dated \"22 Oct 2026\". The release actually shipped on 21 Oct (php.net news, GitHub release at 14:06Z). The ChangeLog keeps the originally planned date, and nobody has corrected it.\n- Security line (verbatim, identical in all four): \"Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).\" CVE IDs are not printed on these lines, unlike earlier entries (e.g. 8.3.35 lists CVE-2026-91768).\n- 8.3.36 and 8.2.35 contain only the security fix. 8.5.12 and 8.4.27 bundle normal bug fixes (GH-23644, GH-21999, GH-23980, a dl() use-after-free, etc.).\n- The fix is \"bailout\": PHP's zend_bailout (longjmp) mechanism, consistent with the GHSA's description of removing longjmp() for OOM.\n" }, { "slug": "php2shell-com", "url": "https://www.php2shell.com/", "publisher": "OpenAI / Wiz / Calif joint microsite (php2shell.com)", "kind": "researcher", "title": "PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web", "published": null, "captures": [ { "stamp": "20261022T111831Z", "files": { "headers.json": { "sha256": "95d2d3cfe2f388045327d30e2dd08bb49dd3e8dd426ae09aa80e1261f01cd7ed", "bytes": 1509 }, "page.html": { "sha256": "8c12d8880e5b0e798d3e4457997397a1c0de6b36ab774a8fe46518f3270532a0", "bytes": 284683 }, "provenance.json": { "sha256": "020c3cad8f308d11c8454cbf625b7310e0958428a69ade312c2cd43d349c2897", "bytes": 952 }, "rendered.html": { "sha256": "e5958b710931a3753baaa7475dea5c3be9f08677412269976d9e50100e3f9022", "bytes": 506683 }, "screenshot.png": { "sha256": "77a8c0a27f91ee02eab5575847f4611e6605f030f286c20c51eb4de3cf0f496a", "bytes": 2152724 }, "text.txt": { "sha256": "b1e83b4f0feb87d5abb59bfb76015b154a7b678a51c0e965e06929f1e6b17f48", "bytes": 9251 } }, "started_utc": "2026-10-22T11:18:31.290Z", "status": 200, "final_url": "https://www.php2shell.com/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "97b231d6043caaa850edf7ddf8cb4b37e0d828dbaa2f34af25642f1b32af18d6", "bytes": 1567 }, "page.html": { "sha256": "3cd8d65ea92fff67fe8ba33a859adf17d23ec992b51a919ea16ace361b803805", "bytes": 288798 }, "provenance.json": { "sha256": "b81bb4aec0049450718b2a7e5f7d1b38aff54270a4eca66f8a201a04025819fd", "bytes": 1502 }, "text.txt": { "sha256": "1a5b93f5d3550ef4fbcedbbb1d54e790c6c63205ff114093e88174b27f79dd4c", "bytes": 9276 } }, "started_utc": "2026-10-23T16:27:22.513Z", "status": 200, "final_url": "https://www.php2shell.com/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web\n\nCaptured by claude-story-site. Status: captured. The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure.\n\n- Credits: Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld, Tomer Schwartz); OpenAI Codex Security (Amy Burnett); Calif (Ryan A.). Linked from patchtheplanet.org.\n- 'PHP powers approximately 70% of websites'; 'a simple Hello World application running on an affected PHP version' is affected.\n- 'PHP-FPM RCE was confirmed through application-level code paths.' 'Upgrading PHP is the only complete remediation.'\n- No date on the page.\n" }, { "slug": "phparch-php-security-2025-audit", "url": "https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/", "publisher": "php[architect]", "kind": "news", "title": "PHP Security in 2025: Lessons from the Core Security Audit | PHP Architect", "published": "2025-09", "captures": [ { "stamp": "20261022T112947Z", "files": { "headers.json": { "sha256": "f94a2cb9fd6c974ab16b7f672856596b84da0ee50036c93a902f055a2efebb3f", "bytes": 1063 }, "page.html": { "sha256": "85b9dacfb542ca35651d775dfe24c41186dfdca2ae5abc86bafcdd1e19b79195", "bytes": 94581 }, "provenance.json": { "sha256": "4783394753855b623aa99c5c3077af3a72dc1b6dbd18ba5e2e181737ffcbc90b", "bytes": 1095 }, "rendered.html": { "sha256": "8f4192ecc48d4d4fb38e2492bac830525bfcab04ff70a72849ad8ccc35e38358", "bytes": 94279 }, "screenshot.png": { "sha256": "51293897aa9bc0b5b07dbb244193f6b3da545420a92eb912de4664a8e0ebe245", "bytes": 2293707 }, "text.txt": { "sha256": "95189f8e2e198e19e39271f1750db73ca525f593abbe9ec363969f3eae4499ec", "bytes": 28517 } }, "started_utc": "2026-10-22T11:29:47.363Z", "status": 200, "final_url": "https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Background on the 2024 core security audit.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Security in 2025: Lessons from the Core Security Audit | PHP Architect\n\nCaptured by claude-story-site. Status: captured. Background on the 2024 core security audit.\n\n- Captured for the record.\n" }, { "slug": "phpfoundation-blog-security-release-leak", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "publisher": "The PHP Foundation", "kind": "advisory", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081244Z", "files": { "headers.json": { "sha256": "3b9ca485b393afa38381b67bb251208dca58e32f815fd1aed95ba69e1d88dda3", "bytes": 856 }, "page.html": { "sha256": "6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223", "bytes": 40324 }, "provenance.json": { "sha256": "777ac74e8e4915a67c651d019c1cdcf9a099773e9963221b097b676fa5054bde", "bytes": 1222 }, "rendered.html": { "sha256": "074da5662f04df8f88a2efc163726c553f5bb43c8095278a089daa0faf364955", "bytes": 126414 }, "screenshot.png": { "sha256": "09956999247e6e42a5635bb2b1234a2f8a11f0c66c26b88fafc020c31f3b6cd6", "bytes": 2630327 }, "text.txt": { "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "bytes": 31883 } }, "started_utc": "2026-10-22T08:12:44.668Z", "status": 200, "final_url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Dated Oct 21, 2026. Primary account of the leak: CVE IDs circulating Oct 20 ~15:00 UTC; Calif 'mistakenly published a video' ~20:00 UTC; mitigation advice may have leaked; Chainguard broke embargo Oct 21 07:41 UTC. Captured text also contains reader comments below the post (lines ~90 onward) — those are third-party, unverified.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Foundation blog, 21 Oct 2026: the leak and the discovery timeline (collector-researchers)\n\nCaptured for the researchers/leak beat; the advisory collectors may hold their own copy.\n\n## Discovery (verbatim)\n- 2024: \"While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found\".\n- \"The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th. More recently, Trail of Bits has also been auditing PHP.\"\n- Tools: \"Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos ... OpenAI's Daybreak Red for validating reports and exploits\".\n- Thanks \"OpenAI Codex Security, especially Amy Burnett\".\n\n## Leak (verbatim, section \"Leak and disrupted disclosure\")\n- \"The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date.\"\n- \"On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.\" Pre-announcement moved to 19:30 UTC; release moved from Oct 22 14:00 UTC to Oct 21 14:00 UTC.\n- \"As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs\".\n- \"Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well.\"\n- \"did not identify any functional exploits at the time of release/public disclosure.\"\n- \"On October 21st at 07:41 UTC ... Chainguard unilaterally broke the embargo and published built images containing the fix.\"\n\n## Odd / follow up\n- Does not say WHO first leaked the CVE IDs, nor where. Daubois (same team) points to an anonymous Hacker News post.\n- Text capture includes reader comments under the post (third-party; e.g. a commenter claims \"sansec.io leaked one of the attack vectors ... in their page's metadata\"; another notes ELLIO's first in-the-wild hit 55 min after Chainguard). Unverified.\n" }, { "slug": "phpocalypse-tracker-sites-csv", "url": "https://allixsenos.github.io/phpocalypse-tracker/sites.csv", "publisher": "PHPocalypse Tracker (allixsenos)", "kind": "other", "title": "PHPocalypse Tracker (allixsenos)", "published": null, "captures": [ { "stamp": "20261022T183616Z", "files": { "headers.json": { "sha256": "5b36e9822f2d454b789c5f6ffbe04185fa3ccc3c435cd4512241240f5f5ea478", "bytes": 826 }, "page.html": { "sha256": "8109506bc80264887f2bd36eb452c1ad5468db6330efe4f167623be9f9965fe6", "bytes": 18969 }, "provenance.json": { "sha256": "83c0f400d5e4a6eb1dcbc049c4dae82a42be94efb84aeeb72dc7581ae29484a7", "bytes": 1295 }, "text.txt": { "sha256": "8109506bc80264887f2bd36eb452c1ad5468db6330efe4f167623be9f9965fe6", "bytes": 18969 } }, "started_utc": "2026-10-22T18:36:16Z", "status": 200, "final_url": "https://allixsenos.github.io/phpocalypse-tracker/sites.csv" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T183616Z. The community list of 50 sites dark and back, with times and cited claims (data)", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPocalypse Tracker (allixsenos)\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `int/community/phpocalypse-tracker/sites-csv`, snapshot `20261022T183616Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T183616Z/provenance.json`. Publisher: PHPocalypse Tracker (allixsenos). Language: en. URL: https://allixsenos.github.io/phpocalypse-tracker/sites.csv\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe PHPocalypse Tracker's (allixsenos, GitHub Pages) machine-readable list of sites that went dark over php2shell: a CSV with columns name, url, country, type, dark_since, back_up, source, notes. At this snapshot (18:36 UTC) it has 50 rows: 48 with a back_up time and 2 still dark; 24 are in the Netherlands. Each row cites a source (often a post on X) and notes how it was checked (e.g. manual browser checks, HTTP status). It is a community dataset, not an official list: each row's claim is only as good as the source it cites. The watch fetched it over HTTP, so there is no rendered.html and no screenshot.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): The community list of 50 sites dark and back, with times and cited claims (data)\n\nSupports: contradictions/sites-taken-offline.json; series/sites-dark\n\n## Capture notes\n\nNot in the watch snapshot, so not here: rendered.html.\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "pl-beincrypto-alarm-wlamania-na-gielde-kryptowalut-ryz", "url": "https://pl.beincrypto.com/alarm-wlamania-na-gielde-kryptowalut-ryzyko-php2shell/", "publisher": "BeInCrypto Polska", "kind": "news", "title": "Ostrzeżenie dla giełd kryptowalut: krytyczna luka PHP naraża serwisy płatnicze na ryzyko", "published": "2026-10-21T22:42:38Z", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "a1fb9dba5a46db6482114129523fcb764fa3cacbe96ab8acc4fca6a25cec15ad", "bytes": 3099 }, "page.html": { "sha256": "21cc3800d060f3836fc1e1f51dca12a9b1c150cb7a2f44138d608ec93cf3598c", "bytes": 493444 }, "provenance.json": { "sha256": "83da1cd047b9c3889252721250774b985b6edb219749e7746ad65954036a5180", "bytes": 1767 }, "rendered.html": { "sha256": "c982dbb8d84751e0487d906c2207d25971266ee59866f3c42072b645064d46d8", "bytes": 493707 }, "screenshot.jpg": { "sha256": "3b3ef25d84e28b1db190ba827c82e863fefaad24615b12df5a30232b14d46f2c", "bytes": 464608 }, "text.txt": { "sha256": "2df4c295d4f47d9cd6a9dd9c5ee8ed8194390816b082ebccd81d174f07b0c790", "bytes": 8603 } }, "started_utc": "2026-10-24T13:55:27.182Z", "status": 200, "final_url": "https://pl.beincrypto.com/alarm-wlamania-na-gielde-kryptowalut-ryzyko-php2shell/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). BeInCrypto Polska (Polish), 21 October: the Polish edition of the BeInCrypto article recorded as nl-beincrypto-crypto-exchange-hack-waarschuwing-php2s...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Ostrzeżenie dla giełd kryptowalut: krytyczna luka PHP naraża serwisy płatnicze na ryzyko\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pl/news/pl-beincrypto/alarm-wlamania-na-gielde-kryptowalut-ryzyko-php2shell`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBeInCrypto Polska (Polish), 21 October: the Polish edition of the BeInCrypto article recorded as nl-beincrypto-crypto-exchange-hack-waarschuwing-php2sh. It says PHP developers released emergency patches on 21 October for two flaws called PHP2Shell, scored 9.2, and, in its own words, that there is no confirmed evidence of compromise of the named payment providers or large exchanges. The claim is recorded on the Dutch edition.\n\n> Nie ma potwierdzonych dowodów kompromitacji wymienionych dostawców płatności lub dużych giełd przez luki PHP2Shell.\n\n_Curator's translation:_ \"There is no confirmed evidence of compromise of the named payment providers or large exchanges through the PHP2Shell flaws.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Ostrzeżenie dla giełd kryptowalut: krytyczna luka PHP naraża serwisy płatnicze na ryzyko\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "pl-martincid-technology-pl-php2shell-latka-php-juz-je", "url": "https://pl.martincid.com/technology-pl/php2shell-latka-php-juz-jest-ale-strony-na-wordpressie-musza-czekac-na-hostingodawce/", "publisher": "pl.martincid", "kind": "news", "title": "PHP2Shell: łatka PHP już jest, ale strony na WordPressie muszą czekać na hostingodawcę – Martin Cid Magazine PL", "published": "2026-10-21T16:29:41-04:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "498941cb4310e3e054ad5443fd649dcee6adddac7cb8de1d1ac4069dce62ef31", "bytes": 1259 }, "page.html": { "sha256": "76deb19b68cd29dcdbbdd8ff5d618b743f26abd404c013fcae33f0d1890c0670", "bytes": 168184 }, "provenance.json": { "sha256": "fafa4d1a4a70afa79638a4f8857442b5b1b3089aa8d82706436b08d051a588bc", "bytes": 1892 }, "rendered.html": { "sha256": "c2b9538085393058f4f442fe0d8d15e67cc6810f85b7a6044093a5c0b9b7dde4", "bytes": 169733 }, "screenshot.jpg": { "sha256": "81938541bcbf15dcb4d9eae6b2fa7399aa1e3d269599998cc398f622b34cee9a", "bytes": 783200 }, "text.txt": { "sha256": "bc7469e5682b9d31e924a9825ede18c4994f530fca3b735840c69fc92b5fbc0b", "bytes": 10457 } }, "started_utc": "2026-10-24T08:57:59.500Z", "status": 200, "final_url": "https://pl.martincid.com/technology-pl/php2shell-latka-php-juz-jest-ale-strony-na-wordpressie-musza-czekac-na-hostingodawce/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pl-PL", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Martin Cid Magazine Polska (Polish), 21 October: why WordPress sites must wait for their host rather than update themselves. It says the flaws are in...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: łatka PHP już jest, ale strony na WordPressie muszą czekać na hostingodawcę – Martin Cid Magazine PL\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pl/news/pl-martincid/technology-pl-php2shell-latka-php-juz-jest-ale-strony-na-wor`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nMartin Cid Magazine Polska (Polish), 21 October: why WordPress sites must wait for their host rather than update themselves. It says the flaws are in PHP itself, below the CMS, so a WordPress update changes nothing; PHP covers every web-request set-up (FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), citing The Hacker News that an attack works even against a default 'Hello World' page, and that the worst case is mod_php. Wordfence says the patch cannot arrive through automatic updates, and Laravel Forge says Ubuntu's unattended upgrades do not cover PHP installed from outside packages. On package-source timing, mySites.guru reported that cPanel EasyApache 4 had fixed builds within minutes while Ondřej Surý's PPA and Remi's repository did not yet; only 0.08% of the active sites it monitors showed a fixed PHP at 13:52 UTC. It warns that backports by Ubuntu, Debian and Red Hat keep the old version number, so version checks mislead, and that long-running processes must be restarted. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older get no fix from the project beyond minimal source patches.\n\n> Wśród aktywnych witryn monitorowanych przez mySites.guru o 13:52 UTC poprawioną wersję PHP zgłaszało 0,08%.\n\n_Curator's translation:_ \"Among the active sites monitored by mySites.guru at 13:52 UTC, 0.08% reported a patched PHP version.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: łatka PHP już jest, ale strony na WordPressie muszą czekać na hostingodawcę – Martin Cid Magazine PL\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pl-PL`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "polinews-news-articleview-html", "url": "https://www.polinews.co.kr/news/articleView.html?idxno=746632", "publisher": "폴리뉴스 Polinews", "kind": "news", "title": "[종합] 靑, PHP 사이버 보안비상에 민관군 긴급회의…국내 취약 자산 11만건 추정 < 이슈기획 < 오피니언·이슈 < 기사본문 - 폴리뉴스 Polinews", "published": "2026-10-22T20:42:07+09:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "ae83250b82306abe2e1856516b552ca589dc081b94ee8dc3510d5a2eb419a0c7", "bytes": 355 }, "page.html": { "sha256": "b7cada245604c7e609d57286d94cb94aaa17c0990e68b2b323102409bc7a8c19", "bytes": 153197 }, "provenance.json": { "sha256": "cd806083f05b72f0b87a699666a3cc2790e05f84290f3324a748e7fe6661a12d", "bytes": 1721 }, "rendered.html": { "sha256": "abab15a515f0e377f7658bdf5fd782d45e6f9510b2f12a347b520f4dcfe2f12d", "bytes": 507749 }, "screenshot.jpg": { "sha256": "1f30415ca69f3c7857c286053e7e107bacda26ac54e6d6d7c09c591453dbeec7", "bytes": 523290 }, "text.txt": { "sha256": "b4f4006727c71782d57186c85e4f20f197589c088961d658ac30ccf8aac159f1", "bytes": 10851 } }, "started_utc": "2026-10-22T18:25:50.749Z", "status": 200, "final_url": "https://www.polinews.co.kr/news/articleView.html?idxno=746632" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in ko: Polinews: South Korea's National Security Office (3rd deputy Song Ki-ho) held an emergency civil-public-military meeting with MSIT, the MND and the NIS. MSIT raised the private-sector cyber crisis alert to 'Caution'. Ahn", "raw_sha256": {}, "has_notes": true, "notes_md": "# [종합] 靑, PHP 사이버 보안비상에 민관군 긴급회의…국내 취약 자산 11만건 추정 < 이슈기획 < 오피니언·이슈 < 기사본문 - 폴리뉴스 Polinews\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `kr/news/polinews/news-articleview-html`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: 폴리뉴스 Polinews. Language: ko. URL: https://www.polinews.co.kr/news/articleView.html?idxno=746632\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nPolinews: South Korea's National Security Office (3rd deputy Song Ki-ho) held an emergency civil-public-military meeting with MSIT, the MND and the NIS. MSIT raised the private-sector cyber crisis alert to 'Caution'. AhnLab estimates about 110,000 vulnerable PHP assets in Korea. Hosting firms Cafe24 and Gabia are patching. In Japan, the PM's site, MOF, MLIT, NTA, MUFG, Mizuho and Rakuten were affected.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/kr/news/polinews/news-articleview-html.json`), not the publisher's and not checked word for word by the curator.\n\n**official**: National Security Office 3rd Deputy Director Song Ki-ho chaired an emergency civil-public-military cyber security meeting with MSIT, the MND and the NIS.\n\n> 국가안보실은 22일 송기호 안보실 제3차장 주재로 민·관·군 사이버 안보 긴급대책회의를 열었다\n\n_Watch reader's translation:_ On the 22nd the National Security Office held an emergency civil-public-military cyber security countermeasures meeting chaired by 3rd Deputy Director Song Ki-ho\n\n**agency**: MSIT raised the private-sector cyber crisis alert from 'Interest' to 'Caution'.\n\n> 과학기술정보통신부는 이날 민간 분야 사이버위기 경보를 '관심'에서 '주의'로 올리고\n\n_Watch reader's translation:_ MSIT that day raised the private-sector cyber crisis alert from 'Interest' to 'Caution'\n\n**number**: AhnLab's internet asset search estimates about 110,000 internet assets in Korea run vulnerable PHP versions (via Yonhap).\n\n> 국내에서 취약한 PHP 버전이 설치된 것으로 추정되는 인터넷 자산은 약 11만건이다\n\n_Watch reader's translation:_ Internet assets in Korea estimated to have a vulnerable PHP version installed number about 110,000\n\n**hosting**: Korean web hosts Cafe24 and Gabia began security patching and customer notices.\n\n> 카페24와 가비아 등 웹호스팅 업체들도 보안 패치와 고객 안내에 나섰다\n\n_Watch reader's translation:_ Web hosting companies such as Cafe24 and Gabia also began security patching and customer guidance\n\n**offline**: In Japan, PM Takaichi's official site was briefly suspended. MOF, MLIT and NTA sites were partly suspended, and MUFG, Mizuho and Rakuten services went into emergency checks.\n\n> 다카이치 사나에 총리의 공식 사이트는 일시 중단됐다가 보안 조치 후 재개됐으며\n\n_Watch reader's translation:_ PM Sanae Takaichi's official site was temporarily suspended and then resumed after security measures\n\n**official**: Song Ki-ho said attack attempts were already reported overseas and speed of action will decide the scale of damage.\n\n> 이미 해외에서는 공격 시도가 보고되고 있어 얼마나 빨리 조치하느냐가 피해 규모를 좌우한다\n\n_Watch reader's translation:_ attack attempts are already being reported overseas, so how quickly we act will determine the scale of damage\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in ko: Polinews: South Korea's National Security Office (3rd deputy Song Ki-ho) held an emergency civil-public-military meeting with MSIT, the MND and the NIS. MSIT raised the private-sector cyber crisis alert to 'Caution'. Ahn\n\nSupports: translations/kr/news/polinews/news-articleview-html.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "polskieradio24-pieniadze-strony-bip-znikaja-z-sieci-luk", "url": "https://polskieradio24.pl/pieniadze/strony-bip-znikaja-z-sieci-luka-php-pozwala-przejmowac-serwery-co-dalej", "publisher": "Polskie Radio 24", "kind": "news", "title": "Strony BIP znikają z sieci. Luka PHP pozwala przejmować serwery. Co dalej?", "published": "2026-10-22T10:27:57+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "6ee25600e86037e373e93633c293a08b932892a3048f0f2f6a4ca12af3599794", "bytes": 1904 }, "page.html": { "sha256": "f3c7c5067ea540641c25fd5c098a6163853810e2b9565b4907e60a4dda892363", "bytes": 297430 }, "provenance.json": { "sha256": "271cece1ddfe97a05eee30ea9b7bd3246fa802dd1ab44da3e310db209856e4ed", "bytes": 1824 }, "rendered.html": { "sha256": "f45d73f94085b864af3317b86e0a4712e00b7459bfbfca50bf6ec55874f186ca", "bytes": 534856 }, "screenshot.jpg": { "sha256": "a14ae506a5c300fa2ebcb10c2d5d867bd1972923d8218ba14a3d1143686de49e", "bytes": 1049025 }, "text.txt": { "sha256": "1c64ddbab11847b558be1aab24627b830689e5a96767a2b46bc44648ffd7c602", "bytes": 21009 } }, "started_utc": "2026-10-23T16:23:53.967Z", "status": 200, "final_url": "https://polskieradio24.pl/pieniadze/strony-bip-znikaja-z-sieci-luka-php-pozwala-przejmowac-serwery-co-dalej" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Polskie Radio 24 (Polish), 22 October, by Michał Tomaszkiewicz: BIP (public information) pages are going offline because of two PHP flaws. It says the...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Strony BIP znikają z sieci. Luka PHP pozwala przejmować serwery. Co dalej?\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pl/news/polskieradio24/pieniadze-strony-bip-znikaja-z-sieci-luka-php-pozwala-przejm`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPolskie Radio 24 (Polish), 22 October, by Michał Tomaszkiewicz: BIP (public information) pages are going offline because of two PHP flaws. It says the Informacyjna Agencja Radiowa reported on 22 October that the Central Informatics Centre (COI) temporarily switched off BIP pages in the national public-information access system (SSDIP), affecting only some bodies, and that Białystok University of Technology restricted access to its systems; it stresses this is preventive, not an outage or a successful attack, and that restoring services may take days. It explains the two CVEs (9.2) and says the PHP team brought the release forward to 21 October after the premature disclosure on 20 October, and that Amazon's MadPot recorded the first attempt on 17 October.\n\n> 22 października Informacyjna Agencja Radiowa podała, że Centralny Ośrodek Informatyki (COI) czasowo wyłączył strony BIP działające w Scentralizowanym Systemie Dostępu do Informacji Publicznej (SSDIP).\n\n_Curator's translation:_ \"On 22 October the Radio Information Agency reported that the Central Informatics Centre (COI) had temporarily switched off BIP pages operating in the Centralised Public Information Access System (SSDIP).\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Polskie Radio 24 reports, citing IAR, that COI disabled BIP pages run in the centralised SSDIP system, and that Białystok University of Technology restricted its websites, USOSweb, Moodle and other services. It notes that the Czech Government Office and Czech meteorological services also went offline, and quotes Adam Haertle of Zaufana Trzecia Strona.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Strony BIP znikają z sieci. Luka PHP pozwala przejmować serwery. Co dalej?\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "posttoday-ai-today-750820", "url": "https://www.posttoday.com/ai-today/750820", "publisher": "โพสต์ทูเดย์", "kind": "news", "title": "เตือนภัยช่องโหว่ PHP2Shell ภาครัฐเร่งยกระดับความปลอดภัยไซเบอร์", "published": "2026-10-22T16:55:00+07:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "4b376ed5937dd5621058dbf98381320a9ceda81cb69355efb04dadc4b820769d", "bytes": 873 }, "page.html": { "sha256": "0707f39ee38779b0e7251cf4eb5fb613d0ad2bc49f50f398b913ac3b34430bc9", "bytes": 148348 }, "provenance.json": { "sha256": "5fec4b1cc025c9ba61644362a41d30de179e182f03c9f3875bbae2d48c62e1de", "bytes": 1650 }, "rendered.html": { "sha256": "2e67539c327ef7d52fe651128e8c77e0ec9e57bcfe21bfaa2b73ce573bfdae14", "bytes": 194909 }, "screenshot.jpg": { "sha256": "8e0fbf3151bf9fc51e734ef080c5d39897e411f601e0a33e1d5450cb921198d2", "bytes": 359304 }, "text.txt": { "sha256": "5e2f47f8f5c1360750b9ae5be4dd78fbdedcbd153968b0c5abded647e312f97d", "bytes": 8947 } }, "started_utc": "2026-10-23T16:25:00.037Z", "status": 200, "final_url": "https://www.posttoday.com/ai-today/750820" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "th", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Post Today (Thai), 22 October: Thai ministers press agencies to close the PHP2Shell flaw. Deputy Prime Minister and Higher Education, Science, Researc...", "raw_sha256": {}, "has_notes": true, "notes_md": "# เตือนภัยช่องโหว่ PHP2Shell ภาครัฐเร่งยกระดับความปลอดภัยไซเบอร์\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `th/news/posttoday/ai-today-750820`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPost Today (Thai), 22 October: Thai ministers press agencies to close the PHP2Shell flaw. Deputy Prime Minister and Higher Education, Science, Research and Innovation Minister Yodchanan Wongsawat is quoted that OpenAI's research team detected the flaw in advance, giving developers about two months to prepare, and sets a three-step response for large-database bodies such as universities and hospitals (check systems and databases, cloud protection, upgrade). Minister Pharadon Prissananantakul, who oversees the National Cyber Security Agency (NCSA), says ThaiCERT issued a national cyber-threat alert on the morning of 22 October and describes four proactive measures (alerting and assessing agencies, stronger monitoring of abnormal access, close tracking of patching).\n\n> ทางศูนย์ ThaiCERT จึงได้เร่งออกประกาศแจ้งเตือนภัยคุกคามไซเบอร์ระดับประเทศทันทีเมื่อช่วงเช้าของวันที่ 22 ตุลาคมที่ผ่านมา\n\n_Curator's translation:_ \"ThaiCERT therefore promptly issued a national cyber-threat warning on the morning of 22 October.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Post Today: Deputy PM Yodchanan and Minister Paradorn Prissanananthakul (overseeing NCSA) respond. ThaiCERT issued a national cyber threat alert on the morning of 22 Oct. The NCSA set out four proactive measures: alert agencies and assess risk, raise monitoring of abnormal access, and closely track patch deployment.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"เตือนภัยช่องโหว่ PHP2Shell ภาครัฐเร่งยกระดับความปลอดภัยไซเบอร์\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `th`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "pplware-sapo-internet-php2shell-disponibilizadas-atua", "url": "https://pplware.sapo.pt/internet/php2shell-disponibilizadas-atualizacoes-urgentes-para-corrigir-duas-falhas-criticas/", "publisher": "Pplware", "kind": "news", "title": "PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas", "published": "2026-10-21T14:49:25+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "84e1fdc851d894be6dc6eb87d75a5ed625ebe0d8e758567996b068a60a1b7cf5", "bytes": 926 }, "page.html": { "sha256": "4289afd88c02dfbe2f999f11183cc357a4c12fda6a6018cd8b9f8adab7b04399", "bytes": 232611 }, "provenance.json": { "sha256": "6d5f7da50ada06936d3dd66ebd28aebca6f9013934b5d41d8931ce6b18d24510", "bytes": 1699 }, "text.txt": { "sha256": "fb37c3809a81d7b5a986a480f74963135b6b7a9bb742c10ba07c745bf0dafb53", "bytes": 11868 } }, "started_utc": "2026-10-23T16:24:04.413Z", "status": 200, "final_url": "https://pplware.sapo.pt/internet/php2shell-disponibilizadas-atualizacoes-urgentes-para-corrigir-duas-falhas-criticas/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt-PT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Pplware (Portuguese, SAPO), 21 October: urgent updates for the two PHP2Shell flaws. It says the two CVEs relate to memory management and the handling...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `pt/news/pplware-sapo/internet-php2shell-disponibilizadas-atualizacoes-urgentes-pa`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPplware (Portuguese, SAPO), 21 October: urgent updates for the two PHP2Shell flaws. It says the two CVEs relate to memory management and the handling of internal data while processing HTTP requests; that Wiz researchers say the problems existed for decades, but the complexity needed to demonstrate exploitation hindered discovery of a working attack, and that advanced AI models helped overcome some technical difficulties; that PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed set-ups are affected, mod_php especially, where remote code execution was demonstrated with a single unauthenticated request before application code runs.\n\n> Segundo os investigadores da Wiz, os problemas existem há décadas, mas a complexidade necessária para demonstrar a sua exploração dificultou a descoberta de um ataque funcional.\n\n_Curator's translation:_ \"According to Wiz's researchers, the problems have existed for decades, but the complexity needed to demonstrate their exploitation made it hard to find a working attack.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Pplware explains the urgent updates: the CVEs, the exposed SAPIs, Wiz's memory-read findings, the fixed versions and the backports, plus the NCSC UK take-offline advice.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: disponibilizadas atualizações urgentes para corrigir duas falhas críticas\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt-PT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "prefecture-police-site", "url": "https://www.prefecturedepolice.interieur.gouv.fr/", "publisher": "prefecturedepolice.interieur.gouv.fr", "kind": "government", "title": "Page accueil | Préfecture de Police", "published": null, "captures": [ { "stamp": "20261022T081934Z", "files": { "headers.json": { "sha256": "9134dcb7c5881a8b194d3f9dd3ffbc2378b9c539130eeffa47ac45748d5f48d4", "bytes": 473 }, "page.html": { "sha256": "0d34ee20b6d729126f325918feec97ab0d8808e852e96e505214b643123a14e8", "bytes": 222 }, "provenance.json": { "sha256": "36da19b3c25610bbc46a1d736fbea1a8ebb03726e59893c483a481517ee1007a", "bytes": 1025 }, "rendered.html": { "sha256": "8d759eec1f0249c6e5fd78724fad69cb850e27fc7c2a9c12d1b24afcd09e4af4", "bytes": 104031 }, "screenshot.png": { "sha256": "65910824ad9b6a70a3d52b37c03081b28de5bcf27ce8d96459de86fc56a83f0e", "bytes": 219205 }, "text.txt": { "sha256": "3689dd69c688f7c18520c26d77dfd3de27079a3ce0905e8154628e52a3b7698a", "bytes": 2044 } }, "started_utc": "2026-10-22T08:19:34.659Z", "status": 200, "final_url": "https://www.prefecturedepolice.interieur.gouv.fr/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "pressebox-pressemitteilung-scalecommerce-gmbh-krit", "url": "https://www.pressebox.de/pressemitteilung/scalecommerce-gmbh/kritische-php-sicherheitslcke-scalecommerce-patcht-alle-kundinnen-und-kunden-binnen-weniger-minuten-auch-php-versionen-ohne-offiziellen-fix/boxid/1317515", "publisher": "PresseBox", "kind": "news", "title": "Kritische PHP-Sicherheitslücke: ScaleCommerce patcht alle Kundinnen und Kunden binnen weniger Minuten – auch PHP-Versionen ohne offiziellen Fix, ScaleCommerce GmbH, Story - PresseBox", "published": "2026-10-22T12:55:00+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ab50671960637e05d15cd2d6f318f26589646c66249cda9d4fc22be074cc4353", "bytes": 1535 }, "page.html": { "sha256": "50f9416b021c2abd16feea6a3cdccc303accb8e4c5ad6dc59c1aa33f3c997b4b", "bytes": 236923 }, "provenance.json": { "sha256": "f5e4f32d23ec31e8097fe565b1d9ba5ffdeccecdf47dd8305183a57400901f45", "bytes": 1982 }, "text.txt": { "sha256": "f6dcda47250769a76965a0d52c18acd90fe72d0ab05ab48ea75023bbec12276c", "bytes": 7382 } }, "started_utc": "2026-10-23T16:13:27.369Z", "status": 200, "final_url": "https://www.pressebox.de/pressemitteilung/scalecommerce-gmbh/kritische-php-sicherheitslcke-scalecommerce-patcht-alle-kundinnen-und-kunden-binnen-weniger-minuten-auch-php-versionen-ohne-offiziellen-fix/boxid/1317515" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de-DE", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). PresseBox (German), 22 October: a press release from the hosting provider ScaleCommerce (Berlin), promotional in tone. It says that when PHP published...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Kritische PHP-Sicherheitslücke: ScaleCommerce patcht alle Kundinnen und Kunden binnen weniger Minuten – auch PHP-Versionen ohne offiziellen Fix, ScaleCommerce GmbH, Story - PresseBox\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/pressebox/pressemitteilung-scalecommerce-gmbh-kritische-php-sicherheit`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPresseBox (German), 22 October: a press release from the hosting provider ScaleCommerce (Berlin), promotional in tone. It says that when PHP published its emergency update at 16:00 CEST on 21 October, 90% of its hosting customers were patched 18 minutes later and all systems by 20:00, including shops on PHP versions with no official fix, thanks to automating the rollout in the eight hours after PHP's announcement; about 300 systems with old operating systems needed an Ubuntu update first, and its PHP provider supplied patches for older versions. After the rollout it reviewed logs and found only isolated attack attempts on customer shops and no sign of broad compromise.\n\n> Das Ergebnis: nur vereinzelte Angriffsversuche auf Kundenshops, keine Hinweise auf eine breite Kompromittierung.\n\n_Curator's translation:_ \"The result: only isolated attack attempts on customer shops, no indications of a broad compromise.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Press release from Berlin e-commerce hoster ScaleCommerce: 90% of its hosting customers were patched 18 minutes after PHP's 16:00 release, and all systems by 20:00, including PHP versions without an official fix. It made over 300 OS and over 1,000 PHP updates and saw only isolated attack attempts in logs.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Kritische PHP-Sicherheitslücke: ScaleCommerce patcht alle Kundinnen und Kunden binnen weniger Minuten – auch PHP-Versionen ohne offiziellen Fix, ScaleCommerce G\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de-DE`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "prophetsecurity-php2shell-detect", "url": "https://www.prophetsecurity.ai/blog/php2shell", "publisher": "Prophet Security", "kind": "vendor", "title": "php2shell: Detecting and Investigating CVE-2026-109618 and CVE-2026-109619 | Prophet Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112954Z", "files": { "headers.json": { "sha256": "3d69271680bbf150bc6fae70fc1287cd80311e2b43424bbf4f428714ecd955b7", "bytes": 1637 }, "page.html": { "sha256": "b00c997496adf4b1764b46125a9a74849e83e0baf12ba075d39cc6b0c4493bb0", "bytes": 178998 }, "provenance.json": { "sha256": "c58cd7be80e63d3760a0f31b5507e5a3f5678bcc269f1ef1e986c903224553af", "bytes": 1025 }, "rendered.html": { "sha256": "3ac8595af5225424d4be82b0b063abfb5254d537481410f86cb935ebdb46b2a5", "bytes": 797451 }, "screenshot.png": { "sha256": "8a43fab6765b4d462f55e613f1f5fec6d081c690d44afd1fc4af635f917078f4", "bytes": 1773221 }, "text.txt": { "sha256": "2e8efe1d3d72efc2c7357b939ba6e0a4ee639b3fb3cde21efaa44f5f60a00e51", "bytes": 15452 } }, "started_utc": "2026-10-22T11:29:54.934Z", "status": 200, "final_url": "https://www.prophetsecurity.ai/blog/php2shell" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "997bfc5af7c0b384391765e06e77a9627a395760d29d0491157bcb82da159ee7", "bytes": 1709 }, "page.html": { "sha256": "db354351b01d8447569f087c81b0f2d39a2babefd76ba695e70059f0a3235ab4", "bytes": 177663 }, "provenance.json": { "sha256": "2783ca95e3795e226b6328e9f52e76e77523a6469728f2988dcb8021fbf02202", "bytes": 1655 }, "text.txt": { "sha256": "8549941ea19ea0071065130a1c3b1bee7d19b4e3a8595a65fbae489972228f83", "bytes": 16243 } }, "started_utc": "2026-10-23T23:43:07.127Z", "status": 200, "final_url": "https://www.prophetsecurity.ai/blog/php2shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor detection guidance.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell: Detecting and Investigating CVE-2026-109618 and CVE-2026-109619 | Prophet Security\n\nCaptured by claude-story-site. Status: captured. Vendor detection guidance.\n\n- Captured for the record.\n" }, { "slug": "prtimes-main-html-rd-p-000000090-000072250-html", "url": "https://prtimes.jp/main/html/rd/p/000000090.000072250.html", "publisher": "PR TIMES", "kind": "news", "title": "Cohesity、PHPの深刻な脆弱性「PHP2Shell」の影響と企業が講じるべき対策を解説 | Cohesity Japan株式会社のプレスリリース", "published": "2026-10-26 17:00 (page time zone not stated)", "captures": [ { "stamp": "20261026T121439Z", "files": { "headers.json": { "sha256": "dc7f64c0a550b49590d5793ae02096b89de83e5a4bcacdd4c83aed9031e8cafe", "bytes": 804 }, "page.html": { "sha256": "67a3d1374d6d75e1944cedd812387b237aa5e217342af0f6e889c4f4733087cd", "bytes": 251412 }, "provenance.json": { "sha256": "5c2795293b33e324053baa12443394fc3fa2072e42fbd37d576493e72659a1b7", "bytes": 1738 }, "rendered.html": { "sha256": "a879496695518b8d885d95faf4bbdbf856a17773baf03e52e842dd792eb29abe", "bytes": 270915 }, "screenshot.jpg": { "sha256": "cdd835f1d973c65d668b393ac6e1e84d5792f198127f24f61a10c71da009af75", "bytes": 558127 }, "text.txt": { "sha256": "fe7dc6113b9834b6f1c26eea2f7234b444a3fbd58d96325e5aca707cd3d71dbb", "bytes": 14671 } }, "started_utc": "2026-10-26T12:30:37.934Z", "status": 200, "final_url": "https://prtimes.jp/main/html/rd/p/000000090.000072250.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T121439Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). PR TIMES (Japanese), 26 October: a press release by Cohesity Japan giving the view of its global cyber-resilience vice president James Blake. It says...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Cohesity、PHPの深刻な脆弱性「PHP2Shell」の影響と企業が講じるべき対策を解説 | Cohesity Japan株式会社のプレスリリース\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/prtimes/main-html-rd-p-000000090-000072250-html`, snapshot `20261026T121439Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T121439Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPR TIMES (Japanese), 26 October: a press release by Cohesity Japan giving the view of its global cyber-resilience vice president James Blake. It says the flaws can affect web servers and also network devices and security products that use PHP, that mod_php deployments may be under-inventoried, that financial institutions use PHP like other firms and may be affected though layers such as WAFs and jump servers reduce but do not remove the risk, that stolen passwords and API keys are possible, that shared servers can spread harm between sites, that unsupported PHP 5 and 7 are hard to fix and that systems that cannot be updated should be cut off from external networks; it stresses checking for existing intrusion, not only patching. A vendor's commentary; it adds no new facts.\n\n> 金融機関も他の企業と同様にPHPを利用しており、今回の脆弱性の影響を受ける可能性があります。\n\n_Curator's translation:_ \"Financial institutions use PHP like other companies and may be affected by these vulnerabilities.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Cohesity、PHPの深刻な脆弱性「PHP2Shell」の影響と企業が講じるべき対策を解説 | Cohesity Japan株式会社のプレスリリース\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "public25-news-articleview-html", "url": "https://www.public25.com/news/articleView.html?idxno=57153", "publisher": "공생공사닷컴", "kind": "news", "title": "로그프레소, PHP 취약점 진단 스캐너 공개…내부망까지 점검 < 퍼블릭경제 < 공공&경제 < 기사본문 - 퍼블릭타임스", "published": "2026-10-26T08:42:51+09:00", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "ead777b069c1877daf426b05b61f2a208a125042e028720a5c4b4eb0abe29767", "bytes": 354 }, "page.html": { "sha256": "47adefee91b1465c0e2b7e3345e72d08e03cdd90b9676f3e79666820888d54c2", "bytes": 124490 }, "provenance.json": { "sha256": "08e68a9e98c0c4dfecbbde189041b3cbb474a6e294e5d0a8dcaac920f621b5a3", "bytes": 1682 }, "rendered.html": { "sha256": "2c49f53e3341706410109f6ee0996ff2a79661c7289d4ddd2f6abba6c08cd947", "bytes": 435481 }, "screenshot.jpg": { "sha256": "c4c9a57f3c082173db19c41ee39ee4e58c293f1d1047e0ec6fd5c3c60c0e84f0", "bytes": 334145 }, "text.txt": { "sha256": "65961726b514f18efb36ab058ad75a86a5f5d64ff68dd4d802a0881af0fc3e52", "bytes": 6174 } }, "started_utc": "2026-10-26T09:57:36.462Z", "status": 200, "final_url": "https://www.public25.com/news/articleView.html?idxno=57153" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Public Times (Korean), 26 October, by Kim Ha-seong: Logpresso's 'PHP2Shell Scanner' app, which it says was published in the Logpresso Store on 24 Octo...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 로그프레소, PHP 취약점 진단 스캐너 공개…내부망까지 점검 < 퍼블릭경제 < 공공&경제 < 기사본문 - 퍼블릭타임스\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/public25/news-articleview-html`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPublic Times (Korean), 26 October, by Kim Ha-seong: Logpresso's 'PHP2Shell Scanner' app, which it says was published in the Logpresso Store on 24 October and announced on 26 October. It checks external web services and internal-network PHP assets by URL registration, records the PHP version per asset, supports re-scans after patching and CSV export, and ships detection queries and rules. It recaps the two CVEs (9.2) and says versions since 5.4.0 (2012) are reported affected. The same product as in denews-news-articleview-html. Noted as material only: the vault does not run such tools.\n\n> 로그프레소는 PHP2Shell 취약점을 진단하는 ‘PHP2Shell 스캐너’ 앱을 지난 24일 로그프레소 스토어에 공개했다고 26일 밝혔다.\n\n_Curator's translation:_ \"Logpresso said on the 26th that it released, on the 24th, a 'PHP2Shell Scanner' app that diagnoses the PHP2Shell vulnerability in the Logpresso Store.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"로그프레소, PHP 취약점 진단 스캐너 공개…내부망까지 점검 < 퍼블릭경제 < 공공&경제 < 기사본문 - 퍼블릭타임스\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. The footer carries a copyright line ('무단전재 및 재배포, AI학습 및 활용 금지': no reproduction, redistribution, or AI training or use). It is a rights notice, not an instruction to act; recorded here and flagged to the editor. Nothing else addresses an AI or hides text from a reader.\n" }, { "slug": "qa-financial-php-security-crisis-raises-testing-stake", "url": "https://qa-financial.com/php-security-crisis-raises-testing-stakes-for-banks/", "publisher": "QA Financial", "kind": "news", "title": "PHP security crisis raises testing stakes for banks - QA Financial", "published": "2026-10-22T13:42:51+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "7023ce5ee1ef7f5bbdd3abf28da4178dce1e1a4a23d3081219e3d7d7adea44c7", "bytes": 961 }, "page.html": { "sha256": "06ecd3bded5d56c322656eddc050f0c7d97300c8d202f49485e431fcc475df15", "bytes": 114510 }, "provenance.json": { "sha256": "9b2fef1858514a1fe035ca4d97e6e9acff71fd254c44258aeacdc7f6189c94dd", "bytes": 1580 }, "text.txt": { "sha256": "3a64bdadbb6d9fe39fb4d15c9f31c449471ea339f3bd17e8882e711c66ce1e88", "bytes": 7331 } }, "started_utc": "2026-10-23T16:15:50.193Z", "status": 200, "final_url": "https://qa-financial.com/php-security-crisis-raises-testing-stakes-for-banks/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-GB", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). QA Financial: the PHP security crisis raises the stakes of software testing for banks. The opening paragraph refers to an alert covering CVE-2026-1096...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP security crisis raises testing stakes for banks - QA Financial\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/qa-financial/php-security-crisis-raises-testing-stakes-for-banks`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nQA Financial: the PHP security crisis raises the stakes of software testing for banks. The opening paragraph refers to an alert covering CVE-2026-109618 and CVE-2026-109619, which could let attackers execute code remotely without authentication. The article's own sources and the issuer of the alert were not read past the lead.\n\n> Its alert covers vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, which could enable attackers to execute code remotely without authentication.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP security crisis raises testing stakes for banks - QA Financial\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-GB`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "qdnd-phap-luat-tin-tuc-hai-lo-hong-nghiem-tro", "url": "https://www.qdnd.vn/phap-luat/tin-tuc/hai-lo-hong-nghiem-trong-trong-php-da-co-ban-va-nguoi-dung-internet-khong-can-qua-lo-lang-1061728", "publisher": "Báo Quân đội nhân dân", "kind": "news", "title": "Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá", "published": "not stated in the capture", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "d0e5b05bdec369ac00d7efba505069b451dafa6c0982265a31e36fedcf39525b", "bytes": 1286 }, "page.html": { "sha256": "26078fba025c6012ccbcce562add2b64e063b1ad9499333d28d26ab60352a7ba", "bytes": 111518 }, "provenance.json": { "sha256": "4a686c403cbd4d5440e89024068ff8be702e61026ea5462f716bb5b764e7de91", "bytes": 1832 }, "rendered.html": { "sha256": "21b2bcbb6d65d20a294b18df7ad59a0c26d8d43c6d521aabf6f90184969255f6", "bytes": 115148 }, "screenshot.jpg": { "sha256": "e6a608d019533ca9ffaa6b05c20916bd423ede9146078839740e37c6f0e77e44", "bytes": 551929 }, "text.txt": { "sha256": "7b9e2e56682eb15eea7a5d5b7b1e2d94e59f2a84201005bd779308eac19fa510", "bytes": 9105 } }, "started_utc": "2026-10-24T09:05:23.245Z", "status": 200, "final_url": "https://www.qdnd.vn/phap-luat/tin-tuc/hai-lo-hong-nghiem-trong-trong-php-da-co-ban-va-nguoi-dung-internet-khong-can-qua-lo-lang-1061728" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "vi", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). People's Army Newspaper (Vietnamese), citing Vietnam's Cybersecurity Department and the National Cybersecurity Association: the two CVEs were patched...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `vn/news/qdnd/phap-luat-tin-tuc-hai-lo-hong-nghiem-trong-trong-php-da-co-b`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nPeople's Army Newspaper (Vietnamese), citing Vietnam's Cybersecurity Department and the National Cybersecurity Association: the two CVEs were patched on 21 October and both score 9.2 on CVSS 4.0; Wiz and other teams found them with AI tools and passed the information to the PHP team before disclosure. It says exploitation requires specially crafted requests and exact control of memory state, that a suitably configured WAF can limit some unusual requests but is no substitute for patching, and that some hosting and cloud providers have patched and added WAF rules. For ordinary internet users it says the flaws sit on the servers, not on personal devices or browsers, so there is no need to stop browsing or shopping online, while basic security habits still apply.\n\n> Vì vậy, người dùng internet thông thường không cần ngừng truy cập website, tìm kiếm thông tin, mua sắm hoặc thực hiện các giao dịch trực tuyến chỉ vì thông tin về hai lỗ hổng này được công bố.\n\n_Curator's translation:_ \"Therefore, ordinary internet users do not need to stop visiting websites, searching for information, shopping or making online transactions just because information about these two vulnerabilities has been published.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `vi`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "qnap-qsa-26-18", "url": "https://www.qnap.com/en/security-advisory/qsa-26-18", "publisher": "QNAP", "kind": "vendor", "title": "Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP", "published": "2026-10-22 (release date on the page)", "captures": [ { "stamp": "20261022T191720Z", "files": { "headers.json": { "sha256": "aa08aaebb6e26e71a93712249fa6ad431e8d910a925ae174fa44959c2321f018", "bytes": 739 }, "provenance.json": { "sha256": "9ed0a563b1c7b28729c903b027ae9f66d5e825faa7b14caab83cf5c699111d72", "bytes": 1555 }, "rendered.html": { "sha256": "a49d81def04843e1e2bf1e474dfd384989bb9eeb992dc1cb33ca624a08fa4c42", "bytes": 209652 }, "screenshot.jpg": { "sha256": "775851d837e4ee7b5e48ca2f7be725c84564336a7f215265a5861185023bc955", "bytes": 401134 }, "text.txt": { "sha256": "45f3ae53efc4028d20fc6d29bf21d91f84ff1bf962beef861d70be6f72d04593", "bytes": 7261 } }, "started_utc": "2026-10-22T19:17:21.388Z", "status": 202, "final_url": "https://www.qnap.com/en/security-advisory/qsa-26-18" } ], "status": "captured", "primary": true, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191720Z. QNAP products affected; take NAS offline (primary)", "raw_sha256": {}, "has_notes": true, "notes_md": "# Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `tw/security-vendor/qnap/qsa-26-18`, snapshot `20261022T191720Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191720Z/provenance.json`. Publisher: QNAP. Language: en. URL: https://www.qnap.com/en/security-advisory/qsa-26-18\n\n## What the page says\n\n_Curator's reading of the capture._\n\nQNAP security advisory QSA-26-18, \"Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products\". Affected: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x and h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, QuMagie 2.10.1 and earlier, Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier (ARM32), TVR OS 1.0.4 and earlier. Both CVEs are CVSS v4.0 9.2 and can be triggered before application authentication; PHP fixed them on 21 October in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. \"Exploitation attempts against PHP have been publicly reported. QNAP has not received reports of exploitation targeting QNAP products.\" Fixed QNAP versions are pending; until then: take the device off the internet (no port forwarding, UPnP, myQNAPcloud Link), use a VPN, restrict management ports, stop unneeded PHP-based apps, check for compromise. PHP in Container Station containers is not covered. The watch kept no page.html for this snapshot (rendered.html only).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): QNAP products affected; take NAS offline (primary)\n\nSupports: cyber desk: appliances\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG). Not in the watch snapshot, so not here: page.html.\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "qnap-statement-php2shell", "url": "https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance", "publisher": "QNAP", "kind": "vendor", "title": "QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP", "published": "2026-10-22 (dateline Taipei)", "captures": [ { "stamp": "20261022T191720Z", "files": { "headers.json": { "sha256": "c253a6f6b0a50935f373029d625f1816fe441abf971eae8fab073bd5ddd84df6", "bytes": 5433 }, "page.html": { "sha256": "6d7e8996b605faaaa6df09930f6790a531f355fbe2fe16f5ffef4c1e93ebb781", "bytes": 169112 }, "provenance.json": { "sha256": "5bde08241c094606508438d02703564d9ee44a9f24dff12bd8d67a88dba8840e", "bytes": 1790 }, "rendered.html": { "sha256": "70a37c635627cbe7026e77c82a9d45f14fd116c035e5e8fb06787c951812aa94", "bytes": 200745 }, "screenshot.jpg": { "sha256": "4c6ebb3a51a831ef15bcb4d9b250468467353cce02251de6b8eda4e444665fad", "bytes": 320971 }, "text.txt": { "sha256": "7ef4fbb68cf300de902a7ae7193b4d2e5ce539e4b21c4040a0e6fcabf7e02e2f", "bytes": 4716 } }, "started_utc": "2026-10-22T19:17:21.388Z", "status": 200, "final_url": "https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance" } ], "status": "captured", "primary": true, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191720Z. QNAP PSIRT saw scanning and attack attempts (primary)", "raw_sha256": {}, "has_notes": true, "notes_md": "# QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `tw/security-vendor/qnap/statement-php2shell`, snapshot `20261022T191720Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191720Z/provenance.json`. Publisher: QNAP. Language: en. URL: https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance\n\n## What the page says\n\n_Curator's reading of the capture._\n\nQNAP's press statement on PHP2Shell (CVSS v4.0 9.2, patched by PHP on 21 October). QNAP PSIRT launched a cross-functional response and is reviewing all products and cloud services. It states that QNAP PSIRT \"has observed scanning activity and exploitation attempts targeting these vulnerabilities in the wild\", and that it \"detected and successfully blocked attempted attacks against QNAP's official website and online store, as well as its cloud services\". It points to advisory QSA-26-18 for products.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): QNAP PSIRT saw scanning and attack attempts (primary)\n\nSupports: cyber desk: appliances; exploitation\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "qualys-blog-php-preannounce", "url": "https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities", "publisher": "Qualys", "kind": "vendor", "title": "403 Forbidden", "published": "2026-10-20", "captures": [ { "stamp": "20261022T113004Z", "files": { "headers.json": { "sha256": "9ae7ad7eb7ecad9ff1195f99f730cc79be3ed1abdbb907f73ad003c7d28c5651", "bytes": 628 }, "page.html": { "sha256": "dd1c2f122d665c4b3fb0be7b2e8e1eb717607b195475efd409f666dfbd979b60", "bytes": 1486 }, "provenance.json": { "sha256": "f3a38995a937d0edc65d7304bf5014e3d946eb475aa675593c5aa03aea58e148", "bytes": 1110 }, "rendered.html": { "sha256": "eddbe1ecca686ffa5ca8cfa12c3054e26ecd8eb8c21461faaa9951759d65f41d", "bytes": 1203 }, "screenshot.png": { "sha256": "88143431c2f2ccebbb073449167e29d4114759e3e211d651114b2d152afd2e9e", "bytes": 10431 }, "text.txt": { "sha256": "c6c1266b1b8854e014702a20b4d2b956f885b89fc66f21fad180d33a4c37467d", "bytes": 19 } }, "started_utc": "2026-10-22T11:30:04.759Z", "status": 403, "final_url": "https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "Published on 20 October on the pre-announcement.", "raw_sha256": {}, "has_notes": true, "notes_md": "# 403 Forbidden\n\nCaptured by claude-story-site. Status: blocked. Published on 20 October on the pre-announcement.\n\n- A dated pre-release artefact.\n" }, { "slug": "quarkslab-blog-php-src-audit", "url": "https://blog.quarkslab.com/security-audit-of-php-src.html", "publisher": "Quarkslab", "kind": "researcher", "title": "Security audit of PHP-SRC - Quarkslab's blog", "published": "2025-04-10", "captures": [ { "stamp": "20261022T113008Z", "files": { "headers.json": { "sha256": "9a1974a3d0e74f6c61049df444eec6f88c921c1df160c4d36547d455f5f69d3a", "bytes": 721 }, "page.html": { "sha256": "cfffdbab1e24dbeaafa236432ed6653fa2442387aeae475f996cddddb722bb89", "bytes": 28339 }, "provenance.json": { "sha256": "c1a3e69c282c4e578340fa0788f636f5604d1f0d0a6076bac4cd7bd024ee55ca", "bytes": 996 }, "rendered.html": { "sha256": "032ff57da663f85dcf219749a2b1849c606efef96c9044684130409249a05e18", "bytes": 27638 }, "screenshot.png": { "sha256": "84a81db5a451d763ffe7a40817ea3c94e0e0a7d7da3bd0b7c74b2b8b0c912974", "bytes": 932374 }, "text.txt": { "sha256": "cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321", "bytes": 7821 } }, "started_utc": "2026-10-22T11:30:08.092Z", "status": 200, "final_url": "https://blog.quarkslab.com/security-audit-of-php-src.html" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Quarkslab's own account of the 2024 php-src audit (OSTIF, Sovereign Tech Agency): findings, two redacted high-severity issues with fixes in progress.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Security audit of PHP-SRC - Quarkslab's blog\n\nCaptured by claude-story-site. Status: captured. Quarkslab's own account of the 2024 php-src audit (OSTIF, Sovereign Tech Agency): findings, two redacted high-severity issues with fixes in progress.\n\n- Primary for the 2024 audit. Does not describe an out-of-memory finding as such.\n" }, { "slug": "ra2ej-php2shell-893716-html", "url": "https://www.ra2ej.com/ثغرتان-حرجتان-في-لغة-بي-إتش-بي-تدفعان-حكومات-ومؤسسات-إلى-إغلاق-مواقعها-ما-هي-php2shell-وماذا-تعني-للمستخدم-العادي؟-893716.html", "publisher": "رائج", "kind": "news", "title": "ثغرتان حرجتان في لغة بي إتش بي تدفعان حكومات ومؤسسات إلى إغلاق مواقعها: ما هي PHP2Shell وماذا تعني للمستخدم العادي؟", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "febd8b242ff4ba9eaa134422e76e35b7962b344b3a14df9bb179e2ef78224bce", "bytes": 543 }, "page.html": { "sha256": "2349421cf5aa44e0b13caca27e5042a3e1a0ca80c7de8b29b368f9c4176a9fe3", "bytes": 274342 }, "provenance.json": { "sha256": "ac234c45230e139b588857d2c52d1eb60033a6a04fd4877729911447b246cc22", "bytes": 2421 }, "rendered.html": { "sha256": "54a538fe54004eba524a2490c437d4975d4bf7ae6f1d2cecaf972e62070803b6", "bytes": 283644 }, "screenshot.jpg": { "sha256": "0ea9825ae8794f129a3423dae52c30a2d8c608403d3e1c828b632b833ab961d3", "bytes": 741735 }, "text.txt": { "sha256": "d84306eefeb71b264b0ee63e74c7d38cdfc39152d345148883608a4db1d559a5", "bytes": 20706 } }, "started_utc": "2026-10-23T16:24:33.256Z", "status": 200, "final_url": "https://www.ra2ej.com/%D8%AB%D8%BA%D8%B1%D8%AA%D8%A7%D9%86-%D8%AD%D8%B1%D8%AC%D8%AA%D8%A7%D9%86-%D9%81%D9%8A-%D9%84%D8%BA%D8%A9-%D8%A8%D9%8A-%D8%A5%D8%AA%D8%B4-%D8%A8%D9%8A-%D8%AA%D8%AF%D9%81%D8%B9%D8%A7%D9%86-%D8%AD%D9%83%D9%88%D9%85%D8%A7%D8%AA-%D9%88%D9%85%D8%A4%D8%B3%D8%B3%D8%A7%D8%AA-%D8%A5%D9%84%D9%89-%D8%A5%D8%BA%D9%84%D8%A7%D9%82-%D9%85%D9%88%D8%A7%D9%82%D8%B9%D9%87%D8%A7-%D9%85%D8%A7-%D9%87%D9%8A-php2shell-%D9%88%D9%85%D8%A7%D8%B0%D8%A7-%D8%AA%D8%B9%D9%86%D9%8A-%D9%84%D9%84%D9%85%D8%B3%D8%AA%D8%AE%D8%AF%D9%85-%D8%A7%D9%84%D8%B9%D8%A7%D8%AF%D9%8A%D8%9F-893716.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Raij (Arabic), an explainer on PHP2Shell for ordinary users. It says, citing Reuters, that the White House said it learned of the vulnerability on Fri...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثغرتان حرجتان في لغة بي إتش بي تدفعان حكومات ومؤسسات إلى إغلاق مواقعها: ما هي PHP2Shell وماذا تعني للمستخدم العادي؟\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sa/news/ra2ej/php2shell-893716-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nRaij (Arabic), an explainer on PHP2Shell for ordinary users. It says, citing Reuters, that the White House said it learned of the vulnerability on Friday 16 October 2026; that accounts of the discovery differ: OpenAI says it led a collaboration to prepare fixes before disclosure, Calif says it found the flaws with a large language model on 1 August, Wiz says it found them independently with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol and that they stayed undiscovered for over a decade; that Amazon Threat Intelligence recorded an attempt on a honeypot on 17 October, four days before the announcement, from an anonymous address, with further attempts on disclosure day from varied infrastructure pointing to multiple actors; that watchTowr's head of threat intelligence, Jake Knott, told CNET attempts were being seen but 'no one has succeeded so far'; and warnings, quoted from The Guardian, of a long-lasting problem and wide automated exploitation. The piece ends that ordinary users face no direct risk but may see outages and scams.\n\n> وقال البيت الأبيض إنه علم بالثغرة يوم الجمعة 16 أكتوبر 2026.\n\n_Curator's translation:_ \"The White House said it learned of the vulnerability on Friday 16 October 2026.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثغرتان حرجتان في لغة بي إتش بي تدفعان حكومات ومؤسسات إلى إغلاق مواقعها: ما هي PHP2Shell وماذا تعني للمستخدم العادي؟\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "radioworld-tech-and-gear-radio-it-management-is-you", "url": "https://www.radioworld.com/tech-and-gear/radio-it-management/is-your-manufacturer-affected-by-the-php-vulnerability", "publisher": "Radio World", "kind": "news", "title": "Is Your Manufacturer Affected by the PHP Vulnerability? - Radio World", "published": "2026-10-23T20:48:42+00:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "d7336fdd1fdf07dc7ea57efea84e01eaf411df59a3220b3fa11f66da678e3a05", "bytes": 1017 }, "page.html": { "sha256": "6c32faf39fce2022993a8addd1f18e9152f0549b9bfdff74f78de168560c3bd5", "bytes": 86962 }, "provenance.json": { "sha256": "ab53a9ef86ec655e72623716fb8deba8c4a91f1cc87bef3d8aace523dd077c3e", "bytes": 1671 }, "text.txt": { "sha256": "4f0cb1a8440e5f6f9e655834135c053f12ecef341095a3e8fd01f12b0e1ea30c", "bytes": 5267 } }, "started_utc": "2026-10-24T13:40:15.491Z", "status": 200, "final_url": "https://www.radioworld.com/tech-and-gear/radio-it-management/is-your-manufacturer-affected-by-the-php-vulnerability" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Radio World (English), 23 October, by Paul McLane: a running checklist of broadcast-equipment makers' answers on whether their products are affected....", "raw_sha256": {}, "has_notes": true, "notes_md": "# Is Your Manufacturer Affected by the PHP Vulnerability? - Radio World\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ca/news/radioworld/tech-and-gear-radio-it-management-is-your-manufacturer-affec`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nRadio World (English), 23 October, by Paul McLane: a running checklist of broadcast-equipment makers' answers on whether their products are affected. Telos Alliance issued a tech advisory that its Zephyr Connect SE, Altus SE and Pathfinder Core Pro are affected and promised remediation strategies; Comrex says none of its products or services are affected except its Switchboard service, patched within hours of the CVE notice, and notes the vulnerability was found by AI; Wheatstone says only a Nielsen timestamp interface affecting a handful of X5 customers; Burk, Digital Alert Systems, Inovonics, RCS, Sage Alerting, Tieline and WideOrbit say their products are not affected or do not use PHP. The list is stated to be growing as answers come in.\n\n> Telos Alliance — The company issued a tech advisory that its Zephyr Connect SE, Altus SE and Pathfinder Core Pro were affected by the PHP2Shell vulnerability.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Is Your Manufacturer Affected by the PHP Vulnerability? - Radio World\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "raya-2026-10-22-php", "url": "https://www.raya.com/2026/10/22/ثغرتان-خطيرتان-في-php-تهددان-خوادم-المواقع", "publisher": "جريدة الراية", "kind": "news", "title": "ثغرتان خطيرتان في PHP تهددان خوادم المواقع - جريدة الراية", "published": "2026-10-22 11:07:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "85736b61061b4eae930202aee53963fdccb25d6bd47fa0f673ffe12607d27362", "bytes": 1417 }, "page.html": { "sha256": "101f4e2ad23623ed81ff64d388b0718db4ec5a2306e4c943ac2c4e1cf905c10d", "bytes": 185759 }, "provenance.json": { "sha256": "9bbac0cd9688549ab37cf2f977d1cffa124b63fa8c5b7033fe2ce30d451b3994", "bytes": 1683 }, "text.txt": { "sha256": "ee2c1881db3c1d9000bef7bee4006da4ddc8585e1e1bc818c44acf401a458c1e", "bytes": 12078 } }, "started_utc": "2026-10-23T16:14:06.212Z", "status": 200, "final_url": "https://www.raya.com/2026/10/22/%D8%AB%D8%BA%D8%B1%D8%AA%D8%A7%D9%86-%D8%AE%D8%B7%D9%8A%D8%B1%D8%AA%D8%A7%D9%86-%D9%81%D9%8A-php-%D8%AA%D9%87%D8%AF%D8%AF%D8%A7%D9%86-%D8%AE%D9%88%D8%A7%D8%AF%D9%85-%D8%A7%D9%84%D9%85%D9%88%D8%A7%D9%82%D8%B9" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Al Raya (Qatar, Arabic), 22 October, a Q&A style explainer. It says two serious flaws were found in PHP, that authorities and IT-security experts trea...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثغرتان خطيرتان في PHP تهددان خوادم المواقع - جريدة الراية\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/raya/2026-10-22-php`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nAl Raya (Qatar, Arabic), 22 October, a Q&A style explainer. It says two serious flaws were found in PHP, that authorities and IT-security experts treat the situation as an exceptional emergency because the details leaked unintentionally before the planned date, and that many site operators took sites offline as a precaution. Ordinary users face no direct risk to phones, tablets or computers, but an indirect one if a site they use is unpatched. It says it is not yet clear how the flaws were found though there are many signs that wide use of AI contributed, and that large hosting companies such as IONOS have already updated PHP on their systems.\n\n> كما قامت شركات استضافة مواقع كبرى، مثل \"آيونوس\"، بتحديث إصدار \"بي إتش بي\" في أنظمتها بالفعل\n\n_Curator's translation:_ \"Large web-hosting companies, such as IONOS, have also already updated the PHP version on their systems.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Qatari daily Al-Raya runs a Q&A (apparently translated from German dpa copy) saying Germany's BSI warns of imminent danger and many operators took sites offline. It notes that large hosters such as IONOS have already updated PHP, and that automated attack waves have begun.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثغرتان خطيرتان في PHP تهددان خوادم المواقع - جريدة الراية\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "rbbtoday-release-prtimes2-today-20261022-1383966", "url": "https://www.rbbtoday.com/release/prtimes2-today/20261022/1383966.html", "publisher": "RBB TODAY", "kind": "news", "title": "PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開 - PR TIMES｜RBB TODAY", "published": "2026-10-22 14:46", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "60814dbf888cffe90b116df2bbe8727f8d780d70bd97269e8815e1f9cb78d54e", "bytes": 932 }, "page.html": { "sha256": "eea2aefd9bc692243f2ee6a944a8718d23e4cca03877b8969f8daa5fe6151f9b", "bytes": 39818 }, "provenance.json": { "sha256": "9108bddd13caf0a3fcb8251bd857fc4ee185f9b0542ee3212f4d8fe794ff5dc5", "bytes": 1794 }, "rendered.html": { "sha256": "bbbe2196115eb6fc6b84c0c2bb57263e31e3e5462dccd7db71a793c7836d7169", "bytes": 56551 }, "screenshot.jpg": { "sha256": "df9731b098f981dfa455d94ddf8460870bdd9cbfa301486359b15d66e4f7b94d", "bytes": 552862 }, "text.txt": { "sha256": "ec0a9452b36eedf980416e563a803cdd0c69bc161878221461829b6267be5791", "bytes": 9183 } }, "started_utc": "2026-10-23T16:19:47.000Z", "status": 200, "final_url": "https://www.rbbtoday.com/release/prtimes2-today/20261022/1383966.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). RBB TODAY (Japanese), 22 October, a PR TIMES release by TorchUp (Tokyo) offering a free white paper, a four-phase checklist for companies that run Wor...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開 - PR TIMES｜RBB TODAY\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/rbbtoday/release-prtimes2-today-20261022-1383966-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nRBB TODAY (Japanese), 22 October, a PR TIMES release by TorchUp (Tokyo) offering a free white paper, a four-phase checklist for companies that run WordPress sites: take stock (PHP version, who administers the server, backups, logs), interim measures, apply the fix or migrate, and decide whether to keep the site up and look for signs of intrusion. It says the flaw is in PHP itself so updating WordPress or plugins is not enough, and that configuration changes alone cannot block every attack path. Marketing content; it adds no new facts.\n\n> ただし、設定変更だけではすべての攻撃経路を防げるわけではありません。\n\n_Curator's translation:_ \"However, configuration changes alone cannot block every attack path.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ PR Times release (via RBB Today) from Tokyo firm TorchUp offering a free whitepaper and checklist for WordPress site operators on php2shell.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHPに深刻度9.2の緊急脆弱性「php2shell」発覚、WordPressサイト運営企業向けの対策チェックリストをTorchUpが無料公開 - PR TIMES｜RBB TODAY\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "recordedfuture-php2shell", "url": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "publisher": "Recorded Future", "kind": "vendor", "title": "PHP2Shell Exploitation: Two Critical PHP Flaws Explained", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113014Z", "files": { "headers.json": { "sha256": "3f16adaf8c9cba92536851d7836d4e787039ea13bccb4da34e56759d45f7fbef", "bytes": 1234 }, "page.html": { "sha256": "cd54cc52e04832d03115211f9aca789fb9d4861a8460a25a4e6ccc45f2d11f9b", "bytes": 27860 }, "provenance.json": { "sha256": "d044ae83506d9d12bb11b3e2357405fd0be2350bf9782b8f21e5d0bc7134c316", "bytes": 1034 }, "rendered.html": { "sha256": "ca1457d1d590d21807ebf2cd64d30304ff3607b8171472c2d205a8fd4365a37c", "bytes": 178844 }, "screenshot.png": { "sha256": "cd745753c1ec28fcaf45c4b291d01045bdf86c88cbd0184e664e196bdd0f8ddc", "bytes": 2871582 }, "text.txt": { "sha256": "f9cb130d64545fe46a477766dce91126405f12d99e8051aff2c05e084a904fe9", "bytes": 18444 } }, "started_utc": "2026-10-22T11:30:14.282Z", "status": 200, "final_url": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation" }, { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "df92af5f1f15a9b85ac768da0a431d3d7aeadec8e8e1068f4d7d57e76f9b56b1", "bytes": 1305 }, "page.html": { "sha256": "cd54cc52e04832d03115211f9aca789fb9d4861a8460a25a4e6ccc45f2d11f9b", "bytes": 27860 }, "provenance.json": { "sha256": "9c026e4540e485d466a7ebfb9befe5fe2ea5a26a87647d09af9bbb5d950e3209", "bytes": 1706 }, "rendered.html": { "sha256": "e4e4f2824c8737f38089591489f1357b6b278f491cc344717f0a01d6de090dee", "bytes": 91816 }, "screenshot.jpg": { "sha256": "68cd85ed3f9dc7d419ee012d3ab12f44d57604bffc4dad62486f71cd98e5a098", "bytes": 899644 }, "text.txt": { "sha256": "39efeb7b8ae8152f98ccf53437e4070f12339a7e718570de9f01ac96d23b0622", "bytes": 17215 } }, "started_utc": "2026-10-23T01:38:06.991Z", "status": 200, "final_url": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "a5b6e014f8f9bad6ff90385d3a483a51fec3e5af097bc5ce4162c306687fe3f8", "bytes": 1305 }, "page.html": { "sha256": "d93a1ac76ef2a1cbc5efb69085764a3b86d3ec663e9fef379392bd05c683cbbf", "bytes": 27860 }, "provenance.json": { "sha256": "5d37943846b2c5186dc66fa38523588b066ccf066a901a7e37e11aacceb6647f", "bytes": 1787 }, "rendered.html": { "sha256": "7e5416dba92c0c59ea7f7e10bb5481e565b2d87f419a1ff778b9a917ae169101", "bytes": 91859 }, "screenshot.jpg": { "sha256": "68cd85ed3f9dc7d419ee012d3ab12f44d57604bffc4dad62486f71cd98e5a098", "bytes": 899644 }, "text.txt": { "sha256": "455f6f3614b4acfb45ef4b051f2db40c015a61a3e797016042ca5ff9c0a00f9f", "bytes": 17215 } }, "started_utc": "2026-10-23T23:43:16.899Z", "status": 200, "final_url": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Exploitation: Two Critical PHP Flaws Explained\n\nCaptured by claude-story-site. Status: captured. Vendor explainer.\n\n- Captured for the record.\n" }, { "slug": "repubblica-tecnologia-2026-10-21-news-php2shell-ia", "url": "https://www.repubblica.it/tecnologia/2026/10/21/news/php2shell_ia_due_falle_web-425663861/", "publisher": "la Repubblica", "kind": "news", "title": "PHP2Shell, l’IA svela due falle critiche nel web - la Repubblica", "published": "2026-10-21T17:55:56Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "45bea6772e54153e771d375e8dd3dc5e4504588e04db6330e62bbe061e8ae95f", "bytes": 1987 }, "page.html": { "sha256": "57b4522b2978e48a007d6bf4bfbd025bfa1f7f3899e268d0a0f2489829eecd12", "bytes": 163017 }, "provenance.json": { "sha256": "135bf07c552eee1b70fe0f3f83b1e8cfab80555f9d67f05a6b03656bd4fb421e", "bytes": 1618 }, "text.txt": { "sha256": "15cece2248273664131179c3462761620f79e5f2ed3af09e3aee95a919e3b217", "bytes": 13395 } }, "started_utc": "2026-10-23T16:18:57.638Z", "status": 200, "final_url": "https://www.repubblica.it/tecnologia/2026/10/21/news/php2shell_ia_due_falle_web-425663861/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). la Repubblica (Italian), 21 October: AI reveals two critical flaws in the web, both 9.2 on CVSS, together called PHP2Shell. It argues that the same sy...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell, l’IA svela due falle critiche nel web - la Repubblica\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/repubblica/tecnologia-2026-10-21-news-php2shell-ia-due-falle-web-425663`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nla Repubblica (Italian), 21 October: AI reveals two critical flaws in the web, both 9.2 on CVSS, together called PHP2Shell. It argues that the same systems that help find complex flaws can also speed up the preparation of attacks, so checks must move as fast as the ability to fix.\n\n> Gli stessi sistemi capaci di aiutare a trovare falle complesse possono accelerare anche la preparazione degli attacchi.\n\n_Curator's translation:_ \"The same systems that can help find complex flaws can also speed up the preparation of attacks.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ La Repubblica explains the two flaws and the discovery timeline (Calif from 30 July, report 11 August; Wiz 24 August). It covers the PHP Foundation's 'structural failure' admission and the leak that moved the release from 22 to 21 October.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell, l’IA svela due falle critiche nel web - la Repubblica\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "reuters-factbox-gbaf", "url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/", "publisher": "globalbankingandfinance.com", "kind": "news", "title": "Major European Websites Offline Amid Critical PHP Security Flaws", "published": null, "captures": [ { "stamp": "20261022T081002Z", "files": { "headers.json": { "sha256": "0f82cac11c2c31881c8242d2bf90ed1ebc349bbb702d299abb0e94c2b2fc1880", "bytes": 1330 }, "page.html": { "sha256": "8b08fae52d13b125e5261388eb67d5e549c6ee18d44c3d6d93c35a155d104314", "bytes": 211274 }, "provenance.json": { "sha256": "0ec20c99fc8c619438aa226c1087f5d008ef9a7db541e19985ae4af428a0042f", "bytes": 1066 }, "rendered.html": { "sha256": "cdcd3539791cbe2e6d50b9b6206835f8ccf4f1fb48ed26adad8b43e163ba64f4", "bytes": 225149 }, "screenshot.png": { "sha256": "be60a7208d66854ef7c6ec0949fbd543dea20f03eb2f712803865e01ee11e6ce", "bytes": 3384956 }, "text.txt": { "sha256": "9703a69c2faf52b56bf06d29691f5173128b527dc9b76db27050db282fff262b", "bytes": 8772 } }, "started_utc": "2026-10-22T08:10:02.558Z", "status": 200, "final_url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "reuters-factbox-websites-offline", "url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/", "publisher": "Reuters factbox, via Global Banking and Finance", "kind": "news", "title": "Global Websites Offline Amid PHP Security Flaws: Finance Sector Impact", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113026Z", "files": { "headers.json": { "sha256": "8756be9a476cea45bf6f0ba5d6afec78293d9a1c08b04c463ba887aa51643743", "bytes": 1259 }, "page.html": { "sha256": "8c4668f8881f07f4e9fcdaf5498ac560214aa9243a2e163122532b0a80b2d141", "bytes": 214076 }, "provenance.json": { "sha256": "93bc4bfda9e1316396b718afd5bf442ed65dbddf92c7700d9308c0d04c3c7806", "bytes": 1084 }, "rendered.html": { "sha256": "5732718cdad049baa24fe5d9d7c0e91fd962f71df61672c4e0b3d101b9a262c3", "bytes": 227694 }, "screenshot.png": { "sha256": "28b7c31e70d01ad1a8ca150a6127d7188c38f431b913c022f6aa6a997c47cc5c", "bytes": 3456506 }, "text.txt": { "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "bytes": 10148 } }, "started_utc": "2026-10-22T11:30:26.047Z", "status": 200, "final_url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a624791e097041e6abf1e0e6b6abc35bdab5812d0bba162c99d36c6ae134e7a1", "bytes": 1354 }, "page.html": { "sha256": "f45743afa98ecc69805e3186c1672ce9cb07f73588a358041e316682975662c1", "bytes": 212742 }, "provenance.json": { "sha256": "da3f25a56f17707a7318f3719a8a3facdaaad926401b3ff066abb8aa422b86c7", "bytes": 1766 }, "rendered.html": { "sha256": "7d1caa464a19381a8838781832a841b7a677de19ab56746d8fdcd24c83b2fe51", "bytes": 220594 }, "screenshot.jpg": { "sha256": "a3a13d7a6abe4a384970719218cf0e608fbbefc3a5b3e314dbe10d9d6e9c5d34", "bytes": 796133 }, "text.txt": { "sha256": "580b1825b53a02b647e824a20640ed311a5fc9b52a41f4d4dfe3799f365310dc", "bytes": 9611 } }, "started_utc": "2026-10-23T16:15:44.270Z", "status": 200, "final_url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "49b0b8c9d4f582ca5c7660b7fa87294c3a67aa9f1bf7aa59650a9bbecc961351", "bytes": 1354 }, "page.html": { "sha256": "bac73707ea379a721131c9b0cf14ba3b75a2cc834875f008cde49b792219b26c", "bytes": 212658 }, "provenance.json": { "sha256": "89a0679a453e4343388fd8fcd83c18cecd38fa74bd9697ab6f741f29863c8379", "bytes": 1802 }, "rendered.html": { "sha256": "1d5baf8d98f6f0d3737219eeb089eeb9124a8b0d00764956a88c642639fe17c4", "bytes": 220510 }, "screenshot.jpg": { "sha256": "f1b373c45ccb4a638fb123526c6b9698acbd4b0dc4e87f093f1b124244a93a6a", "bytes": 786557 }, "text.txt": { "sha256": "cee32261ea200d861ff0b9c5363eeb61fd513192358fde3ec394df4e8108e023", "bytes": 9569 } }, "started_utc": "2026-10-23T23:33:12.124Z", "status": 200, "final_url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Reuters list of websites taken offline: Netherlands, France, Germany, Belgium, Finland and others.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Global Websites Offline Amid PHP Security Flaws: Finance Sector Impact\n\nCaptured by claude-story-site. Status: captured. Reuters list of websites taken offline: Netherlands, France, Germany, Belgium, Finland and others.\n\n- A syndicated copy; Reuters' own page not captured.\n" }, { "slug": "rijksoverheid-ncsc-php-news", "url": "https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php", "publisher": "Rijksoverheid (Dutch government) / NCSC-NL", "kind": "government", "title": "NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113033Z", "files": { "headers.json": { "sha256": "02c777fcd4897b76fb5febbe44f6827eac84175c43def883b4074889c879f1e6", "bytes": 2789 }, "page.html": { "sha256": "cd5e199ae854bb38177fa187f36f80b267ee93f5b23262122697c7038276e21e", "bytes": 240904 }, "provenance.json": { "sha256": "41eeb42a42ffe905a45ac1fe625d4acb5b9ba172ca4fd9253d01dc7295a7aa8b", "bytes": 1072 }, "rendered.html": { "sha256": "e364ac0a4f3336a54bc2581a182d37db39961f47802adca7c95247e9c0fd4613", "bytes": 244344 }, "screenshot.png": { "sha256": "0b023dc6a8fca71e18932ef0a168051841129928264b33c1937fff623cab4457", "bytes": 435918 }, "text.txt": { "sha256": "7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3", "bytes": 3720 } }, "started_utc": "2026-10-22T11:30:33.461Z", "status": 200, "final_url": "https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Primary: NCSC.NL taken offline 'uit voorzorg'; advises a risk assessment per internet-facing PHP system and considering switching systems off until fixed.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl\n\nCaptured by claude-story-site. Status: captured. Primary: NCSC.NL taken offline 'uit voorzorg'; advises a risk assessment per internet-facing PHP system and considering switching systems off until fixed.\n\n- Verbatim (Dutch): 'uit voorzorg de website NCSC.NL tijdelijk offline gehaald'; 'een risicoafweging te maken per systeem'. Translation is this site's.\n" }, { "slug": "rocket-boys-security-measures-lab-php2shell-poc-expl", "url": "https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/", "publisher": "合同会社ロケットボーイズ", "kind": "news", "title": "PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab", "published": "2026-10-22T14:56:52+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2fa11046b852bd7af02b3a4a36eff2eab616cdb9797f80587b3065a2cd420f54", "bytes": 1444 }, "page.html": { "sha256": "0d96245e6d02d7170bb3666d25918320a9728cf856c4d4a8f0a52f23520fc7b1", "bytes": 615369 }, "provenance.json": { "sha256": "77749fc927be896e16ce7318e493d0d9ecf80ea4996f0cbb3b84d35851cb616f", "bytes": 1904 }, "rendered.html": { "sha256": "7c53e1dbafedd63bc6a78deaeed6c424f6769f27ae8759d206c1d5e18a290244", "bytes": 628633 }, "screenshot.jpg": { "sha256": "9e4bfc3e74986643d92c2075b3db42e1f1ead0838b37b7c1777e22db8b1821a4", "bytes": 1087188 }, "text.txt": { "sha256": "200b9c25496ebb7c2ce6a67438d5aa9ff91913881792669617d5194d17301151", "bytes": 24573 } }, "started_utc": "2026-10-23T16:19:53.778Z", "status": 200, "final_url": "https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Security Measures Lab / Rocket Boys (Japanese), 22 October: proof-of-concept code for PHP2Shell is surging on GitHub. The Korean firm AhnLabs examined...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/rocket-boys/security-measures-lab-php2shell-poc-exploitation-20261022`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSecurity Measures Lab / Rocket Boys (Japanese), 22 October: proof-of-concept code for PHP2Shell is surging on GitHub. The Korean firm AhnLabs examined 100 related repositories on GitHub on 22 October and counted 27 classified as PoCs; Amazon Threat Intelligence reported attempts from four days before disclosure. The curator did not fetch any of the repositories or code.\n\n> 韓国のセキュリティ企業AhnLabは2026年10月22日、GitHub上の関連リポジトリ100件を調査し、PoCに分類される27件を確認したと公表しました。\n\n_Curator's translation:_ \"On 22 October 2026 the Korean security company AhnLab announced that it had examined 100 related repositories on GitHub and confirmed 27 classified as PoCs.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Security Measures Lab (Rocket Boys) analysis. Korean security firm AhnLab surveyed GitHub on 22 Oct: of the top 100 non-fork 'php2shell' repos, 99 were related, 46 defensive and 36 attack/PoC, with 27 classed as PoC; the earliest PoC repo was created 20 Oct 19:16 UTC. It also retells Amazon's MadPot observations from 17 Oct and warns about fake PoCs.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "root-zpravicky-utok-na-php2shell-zacal-uz-cty", "url": "https://www.root.cz/zpravicky/utok-na-php2shell-zacal-uz-ctyri-dny-pred-zverejnenim-zranitelnosti-tvrdi-amazon/", "publisher": "Root.cz", "kind": "news", "title": "Útok na PHP2Shell začal už čtyři dny před zveřejněním zranitelností, tvrdí Amazon - Root.cz", "published": "not stated in the capture (the text says 'yesterday afternoon' of the 21 October patches)", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c4f3f6f28620b890ca0f6ef497dbd90142d32beeb7355a9cc76d661573082160", "bytes": 703 }, "page.html": { "sha256": "557dc69ea9fcb90c4f6de063b4b3695ae52807464704aba6812e42c5fdc02233", "bytes": 209627 }, "provenance.json": { "sha256": "a9ab0514ac7a3ff232315eef9b0ef93229133030d8670a248a0107d2393f5895", "bytes": 1828 }, "rendered.html": { "sha256": "0b228a16dcfcde2230aa66f79cd100524084d827ef33d971795497abe47d64ab", "bytes": 387871 }, "screenshot.jpg": { "sha256": "586e09fa07a61b140115a1af14fa981dba0979c49ed07f992978266a94448888", "bytes": 244709 }, "text.txt": { "sha256": "44cce45b82b5efbb25345e9053f9703ea366397d39c0e6f6476f240fec598205", "bytes": 3045 } }, "started_utc": "2026-10-23T16:12:49.177Z", "status": 200, "final_url": "https://www.root.cz/zpravicky/utok-na-php2shell-zacal-uz-ctyri-dny-pred-zverejnenim-zranitelnosti-tvrdi-amazon/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "cs", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Root.cz (Czech), a short news item by Petr Krčmář, probably 22 October. It says Amazon recorded the first exploitation attempt on 17 October, four day...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Útok na PHP2Shell začal už čtyři dny před zveřejněním zranitelností, tvrdí Amazon - Root.cz\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `cz/news/root/zpravicky-utok-na-php2shell-zacal-uz-ctyri-dny-pred-zverejne`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nRoot.cz (Czech), a short news item by Petr Krčmář, probably 22 October. It says Amazon recorded the first exploitation attempt on 17 October, four days before publication, on its MadPot honeypot network, on a server meant to attract attackers and not an ordinary production site, from an IP address linked to a commercial anonymisation network; Amazon cannot explain how the attacker learned of the flaws before disclosure. More attempts from various sources came several hours before publication, which may point to several actors; after the fixes attempts rose, but it is not certain every captured attempt could have succeeded on a truly vulnerable server. Amazon advises administrators to look for signs of attack from at least 17 October, not from disclosure day.\n\n> Amazon doporučuje správcům při hledání známek útoku nezačínat až dnem zveřejnění zranitelností, ale prověřit podezřelou aktivitu nejméně od 17. října.\n\n_Curator's translation:_ \"Amazon recommends that administrators looking for signs of attack should not start from the day the vulnerabilities were published but check for suspicious activity from at least 17 October.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Útok na PHP2Shell začal už čtyři dny před zveřejněním zranitelností, tvrdí Amazon - Root.cz\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `cs`. The lead image is credited as made with 'Zoner AI' (site chrome). Nothing in the article text addresses an AI or hides text from a reader.\n" }, { "slug": "rte-reuters-websites-go-dark", "url": "https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/", "publisher": "rte.ie", "kind": "news", "title": "Websites go dark as AI exposes critical security flaws", "published": null, "captures": [ { "stamp": "20261022T081010Z", "files": { "headers.json": { "sha256": "f5b5b1d3b6b258e2668d1a3047ddb2a89d50c42adc9c44c86ef90afd467c1bc3", "bytes": 1235 }, "page.html": { "sha256": "2945a45c012dc5bd698063f5c9a20f07fd33bcd8caf04a6367975d09fd13d668", "bytes": 113113 }, "provenance.json": { "sha256": "76e5dfc557b4b3c9272c645b3194acdc2db8d1133b8afbb477a1aaed2ffb15d8", "bytes": 1022 }, "rendered.html": { "sha256": "2e18e85345a2955f871b8555cb252692d6dbcf108944014933fa45e2c30fc839", "bytes": 332598 }, "screenshot.png": { "sha256": "17168dd7f381156936039432350ee18a1b46c8e6f4906d21645fc0fcf7bf2a1f", "bytes": 1313851 }, "text.txt": { "sha256": "99bb92662561bd292bc1f931e1e6a22f14756140e4f67365d75961f4b05bb653", "bytes": 9940 } }, "started_utc": "2026-10-22T08:10:10.386Z", "status": 200, "final_url": "https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "rtl-leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-fi", "url": "https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html", "publisher": "RTL.de", "kind": "news", "title": "PHP-Lücke: BSI warnt vor Cyber-Gefahr – Firmen oft unwissend", "published": "2026-10-22T19:41:37", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "321a40764cf371471d79d6f2d6b9f3227260276dfcb529eebfcd688f7e5ad5b9", "bytes": 1618 }, "page.html": { "sha256": "abe3016b1607d34a0956dd46eac3453997dad2d79d292600a3c1c90d5be02960", "bytes": 1203929 }, "provenance.json": { "sha256": "75a301ad356d6e1a61261537316a74a33e17dc037d70875abd177eb6b3483efa", "bytes": 1796 }, "rendered.html": { "sha256": "b15ecaa96265133b0343466847e71af449c249b10ed1a8622c8f2e0a57f90ce3", "bytes": 1225662 }, "screenshot.jpg": { "sha256": "be70d324955662023d26ab0cc1419cadafc6d450f8bd3517d4fa5aab90fe120f", "bytes": 119816 }, "text.txt": { "sha256": "a69da5f39287ad4307292733dfaf03317eb57edfcc30fc1959d41922af77bcf7", "bytes": 7400 } }, "started_utc": "2026-10-22T18:20:12.859Z", "status": 200, "final_url": "https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 6 new items in de: RTL (dpa-based) reports the BSI has found no cases of exploitation so far and believes many operators have patched. Digital Minister Wildberger praised BSI and ITZBund and said shutting down sites was right; the Interior", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Lücke: BSI warnt vor Cyber-Gefahr – Firmen oft unwissend\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `de/news/rtl/leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-firmen`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: RTL.de. Language: de. URL: https://www.rtl.de/leben/digitales/php-luecke-bsi-warnt-vor-cyber-gefahr-firmen-oft-unwissend-id31448587.html\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nRTL (dpa-based) reports the BSI has found no cases of exploitation so far and believes many operators have patched. Digital Minister Wildberger praised BSI and ITZBund and said shutting down sites was right; the Interior Ministry says federal sites taken offline are mostly back. Bitkom, eco, Green MP von Notz and the DStGB are quoted.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/de/news/rtl/leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-firmen.json`), not the publisher's and not checked word for word by the curator.\n\n**agency**: The BSI said it had so far found no cases in which the vulnerabilities were exploited, though successful attacks cannot be ruled out.\n\n> Das Bundesamt für Sicherheit in der Informationstechnik (BSI) habe bislang keine Fälle festgestellt, in denen die Sicherheitslücken ausgenutzt wurde, erklärte die IT-Sicherheitsbehörde. „Dennoch können erfolgreiche Angriffe derzeit nicht ausgeschlossen werden.“\n\n_Watch reader's translation:_ The BSI had so far not found any cases in which the vulnerabilities were exploited, the IT security authority said. 'Nevertheless, successful attacks cannot currently be ruled out.'\n\n**agency**: The BSI said the absence of reported compromises suggests many operators have already patched successfully.\n\n> Dass bislang keine kompromittierten Systeme gemeldet worden seien, „lässt aktuell den Schluss zu, dass viele Betreiber gemäß den Empfehlungen bereits erfolgreich gepatcht haben“, erklärte das BSI.\n\n_Watch reader's translation:_ That no compromised systems have been reported so far 'currently allows the conclusion that many operators have already successfully patched in accordance with the recommendations', the BSI said.\n\n**official**: The Federal Interior Ministry said federal administration websites taken offline preventively are mostly available again.\n\n> „Websites der Bundesverwaltung, die präventiv vom Netz genommen wurden, sind größtenteils wieder verfügbar“, erklärte am Donnerstag das Bundesinnenministerium.\n\n_Watch reader's translation:_ 'Websites of the federal administration that were taken offline preventively are mostly available again,' the Federal Interior Ministry said on Thursday.\n\n**official**: Digital Minister Karsten Wildberger said shutting down websites was the right decision and there are no signs of successful compromise of federal systems.\n\n> „Nach unserem bisherigen Erkenntnisstand gibt es aktuell keine Hinweise auf eine erfolgreiche Kompromittierung von Systemen der Bundesverwaltung.“\n\n_Watch reader's translation:_ 'According to our current knowledge, there are currently no indications of a successful compromise of federal administration systems.'\n\n**official**: Green interior politician Konstantin von Notz sharply criticised the federal government's IT security policy.\n\n> „Dringend notwendig ist, auf diese stark gestiegene Bedrohungen mit echten politischen Handlungen zu antworten, die die IT-Sicherheit schnellstmöglich signifikant erhöhen“, sagte von Notz der „Rheinischen Post“.\n\n_Watch reader's translation:_ 'It is urgently necessary to respond to these sharply increased threats with real political action that significantly increases IT security as quickly as possible,' von Notz told the Rheinische Post.\n\n**agency**: A BSI spokeswoman advised end users not to make home routers remotely accessible and to be careful with downloads because manipulated websites may be circulating.\n\n> Endnutzern rät die IT-Sicherheitsbehörde insbesondere, ihre Internetrouter nicht so zu konfigurieren, dass sie auch von unterwegs darauf zugreifen können.\n\n_Watch reader's translation:_ The IT security authority advises end users in particular not to configure their internet routers so that they can be accessed remotely.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 6 new items in de: RTL (dpa-based) reports the BSI has found no cases of exploitation so far and believes many operators have patched. Digital Minister Wildberger praised BSI and ITZBund and said shutting down sites was right; the Interior\n\nSupports: translations/de/news/rtl/leben-digitales-php-luecke-bsi-warnt-vor-cyber-gefahr-firmen.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "rtve-noticias-20261022-fallos-criticos-php2shell-vulnerabili", "url": "https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml", "publisher": "RTVE.es", "kind": "news", "title": "Alerta por fallos críticos en PHP: riesgo en servidores web", "published": "2026-10-22T01:49:29+02:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "b5dad02e568f4ab4cfd809b3fe342ed8cf08defddf91510779f5afe2637dc887", "bytes": 606 }, "page.html": { "sha256": "af0bf01237b873ef9dcabdb4816360d6bd3f4ffd3ec09ada675afefde44af993", "bytes": 95615 }, "provenance.json": { "sha256": "6201b6d432f17cc9fc0b4d70179f355634fd09105282bb90ee5d8e51d9339aec", "bytes": 1833 }, "rendered.html": { "sha256": "3ef986deb6a9e2970044a3f98bb0ecf6bf0dce0baa34426bbaf3e2054bde3fb8", "bytes": 179111 }, "screenshot.jpg": { "sha256": "b96238b874f2f01b6987479aee95c2e60d58e80ffa155472735187d0e3e796b0", "bytes": 829185 }, "text.txt": { "sha256": "0c7f8e327e5c8bd0d5c3b0c7c6ab7cb7ef3a383f5da908cecc7da96ba7a19ccf", "bytes": 11153 } }, "started_utc": "2026-10-22T18:20:58.445Z", "status": 200, "final_url": "https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in es: RTVE describes the global alert, Spain's INCIBE critical notice and the NSA warning. It lists precautionary shutdowns: ITZBund in Germany, French prefecture sites, Belgian portals, Finland, and Czechia's government page.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Alerta por fallos críticos en PHP: riesgo en servidores web\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `es/news/rtve/noticias-20261022-fallos-criticos-php2shell-vulnerabilidades`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: RTVE.es. Language: es. URL: https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nRTVE describes the global alert, Spain's INCIBE critical notice and the NSA warning. It lists precautionary shutdowns: ITZBund in Germany, French prefecture sites, Belgian portals, Finland, and Czechia's government page.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/es/news/rtve/noticias-20261022-fallos-criticos-php2shell-vulnerabilidades.json`), not the publisher's and not checked word for word by the curator.\n\n**agency**: Spain's INCIBE issued a critical alert on PHP2Shell.\n\n> En España, el Instituto Nacional de Ciberseguridad (Incibe) también ha emitido una alerta crítica.\n\n_Watch reader's translation:_ In Spain, the National Cybersecurity Institute (Incibe) has also issued a critical alert.\n\n**offline**: Germany's federal IT provider ITZBund took several pages offline; the German digital ministry said it was precautionary with no security incidents.\n\n> En Alemania, el proveedor federal de servicios informáticos ITZBund ha retirado varias páginas de Internet. El Ministerio de Digitalización germano ha aclarado que se trataba de una medida de precaución y que no se habían registrado incidentes de seguridad.\n\n_Watch reader's translation:_ In Germany, the federal IT service provider ITZBund has taken several pages off the internet. The German Digital Ministry clarified it was a precautionary measure and that no security incidents had been recorded.\n\n**offline**: France's Interior Ministry temporarily disabled prefecture websites pending the fix.\n\n> En Francia, el Ministerio del Interior ha desactivado temporalmente las webs de las prefecturas a la espera de aplicar la corrección de seguridad.\n\n_Watch reader's translation:_ In France, the Interior Ministry has temporarily deactivated the prefectures' websites pending application of the security fix.\n\n**agency**: Belgium's cybersecurity centre confirmed it had recorded no attacks in the country.\n\n> su centro de ciberseguridad confirmó que no había registrado ataques en el país\n\n_Watch reader's translation:_ its cybersecurity centre confirmed it had not recorded attacks in the country\n\n**offline**: Czechia took its government web page offline to install updates.\n\n> Chequia ha desconectado su página gubernamental para instalar las actualizaciones necesarias.\n\n_Watch reader's translation:_ Czechia has disconnected its government web page to install the necessary updates.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in es: RTVE describes the global alert, Spain's INCIBE critical notice and the NSA warning. It lists precautionary shutdowns: ITZBund in Germany, French prefecture sites, Belgian portals, Finland, and Czechia's government page.\n\nSupports: translations/es/news/rtve/noticias-20261022-fallos-criticos-php2shell-vulnerabilidades.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "safeguard-how-hard-to-exploit", "url": "https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes", "publisher": "Safeguard (vendor blog)", "kind": "vendor", "title": "PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113039Z", "files": { "headers.json": { "sha256": "f024dda4aca45ee7784179ce10f5502c7cdc1848b68820c5e3ac4d5ae9977fe4", "bytes": 1910 }, "page.html": { "sha256": "ca8f171043e3a56f99149b1ffa731bfdd00faa1aca0dde315bab896ba544148f", "bytes": 419051 }, "provenance.json": { "sha256": "dc78d80894e1f67eb84e8f3dbcb4fce3d4687ae21172b11e13dab9e452491777", "bytes": 1094 }, "rendered.html": { "sha256": "d50d0675b422cf74595a98594b026b8936b4a597bfdd8e14bf6417f1fb65c089", "bytes": 425970 }, "screenshot.png": { "sha256": "81bc77d288b0f16b3a5aff9755c8f70d850d79e54d2f786960ea233e942d2e24", "bytes": 3150477 }, "text.txt": { "sha256": "271a233b1b8e628f66e764b3e3f089b09951d09ecdbb5fb9ef39d619eae623e9", "bytes": 37594 } }, "started_utc": "2026-10-22T11:30:39.560Z", "status": 200, "final_url": "https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d50c6a9ddd97239fa2ed1d9614882d0507ba77f07c9484fc833498c7ed6307d6", "bytes": 1917 }, "page.html": { "sha256": "959573a3f2c3d2e8848e4f61f7cabb007ee6331d4673a54a6d7c1c9b66bc230d", "bytes": 419348 }, "provenance.json": { "sha256": "f8b12a3e1a08e3c7e4903cb98245fd94c2e743c19e8e39a9278b9eaf6432b84f", "bytes": 1844 }, "rendered.html": { "sha256": "0a7a5c755f46e5b6dbf8c621456c0772fb7d7a77d2a2c3994eb743198469366d", "bytes": 417090 }, "screenshot.jpg": { "sha256": "73084c3582950994b826c9dbfbaaac7cf5304f70bb032169e76d55d2ecc92382", "bytes": 855170 }, "text.txt": { "sha256": "b71f6bcecfb482abe1ff03d2d333d48f6729f67fad7c3525ff8abacfb7b03a67", "bytes": 38094 } }, "started_utc": "2026-10-23T16:27:57.460Z", "status": 200, "final_url": "https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog\n\nCaptured by claude-story-site. Status: captured. Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation.\n\n- Secondary; cites Kostas's test of the PoC and Gina Peter Banyard's Mastodon post (neither captured).\n" }, { "slug": "safeguard-waf-rules-limits", "url": "https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits", "publisher": "Safeguard (vendor blog)", "kind": "vendor", "title": "PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111928Z", "files": { "headers.json": { "sha256": "0c47d1b3b4483fe3dfbc1d2c92601e2da277c00bd9b13a0b4e1400d532b810f8", "bytes": 1911 }, "page.html": { "sha256": "7ee15349d487eb9f5fb2f578f4e465e1bdd8b44a4f7ecbfc4b2d6da5277b7dda", "bytes": 428039 }, "provenance.json": { "sha256": "a152958c004bbd289d33c79fc1eaf5b3b1aa6442001c31226607d2a25f3b67d4", "bytes": 1055 }, "rendered.html": { "sha256": "9cf1b889fa9c9bfb3bc5a219a58059a1fbb4ad867e796b6d89a2ca8960724e69", "bytes": 436335 }, "screenshot.png": { "sha256": "ec0109ce98dbf571daf5c08aeff60ae7e9957e2fc907b50f17bd9e196ef0c621", "bytes": 3153430 }, "text.txt": { "sha256": "664a398aae1f5c1df20e43deb46b962fd818b4403c864de8cab55f23c79c193c", "bytes": 36136 } }, "started_utc": "2026-10-22T11:19:28.763Z", "status": 200, "final_url": "https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a314209add798e06b3201c58b75dd001a6daa7a4ff87db80e6ea6f850fd42f97", "bytes": 1917 }, "page.html": { "sha256": "f050c34d2436011467e49cdbc40eb33073ec2f702dfc89de060201e134559a83", "bytes": 428336 }, "provenance.json": { "sha256": "48c3dd6455b47b497867076dddbcbab1bc42a3f52e7df3ca7297a39eef513956", "bytes": 1796 }, "rendered.html": { "sha256": "ed5af89a5a77b0082b72458d20a56ccad03f03e8235e6460165cafa9da9c4faa", "bytes": 426115 }, "screenshot.jpg": { "sha256": "71998cc58d77b7bb204a1d1c83e2585cd195ef802f9d2c1a4ef72de08290ec36", "bytes": 772450 }, "text.txt": { "sha256": "9c8bc44b157ad4c12dd5b38c06b69f4622f866c3ceadfa5fe0eb5d0cb1bb7767", "bytes": 36495 } }, "started_utc": "2026-10-23T16:27:58.043Z", "status": 200, "final_url": "https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog\n\nCaptured by claude-story-site. Status: captured. Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.\n\n- A vendor's round-up, not tested. Records Cloudflare's seven rules per ruleset plus a response-side rule, 03:02 UTC; Akamai 3000991; no AWS managed rule found.\n- 'A response rule cannot undo code that already ran.' 'The WAF only sees what passes through it.'\n- Note: the page's navigation lists model prices, including Anthropic models; irrelevant to the story.\n" }, { "slug": "salzburg24-news-oesterreich-massive-sache-folgen-der-php-sic", "url": "https://www.salzburg24.at/news/oesterreich/massive-sache-folgen-der-php-sicherheitsluecke-fuer-heimische-wirtschaft-noch-unklar-art-342173", "publisher": "salzburg24", "kind": "news", "title": "\"Massive Sache\": Folgen der PHP-Sicherheitslücke für heimische Wirtschaft noch unklar - Salzburg24.at", "published": "2026-10-22T13:23:30+02:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "6430448bafcff3d14b3338abb5a7e0b688efd672d89994532cd0a8a87f1b831c", "bytes": 458 }, "page.html": { "sha256": "98c9bd3cddf8b6da466f829144d927edfb8d2fcd418ed67f70032b634a635b4f", "bytes": 112344 }, "provenance.json": { "sha256": "ba66f55c36702b317066bdcdf72907e8c7ec45aabb5d7026df03f879a0bebc28", "bytes": 1910 }, "rendered.html": { "sha256": "46d378c2461d705290e7367aa3267dbbbc33ebc9ac5ea969430d6697a5d5efd5", "bytes": 119883 }, "screenshot.jpg": { "sha256": "d42f5c02ab3a0d2c4e847c973e018677438181c10a51ff27163b2d60e9c5e577", "bytes": 535431 }, "text.txt": { "sha256": "c08f50a226214f7bc04c16d3d05dce23038cc1a460fa4349860046d0f0a1e74f", "bytes": 6818 } }, "started_utc": "2026-10-22T18:17:29.650Z", "status": 200, "final_url": "https://www.salzburg24.at/news/oesterreich/massive-sache-folgen-der-php-sicherheitsluecke-fuer-heimische-wirtschaft-noch-unklar-art-342173" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in de: Salzburg24 (APA-based) says the damage to the Austrian economy cannot yet be estimated. The Interior Ministry reports no confirmed successful attacks so far; WKÖ's Markus Roth calls it 'a massive thing', VÖSI urges check", "raw_sha256": {}, "has_notes": true, "notes_md": "# \"Massive Sache\": Folgen der PHP-Sicherheitslücke für heimische Wirtschaft noch unklar - Salzburg24.at\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `at/news/salzburg24/news-oesterreich-massive-sache-folgen-der-php-sicherheitslue`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: salzburg24. Language: de. URL: https://www.salzburg24.at/news/oesterreich/massive-sache-folgen-der-php-sicherheitsluecke-fuer-heimische-wirtschaft-noch-unklar-art-342173\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nSalzburg24 (APA-based) says the damage to the Austrian economy cannot yet be estimated. The Interior Ministry reports no confirmed successful attacks so far; WKÖ's Markus Roth calls it 'a massive thing', VÖSI urges checks, and Uni Salzburg and Cineplexx switched off IT services. It also cites Palo Alto Networks' estimate of 22 million exposed servers and Satya Nadella's comments.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/at/news/salzburg24/news-oesterreich-massive-sache-folgen-der-php-sicherheitslue.json`), not the publisher's and not checked word for word by the curator.\n\n**official**: Austrian Interior Ministry spokesman Patrick Maierhofer said there were no concrete reports of successful attacks so far, but attacks were firmly expected.\n\n> \"Konkrete Meldungen über erfolgreiche Angriffe aufgrund der Schwachstellen liegen derzeit noch nicht vor\", sagte Innenministeriumssprecher Patrick Maierhofer am späten Donnerstagvormittag auf APA-Anfrage.\n\n_Watch reader's translation:_ 'There are currently no concrete reports of successful attacks due to the vulnerabilities,' Interior Ministry spokesman Patrick Maierhofer told APA late on Thursday morning.\n\n**offline**: Several Austrian businesses switched off IT services, including the University of Salzburg and cinema chain Cineplexx.\n\n> Wegen des Cyberrisikos schalteten diverse Betriebe ihre IT-Services ab, darunter auch die Uni Salzburg unt Cineplexx.\n\n_Watch reader's translation:_ Because of the cyber risk, various businesses switched off their IT services, including the University of Salzburg and Cineplexx.\n\n**official**: Markus Roth of the Austrian Economic Chamber (WKÖ) called the flaw 'a massive thing' and said financial damage cannot yet be quantified.\n\n> Markus Roth, Obmann der WKÖ-Bundessparte Information und Consulting, stuft die PHP-Sicherheitslücke als \"eine massive Sache\" ein.\n\n_Watch reader's translation:_ Markus Roth, chairman of the WKÖ federal division Information and Consulting, classifies the PHP security vulnerability as 'a massive thing'.\n\n**other**: The Austrian software association VÖSI urged all affected organisations to check PHP versions immediately and assess risks with hosting partners.\n\n> Der Verband Österreichischer Software Innovationen (VÖSI) empfahl in einer Mitteilung \"allen betroffenen Organisationen, ihre eingesetzten PHP-Versionen unverzüglich zu überprüfen, verfügbare Sicherheitsupdates einzuspielen\n\n_Watch reader's translation:_ The Association of Austrian Software Innovations (VÖSI) recommended in a statement 'to all affected organisations to check their PHP versions in use without delay, install available security updates\n\n**number**: Palo Alto Networks estimates more than 22 million vulnerable servers and web applications worldwide.\n\n> Die Cybersicherheitsfirma Palo Alto Networks schätzt die Zahl der weltweit gefährdeten Server und Webanwendungen auf mehr als 22 Millionen.\n\n_Watch reader's translation:_ The cybersecurity firm Palo Alto Networks estimates the number of vulnerable servers and web applications worldwide at more than 22 million.\n\n**official**: Microsoft CEO Satya Nadella, at an event in Cologne, called it a sleepless night for IT managers and a wake-up call.\n\n> Microsoft-Chef Satya Nadella bezeichnete die Lage auf einer Veranstaltung in Köln als schlaflose Nacht für IT-Verantwortliche und sprach von einem Weckruf\n\n_Watch reader's translation:_ Microsoft CEO Satya Nadella described the situation at an event in Cologne as a sleepless night for IT managers and spoke of a wake-up call\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in de: Salzburg24 (APA-based) says the damage to the Austrian economy cannot yet be estimated. The Interior Ministry reports no confirmed successful attacks so far; WKÖ's Markus Roth calls it 'a massive thing', VÖSI urges check\n\nSupports: translations/at/news/salzburg24/news-oesterreich-massive-sache-folgen-der-php-sicherheitslue.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "sankei-dmm-service-halt", "url": "https://www.sankei.com/article/20261022-ARAQ7L3PNVFVLMMEJUZW4LJ4A4/", "publisher": "産経ニュース", "kind": "news", "title": "エンタメサイトDMMがサービス停止、外部システムの脆弱性への対応　「情報漏洩は無し」 - 産経ニュース", "published": "2026-10-22T11:11+09:00 (as stated on the page)", "captures": [ { "stamp": "20261022T191536Z", "files": { "headers.json": { "sha256": "fa65e324a3b7cf7c1196a64c9fd86793a9917fed803cb87912c7989f3d1b642a", "bytes": 1835 }, "page.html": { "sha256": "9a5b021f7f274c1239b30a485f69d7cb47c8927c5282b90674b0b53df0a9d521", "bytes": 214258 }, "provenance.json": { "sha256": "4704131fdfdbc8c60e3335bfd3137a614a4230409e82de18c060c74c538c3664", "bytes": 1671 }, "rendered.html": { "sha256": "a1873be5089d2750c1332f457f1981689089867c7ec13aa53a9fd51505b2cff6", "bytes": 380702 }, "screenshot.jpg": { "sha256": "571e296c44ad89cc5f1581a63007d9b169a0b5556ce6633166924deb243cca71", "bytes": 91325 }, "text.txt": { "sha256": "8baf5de68d8527ed2167041c1b91cafb575afa7165abb55cab5566fcd9e2d610", "bytes": 5432 } }, "started_utc": "2026-10-22T19:15:36.507Z", "status": 200, "final_url": "https://www.sankei.com/article/20261022-ARAQ7L3PNVFVLMMEJUZW4LJ4A4/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191536Z. DMM halted services for an \"external software vulnerability\", would not confirm PHP", "raw_sha256": {}, "has_notes": true, "notes_md": "# エンタメサイトDMMがサービス停止、外部システムの脆弱性への対応　「情報漏洩は無し」 - 産経ニュース\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `jp/news/sankei/dmm-service-halt`, snapshot `20261022T191536Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191536Z/provenance.json`. Publisher: 産経ニュース. Language: ja. URL: https://www.sankei.com/article/20261022-ARAQ7L3PNVFVLMMEJUZW4LJ4A4/\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSankei reports that DMM.com's entertainment site DMM announced temporary maintenance across its services on 21 October to respond to a vulnerability found in external software it uses, and that no leak of users' personal data occurred. Services were stopped in turn from 22:00 on 21 October; at 10:00 on 22 October some were still in maintenance. Asked by Sankei, DMM said it \"cannot say more than the announcement\" and did not say whether this related to the PHP problem.\n\n> 同社は産経新聞の取材に、「発表文以上のことは言えない」と話し、21日にシステムの重大な欠陥に当たる脆弱性が見つかったプログラミング言語「PHP」を巡る問題との関連については明らかにしなかった。\n\n_Curator's translation:_ Asked by the Sankei Shimbun, the company said it \"cannot say more than the announcement\" and did not clarify any connection with the problem around the programming language PHP, in which a serious vulnerability was found on the 21st.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): DMM halted services for an \"external software vulnerability\", would not confirm PHP\n\nSupports: contradictions/compromise-dmm.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "sankei-pressrelease-prtimes-ec2547367bpozjzxed6", "url": "https://www.sankei.com/pressrelease/prtimes/EC2547367BPOZJZXED6ZX7VWCI/", "publisher": "産経ニュース", "kind": "news", "title": "PHP重大脆弱性「PHP2Shell」に対応。ALION、他社開発のWordPress・PHPシステムを10万円からスポット支援 - 産経ニュース", "published": "2026-10-22T08:00:00+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "774ba05a2aaa9b3b1c26da9f77c6a85c48c2a84ac7542614b07d185f2d394d62", "bytes": 1588 }, "page.html": { "sha256": "f243a79bc2fa8719394ce256aa0f19ad9d4cf848ac744b451637ca79e76ee02e", "bytes": 338720 }, "provenance.json": { "sha256": "63d5f113e33e149c031cad2adf6c30bc1cd11d934e38bd1f3f785ed9ad524425", "bytes": 1688 }, "rendered.html": { "sha256": "bfe2559b46b5416eb8bd87fa0f9b2a803f8f7e3e50b49f46e69d48a44e0eb375", "bytes": 536532 }, "text.txt": { "sha256": "e841af46452e1e1c12b7892cfddca5585fb2dd56674ec0bedd582ac2d6aea9b5", "bytes": 13918 } }, "started_utc": "2026-10-23T16:19:58.590Z", "status": 200, "final_url": "https://www.sankei.com/pressrelease/prtimes/EC2547367BPOZJZXED6ZX7VWCI/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Sankei News (Japanese), 22 October, a PR TIMES press release by ALION Inc. launching an 'urgent PHP security fix support service' from ¥100,000 per ca...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP重大脆弱性「PHP2Shell」に対応。ALION、他社開発のWordPress・PHPシステムを10万円からスポット支援 - 産経ニュース\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/sankei/pressrelease-prtimes-ec2547367bpozjzxed6zx7vwci`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSankei News (Japanese), 22 October, a PR TIMES press release by ALION Inc. launching an 'urgent PHP security fix support service' from ¥100,000 per case for companies whose WordPress or PHP systems were built by others (no maintenance contract, unknown PHP version, developer unreachable). The release recaps the two CVEs (9.2), the fixed versions, that WordPress and plugin updates are not enough, and that distributions and hosts may apply fixes to their own packages, so the version number alone should not be trusted; PHP 8.1 and earlier need a vendor fix or a move to a supported version. Promotional; it adds no new facts.\n\n> バージョン番号だけで判断せず、利用環境と提供元の案内を確認することが重要です。\n\n_Curator's translation:_ \"It is important not to judge by the version number alone but to check one's environment and the provider's notices.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Press release (via Sankei) from ALION Co. offering emergency PHP2Shell fixes for third-party WordPress/PHP systems from JPY 100,000. A sidebar headline says entertainment site DMM suspended service to deal with an 'external system vulnerability', with no data leak.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP重大脆弱性「PHP2Shell」に対応。ALION、他社開発のWordPress・PHPシステムを10万円からスポット支援 - 産経ニュース\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "sansec-research-php2shell", "url": "https://sansec.io/research/php2shell", "publisher": "Sansec", "kind": "researcher", "title": "PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansec", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113104Z", "files": { "headers.json": { "sha256": "2dfd5ab190184ed3ba6295db2882e7dce9719d6048f860a68a011034c1e1e26e", "bytes": 1167 }, "page.html": { "sha256": "60368be8e17445397b0865e1a7c8a7142cd888ffd81aac0b11d7d0644dbaab1d", "bytes": 36814 }, "provenance.json": { "sha256": "7443427160ac153a29c5b8c8c5278458e0b6c1eb5bc1bb1597d25757d01836bb", "bytes": 978 }, "rendered.html": { "sha256": "31f57c6c03a271c045e195256e2d406614c505ca3c3d07ce40c299983be0cc0a", "bytes": 37783 }, "screenshot.png": { "sha256": "21518bc8c146169d1d397668488e88840c646c1286340aa20808740f0538eed8", "bytes": 1506901 }, "text.txt": { "sha256": "281e3c508909a7002ae17602fd885f6acbd78e3766d8de3153f1139c7be8d134", "bytes": 9554 } }, "started_utc": "2026-10-22T11:31:04.850Z", "status": 200, "final_url": "https://sansec.io/research/php2shell" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "08e45c06d2d5b4dcc02bb11b1ce1b21e663992ce40c20d74d0b89ae2ae32fc97", "bytes": 1228 }, "page.html": { "sha256": "0464d92757acaa440ff1a843c8b17488b8c4d11c76829960603d05df17be5c00", "bytes": 36616 }, "provenance.json": { "sha256": "dfff01421f95d98b2c7ecc72a48a9df8580284f8e24d0b9541c9103220f34cb2", "bytes": 1534 }, "text.txt": { "sha256": "17011ff26544f8a95f05ff13b9ec30ee2bd69f22541ee7ac87635385f42b85dd", "bytes": 9778 } }, "started_utc": "2026-10-23T16:23:31.469Z", "status": 200, "final_url": "https://sansec.io/research/php2shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor advisory predicting mass exploitation within 15 minutes of release; no IOCs; later accused in a reader comment of leaking a vector in page metadata (unverified).", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansec\n\nCaptured by claude-story-site. Status: captured. Vendor advisory predicting mass exploitation within 15 minutes of release; no IOCs; later accused in a reader comment of leaking a vector in page metadata (unverified).\n\n- Captured for the prediction and the record.\n" }, { "slug": "sbbit-article-cont1-187672", "url": "https://www.sbbit.jp/article/cont1/187672", "publisher": "ビジネス+IT", "kind": "news", "title": "【高市総理も注意喚起】インターネット崩壊危機？PHP重大脆弱性でWebサイト緊急停止 世界のWebサイトの約7割で利用、国内サービスも緊急メンテナンス｜ビジネス+IT", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f30b7a27f49d8a5f8bfdf6baa250798cb15be5dd117340a4f097103301d5231b", "bytes": 1257 }, "page.html": { "sha256": "9c2842405004e466c56b866ab9d7a46d903cd1413b5ac055bff160678e0906d5", "bytes": 149888 }, "provenance.json": { "sha256": "4988df9bada2e84740bcd8d5942be8f7f522754c0127f35bbfc6f919c89dbcf6", "bytes": 1709 }, "rendered.html": { "sha256": "9634c86a375d1297a2cf064ccc2d1a36fbf9ada78dd80d434a156306663cdb8f", "bytes": 161313 }, "screenshot.jpg": { "sha256": "ceb2ff6b38f919f52916cd6bda3ee608d5c30eedc7334b2bc42c07567304ef37", "bytes": 618633 }, "text.txt": { "sha256": "1b6ba4d359d3f171c6be690d6aad208167406ffa8da475b9c252c1a1d510b5ba", "bytes": 12705 } }, "started_utc": "2026-10-23T16:20:02.939Z", "status": 200, "final_url": "https://www.sbbit.jp/article/cont1/187672" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Business+IT (Japanese), a feature on the PHP flaws with the PM's alert in its headline; the capture holds the free part, the rest is behind a registra...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 【高市総理も注意喚起】インターネット崩壊危機？PHP重大脆弱性でWebサイト緊急停止 世界のWebサイトの約7割で利用、国内サービスも緊急メンテナンス｜ビジネス+IT\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/sbbit/article-cont1-187672`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBusiness+IT (Japanese), a feature on the PHP flaws with the PM's alert in its headline; the capture holds the free part, the rest is behind a registration wall. It says one trigger was a post to Hacker News ahead of the planned disclosure, rates 9.2 on CVSS 4.0, describes the two memory-management flaws, notes that mod_php has a demonstrated path from an unauthenticated request before application code runs while other set-ups need other conditions, and gives W3Techs (October 2026) figures: PHP on 69.3% of sites whose server-side language is known; PHP 8 65.2%, 7 27.0%, 5 7.7% of those, so at least about 35% are on end-of-life lines. In Japan from the afternoon of 21 October BASE, Kodomon, pixiv, Niconico, game companies and Sakura Internet suspended all or part of their services; BASE and Kodomon named the PHP flaw; the Ministry of Finance paused related web content.\n\n> 日本国内では21日午後から、BASE、コドモン、pixiv、ニコニコ、ゲーム各社、さくらインターネットなどがサービスの全部または一部を停止し、緊急メンテナンスに入った。\n\n_Curator's translation:_ \"In Japan, from the afternoon of the 21st, BASE, Kodomon, pixiv, Niconico, game companies, Sakura Internet and others suspended all or part of their services and went into emergency maintenance.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Business+IT (SB Creative): in Japan, from the afternoon of 21 Oct, BASE, Codmon, pixiv, Niconico, game firms and Sakura Internet stopped all or part of their services. The Ministry of Finance suspended web content. PM Takaichi made an unusual appeal. W3Techs October data: PHP used by 69.3% of sites; versions 8.x 65.2%, 7.x 27.0%, 5.x 7.7%.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"【高市総理も注意喚起】インターネット崩壊危機？PHP重大脆弱性でWebサイト緊急停止 世界のWebサイトの約7割で利用、国内サービスも緊急メンテナンス｜ビジネス+IT\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "scherzer-dev-wikipedia-ref-15-blog-20261022-php2shell", "url": "https://scherzer.dev/Blog/20261022-php2shell-timeline", "publisher": "scherzer.dev", "kind": "news", "title": "Blog: PHP2Shell: a Timeline", "published": "2026-10-22", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "df672020539aff4161e5fa395ad7356be37b6291ca4c15998360123c4afbe5ab", "bytes": 306 }, "page.html": { "sha256": "5faf1793608886a1a169ea16b95d497aac7de2306a41c12606f41020070b4fee", "bytes": 24467 }, "provenance.json": { "sha256": "b123be8972cc2ab5076749eb5602d1783bb0a7db8a1e72762977a84b0d96df91", "bytes": 1649 }, "rendered.html": { "sha256": "f204f70da72668f2c7ba06e5151e5fa31bb3e171c7e34a9ffa5b50536558abf7", "bytes": 24408 }, "screenshot.jpg": { "sha256": "dc89167758e71b8ebe3b395bdaa27b1adf95330bfaa5f22ac4f48a9e8cc334ed", "bytes": 494679 }, "text.txt": { "sha256": "ddee9f1e0bb292593c2674f5c54c40a85174c075d2ec55017124b0b23519a5f3", "bytes": 8835 } }, "started_utc": "2026-10-25T11:46:20.633Z", "status": 200, "final_url": "https://scherzer.dev/Blog/20261022-php2shell-timeline" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Daniel Scherzer's blog (English), 22 October: 'PHP2Shell: a Timeline'. The author is a PHP release manager (for 8.5) who says he was privy to internal...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Blog: PHP2Shell: a Timeline\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `int/community/scherzer-dev/wikipedia-ref-15-blog-20261022-php2shell-timeline`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nDaniel Scherzer's blog (English), 22 October: 'PHP2Shell: a Timeline'. The author is a PHP release manager (for 8.5) who says he was privy to internal discussions and lists only events and times verifiable from public information, mostly git history, GitHub logs and PHP Foundation posts, without judgement. Discovery: a 2024 security-audit tag in php-src (Quarkslab audit); a PHP developer in 2024 found the first signs of the out-of-memory problem; the PHP Foundation formed an Ecosystem Security Team on 18 May 2026; Calif began auditing PHP on 30 July under Patch the Planet, started finding code paths on 1 August, and on 11 August reported an unconditional remote code execution with the same cause as the 2024 finding, followed by reports from other organisations. Release: tags and tarballs for 8.2.35, 8.3.36, 8.4.27 and 8.5.12 were made on Monday 19 October (07:30 to 17:19 UTC) but not published; the release was due Thursday 22 October 14:00 UTC; about 15:00 UTC on Tuesday 20 October online discussion of the CVE IDs, with some wrong details, led to it being moved to Wednesday 21 October, same time; a pre-announcement was posted at 19:25 and 19:33 UTC; about 20:00 Calif published a proof-of-concept video, later deleted but copied (a copy was online at 20:27). On 21 October Chainguard published patched PHP before release (07:41 UTC per the PHP Foundation; Hacker News reports say builds were available from 06:07); the fixes were published between 13:31 and 13:35 UTC, with source-only backports for 7.4, 8.0 and 8.1. Fixes had been shared under embargo with several vendors beforehand.\n\n> The coordinated releases were originally scheduled for 14:00 UTC on Thursday, October 22\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Blog: PHP2Shell: a Timeline\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "schieb-php2shell-sicherheitsluecke-so-schuetzt", "url": "https://www.schieb.de/php2shell-sicherheitsluecke-so-schuetzt-ihr-eure-webanwendungen", "publisher": "schieb.de", "kind": "news", "title": "PHP2Shell-Sicherheitslücke: So schützt ihr eure Webanwendungen", "published": "2026-10-25", "captures": [ { "stamp": "20261026T094033Z", "files": { "headers.json": { "sha256": "f36f38b29278645aaa45baa5ed4f3727e3829bbd5a1448af780d924f59465bdd", "bytes": 737 }, "page.html": { "sha256": "037b0f7fd27aefb1f1fa645b10f6a614e9ab9d75977f146d6add52ea7b9f9f0d", "bytes": 318990 }, "provenance.json": { "sha256": "5fa0c8bd84e9f964c4de87b23da5cd78bd19b911c02a4464ceec56c1b0bc791e", "bytes": 1741 }, "rendered.html": { "sha256": "698e7f7305754e4492511de84f3874c4e2bfa595e8f8705f2d14f485f87c3b5a", "bytes": 320591 }, "screenshot.jpg": { "sha256": "3961ba1020209e1b26e2634f43f83bea3f5e17b28fab3e3c4a3d223d2e104c72", "bytes": 516479 }, "text.txt": { "sha256": "19c3451138492c8a1061d73dbd093c8709a5dcde94065b2c8a61904b9ed85a48", "bytes": 7107 } }, "started_utc": "2026-10-26T09:47:37.346Z", "status": 200, "final_url": "https://www.schieb.de/php2shell-sicherheitsluecke-so-schuetzt-ihr-eure-webanwendungen" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T094033Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). schieb.de (German), 25 October, by Jörg Schieb: a guide for site operators to check, patch and document. It says the German BSI has issued an updated...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell-Sicherheitslücke: So schützt ihr eure Webanwendungen\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/schieb/php2shell-sicherheitsluecke-so-schuetzt-ihr-eure-webanwendun`, snapshot `20261026T094033Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T094033Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nschieb.de (German), 25 October, by Jörg Schieb: a guide for site operators to check, patch and document. It says the German BSI has issued an updated cyber-security warning on critical PHP vulnerabilities and sends readers to it for CVE numbers, affected versions and patch levels. The remainder is generic advice on why unmaintained shared hosting, old CMS instances and forgotten project servers are favourite targets for automated scans.\n\n> Das Bundesamt für Sicherheit in der Informationstechnik (BSI) hat eine aktualisierte Cybersicherheitswarnung zu kritischen Schwachstellen in PHP herausgegeben.\n\n_Curator's translation:_ \"The Federal Office for Information Security (BSI) has issued an updated cyber-security warning on critical vulnerabilities in PHP.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell-Sicherheitslücke: So schützt ihr eure Webanwendungen\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "scotsman-edinburgh-council", "url": "https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652", "publisher": "scotsman.com", "kind": "news", "title": "Edinburgh council website offline amid global cyber security alert", "published": null, "captures": [ { "stamp": "20261022T081043Z", "files": { "headers.json": { "sha256": "5611f99e1d303b8595b1fb461712ec67fcf267031ac6236b0c9132ed03f58115", "bytes": 1606 }, "page.html": { "sha256": "85fe7278d49241428ba4260ba45ef05404b05a13506d4fd2f84ff3002f15edc3", "bytes": 262891 }, "provenance.json": { "sha256": "f5286c2605672538c7198984bab2fe42a0c6eaeaddb14ec027f66d04d8d19c7d", "bytes": 1110 }, "rendered.html": { "sha256": "c0b3ace7431c2f7a00313b57ca3b4f7e65b274431ac45fd1653c2281e8368546", "bytes": 545168 }, "screenshot.png": { "sha256": "d762e99ddb102895bafd39a1da11a34a4d00e0a6d3be8d8106a67a3ef473f1a3", "bytes": 1619065 }, "text.txt": { "sha256": "3598df2ac437acced78bcb4e6e3d00d9fefacec158ff9f8fcc2cbcb24f41d702", "bytes": 6887 } }, "started_utc": "2026-10-22T08:10:43.550Z", "status": 200, "final_url": "https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "scotsman-edinburgh-council-offline", "url": "https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652", "publisher": "The Scotsman (Jack Davies)", "kind": "news", "title": "Edinburgh council website offline amid global cyber security alert", "published": "2026-10-21T18:09+01:00", "captures": [ { "stamp": "20261022T112150Z", "files": { "headers.json": { "sha256": "1c3f67fd980359a0bfbaa40d100d35aea3cac3074d6b29d0a1753b16584a605a", "bytes": 1536 }, "page.html": { "sha256": "90aaacae5232524ded421df348d5573c267ac8e950c4e48628bd8ed586c6aedd", "bytes": 262633 }, "provenance.json": { "sha256": "25e30a911da3a7887aafc5080201b7d8bc5dc8508f1d3a7a2545b1c4d5963ee7", "bytes": 1118 }, "rendered.html": { "sha256": "e02581dcf2ba49c3963ed48490b34c813b9558ff27991256fc0f50231be75ac2", "bytes": 712640 }, "screenshot.png": { "sha256": "bb1c80d6965bbdc9c3143e0ff88f84de54ca8c9af02419c854993868a6452a05", "bytes": 2399966 }, "text.txt": { "sha256": "fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6", "bytes": 8754 } }, "started_utc": "2026-10-22T11:21:50.230Z", "status": 200, "final_url": "https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Edinburgh council site offline late Wednesday afternoon; spokesperson: 'essential maintenance', 'waiting on an update from our provider'; link not confirmed.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Edinburgh council website offline amid global cyber security alert\n\nCaptured by claude-story-site. Status: captured. Edinburgh council site offline late Wednesday afternoon; spokesperson: 'essential maintenance', 'waiting on an update from our provider'; link not confirmed.\n\n- Published 21 Oct 2026 18:09 BST. The council 'yet to confirm whether it is linked to the cyber security alert'.\n" }, { "slug": "security-nl-kamervragen", "url": "https://www.security.nl/posting/958558/Kamervragen+over+offline+halen+van+overheidswebsites+wegens+PHP2Shell", "publisher": "Security.NL", "kind": "news", "title": "Kamervragen over offline halen van overheidswebsites wegens PHP2Shell - Security.NL", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "4d107d3dd5173a9c9d151632ca49ecdd8b9e07da296ed9e66654a32e564ba3c0", "bytes": 702 }, "page.html": { "sha256": "51174f6f099c2dd54eebb00885496dccc70e52fe65131aba42243838ada22887", "bytes": 129717 }, "provenance.json": { "sha256": "3fad892523646e88d17ddc1dea9c70fc4e1a2bdeedf65f00b1dce8050ec463c5", "bytes": 1709 }, "rendered.html": { "sha256": "e81c7d4fbde3e05d6194610f42b9d9788585cca1b48ee5979f24c3047e2a7d92", "bytes": 128856 }, "screenshot.jpg": { "sha256": "1786f1bdd2b07ed1b6dbc345c5ca95b0f937c90726a069b0871ac879c19bd641", "bytes": 929859 }, "text.txt": { "sha256": "d18184822cdd69f9eb08811366a5bda90e62a1ee40360b9392836db3b92c43e7", "bytes": 60715 } }, "started_utc": "2026-10-23T16:23:40.584Z", "status": 200, "final_url": "https://www.security.nl/posting/958558/Kamervragen+over+offline+halen+van+overheidswebsites+wegens+PHP2Shell" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Security.NL (Dutch): members of the Tweede Kamer asked Justice and Security minister van Weel questions about taking government websites offline over...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Kamervragen over offline halen van overheidswebsites wegens PHP2Shell - Security.NL\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/tech-press/security-nl/kamervragen`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSecurity.NL (Dutch): members of the Tweede Kamer asked Justice and Security minister van Weel questions about taking government websites offline over the PHP2Shell flaw. The day before, DigiD, MijnOverheid, Overheid.nl and TweedeKamer.nl went offline because of the PHP vulnerabilities, after information leaked early. The capture is about 60,000 characters because it includes the site's reader comments, which are untrusted, anonymous opinions and were not used.\n\n> In de Tweede Kamer zijn vragen gesteld aan minister van Weel van Justitie en Veiligheid over het offline halen van overheidssites vanwege het PHP2Shell-lek.\n\n_Curator's translation:_ \"In the House of Representatives, questions have been put to Minister van Weel of Justice and Security about taking government sites offline because of the PHP2Shell leak.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Kamervragen over offline halen van overheidswebsites wegens PHP2Shell - Security.NL\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "security-nl-palo-alto-firewalls", "url": "https://www.security.nl/posting/958521/Firewalls+Palo+Alto+Networks+kwetsbaar+voor+PHP2Shell%2C+Cisco+en+Fortinet+onderzoeken", "publisher": "Security.NL", "kind": "news", "title": "Firewalls Palo Alto Networks kwetsbaar voor PHP2Shell, Cisco en Fortinet onderzoeken - Security.NL", "published": "2026-10-22 10:58 (page time zone not stated)", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "43988a829f31e0d0bd95fa6223118a5e7f52a37369e6f59b31a07e79c3bf8655", "bytes": 701 }, "page.html": { "sha256": "b7939d500ad70bbb5a1acb2d74a862caef3c386ff1c7484d92a1e12331a98058", "bytes": 39558 }, "provenance.json": { "sha256": "d00bc2b4ef63bdd52aa4fe414c094233f5cfc4e28d319d8de0db1ee0c97ffff3", "bytes": 1781 }, "rendered.html": { "sha256": "70502fa5dc7792f6f2850230995e14542d73db6fb8b72cb110641c2f72c4039c", "bytes": 39419 }, "screenshot.jpg": { "sha256": "deda6bac5da661ead8255c00cc8e6c2eeb2b7bf7b3c22c17358303a7381827a0", "bytes": 299043 }, "text.txt": { "sha256": "b12e1921474a42f9ab74fda110f590d82e18b207801fc2ecc10fd7c30c256e0f", "bytes": 6143 } }, "started_utc": "2026-10-23T16:23:41.218Z", "status": 200, "final_url": "https://www.security.nl/posting/958521/Firewalls+Palo+Alto+Networks+kwetsbaar+voor+PHP2Shell%2C+Cisco+en+Fortinet+onderzoeken" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Security.NL (Dutch), 22 October: Palo Alto Networks says its PAN-OS, the operating system of its firewalls, is vulnerable to the PHP2Shell flaws in ve...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Firewalls Palo Alto Networks kwetsbaar voor PHP2Shell, Cisco en Fortinet onderzoeken - Security.NL\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/tech-press/security-nl/palo-alto-firewalls`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSecurity.NL (Dutch), 22 October: Palo Alto Networks says its PAN-OS, the operating system of its firewalls, is vulnerable to the PHP2Shell flaws in versions 10.2, 11.1, 11.2, 12.1 and 12.2; it is working on updates with no date, and customers are most at risk if the firewall's management interface is reachable from the internet, so it advises restricting that access. Fortinet says it is still checking its products and has found some not affected; Cisco says its investigation is ongoing and has found Cisco AI Defense and Cisco Umbrella not at risk.\n\n> In een beveiligingsbulletin meldt Palo Alto Networks dat de kwetsbaarheden aanwezig zijn in PAN-OS, het besturingssysteem dat op de firewalls van het bedrijf draait.\n\n_Curator's translation:_ \"In a security bulletin, Palo Alto Networks says the vulnerabilities are present in PAN-OS, the operating system that runs on the company's firewalls.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Firewalls Palo Alto Networks kwetsbaar voor PHP2Shell, Cisco en Fortinet onderzoeken - Security.NL\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "security-nl-qnap-nas-offline", "url": "https://www.security.nl/posting/958512/QNAP+adviseert+offline+halen+NAS-systemen+wegens+PHP2Shell", "publisher": "Security.NL", "kind": "news", "title": "QNAP adviseert offline halen NAS-systemen wegens PHP2Shell - Security.NL", "published": "2026-10-22 10:14 (page time zone not stated; the capture's 'last updated' stamp reads 'yesterday, 13:26')", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "3836c557b4383e09f401eea5309562864ba592f256c5ea9a2b134dd133f1c5df", "bytes": 701 }, "page.html": { "sha256": "377e1e671f7c9e2ade88ec81e9f703af4a14ee23fc92d42841ef1c1b8f901dab", "bytes": 58347 }, "provenance.json": { "sha256": "20e72fcfa72450adab3e9ac812f7ad660bdc406b84d3eaf825a506d2a14ebd39", "bytes": 1691 }, "rendered.html": { "sha256": "3084dbb6b62aa99ffd73e612981b4e397cab6101be5d2fe3295563b9656cf7bf", "bytes": 58098 }, "screenshot.jpg": { "sha256": "e7a9d2a73383156caaf88db9d9b98d0ca3e05c4371b61bc2740a037d12a35366", "bytes": 652301 }, "text.txt": { "sha256": "5c047c35457e413b8690a77634d2b2b4ab8899a42d4c54c1f710bd2eecf5cef7", "bytes": 14179 } }, "started_utc": "2026-10-23T16:23:41.289Z", "status": 200, "final_url": "https://www.security.nl/posting/958512/QNAP+adviseert+offline+halen+NAS-systemen+wegens+PHP2Shell" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Security.NL (Dutch), 22 October, updated: QNAP warns that its NAS software (QTS, QuTS hero, QuTScloud, Note Station, QNE, QVR Surveillance, TVR OS) co...", "raw_sha256": {}, "has_notes": true, "notes_md": "# QNAP adviseert offline halen NAS-systemen wegens PHP2Shell - Security.NL\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/tech-press/security-nl/qnap-nas-offline`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSecurity.NL (Dutch), 22 October, updated: QNAP warns that its NAS software (QTS, QuTS hero, QuTScloud, Note Station, QNE, QVR Surveillance, TVR OS) contains the PHP2Shell flaws, rates the impact critical, is working on updates with no date and advises taking the devices off the internet (switch off port forwarding, UPnP, myQNAPcloud Link and the built-in web server; use a VPN if remote access is needed). An update says QNAP's own PSIRT has observed scanning and exploitation attempts using the flaws and is monitoring them closely. It corroborates qnap-products-affected and qnap-attempts-in-wild, already held.\n\n> QNAP waarschuwt eigenaren van de NAS-systemen die het levert dat de PHP2Shell-lekken ook daarin aanwezig zijn en adviseert om de apparaten voorlopig offline te halen.\n\n_Curator's translation:_ \"QNAP warns owners of the NAS systems it supplies that the PHP2Shell flaws are present in them too and advises taking the devices offline for the time being.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"QNAP adviseert offline halen NAS-systemen wegens PHP2Shell - Security.NL\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `nl`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "securityaffairs-201662-hacking-pierluigi-paganini-answer", "url": "https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html", "publisher": "Security Affairs", "kind": "news", "title": "Pierluigi Paganini answers questions about the PHP2Shell flaws", "published": "2026-10-24T18:58:38+00:00", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "0972fb957930d8bc89841ab7dfd5cdb707e82f6915df1c628325e547af45cb88", "bytes": 1271 }, "page.html": { "sha256": "bc6a336b46da76735321b216c1ee1d4420ed78fbedfecd3766daa9248710f280", "bytes": 118112 }, "provenance.json": { "sha256": "9883a90a228e8dd72d00ae82f9a49d12148ba4ded84af834284981fd03c0256d", "bytes": 1817 }, "rendered.html": { "sha256": "6147b596bfa7cf408aa117d01f97c896be15c439d7b5d529729afa0b3c3bdea9", "bytes": 119912 }, "screenshot.jpg": { "sha256": "ea10f7c681e0d1c3e47de4b915ed3dc9c7d61a7bf8d81e3b880be44b765cf113", "bytes": 125354 }, "text.txt": { "sha256": "f9efb87ab0fdf675c849f17b9818a935cc473331439fd53942ec7854cd6ca6ad", "bytes": 9786 } }, "started_utc": "2026-10-25T09:47:34.027Z", "status": 200, "final_url": "https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Security Affairs, 24 October: Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks and the...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Pierluigi Paganini answers questions about the PHP2Shell flaws\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ie/news/securityaffairs/201662-hacking-pierluigi-paganini-answers-questions-about-th`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSecurity Affairs, 24 October: Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks and the risks to businesses, servers and personal data. The page's related-headline list includes 'PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches' and 'PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet'. A question-and-answer interview.\n\n> Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Pierluigi Paganini answers questions about the PHP2Shell flaws\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "securitynl-misbruik-gemeld", "url": "https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online", "publisher": "Security.NL", "kind": "news", "title": "Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online - Security.NL", "published": null, "captures": [ { "stamp": "20261022T191411Z", "files": { "headers.json": { "sha256": "c37024d430f2b3fa5c95ea5683e5940449e88b7fd413a8b988d5b319ec8994cc", "bytes": 702 }, "page.html": { "sha256": "cd6e2c2562a334ee538a1077307216c177a9519ccade2c2d0a9d40f148343ee7", "bytes": 74522 }, "provenance.json": { "sha256": "f78382e73afa9d49b87094527fd7370934f9a39f7e1272487b9d005ddc94f61d", "bytes": 1719 }, "rendered.html": { "sha256": "5e59252be35ff9eaeb2d499c3533191bc9cdde4e6e5e5afcfc01a5578845d3b4", "bytes": 74281 }, "screenshot.jpg": { "sha256": "d5216b9d695d581b8a409a63a898b4f230cb56b9ba77ec1347bb252de5ffd0c2", "bytes": 947395 }, "text.txt": { "sha256": "95d1565c5959e61fa188ea5af37ef0518b3c171d442554cbee86484dd03ddd09", "bytes": 22446 } }, "started_utc": "2026-10-22T19:14:11.502Z", "status": 200, "final_url": "https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191411Z. \"Abuse reported\" headline that is attempts in the body; Previdian: attackers failed to execute PHP", "raw_sha256": {}, "has_notes": true, "notes_md": "# Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online - Security.NL\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `nl/tech-press/security-nl/misbruik-gemeld`, snapshot `20261022T191411Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191411Z/provenance.json`. Publisher: Security.NL. Language: nl. URL: https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSecurity.NL's headline is \"Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online\" (abuse of the PHP2Shell flaw reported; DigiD and other sites back online). The body reports attack attempts, not confirmed compromises: Cloudflare saw attack traffic against customers, Hadrian speaks of large-scale exploitation, Patchstack reports active attack attempts and watchTowr warns of exploitation in the wild; whether the attacks succeeded is unclear, and Previdian says attackers in the attacks it observed did not manage to execute PHP or upload files. DigiD, Overheid.nl, MijnOverheid, TweedeKamer.nl and the Belastingdienst were unreachable for a time; most are back. A Dutch police statement says sites were taken offline as a precaution and that politie.nl stayed up. Reader comments (pseudonymous) follow, one pointing to posts on X claiming some PHP patches are insufficient.\n\n> Of de aanvallen ook succesvol zijn is onduidelijk. Cybersecuritybedrijf Previdian stelt dat bij de waargenomen aanvallen het de aanvallers niet lukte om PHP uit te voeren of bestanden te uploaden.\n\n_Curator's translation:_ Whether the attacks were also successful is unclear. Cybersecurity company Previdian states that in the attacks it observed, the attackers did not manage to execute PHP or upload files.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): \"Abuse reported\" headline that is attempts in the body; Previdian: attackers failed to execute PHP\n\nSupports: contradictions/exploitation-germany-netherlands.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "securityweek-exploitation-days-before", "url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "publisher": "SecurityWeek", "kind": "news", "title": "PHP2Shell Exploitation Started Days Before Patches - SecurityWeek", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112314Z", "files": { "headers.json": { "sha256": "20346ce7a28ae2cea09c5ce445b478a4fe9837f2cc4cf97d5ae15a6bcd846d48", "bytes": 1083 }, "page.html": { "sha256": "d00e2e5608d37d978b2fa983ffa1087430976a445caa72df9a49b7618dbe9566", "bytes": 168865 }, "provenance.json": { "sha256": "99114af56492dfd4921ca1b095bf85f256188ccd6d6e17fdaadd7657d629d83b", "bytes": 1072 }, "rendered.html": { "sha256": "e493b8fc733dacfc40164c4bb153884e96b82e984e2e3c738c13c536a5edce73", "bytes": 259915 }, "screenshot.png": { "sha256": "e5454077149da3ca0ea83a39c68e30ce9f6f984788c53349e104a0d45dea3fb9", "bytes": 2097665 }, "text.txt": { "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "bytes": 13376 } }, "started_utc": "2026-10-22T11:23:14.866Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/" }, { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "b01a0edd023e17c2f04a4913c33e56ac238c88c8e9485fb7626d944108450f84", "bytes": 1154 }, "page.html": { "sha256": "f647ac130d515c7b5c236e72825fe19525346633a458f5418dd0c7f086b1f105", "bytes": 168791 }, "provenance.json": { "sha256": "9c39d001855e1787e2c3cca3b9f32ebd1eb7ed763fd137f8650e9e3a183e0d98", "bytes": 1755 }, "rendered.html": { "sha256": "dba965e893cc4ff6b487e9ba323d2d44187ec4dec5f54b7a12701b556e6c1f06", "bytes": 168220 }, "screenshot.jpg": { "sha256": "9377de12373bc83afe1223d09bfd971c7e094cedf8d6ed2d183c3454b734a04e", "bytes": 745141 }, "text.txt": { "sha256": "b922b47f8fab0fa86af000c740795a67ad78d0d4cdc6a57a316408988acb5835", "bytes": 12604 } }, "started_utc": "2026-10-23T01:38:36.326Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "a3950340c23973d8fa713fde8e45b57fdad16597cd3e4c15caffce4ed9ac2c89", "bytes": 1348 }, "page.html": { "sha256": "a33eb3fa95d02d124aadccb41bd5593400b53f0c220a6fefc3fed3cee5883808", "bytes": 168695 }, "provenance.json": { "sha256": "88e631a105418e1339c970fd9cfc8fad0b897c58aa97535350ffaad3d1117d15", "bytes": 1695 }, "text.txt": { "sha256": "9dfbfafa6b4a57d429b41f22ff482aa77766cf6bea32505f0edd54168adb4435", "bytes": 13264 } }, "started_utc": "2026-10-23T23:43:44.154Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Exploitation Started Days Before Patches - SecurityWeek\n\nCaptured by claude-story-site. Status: captured. Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.\n\n- The Censys and VirusTotal figures come through this page; Censys's own post was not found.\n" }, { "slug": "securityweek-first-attempts-sensors", "url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/", "publisher": "SecurityWeek", "kind": "news", "title": "PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112324Z", "files": { "headers.json": { "sha256": "dd993a8f1006a3a64fb1decac73db56de8468b6aa2d213379f7b8925a27f83af", "bytes": 1083 }, "page.html": { "sha256": "6d603d0aa60802788b1f163a27b575df0c62e1bb903bca9e6a3c98133e5d095c", "bytes": 169487 }, "provenance.json": { "sha256": "2dca30a4387489ca9868c223790494256dc26503ee6b709a46643fa881c589e8", "bytes": 1115 }, "rendered.html": { "sha256": "f5cdb5755f0b1ab2a897933da2b213a674ccfa76931ab1a19ef6627b79408b15", "bytes": 261102 }, "screenshot.png": { "sha256": "f5f51f0db7037127107f38fdaa5cbdc77c6df0328ef92619061ceb4a76bfb575", "bytes": 2236355 }, "text.txt": { "sha256": "b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41", "bytes": 13245 } }, "started_utc": "2026-10-22T11:23:24.252Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "da6e36978588173199425c7098f5072fedba3ae1eb7cb61af08ef2a4b3eb2e6f", "bytes": 1349 }, "page.html": { "sha256": "6cae7e52b173e57cb4b7b0402b411bd7e307aa280511a3e4b644ebb5e6911d5b", "bytes": 170004 }, "provenance.json": { "sha256": "a3483e71e341aa8163d8fc77e1a3a874ba316fdb8b29a8a8ec46cb72d03d499e", "bytes": 1881 }, "rendered.html": { "sha256": "a958e07b323981251b63f8c41027c69f9e7a3f38a21bbe0a5d195ee85e10f09a", "bytes": 169734 }, "screenshot.jpg": { "sha256": "a4a219aa9272cf0f28de6eb030272d13a43d4f2813cf5ccdefe50da15fba6a91", "bytes": 787321 }, "text.txt": { "sha256": "7e1552c58d4b6cb44154eb8e322fde07d0ed92d7a91450941d6c79d417f92440", "bytes": 13149 } }, "started_utc": "2026-10-23T16:28:31.913Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: patches land; first exploitation attempts hit sensors.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek\n\nCaptured by claude-story-site. Status: captured. Secondary: patches land; first exploitation attempts hit sensors.\n\n- Captured for the record.\n" }, { "slug": "securityweek-mass-exploitation-looms", "url": "https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/", "publisher": "SecurityWeek", "kind": "news", "title": "PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeek", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113111Z", "files": { "headers.json": { "sha256": "bb347753d4feee250192fd7b5bdc50a5bd970acacdb2bbc50ff7ec8f02e421f5", "bytes": 1083 }, "page.html": { "sha256": "cee26b75f5542752d57c034b8a0eccf6b6227242d7619e33a91a35e8d3af8ebb", "bytes": 162723 }, "provenance.json": { "sha256": "f31a296260b932686cb33c7c964e56367479a31e090172999a0b6a20bfac343c", "bytes": 1111 }, "rendered.html": { "sha256": "a85f0c144d03bd751e0f5f14784fdfcb65809370f94510720b7abc2d66c06403", "bytes": 254022 }, "screenshot.png": { "sha256": "65e2d5f0404ae070f6a43772ca24731d6e2b0a1125aac8132107060f194bc2d7", "bytes": 1822934 }, "text.txt": { "sha256": "693aa4300139d2afc431484c18fe038f9b0b2fb411a89b5defbdad622958e851", "bytes": 9475 } }, "started_utc": "2026-10-22T11:31:11.120Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d07cb8cbdf94965f4f3da38d31c3e8eb4d4ec8b5289a58d45b97a85370ffa0ee", "bytes": 1332 }, "page.html": { "sha256": "dc1cf5772ad9e42f303ab0e22885b7f84e9c4d3ad400ceb52b1fb77dba44d45a", "bytes": 163084 }, "provenance.json": { "sha256": "e13a97bd224cb86b0afc537599b080084d303a62dbfdda7df6105d979c1e180c", "bytes": 1880 }, "rendered.html": { "sha256": "a04c14343ca455a6fe20025ba4f4eff6ba4473572a8828d688e7569bdfc29da9", "bytes": 161828 }, "screenshot.jpg": { "sha256": "1493059f9cee65ae994aa49e6861f1d4d5590cc2fe9a8fbc791e4cb752c0b0e7", "bytes": 543279 }, "text.txt": { "sha256": "163bb31414d1edad48e1a2f3ea08d52bbc2f525787b4eecae3f2faed27c07c94", "bytes": 8869 } }, "started_utc": "2026-10-23T16:28:35.698Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Pre-release: 'mass exploitation looms'; watchTowr and Huntress had not seen exploitation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeek\n\nCaptured by claude-story-site. Status: captured. Pre-release: 'mass exploitation looms'; watchTowr and Huntress had not seen exploitation.\n\n- Captured for the record.\n" }, { "slug": "selular-2026-10-ancaman-serangan-siber-php2shell", "url": "https://selular.id/2026/10/ancaman-serangan-siber-php2shell-kemenperin-matikan-situs-tkdn-hingga-25-oktober/", "publisher": "Selular.ID", "kind": "news", "title": "Ancaman Serangan Siber PHP2Shell, Kemenperin Matikan Situs TKDN hingga 25 Oktober | Selular.ID", "published": "2026-10-24 14:00 WIB", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "390ec71c4abe7a222e04e379c264b02a495c1249e176a1ba59afcbb56962ccf6", "bytes": 468 }, "page.html": { "sha256": "7a7f5e36ab1a0c8f906ca3b392f39a98243cd688f119c2181653903a6173dff9", "bytes": 422277 }, "provenance.json": { "sha256": "9202d40b4805a85ea8e00d2f1d9675d85c101cf0a5a4c3690ead25c4b2a9c701", "bytes": 1821 }, "rendered.html": { "sha256": "0a7dc13c14000df3644f6a5b0c2576fd6800b36f840d50cd58cc566f274cc7f3", "bytes": 428764 }, "screenshot.jpg": { "sha256": "e44758febae7b007dbd45db060e5eb09c0765d731083cf25b9a37a00d1ecebc5", "bytes": 704061 }, "text.txt": { "sha256": "a53f6d252999b09d1c0af471d1d92250695ef7ce08c7ed77f35801c41f510da4", "bytes": 9024 } }, "started_utc": "2026-10-24T13:47:27.101Z", "status": 200, "final_url": "https://selular.id/2026/10/ancaman-serangan-siber-php2shell-kemenperin-matikan-situs-tkdn-hingga-25-oktober/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Selular.ID (Indonesia), 24 October, by Suharno: Indonesia's Ministry of Industry (Kemenperin) temporarily switched off several digital services, inclu...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Ancaman Serangan Siber PHP2Shell, Kemenperin Matikan Situs TKDN hingga 25 Oktober | Selular.ID\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/selular/2026-10-ancaman-serangan-siber-php2shell-kemenperin-matikan`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSelular.ID (Indonesia), 24 October, by Suharno: Indonesia's Ministry of Industry (Kemenperin) temporarily switched off several digital services, including the TKDN (local-content) site, to head off cyber-attacks that exploit the two critical PHP2Shell flaws. The shutdown began Thursday 22 October at 22:00 WIB and was due to last until Sunday 25 October, announced on the ministry's social media as a risk-mitigation measure; affected services include the national industry information system (SIINas), the ministry's official site, the TKDN site and all kemenperin.go.id domains. On Saturday 24 October the TKDN site still did not load. The article stresses the TKDN site is a reference for the electronics and telecoms industry (product lists with local-content percentages).\n\n> Penonaktifan layanan dimulai Kamis (22/10/2026) pukul 22.00 WIB dan dijadwalkan berlangsung hingga Minggu (25/10/2026).\n\n_Curator's translation:_ \"The deactivation of services began on Thursday (22/10/2026) at 22:00 WIB and was scheduled to last until Sunday (25/10/2026).\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Ancaman Serangan Siber PHP2Shell, Kemenperin Matikan Situs TKDN hingga 25 Oktober | Selular.ID\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "sempreupdate-php2shell-a-anatomia-das-vulnerabilidade", "url": "https://sempreupdate.com.br/php2shell-a-anatomia-das-vulnerabilidades-criticas-e-o-fracasso-dos-ataques-da-botnet-mirai/", "publisher": "SempreUpdate", "kind": "news", "title": "PHP2Shell: O colapso da botnet Mirai nas falhas RCE", "published": "2026-10-23T16:47:46-03:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "40662cf4952d1c13c2d05a6db00c4a0f31edcbd77844b25193a242dec53ab788", "bytes": 1403 }, "page.html": { "sha256": "2ef99bf5dc389cfe1d630960b4d3d9755cf57fc88e710f774512fcfdb5cc28b0", "bytes": 120147 }, "provenance.json": { "sha256": "267455f026122683de4a9f367ef71f817ce4ac61cfd8b103582635205372fd89", "bytes": 1817 }, "rendered.html": { "sha256": "b793372df00bf16fe4144de50323d6c7daf9093fe1fff64f5e2eee7793117864", "bytes": 120313 }, "screenshot.jpg": { "sha256": "8a322eb00aafa2b3a8bd89411d703f488aaf210978d0de8384c8363213e8db99", "bytes": 968164 }, "text.txt": { "sha256": "1fca2696afa511e9a743a5a6ff54a33bb6a6bc3234f719d554398a10170fefb2", "bytes": 14832 } }, "started_utc": "2026-10-24T08:42:01.215Z", "status": 200, "final_url": "https://sempreupdate.com.br/php2shell-a-anatomia-das-vulnerabilidades-criticas-e-o-fracasso-dos-ataques-da-botnet-mirai/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt-BR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). SempreUpdate (Brazilian Portuguese, a Linux news site), 23 October, by Emanuel Negromonte: PHP2Shell's anatomy and 'the failure of the Mirai botnet at...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: O colapso da botnet Mirai nas falhas RCE\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/sempreupdate/php2shell-a-anatomia-das-vulnerabilidades-criticas-e-o-fraca`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSempreUpdate (Brazilian Portuguese, a Linux news site), 23 October, by Emanuel Negromonte: PHP2Shell's anatomy and 'the failure of the Mirai botnet attacks'. It says proof-of-concept exploits became public within hours of the announcement and set off automated scanning, but that consolidated data from Sophos's Counter Threat Unit show the attacks documented so far, mostly aimed at installing a Mirai variant called Potassium, failed to compromise their targets, being stopped by network defences or by configuration dependencies; Sophos first classed some detections as successful compromises but revised that after forensic analysis. It adds that the PHP Foundation issued a supplementary advisory on 23 October confirming a third remote-code-execution flaw, CVE-2026-115560, with the fix left to the regular update cycle because the conditions for exploiting it are very specific. The exploitation conditions and scanner details it gives are left out of the notes.\n\n> A Sophos inicialmente classificou algumas detecções como comprometimentos bem-sucedidos, mas revisou sua avaliação após análises forenses aprofundadas.\n\n_Curator's translation:_ \"Sophos initially classified some detections as successful compromises but revised its assessment after in-depth forensic analysis.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: O colapso da botnet Mirai nas falhas RCE\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt-BR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "sentinelone-php2shell", "url": "https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/", "publisher": "SentinelOne", "kind": "vendor", "title": "Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113120Z", "files": { "headers.json": { "sha256": "652bccd3c7747978e637a6cf3ca0dd3adcb9d8d6dff7f6ea1e7529206dfc78b6", "bytes": 6215 }, "page.html": { "sha256": "aaf6dfa7fac00ac3a9150b9baee326803df94377bbae974995178f465292bf84", "bytes": 343729 }, "provenance.json": { "sha256": "2a83e001a66dd0c777afe90a659023a49d81f93cd3c8310b6024faf644b74974", "bytes": 1146 }, "rendered.html": { "sha256": "d09c9b7551468ab7f7a69721a397eab5bb3d72b48ef9b756d0427a34c54bc0af", "bytes": 553092 }, "screenshot.png": { "sha256": "aeaf87bfa3d2dea7b44c00746ea38837ee3dbaf866640044a48d46125967360c", "bytes": 3003286 }, "text.txt": { "sha256": "0e75697fb5149ca627012455a8e06b03535c31e0c70e6ef87501d1beb7d39d69", "bytes": 24686 } }, "started_utc": "2026-10-22T11:31:20.524Z", "status": 200, "final_url": "https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/#cq=i1" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "863ff56cb29da4c1ade084e29b4a9018ee0a884182ea33b3b7f76b936e9c12f3", "bytes": 6277 }, "page.html": { "sha256": "c9af48dca9b4a268093289b9330ec9e5b332d8b01cb59fc55cacb27efd4cd6e5", "bytes": 343960 }, "provenance.json": { "sha256": "b7aae5eea5005c42df5442fdeb6d692d21a99cb0f5989e5644c59e9df02ed9ec", "bytes": 1722 }, "text.txt": { "sha256": "6618dbfd02c809cf9a1b2dc95939d0713e202c9fd49f5c7bd895eb26457042f1", "bytes": 24519 } }, "started_utc": "2026-10-23T16:28:00.120Z", "status": 200, "final_url": "https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing).", "raw_sha256": {}, "has_notes": true, "notes_md": "# Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique\n\nCaptured by claude-story-site. Status: captured. Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing).\n\n- Captured for the record.\n" }, { "slug": "seroundtable-google-php2shell-42353-html", "url": "https://www.seroundtable.com/google-php2shell-42353.html", "publisher": "Search Engine Roundtable", "kind": "news", "title": "Google Advice On Taking Sites Down When Fixing PHP2Shell - The PHP Exploit", "published": "2026-10-21T11:35 (per the page)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "f50455e0f9952f10bc96711e1388fd73157cc021ce0c12a504a06a3b8d0eecd5", "bytes": 1313 }, "page.html": { "sha256": "23fea89ce0c76bd8bd49b5bdf234b1a626477eb3db3c94f2e12c153f626fc96f", "bytes": 113491 }, "provenance.json": { "sha256": "1f188a910843234d6da7fcf9fb9adb351cef951526ecf51083d2b62dc188e27f", "bytes": 1485 }, "text.txt": { "sha256": "ced33ac294361df1bd82380fede1bad604578ac5148f9ac7f71ba83ebabbb24e", "bytes": 4938 } }, "started_utc": "2026-10-23T08:10:35.660Z", "status": 200, "final_url": "https://www.seroundtable.com/google-php2shell-42353.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Barry Schwartz: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 carry the fix; many sites were taken offline as a precaution; Google's John Mueller gave advice on taking...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Google Advice On Taking Sites Down When Fixing PHP2Shell - The PHP Exploit\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/news/seroundtable/google-php2shell-42353-html`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBarry Schwartz: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 carry the fix; many sites were taken offline as a precaution; Google's John Mueller gave advice on taking a site down without lasting damage to its search ranking or indexing. Quotes Reuters on European government, school and hospital sites taken offline.\n\n> Several government, school and hospital websites in Europe were taken offline on Wednesday\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "shattered-php2shell-attacks-began-4-days-before-di", "url": "https://shattered.io/php2shell-attacks-began-4-days-before-disclosure-2026/", "publisher": "shattered.io", "kind": "news", "title": "PHP2Shell Exploited 4 Days Before Disclosure [2026]", "published": "2026-10-22T13:08:22+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "0581379715dbf96d91db230506953f5cb953437580223b59995cdddf27c7aca6", "bytes": 906 }, "page.html": { "sha256": "54a6f56103177b36ccb1627362f284d7c1caf3773e81d8b76c4abcf5c5f8f886", "bytes": 211743 }, "provenance.json": { "sha256": "41b78ffcc200494abfa5f58f25edb1d066ea5730e4181169ce9695abce49043d", "bytes": 1706 }, "rendered.html": { "sha256": "c0b9eb91684c89eba77056b7369a845265dbc55fde2516539c8b176c3fb47f27", "bytes": 218949 }, "screenshot.jpg": { "sha256": "9f769b80c5fe3638b6ced0ac4d586438e7a89f6aee03acfc94919dcf9cea5e8c", "bytes": 853792 }, "text.txt": { "sha256": "24bf5e3a430544ca2706f89eab01e6e92aad96dfc014a1223346a265e1e42e28", "bytes": 26442 } }, "started_utc": "2026-10-23T16:18:29.738Z", "status": 200, "final_url": "https://shattered.io/php2shell-attacks-began-4-days-before-disclosure-2026/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). shattered.io (English): a rewrite of The Register's 22 October report. Amazon Threat Intelligence spotted a PHP2Shell exploitation attempt on 17 Octob...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Exploited 4 Days Before Disclosure [2026]\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `io/news/shattered/php2shell-attacks-began-4-days-before-disclosure-2026`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nshattered.io (English): a rewrite of The Register's 22 October report. Amazon Threat Intelligence spotted a PHP2Shell exploitation attempt on 17 October 2026, four days before disclosure, in its MadPot honeypot network, from an IP tied to a commercial anonymisation network; the embargo was due to end at 14:00 UTC on 21 October; Amazon then saw multiple proof-of-concept exploits. A secondary source for what the vault holds from the primary reports.\n\n> Amazon Threat Intelligence spotted a PHP2Shell exploitation attempt on October 17, 2026, The Register reported on October 22.\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Shattered.io (English) analyses AWS's report of a PHP2Shell attempt on 17 October in MadPot, gives a timeline from the AWS blog and The Register, and discusses how an actor could have known during the embargo.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Exploited 4 Days Before Disclosure [2026]\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "shinailbo-news-articleview-html", "url": "https://www.shinailbo.co.kr/news/articleView.html?idxno=5074899", "publisher": "신아일보", "kind": "news", "title": "PHP 취약점 발견, 전세계 해킹 '비상'…사이버위기 '주의'로 상향 < 정책 < 산업 < 기사본문 - 신아일보", "published": "2026-10-22T15:19:37+09:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ca98e26b91f037e324257fa079278bc1f62faf63efcbed9a6f127e6a9cb66545", "bytes": 354 }, "page.html": { "sha256": "21a3b0997f27a72d34ad3b60a31995596acf89a391a69c72413d7b73069f579a", "bytes": 180031 }, "provenance.json": { "sha256": "08278383418e1c213820fb95e1fe01cc907e49d9e700e73a6258ec81fa5dd4d8", "bytes": 1680 }, "rendered.html": { "sha256": "3ad20030e239d467e9a07c36a5c4fc534697972f8e05605341434166b5e09173", "bytes": 232174 }, "screenshot.jpg": { "sha256": "26369a1d866f79eda075ce7083eacaf41723a4727f65789693c7bbbeea5cdb05", "bytes": 551885 }, "text.txt": { "sha256": "75bd3f1d6f44cd9018d0bed9c21a914bdfc192ff78a77dcae5f88a679556f10f", "bytes": 12320 } }, "started_utc": "2026-10-23T16:21:54.809Z", "status": 200, "final_url": "https://www.shinailbo.co.kr/news/articleView.html?idxno=5074899" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Shin-A Ilbo (Korean), 22 October: the headline says the PHP vulnerabilities set off a worldwide hacking emergency and Korea raised its cyber-crisis le...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP 취약점 발견, 전세계 해킹 '비상'…사이버위기 '주의'로 상향 < 정책 < 산업 < 기사본문 - 신아일보\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/shinailbo/news-articleview-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nShin-A Ilbo (Korean), 22 October: the headline says the PHP vulnerabilities set off a worldwide hacking emergency and Korea raised its cyber-crisis level to 'caution'. Citing the science ministry and KISA, it classes CVE-2026-109618 as improper handling of exceptional conditions and CVE-2026-109619 as use-after-free.\n\n> 이번에 확인된 취약점은 예외 상황을 제대로 처리하지 못하는 '부적절한 예외 상황 처리'(Improper Handling of Exceptional Conditions, CVE-2026-109618)\n\n_Curator's translation:_ \"the vulnerabilities identified this time are 'Improper Handling of Exceptional Conditions' (CVE-2026-109618), which fails to handle exceptional situations properly\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Shinailbo: MSIT and KISA held a crisis assessment and raised the private-sector cyber crisis alert to 'Caution', which adds staff and puts emergency dispatch teams on standby. They urged immediate updates and a check for webshells, with reports to KISA. Minister Bae Kyung-hoon called automated blocking and WAF rulesets essential.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP 취약점 발견, 전세계 해킹 '비상'…사이버위기 '주의'로 상향 < 정책 < 산업 < 기사본문 - 신아일보\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ko`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "siamblockchain-2026-10-22-crypto-exchange-hack-alert-ph", "url": "https://siamblockchain.com/2026/10/22/crypto-exchange-hack-alert-php2shell-risk/", "publisher": "Siam Blockchain", "kind": "news", "title": "เว็บไซต์ปิดตัวทั่วโลก หลังพบช่องโหว่ PHP แพลตฟอร์มคริปโทฯ เสี่ยงได้รับผลกระทบ", "published": "2026-10-22", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "31f91ac37218b8dc49b4cbe807a64523324d208a2888444181b20b6b4a47e817", "bytes": 1352 }, "page.html": { "sha256": "2d41b62d846401706ec807f8e77069982bac1de3f9dc9f77103ac8bd42efe8d7", "bytes": 349931 }, "provenance.json": { "sha256": "1c7e2c5d6bfc29d884e646f38aa3bad5e0cc9d16fe4ad6a3391c5987bd13e504", "bytes": 1894 }, "rendered.html": { "sha256": "85203e18b99bcfd100696439ddc12ce36d24aaa12c030fc658e4df355b158f1b", "bytes": 1232406 }, "screenshot.jpg": { "sha256": "0961249abb06809241b44b70836aa2e7216fd90ce2260fe8bdf58851e83488aa", "bytes": 607530 }, "text.txt": { "sha256": "4391c5f206bfa1ec7941c5f06cdc062373e68521b4091d2ad0399cac52038be5", "bytes": 17933 } }, "started_utc": "2026-10-23T16:25:00.611Z", "status": 200, "final_url": "https://siamblockchain.com/2026/10/22/crypto-exchange-hack-alert-php2shell-risk/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "th", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Siam Blockchain (Thai), 22 October: the Thai-language version of the BeInCrypto crypto-exchange warning recorded as nl-beincrypto-crypto-exchange-hack...", "raw_sha256": {}, "has_notes": true, "notes_md": "# เว็บไซต์ปิดตัวทั่วโลก หลังพบช่องโหว่ PHP แพลตฟอร์มคริปโทฯ เสี่ยงได้รับผลกระทบ\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `th/news/siamblockchain/2026-10-22-crypto-exchange-hack-alert-php2shell-risk`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSiam Blockchain (Thai), 22 October: the Thai-language version of the BeInCrypto crypto-exchange warning recorded as nl-beincrypto-crypto-exchange-hack-waarschuwing-php2sh (it quotes the same tweet by CZ and the same SlowMist and Wiz Research points, and the same three at-risk categories). Cloudflare confirmed attackers tried to exploit the flaws and many sites worldwide went offline as a precaution. The claim about the absence of confirmed exchange compromises is recorded on the Dutch edition.\n\n> Cloudflare ก็ได้ยืนยันว่ามิจฉาชีพได้พยายามฉวยโอกาสในเหตุการณ์ดังกล่าวเพื่อหาผลประโยชน์\n\n_Curator's translation:_ \"Cloudflare has also confirmed that fraudsters have tried to take advantage of the event for gain.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Siam Blockchain: PHP2Shell risks for crypto platforms (payment gateways, small exchanges, DeFi front-ends). Embeds a warning tweet from Binance founder CZ and SlowMist's announcement that its MistEye system scanned crypto-industry PHP assets worldwide. No exchange hack confirmed.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"เว็บไซต์ปิดตัวทั่วโลก หลังพบช่องโหว่ PHP แพลตฟอร์มคริปโทฯ เสี่ยงได้รับผลกระทบ\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `th`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "silicon-cybersecurite-1371-php2shell-vulnerabili", "url": "https://www.silicon.fr/cybersecurite-1371/php2shell-vulnerabilites-php-229863", "publisher": "Silicon.fr", "kind": "news", "title": "PHP2Shell : les correctifs arrivent, mais pas au même rythme", "published": "2026-10-22T16:19:07+00:00", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "28dd2d023285ec9edc477d5912e0159e64e1344db0d27f0dfd3fcba12df9706a", "bytes": 962 }, "page.html": { "sha256": "ae676d16d159aef9248db135caf534a7bb15b203b181eb977b64e688997d5d2f", "bytes": 146915 }, "provenance.json": { "sha256": "a71fccd9edddd3fb093c7d34f4df2811e2d77ff5dbbbb833331f5a69e626c49b", "bytes": 1714 }, "rendered.html": { "sha256": "4897908c5ecc8be2c9d7467e4ad71de5549b6a2657b5a86d7caca36cc2197804", "bytes": 344170 }, "screenshot.jpg": { "sha256": "0e580291392fbb418e9ad2b4d70eebc0deddfaa0f930e3ef13d3fb9274c29a02", "bytes": 673877 }, "text.txt": { "sha256": "6b1c6af220b318579d0b31210decae2c0137b2b9b12d63ce3a41e1d8637282c3", "bytes": 15381 } }, "started_utc": "2026-10-24T13:45:10.648Z", "status": 200, "final_url": "https://www.silicon.fr/cybersecurite-1371/php2shell-vulnerabilites-php-229863" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Silicon.fr (French), 22 October, by Clément Bohic: 'the fixes are arriving, but not at the same pace'. It says two critical flaws touch almost every P...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : les correctifs arrivent, mais pas au même rythme\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/silicon/cybersecurite-1371-php2shell-vulnerabilites-php-229863`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSilicon.fr (French), 22 October, by Clément Bohic: 'the fixes are arriving, but not at the same pace'. It says two critical flaws touch almost every PHP version released since March 2012; that Wiz did not find the flaw family alone but took the lead on the narrative, creating the site php2shell.com and praising the 'invaluable' contribution of Gemini 4 Argon; that the PHP project's bulletin is more neutral but says every installation serving web requests is exposed to unauthenticated arbitrary code execution; that Wiz speaks of 70% of websites and Palo Alto Networks' Unit 42 of 22.6 million potentially vulnerable instances; that PHP patched 8.5, 8.4, 8.3 and 8.2 and gave minimal source backports for 8.1, 8.0 and 7.4. It explains the two flaws at a high level (memory exhaustion during request start-up, and stale global state across requests), that mod_php and FrankenPHP are the most exposed, and lists the interim measures the PHP project gave, which are not repeated here.\n\n> Deux vulnérabilités critiques touchent presque toutes les versions de PHP sorties depuis mars 2012.\n\n_Curator's translation:_ \"Two critical vulnerabilities affect almost every PHP version released since March 2012.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : les correctifs arrivent, mais pas au même rythme\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "siliconangle-2026-10-22-php2shell-attacks-began-four", "url": "https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/", "publisher": "SiliconANGLE", "kind": "news", "title": "PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE", "published": "2026-10-22T23:27:27+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f679f363bdb6ceb4cbf592bbdaa119594435a71852cc91500bc2876a2e0cc066", "bytes": 692 }, "page.html": { "sha256": "93efa7ec542828a79d8323a9cd649fb2e6f0ebf0b1f33ef2db2d07f8688d0781", "bytes": 183203 }, "provenance.json": { "sha256": "5a2eb385e610b58cadb52127dc58577ddf9aa4fc62465e1aeeda07c18d25fab0", "bytes": 1721 }, "text.txt": { "sha256": "bfad1c9512cf702bd764da66e5ce5bdc3e602ec3a8c87826b2ad7fc85bda6f77", "bytes": 9686 } }, "started_utc": "2026-10-23T16:22:08.495Z", "status": 200, "final_url": "https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). SiliconANGLE, 22 October: Attackers began targeting the PHP2Shell vulnerabilities four days before the patches, Amazon disclosed, and exploit attempts...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `lt/news/siliconangle/2026-10-22-php2shell-attacks-began-four-days-before-patches`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSiliconANGLE, 22 October: Attackers began targeting the PHP2Shell vulnerabilities four days before the patches, Amazon disclosed, and exploit attempts seen by Cloudflare have since climbed into the millions. It says PHP's maintainers shipped fixes on Wednesday after details leaked, and that the bugs had sat in PHP's code for years until an August audit financed by OpenAI used an AI model to show they could be exploited.\n\n> Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon.com Inc. has disclosed, while exploit attempts seen by Cloudflare Inc. have since climbed into the millions.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "sn-panorama-medien-was-die-php-sicherheitsl", "url": "https://www.sn.at/panorama/medien/was-die-php-sicherheitsluecke-fuer-das-internet-bedeutet-das-problem-ist-riesig-gross-art-679918", "publisher": "Salzburger Nachrichten", "kind": "news", "title": "Was die PHP-Sicherheitslücke für das Internet bedeutet: Das Problem ist „riesig groß“ - SN.at", "published": "2026-10-22T12:43:00+02:00", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "2921f8be03d747abad85c153dc4cdcc1ce079fb9ff6b0507c68952b2681a6e15", "bytes": 438 }, "page.html": { "sha256": "d561c3842cc1fae554d8e5949e27e36ebe49f6bb95c21db0739baa3b1aa7b8d1", "bytes": 145935 }, "provenance.json": { "sha256": "2bc1ab1e31b04a3af686d76593fff2d3e28c17971b599861b768303b851e6d6e", "bytes": 1866 }, "rendered.html": { "sha256": "544317f438c2976c43cbbd7de36cc3e68bbb70c25058b8d8265752a3ab6312e4", "bytes": 158524 }, "screenshot.jpg": { "sha256": "0192d9f21e4f103e2f15fd2486fc551a1eb7ddf8e90505daffaec660c8efd4fd", "bytes": 648673 }, "text.txt": { "sha256": "332525d81a5810fb60d533b85952b97f00a17a5df1d7fd4dc8f1751cde79a444", "bytes": 9255 } }, "started_utc": "2026-10-24T16:07:46.867Z", "status": 200, "final_url": "https://www.sn.at/panorama/medien/was-die-php-sicherheitsluecke-fuer-das-internet-bedeutet-das-problem-ist-riesig-gross-art-679918" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Salzburger Nachrichten (Austria, German), 22 October: what the PHP flaws mean for the internet, headlined 'huge'. It says the two flaws affect every v...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Was die PHP-Sicherheitslücke für das Internet bedeutet: Das Problem ist „riesig groß“ - SN.at\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `at/news/sn/panorama-medien-was-die-php-sicherheitsluecke-fuer-das-inter`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSalzburger Nachrichten (Austria, German), 22 October: what the PHP flaws mean for the internet, headlined 'huge'. It says the two flaws affect every version in use for 14 years and that authorities and experts class it an exceptional emergency because the details leaked unintentionally; the US NSA warned hackers could gain 'direct access' to data systems or server databases, and many providers took sites offline as a precaution, also in Austria. From the Austrian Interior Ministry on Wednesday evening: the new Federal Office for Cybersecurity, with CERT.at, had put out on Tuesday a notice that a 'critical PHP security update' was coming, and again on Wednesday; authorities knew of no cyber-attacks on Austrian sites so far, though attempts were expected. It adds that certain companies are legally bound under the NISG 2026 law that came into force this month, and that ordinary users face only an indirect risk.\n\n> In Österreich sind bei den Behörden bisher keine Cyberattacken auf Webseiten aufgrund der neu entdeckten Sicherheitslücken in der Programmiersprache PHP bekannt geworden.\n\n_Curator's translation:_ \"In Austria, the authorities have so far not become aware of any cyber-attacks on websites because of the newly discovered security vulnerabilities in the PHP programming language.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Was die PHP-Sicherheitslücke für das Internet bedeutet: Das Problem ist „riesig groß“ - SN.at\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "socket-blog-embargo-dispute", "url": "https://socket.dev/blog/php-embargo-dispute", "publisher": "Socket", "kind": "news", "title": "Just a moment...", "published": null, "captures": [ { "stamp": "20261022T112047Z", "files": { "headers.json": { "sha256": "a80f2b5ad8ae81c3b83a000871a7819d186da9f1d450b3717ea39deb9bcacc71", "bytes": 1990 }, "page.html": { "sha256": "b8ac97a2a385dc96494c44b3886248703441a11d350a683a472b690ffe293803", "bytes": 6187 }, "provenance.json": { "sha256": "8255345be61952af9d34d90c1a80520fcab5675c9c8ed3951c2aa93bdc5d64db", "bytes": 939 }, "rendered.html": { "sha256": "45f09ae7a4bb5f729e0b016d77de302dd1646fe819943e3054160f7bc5552cb1", "bytes": 28771 }, "screenshot.png": { "sha256": "38b458f2d97ad16e0fe1fa55afc35614ff1c9d6704c168964e2d9c3c625be655", "bytes": 38311 }, "text.txt": { "sha256": "2edb7b291225f9a58dd5ed7546e5c5ead9d84e0c92a9d78e93e06e030687646e", "bytes": 258 } }, "started_utc": "2026-10-22T11:20:47.891Z", "status": 403, "final_url": "https://socket.dev/blog/php-embargo-dispute" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "baea8c10ee7417b9d6581044628ab5d5bd8ffb728f6337222ea3c20b90220ce1", "bytes": 5394 }, "page.html": { "sha256": "01eb6c37dae7a7eda46afaae385660f01e7af2a754b9e53891ef942907561310", "bytes": 339187 }, "provenance.json": { "sha256": "070d1aa24a28f016f7f8a2558d86cd424f274fee7040432d34c2a9120260107d", "bytes": 1747 }, "rendered.html": { "sha256": "eb511176c44e9b76fa3fe4c694e590706b4e5924e2d686fc9eeee3d976ce2fc0", "bytes": 338513 }, "screenshot.jpg": { "sha256": "4eb3231603ef76ee3bd37b0b1f2c48ed3f40229f90f85c515a048b476632f8e4", "bytes": 667670 }, "text.txt": { "sha256": "c13e57baa3387cf5943c258a1c7de3c28dc015692d81ea03f9bb260eb2a081e7", "bytes": 10562 } }, "started_utc": "2026-10-23T16:28:01.231Z", "status": 200, "final_url": "https://socket.dev/blog/php-embargo-dispute" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "BLOCKED: Cloudflare bot challenge.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Just a moment...\n\nCaptured by claude-story-site. Status: blocked. BLOCKED: Cloudflare bot challenge.\n\n- Cloudflare 'Performing security verification'. Not read. Search summary: Lorenc accepts the timeline, denies leaking, cites exploits in the wild.\n" }, { "slug": "socradar-blog-php2shell", "url": "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "publisher": "SOCRadar", "kind": "news", "title": "PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix", "published": "2026-10-21T13:38:58+03:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "09eba8417ddea4703689bb42e31c614aece5a2fb35a0f23fa0c803fb66951a44", "bytes": 1589 }, "page.html": { "sha256": "98bc01963dcce2e927d6c4e0eb5eaf4c288ce2f03e7b8739e2151559a948d559", "bytes": 277344 }, "provenance.json": { "sha256": "94b85489793072435a5663eba6c4f62860713790b611b35d300c7b7e47984a3f", "bytes": 1613 }, "rendered.html": { "sha256": "0285c3fc043540fec66f56ce7b604e96399b55e6eb400041bb7248d6575a993d", "bytes": 299254 }, "screenshot.jpg": { "sha256": "5cc1bba339f9504fd439a309f782370650d1f79850c1790f509d3c811d13830a", "bytes": 833962 }, "text.txt": { "sha256": "88edcdf127e01f96370214c807432bd24ffb506f250d1f9f1c38df6abd6b1083", "bytes": 30240 } }, "started_utc": "2026-10-23T16:26:10.318Z", "status": 200, "final_url": "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). SOCRadar blog, 21 October: PHP2Shell (CVE-2026-109618 and CVE-2026-109619), critical PHP RCE flaws, with affected versions and how to fix them. A long...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/security-vendor/socradar/blog-php2shell`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSOCRadar blog, 21 October: PHP2Shell (CVE-2026-109618 and CVE-2026-109619), critical PHP RCE flaws, with affected versions and how to fix them. A long vendor page (about 30,000 characters); only the headings were read.\n\n> PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Critical PHP RCE Flaws, Affected Versions, and How to Fix Them\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "software-it168-a2026-1022-6954-000006954576-shtml", "url": "https://software.it168.com/a2026/1022/6954/000006954576.shtml", "publisher": "IT168 软件·学院", "kind": "news", "title": "360安全云发布PHP2Shell应急防护方案，助力政企网站抢修窗口期-互联网专区", "published": "2026-10-22 16:30", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "f9958af19896bb4d9ba961c79cd48d084987a9ca7b605c695c4bcee6a9fc8326", "bytes": 416 }, "page.html": { "sha256": "905deb05ec0d944aa03460dadb3939e3cbe8e5be0c22b69ee79f2986cad7ca09", "bytes": 41653 }, "provenance.json": { "sha256": "9ab87c259d801c52b06b3c65a735583cd68c91a3375ff1d033408e163d8dac4a", "bytes": 1693 }, "rendered.html": { "sha256": "0bb5ed8f6e033e4aa23ac4bc016b9555658e8ac43ba3de04c3d926173d20715d", "bytes": 43285 }, "screenshot.jpg": { "sha256": "5841f166e016fa003a0fd8b6fd919aa0003a79f99fdeb4f58c8547e6ab2a3b63", "bytes": 488655 }, "text.txt": { "sha256": "1f93707d7016fd45cec3347ef6968f2b5e148581818a29743a2b02382b475584", "bytes": 9113 } }, "started_utc": "2026-10-24T13:46:36.384Z", "status": 200, "final_url": "https://software.it168.com/a2026/1022/6954/000006954576.shtml" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). IT168 (China, Chinese), 22 October: a vendor-written piece promoting '360 Security Cloud's' emergency protection plan for PHP2Shell. Its framing parag...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 360安全云发布PHP2Shell应急防护方案，助力政企网站抢修窗口期-互联网专区\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/software-it168/a2026-1022-6954-000006954576-shtml`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nIT168 (China, Chinese), 22 October: a vendor-written piece promoting '360 Security Cloud's' emergency protection plan for PHP2Shell. Its framing paragraph lists precautionary shutdowns on 21 October: in the Netherlands the Port of Rotterdam, the government portal Overheid.nl, the Dutch football association, the sites of the five national parties and several hospitals, following the national cyber-security centre's approach; in Finland the state IT agency Valtori took public government network services offline; France's interior ministry temporarily closed local-government administrative sites pending the patch; and Australian government sites, including the Signals Directorate's, were affected. It cites W3Techs (about 70.5% of sites with a known server-side language), VirusTotal's estimate of over 5.1 million exposed PHP hosts, and says no confirmed successful intrusion had been publicly reported. Promotional; the product claims are not recorded.\n\n> 据VirusTotal估算，暴露在互联网上的PHP主机超过510万台。\n\n_Curator's translation:_ \"VirusTotal estimates there are more than 5.1 million PHP hosts exposed on the internet.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"360安全云发布PHP2Shell应急防护方案，助力政企网站抢修窗口期-互联网专区\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "sohu-a-1091246810-122998307", "url": "https://www.sohu.com/a/1091246810_122998307", "publisher": "搜狐", "kind": "news", "title": "php2shell 漏洞刷屏，集运公司要不要连夜打补丁？先看系统用什么写的_影响_客户_代码执行", "published": "2026-10-22 17:12", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "f6f1cf067aaaa8401b15a14c3fedebc718ff26cd81f09f45ace2abe5d51c8cbd", "bytes": 961 }, "page.html": { "sha256": "c3c2965c5f32dac4b5950f89675660fd2ed28cdc5be4036dc9269f29aa3b439a", "bytes": 24667 }, "provenance.json": { "sha256": "18fc9a1af81db47e4cae8aef524702af968a3079bbcb853ce371b536abfff0e8", "bytes": 1614 }, "rendered.html": { "sha256": "1cc232cf6b69cdfc4edcde411e316b3ff34e8f91d0fd2ae9d75dc1d9b7ddc871", "bytes": 311319 }, "screenshot.jpg": { "sha256": "5cba4b3b080f61915b1a7f064bccb0d86721e48c535c1c2942c2b8683ca7cffe", "bytes": 51556 }, "text.txt": { "sha256": "8c877fbeaef6282cf6090b2f29b151c98f0a3e9b11beaaf2e8c79b7684855d7e", "bytes": 4347 } }, "started_utc": "2026-10-23T16:16:19.362Z", "status": 200, "final_url": "https://www.sohu.com/a/1091246810_122998307" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-CN", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Sohu (China, Chinese), 22 October, a post by the account of Langxin Technology Software, a logistics-software vendor: it says its ASP.NET, SQL Server...", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell 漏洞刷屏，集运公司要不要连夜打补丁？先看系统用什么写的_影响_客户_代码执行\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/sohu/a-1091246810-122998307`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSohu (China, Chinese), 22 October, a post by the account of Langxin Technology Software, a logistics-software vendor: it says its ASP.NET, SQL Server and IIS system does not use PHP and so is outside the flaw's scope, then explains the flaw to customers. It gives the CVSS score as 9.8, which differs from the 9.2 under CVSS 4.0 that PHP and other outlets give, and says China's MIIT NVDB and CNVD have issued risk notices and Tencent Cloud, Alibaba Cloud and QiAnXin CERT issued bulletins. Marketing post by a vendor; the interim measures it lists are not repeated.\n\n> 工信部 NVDB、CNVD 均已发布风险提示，腾讯云、阿里云、奇安信 CERT 相继发出通告\n\n_Curator's translation:_ \"The MIIT's NVDB and CNVD have both issued risk notices, and Tencent Cloud, Alibaba Cloud and QiAnXin CERT have in turn issued bulletins.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Sohu advertorial by the parcel-forwarding software vendor 朗信集运 (Langxin): its ASP.NET system is not affected. It summarises the flaw and in passing lists Chinese agency and cloud advisories and overseas sites taken offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"php2shell 漏洞刷屏，集运公司要不要连夜打补丁？先看系统用什么写的_影响_客户_代码执行\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-CN`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "solutions-numeriques-php2shell-derriere-lurgence-des-correcti", "url": "https://www.solutions-numeriques.com/php2shell-derriere-lurgence-des-correctifs-les-fragilites-de-la-maintenance-du-web/", "publisher": "Solutions Numériques", "kind": "news", "title": "PHP2Shell : derrière l’urgence des correctifs, les fragilités de la maintenance du Web", "published": "2026-10-26T13:36:56+00:00", "captures": [ { "stamp": "20261026T170916Z", "files": { "headers.json": { "sha256": "14ea7a4399a5c1de4c12e5c075b23906582ea19bd574fabc3782c66361d542b1", "bytes": 354 }, "page.html": { "sha256": "3bed9d67f0e81cbbc023dbbcaa008a60d92bfe919a42bc40ba0c5e46c87fc7ed", "bytes": 158140 }, "provenance.json": { "sha256": "5d9220bfcda817438238b3a3992797a0d5d0217b13cc3bd2c12423e5834f8f78", "bytes": 1880 }, "rendered.html": { "sha256": "a537fac19583a4657e2426aa27267c76d86fcf7fbe08d006bf1367770675059b", "bytes": 159718 }, "screenshot.jpg": { "sha256": "ec8eff687c7e18c3b28e3d262c30044e9909399b8587e58ff54940a8295343d4", "bytes": 812651 }, "text.txt": { "sha256": "2ec81d7d33757d7ab45ac9cb59de6be2b6ddb2f0ae8e94a8ec940ab8119fd848", "bytes": 12421 } }, "started_utc": "2026-10-26T17:19:13.972Z", "status": 200, "final_url": "https://www.solutions-numeriques.com/php2shell-derriere-lurgence-des-correctifs-les-fragilites-de-la-maintenance-du-web/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T170916Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Solutions Numériques (French), 26 October: behind the urgency of the PHP2Shell fixes, the fragility of web maintenance. Drawing on the PHP Foundation'...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : derrière l’urgence des correctifs, les fragilités de la maintenance du Web\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/solutions-numeriques/php2shell-derriere-lurgence-des-correctifs-les-fragilites-de`, snapshot `20261026T170916Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T170916Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSolutions Numériques (French), 26 October: behind the urgency of the PHP2Shell fixes, the fragility of web maintenance. Drawing on the PHP Foundation's account, it says that two years earlier, after a Quarkslab security audit, a developer working for the PHP Foundation had identified the first signs of the memory-handling problem later tied to CVE-2026-109618, that several fixes were studied but each had difficulties (possible incompatibilities, risk of new faults, changes needed across many extensions), that discussions dragged on in a team where only a few developers mastered the mechanisms involved, and that it took work by Calif and OpenAI in August 2026 to show that remote code execution was possible. It then asks who maintains the components the web depends on and with what means, and how companies can patch without interrupting their business.\n\n> Deux ans plus tôt, à la suite d’un audit de sécurité réalisé par Quarkslab, un développeur travaillant pour la PHP Foundation avait identifié les premiers signes d’un problème de gestion de la mémoire, qui sera plus tard associé à CVE-2026-109618.\n\n_Curator's translation:_ \"Two years earlier, following a security audit carried out by Quarkslab, a developer working for the PHP Foundation had identified the first signs of a memory-management problem, later associated with CVE-2026-109618.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : derrière l’urgence des correctifs, les fragilités de la maintenance du Web\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "spacemoney-tecnologia-php2shell-falha-critica-php", "url": "https://www.spacemoney.com.br/tecnologia/php2shell-falha-critica-php/", "publisher": "SpaceMoney", "kind": "news", "title": "PHP2Shell: falha crítica no PHP exige correção imediata", "published": "2026-10-22T12:37:02+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "598d8299db9b1ba5f0fc456d4b0bec709afb1db6dccb578442a7fcd25be9b52a", "bytes": 962 }, "page.html": { "sha256": "52a9b01a658c3478371f97646721a584df57797d3c3985d54d396feada0198e4", "bytes": 397527 }, "provenance.json": { "sha256": "ae9ea0f69e21ec523f44ce4b4746bf3f368f41f66eb9dad524aff11fe1805865", "bytes": 1672 }, "rendered.html": { "sha256": "cbfaba1e98945b4c4b4f7660bea5d4c8b2b5856b174c50beb733ec9c45892c43", "bytes": 409984 }, "screenshot.jpg": { "sha256": "c610bc57854a51585b8ab849f61dc975a699d1e31eec41401a5283e77cb20244", "bytes": 651339 }, "text.txt": { "sha256": "ddfdb9f80d319631c28e7b122c9c60ee4bed4cd646b02b9d5cfc5e14cedfb3aa", "bytes": 6862 } }, "started_utc": "2026-10-23T16:11:30.656Z", "status": 200, "final_url": "https://www.spacemoney.com.br/tecnologia/php2shell-falha-critica-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt-BR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). SpaceMoney (Brazil, Portuguese), 22 October: a general explainer saying the flaw sits in the PHP engine, not an application, so sites on platforms suc...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: falha crítica no PHP exige correção imediata\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `br/news/spacemoney/tecnologia-php2shell-falha-critica-php`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSpaceMoney (Brazil, Portuguese), 22 October: a general explainer saying the flaw sits in the PHP engine, not an application, so sites on platforms such as WordPress, Drupal and Joomla can be affected if the PHP version is vulnerable; that Wiz, which discovered and reported the flaws, describes two CVEs scored up to 9.2; that in demonstrations Wiz achieved remote code execution without authentication on WordPress, Drupal and Joomla and read sensitive process data (passwords, tokens, API keys, certificates); and that every PHP version of the last decade, from 5.4, has at least one of the flaws. No new facts.\n\n> A linguagem sustenta 70% dos sites do mundo, incluindo WordPress, Drupal e Joomla.\n\n_Curator's translation:_ \"The language underpins 70% of the world's sites, including WordPress, Drupal and Joomla.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ SpaceMoney summarises Wiz's research: the bugs date back to 5.4, Wiz demonstrated RCE on WordPress/Drupal/Joomla, and AI (Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol) cut exploitation time. It lists the indicators of compromise Wiz suggests.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: falha crítica no PHP exige correção imediata\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `pt-BR`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "stadt-bremerhaven-synology-sicherheitsupdates-fuer-php-geg", "url": "https://stadt-bremerhaven.de/synology-sicherheitsupdates-fuer-php-gegen-php2shell-luecken/", "publisher": "stadt bremerhaven", "kind": "news", "title": "Synology: Sicherheitsupdates für PHP gegen PHP2Shell-Lücken", "published": "2026-10-22", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "47ebfff9d86b48038937cc825706262fea9648729dc6d1d27f2a238056060382", "bytes": 596 }, "page.html": { "sha256": "d0223e08954e27a8073145434236f2cb4727d3a443dcd9d31a41eda92817ac54", "bytes": 126634 }, "provenance.json": { "sha256": "03342d3c6d76b2d99dceed5c3f545e8b80e11fa7fd2e707bb6736b69192c415a", "bytes": 1783 }, "rendered.html": { "sha256": "b34ae46f9992382eafb495ebcbd381651122d04eafbae81a073cc40997a6470b", "bytes": 200042 }, "screenshot.jpg": { "sha256": "8db3ec9b86e894ded12a760cc6767f2b5763137cd21ba186890f8bd5f49d60a7", "bytes": 377876 }, "text.txt": { "sha256": "1b02132739192f4c0c9160bb2558737ecb9b7628bd0ca13c7b36b3a1f8f8acc9", "bytes": 6177 } }, "started_utc": "2026-10-23T16:13:30.865Z", "status": 200, "final_url": "https://stadt-bremerhaven.de/synology-sicherheitsupdates-fuer-php-gegen-php2shell-luecken/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Stadt-Bremerhaven.de (Caschys Blog, German), 22 October, by Carsten Knobloch: Synology has published a statement on PHP2Shell after an investigation b...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Synology: Sicherheitsupdates für PHP gegen PHP2Shell-Lücken\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/stadt-bremerhaven/synology-sicherheitsupdates-fuer-php-gegen-php2shell-luecken`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nStadt-Bremerhaven.de (Caschys Blog, German), 22 October, by Carsten Knobloch: Synology has published a statement on PHP2Shell after an investigation by its PSIRT, saying the flaws affect only NAS systems that run certain packages with a PHP dependency (Calendar, IDrive (third-party; Synology Drive itself is unaffected), Joomla, KodExplorer, MailStation (needs a manual update via Package Center), MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress). Synology has released PHP security updates for DSM 7.4, DSM 7.3 and the out-of-support DSM 7.2; older DSM users should disable the affected packages until they upgrade. Synology says DSM's own PHP component has no externally reachable modules and rates that risk minimal, with a patch planned for future DSM versions (advisory Synology-SA-26:14). The blogger adds there are reports that this is not the end of it.\n\n> Nach einer Untersuchung durch das hauseigene Sicherheitsteam (PSIRT) steht fest, dass die Sicherheitslücken nur NAS-Systeme betreffen, auf denen bestimmte Pakete mit PHP-Abhängigkeit laufen.\n\n_Curator's translation:_ \"After an investigation by its in-house security team (PSIRT), it is established that the vulnerabilities only affect NAS systems running certain packages with a PHP dependency.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Synology: Sicherheitsupdates für PHP gegen PHP2Shell-Lücken\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "startupfortune-cloudflares-ceo-says-worse-bugs-than-php", "url": "https://startupfortune.com/cloudflares-ceo-says-worse-bugs-than-php2shell-are-already-being-patched/", "publisher": "Startup Fortune", "kind": "news", "title": "Cloudflare's CEO Says Worse Bugs Than PHP2Shell Are Already Being Patched - Startup Fortune", "published": "2026-10-26T02:09:10+05:30", "captures": [ { "stamp": "20261026T071149Z", "files": { "headers.json": { "sha256": "2b12582f836342f162442a3abfe326d0209e00bd8e7b6c5367c1b1bac7419be2", "bytes": 1433 }, "page.html": { "sha256": "2f22e4e301b1a813fb5e0518df133f6b80b9f391fe3ffc29d217d4d9bd20bb93", "bytes": 106677 }, "provenance.json": { "sha256": "923eaec470b9fa5f74682548b4a9daa97c65f47bf53bcf6e3c67303164f2407e", "bytes": 1823 }, "rendered.html": { "sha256": "4a84ced79005c70b517498933f6be37bd16b2865152f1a5c18350db29a146ca8", "bytes": 112802 }, "screenshot.jpg": { "sha256": "1e15fb5f6247ebf8406f8b3175feb4f3d2cf500d76a8439d6c4712431ab27cd1", "bytes": 528306 }, "text.txt": { "sha256": "69431f5e5b2dc451952dbb5afda14295268b42d8e324c70318448e593d74c416", "bytes": 8610 } }, "started_utc": "2026-10-26T07:15:28.215Z", "status": 200, "final_url": "https://startupfortune.com/cloudflares-ceo-says-worse-bugs-than-php2shell-are-already-being-patched/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T071149Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Startup Fortune (English), written 25 October by Ron Patel: Cloudflare's CEO says worse bugs than PHP2Shell are already being patched. It says the fla...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Cloudflare's CEO Says Worse Bugs Than PHP2Shell Are Already Being Patched - Startup Fortune\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `bg/news/startupfortune/cloudflares-ceo-says-worse-bugs-than-php2shell-are-already-b`, snapshot `20261026T071149Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T071149Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nStartup Fortune (English), written 25 October by Ron Patel: Cloudflare's CEO says worse bugs than PHP2Shell are already being patched. It says the flaws went public through GitHub security advisories at 13:34 UTC on 21 October, patches the same day, millions of exploit attempts within hours, and quotes Matthew Prince telling Reuters that Cloudflare knows of other serious vulnerabilities in critical software now being patched and expects 'a year or two where every week it feels like the sky is falling', because AI-assisted research is finding bugs that sat unaudited for years. It cites CybelAngel's tracking of roughly 2.24 million internet-facing PHP hosts, 59% of them on end-of-life versions, and watchTowr's Jake Knott on the first in-the-wild attempts. It wrongly says Wiz and Calif 'disclosed' the flaws on 20 October.\n\n> have a year or two where every week it feels like the sky is falling\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Cloudflare's CEO Says Worse Bugs Than PHP2Shell Are Already Being Patched - Startup Fortune\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "startupper-ai-282619-antepithesi-220-ekat-liron-apo", "url": "https://startupper.gr/ai/282619/antepithesi-220-ekat-liron-apo-ti-vretania-stin-asfaleia-ai-meta-to-pagkosmio-sok-tou-php2shell/", "publisher": "startupper", "kind": "news", "title": "PHP2Shell: Παγκόσμιος συναγερμός και «ένεση» 220 εκατ. λιρών από τη Βρετανία για AI Safety - STARTUPPER", "published": "2026-10-26T08:30:14+00:00", "captures": [ { "stamp": "20261026T121439Z", "files": { "headers.json": { "sha256": "999e11e9cea68a97da1071f50e026d5ae6fa4309336023fa9cbd0bbf7963672a", "bytes": 1266 }, "page.html": { "sha256": "9f96d123c959bb351c75763d84e5a67d1937757219f70fc64c237e98fdf07c68", "bytes": 248650 }, "provenance.json": { "sha256": "c8f7bb905897292d0d1af84336d78d5e2f19a3c271f3a1332c3c696e627c7a30", "bytes": 1934 }, "rendered.html": { "sha256": "3174d45ed555fad2f86b604079bd8b32a82ddb90d8c55f2c5c55f576853c6f76", "bytes": 325826 }, "screenshot.jpg": { "sha256": "7964594868a1fdb707cb59e478a716e1a5c04eb055ad5edaead2911045629dd7", "bytes": 736757 }, "text.txt": { "sha256": "2561ba8056cf48f89d1cbb40bf88cf84369cb96916d118a3d22c63c2cf22896a", "bytes": 13885 } }, "started_utc": "2026-10-26T12:25:54.406Z", "status": 200, "final_url": "https://startupper.gr/ai/282619/antepithesi-220-ekat-liron-apo-ti-vretania-stin-asfaleia-ai-meta-to-pagkosmio-sok-tou-php2shell/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "el", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T121439Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Startupper (Greece, Greek), updated 26 October, by Vangelis Graikopoulos: the PHP2Shell crisis and a £220 million UK AI-safety package. It says the Wa...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Παγκόσμιος συναγερμός και «ένεση» 220 εκατ. λιρών από τη Βρετανία για AI Safety - STARTUPPER\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gr/news/startupper/ai-282619-antepithesi-220-ekat-liron-apo-ti-vretania-stin-as`, snapshot `20261026T121439Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T121439Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nStartupper (Greece, Greek), updated 26 October, by Vangelis Graikopoulos: the PHP2Shell crisis and a £220 million UK AI-safety package. It says the Wall Street Journal calls the affair the 'Black October' of cyber-security; that Calif found the flaws with GPT-5.6 Sol in an OpenAI-funded audit in August and Wiz independently with Gemini 4 Argon and GPT-5.6 Sol; that technical details leaked on Tuesday 20 October, bringing the patches forward a day; that the FBI told administrators to take critical servers offline if patches could not be applied quickly; that Censys counts about 39.7 million internet services worldwide running affected PHP versions; that Finland's central government portal and Edinburgh council services went offline, BBC TV and radio producers' sites were temporarily suspended, and in Japan Nomura, MUFG and ANA suspended parts of their online services; that Cloudflare's CEO says attempts rose from tens of thousands in the first 45 minutes to millions in 24 hours; that Amazon's honeypots were hit from 17 October; and that Arctic Wolf says confirmed deep intrusions remain limited. It then describes a UK package announced on Saturday 24 October (£120 million for the AI Security Institute and £100 million for a further strand).\n\n> Σύμφωνα με τα στοιχεία της εξειδικευμένης πλατφόρμας Censys, περίπου 39,7 εκατομμύρια διαδικτυακές υπηρεσίες παγκοσμίως εκτελούσαν εκδόσεις της PHP που επηρεάζονται άμεσα από το PHP2Shell.\n\n_Curator's translation:_ \"According to data from the specialised platform Censys, around 39.7 million internet services worldwide were running PHP versions directly affected by PHP2Shell.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Παγκόσμιος συναγερμός και «ένεση» 220 εκατ. λιρών από τη Βρετανία για AI Safety - STARTUPPER\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `el`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "stephanelarue-sites-des-prefectures-inaccessibles-lint", "url": "https://stephanelarue.com/sites-des-prefectures-inaccessibles-linterieur-les-coupe-a-cause-dune-faille-php/", "publisher": "Stéphane Larue News", "kind": "news", "title": "Sites des préfectures inaccessibles : l'Intérieur les coupe à cause d'une faille PHP", "published": "2026-10-21T16:48:41+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "aa95a99c4107f39c98b9431c0abe5661f834c627ebc1cc47fe2d7d1665008232", "bytes": 1168 }, "page.html": { "sha256": "33e9b4cebf8ec511c6655080db043e66d6d46edff09d45a2e21720bf30b2285b", "bytes": 213873 }, "provenance.json": { "sha256": "86d05fb4452b22c1dee834e1ae39c22397055effac73f494dfd594ac685862c4", "bytes": 1832 }, "rendered.html": { "sha256": "0e1856573788cd51ea8bedf6bc12666dc953f26b9ea507a9f83fa5b65ec4fe3a", "bytes": 794917 }, "screenshot.jpg": { "sha256": "a841aca7aef0a4a416ce35a698a1960482d8180089ca3239ef22273be37fb264", "bytes": 740078 }, "text.txt": { "sha256": "5bdbc3b6e5bbf6d84a636cc86ec4ba16c8ea9722a38a6745f0ed1b4ab2005201", "bytes": 9655 } }, "started_utc": "2026-10-23T16:15:22.128Z", "status": 200, "final_url": "https://stephanelarue.com/sites-des-prefectures-inaccessibles-linterieur-les-coupe-a-cause-dune-faille-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Stéphane Larue News (French), 21 October: France's Ministry of the Interior took the prefecture websites offline on Wednesday 21 October as a precauti...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Sites des préfectures inaccessibles : l'Intérieur les coupe à cause d'une faille PHP\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/stephanelarue/sites-des-prefectures-inaccessibles-linterieur-les-coupe-a-c`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nStéphane Larue News (French), 21 October: France's Ministry of the Interior took the prefecture websites offline on Wednesday 21 October as a precaution, in a statement reported by Reuters, while waiting for a security fix for the software framework the sites run on. The sites of the Nord, Gironde and Rhône prefectures showed only a 'maintenance in progress' page, and the Paris police prefecture portal returned a 503 error when checked; the statement does not say how many sites or when they return. It says PHP's developers had announced two critical vulnerabilities on 20 October and published the fix on Wednesday at 14:00 UTC (16:00 in Paris), that Belgium and the Netherlands also disconnected public sites, and that vehicle registration, passports and residence permits are handled on other state platforms.\n\n> Le ministère de l’Intérieur indique les avoir mis hors ligne à titre de précaution, dans une déclaration rapportée par Reuters.\n\n_Curator's translation:_ \"The Interior Ministry says it took them offline as a precaution, in a statement reported by Reuters.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Stéphane Larue's site (an AI-written article) reports prefecture sites cut by the Interior Ministry. The Nord, Gironde and Rhône prefectures showed 'Maintenance en cours' and the Paris Préfecture de police returned HTTP 503. It lists alternative state portals (ANTS, ANEF).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Sites des préfectures inaccessibles : l'Intérieur les coupe à cause d'une faille PHP\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `fr-FR`. The lead image is captioned as AI-generated (site chrome). Nothing in the article text addresses an AI or hides text from a reader.\n" }, { "slug": "stock-10jqka-20261022-c680990008-shtml", "url": "https://stock.10jqka.com.cn/20261022/c680990008.shtml", "publisher": "同花顺财经股票频道", "kind": "news", "title": "“PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案", "published": "2026-10-22 19:02:18 (page time zone not stated)", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d95c8dce39ebaf7d003b29a14b8ce94e2a5fab077a25e428d5d800cb36774608", "bytes": 1175 }, "page.html": { "sha256": "5c45940b8c65c6d0ddd6a90656787d52fd46fa3ecf38dc130c5ef23b70c3fc7a", "bytes": 114904 }, "provenance.json": { "sha256": "666f77fb6eb9f66e907c6b03c7ff59090fbd17bd34d23e715ce10487e5ccd563", "bytes": 1628 }, "rendered.html": { "sha256": "d901cb2854dd2ed98036b586f3309a3694752c252a133d2f45739090415adfc8", "bytes": 114889 }, "screenshot.jpg": { "sha256": "260d1c0a4b117c228a5b05c978726531b9b08946cff9d6e9f460092106030bf6", "bytes": 385209 }, "text.txt": { "sha256": "9898d2853662d7a4da7d6f72fbba9d100dd15fae2d60a38ce4e78d09e8d28f35", "bytes": 9418 } }, "started_utc": "2026-10-23T16:12:37.442Z", "status": 200, "final_url": "https://stock.10jqka.com.cn/20261022/c680990008.shtml" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh-CN", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). 10jqka (Straight Flush, China, Chinese), 22 October: a press piece from the security firm QiAnXin (688561) promoting its 'Tianji' AI penetration-testi...", "raw_sha256": {}, "has_notes": true, "notes_md": "# “PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `cn/news/stock-10jqka/20261022-c680990008-shtml`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\n10jqka (Straight Flush, China, Chinese), 22 October: a press piece from the security firm QiAnXin (688561) promoting its 'Tianji' AI penetration-testing system as a one-click check. It says QiAnXin's technical experts verified unauthenticated remote command execution and that the potential impact on China exceeds a million assets, argues the flaw is infrastructure-level, cites W3Techs (about three quarters of sites use PHP) and VirusTotal (over 5.1 million detectable PHP hosts), and quotes QiAnXin's mid-2026 vulnerability report on the speed of exploitation. Promotional; the product claims are not recorded.\n\n> 经奇安信（688561）技术专家验证，该漏洞可实现无认证远程任意命令执行，属于互联网基础设施级严重安全风险，对我国的潜在影响超百万级资产。\n\n_Curator's translation:_ \"Verified by QiAnXin's technical experts, the vulnerability allows unauthenticated remote arbitrary command execution, is an infrastructure-level serious security risk, and potentially affects more than a million assets in China.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"“PHP2Shell”敲响企业漏洞警钟，奇安信天戟提供一键速查方案\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `zh-CN`. The page carries a site-added 'Wencai summary' box with an 'AI-generated content' disclaimer and stock-ticker links (site chrome). Nothing in the article text addresses an AI or hides text from a reader.\n" }, { "slug": "suaranasional-2026-10-25-bahaya-celah-keamanan-php2she", "url": "https://suaranasional.com/2026/10/25/bahaya-celah-keamanan-php2shell-komdigi-imbau-pengelola-website-segera-update-php/", "publisher": "Suara Nasional", "kind": "news", "title": "Bahaya Celah Keamanan PHP2Shell: Komdigi Imbau Pengelola Website Segera Update PHP - Suara Nasional", "published": "2026-10-25T06:35:57+00:00", "captures": [ { "stamp": "20261025T120459Z", "files": { "headers.json": { "sha256": "6ab2b5a135319194ac047395133e94100460591e72fcb732dd96dd2b02ef32d7", "bytes": 905 }, "page.html": { "sha256": "b3adcd6340c8d20a22696a84df87c40eb6dd75bc9d3790a5ae9d6dd3b83dc562", "bytes": 98877 }, "provenance.json": { "sha256": "e6435104e9578d257a1bc7889368a55b72a55cddf9a5265bec29c44e4bdc211b", "bytes": 1866 }, "rendered.html": { "sha256": "f5d82a5f5a93153b8cf60f9b856a32b38b218add8a8733c86ba92d708c95004c", "bytes": 543623 }, "screenshot.jpg": { "sha256": "f154d896f95ca569d7187269eb28df7147359e99576033ad13cfce7d253ae5a0", "bytes": 633167 }, "text.txt": { "sha256": "9e587af06b2c873274fb6470000d0de27088a1b93303a46e4b42ee29ba2175e3", "bytes": 7664 } }, "started_utc": "2026-10-25T12:17:03.052Z", "status": 200, "final_url": "https://suaranasional.com/2026/10/25/bahaya-celah-keamanan-php2shell-komdigi-imbau-pengelola-website-segera-update-php/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T120459Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Suara Nasional (Indonesia), 25 October: the Ministry of Communication and Digital (Komdigi) has issued an emergency warning to all digital-system mana...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Bahaya Celah Keamanan PHP2Shell: Komdigi Imbau Pengelola Website Segera Update PHP - Suara Nasional\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/suaranasional/2026-10-25-bahaya-celah-keamanan-php2shell-komdigi-imbau-pen`, snapshot `20261025T120459Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T120459Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSuara Nasional (Indonesia), 25 October: the Ministry of Communication and Digital (Komdigi) has issued an emergency warning to all digital-system managers and web developers in Indonesia about PHP2Shell. Its CSIRT's official alert identifies the two CVEs (9.2 on CVSS 4.0, critical), and the article explains in general terms the memory-management cause of each flaw and the remote-code-execution risk. Mostly a general explainer; the fix versions and advice follow the usual lines.\n\n> Peringatan resmi yang dirilis oleh tim Computer Security Incident Response Team (CSIRT) Komdigi mengidentifikasi dua celah utama, yakni CVE-2026-109618 dan CVE-2026-109619.\n\n_Curator's translation:_ \"The official warning released by Komdigi's Computer Security Incident Response Team (CSIRT) identifies two main flaws, namely CVE-2026-109618 and CVE-2026-109619.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Bahaya Celah Keamanan PHP2Shell: Komdigi Imbau Pengelola Website Segera Update PHP - Suara Nasional\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "substack-lopezkurtz-patch-is-the-exploit", "url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit", "publisher": "David Lopez-Kurtz (Substack)", "kind": "other", "title": "The Patch Is the Exploit - by David Lopez-Kurtz", "published": "2026-10", "captures": [ { "stamp": "20261022T113134Z", "files": { "headers.json": { "sha256": "93831a587e5a9a37a455a49bb5bc1a735ffddbaa9462baecf8483bd621dc0d80", "bytes": 3448 }, "page.html": { "sha256": "77bae2f3d20efe5af0c1bf780b1c2618202d3da7941792444a8fbfed1d4a87f5", "bytes": 224610 }, "provenance.json": { "sha256": "b49aa2b0f632867066da181f78cf57cd3495f0c1c9c7c7634875a04c5f86b5ff", "bytes": 1023 }, "rendered.html": { "sha256": "5a9958401f0de8caa87154eb38d082ae37fe969fe4928862d4e557f4bac4ba1e", "bytes": 263845 }, "screenshot.png": { "sha256": "4f94dc2329c6fd545b1a600cccfc7b2ce2db41deb2b8288403a9eec27e63dd56", "bytes": 3979940 }, "text.txt": { "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "bytes": 33564 } }, "started_utc": "2026-10-22T11:31:34.359Z", "status": 200, "final_url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit" }, { "stamp": "20261025T070559Z", "files": { "headers.json": { "sha256": "291a03786f22e9ef3f0fbfcf09b0a35dcb8e7c85a0b9810e8f656c73de87d5e5", "bytes": 3505 }, "page.html": { "sha256": "36e4a823e30df237f0260fda544fb6e93b88ad7e498b73fec5981bf313269661", "bytes": 226138 }, "provenance.json": { "sha256": "2ae8be0697b36b3c625f6d55cf48465f7b16d2774caf6f062dd9050f7a7d7f7e", "bytes": 1798 }, "rendered.html": { "sha256": "bab69619a3ab52770596118198b3dd28a8dc00ef00cb13bb268e604859efd40d", "bytes": 263962 }, "screenshot.jpg": { "sha256": "a72392a29cacaabbb3774c72bcb58fec9b366695dbfe21c9296515f2fbbb3f9a", "bytes": 931783 }, "text.txt": { "sha256": "ed681f55311835a718a1de42b7d825e0e266eacdea83474879bd56f7d5d27483", "bytes": 33564 } }, "started_utc": "2026-10-25T07:28:39.928Z", "status": 200, "final_url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding.", "raw_sha256": {}, "has_notes": true, "notes_md": "# The Patch Is the Exploit - by David Lopez-Kurtz\n\nCaptured by claude-story-site. Status: captured. Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding.\n\n- Opinion piece; one specific checkable claim about the audit summary.\n" }, { "slug": "sueddeutsche-wirtschaft-php-sicherheitsluecke-2026-ph", "url": "https://www.sueddeutsche.de/wirtschaft/php-sicherheitsluecke-2026-php2shell-webseiten-cybersicherheit-li.3566991", "publisher": "SZ.de", "kind": "news", "title": "PHP-Sicherheitslücke \"PHP2Shell\": Zwei kritische Lücken gefährden Webseiten weltweit - Wirtschaft - SZ.de", "published": "2026-10-21T16:37:18Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "0e933981f96b2bbb683b55d424f7e102ea4f2e0a943b0756bb79badbf2905b1b", "bytes": 953 }, "page.html": { "sha256": "b2b9596ba5189b3e6b748586c5e7990b9bf0502fd227d26a9b2b8bf07b736920", "bytes": 391677 }, "provenance.json": { "sha256": "888d3a2b38cd07f71a29144b1c7bdeffa5e6b4eca78c0d9746639e1e6f391fb2", "bytes": 1862 }, "rendered.html": { "sha256": "bbd9d177f0549e230ca0ec9345ad4a80e8140059adcffd7204466804c057eda6", "bytes": 743779 }, "screenshot.jpg": { "sha256": "e7bb19e5db8381c4583a30afecddb3492f70293c76ce9a70b6269541512e3526", "bytes": 708205 }, "text.txt": { "sha256": "735a9edd2137e32dead0a3e0cd6984dee6f6f37f41bc9d6c5eb96cb0ebcbb40f", "bytes": 10703 } }, "started_utc": "2026-10-23T16:13:32.722Z", "status": 200, "final_url": "https://www.sueddeutsche.de/wirtschaft/php-sicherheitsluecke-2026-php2shell-webseiten-cybersicherheit-li.3566991" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Süddeutsche Zeitung (German), 21 October (18:37 local): a dpa-style report, the same text as the Neue Westfälische item (nw-nachrichten-zwischen-weser...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Sicherheitslücke \"PHP2Shell\": Zwei kritische Lücken gefährden Webseiten weltweit - Wirtschaft - SZ.de\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/sueddeutsche/wirtschaft-php-sicherheitsluecke-2026-php2shell-webseiten-cy`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSüddeutsche Zeitung (German), 21 October (18:37 local): a dpa-style report, the same text as the Neue Westfälische item (nw-nachrichten-zwischen-weser-und-rhein-244), headlined 'Cyber-security emergency'. It says Huntress, the German federal CERT and the official PHP security team describe an acute emergency forcing site operators to act fast, that WordPress alone runs an estimated 400 to 500 million sites and that Moodle, Joomla, Typo3 and Drupal are also PHP, and describes the two CVEs and the remote-code-execution risk. No new claims beyond those recorded on the Neue Westfälische item.\n\n> Wie das IT-Sicherheitsunternehmen Huntress, das Computer Emergency Response Team des Bundes (Cert-Bund) sowie das offizielle PHP-Sicherheitsteam berichten, handelt es sich um eine akute Notfallsituation, die Betreiber von Internetseiten in aller Welt zu schnellem Handeln zwingt.\n\n_Curator's translation:_ \"As the IT security company Huntress, the Computer Emergency Response Team of the Federal Government (CERT-Bund) and the official PHP security team report, it is an acute emergency forcing website operators around the world to act quickly.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Süddeutsche Zeitung (dpa-based) explains PHP2Shell and the BSI's 'Orange' threat level and advice to disconnect servers if patching is not possible. It reports Munich, Charité, Freie Universität and berlin.de going offline, and quotes BSI vice-president Caspers expecting large-scale exploitation within hours of the update.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Sicherheitslücke \"PHP2Shell\": Zwei kritische Lücken gefährden Webseiten weltweit - Wirtschaft - SZ.de\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "sunderlandecho-must-read-astra-security-launches-free-t", "url": "https://www.sunderlandecho.com/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867", "publisher": "Sunderland Echo", "kind": "news", "title": "Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities", "published": "2026-10-23T14:57:09.000Z", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "647c2769b31045a17b4e690d3a63407d8cb9c5b359a391f39062278241bbc709", "bytes": 1669 }, "page.html": { "sha256": "68fe70bf49beb5e6b1fbb4e7e7e26bad7c8dab2326ecaa1ede51a7649e955425", "bytes": 228866 }, "provenance.json": { "sha256": "6de020130f207d63bb9d714ecbb24849547e9d3f7e69c9a432ff24af90cb69d8", "bytes": 1903 }, "rendered.html": { "sha256": "e90d71907d7799d5723f7be2e6fc42db33f2910f3c7da44f9ea00e371d33b10b", "bytes": 236536 }, "screenshot.jpg": { "sha256": "c2700e329487424096dfb8fe2627cada1f0cb096ee2469fcdfffdcfb82d003b0", "bytes": 346095 }, "text.txt": { "sha256": "899ed0de261ef42b0a4c93e076df0c61a09c813ed7517f65345520fbb227c871", "bytes": 6606 } }, "started_utc": "2026-10-23T23:33:26.013Z", "status": 200, "final_url": "https://www.sunderlandecho.com/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Sunderland Echo, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tools to as...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/sunderlandecho/must-read-astra-security-launches-free-tools-to-help-organis`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSunderland Echo, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tools to assess exposure to PHP2Shell. Vendor marketing; the tools were not fetched.\n\n> Astra Security has released two free tools to help organisations assess their exposure to the recently disclosed PHP2Shell vulnerabilities and support remediation efforts.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "sussexexpress-must-read-astra-security-launches-free-t", "url": "https://www.sussexexpress.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867", "publisher": "SussexWorld", "kind": "news", "title": "Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities", "published": "2026-10-23T14:57:09.000Z", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "a2d71c2eb9a377e7d8dccd52cd6ad9afda67e37505a5cb51aa9190aeff8e3eba", "bytes": 1678 }, "page.html": { "sha256": "952da7d44dd1a57977dc7a743d42a81129f060fc02100244731139088d9fd0f5", "bytes": 235514 }, "provenance.json": { "sha256": "6c31e3a50e43716e01668de84c9ca96e8b991a4304f4beeea1094fa7fe1220a8", "bytes": 1902 }, "rendered.html": { "sha256": "569b02a4db12b29f26ebe7f4d4d900a8c5b01c4ecd7d842a77491ceedb4f9463", "bytes": 233215 }, "screenshot.jpg": { "sha256": "60b532b4492a6cd660c4b2d736f984c57aa386e68501c7b1cfac87505fd3aee8", "bytes": 332279 }, "text.txt": { "sha256": "ac79f3e2e45506267ca21a78b4605c28d3c8f8fc6727064d2ea760a5b70277e4", "bytes": 5455 } }, "started_utc": "2026-10-23T23:33:26.082Z", "status": 200, "final_url": "https://www.sussexexpress.co.uk/must-read/astra-security-launches-free-tools-to-help-organisations-identify-php2shell-vulnerabilities-9306867" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). SussexWorld, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tools to assess...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `gb/news/sussexexpress/must-read-astra-security-launches-free-tools-to-help-organis`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nSussexWorld, 23 October: the same syndicated Astra Security press release as in the Milton Keynes Citizen capture, announcing two free tools to assess exposure to PHP2Shell. Vendor marketing; the tools were not fetched.\n\n> Astra Security has released two free tools to help organisations assess their exposure to the recently disclosed PHP2Shell vulnerabilities and support remediation efforts.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Astra Security launches free tools to help organisations identify PHP2Shell vulnerabilities\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tagesanzeiger-php-sicherheitsluecke-millionen-hackeran", "url": "https://www.tagesanzeiger.ch/php-sicherheitsluecke-millionen-hackerangriffe-weltweit-368827139623", "publisher": "Tages-Anzeiger", "kind": "news", "title": "PHP-Sicherheitslücke: Millionen Hackerangriffe weltweit", "published": "2026-10-22 15:01 (page time zone not stated)", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "3d38304ac0a06021628a9d1131ae25def698cf560bffa9d76f17d662ea91440a", "bytes": 566 }, "page.html": { "sha256": "3754013cd8ac9e0e2b1a5bca919dcdd9ce69039f73293a20f2dffea366e3e3d7", "bytes": 361341 }, "provenance.json": { "sha256": "c8e882391831e9797e933e297272874b92706a3dacabffef99a92d9387863b06", "bytes": 1779 }, "rendered.html": { "sha256": "5aa411733a4fc0cef24e30e2191dffe20c3609d0be719a873f32ca520ae9cce0", "bytes": 436202 }, "screenshot.jpg": { "sha256": "dcab401715c6ac2093d7745c6d5b0c0c7272031451d94c24a77bd2c1528db9bd", "bytes": 368979 }, "text.txt": { "sha256": "a302906375f96019a809735c6cff9ed977d839b4ee7c0291f01b70817698aa49", "bytes": 5281 } }, "started_utc": "2026-10-23T08:13:40.782Z", "status": 200, "final_url": "https://www.tagesanzeiger.ch/php-sicherheitsluecke-millionen-hackerangriffe-weltweit-368827139623" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Tages-Anzeiger (Switzerland, German), 22 October: hackers are trying millions of times worldwide to exploit the PHP flaw. Citing Cloudflare's chief Ma...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Sicherheitslücke: Millionen Hackerangriffe weltweit\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/tagesanzeiger/php-sicherheitsluecke-millionen-hackerangriffe-weltweit-3688`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTages-Anzeiger (Switzerland, German), 22 October: hackers are trying millions of times worldwide to exploit the PHP flaw. Citing Cloudflare's chief Matthew Prince on Sky News, it gives some thousands of attempts in the ten hours before the announcement, hundreds of thousands two hours after and millions since, and says many sites taken offline as a precaution were back online. It reports that the BSI and IT experts still urge vigilance for unpatched systems. Corroborates the Cloudflare figures already held.\n\n> Zehn Stunden vor der Ankündigung waren es einige Tausend Versuche, zwei Stunden danach Hunderttausende.\n\n_Curator's translation:_ \"Ten hours before the announcement there were a few thousand attempts, two hours after, hundreds of thousands.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Sicherheitslücke: Millionen Hackerangriffe weltweit\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tageskarte-technologie-detail-webseiten-in-gefahr-p", "url": "https://www.tageskarte.io/technologie/detail/webseiten-in-gefahr-php-sicherheitsluecken-zwingen-hoteliers-und-gastronomen-zum-handeln.html", "publisher": "www.tageskarte.io", "kind": "news", "title": "Webseiten in Gefahr: PHP-Sicherheitslücken zwingen Hoteliers und Gastronomen zum Handeln: Tageskarte", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c709bc3638933e941cfe64c19e0c2cc27e09a982cc5b4d1b0208eea79e5214e9", "bytes": 520 }, "page.html": { "sha256": "6dcf98e7cdd9e365296c619083f7d70ea19c9c3727ba71f672488f17e25815a5", "bytes": 83680 }, "provenance.json": { "sha256": "62f7f306f293d51fabbd9202e16fd178e08c8d0fa1442570fcad86d69ae15842", "bytes": 1749 }, "text.txt": { "sha256": "d9ffeb70695c206ad5e64839c65305d3c2ed26b4ad0bba92a900214930e259ad", "bytes": 18367 } }, "started_utc": "2026-10-23T16:09:36.093Z", "status": 200, "final_url": "https://www.tageskarte.io/technologie/detail/webseiten-in-gefahr-php-sicherheitsluecken-zwingen-hoteliers-und-gastronomen-zum-handeln.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de-DE", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Tageskarte (German hospitality trade site), a guide aimed at hoteliers and restaurateurs on what the PHP flaws mean for their websites and booking sys...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Webseiten in Gefahr: PHP-Sicherheitslücken zwingen Hoteliers und Gastronomen zum Handeln: Tageskarte\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `at/news/tageskarte/technologie-detail-webseiten-in-gefahr-php-sicherheitsluecke`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTageskarte (German hospitality trade site), a guide aimed at hoteliers and restaurateurs on what the PHP flaws mean for their websites and booking systems. It repeats the dpa material (all PHP installations that process web requests are at risk; BSI's warning level '3 / Orange', extraordinarily high; Heise security saying older version series back to PHP 5 are affected; several federal states, municipalities, authorities, universities and hospitals took sites offline as a precaution; the IT-security expert Christoph Fischer's call to take unprotected systems offline) and adds practical advice for small operators. No new facts.\n\n> In seiner veröffentlichten Warnung ordnet das Bundesamt für Sicherheit in der Informationstechnik (BSI) das Risiko mit der Warnstufe „3 / Orange“ als außerordentlich hoch ein.\n\n_Curator's translation:_ \"In its published warning the Federal Office for Information Security (BSI) classes the risk as extraordinarily high with warning level '3 / Orange'.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Webseiten in Gefahr: PHP-Sicherheitslücken zwingen Hoteliers und Gastronomen zum Handeln: Tageskarte\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de-DE`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tagesschau-wirtschaft-digitales-php-panne-100-html", "url": "https://www.tagesschau.de/wirtschaft/digitales/php-panne-100.html", "publisher": "tagesschau.de", "kind": "news", "title": "PHP-Bedrohung: Was über die Sicherheitslücke bekannt ist | tagesschau.de", "published": "2026-10-22T15:41:31", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "40fbd7c84ab114056a07be929bf764dd6caf6cd982a301e123ba2021a8ff6a41", "bytes": 723 }, "page.html": { "sha256": "3a12ec82611b7543569879d72cd1a35cdf7178942b14dcf40af7ff22e9ac1e65", "bytes": 534880 }, "provenance.json": { "sha256": "513a0afc9952926835ce81fa24f259dc15d54e10c33e049e0376374580de3061", "bytes": 1549 }, "text.txt": { "sha256": "05d9718a79ed9daae15685b51b45c40420bd82feb2abed7c8125dd0287de566b", "bytes": 8883 } }, "started_utc": "2026-10-23T16:13:37.742Z", "status": 200, "final_url": "https://www.tagesschau.de/wirtschaft/digitales/faq-php-sicherheitsluecke-100.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). tagesschau.de (ARD, German), 22 October: what is known about the PHP security hole. It says the German BSI published an official cyber-security warnin...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Bedrohung: Was über die Sicherheitslücke bekannt ist | tagesschau.de\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `de/news/tagesschau/wirtschaft-digitales-php-panne-100-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\ntagesschau.de (ARD, German), 22 October: what is known about the PHP security hole. It says the German BSI published an official cyber-security warning (reference BITS-H No. 2026-297981-1032) rating the risk at warning level '3 / Orange', extraordinarily high, meaning countermeasures must be taken at once because serious disruption to normal operations threatens; that the PHP developers published updated versions on Wednesday afternoon; that Heise Security warned operators that working malicious programs would appear within hours or at most days; that Digital Minister Karsten Wildberger told Bild that no damage had been done to federal IT systems and no sign that federal sites and infrastructure are affected; and that large hosts such as IONOS had already updated PHP, so sites with automatic security updates are at least protected.\n\n> In der Warnung (Aktenzeichen BITS-H Nr. 2026-297981-1032) ordnet das BSI das Risiko mit der Warnstufe \"3 / Orange\" als außerordentlich hoch ein.\n\n_Curator's translation:_ \"In the warning (reference BITS-H No. 2026-297981-1032) the BSI classes the risk as extraordinarily high with warning level '3 / Orange'.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Tagesschau explainer: many sites were taken offline yesterday and many are back. It cites the BSI warning (file number BITS-H Nr. 2026-297981-1032, level '3 / Orange'), Marc Henrichmann in Handelsblatt, Digital Minister Wildberger, heise's warning about exploits within hours or days, and says hosters like Ionos have already updated PHP.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Bedrohung: Was über die Sicherheitslücke bekannt ist | tagesschau.de\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tagesspiegel-dpa-noch-offline", "url": "https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-millionen-hacker-versuche-viele-webseiten-noch-offline-16186782.html", "publisher": "tagesspiegel.de", "kind": "news", "title": "Sicherheitslücke: „Millionen“ Hacker-Versuche: Viele Webseiten noch offline", "published": null, "captures": [ { "stamp": "20261022T081509Z", "files": { "headers.json": { "sha256": "86ad8f46f4091f6f34bd73d9618834a0d24ae6b34d21aff82c63dddd22685989", "bytes": 2206 }, "page.html": { "sha256": "964ba8f9a0f47fa611d089cc83f40fdc86ece4c050c602c0dc4661e681cfe8e0", "bytes": 427516 }, "provenance.json": { "sha256": "930f043564eecbeff95506cb2928c7e186e06d30a7ce31a08ac09d6d78701805", "bytes": 1193 }, "rendered.html": { "sha256": "a85f172a5b4be987ce218fb4e2a01b1db2301e6d9daa9c09735d00f16245c082", "bytes": 395185 }, "screenshot.png": { "sha256": "9716d20f18ff56bd31a88188f81e8a38aef651c6e4bedbe0e81f190dfba22755", "bytes": 740028 }, "text.txt": { "sha256": "0255857572a7411c4f2c88bf5ff7fd00a0bcb89cfca6f84234f0a55999ff3c79", "bytes": 5013 } }, "started_utc": "2026-10-22T08:15:09.686Z", "status": 200, "final_url": "https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-millionen-hacker-versuche-viele-webseiten-noch-offline-16186782.html" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "dfd49341c2968ad18ba184e17d83f30476f2704e4673342c830633888ace52b3", "bytes": 2208 }, "page.html": { "sha256": "ca26c4db6077b3188713d4b0fec01f620f4b60fba9a1e37eb245b1f338d69833", "bytes": 433423 }, "provenance.json": { "sha256": "533fae58738885c6be06dd2a20b3b751785f9b4074a85b3a4f35de994555f4a7", "bytes": 1806 }, "text.txt": { "sha256": "03282d093de71a4ff4f9d4aea3458d633a827a6db3f1902424e55887053e4aa2", "bytes": 6910 } }, "started_utc": "2026-10-23T16:13:39.105Z", "status": 200, "final_url": "https://www.tagesspiegel.de/gesellschaft/medien/dpa-sicherheitslucke-im-internet-millionen-hacker-versuche-viele-webseiten-wieder-online-16186782.html" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "takvim-guncel-2026-10-22-php2shell-guvenlik-aci", "url": "https://www.takvim.com.tr/guncel/2026/10/22/php2shell-guvenlik-acigi-nedir-turkiye-ve-dunyada-son-durum", "publisher": "Takvim", "kind": "news", "title": "Siber alemde PHP2Shell alarmı! 5 soruda Avrupa'da siteleri karartan kriz: Türkiye'de durum ne?", "published": "2026-10-22T16:54:38+03:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2111617c5d08356b2a6e7f10a21747160e5bf9f49581d79e0a9930aa67b2a91e", "bytes": 1601 }, "page.html": { "sha256": "2e7c3f55e0f7e106a3d0e658a2a6844ae28acc1822f40bb830122070cd73dca2", "bytes": 98433 }, "provenance.json": { "sha256": "f398cbab978268b1e3a857beaa20f51bbbd5673a79ed3eded3688096db5746e4", "bytes": 1662 }, "text.txt": { "sha256": "b3e09b64bcca18a03d26baaf76d2d633ce703cf36707e96e1bbc5ac60f508c28", "bytes": 6772 } }, "started_utc": "2026-10-23T16:25:58.558Z", "status": 200, "final_url": "https://www.takvim.com.tr/guncel/2026/10/22/php2shell-guvenlik-acigi-nedir-turkiye-ve-dunyada-son-durum#6" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Takvim (Turkey, Turkish), 22 October, updated 23:35: a five-question explainer on the crisis that closed public sites in Europe and what it means in T...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Siber alemde PHP2Shell alarmı! 5 soruda Avrupa'da siteleri karartan kriz: Türkiye'de durum ne?\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/takvim/guncel-2026-10-22-php2shell-guvenlik-acigi-nedir-turkiye-ve`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTakvim (Turkey, Turkish), 22 October, updated 23:35: a five-question explainer on the crisis that closed public sites in Europe and what it means in Turkey. It says that after a warning from Belgium's Cyber Security Centre (CCB) the websites of the Foreign, Finance and Labour ministries and media and education platforms were temporarily disabled; that in the Netherlands DigiD, the Port of Rotterdam portal, the Schiphol airport app and House of Representatives sites were closed; that prefectures, police units and many public portals in France, Germany and Finland were closed as a precaution; that South Korea raised its cyber crisis alert and the US (FBI, NSA) and Japan made emergency update calls. In Turkey, the Presidency's Cyber Security Directorate issued national security alert TR-26-1372 to public and private infrastructure and said that technical checks of e-Devlet, which holds data on over 69 million citizens, found no risk or disruption. The paper's tone is reassuring.\n\n> Cumhurbaşkanlığı Siber Güvenlik Başkanlığı, TR-26-1372 numaralı güvenlik bildirimi ile tüm kamu ve özel sektör altyapılarına yönelik ulusal güvenlik alarmı yayınladı.\n\n_Curator's translation:_ \"The Presidency's Cyber Security Directorate issued a national security alert, with security notice number TR-26-1372, to all public and private-sector infrastructure.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Takvim's five-question explainer lists European shutdowns (Belgium, Netherlands, France, Germany, Finland) and South Korea's alert. It reports that Turkey's Cyber Security Presidency issued notice TR-26-1372, and that checks of e-Devlet (data of over 69 million citizens) found no security risk.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Siber alemde PHP2Shell alarmı! 5 soruda Avrupa'da siteleri karartan kriz: Türkiye'de durum ne?\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tchina-kyodonews-articles-15266", "url": "https://tchina.kyodonews.net/articles/-/15266", "publisher": "共同網", "kind": "news", "title": "日本政府全力應對「PHP」漏洞 通過SNS廣泛提醒注意", "published": null, "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "41b14dbd6bfd7cae983a3c789bb5fcc6bb1b7fde60d2a962ccc64dd2d3b9abf5", "bytes": 629 }, "page.html": { "sha256": "0992c7a3d2e34db52eba96c7ccd42dd28971bb55794a61bfb7fa80da9b059ebf", "bytes": 41675 }, "provenance.json": { "sha256": "dd348f2f793e79fab81b7510d109d933794bb63abcf9d7b3861abb7157af9300", "bytes": 1577 }, "rendered.html": { "sha256": "05a6b62c1ba5b3b6ed8aa822340563f5400ac6b220527930f64e1437ca0593a8", "bytes": 145362 }, "screenshot.jpg": { "sha256": "0221e66ed7476307936a6f062a8747fb6dc8c022648172564a8333d513ea7306", "bytes": 259279 }, "text.txt": { "sha256": "f638db697df7eced152a6cc515ffdad78ae8f0ae06c827284e7f40cc04652173", "bytes": 4377 } }, "started_utc": "2026-10-22T18:22:30.892Z", "status": 200, "final_url": "https://tchina.kyodonews.net/articles/-/15266" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "zh", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in zh: Kyodo (Chinese edition): the Japanese government is coordinating its PHP response through the National Cybersecurity Office (NCO). The NCO posted on X on 21 Oct and advised temporarily stopping websites that cannot be pa", "raw_sha256": {}, "has_notes": true, "notes_md": "# 日本政府全力應對「PHP」漏洞 通過SNS廣泛提醒注意\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `hk/news/tchina-kyodonews/articles-15266`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: 共同網. Language: zh. URL: https://tchina.kyodonews.net/articles/-/15266\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nKyodo (Chinese edition): the Japanese government is coordinating its PHP response through the National Cybersecurity Office (NCO). The NCO posted on X on 21 Oct and advised temporarily stopping websites that cannot be patched. PM Takaichi also posted. Officials met at the Kantei, the NSC met, and Chief Cabinet Secretary Kihara said no damage had been reported.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/hk/news/tchina-kyodonews/articles-15266.json`), not the publisher's and not checked word for word by the curator.\n\n**official**: Chief Cabinet Secretary Minoru Kihara said the government will use the National Cybersecurity Office (NCO) and social media to spread information quickly.\n\n> 官房長官木原稔在記者會上強調，將以國家網路安全統括室（NCO）為中心，利用社群平台（SNS）迅速發佈必要資訊\n\n_Watch reader's translation:_ Chief Cabinet Secretary Minoru Kihara stressed at a press conference that the government will, centred on the NCO, use social media to rapidly publish necessary information\n\n**agency**: Japan's NCO recommended temporarily stopping websites as an effective measure when patching is difficult.\n\n> 作為難以打補丁之際的有效對策，NCO建議讓網站暫時停止運行\n\n_Watch reader's translation:_ As an effective measure when patching is difficult, the NCO recommended temporarily stopping websites\n\n**official**: PM Sanae Takaichi posted on X urging people to prepare to patch, with reference to NCO information.\n\n> 首相高市早苗也於當晚在X的自身帳號上發文，呼籲參考NCO發佈的資訊，做好打補丁的準備\n\n_Watch reader's translation:_ PM Sanae Takaichi also posted that evening on her own X account, urging people to refer to NCO information and prepare to patch\n\n**official**: NCO head Yoichi Iida and NPA Cyber Police Bureau chief Takashi Osaka met the PM, and a National Security Council meeting was held.\n\n> 擔任NCO一把手的內閣網路官飯田陽一、警察廳網路警察局局長逢阪貴士進入首相官邸\n\n_Watch reader's translation:_ Cabinet cyber officer Yoichi Iida, head of the NCO, and NPA Cyber Police Bureau chief Takashi Osaka entered the PM's office\n\n**official**: Kihara said no damage linked to the flaw had been reported.\n\n> 「目前沒有收到與該漏洞有關的受損報告。」\n\n_Watch reader's translation:_ 'We have not received any reports of damage related to this vulnerability so far.'\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in zh: Kyodo (Chinese edition): the Japanese government is coordinating its PHP response through the National Cybersecurity Office (NCO). The NCO posted on X on 21 Oct and advised temporarily stopping websites that cannot be pa\n\nSupports: translations/hk/news/tchina-kyodonews/articles-15266.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "tech-everyeye-notizie-vulnerabilita-php-70-siti-mondo", "url": "https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html", "publisher": "Everyeye Tech", "kind": "news", "title": "Vulnerabilità PHP: il 70% dei siti al mondo è stato a rischio per più di 10 anni!", "published": "2026-10-23T08:30:00+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "1033588b0b0979cac12fb3b7abe3eb031cb53ef0a6b5b318fcb11415ef4b55b4", "bytes": 782 }, "page.html": { "sha256": "c12e14252ec4e468f220422f9b5516d5b5716fac875a8b1fd725e0632a551cdd", "bytes": 57672 }, "provenance.json": { "sha256": "961a1a318348cf1b33331123399d361f6921794b2a637d72f6e36f99c5698c48", "bytes": 1796 }, "rendered.html": { "sha256": "1c5653d11e5fcbaf7c8f18b03fc3164e3db2062d2c04486bf109127875386a6d", "bytes": 85546 }, "screenshot.jpg": { "sha256": "9dc5ba083ccb0610474a46e753440046e7dd335e30555aa41ee8d811ad5b4603", "bytes": 654979 }, "text.txt": { "sha256": "e7a5a2d24c7eb2aa38181b0292f6a2cc695ad4388ed7ca476335140c75cab18d", "bytes": 6765 } }, "started_utc": "2026-10-23T16:18:59.444Z", "status": 200, "final_url": "https://tech.everyeye.it/notizie/vulnerabilita-php-70-siti-mondo-rischio-10-anni-907538.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Everyeye Tech (Italian), 23 October: the headline says 70% of the world's websites were at risk for more than 10 years. The patches fix two vulnerabil...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Vulnerabilità PHP: il 70% dei siti al mondo è stato a rischio per più di 10 anni!\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/tech-everyeye/notizie-vulnerabilita-php-70-siti-mondo-rischio-10-anni-9075`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nEveryeye Tech (Italian), 23 October: the headline says 70% of the world's websites were at risk for more than 10 years. The patches fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, both 9.2 out of 10, followed by advice on protecting a site.\n\n> Le patch risolvono due vulnerabilità, identificate come CVE-2026-109618 e CVE-2026-109619 e soprannominate PHP2Shell; entrambe hanno un punteggio di 9,2 su 10.\n\n_Curator's translation:_ \"The patches fix two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell; both score 9.2 out of 10.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Vulnerabilità PHP: il 70% dei siti al mondo è stato a rischio per più di 10 anni!\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `it`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tech-noisy-2026-10-22-php2shell-php-rce-cve-2026-10", "url": "https://tech-noisy.com/2026/10/22/php2shell-php-rce-cve-2026-109618/", "publisher": "tech-noisy", "kind": "news", "title": "PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲", "published": "2026-10-22T01:34:38+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "8b127169b90556b903f5390312a835ab5e9995a881b341d7808038de6fd0bdbc", "bytes": 565 }, "page.html": { "sha256": "e9688d38fe817a9be886bd61660a625b69892f54818074df6f4b93182a3155b9", "bytes": 297452 }, "provenance.json": { "sha256": "6e65ff25b3fda2d3b1135c9a24f4e67c5d2ae40d1dd7612bb01b5ee5f351348b", "bytes": 1546 }, "text.txt": { "sha256": "5f8a25c11cb647793db8c9c71ba37be748b0ed9384d0ee3f71e584c4bbfee168", "bytes": 16360 } }, "started_utc": "2026-10-23T16:20:11.451Z", "status": 200, "final_url": "https://tech-noisy.com/2026/10/22/php2shell-php-rce-cve-2026-109618/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). tech-noisy (Japanese), 22 October: an explainer headed 'PHP2Shell: two flaws in PHP itself and fixed versions 8.5.12'. It says PHP published fixes on...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/tech-noisy/2026-10-22-php2shell-php-rce-cve-2026-109618`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\ntech-noisy (Japanese), 22 October: an explainer headed 'PHP2Shell: two flaws in PHP itself and fixed versions 8.5.12'. It says PHP published fixes on 21 October (CVSS 4.0 9.2), the official advisory names PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed and rates mod_php highest, 8.2 to 8.5 need updating and 8.1 and earlier get no official fix, and that Wiz, which found it, says it used Gemini 4 Argon and GPT-5.6 Sol. It says PHP had pre-announced on the 20th that it might publish earlier if details became public or real exploitation was seen, that the CVE numbers were reported to have leaked online the day before, and that, although some reports say real attacks had started, Huntress said at the evening of 21 October (US Eastern) that it had not seen exploitation in its monitored environments. It carries an editorial view and an FAQ.\n\n> 実際の攻撃が出始めたとの報告もある一方、Huntress は 21 日夕方(米東部時間)の時点で、自社の監視先では悪用を確認していないとしています。\n\n_Curator's translation:_ \"While there are reports that real attacks have begun, Huntress says that as of the evening of the 21st (US Eastern time) it had not confirmed exploitation in the environments it monitors.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ tech-noisy.com (Japan) explainer of the advisory and Wiz research. It adds Google Cloud guidance (rebuild GKE/Cloud Run images, Cloud Armor managed rules protect, App Engine standard PHP 8.2+ auto-patched) and Huntress saying it had seen no exploitation as of 21 Oct evening (US Eastern).\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "techaeris-2026-10-21-php2shell-the-emergency-php-p", "url": "https://techaeris.com/2026/10/21/php2shell-the-emergency-php-patch-is-out/", "publisher": "Techaeris", "kind": "news", "title": "PHP2Shell: The Emergency PHP Patch Is Out", "published": "2026-10-21T09:14:26-05:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "1aa31bc55521f931aa20a3b25c90991f330d67d3726196eab7de3d203ae5b7e0", "bytes": 1209 }, "page.html": { "sha256": "3fc752e21ee0a92ffaae10a2a2f468f2d31b644915d6eabc17aafa477ad2796f", "bytes": 352309 }, "provenance.json": { "sha256": "b14a9b3075404e6aa1b4023af75ab7ec5b104913a37b89caa5df44864869e63d", "bytes": 1540 }, "text.txt": { "sha256": "2dfe83a6dd42414c846217e91064fd836dfe85eb7c240ca3802b954d18acab5f", "bytes": 12022 } }, "started_utc": "2026-10-23T16:10:23.647Z", "status": 200, "final_url": "https://techaeris.com/2026/10/21/php2shell-the-emergency-php-patch-is-out/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Techaeris, 21 October: the emergency PHP patch is out and the real race starts now. The PHP security team released fixes on Wednesday 21 October 2026...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: The Emergency PHP Patch Is Out\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/techaeris/2026-10-21-php2shell-the-emergency-php-patch-is-out`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTechaeris, 21 October: the emergency PHP patch is out and the real race starts now. The PHP security team released fixes on Wednesday 21 October 2026 at 14:00 UTC (10:00 Eastern) for two critical flaws, each rated 9.2 out of 10 under CVSS v4.0; the article covers what shipped, what is still exposed and what to do.\n\n> The PHP security team released fixes today, Wednesday, October 21, 2026, at 14:00 UTC, or 10:00 a.m. Eastern\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: The Emergency PHP Patch Is Out\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "techgaming-internet-sotto-attacco-php2shell-vulnera", "url": "https://www.techgaming.it/internet-sotto-attacco-php2shell-vulnerabilita-pokemon-plex-gitlab/", "publisher": "TechGaming.it", "kind": "news", "title": "Internet sotto attacco: PHP2Shell mette a rischio milioni di siti", "published": "2026-10-22T18:55:29+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "b242a353ac37e8bed264060f690e11c624f05ae16b10f6b794367f5d08bc7e88", "bytes": 491 }, "page.html": { "sha256": "3ba4259ae28924925d19db0652b3ddcc789c1219319a4d44a0e7ac57f0970770", "bytes": 87655 }, "provenance.json": { "sha256": "a8c9c07742a1a8b67fdc48db05292cdb10a42bb4ff427eef328395a0f2a755a3", "bytes": 1769 }, "rendered.html": { "sha256": "de0edb377cc84cfc56d0c5971e619ef7c46285ba302cc38310e1c93e647a0ffd", "bytes": 124947 }, "screenshot.jpg": { "sha256": "4daf321cd631fc535ff36cad1cd3790c703ba35c268d0dd754a89991b41a816b", "bytes": 396480 }, "text.txt": { "sha256": "75acc700630c3f2a197a81ac80c4017d2e05115f04c092bf7dd476b200baa00b", "bytes": 6440 } }, "started_utc": "2026-10-23T16:19:01.914Z", "status": 200, "final_url": "https://www.techgaming.it/internet-sotto-attacco-php2shell-vulnerabilita-pokemon-plex-gitlab/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it-IT", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). TechGaming.it (Italian), 22 October: a roundup, via Kotaku, of the week's security problems in PHP, GitLab and Plex and their effect on gaming. On PHP...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Internet sotto attacco: PHP2Shell mette a rischio milioni di siti\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/techgaming/internet-sotto-attacco-php2shell-vulnerabilita-pokemon-plex`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTechGaming.it (Italian), 22 October: a roundup, via Kotaku, of the week's security problems in PHP, GitLab and Plex and their effect on gaming. On PHP2Shell it gives Cloudflare's figures (thousands of attempts in the ten hours before disclosure, tens of thousands in the first 45 minutes after), says several Pokémon-related apps were temporarily suspended for emergency maintenance, that Square Enix confirmed unauthorised access to its systems, and that the PHP vulnerability reportedly contributed to the decision to end two long-running Japanese mobile games for good. It then covers separate issues: a GitLab flaw (CVE-2026-110264, CVSS 10, very old versions) and four Plex vulnerabilities that can be combined, some already used by attackers to mine cryptocurrency and route traffic. The link between Square Enix's unauthorised access and PHP2Shell is not established.\n\n> Diverse applicazioni legate al franchise Pokémon sono state temporaneamente sospese per consentire interventi di manutenzione straordinaria, mentre Square Enix ha confermato episodi di accesso non autorizzato ai propri sistemi.\n\n_Curator's translation:_ \"Several applications linked to the Pokémon franchise were temporarily suspended for extraordinary maintenance, while Square Enix confirmed episodes of unauthorised access to its systems.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Internet sotto attacco: PHP2Shell mette a rischio milioni di siti\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it-IT`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "technotoday-php2shell-saldirilari-iki-kritik-php-aci", "url": "https://technotoday.com.tr/php2shell-saldirilari-iki-kritik-php-acigi-nasil-calisiyor/", "publisher": "Technotoday", "kind": "news", "title": "PHP2Shell Saldırıları: İki Kritik PHP Açığı Nasıl Çalışıyor? - Technotoday", "published": "2026-10-22T16:12:05+03:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "11c29c31312ffea5f08690956575683a65e78e911bb465da2798de3a31a9fd29", "bytes": 1396 }, "page.html": { "sha256": "ab4decfc27aa189d1598cb2ee1af922ad809960b345b0f9b598d3a114e8682ca", "bytes": 136685 }, "provenance.json": { "sha256": "3ef547f8def70c58e139363957f4da1efa64818f5bfed122c9e01a7d2b1095c2", "bytes": 1780 }, "rendered.html": { "sha256": "da5dc5b7e911fc1ffda05006c03d9107f10f893908a2e5726864161d5760a9ff", "bytes": 149032 }, "screenshot.jpg": { "sha256": "e092c6a411531aadc460dcd922c6aaa2a33128538b1933a7d6caa5420de4d4fa", "bytes": 290667 }, "text.txt": { "sha256": "f167921e5723693a3bf70820a4bef11fd6a6b0ceb47e632f67b45b53aa6b31ea", "bytes": 4072 } }, "started_utc": "2026-10-23T16:26:01.012Z", "status": 200, "final_url": "https://technotoday.com.tr/php2shell-saldirilari-iki-kritik-php-acigi-nasil-calisiyor/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Technotoday (Turkey, Turkish), by Muhammed Kayan, dated 23 October on the page: how the two critical PHP flaws work. It says the CVEs were made more c...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Saldırıları: İki Kritik PHP Açığı Nasıl Çalışıyor? - Technotoday\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/technotoday/php2shell-saldirilari-iki-kritik-php-acigi-nasil-calisiyor`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTechnotoday (Turkey, Turkish), by Muhammed Kayan, dated 23 October on the page: how the two critical PHP flaws work. It says the CVEs were made more critical by technical details leaking before the 21 October update, that both score 9.2 on CVSS 4.0, that the first attack attempts were reported to have been seen before the official patches were released, and that the number of successfully compromised systems was not yet known. It describes the memory-handling causes at a general level, says the flaw sits in PHP itself so a site with safe application code can still be affected, and notes Wiz's demonstrations against WordPress, Drupal and Joomla.\n\n> Bununla birlikte başarılı şekilde ele geçirilen sistemlerin sayısı henüz kesin olarak bilinmiyor.\n\n_Curator's translation:_ \"However, the number of systems successfully taken over is not yet known with certainty.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Saldırıları: İki Kritik PHP Açığı Nasıl Çalışıyor? - Technotoday\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "techtarget-cybersecurity-news-366652444-php2shell-2", "url": "https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released", "publisher": "TechTarget", "kind": "news", "title": "PHP2Shell: 22M exposed servers at risk as emergency patches released | TechTarget", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "01b64580a78bd6540f2ba577f1a39e1318d39cf99fec060470103c09bfaa6f39", "bytes": 649 }, "page.html": { "sha256": "2e80afaab63864d63fd5576bd930374708a7de19ed8bee095cda4dc0e50ff767", "bytes": 326708 }, "provenance.json": { "sha256": "cadb807c3d21b086488c4d7dfcf4106f13650a2208d98431782cc2bad6b74e85", "bytes": 1848 }, "rendered.html": { "sha256": "4655866500679d77a40877f6232299c59a16bc4ee291b4d53977558b287107cc", "bytes": 346405 }, "screenshot.jpg": { "sha256": "ac949048de5339dd9f680d5732f3d4d46568b85ca2993b2b9dd3eca1397083b4", "bytes": 563841 }, "text.txt": { "sha256": "9c9a0459deeccb0d0f8702c4727cedf98afe67f8151d093511d9fd341ae175e2", "bytes": 8195 } }, "started_utc": "2026-10-23T23:28:03.603Z", "status": 200, "final_url": "https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). TechTarget, a news piece: 'PHP2Shell: 22M exposed servers at risk as emergency patches released'. AI gave defenders a head start, but PHP2Shell has sp...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: 22M exposed servers at risk as emergency patches released | TechTarget\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/techtarget/cybersecurity-news-366652444-php2shell-22m-exposed-servers-a`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTechTarget, a news piece: 'PHP2Shell: 22M exposed servers at risk as emergency patches released'. AI gave defenders a head start, but PHP2Shell has sparked a chaotic race against automated exploits across 22 million vulnerable servers; Palo Alto Networks said it had identified more than 22.6 million exposed instances potentially vulnerable.\n\n> Palo Alto Networks said Wednesday it had identified more than 22.6 million exposed instances potentially vulnerable to the PHP2Shell flaws.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: 22M exposed servers at risk as emergency patches released | TechTarget\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "techtarget-disclosure-unravels", "url": "https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop", "publisher": "TechTarget", "kind": "news", "title": "PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget", "published": null, "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "87d33c4caf1882ea5e9811dcd54795674e0daed96eda7777f7747cbeee38db5a", "bytes": 649 }, "page.html": { "sha256": "0223170b84edc3cf77a3901e446e8f957010d65649c750657d38ee5bf934a171", "bytes": 328498 }, "provenance.json": { "sha256": "69ff5c6742e78f811ceeedfb7649bef62e0bd8b0e55f6aa02961068734c0df60", "bytes": 1749 }, "rendered.html": { "sha256": "0fc25e764308756339016f1356395c2d0c9df502cb917185f4a3f0c7740568cf", "bytes": 353658 }, "screenshot.jpg": { "sha256": "bb1a9c86e83b49f116612264096508106615025ce4df63205f5f31aaa75c0d6a", "bytes": 729081 }, "text.txt": { "sha256": "c186055de6bb1abc70e426281fe382563363ff7b1fe80ba32542b4b9a45f9374", "bytes": 10677 } }, "started_utc": "2026-10-23T01:38:53.379Z", "status": 200, "final_url": "https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): \"hard vulnerabil...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/tech-press/techtarget/disclosure-unravels`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: TechTarget. Language: en. URL: https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTechTarget on how the disclosure unravelled: the leak of the CVE IDs on 20 October brought the release forward to 21 October; Chainguard published fixed images at 07:41 UTC on 21 October, more than six hours early, and the PHP Foundation's criticism is quoted. Chainguard CEO Dan Lorenc does not dispute publishing early but disputes the Foundation's account: he says Chainguard learned on 16 October that a disclosure was coming, independently found the vulnerability that night with an in-house AI harness and a frontier model, joined the coordination channel on 17 October, and published after multiple vendors in the channel reported active exploitation overnight on 20-21 October. Lorenc says Chainguard saw exploitation attempts mainly from Russian and Chinese IP addresses and that many public PoCs were fake. It also reports Amazon's 17 October honeypot hit and Hadrian's \"in the wild at scale\", and more than 30 UK government services taken offline. No organisation is named as compromised.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): \"hard vulnerability to exploit\": needs the target's environment\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "techtarget-itmedia-tt-article-2610-23-2000002526", "url": "https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/", "publisher": "TechTargetジャパン", "kind": "news", "title": "PHP脆弱性「PHP2Shell」で2260万件に影響　情シスの緊急チェックリスト：OpenAIモデルが暴いた脆弱性 - TechTargetジャパン", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "1ed00bf9510a28811029c3773c98ef4917dc6ae3376546f9ee49eeefdf791094", "bytes": 870 }, "page.html": { "sha256": "1498ca3c19557d38005bc06db2069e1561066b51714b0d2154695008912616bc", "bytes": 132446 }, "provenance.json": { "sha256": "ec02390651f5159484927d2430d0edeab353f6f7320e822b78e7370d8e935e5d", "bytes": 1753 }, "rendered.html": { "sha256": "1df30985b49b1cb8309a37f9516a902205855509ba3cd2f2622cd72c65234984", "bytes": 162276 }, "screenshot.jpg": { "sha256": "5917450e22e610727faa5390c93e7e7903e92d75d6a8b1d8c676bcf6e8cb7d2e", "bytes": 530090 }, "text.txt": { "sha256": "14c421632d9592d8a6b0b2bef1f45af7363175b91bd978cc453d73de9b51dbdb", "bytes": 9486 } }, "started_utc": "2026-10-23T16:20:11.758Z", "status": 200, "final_url": "https://techtarget.itmedia.co.jp/tt/article/2610/23/2000002526/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). TechTarget Japan (Japanese): the headline says the PHP2Shell vulnerability affects 22.6 million and gives an urgent checklist for IT staff; the lead s...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP脆弱性「PHP2Shell」で2260万件に影響　情シスの緊急チェックリスト：OpenAIモデルが暴いた脆弱性 - TechTargetジャパン\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/techtarget-itmedia/tt-article-2610-23-2000002526`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTechTarget Japan (Japanese): the headline says the PHP2Shell vulnerability affects 22.6 million and gives an urgent checklist for IT staff; the lead says more than 22 million servers were put at risk, that OpenAI helped with the fix and that a WAF alone cannot prevent it. The 22 million figure's basis is not given in the text read.\n\n> PHPを脅かす脆弱性「PHP2Shell」が浮き彫りになり、2200万台以上のサーバが危険にさらされた。\n\n_Curator's translation:_ \"The vulnerability 'PHP2Shell' threatening PHP came to light, and more than 22 million servers were put at risk.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP脆弱性「PHP2Shell」で2260万件に影響　情シスの緊急チェックリスト：OpenAIモデルが暴いた脆弱性 - TechTargetジャパン\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "techzine-php-chainguard", "url": "https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/", "publisher": "Techzine Global", "kind": "news", "title": "PHP accuses Chainguard in PHP2shell", "published": null, "captures": [ { "stamp": "20261022T081301Z", "files": { "headers.json": { "sha256": "e4c1c978fae1d476008a0220bd56d79c287115d6dca754076ac5c220c8403209", "bytes": 1084 }, "page.html": { "sha256": "f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd", "bytes": 103 }, "provenance.json": { "sha256": "0b93d24048c39675ef0bec6c63cbadc201cd4c761b3fd85f96538ec7afa93ea9", "bytes": 1084 }, "rendered.html": { "sha256": "8631afb05e141985b74d3ac4fc67eca679d940e50dcd377593b0a5faf473e4a8", "bytes": 29118 }, "screenshot.png": { "sha256": "83e27bf325b865db2d303c7c20ec30a0a5c0b452145b2b48175a74d4b292d20f", "bytes": 38816 }, "text.txt": { "sha256": "a709538005b7efca9f1059e2eeaa4a13cd196d9f8215befc91b286d42f56d334", "bytes": 263 } }, "started_utc": "2026-10-22T08:13:01.646Z", "status": 403, "final_url": "https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1" }, { "stamp": "20261022T112124Z", "files": { "headers.json": { "sha256": "5345616d7653c07e708bb2b1f5f0b9fe2afefd06cca4a63dc7bb7fee0684222a", "bytes": 1080 }, "page.html": { "sha256": "f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd", "bytes": 103 }, "provenance.json": { "sha256": "8870e433407b07164f7f83ef420dd5307c6c1c525544cc382a43dd9da569c4ac", "bytes": 1084 }, "rendered.html": { "sha256": "f9d1600dea692ee1e52186d55f0ac9eee1a19f909c76aec8fa9b5ef26f1278bb", "bytes": 29118 }, "screenshot.png": { "sha256": "6127fef1895a985b7bcd7168fff19347a8ca8f67cfc409d39a802caebc1fce9c", "bytes": 38923 }, "text.txt": { "sha256": "93f61d068317f6ef84245b70a7d8b8ea0f4b1d351af10fc89a31cbe4ae7eb1da", "bytes": 263 } }, "started_utc": "2026-10-22T11:21:24.429Z", "status": 403, "final_url": "https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1" } ], "status": "blocked", "primary": false, "added_by": "collector-researchers", "notes": "Cloudflare challenge (HTTP 403) at 2026-10-22T08:13Z; 403 capture folder kept. Per search snippet: Chainguard CEO Dan Lorenc does not dispute timeline but denies leaking. Unverified until captured. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Techzine Global: \"PHP accuses Chainguard in PHP2shell\" — BLOCKED\n\n- Cloudflare challenge (403) at 2026-10-22T08:13Z. Snippet only (unverified): Chainguard CEO Dan Lorenc \"does not dispute the timeline but denies\" leaking; Chainguard says patched images were built overnight. Retry, and look for Lorenc's own posts on X/Bluesky.\n\n\n## Retry by claude-story-site, 22 Oct\n- Second attempt, same challenge page. The Register carries Lorenc's statements instead.\n\n\n## Retry by claude-story-site, 22 Oct\n- Second attempt, same challenge page. The Register carries Lorenc's statements instead.\n\n\n## Retry by claude-story-site, 22 Oct\n- Second attempt, same challenge page. The Register carries Lorenc's statements instead.\n" }, { "slug": "tek-sapo-opiniao-artigos-exposicao-de-portugal-ao-php2shell", "url": "https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/", "publisher": "SAPO Tek", "kind": "news", "title": "Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias", "published": "2026-10-22T07:50:00+00:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "121c973fd73d36bc65dfc31653a2ff19422a7b8e25d1f328f86411b7d8c3c77d", "bytes": 1738 }, "page.html": { "sha256": "8d41c37fca5cebfd108617002fc0317fffc002ca8c41b3b9a66fb17c2c45ba89", "bytes": 353947 }, "provenance.json": { "sha256": "5f6cbedc7a1d7e479d21d57a1c6ac4dff7f7f572029fd0e0f56a7405c4ba6e25", "bytes": 1778 }, "rendered.html": { "sha256": "72eded33521a415c81fd37e27d2afe80e2d4e2c4c14c08faad6584dbb4c0a2fc", "bytes": 373282 }, "screenshot.jpg": { "sha256": "83bdcf2750a1108c7ef489988c10baeed1011c19c18e79b17e3a7e86acf6e14d", "bytes": 902271 }, "text.txt": { "sha256": "7203d6e735dd3989c864ca946af9c9743d051148d4c016d9fc4c0af587b4023a", "bytes": 18453 } }, "started_utc": "2026-10-22T18:27:41.042Z", "status": 200, "final_url": "https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP serv", "raw_sha256": {}, "has_notes": true, "notes_md": "# Exposição de Portugal ao PHP2SHELL: Em trinta segundos - Tek Notícias\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: SAPO Tek. Language: pt. URL: https://tek.sapo.pt/opiniao/artigos/exposicao-de-portugal-ao-php2shell-em-trinta-segundos/\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nIn a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP servers (1,329 with no fix possible), the public school network is the biggest block, and twelve Évora district councils were patched within six hours. He also dates Portugal's CNCS alert to the night of 20 October.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta.json`), not the publisher's and not checked word for word by the curator.\n\n**number**: CyberS3c measured 391 Portuguese public-sector sites on 21 October: 58% show PHP, and 29 of the 66 that disclose a version run versions unsupported for six years on average.\n\n> A CyberS3c mediu nesse dia 391 sites do setor público: 58% mostram PHP, e dos 66 que dizem que versão usam, 29 correm versões sem suporte há seis anos em média.\n\n_Watch reader's translation:_ CyberS3c measured 391 public-sector sites that day: 58% show PHP, and of the 66 that say which version they use, 29 run versions that have been unsupported for six years on average.\n\n**number**: Shodan sees 2,339 Portuguese servers announcing PHP; 1,329 have no fix at all, only replacement, and the largest block is the public school network.\n\n> No país inteiro, o motor de pesquisa Shodan vê 2 339 servidores portugueses a anunciar PHP; para 1 329 deles não existe correção nenhuma, só substituição. O maior bloco é a rede das escolas públicas.\n\n_Watch reader's translation:_ Across the whole country, the Shodan search engine sees 2,339 Portuguese servers announcing PHP; for 1,329 of them there is no fix at all, only replacement. The largest block is the public schools network.\n\n**patching**: Twelve municipal councils in the Évora district were patched six hours after the fix because they share a professionally managed platform.\n\n> doze câmaras do distrito de Évora estavam corrigidas seis horas depois do patch, porque partilham uma plataforma gerida a sério.\n\n_Watch reader's translation:_ twelve councils in the Évora district were patched six hours after the patch, because they share a properly managed platform.\n\n**number**: W3Techs on 21 October: 74.4% of identifiable .pt sites run PHP and 66.1% of those with a CMS use WordPress; with about 490,000 active .pt domains, that suggests over 300,000 Portuguese PHP sites (an estimate).\n\n> Entre os sites com domínio .pt cuja tecnologia é identificável, 74,4% correm em PHP e 66,1% dos que têm gestor de conteúdos usam WordPress, segundo o W3Techs, a 21 de outubro de 2026.\n\n_Watch reader's translation:_ Among .pt domain sites whose technology is identifiable, 74.4% run on PHP and 66.1% of those with a content management system use WordPress, according to W3Techs, on 21 October 2026.\n\n**agency**: Portugal's CNCS issued an alert on the night of 20 October, after the Hacker News leak.\n\n> Nessa noite o CNCS português emitiu um alerta.\n\n_Watch reader's translation:_ That night the Portuguese CNCS issued an alert.\n\n**exploitation**: Cloudflare was already seeing first attacks at 07:43 on 21 October, before the patch.\n\n> Às 07h43 desse dia a Cloudflare já via os primeiros ataques, antes do patch.\n\n_Watch reader's translation:_ At 07:43 that day Cloudflare was already seeing the first attacks, before the patch.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in pt: In a TEK Sapo opinion piece, Sérgio Silva of CyberS3c measures Portugal's PHP2Shell exposure. He finds 58% of 391 public-sector sites show PHP and many run long-unsupported versions, Shodan sees 2,339 Portuguese PHP serv\n\nSupports: translations/pt/news/tek-sapo/opiniao-artigos-exposicao-de-portugal-ao-php2shell-em-trinta.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "tekno-kompas-read-2026-10-22-14200007-celah-keamanan", "url": "https://tekno.kompas.com/read/2026/10/22/14200007/celah-keamanan-php2shell-berpotensi-ancam-70-persen-website-di-dunia", "publisher": "Kompas Tekno", "kind": "news", "title": "Celah Keamanan \"PHP2Shell\" Berpotensi Ancam 70 Persen Website di Dunia", "published": "2026-10-22T07:20:00+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "be57a1f17765e3c44e6c6a1457049747db2e019af0e4f34f414e6654b9b5df2f", "bytes": 663 }, "page.html": { "sha256": "b74e3d916531af6183d1be10b934c10099192b15a101dcaa1801ec40e0544d79", "bytes": 461733 }, "provenance.json": { "sha256": "86bfa2166d3741bcc0ea87733ff54ed74e80a1ab3f774de2bb75e80cd72fee83", "bytes": 1835 }, "rendered.html": { "sha256": "fa66795523df91797133116303165637920b3438272437be7c46768eca1891eb", "bytes": 669227 }, "screenshot.jpg": { "sha256": "b2876f34e50b9cec375cdfc68acf27c8125045e3a8f227fe8e877ebeafbf3072", "bytes": 759278 }, "text.txt": { "sha256": "7af1dfc49a5f36532cb6e72872b80a670490e2a4dbc3a9879214a034b7953f49", "bytes": 9762 } }, "started_utc": "2026-10-23T16:16:42.030Z", "status": 200, "final_url": "https://tekno.kompas.com/read/2026/10/22/14200007/celah-keamanan-php2shell-berpotensi-ancam-70-persen-website-di-dunia" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Kompas Tekno (Indonesia), 22 October: PHP2Shell potentially threatens 70% of the world's websites. It stresses that W3Techs' figure of about 70% refer...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Celah Keamanan \"PHP2Shell\" Berpotensi Ancam 70 Persen Website di Dunia\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/tekno-kompas/read-2026-10-22-14200007-celah-keamanan-php2shell-berpotensi`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nKompas Tekno (Indonesia), 22 October: PHP2Shell potentially threatens 70% of the world's websites. It stresses that W3Techs' figure of about 70% refers to the share of sites with an identifiable server-side language that use PHP, not to the number confirmed vulnerable or attacked; cites Wiz Research's report of 21 October that the flaws are in PHP's core and allow remote code execution without authentication, and links to related coverage of government and hospital sites being closed. It is a general explainer.\n\n> Adapun angka 70 persen ini merujuk pada luasnya penggunaan PHP, bukan jumlah situs web yang dipastikan memiliki celah keamanan atau telah menjadi korban serangan siber.\n\n_Curator's translation:_ \"The figure of 70 percent refers to the wide use of PHP, not the number of websites confirmed to have the vulnerability or to have fallen victim to a cyber attack.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Kompas Tekno explainer based on Wiz Research (W3Techs 70%, RCE and memory disclosure, AI tools used). The related-article list includes local and regional headlines: BSSN warning, Japan cyber emergency and the Korean president ordering an investigation, Nepal government sites closed, government and hospital sites shut.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Celah Keamanan \"PHP2Shell\" Berpotensi Ancam 70 Persen Website di Dunia\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "teknoblog-php-icin-acil-guncelleme-iki-kritik-guve", "url": "https://www.teknoblog.com/php-icin-acil-guncelleme-iki-kritik-guvenlik-acigi-kapatildi/", "publisher": "Teknoblog", "kind": "news", "title": "PHP için acil güncelleme: İki kritik güvenlik açığı kapatıldı", "published": "2026-10-22T04:46:46+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "945cf5a3dd003094b28ea18c771b341d193b90ca2917c774716c2dc0c87806d0", "bytes": 901 }, "page.html": { "sha256": "a5489a0269aeda56ddf861b79e8903bd31c5c2b2bb55625016c4484cffff7aa6", "bytes": 121403 }, "provenance.json": { "sha256": "2ca89b7cb5bdc3689daddca7b059102a0d4ffcbe57021d27fc3f4eddc52bb880", "bytes": 1763 }, "rendered.html": { "sha256": "d8d938b6a75b08ed95fc31a155bbd28ef0eda8b0999f57a41d6dd3dc9e3a9306", "bytes": 286302 }, "screenshot.jpg": { "sha256": "012d3413ad57b38c8b06f321cbb9883cee263222f595c22de139de4f2d93d61d", "bytes": 412343 }, "text.txt": { "sha256": "dc5e41ea28b9ed6bc99d9a8b2fd1753679e2c8c23b9372ee1d65c07995bcb8ac", "bytes": 6306 } }, "started_utc": "2026-10-23T16:26:01.899Z", "status": 200, "final_url": "https://www.teknoblog.com/php-icin-acil-guncelleme-iki-kritik-guvenlik-acigi-kapatildi/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Teknoblog (Turkey, Turkish), 22 October: urgent PHP update for two critical flaws. It says the PHP team rates the risk for mod_php as particularly hig...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP için acil güncelleme: İki kritik güvenlik açığı kapatıldı\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/teknoblog/php-icin-acil-guncelleme-iki-kritik-guvenlik-acigi-kapatildi`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTeknoblog (Turkey, Turkish), 22 October: urgent PHP update for two critical flaws. It says the PHP team rates the risk for mod_php as particularly high because an attack can be triggered before application code runs; describes at a general level the two memory-handling causes; tells site managers that checking only the WordPress update list may not suffice because the PHP package can be the hosting provider's or server administrator's responsibility; that PHP 8.1 and earlier are outside regular support though some distributions and vendors may backport the fix; and that PHP 8.2's security support ends on 31 December 2026. No new facts.\n\n> Öte yandan PHP 8.2 için de destek takvimi daralıyor. Bu dalın güvenlik desteği 31 Aralık 2026 tarihinde sona erecek.\n\n_Curator's translation:_ \"On the other hand, the support calendar for PHP 8.2 is also narrowing. This branch's security support will end on 31 December 2026.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Teknoblog explains the php.net advisory: fixed versions, affected SAPIs (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed) and the higher risk for mod_php. It notes that PHP 8.2 security support ends on 31 December 2026.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP için acil güncelleme: İki kritik güvenlik açığı kapatıldı\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "teknofilo-php2shell-fallos-php-cierre-webs-actuali", "url": "https://www.teknofilo.com/php2shell-fallos-php-cierre-webs-actualizacion/", "publisher": "Teknófilo", "kind": "news", "title": "PHP2Shell: fallos críticos de PHP provocan cierres de webs", "published": "2026-10-22T09:43:02+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "60923e8a376cdaaec315cf058ecf0a866ec1cb0e8e4fb4975827bdacc60e279a", "bytes": 918 }, "page.html": { "sha256": "9cf6f961639109ec2b75185b0aa1297bffd9a067064d691eb25591975d8b4c9c", "bytes": 285494 }, "provenance.json": { "sha256": "2e1464cb1c69abdb9fe4a84b967a3c0d37574f11d81da4f1309e994d873fd8e9", "bytes": 1546 }, "text.txt": { "sha256": "7a39ad9839af226a96cdb6cddbce5c9a5575c4fa4718543567d1ffd1b0332a8a", "bytes": 10573 } }, "started_utc": "2026-10-23T16:09:21.662Z", "status": 200, "final_url": "https://www.teknofilo.com/php2shell-fallos-php-cierre-webs-actualizacion/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "es", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Teknófilo (Spain, Spanish), 22 October, by Luis A.: two critical PHP flaws led to services being disconnected preventively while owners applied the fi...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: fallos críticos de PHP provocan cierres de webs\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/teknofilo/php2shell-fallos-php-cierre-webs-actualizacion`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTeknófilo (Spain, Spanish), 22 October, by Luis A.: two critical PHP flaws led to services being disconnected preventively while owners applied the fixes. It says the updates were published on 21 October, that the flaw sits in the engine so it can reach sites whose code and CMS are up to date, that both CVEs score 9.2 and allow remote code execution without logging in under some conditions, that the UK NCSC advisory explains the memory-management and failure-handling causes, and, citing Wiz, that process memory (passwords, tokens, access keys) can be read. No new facts.\n\n> Dos vulnerabilidades críticas de PHP, conocidas como PHP2Shell, han llevado a desconectar servicios de forma preventiva mientras sus responsables aplicaban las correcciones.\n\n_Curator's translation:_ \"Two critical PHP vulnerabilities, known as PHP2Shell, have led to services being disconnected preventively while their owners applied the fixes.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Teknofilo explains PHP2Shell, why WordPress sites are exposed, and which versions fix it. It covers the Dutch government's shutdown of Overheid.nl, MijnOverheid.nl and DigiD, Wikimedia's Cloud VPS/Toolforge outage, and AWS's early detection.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: fallos críticos de PHP provocan cierres de webs\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `es`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "teknologi-bisnis-read-20261023-84-2015221-pengamat-ingatk", "url": "https://teknologi.bisnis.com/read/20261023/84/2015221/pengamat-ingatkan-komdigi-mitigasi-kerentanan-php-tak-boleh-sebatas-imbauan", "publisher": "Bisnis Tekno", "kind": "news", "title": "Pengamat Ingatkan Komdigi, Mitigasi Kerentanan PHP Tak Boleh Sebatas Imbauan", "published": "2026-10-23T19:15:37+07:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "d42441c34ffe5994bc58f57d75b61bd82ba57f6d35ca45d4427ac95502b4ea4e", "bytes": 846 }, "page.html": { "sha256": "a44e6590cca02eae0d7584028479ebcfbb0266b0e195b46639c9d4400448beba", "bytes": 155437 }, "provenance.json": { "sha256": "3122e6ed0597e5d6d6ea3638465dca599911a32e2f1e51fcc742a09b1a8804b7", "bytes": 1870 }, "rendered.html": { "sha256": "f04d347c528bc8f6844c68845f79cfae00f1680fbdeb77470a71a75a3da89dd2", "bytes": 165004 }, "screenshot.jpg": { "sha256": "016615053f95f18d279ddd5b1b1ab024310a9b5648c917c16c087837df1db4ba", "bytes": 544731 }, "text.txt": { "sha256": "61bc489ad7a99ae3e8b91b36925996917c2b7ed0f1c81c89cf4cba8f53ed8746", "bytes": 8168 } }, "started_utc": "2026-10-24T08:49:56.893Z", "status": 200, "final_url": "https://teknologi.bisnis.com/read/20261023/84/2015221/pengamat-ingatkan-komdigi-mitigasi-kerentanan-php-tak-boleh-sebatas-imbauan" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id-ID", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Bisnis Tekno (Indonesia), 23 October, by Bisnis.com: Komdigi (the Ministry of Communication and Digital) asked users of National Data Center (PDN) 1 t...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Pengamat Ingatkan Komdigi, Mitigasi Kerentanan PHP Tak Boleh Sebatas Imbauan\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/teknologi-bisnis/read-20261023-84-2015221-pengamat-ingatkan-komdigi-mitigasi`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nBisnis Tekno (Indonesia), 23 October, by Bisnis.com: Komdigi (the Ministry of Communication and Digital) asked users of National Data Center (PDN) 1 to update PHP after the PHP2Shell flaws; the cyber-security researcher Pratama Persadha (CISSReC) says that is right but late, and should not stop at a voluntary appeal, since the ministry's letter takes the form of a letter and not an obligation with a deadline and verification. He cites Censys data at announcement showing about 1.5 million of 2.6 million PHP hosts on the internet unpatched, and welcomes that the letter names the safe versions, prioritises internet-facing public servers and allows temporarily switching off services that cannot be patched.\n\n> Pratama juga mengutip data Censys saat kerentanan diumumkan, yang menunjukkan sekitar 1,5 juta dari 2,6 juta host PHP di internet belum ditambal.\n\n_Curator's translation:_ \"Pratama also cited Censys data from when the vulnerability was announced, showing that about 1.5 million of 2.6 million PHP hosts on the internet had not been patched.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Pengamat Ingatkan Komdigi, Mitigasi Kerentanan PHP Tak Boleh Sebatas Imbauan\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id-ID`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "teknotalk-php2shell-acigi-kron-teknoloji-guvenlik", "url": "https://www.teknotalk.com/php2shell-acigi-kron-teknoloji-guvenlik-uyarisi-212051/", "publisher": "TeknoTalk", "kind": "news", "title": "PHP2Shell Açığı Nedir? Kron Teknoloji’den Kritik Güvenlik Uyarısı!", "published": "2026-10-23 15:20 (page time zone not stated)", "captures": [ { "stamp": "20261024T133450Z", "files": { "headers.json": { "sha256": "dbbee7fa3069de9cbe38fee9a3f9428cb1602ed0574755d92647881e2d35a52a", "bytes": 1099 }, "page.html": { "sha256": "36162fa3fa246b1ad6740bec20c60e0cb68f04e3299c6fdf0ad39f48c6823d51", "bytes": 78597 }, "provenance.json": { "sha256": "d3d5e35f1beccedecba3bb985065693f89c96206273b33728fd2d265bf5a7aee", "bytes": 1742 }, "rendered.html": { "sha256": "229642c0c9abc984d74e4398bf010044a4adbf1c8f7a4b98d1540430564ba623", "bytes": 240672 }, "screenshot.jpg": { "sha256": "2dae78b8086411fb2d55ef27d45084de9c1c4ff0c7ac593ead93726fb1908312", "bytes": 442720 }, "text.txt": { "sha256": "2afa927191f5f8922dc1ebff0c10a8372d40279073d72827a2d000ac4360f5c5", "bytes": 5007 } }, "started_utc": "2026-10-24T13:58:07.772Z", "status": 200, "final_url": "https://www.teknotalk.com/php2shell-acigi-kron-teknoloji-guvenlik-uyarisi-212051/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). TeknoTalk (Turkey, Turkish), 23 October: a piece built round a statement from the Turkish security firm Kron Teknoloji, which stresses that after patc...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Açığı Nedir? Kron Teknoloji’den Kritik Güvenlik Uyarısı!\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/teknotalk/php2shell-acigi-kron-teknoloji-guvenlik-uyarisi-212051`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTeknoTalk (Turkey, Turkish), 23 October: a piece built round a statement from the Turkish security firm Kron Teknoloji, which stresses that after patching, organisations should review who and what can reach critical systems (limited, logged privileged access and monitored critical sessions) to limit the effect of an attack. It says Turkey's Presidency Cyber Security Directorate started a national-scale security scan over the two PHP flaws, announced that nothing had been found affecting e-Devlet, and called on the public and private sectors to check their PHP and apply updates. The vendor's product pitch is not recorded.\n\n> Siber Güvenlik Başkanlığı, e-Devlet hizmetlerinin güvenliğini olumsuz etkileyen herhangi bir durum tespit edilmediğini açıklarken, kamu ve özel sektöre kullandıkları PHP altyapılarını kontrol etmeleri ve güvenlik güncellemelerini vakit kaybetmeden uygulamaları çağrısında bulundu.\n\n_Curator's translation:_ \"While the Cyber Security Directorate announced that nothing had been found to adversely affect the security of e-Devlet services, it called on the public and private sectors to check their PHP infrastructure and apply security updates without delay.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Açığı Nedir? Kron Teknoloji’den Kritik Güvenlik Uyarısı!\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "telesurenglish-php2shell-vulnerabilities", "url": "https://www.telesurenglish.net/php2shell-vulnerabilities/", "publisher": "teleSUR English", "kind": "news", "title": "PHP2Shell Crisis: 2 Critical Flaws Put 70% of Websites at Risk - teleSUR English", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "b5bf418e8f7a4753c95a7dff0c621d50fefa528d2c448c86d4b43a724f1f2079", "bytes": 1227 }, "page.html": { "sha256": "fe0ddb6162ea441d8bf8609df7299ee43107fb5547abbf44fa8f4d35f209fdd4", "bytes": 266548 }, "provenance.json": { "sha256": "8ca9e8a35a23c6de03bc7d7b441ecd379f1c8426a215bab2ee0b2039341966a6", "bytes": 1641 }, "rendered.html": { "sha256": "6532d8704935b744e94a431c096d257cf9da6d09d578f250dcd5bfae0024b894", "bytes": 533492 }, "screenshot.jpg": { "sha256": "0c5395be653ab916048e1c2878f0e8f0480025192a61beff28e1f5fd3b9a6412", "bytes": 910018 }, "text.txt": { "sha256": "6efd752b24f540730043417e4f8e1837289ad08b2351a62e22a4bc2bdc3e8ad6", "bytes": 13719 } }, "started_utc": "2026-10-25T09:55:29.061Z", "status": 200, "final_url": "https://www.telesurenglish.net/php2shell-vulnerabilities/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). teleSUR English: PHP2Shell crisis, two critical flaws put 70% of websites at risk. The PHP Foundation released emergency patches after technical detai...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Crisis: 2 Critical Flaws Put 70% of Websites at Risk - teleSUR English\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `sk/news/telesurenglish/php2shell-vulnerabilities`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nteleSUR English: PHP2Shell crisis, two critical flaws put 70% of websites at risk. The PHP Foundation released emergency patches after technical details leaked online; the flaws allow unauthenticated remote code execution, prompting emergency patches, mass attacks and global website shutdowns.\n\n> The PHP Foundation released emergency patches for two critical PHP2Shell vulnerabilities after technical details leaked online.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Crisis: 2 Critical Flaws Put 70% of Websites at Risk - teleSUR English\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "telset-laptop-pc-dua-celah-kritis-php-bocor-seb", "url": "https://telset.id/laptop-pc/dua-celah-kritis-php-bocor-sebelum-patch-situs-web-terancam", "publisher": "Telset.id", "kind": "news", "title": "Dua Kerentanan Kritis PHP Bocor Sebelum Patch Dirilis | Telset.id", "published": "2026-10-22T00:01:37", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d6548b34b56836fbcf7759404a269f06ca5cf591cc3d6c5f0f26ae5feffc6532", "bytes": 1783 }, "page.html": { "sha256": "bc7715e659768ef71feb1740c4bfa735480a4c2b7ca0f56c439e0243fc716ba9", "bytes": 130239 }, "provenance.json": { "sha256": "c99492c1cf4aea28da47e3d69b0ba45d7140d70a7e5588e64eb64fd5db204352", "bytes": 1749 }, "rendered.html": { "sha256": "f0b452131392e31b60b2f2d29590caca7696b0919e5bfdf9392a0d3b8b87d2cc", "bytes": 134514 }, "screenshot.jpg": { "sha256": "e215e09df169dcd602d107c91631f54bb8d94e228c43133bd5c0a104b0670f52", "bytes": 661474 }, "text.txt": { "sha256": "815181e03b96f48f774618be7dc381ea2439fcf490651d45d27f45e661d334b2", "bytes": 7843 } }, "started_utc": "2026-10-23T16:16:43.832Z", "status": 200, "final_url": "https://telset.id/laptop-pc/dua-celah-kritis-php-bocor-sebelum-patch-situs-web-terancam" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Telset.id (Indonesian), 22 October: two critical PHP flaws leaked before the patch, via the Hacker News forum. It says PHP's advisory announced a patc...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Dua Kerentanan Kritis PHP Bocor Sebelum Patch Dirilis | Telset.id\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/telset/laptop-pc-dua-celah-kritis-php-bocor-sebelum-patch-situs-web`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTelset.id (Indonesian), 22 October: two critical PHP flaws leaked before the patch, via the Hacker News forum. It says PHP's advisory announced a patch at 14:00 UTC on Wednesday 21 October for two flaws rated 9.2 on CVSS 4.0, that the flaws are expected to affect PHP versions 5 to 8, that PHP reserved the right to release earlier if details of either became public or active exploitation appeared, and that no active exploitation had been reported at the time.\n\n> PHP juga menyatakan pihaknya berhak merilis lebih awal apabila detail salah satu kerentanan menjadi publik atau muncul bukti eksploitasi aktif di lapangan.\n\n_Curator's translation:_ \"PHP also stated that it reserves the right to release earlier if details of one of the vulnerabilities become public or evidence of active exploitation appears in the field.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Telset rewrite of BleepingComputer's pre-release story: details leaked via Hacker News (user 'petecooper') and Florian Roth's X post, watchTowr confirmed, the patch was due 21 Oct 14:00 UTC, and there was no active exploitation yet.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Dua Kerentanan Kritis PHP Bocor Sebelum Patch Dirilis | Telset.id\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tenable-php2shell-faq", "url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "publisher": "Tenable", "kind": "vendor", "title": "php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112331Z", "files": { "headers.json": { "sha256": "5ddfb8ebd67d5b056190eb932bd7230be55b6dcec36b71da7591e9ff3ef787e9", "bytes": 1390 }, "page.html": { "sha256": "0f90e53e8a45f385d5e14f7493f1aa99aff8d34b7405ed43d70a3534381dd264", "bytes": 274325 }, "provenance.json": { "sha256": "f1f23ada9af900931c49744b7cb544a8b730ec5038bd6637c3a3b521f095c4d6", "bytes": 1155 }, "rendered.html": { "sha256": "bbc941dd99bd25fbb24457889bb89c0cd2213187cc104c491b15a86ad1167425", "bytes": 469247 }, "screenshot.png": { "sha256": "fb42572ffc60b269206740e6d85216b9fa06d7226bfb49682d148b44740c897c", "bytes": 2222099 }, "text.txt": { "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "bytes": 16528 } }, "started_utc": "2026-10-22T11:23:31.380Z", "status": 200, "final_url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote" }, { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "1d02381084191d6534f0983e1c7a9f34065d722a633b924b9d5f4ab911f53790", "bytes": 1459 }, "page.html": { "sha256": "c231dd15491a108f1ace260f414fb4d60d4f4d42763f7c4aa7813c8a7170de79", "bytes": 273785 }, "provenance.json": { "sha256": "c31c494b31128bda6983281792f57d8f98477983b9afa9810176bfa94e7a74d4", "bytes": 1875 }, "rendered.html": { "sha256": "d755e9f15fdceebffb5e603cca452d77d6a11085e45d792a961c59602842ff85", "bytes": 463959 }, "screenshot.jpg": { "sha256": "fd220e0c7ad0bd16ea40637a14d213d69ed25dbf59b1729c084677c6c15697fb", "bytes": 712844 }, "text.txt": { "sha256": "7cc4ddb02c3fbb29a56167a1dd773f3166ea426fed07f8ce4ca27c3b95497359", "bytes": 15649 } }, "started_utc": "2026-10-23T08:27:36.799Z", "status": 200, "final_url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor FAQ; notes Cloudflare's rules cover only traffic routed through Cloudflare.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®\n\nCaptured by claude-story-site. Status: captured. Vendor FAQ; notes Cloudflare's rules cover only traffic routed through Cloudflare.\n\n- Captured for the record.\n" }, { "slug": "tgrthaber-ekonomi-php2shell-alarmi-sifre-bile-gere", "url": "https://www.tgrthaber.com/ekonomi/php2shell-alarmi-sifre-bile-gerekmiyor-milyonlarca-liralik-kayip-riski-3366771", "publisher": "TGRT Haber", "kind": "news", "title": "PHP2Shell alarmı: Şifre bile gerekmiyor! Milyonlarca liralık kayıp riski | TGRT Haber", "published": "2026-10-22T09:56:58+03:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "eace79478b0038d5c3279bb4f4b581008c4ac9b0bcc87bf7c4002cfe69aa9d66", "bytes": 939 }, "page.html": { "sha256": "c06a0c0aaf589cb9ed9609591e97419b9eca1ca4fab60be45add56beb4c3161e", "bytes": 174564 }, "provenance.json": { "sha256": "4d02c7df50e49917eb13c3188e6f5a96dde3bc438b5d67e7171897388ea85870", "bytes": 1835 }, "rendered.html": { "sha256": "410acc4f891d7d19af570c908afe4a7cd77c88db684ba0f6d2030b0948c1da1e", "bytes": 283922 }, "screenshot.jpg": { "sha256": "a8015eba5233f3061a72d97e1d773b64a19f249d0eb5c6a8ab88f60f58f823bc", "bytes": 609528 }, "text.txt": { "sha256": "99c900097bdc9f6ef203ef48517c51370b847192d9939da1fa0b4aeb016be2b6", "bytes": 9360 } }, "started_utc": "2026-10-23T16:26:02.393Z", "status": 200, "final_url": "https://www.tgrthaber.com/ekonomi/php2shell-alarmi-sifre-bile-gerekmiyor-milyonlarca-liralik-kayip-riski-3366771?s=6" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). TGRT Haber (Turkey, Turkish), 22 October, by Bengü Sarıkuş: PHP2Shell alert, 'not even a password needed', with the economist Necmettin Batırel explai...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell alarmı: Şifre bile gerekmiyor! Milyonlarca liralık kayıp riski | TGRT Haber\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/tgrthaber/ekonomi-php2shell-alarmi-sifre-bile-gerekmiyor-milyonlarca-l`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTGRT Haber (Turkey, Turkish), 22 October, by Bengü Sarıkuş: PHP2Shell alert, 'not even a password needed', with the economist Necmettin Batırel explaining the economic risks. It says the flaw is claimed to affect about 70% of websites, is regarded as one of the most serious crises of the last ten years, and could let attackers run commands remotely within seconds without a password. Opinion and explanation; no new facts.\n\n> Ekonomist Necmettin Batırel, Tgrthaber.com Özel Haber Şefi Bengü Sarıkuş’a riskin boyutlarını açıkladı.\n\n_Curator's translation:_ \"The economist Necmettin Batırel explained the scale of the risk to Tgrthaber.com Special News Chief Bengü Sarıkuş.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell alarmı: Şifre bile gerekmiyor! Milyonlarca liralık kayıp riski | TGRT Haber\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "thansettakij-economy-672045", "url": "https://www.thansettakij.com/economy/672045", "publisher": "ฐานเศรษฐกิจ", "kind": "news", "title": "“ภราดร” สั่ง สกมช.รับมือด่วน ช่องโหว่ไซเบอร์วิกฤต “PHP2Shell”", "published": "2026-10-22 10:40 (page time zone not stated)", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "c50997c11f6a1896101ad38eb4fac68bd75d8c7efb788944eaab70a95648c8a9", "bytes": 901 }, "page.html": { "sha256": "974c565123ffb789af65f63beb0e32698d49e4709db196f5b3375dfc4b604ec6", "bytes": 202451 }, "provenance.json": { "sha256": "efb05d24e7a7636dbd7b8c5a3b746972fb65f03d9c05456b27892cdd5854f473", "bytes": 1650 }, "rendered.html": { "sha256": "98a1533a938f74767348e8499b1f77c978a3f2b339c34673a29d770522828ef3", "bytes": 551319 }, "screenshot.jpg": { "sha256": "58a2ffe86aae0b63d7a3199b2bbf08501922dc6b7f99c06ab652fa5efaa17b8b", "bytes": 405388 }, "text.txt": { "sha256": "782fad1c4851da1e591adfbebd727405665fb11f56c3caa78c3c5a832ac48f24", "bytes": 11900 } }, "started_utc": "2026-10-23T16:25:13.686Z", "status": 200, "final_url": "https://www.thansettakij.com/economy/672045" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "th", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Thansettakij (Thailand, Thai), 22 October, by Metha Sakawarat: Minister Pharadon Prissananantakul, who oversees the National Cyber Security Agency (NC...", "raw_sha256": {}, "has_notes": true, "notes_md": "# “ภราดร” สั่ง สกมช.รับมือด่วน ช่องโหว่ไซเบอร์วิกฤต “PHP2Shell”\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `th/news/thansettakij/economy-672045`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThansettakij (Thailand, Thai), 22 October, by Metha Sakawarat: Minister Pharadon Prissananantakul, who oversees the National Cyber Security Agency (NCSA), directed the NCSA to watch for and respond to the critical 'PHP2Shell' flaws; NCSA's ThaiCERT immediately issued a warning to relevant bodies nationwide and raised monitoring. It asks public bodies, organisations and administrators using PHP to inventory their PHP versions (internet-facing systems first), patch as the developer advises, and watch for attacks. Same event as the Post Today item (posttoday-ai-today-750820).\n\n> สกมช. โดยศูนย์ประสานการรักษาความมั่นคงปลอดภัยระบบคอมพิวเตอร์แห่งชาติ (ThaiCERT) ได้ออกประกาศแจ้งเตือนหน่วยงานที่เกี่ยวข้องทั่วประเทศทันที\n\n_Curator's translation:_ \"The NCSA, through the National Computer Emergency Response Team (ThaiCERT), immediately issued a warning to relevant agencies nationwide.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Thansettakij: Minister Paradorn ordered the NCSA to monitor and respond to PHP2Shell on 22 Oct. ThaiCERT issued alerts to agencies nationwide and raised monitoring, focusing on high-risk systems and critical services. It lists three recommended steps.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"“ภราดร” สั่ง สกมช.รับมือด่วน ช่องโหว่ไซเบอร์วิกฤต “PHP2Shell”\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `th`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "the-next-web-php2shell-no-confirmed-breaches", "url": "https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches", "publisher": "The Next Web", "kind": "news", "title": "Millions of PHP2Shell attempts so far, but officials see no break-in", "published": "2026-10-22T13:03:23+00:00", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "e6d8d4adb500bd8557202df5e2ea5efa0d422e74d385a5e8bbfbada2dc2f9ede", "bytes": 6339 }, "page.html": { "sha256": "c51dfb0561b1bdb2cd0a5691a16ffc394908928d2deab03e90047ca1b6311bdb", "bytes": 187527 }, "provenance.json": { "sha256": "a0b248b887c69f899d2340dd7db5144b7abcc3350ea0ea1e7b86f45cd08ee9a0", "bytes": 1561 }, "text.txt": { "sha256": "75d67773b979aa86ec9f32e1690fa2d13b8d5905d6cfac239cfcd9331d8c17dc", "bytes": 5405 } }, "started_utc": "2026-10-24T08:57:42.230Z", "status": 200, "final_url": "https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches" }, { "stamp": "20261026T144241Z", "files": { "headers.json": { "sha256": "d25dd24f8d29924470539e32aaa05c6719f75b8570a04b0f9c9647aaddfbc0c2", "bytes": 6345 }, "page.html": { "sha256": "ef3ae17b691a80753192168b50d6366320e28372b2e63c4233944b20360a3486", "bytes": 189404 }, "provenance.json": { "sha256": "17f4ffeeba9bd7c94cd3660105456fc8affebf6d0efc0092bf6ebf17e57f1677", "bytes": 1894 }, "rendered.html": { "sha256": "19f486164f9d5b7f0db6674db8f8763c2fab35121fda2a664ac8fd587fd05c1c", "bytes": 190051 }, "screenshot.jpg": { "sha256": "e7abf2251964d740c5ded80439f4870a8e58b088aa3449880b15236a9a0aa824", "bytes": 413869 }, "text.txt": { "sha256": "b496a4c63a57ddc8b4b3dcf43b9ce24f16d349b6160ddff80c2d1ac4fb63c252", "bytes": 5407 } }, "started_utc": "2026-10-26T14:45:44.006Z", "status": 200, "final_url": "https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). The Next Web, 22 October: millions of PHP2Shell attempts so far, but officials see no break-in. Cloudflare's chief executive, Matthew Prince, said on...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Millions of PHP2Shell attempts so far, but officials see no break-in\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `nl/tech-press/the-next-web/php2shell-no-confirmed-breaches`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Next Web, 22 October: millions of PHP2Shell attempts so far, but officials see no break-in. Cloudflare's chief executive, Matthew Prince, said on X that across Cloudflare's network there were thousands of attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions by then. Officials in Germany, the Netherlands and Japan say they have not seen one succeed.\n\n> Hackers have made millions of attempts to exploit PHP2Shell since Wednesday’s disclosure, Cloudflare’s chief executive, Matthew Prince, said on X.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"Millions of PHP2Shell attempts so far, but officials see no break-in\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "the-register-hackers-pile-on-php2shell", "url": "https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749", "publisher": "The Register", "kind": "news", "title": "Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure", "published": "2026-10-22T12:15Z (page metadata)", "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "3cfdc7a18e4e95df52e618a5577820ba9581c24d8855b4d3aecd33ff83bcc675", "bytes": 681 }, "page.html": { "sha256": "148ef10bfbb853f07c9a557ad0fcdcc0e9f426031b2db8b35ef02eb74e388e48", "bytes": 177151 }, "provenance.json": { "sha256": "1ec8e239956f02724e1a998759c4233e281a4bec4a595c22bba308b9d01a7171", "bytes": 1787 }, "rendered.html": { "sha256": "38861fc6b57607a8dfa8f014cad3832159f9b54efa5f873ba6a8fc63016cfe23", "bytes": 191595 }, "screenshot.jpg": { "sha256": "770a3106cd4f7fc29127787f5dd14f505c0c3919890e7ed4466f4e5ab5a8e3b6", "bytes": 717098 }, "text.txt": { "sha256": "84de32feb23a6eb85ee2770c86b383a8219f0adcf22756f9b38c00a680f09a13", "bytes": 9167 } }, "started_utc": "2026-10-23T01:28:32.047Z", "status": 200, "final_url": "https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): Hadrian \"exploit...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `gb/tech-press/the-register/hackers-pile-on-php2shell`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: The Register. Language: en. URL: https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Register: Amazon Threat Intelligence detected an attempt to exploit PHP2Shell on 17 October, four days before patches, through MadPot, its honeypot network, from an anonymised IP address; Amazon says it is unclear how the actor got exploit information under embargo. Hadrian reported on 21 October that PHP2Shell was being \"exploited in the wild at scale\". The article reports attempts; it names no organisation as compromised.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): Hadrian \"exploited in the wild at scale\"\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "the-verge-php2shell-websites-down", "url": "https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down", "publisher": "The Verge", "kind": "news-live", "title": "Everything we know so far about the PHP2Shell vulnerability | The Verge", "published": "2026-10-22T15:12:27Z (modified 16:49:48Z, per the page's metadata)", "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "72488aee5271c869c30dbc34fd1f73be05596b76500d2d7c01afbd7b5b326334", "bytes": 1261 }, "page.html": { "sha256": "f55d379b157610b1272175bd8026288fe5bac8641b3baaf66e69bb6ebf9a784f", "bytes": 270997 }, "provenance.json": { "sha256": "f1547601bdcc8989fbbe161f438dfc162581a8ba708a13b4d8ece17d4f022eff", "bytes": 1677 }, "rendered.html": { "sha256": "4dce1bbf4c543244209fdb9ff0730f6ddf7ed9b7e83ef7a59372e028ca555129", "bytes": 464122 }, "screenshot.jpg": { "sha256": "8b53a0fc3da806d09328a78fdf251eea67a748f0ac8bda9783fafee8fa05603a", "bytes": 591159 }, "text.txt": { "sha256": "1a9a20537e477cc84bdd688c3d13f165e980a7bae0aa54bd2f88011d32d3b3d3", "bytes": 8601 } }, "started_utc": "2026-10-23T01:38:55.153Z", "status": 200, "final_url": "https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation E...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Everything we know so far about the PHP2Shell vulnerability | The Verge\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/tech-press/the-verge/php2shell-websites-down`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: The Verge. Language: en. URL: https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Verge's running explainer. Its headline says the vulnerabilities \"were exploited days before the patch\"; the body says hackers \"attempted to exploit\" them, citing Amazon's 17 October honeypot detection. PHP Foundation executive director Elizabeth Barron told The Verge that \"to our knowledge, there has been no successful attempt at remote\" code execution. Cloudflare CEO Matthew Prince: thousands of attempts in the 10 hours before the announcement, hundreds of thousands in the two hours after, millions by the next night. It also says the patch was released at 10AM ET, that two Japanese mobile games (World Quest, Save My Demonic World) are shutting down because they cannot be updated (via Kotaku), and cites watchTowr that every PHP version from PHP 5 onward is reportedly affected.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation ED: \"to our knowledge, there has been no successful attempt at remote code execution\"\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "the420-php2shell-critical-vulnerabilities-cve-2", "url": "https://the420.in/php2shell-critical-vulnerabilities-cve-2026-109618-cve-2026-109619/", "publisher": "The420.in", "kind": "news", "title": "PHP2Shell Alert: Two Critical 9.2-Rated Flaws Put PHP Servers on High Alert - The420.in", "published": "2026-10-23T05:47:10+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9842e6aa0dbf52c52bbb8cc3fdf5e7e0a1101470b98c5d8f0995b012c162c394", "bytes": 908 }, "page.html": { "sha256": "41a9edaa576abcb3c6d76cd4681335e3db644cef861940d3ac1369cbe391df75", "bytes": 127752 }, "provenance.json": { "sha256": "f059b1b3cd2ba2598603cdaaf6b860b641e1c41774abf92c1da3aa5635b2f7d2", "bytes": 1763 }, "rendered.html": { "sha256": "48f4d57b1e323d8cd251901d6cca64e42b9ca544eab33a8d07599e56f813f7e5", "bytes": 142903 }, "screenshot.jpg": { "sha256": "6dd31a1080ee573994d0b65a949239ba6e1f01b2d1a68320efef20e8a8c74f47", "bytes": 629801 }, "text.txt": { "sha256": "b04078d220da16a820c7c3fff6b6b572df24270cefc82538612e11d4de7a8166", "bytes": 9089 } }, "started_utc": "2026-10-23T16:17:29.029Z", "status": 200, "final_url": "https://the420.in/php2shell-critical-vulnerabilities-cve-2026-109618-cve-2026-109619/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). The420.in, 23 October: two critical 9.2-rated flaws put PHP servers on high alert. The updates were scheduled for 21 October at 14:00 UTC; the page no...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Alert: Two Critical 9.2-Rated Flaws Put PHP Servers on High Alert - The420.in\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `in/news/the420/php2shell-critical-vulnerabilities-cve-2026-109618-cve-2026`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe420.in, 23 October: two critical 9.2-rated flaws put PHP servers on high alert. The updates were scheduled for 21 October at 14:00 UTC; the page notes that early public discussion included a proof-of-concept repository with verification tools and a lab environment, and that Cloudflare reported early attempts after details surfaced. No repository was fetched.\n\n> Early public discussion has included a proof-of-concept repository containing verification tools and a laboratory environment associated with PHP2Shell.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Alert: Two Critical 9.2-Rated Flaws Put PHP Servers on High Alert - The420.in\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "thehackernews-php2shell-4days", "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "publisher": "The Hacker News (Ravie Lakshmanan)", "kind": "news", "title": "Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed", "published": "2026-10-22", "captures": [ { "stamp": "20261022T081320Z", "files": { "headers.json": { "sha256": "54c094189f50f4afa3962d0e484ef93cf0f92bd1fefb71ae2fec7e63b71b3b14", "bytes": 783 }, "page.html": { "sha256": "b2b51b3736eab8ebf9fb584770654a563ec0cde9a258c8ccc9b2cac5e2759495", "bytes": 181180 }, "provenance.json": { "sha256": "ef03914e372ab683b87cf258b84ec703ba5cc140e8b724fe1fa547d0f7a066fe", "bytes": 1081 }, "rendered.html": { "sha256": "a7caeb00fddc406d6dcfeb68c7fdce453fdb39446eb83daa364cb3f2986a7834", "bytes": 176478 }, "screenshot.png": { "sha256": "71b28408de124895b1534822f79eff33a445be5296c09203d51f152ef67d089c", "bytes": 2255956 }, "text.txt": { "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "bytes": 12295 } }, "started_utc": "2026-10-22T08:13:20.228Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "421a40b8b01bedb96dc2f965ab732985b9acdfe566cb1046ac4522f6b5ce82a7", "bytes": 854 }, "page.html": { "sha256": "ef230d20b5059df376ebaca22a0031d7d1cb8b1bde9736da35073b93c319a3d7", "bytes": 186319 }, "provenance.json": { "sha256": "30680a19ac8a0b6c34a81631234187928f82c134b8a42f79dc7534efcd056463", "bytes": 1839 }, "rendered.html": { "sha256": "1426a64bb1181ef901405314bec3c221608a0d215a92c84dedf3b88febfc4896", "bytes": 183052 }, "screenshot.jpg": { "sha256": "139266d86df524fb02573a64129c85fa1e62866024c1aad8ffae1af2f86ae158", "bytes": 742596 }, "text.txt": { "sha256": "0c31fcebda310760b15f83418566d5bd2e63ebaffa0b93669443fb6f970efe31", "bytes": 12859 } }, "started_utc": "2026-10-23T16:17:31.610Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html" } ], "status": "captured", "primary": false, "added_by": "collector-researchers", "notes": "Dated Oct 22, 2026. Quotes Amazon CISO CJ Moses ('post shared with The Hacker News'): MadPot honeypot exploit attempt Oct 17 2026 from anonymization network IP geolocated to Australia; PoC attempts from ~02:00 UTC Oct 21. Says 'details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time' — contrast PHP Foundation 'No technical details leaked'. VulnCheck: PHP on 2,608,039 internet-facing hosts.", "raw_sha256": {}, "has_notes": true, "notes_md": "# The Hacker News: Amazon saw a PHP2Shell exploit attempt 4 days before disclosure\n\n- Ravie Lakshmanan, Oct 22, 2026. Captured 08:13:20Z.\n- CJ Moses (CISO, Amazon Integrated Security), \"in a post shared with The Hacker News\": \"The exploit attempt originated from an IP address associated with a commercial anonymization network ... While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.\" Date Oct 17, 2026, MadPot; IP geolocated to Australia (IOC omitted here).\n- Amazon: PoC attempts from ~02:00 UTC Oct 21, then six hours of attempts from anonymised infrastructure; \"multiple threat actors\".\n- ELLIO: first sensor hit Oct 21 08:36 UTC.\n- Leak wording differs: THN says \"details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time\"; PHP Foundation said \"No technical details leaked\" (with the CVE IDs), the video came later.\n- Size: VulnCheck counts PHP on 2,608,039 internet-facing hosts — a far smaller, host-based number than \"70% of websites\" or \"30 million websites\".\n- Primary AWS post not yet found (THN does not link one). The AWS Security Blog post is still to be located.\n" }, { "slug": "thehackernews-php2shell-unpatched-alert", "url": "https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html", "publisher": "The Hacker News", "kind": "news", "title": "PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert", "published": "2026-10-20", "captures": [ { "stamp": "20261022T113144Z", "files": { "headers.json": { "sha256": "504e60a31ad0c0649db5fe4d0560bcb64bcea39e2c5d8b374dd60c86235937fb", "bytes": 783 }, "page.html": { "sha256": "b8297488c796fba8c0c46fbb558121433294b8f8991c457777efa33409b6634e", "bytes": 175875 }, "provenance.json": { "sha256": "3eccd35b7d04ded29ea8937c2d7870a8be4adac2340d632f92f01cfe630c3147", "bytes": 1090 }, "rendered.html": { "sha256": "e34515d9ce5113ec57194450be97a765341affcc8cae816dd5a475c8d200873c", "bytes": 171094 }, "screenshot.png": { "sha256": "1686d34457b358c5f9a1950a0da921ac4d765a0491953e9383a70b1498568c29", "bytes": 2281720 }, "text.txt": { "sha256": "33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b", "bytes": 10078 } }, "started_utc": "2026-10-22T11:31:44.588Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "d78c94137a0e92fbbf0e7183aa102252377215b5c2ea8c1376a7c1e5a0ac01af", "bytes": 853 }, "page.html": { "sha256": "5cda48a2a38c28e613f475c02a5e043468526043de9e64d7da8e881940d9dc0d", "bytes": 175811 }, "provenance.json": { "sha256": "2e335ba1f28d24aa170686d6db00688fb4c984b8b6f610cc4834b61f2a81c804", "bytes": 1878 }, "rendered.html": { "sha256": "208b58c48b4c5486c4f4282b9870d5d0d666d76c0506a64051a25d6d6c9e2a1f", "bytes": 170442 }, "screenshot.jpg": { "sha256": "5bd727d03b84a7d4ff60f97edb1cd772106c66edc82cd6044af820f1135ab4e8", "bytes": 581215 }, "text.txt": { "sha256": "2ada6ad9a37f82d308e5d324ffc263ec5fb071349cc059b76699b1c07896ce81", "bytes": 9243 } }, "started_utc": "2026-10-23T16:17:31.777Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Pre-release coverage of the two unpatched flaws.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert\n\nCaptured by claude-story-site. Status: captured. Pre-release coverage of the two unpatched flaws.\n\n- Captured for the record of pre-release framing.\n" }, { "slug": "thehackernews-what-protects-you", "url": "https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html", "publisher": "The Hacker News", "kind": "news", "title": "PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113151Z", "files": { "headers.json": { "sha256": "1d0e37d8f272c2035915a1e3bae5d055fd9d8a9dac4b60116725e2af378e7d7a", "bytes": 783 }, "page.html": { "sha256": "c3d4ade9c8b6af04990a2ee26114a8665f943ed5142ae7348e38ef3b23d34ab9", "bytes": 180675 }, "provenance.json": { "sha256": "b3b2d8123bee4172bcdb4453abeb515d86f34dd658088159147c1b0b944661d2", "bytes": 1081 }, "rendered.html": { "sha256": "64ef5d20df0ea8dfc700220c350757cc455bcfc017751142819841c35e11ff9c", "bytes": 179165 }, "screenshot.png": { "sha256": "e0e1a25547dc8d319ff4071cceff2950d36aa030ec7f2ab1625d04018d2e39cc", "bytes": 3022943 }, "text.txt": { "sha256": "2301d254784fd6612f36f844e16a706e2e7ca5f8d8f942f7f36544c59d78d82c", "bytes": 13774 } }, "started_utc": "2026-10-22T11:31:51.209Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "6fe8d9a594d87cf3b4e9bff6ba69087b72b6caae8189f7c963459900dbfc9457", "bytes": 854 }, "page.html": { "sha256": "ac78fa7d842fd9a45c9ce0e37f6d967597b33523f67008ec1a947a71d1d32453", "bytes": 180622 }, "provenance.json": { "sha256": "6331f3ea1bddda7045300126dcf0e02e399cc9f23e0ac6a8473ecacb20cd0104", "bytes": 1845 }, "rendered.html": { "sha256": "77fb59d32cd5b8d132a7f9909e2798408b7410faee4448752b405a9138704474", "bytes": 182039 }, "screenshot.jpg": { "sha256": "ea9238fdc90aa3a11701eb1c2d3bd19ccc41d5917ff3a02836b83f7c17345990", "bytes": 737255 }, "text.txt": { "sha256": "0a3177145305ec7cb2ab8689aea2d0b8a71f695571ed483cf9374df75c18f191", "bytes": 13743 } }, "started_utc": "2026-10-23T16:17:32.030Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "What protects before the 14:00 UTC patch; no compromise confirmed; public exploit code not shown to work; not in KEV.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't\n\nCaptured by claude-story-site. Status: captured. What protects before the 14:00 UTC patch; no compromise confirmed; public exploit code not shown to work; not in KEV.\n\n- Captured for the pre-release state.\n" }, { "slug": "thelec-news-articleview-html", "url": "https://www.thelec.kr/news/articleView.html?idxno=64169", "publisher": "디일렉", "kind": "news", "title": "엔키화이트햇, 'PHP2Shell' 진단 스캐너 무상 공개 < IT‧게임 < 기사본문 - 디일렉(THE ELEC)", "published": "2026-10-23T09:55:05+09:00", "captures": [ { "stamp": "20261025T144008Z", "files": { "headers.json": { "sha256": "730ee4c3e5a27fb8ba89eebdd54746010c506c10e850b2e59861964b206ebd53", "bytes": 355 }, "page.html": { "sha256": "63efbeea5a4bc883da9494a7bdbaf3123c3ca2a13e698cc3834c31d53566c9f8", "bytes": 119768 }, "provenance.json": { "sha256": "ae90748f437d7b9ca78f7fb8e5acf86fdbef35a552fa4ae11fc4dc701ed7835e", "bytes": 1634 }, "rendered.html": { "sha256": "42c43bc3562fb42149e4cc125bf8e0826195ebc8221671722f2205fa36a9fabd", "bytes": 132491 }, "screenshot.jpg": { "sha256": "c3c3234be3ae22c4c062718c03bc3e9a6ea485b880175d21e1f8dab021522d49", "bytes": 315042 }, "text.txt": { "sha256": "eb1a7b1f287c825f45104eddc9ad21ce40607191cfbb92a41efe3267707a5b6c", "bytes": 5432 } }, "started_utc": "2026-10-25T14:57:00.049Z", "status": 200, "final_url": "https://www.thelec.kr/news/articleView.html?idxno=64169" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ko", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T144008Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). The Elec (Korean), 23 October, by Seong Ji-on: Enki WhiteHat is offering free a diagnostic scanner for PHP2Shell that gives a first judgement of wheth...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 엔키화이트햇, 'PHP2Shell' 진단 스캐너 무상 공개 < IT‧게임 < 기사본문 - 디일렉(THE ELEC)\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/thelec/news-articleview-html`, snapshot `20261025T144008Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T144008Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Elec (Korean), 23 October, by Seong Ji-on: Enki WhiteHat is offering free a diagnostic scanner for PHP2Shell that gives a first judgement of whether the flaws are present. It checks only the PHP version and related settings, without attack code, by entering a URL with no login, and companies that do not use its Offen ASM product can also use it. It says, per Enki WhiteHat, all unpatched versions from PHP 5.4 to 8.5.11 are affected, and describes the analysis report published with it (causes of both flaws, affected systems and versions, immediate mitigations, how to apply the official patch). Same announcement as the Electronic Times item (etnews-20261023000089); noted as material only: the vault does not run such tools.\n\n> 스캐너는 실제 공격 코드를 쓰지 않고 PHP 버전과 관련 설정만 확인해 위험 여부를 판별한다.\n\n_Curator's translation:_ \"The scanner does not use actual attack code; it determines risk by checking only the PHP version and related settings.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"엔키화이트햇, 'PHP2Shell' 진단 스캐너 무상 공개 < IT‧게임 < 기사본문 - 디일렉(THE ELEC)\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ko`. The footer carries a copyright line ('무단전재 및 재배포, AI학습 및 활용 금지': no reproduction, redistribution, or AI training or use). It is a rights notice, not an instruction to act; recorded here and flagged to the editor. Nothing else addresses an AI or hides text from a reader.\n" }, { "slug": "themandarin-322640-asd-rushes-out-critical-alert-on-unpatched-php-vulner", "url": "https://www.themandarin.com.au/322640-asd-rushes-out-critical-alert-on-unpatched-php-vulnerability/", "publisher": "The Mandarin", "kind": "news", "title": "ASD rushes out ‘critical’ alert on unpatched PHP vulnerability", "published": "2026-10-21", "captures": [ { "stamp": "20261023T080331Z", "files": { "headers.json": { "sha256": "2786d04a60bb9fdd6e9fe1c8b3676b622ed6893d92da0dfaf1d4da8e62762983", "bytes": 1322 }, "page.html": { "sha256": "9021ab20ae8fe8628bb6d9ef05a6dcbbca3e9ca72dd23f7deabe62f3ad2c3c1c", "bytes": 814074 }, "provenance.json": { "sha256": "85d0416f786cca79b53d8f656628392578ac47490f15b4dabddd411d6bb0b026", "bytes": 1812 }, "rendered.html": { "sha256": "374f0fe50f0b037a070773e8f00baef19b503425a88f30a363ec75e7006b08b8", "bytes": 833792 }, "screenshot.jpg": { "sha256": "572e4eca4484969f39d4346e8ef118f81fcba26185f481640896c82ea63d316f", "bytes": 446918 }, "text.txt": { "sha256": "b6625a35ad00fcab445a86fa4d0e8a0cfb781915ed1fa78e7cdd0055c23f397f", "bytes": 5673 } }, "started_utc": "2026-10-23T08:10:44.533Z", "status": 200, "final_url": "https://www.themandarin.com.au/322640-asd-rushes-out-critical-alert-on-unpatched-php-vulnerability/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). Julian Bajkowski: the Australian Signals Directorate put government and business on alert on Wednesday afternoon, quoting the PHP Foundation's advance notice an...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ASD rushes out ‘critical’ alert on unpatched PHP vulnerability\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/news/themandarin/322640-asd-rushes-out-critical-alert-on-unpatched-php-vulner`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nJulian Bajkowski: the Australian Signals Directorate put government and business on alert on Wednesday afternoon, quoting the PHP Foundation's advance notice and telling organisations to watch for the patch release. The standfirst says GovCMS was one of thousands of web back ends left exposed. The page is partly paywalled in the capture.\n\n> PHP Foundation has published advanced notice of critical vulnerabilities\n\n## Why it is here\n\nNot from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug.\n\n## Capture notes\n\nLanguage `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "thenextweb-wikipedia-ref-9-dation-structural-failur", "url": "https://thenextweb.com/news/php-foundation-structural-failure-2024-flaw-leak", "publisher": "The Next Web", "kind": "news", "title": "PHP knew about one of the flaws in 2024 but could not agree a fix", "published": "2026-10-21T16:02:04+00:00", "captures": [ { "stamp": "20261025T114552Z", "files": { "headers.json": { "sha256": "017b0c257017055a2d046d9eb280a4eec9c20ac4a94def0e9e3a3af2d7bdf4a8", "bytes": 6341 }, "page.html": { "sha256": "cec88d6af74310a0dfcdf1856b500251d7d842d1c44c0db5956d9cfc897e43e9", "bytes": 186983 }, "provenance.json": { "sha256": "8150084b61f7b57f56a4f1882e8166c12233c833e3c041bdffd408c945baffe6", "bytes": 1729 }, "rendered.html": { "sha256": "cd019ddde23fc29d4e3ba980a7fb8749f80bae11390dabc651cb924d67c2681f", "bytes": 189355 }, "screenshot.jpg": { "sha256": "86201576b81dc923caea5bfbc870285b600b9aa49b19c5b14b4a7954a148ede5", "bytes": 403713 }, "text.txt": { "sha256": "1bc9ed0181f47f315a740b93d05a6f574f5485d1f57f8b69ba25e820bf7f0c2f", "bytes": 5665 } }, "started_utc": "2026-10-25T11:45:55.971Z", "status": 200, "final_url": "https://thenextweb.com/news/php-foundation-structural-failure-2024-flaw-leak" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). The Next Web (English), 21 October: 'PHP knew about one of the flaws in 2024 but could not agree a fix', reporting a PHP Foundation blog post publishe...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP knew about one of the flaws in 2024 but could not agree a fix\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/thenextweb/wikipedia-ref-9-dation-structural-failure-2024-flaw-leak`, snapshot `20261025T114552Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T114552Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Next Web (English), 21 October: 'PHP knew about one of the flaws in 2024 but could not agree a fix', reporting a PHP Foundation blog post published on the day of the release. It says a core developer first spotted the memory-handling bug in 2024 while fixing a separate issue from PHP's first external security audit, that someone theorised a possible exploit but nobody found a concrete way in, and that the fix then stalled for months because the security team's competing repairs each carried a cost (one broke backward compatibility, one added a denial-of-service risk, one forced changes on thousands of third-party extensions). The Foundation wrote that the delay was a structural failure caused by the team's decision process and lack of resources. On the leak: on 20 October at about 15:00 UTC the two CVE identifiers began circulating on forums and social media with a wrong release time and a wrong severity score of 10.0 (the real figure is 9.2), with no technical details at that point; the Foundation brought the announcement forward and moved the release up a day, from 22 to 21 October; at about 20:00 UTC Calif mistakenly published a video of its proof of concept working against real targets, deleted but copied, which sped up public exploit code the next day; and more than six hours before the release Chainguard published built images containing the fix, which the Foundation says 'disregarded weeks of work by many parties toward a coordinated disclosure'. The team saw no working exploit by the time of release. The post also asks for money: the team published 15 CVEs since the start of July and worked through more than 100 others that proved invalid or duplicates.\n\n> the delay was a structural failure, caused by both the security team’s decision process and its lack of resources\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP knew about one of the flaws in 2024 but could not agree a fix\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "therecord-php-foundation-statement", "url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities", "publisher": "The Record (Recorded Future News)", "kind": "news", "title": "PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Record from Recorded Future News", "published": "2026-10-22", "captures": [ { "stamp": "20261022T113158Z", "files": { "headers.json": { "sha256": "2257c81e7400eff589569be8295f608e775b7e305c9af66d1e8d4a8f580c7229", "bytes": 914 }, "page.html": { "sha256": "8849918ee23ea9f6e709c68d21726ff22f31b4e88bf3fc8d6c2d67f55d338d81", "bytes": 92120 }, "provenance.json": { "sha256": "e26d3d9bab095c3530be9242fd010f71c6efd72f0f561f48cc26892f32df92cb", "bytes": 1122 }, "rendered.html": { "sha256": "387866a008c5068d55372962daa2904c6bee30821494b4c30a467aaa1c775383", "bytes": 96511 }, "screenshot.png": { "sha256": "31f0aeaac3e78e1ab3c579a6217361b9148b439f02245b029c43c19d4f7f759a", "bytes": 1498927 }, "text.txt": { "sha256": "28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e", "bytes": 7717 } }, "started_utc": "2026-10-22T11:31:58.430Z", "status": 200, "final_url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2556552de87e0fb836287316ada33cfbf38a8854dd71c77a7c51a32cad3bcf28", "bytes": 987 }, "page.html": { "sha256": "174ced4d86e17882246f66b238020390f7025ebd7540bf47cea84b3941e0d830", "bytes": 92236 }, "provenance.json": { "sha256": "91d4623dd66eb56ccd65fead43d62255897d8e5e92a595fe9d40eaa890448210", "bytes": 1878 }, "rendered.html": { "sha256": "14c928a86548e2e96efa8ef7d725ac5a832fb58d993c74436e44ee03818a690c", "bytes": 96434 }, "screenshot.jpg": { "sha256": "a6805b7be8e65d53c948e0f3548693b0d97ac4f4448f96cdf1deb60f47bacedf", "bytes": 538706 }, "text.txt": { "sha256": "be05daefbd9bf0d2d1f784c5c8e34c73955e15d6b420dc4f75ecd35701a92ddb", "bytes": 7730 } }, "started_utc": "2026-10-23T16:28:43.230Z", "status": 200, "final_url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: the Foundation's account that AI review first sparked alarm in August but signs surfaced in 2024.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Record from Recorded Future News\n\nCaptured by claude-story-site. Status: captured. Secondary: the Foundation's account that AI review first sparked alarm in August but signs surfaced in 2024.\n\n- Captured for the record.\n" }, { "slug": "therecord-php-warnings", "url": "https://therecord.media/php-script-vulnerabilities-warnings", "publisher": "therecord.media", "kind": "news", "title": "Hundreds of websites taken offline as concern grows over two PHP vulnerabilities | The Record from Recorded Future News", "published": null, "captures": [ { "stamp": "20261022T080854Z", "files": { "headers.json": { "sha256": "bf9113e74b1e6fc5bdd612ddf58eda8304cdbe00ea65f0e32c62070fe5c48171", "bytes": 985 }, "page.html": { "sha256": "cdc8d409db3a15177c95696d32903a6f181766a8f37ef3f114e63810f7adaf50", "bytes": 92880 }, "provenance.json": { "sha256": "67050f29346e8aa3be54f2ab569c9e34e21f12f48d2f4458f9ff96f9e7c05dee", "bytes": 1069 }, "rendered.html": { "sha256": "6b4ce2be2649726e849b9a114c3d0c6c1e9477082e820c0c1561f427cbad00d0", "bytes": 97133 }, "screenshot.png": { "sha256": "7b41ac3613b3db9c15c197aef53bcda877ae332bff01b2155e5dbb4e5291927f", "bytes": 1516966 }, "text.txt": { "sha256": "39efe473da414c018f1d06c944097b5fbee7132a7cbc76df44a89656db344443", "bytes": 7551 } }, "started_utc": "2026-10-22T08:08:54.959Z", "status": 200, "final_url": "https://therecord.media/php-script-vulnerabilities-warnings" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2796e5f62520fb3f9ba89e4efcffe6c9b2d11bbbdc18cc295d2526830e271c6a", "bytes": 985 }, "page.html": { "sha256": "81217ad9ce720fb18adb95f74c70c257fbfaf0977c285d60eaf20c2eb1ee1862", "bytes": 93427 }, "provenance.json": { "sha256": "3e3ee8cb18e3ca186473fcebf920eba42be6971c1033bafa3b15d2ee3e023e81", "bytes": 1641 }, "text.txt": { "sha256": "4ee6aaf030fcd7f6d4fa3d6dd56586dbd78afd39977e4603a2c40dadd53d93a0", "bytes": 7498 } }, "started_utc": "2026-10-23T16:28:43.806Z", "status": 200, "final_url": "https://therecord.media/php-script-vulnerabilities-warnings" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "theregister-php-blames-chainguard", "url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "publisher": "The Register", "kind": "news", "title": "PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk", "published": "2026-10-22", "captures": [ { "stamp": "20261022T113204Z", "files": { "headers.json": { "sha256": "f037ca6b2e792623b19de3cc87220576a70faf147d1140a31fe0f0a22fa34d1e", "bytes": 610 }, "page.html": { "sha256": "f7f24a70afadc30edf03beb3e697086d5126ad7f5ddf2875c2e5c54bc07208a5", "bytes": 183584 }, "provenance.json": { "sha256": "28bb52465a44cfdc683cafd60ae043da8145a2e31fa1e280fa7ed7b81e417e32", "bytes": 1225 }, "rendered.html": { "sha256": "3729f08f3b948bc4af5a39a2b7351e38db6eeafbbcb982556755e5929dabb56d", "bytes": 197763 }, "screenshot.png": { "sha256": "d7c98b6141ded745143bbb5bc018fb02e07f795ab320a20434e063f150a3b875", "bytes": 1745666 }, "text.txt": { "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "bytes": 13215 } }, "started_utc": "2026-10-22T11:32:04.104Z", "status": 200, "final_url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "a1978393d061c66f63509e1c1c1a981a94391c640732adda0650aff46e5136d2", "bytes": 681 }, "page.html": { "sha256": "2ae362bc7596728abff7d47881889ac36ea6b0f56b399d1764f98a7032de6dec", "bytes": 183254 }, "provenance.json": { "sha256": "84d6fb599d488aaf94357843ef4ed03d95f6b1c458afccacf0ceb42f0e84a701", "bytes": 1985 }, "rendered.html": { "sha256": "b138f7fef816c5180a11c1d2fc70655a5669b0af56c0c9eb19c663c72191ca2c", "bytes": 199783 }, "screenshot.jpg": { "sha256": "1451218d7d84aec414a1764685d312ecefea6858a4a230fda6c9991961e4f3cc", "bytes": 964556 }, "text.txt": { "sha256": "ca382cdb9b4ecdf3e8ef86975c0671cea61b842d9de3ca1b06b1f60c98febe6d", "bytes": 12962 } }, "started_utc": "2026-10-23T16:16:03.198Z", "status": 200, "final_url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk\n\nCaptured by claude-story-site. Status: captured. Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.\n\n- Secondary but the fullest account of Chainguard's side. Lorenc did not name vendors or publish evidence.\n" }, { "slug": "thestar-aseanplus-aseanplus-news-2026-10-22-seri", "url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/22/serious-language-programme-php039s-security-flaw-leaves-internet-websites-at-major-risk-reports-dpa", "publisher": "The Star", "kind": "news", "title": "Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star", "published": "2026-10-22T12:48:00.000Z", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "6821f5025b8949aeddbf985a428f0baf8d02f287b669ee066a7dfecdc0ecd764", "bytes": 1374 }, "page.html": { "sha256": "b0bf2d6452f14d74d1e3257844ee35730c93de2f0da5bef61322cda24943076d", "bytes": 423848 }, "provenance.json": { "sha256": "6de00b038120b27d2949aeaa6f4916ddef07cd08a99baa6b6ddf1e53fd7466ef", "bytes": 1945 }, "rendered.html": { "sha256": "fd7b35fbbccd69663821a4bb016415ce72b4e8e16f05dfc0143461f5f7668bb0", "bytes": 526354 }, "screenshot.jpg": { "sha256": "7834b934aa582fdd0dc3d3c29742f93983d06719ada07f891f5e5eb6cf24c6f7", "bytes": 544408 }, "text.txt": { "sha256": "465bf0298d2e3f5d97b451b1816104c3d11790e4a222732501d273842e71bcb0", "bytes": 6304 } }, "started_utc": "2026-10-23T16:22:36.750Z", "status": 200, "final_url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/22/serious-language-programme-php039s-security-flaw-leaves-internet-websites-at-major-risk-reports-dpa" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). The Star (Malaysia), a dpa wire report of 22 October: PHP's security flaw leaves websites at major risk. Security experts warned of two critical vulne...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `my/news/thestar/aseanplus-aseanplus-news-2026-10-22-serious-language-program`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nThe Star (Malaysia), a dpa wire report of 22 October: PHP's security flaw leaves websites at major risk. Security experts warned of two critical vulnerabilities in the core of PHP, dubbed PHP2Shell and registered as CVE-2026-109618 and CVE-2026-109619.\n\n> Security experts warned of two critical vulnerabilities in the core of the programming language, dubbed \"PHP2Shell\" and registered under the official identifiers CVE-2026-109618 and CVE-2026-109619.\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ The Star (Malaysia) runs a dpa wire story from Berlin: PHP2Shell shakes websites worldwide, CERT-EU urges isolation, and the patch is out. Heise Security warned that working exploit scripts would appear within hours and advised disconnecting PHP servers until patched.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tiasang-lo-hong-php-ai-khien-dieu-bi-lang-quen-t", "url": "https://tiasang.com.vn/lo-hong-php-ai-khien-dieu-bi-lang-quen-thanh-moi-de-doa-5135729.html", "publisher": "Tia Sáng", "kind": "news", "title": "Lỗ hổng bảo mật PHP: AI khiến điều bị lãng quên thành mối đe dọa", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "2c004ced4fc129b01d96818b80112309dd714140bcfba514f81fc169f5820aa2", "bytes": 1758 }, "page.html": { "sha256": "8e9f81344cf949c2dab97abd28f859af5cfab0ae40408140ce0974c3d7fbefcd", "bytes": 194007 }, "provenance.json": { "sha256": "48df29c3fdcff0a5e3fa7c0039ac4c2cfd3b335e02d7b3b941f916c33865dd9b", "bytes": 1781 }, "rendered.html": { "sha256": "0b5817e1dc541694be86fd9f478f0e3b11d9a3c7ea890136c3353727b0801088", "bytes": 398685 }, "screenshot.jpg": { "sha256": "4c0d28855af00a794806adbc621d4c40a25a0b4aa22068273078cb6a1de730f4", "bytes": 953423 }, "text.txt": { "sha256": "7b279f0fc3928e58f4e3c23f84ea63a0ef75fef70df77dc620888e02dae7e756", "bytes": 22053 } }, "started_utc": "2026-10-23T16:29:05.639Z", "status": 200, "final_url": "https://tiasang.com.vn/lo-hong-php-ai-khien-dieu-bi-lang-quen-thanh-moi-de-doa-5135729.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "vi", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Tia Sáng (Vietnam, Vietnamese), a long feature, 'PHP vulnerability: AI turns what was forgotten into a threat'. It says many European bodies proactive...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Lỗ hổng bảo mật PHP: AI khiến điều bị lãng quên thành mối đe dọa\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `vn/news/tiasang/lo-hong-php-ai-khien-dieu-bi-lang-quen-thanh-moi-de-doa-5135`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTia Sáng (Vietnam, Vietnamese), a long feature, 'PHP vulnerability: AI turns what was forgotten into a threat'. It says many European bodies proactively disconnected or closed sites after information on the two flaws leaked before patches could be applied, quotes Professor Phan Duong Hieu of the Paris Polytechnic's telecom school on the unauthenticated remote control risk, says the flaws were found from August while the PHP team prepared patches quietly, that governments worry hackers could use AI to shorten exploitation, and that an estimated 1.5 million of 2.6 million servers still run unpatched PHP. The explanation of PHP and the AI discussion follow; no new facts beyond the Censys-derived estimate already held.\n\n> Ước tính hiện có khoảng 1,5 triệu trong số 2,6 triệu máy chủ đang sử dụng phiên bản PHP chưa vá lỗi.\n\n_Curator's translation:_ \"It is estimated that about 1.5 million of 2.6 million servers are currently using unpatched PHP versions.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Tia Sang (Vietnam) feature: European agencies, schools and hospitals went offline. Prof. Phan Duong Hieu explains the risk, and an estimate says about 1.5 million of 2.6 million servers still run unpatched PHP. It highlights that Calif is led by Vietnamese engineer Duong Ngoc Thai and covers the history from Esser in 2004 to OSTIF/Quarkslab in 2024.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Lỗ hổng bảo mật PHP: AI khiến điều bị lãng quên thành mối đe dọa\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `vi`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tirto-website-sedunia-geger-ditemukan-celah-ke", "url": "https://tirto.id/website-sedunia-geger-ditemukan-celah-keamanan-di-php-ada-bug-apa-hEbc", "publisher": "Tirto.id", "kind": "news", "title": "Web Sedunia Geger Ditemukan Celah Keamanan di PHP, Ada Bug Apa?", "published": "not stated in the capture", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "ecb452f95ee7d7571cab6b93001bfdff027669a5ff612a6f70da0b392197c25f", "bytes": 1208 }, "page.html": { "sha256": "9c40c0e68265b1e2c5cacba1eec37690da8f41866379feef6ea174fea319f057", "bytes": 105829 }, "provenance.json": { "sha256": "d94615e6bf2f55fc37587e8d28366af2cd4b34d8b4e244478304677b22f7736c", "bytes": 1744 }, "rendered.html": { "sha256": "08e9400ae1598a7e38c27a7da4625aab607d77df806c98e474995f5c7db4ed31", "bytes": 113150 }, "screenshot.jpg": { "sha256": "c49537e4a9e1c8ebc645b7c10a16ea45190409258e656c8f9466927b7efbda36", "bytes": 598473 }, "text.txt": { "sha256": "0df40bc3b926c3afaeb16fd2de610316baba98666c8347381c224cea709237c9", "bytes": 8812 } }, "started_utc": "2026-10-23T16:16:43.964Z", "status": 200, "final_url": "https://tirto.id/website-sedunia-geger-ditemukan-celah-keamanan-di-php-ada-bug-apa-hEbc" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "id", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Tirto.id (Indonesia), an explainer, 'Web worldwide in uproar over PHP flaw, what bug is it?'. It says a PHP bug called PHP2Shell is reported to let ha...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Web Sedunia Geger Ditemukan Celah Keamanan di PHP, Ada Bug Apa?\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `id/news/tirto/website-sedunia-geger-ditemukan-celah-keamanan-di-php-ada-bu`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTirto.id (Indonesia), an explainer, 'Web worldwide in uproar over PHP flaw, what bug is it?'. It says a PHP bug called PHP2Shell is reported to let hackers into systems and read memory holding sensitive information, including passwords; that the flaw was found by a joint team of AI and security companies including OpenAI, Wiz (Google's) and Calif; that PHP runs about 70% of websites; and quotes deVere Group's chief executive Nigel Green (via CNN) on the risk to places where people spend money online. No new facts.\n\n> Bug tersebut, yang disebut PHP2Shell, dilaporkan memungkinkan peretas masuk dalam sistem dan membaca memori berisi informasi sensitif, termasuk kata sandi.\n\n_Curator's translation:_ \"The bug, called PHP2Shell, is reported to allow hackers to enter systems and read memory containing sensitive information, including passwords.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Tirto rewrite of CNN: government sites in the US, UK, France, Denmark, Finland and the Netherlands were suspended. It names Japanese companies ANA, JR West and MUFG as affected, plus Ireland's The Journal and Wikimedia, and quotes deVere Group's Nigel Green.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Web Sedunia Geger Ditemukan Celah Keamanan di PHP, Ada Bug Apa?\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `id`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "topagrar-betriebsleitung-news-php-sicherheitsluck", "url": "https://www.topagrar.com/betriebsleitung/news/php-sicherheitslucke-was-landwirte-mit-hofwebseite-jetzt-wissen-mussen-20030467.html", "publisher": "top agrar", "kind": "news", "title": "PHP-Sicherheitslücke: Was Landwirte mit Hofwebseite jetzt wissen müssen | top agrar", "published": "2026-10-22T11:55:00+02:00", "captures": [ { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "28829957f75098dac3573ea906a2444ae7c80e23ea516d7047e67de0d4d95c67", "bytes": 1852 }, "provenance.json": { "sha256": "a518d17f680e8ccd383738b4c30dd41aa6e84563c043f14a22b28223c88ff9e6", "bytes": 1626 }, "text.txt": { "sha256": "28e10d0ef3eb49719e7bfa4e82d274429905e0340a020e7fc95d82132223da0f", "bytes": 9480 } }, "started_utc": "2026-10-23T23:27:23.649Z", "status": 200, "final_url": "https://www.topagrar.com/betriebsleitung/news/php-sicherheitslucke-was-landwirte-mit-hofwebseite-jetzt-wissen-mussen-20030467.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). top agrar (German farming trade site), 22 October: what farmers with a farm website need to know about the PHP flaw. It repeats the BSI's official war...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-Sicherheitslücke: Was Landwirte mit Hofwebseite jetzt wissen müssen | top agrar\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `at/news/topagrar/betriebsleitung-news-php-sicherheitslucke-was-landwirte-mit`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\ntop agrar (German farming trade site), 22 October: what farmers with a farm website need to know about the PHP flaw. It repeats the BSI's official warning at level '3 / Orange', the remote-code-execution risk and the fixes published on Wednesday afternoon, and quotes the BSI's vice-president Thomas Caspers (via Tagesschau) that with the security updates attackers are also enabled, simply by analysing them, to attack sites that have not been patched, so the BSI advises operators to patch quickly. The page also shows unrelated teasers (cooling units over 50 degrees; cyber attacks on hundreds of French supermarkets).\n\n> zitierte die Tagesschau den Vizepräsidenten des Bundesamts für Sicherheit in der Informationstechnik, Thomas Caspers.\n\n_Curator's translation:_ \"Tagesschau quoted the vice-president of the Federal Office for Information Security, Thomas Caspers.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Top agrar explains the PHP flaw for farmers who run farm websites or online shops, citing the BSI warning level '3 / Orange' and BSI vice-president Caspers via Tagesschau. It gives a template email to send to hosting providers and advice on whether to take a site offline.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP-Sicherheitslücke: Was Landwirte mit Hofwebseite jetzt wissen müssen | top agrar\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `de`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tpo-nl-digid-offline", "url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "publisher": "TPO.nl", "kind": "news", "title": "PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113213Z", "files": { "headers.json": { "sha256": "3b4fb879e9421d7c88e3feb33a0521286d51f96fea6fe5ce5a04f9a54f055b3b", "bytes": 826 }, "page.html": { "sha256": "1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad", "bytes": 233569 }, "provenance.json": { "sha256": "e8a125363be8a52f4be95819b63112af3af8ea3317977ed509fbe2a52b0e31df", "bytes": 1020 }, "rendered.html": { "sha256": "d32cd4732dc20dda8b4464a52f471b942ec7756397f0ff01d40dd7344843c936", "bytes": 407728 }, "screenshot.png": { "sha256": "50d028e45666fd51dea41fe9359edc265ec4671d4ca742a6acc17eb2ef119a4d", "bytes": 1351320 }, "text.txt": { "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "bytes": 3796 } }, "started_utc": "2026-10-22T11:32:13.597Z", "status": 200, "final_url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Dutch: DigiD, MijnOverheid and the Tweede Kamer offline.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL\n\nCaptured by claude-story-site. Status: captured. Dutch: DigiD, MijnOverheid and the Tweede Kamer offline.\n\n- Secondary Dutch coverage.\n" }, { "slug": "tpo-tpo-nl-digid-offline", "url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "publisher": "TPO", "kind": "news", "title": "PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL", "published": "2026-10-21T14:53:56+00:00", "captures": [ { "stamp": "20261022T171501Z", "files": { "headers.json": { "sha256": "d679fd249c5d952dda77dd7e6cacb7c092e618eb15c5e59246e6deaedfd6bfe4", "bytes": 903 }, "page.html": { "sha256": "1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad", "bytes": 233569 }, "provenance.json": { "sha256": "01b81cb90dbf7aa36af6f95353411d042db7aaebbfc47685d58e68efa55540ae", "bytes": 1577 }, "rendered.html": { "sha256": "115512a91059970f03be37577b59b1af81dd6f12a2e113783ecfa9740cfd65b0", "bytes": 406102 }, "screenshot.jpg": { "sha256": "c831463120c4b1e47b6e6d8123de97f6e1c5d84a5e959062aad715898eeee87c", "bytes": 348035 }, "text.txt": { "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "bytes": 3796 } }, "started_utc": "2026-10-22T17:22:11.610Z", "status": 200, "final_url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "nl", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T171501Z. 6 new items in nl: TPO reports that NotuBiz, used by about 100 municipalities, went down first, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-leave tool, RTL, ANP, the Schiphol app, hospitals and KW", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `nl/news/tpo/tpo-nl-digid-offline`, snapshot `20261022T171501Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T171501Z/provenance.json`. Publisher: TPO. Language: nl. URL: https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nTPO reports that NotuBiz, used by about 100 municipalities, went down first, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-leave tool, RTL, ANP, the Schiphol app, hospitals and KWF; universities of applied sciences shut systems with SURF. It says all Flemish government sites and French prefecture sites went offline, and quotes NCSC deputy director Corine Schipper-Derkse and Justice Minister Van Weel.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/nl/news/tpo/tpo-nl-digid-offline.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: Meeting platform NotuBiz, used by about a hundred municipalities, went down first in the morning, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-reporting tool, RTL, ANP and the Schiphol app.\n\n> Vergaderplatform Notubiz, dat door zo’n honderd gemeenten wordt gebruikt, ging ’s ochtends als eerste plat. Daarna volgden onder meer de Autoriteit Persoonsgegevens, de Unie van Waterschappen, de ziekmeldtool van UWV, RTL, het ANP en de app van Schiphol.\n\n_Watch reader's translation:_ Meeting platform Notubiz, used by around a hundred municipalities, went down first in the morning. It was followed by, among others, the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-reporting tool, RTL, ANP and the Schiphol app.\n\n**offline**: The Netherlands Association of Universities of Applied Sciences said many educational institutions switched off systems and are working on recovery with SURF; charity KWF also went offline.\n\n> De Vereniging Hogescholen meldt dat “veel onderwijsinstellingen” systemen hebben uitgezet en samen met SURF werken aan herstel.\n\n_Watch reader's translation:_ The Netherlands Association of Universities of Applied Sciences reports that 'many educational institutions' have switched off systems and are working on recovery together with SURF.\n\n**offline**: In Belgium all websites of the Flemish government went offline, and in France those of the prefectures.\n\n> In België gingen alle websites van de Vlaamse overheid uit de lucht, in Frankrijk die van de prefecturen en ook in Finland grepen overheden in.\n\n_Watch reader's translation:_ In Belgium all websites of the Flemish government went offline, in France those of the prefectures, and in Finland too governments intervened.\n\n**official**: NCSC-NL deputy director Corine Schipper-Derkse stressed it is not an attack but a design flaw in the software.\n\n> “Het is niet zozeer een aanval, maar een weeffout die in de software zit en dat kan gebeuren”, aldus adjunct-directeur Corine Schipper-Derkse.\n\n_Watch reader's translation:_ 'It is not so much an attack, but a design flaw in the software, and that can happen,' said deputy director Corine Schipper-Derkse.\n\n**official**: Dutch Justice and Security Minister Van Weel said there were 'no signals yet' that the flaws were being actively exploited.\n\n> Minister Van Weel van Justitie en Veiligheid liet weten dat er “nog geen signalen” zijn dat de lekken actief worden misbruikt.\n\n_Watch reader's translation:_ Minister Van Weel of Justice and Security said there were 'no signals yet' that the flaws are being actively exploited.\n\n**agency**: NCSC-NL speaks of a 'very high risk of complete takeover of the system'.\n\n> Het NCSC spreekt van een “zeer hoog risico op volledige overname van het systeem”.\n\n_Watch reader's translation:_ The NCSC speaks of a 'very high risk of complete takeover of the system'.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 6 new items in nl: TPO reports that NotuBiz, used by about 100 municipalities, went down first, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-leave tool, RTL, ANP, the Schiphol app, hospitals and KW\n\nSupports: translations/nl/news/tpo/tpo-nl-digid-offline.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "trak-stories-70-websites-at-security-risk-due", "url": "https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/", "publisher": "Trak.in", "kind": "news", "title": "70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell - Trak.in - Indian Business of Tech, Mobile & Startups", "published": "2026-10-22T01:39:26+00:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "8fde4430e8c470e49b420cd29fee49793f43d3268f43588b2ba02416312839a1", "bytes": 1484 }, "page.html": { "sha256": "da1aed41fe100616f8a86703474d47523f95c935adb9d20a5b65859ffe6287da", "bytes": 194289 }, "provenance.json": { "sha256": "4d427b769b9cb3f10ad791e195f0f582fd24a190503c9e200e6be5e3b92be443", "bytes": 1826 }, "rendered.html": { "sha256": "074589989cd1856a02772f19472fe2f6cc4cccba33b84c7111de496a2cbde883", "bytes": 240970 }, "screenshot.jpg": { "sha256": "ec39f77be4fbb05ab80efb990eb4abb700a658e2171e10f91d64fa0c8c6f67e9", "bytes": 556334 }, "text.txt": { "sha256": "019553b7a67c18ab791515f5de15e32683828dbee3ffb981c370cf741299b786", "bytes": 7293 } }, "started_utc": "2026-10-23T16:17:30.288Z", "status": 200, "final_url": "https://trak.in/stories/70-websites-at-security-risk-due-to-critical-php-vulnerability-php2shell/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Trak.in (India), 22 October: researchers at Wiz uncovered critical PHP vulnerabilities, dubbed PHP2Shell, that could let attackers run malicious code...", "raw_sha256": {}, "has_notes": true, "notes_md": "# 70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell - Trak.in - Indian Business of Tech, Mobile & Startups\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `in/news/trak/stories-70-websites-at-security-risk-due-to-critical-php-vul`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTrak.in (India), 22 October: researchers at Wiz uncovered critical PHP vulnerabilities, dubbed PHP2Shell, that could let attackers run malicious code on vulnerable servers without authentication and expose sensitive information; the headline says 70% of websites are at risk.\n\n> Cybersecurity researchers at Wiz have uncovered critical vulnerabilities in PHP, the programming language that powers a large portion of the internet.\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Trak.in (Indian business site) English explainer based on Wiz research: the two CVEs, 70% figure, AI tools used, and patching advice.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"70% Websites At Security Risk Due To Critical PhP Vulnerability: PHP2Shell - Trak.in - Indian Business of Tech, Mobile & Startups\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "trendmicro-ja-jp-about-newsroom-press-releases-2026", "url": "https://www.trendmicro.com/ja_jp/about/newsroom/press-releases/2026/pr-20261023-01.html", "publisher": "トレンドマイクロ", "kind": "news", "title": "トレンドマイクロ、PHPの重大な脆弱性「PHP2Shell」への支援・対応策を発表 | トレンドマイクロ (JP)", "published": "2026-10-23", "captures": [ { "stamp": "20261024T083755Z", "files": { "headers.json": { "sha256": "1ab6961f42dd9f9f95edaba5b1befbcf55e315debb7f389e294becdc1b6c6728", "bytes": 961 }, "page.html": { "sha256": "c37e02ecd7d13b419f13fe6f2a9745deff53889dc1efd8ac6f7f93f935674e5d", "bytes": 86216 }, "provenance.json": { "sha256": "4c8de4751f524032ffd49f8109f9fb90cf1dfdc1af38595b4dcfc2116bd5b0a2", "bytes": 1825 }, "rendered.html": { "sha256": "c3ba754fda3d32b258d89c4f2c66ccb59f17209ef2b1aa222407b001a7f986b7", "bytes": 143987 }, "screenshot.jpg": { "sha256": "caf6371a7c079d40487af5824253a9f9d8b2e838b43b23533035c52e20a03caa", "bytes": 588986 }, "text.txt": { "sha256": "949a7f1314773718d89d8e117c72f102c36677e39984c3948a639e3d36d9c609", "bytes": 9942 } }, "started_utc": "2026-10-24T08:46:10.148Z", "status": 200, "final_url": "https://www.trendmicro.com/ja_jp/about/newsroom/press-releases/2026/pr-20261023-01.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Trend Micro Japan (Japanese), 23 October: a press release announcing support measures for PHP2Shell, including a free 'PHP2Shell Exposure Checker' (re...", "raw_sha256": {}, "has_notes": true, "notes_md": "# トレンドマイクロ、PHPの重大な脆弱性「PHP2Shell」への支援・対応策を発表 | トレンドマイクロ (JP)\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/trendmicro/ja-jp-about-newsroom-press-releases-2026-pr-20261023-01-html`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTrend Micro Japan (Japanese), 23 October: a press release announcing support measures for PHP2Shell, including a free 'PHP2Shell Exposure Checker' (reads a public site's HTTP headers to indicate whether it may be affected) and a PHP web shield for small businesses. It says the flaw details leaked and exploit code was published before the fix, that initial exploitation attempts have been reported, and in a footnote that successful exploitation in the wild had not been confirmed by independent verification (TrendAI security blog, 22 October); it also says results are an indication from externally visible information such as the PHP version, since Linux distributions may ship fixes without changing the version string. Vendor marketing; noted as material only: the vault does not run such tools.\n\n> 実環境での悪用成功は、独立した検証によって確認されていません\n\n_Curator's translation:_ \"Successful exploitation in real environments has not been confirmed by independent verification.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"トレンドマイクロ、PHPの重大な脆弱性「PHP2Shell」への支援・対応策を発表 | トレンドマイクロ (JP)\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tugatech-t93092-milhoes-de-servidores-php-expostos-ao-risco", "url": "https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell", "publisher": "TugaTech", "kind": "news", "title": "Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech", "published": null, "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "9ba4e8c110dfec261e69ff9e30583f3035699374cdc4c8bbda36e6ffbd8be6a6", "bytes": 1238 }, "page.html": { "sha256": "5eb2708e19df644429bd5ac2756cb2c61c3e5e6404055fe5e598966c814d6a35", "bytes": 94257 }, "provenance.json": { "sha256": "ce02f1eecf8e728dc52f46b35ef04cd30431f0d48c23a3a7ce338c973434e38f", "bytes": 1787 }, "rendered.html": { "sha256": "3e2919e620909a26d898f060386cd197035237503335812de34a61a73a525b5b", "bytes": 447588 }, "text.txt": { "sha256": "86e513bd05a0b5fdd5b9e959b368b60b23112bfffe99f7d9ae4097f42042cc26", "bytes": 8239 } }, "started_utc": "2026-10-22T18:27:42.794Z", "status": 200, "final_url": "https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "pt", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in pt: TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while abou", "raw_sha256": {}, "has_notes": true, "notes_md": "# Milhões de servidores PHP expostos ao risco da falha PHP2Shell | TugaTech\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: TugaTech. Language: pt. URL: https://tugatech.com.pt/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha-php2shell\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nTugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while about 758,000 run end-of-life versions. It adds a breakdown by web server, app and country, plus about 5,700 malicious PHP servers.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha.json`), not the publisher's and not checked word for word by the curator.\n\n**number**: VirusTotal mapped about 5.1 million IPs running PHP, about 3.8 million with at least one open port; four in five hide their version.\n\n> Mapeando cerca de 5,1 milhões de endereços IP que correm PHP, a investigação indica que aproximadamente 3,8 milhões mantêm pelo menos uma porta aberta.\n\n_Watch reader's translation:_ Mapping around 5.1 million IP addresses running PHP, the investigation indicates that approximately 3.8 million keep at least one port open.\n\n**number**: Of about 1.1 million servers disclosing a version, only about 272,000 run supported branches 8.2–8.5, while about 758,000 run end-of-life versions 5.4–8.1.\n\n> Apenas cerca de 272 mil computadores correm ramificações com suporte ativo (versões 8.2 a 8.5), as únicas que recebem correções diretas da equipa do PHP.\n\n_Watch reader's translation:_ Only about 272 thousand computers run branches with active support (versions 8.2 to 8.5), the only ones that receive direct fixes from the PHP team.\n\n**number**: About 187,000 addresses remain on PHP 7.4 and about 119,000 on PHP 5.4.\n\n> Cerca de 187 mil endereços continuam presos ao PHP 7.4, enquanto perto de 119 mil operam sobre a versão 5.4.\n\n_Watch reader's translation:_ About 187 thousand addresses remain stuck on PHP 7.4, while nearly 119 thousand operate on version 5.4.\n\n**number**: The US hosts the largest share of exposed machines, about 920,000 IPs, concentrated at AWS, DigitalOcean, OVHcloud and Hetzner.\n\n> Geograficamente, a maior fatia de máquinas expostas situa-se nos EUA, com perto de 920 mil endereços IP.\n\n_Watch reader's translation:_ Geographically, the largest share of exposed machines is in the US, with nearly 920 thousand IP addresses.\n\n**number**: About 5,700 active PHP servers have multiple VirusTotal threat detections, including stealer control panels.\n\n> Cerca de 5,7 mil servidores PHP ativos registam múltiplas deteções de ameaças no VirusTotal, incluindo painéis de controlo de roubo de dados (stealers) a operar com versões recentes do PHP.\n\n_Watch reader's translation:_ About 5.7 thousand active PHP servers register multiple threat detections on VirusTotal, including data-theft (stealer) control panels running recent PHP versions.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in pt: TugaTech reports a global VirusTotal analysis of PHP exposure: about 5.1 million PHP IPs, of which 3.8 million have open ports and 1.1 million disclose their version. Only about 272,000 run supported branches, while abou\n\nSupports: translations/pt/news/tugatech/t93092-milhoes-de-servidores-php-expostos-ao-risco-da-falha.json\n\n## Capture notes\n\nNo screenshot: the watch kept none for this snapshot (minor change). Its sha256 was 0bf133de53f81c744b5a181e1c13fa59bdefd42dfb443cb885272968bf9d3c0a.\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "turbolab-server-1224-php2shell-amazon-ha-rilevato", "url": "https://turbolab.it/server-1224/php2shell-amazon-ha-rilevato-tentativi-exploit-4-giorni-prima-patch-php-4946", "publisher": "TurboLab.it", "kind": "news", "title": "PHP2Shell: Amazon ha rilevato tentativi di exploit 4 giorni prima della patch di PHP (aggiornato: 22 ottobre 2026, ore 20:50) | TurboLab.it", "published": "2026-10-22 20:50 (page time zone not stated)", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "dfd2a02a86522a2fe1a2b98c39378b67eb8acee32785212b837a3bded7d6867b", "bytes": 653 }, "page.html": { "sha256": "e10d3fdaa60663112c12e771948130c225f3eb73b87f9a92dcee914ad623460e", "bytes": 659235 }, "provenance.json": { "sha256": "8b549c5052473635cfa244926c779a1466898278ab1b1bafe35efa7031e03bd7", "bytes": 1869 }, "rendered.html": { "sha256": "b22e565c3389f8a029041c927098827231b27294a3e6f94656c05c1824a33b96", "bytes": 672612 }, "screenshot.jpg": { "sha256": "403ecfb8ecbc539b747d64f4c591c74999ba2ec6a7f83a3ed836c56a538e1caf", "bytes": 895088 }, "text.txt": { "sha256": "1fb6f3a2b702e7ac6d9aa3f64ed588a1c883ebe0b5ba664548e64ef338deb734", "bytes": 8512 } }, "started_utc": "2026-10-23T16:19:08.760Z", "status": 200, "final_url": "https://turbolab.it/server-1224/php2shell-amazon-ha-rilevato-tentativi-exploit-4-giorni-prima-patch-php-4946" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). TurboLab.it (Italian), updated 22 October 20:50, by massimo.valenti ('human author, AI support'): Amazon detected exploit attempts four days before th...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Amazon ha rilevato tentativi di exploit 4 giorni prima della patch di PHP (aggiornato: 22 ottobre 2026, ore 20:50) | TurboLab.it\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `it/news/turbolab/server-1224-php2shell-amazon-ha-rilevato-tentativi-exploit-4`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTurboLab.it (Italian), updated 22 October 20:50, by massimo.valenti ('human author, AI support'): Amazon detected exploit attempts four days before the patch. It says an Amazon honeypot already recorded a PHP2Shell attempt on 17 October, found by analysts on Wednesday by looking back over MadPot sensor data, from an IP address tied to a commercial anonymisation network and geolocated in Australia, and quotes Amazon's CISO CJ Moses that a honeypot targeted from an anonymised IP while the flaw was still under embargo suggests an attacker was behind it, though it is unclear how they obtained exploit information before disclosure. The practical lesson drawn is that the advisory date is not the start of the risk, so administrators should check logs back from 17 October.\n\n> La richiesta proveniva da un indirizzo IP associato a una rete commerciale di anonimizzazione, geolocalizzato in Australia.\n\n_Curator's translation:_ \"The request came from an IP address associated with a commercial anonymisation network, geolocated in Australia.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell: Amazon ha rilevato tentativi di exploit 4 giorni prima della patch di PHP (aggiornato: 22 ottobre 2026, ore 20:50) | TurboLab.it\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `it`. The byline reads 'Autore umano, supporto AI' (human author, AI support), a statement about how the article was made. Nothing in the article text addresses an AI or hides text from a reader.\n" }, { "slug": "turkey-breaking-news-2026-10-25-d8-ab-d8-ba-d8-b1-d8-a9", "url": "https://turkey-breaking.com/News/2026/10/25/%d8%ab%d8%ba%d8%b1%d8%a9-%d8%ac%d8%af%d9%8a%d8%af%d8%a9-%d9%81%d9%8a-php-%d8%aa%d8%aa%d9%8a%d8%ad-%d8%aa%d9%86%d9%81%d9%8a%d8%b0-%d8%b4%d9%8a%d9%81%d8%b1%d8%a7%d8%aa-%d8%b9%d9%86-%d8%a8%d9%8f%d8%b9/", "publisher": "تركيا عاجل", "kind": "news", "title": "ثغرة جديدة في PHP تتيح تنفيذ شيفرات عن بُعد.. لماذا لا يحتاج بعض المسؤولين إلى إجراء إضافي؟", "published": "2026-10-25 07:51 (page time zone not stated)", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "b56c3a91d7ad1321600b02fab05bca0ef2629e8fbc5d0ebc3775da21e1437f07", "bytes": 1125 }, "page.html": { "sha256": "4276cdd5fa756e51667f8deccb46444beccab9a23b4f599333b5616bb276b9b3", "bytes": 130616 }, "provenance.json": { "sha256": "f3d0fc7d1f2abd7d408eb4e5bf535f67b5d5fd9b74e4957e363fe55650ec1500", "bytes": 2179 }, "rendered.html": { "sha256": "ff1d444ad2ab5f1909e10cef91676c56b1c742dd9215988b8ead5b3bdcf14549", "bytes": 618558 }, "screenshot.jpg": { "sha256": "a2549f815c6284ff987630f9ebf9faf2cad7c05c5dfba0adfa453de235fe2b02", "bytes": 305529 }, "text.txt": { "sha256": "b8d2060e6c49ff425e5e2b4acb811b0426fca145e7feee935a34dc5089430c6e", "bytes": 8716 } }, "started_utc": "2026-10-25T09:43:32.874Z", "status": 200, "final_url": "https://turkey-breaking.com/News/2026/10/25/%d8%ab%d8%ba%d8%b1%d8%a9-%d8%ac%d8%af%d9%8a%d8%af%d8%a9-%d9%81%d9%8a-php-%d8%aa%d8%aa%d9%8a%d8%ad-%d8%aa%d9%86%d9%81%d9%8a%d8%b0-%d8%b4%d9%8a%d9%81%d8%b1%d8%a7%d8%aa-%d8%b9%d9%86-%d8%a8%d9%8f%d8%b9/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ar", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Turkey Breaking (Arabic, relaying Sözcü), 25 October: a new PHP vulnerability, CVE-2026-115560, was disclosed two days after the urgent PHP2Shell fixe...", "raw_sha256": {}, "has_notes": true, "notes_md": "# ثغرة جديدة في PHP تتيح تنفيذ شيفرات عن بُعد.. لماذا لا يحتاج بعض المسؤولين إلى إجراء إضافي؟\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `eg/news/turkey-breaking/news-2026-10-25-d8-ab-d8-ba-d8-b1-d8-a9-d8-ac-d8-af-d9-8a-d8`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTurkey Breaking (Arabic, relaying Sözcü), 25 October: a new PHP vulnerability, CVE-2026-115560, was disclosed two days after the urgent PHP2Shell fixes. The PHP developers judged that the configurations that cause it are unlikely to be used in real applications, so no emergency patch has been issued and the fix is expected in the next regular bug-fix release; as of the article PHP had not disclosed the affected versions, the release that will carry the fix or the severity, and it is still unknown whether the new flaw shares a root cause with one of the earlier PHP2Shell flaws. A mitigation the PHP team gave on 21 October already covers it for administrators who applied it. The conditions for exploitation that the article lists are left out of the notes.\n\n> وحُددت الثغرة الجديدة بالرقم CVE-2026-115560، فيما قدّر مطورو PHP أن احتمال استخدام الإعدادات المسببة لها في التطبيقات الفعلية منخفض.\n\n_Curator's translation:_ \"The new vulnerability was identified as CVE-2026-115560, while PHP developers estimated that the likelihood of the settings that cause it being used in real applications is low.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"ثغرة جديدة في PHP تتيح تنفيذ شيفرات عن بُعد.. لماذا لا يحتاج بعض المسؤولين إلى إجراء إضافي؟\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `ar`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "turkiyedeisdunyasi-php2shell-turkiye-avrupa-siber-142939", "url": "https://turkiyedeisdunyasi.com/php2shell-turkiye-avrupa-siber-142939/", "publisher": "turkiyedeisdunyasi", "kind": "news", "title": "Türkiye, PHP2Shell tehdidinde Avrupa’yı geride bıraktı - Türkiye'de İş Dünyası", "published": "2026-10-23T12:10:03+03:00", "captures": [ { "stamp": "20261026T121439Z", "files": { "headers.json": { "sha256": "1080c4f7d61602e411f9910d014e3d6f4d5ebd788b9628f34e069f0905c27794", "bytes": 3287 }, "page.html": { "sha256": "2ede440b739a7b28cc64373bb4cdceec0a7115558d5af735ea900f783fe3b6a1", "bytes": 191280 }, "provenance.json": { "sha256": "9a0af102c10bfbd1fd23cf1c4658f5252b56b949155065ede6424b9b06b65844", "bytes": 1736 }, "rendered.html": { "sha256": "5dcfdc57b46b1fc099934d0d17b657d96b5a25c7612460ea98ab8e7bd208fbe4", "bytes": 229454 }, "screenshot.jpg": { "sha256": "5515c5ee58c6f73f9fb1a76a861a920b2710af8d5284dc2890635bdf11ec13a0", "bytes": 791938 }, "text.txt": { "sha256": "1e307b7b74a2d10aef289c79896d0f782e0b1d0b5e81db504ae2cc6f478ae5a7", "bytes": 9364 } }, "started_utc": "2026-10-26T12:37:39.427Z", "status": 200, "final_url": "https://turkiyedeisdunyasi.com/php2shell-turkiye-avrupa-siber-142939/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "tr", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T121439Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Türkiye'de İş Dünyası (Turkey, Turkish), updated 23 October: 'Turkey outdid Europe on the PHP2Shell threat', on an analysis by the fintech company Onl...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Türkiye, PHP2Shell tehdidinde Avrupa’yı geride bıraktı - Türkiye'de İş Dünyası\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `tr/news/turkiyedeisdunyasi/php2shell-turkiye-avrupa-siber-142939`, snapshot `20261026T121439Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T121439Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTürkiye'de İş Dünyası (Turkey, Turkish), updated 23 October: 'Turkey outdid Europe on the PHP2Shell threat', on an analysis by the fintech company Onlayer of about 1.4 million merchant sites in 20 markets. It says 35.8% of merchant sites in Turkey were affected by PHP2Shell against a 45.7% average abroad and 56.7% in Europe, that the share of updated sites rose about fivefold in under 24 hours after the fixes, that 36.2% of Turkish merchant sites use PHP (about 64% use other technologies and are unaffected) and that 98.9% of PHP-using sites were on affected versions, which it attributes to the flaw covering most PHP versions published since 2012.\n\n> Araştırmaya göre Türkiye’deki üye işyeri sitelerinin yüzde 35,8’i PHP2Shell güvenlik açığından etkilenirken, yurt dışı ortalaması yüzde 45,7 olarak hesaplandı.\n\n_Curator's translation:_ \"According to the research, 35.8% of merchant sites in Turkey are affected by the PHP2Shell vulnerability, while the average abroad was calculated at 45.7%.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: \"Türkiye, PHP2Shell tehdidinde Avrupa’yı geride bıraktı - Türkiye'de İş Dünyası\". Selected mechanically, not read by a person.\n\n## Capture notes\n\nLanguage `tr`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "tuttotech-news-2026-10-22-vulnerabilita-php-html", "url": "https://www.tuttotech.net/news/2026/10/22/vulnerabilita-php.html", "publisher": "TuttoTech.net", "kind": "news", "title": "Due gravi falle in PHP mandano offline i siti web governativi", "published": "2026-10-22T16:41:29+02:00", "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "a1887304d23ff9d1adb3f4ea5a2ab31d260170b5c193a662ee297f69283fd170", "bytes": 794 }, "page.html": { "sha256": "d565db358e1e3174b9bee376602cb8654314a0e1b36d29b47478e8730b12c075", "bytes": 206784 }, "provenance.json": { "sha256": "6f96056f90767210f819d3048606463447f461b4558c9d8f322f7a103687b0a3", "bytes": 1660 }, "rendered.html": { "sha256": "e555f146d258fe7ed6e95496fb0cd0daa3d9a4e40db7b332d71a234c93d20e22", "bytes": 211746 }, "screenshot.jpg": { "sha256": "3b6f02b69024fd2de862fe8555157c453c8fef3e29b2b7f720ed33f226bff325", "bytes": 676024 }, "text.txt": { "sha256": "cd3f99c6c9f942595087eaa47ae8e71639cd4526a4453110ddd6a6365de3ae26", "bytes": 11890 } }, "started_utc": "2026-10-22T18:23:29.244Z", "status": 200, "final_url": "https://www.tuttotech.net/news/2026/10/22/vulnerabilita-php.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "it", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 7 new items in it: TuttoTech reports government shutdowns in the Netherlands, France, Denmark and Finland, plus Canada, Wikipedia and the Internet Archive. It covers the AI discovery and AWS's early detection, and cites Censys data that 1.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Due gravi falle in PHP mandano offline i siti web governativi\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `it/news/tuttotech/news-2026-10-22-vulnerabilita-php-html`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: TuttoTech.net. Language: it. URL: https://www.tuttotech.net/news/2026/10/22/vulnerabilita-php.html\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nTuttoTech reports government shutdowns in the Netherlands, France, Denmark and Finland, plus Canada, Wikipedia and the Internet Archive. It covers the AI discovery and AWS's early detection, and cites Censys data that 1.5 million of 2.6 million hosts ran unpatched PHP.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/it/news/tuttotech/news-2026-10-22-vulnerabilita-php-html.json`), not the publisher's and not checked word for word by the curator.\n\n**offline**: In the Netherlands, Overheid.nl, the Port of Rotterdam, football federation KNVB, the five largest political parties' sites and several hospital portals went offline.\n\n> nei Paesi Bassi lo stop ha interessato anche il portale governativo Overheid.nl, il porto di Rotterdam, la federazione calcistica nazionale KNVB, i siti dei cinque maggiori partiti politici e diversi portali ospedalieri.\n\n_Watch reader's translation:_ in the Netherlands the shutdown also affected the government portal Overheid.nl, the port of Rotterdam, the national football federation KNVB, the sites of the five largest political parties and several hospital portals.\n\n**offline**: In Denmark, Kombit, the IT company running municipal services, temporarily shut several platforms including the national school communication system.\n\n> In Danimarca, Kombit, l’azienda informatica che gestisce servizi per i comuni, ha annunciato la chiusura temporanea di diverse piattaforme, compreso il sistema nazionale di comunicazione scolastica.\n\n_Watch reader's translation:_ In Denmark, Kombit, the IT company that manages services for municipalities, announced the temporary closure of several platforms, including the national school communication system.\n\n**offline**: France's Interior Ministry put its websites into preventive maintenance mode.\n\n> La Francia ha adottato una misura analoga, con il Ministero dell’Interno che ha posto i propri siti web in modalità di manutenzione preventiva.\n\n_Watch reader's translation:_ France adopted a similar measure, with the Interior Ministry putting its websites into preventive maintenance mode.\n\n**offline**: In Canada the temporary suspension of some services was announced.\n\n> Anche in Canada è stata annunciata la sospensione temporanea di alcuni servizi\n\n_Watch reader's translation:_ In Canada too, the temporary suspension of some services was announced\n\n**offline**: The Internet Archive said it briefly paused some activities to deal with the issue.\n\n> Internet Archive ha dichiarato di aver interrotto brevemente alcune attività per affrontare il problema.\n\n_Watch reader's translation:_ The Internet Archive said it briefly interrupted some activities to address the problem.\n\n**number**: Censys data: about 1.5 million of 2.6 million hosts reported a PHP version for which no fix was available.\n\n> secondo i dati della società di analisi Censys, circa 1,5 milioni di host su 2,6 milioni segnalavano l’utilizzo di una versione di PHP per la quale non era disponibile una correzione.\n\n_Watch reader's translation:_ according to data from analytics firm Censys, about 1.5 million of 2.6 million hosts reported using a PHP version for which no fix was available.\n\n**official**: Costin Raiu, co-founder of research firm TLP, described a race to exploitation and warned of large-scale compromise of vulnerable web servers.\n\n> Costin Raiu, cofondatore della società di ricerca sulla sicurezza informatica e di risposta agli incidenti TLP, ha descritto questa dinamica come una corsa allo sfruttamento delle falle\n\n_Watch reader's translation:_ Costin Raiu, co-founder of the security research and incident response firm TLP, described this dynamic as a race to exploit the flaws\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 7 new items in it: TuttoTech reports government shutdowns in the Netherlands, France, Denmark and Finland, plus Canada, Wikipedia and the Internet Archive. It covers the AI discovery and AWS's early detection, and cites Censys data that 1.\n\nSupports: translations/it/news/tuttotech/news-2026-10-22-vulnerabilita-php-html.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "tvtechnology-infrastructure-security-how-to-protect-y", "url": "https://www.tvtechnology.com/infrastructure/security/how-to-protect-your-station-from-php2shell", "publisher": "TV Tech", "kind": "news", "title": "How to Protect Your Station From PHP2Shell | TV Tech", "published": "2026-10-26T13:15:32Z", "captures": [ { "stamp": "20261026T170916Z", "files": { "headers.json": { "sha256": "2e80a288a997a0f193c25df3dcc4974c600b2bde76740e27c1e2d2a3f71907e6", "bytes": 2421 }, "page.html": { "sha256": "e38765ac517b2d8e20c94471249e050e9a99c19014ce2b8304589a27e31336ac", "bytes": 1120140 }, "provenance.json": { "sha256": "83c8bc6e959831ee90995da964e1bec6ed6a0b21d09859739cfa3e14bf01f2ad", "bytes": 1768 }, "rendered.html": { "sha256": "e44479d127b49fb7c84a8e03dfb3fc3b0c9c04e2b478358d2f37d5019a75c89b", "bytes": 1161360 }, "screenshot.jpg": { "sha256": "a093e04e6a97c62458dd89ddf4f48f126fd0d97bd55c8e20f190255b3e49c13a", "bytes": 681447 }, "text.txt": { "sha256": "ff46c45e7a7e83451c6cdb4aeb312b8ef0fd526f5a337d17a37524ce0de3999c", "bytes": 11300 } }, "started_utc": "2026-10-26T17:33:26.616Z", "status": 200, "final_url": "https://www.tvtechnology.com/infrastructure/security/how-to-protect-your-station-from-php2shell" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T170916Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). TV Tech (US, English), 26 October, by Nick Langan: 'How to protect your station from PHP2Shell', written for radio and TV station engineers. It says a...", "raw_sha256": {}, "has_notes": true, "notes_md": "# How to Protect Your Station From PHP2Shell | TV Tech\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/news/tvtechnology/infrastructure-security-how-to-protect-your-station-from-php`, snapshot `20261026T170916Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T170916Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nTV Tech (US, English), 26 October, by Nick Langan: 'How to protect your station from PHP2Shell', written for radio and TV station engineers. It says administrators began pulling affected sites offline after news trickled out on Wednesday, and that about 70% of websites are estimated to run on PHP; it quotes the software engineer Jeff Geerling (via Radio World) that more than half the internet's public services run on PHP, and that millions of routers, device backends and embedded tools also use it, though many do not expose that interface to the public internet; it quotes Microsoft's chief executive Satya Nadella, speaking at an AI Tour event in Germany, 'I've not seen anything like this in a long, long time'; and mentions the separate eMudhra intermediate-certificate compromise and a Node.js issue in the same week, with tips from the FBI.\n\n> seen anything like this in a long, long time\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"How to Protect Your Station From PHP2Shell | TV Tech\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "uk-edinburgh-council", "url": "https://www.edinburgh.gov.uk/", "publisher": "edinburgh.gov.uk", "kind": "government", "title": "Home – The City of Edinburgh Council", "published": null, "captures": [ { "stamp": "20261022T081940Z", "files": { "headers.json": { "sha256": "5b0c2f2f2f2adac16e8aea91766e3bf330147b025746aefc77de7cbc15b28b80", "bytes": 621 }, "page.html": { "sha256": "91d7847df525e1b8df2d6e6df1ca60c56e5def200252796893d555bf256b5360", "bytes": 64820 }, "provenance.json": { "sha256": "479d5602d1a8929b0e89a474628de89b7091e747ec84c503d26442211780c7fb", "bytes": 926 }, "rendered.html": { "sha256": "3b404767e790607c81648c674f2c3a6f2c1cf4e0b5f510c60372e7ced18b4f04", "bytes": 85320 }, "screenshot.png": { "sha256": "612cdf82ad70d709d2f503e5bd0e4bbe0d95286c72e51e9e2dcceb4c4dda1a9d", "bytes": 934354 }, "text.txt": { "sha256": "eef60737c49dfded7a4cf9d305998ac3db3278cf7683c33adb852be709ee3b97", "bytes": 2792 } }, "started_utc": "2026-10-22T08:19:40.197Z", "status": 200, "final_url": "https://www.edinburgh.gov.uk/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "A capture of the site itself on 22 October (HTTP 200, no error), taken to record whether it was up. Row written by claude-newsroom-lead from provenance.json: the collector-gov agent stopped before committing.", "raw_sha256": {}, "has_notes": false }, { "slug": "unige-site", "url": "https://www.unige.ch/", "publisher": "unige.ch", "kind": "government", "title": "Error 503", "published": null, "captures": [ { "stamp": "20261022T081909Z", "files": { "headers.json": { "sha256": "45d418c6a1e13df367e5e13dfedc3c3513a91092939f89a4eb322a8f42577c36", "bytes": 156 }, "page.html": { "sha256": "4588df31ba75c0a04c05e175d37f8cc5a25d23d6db540d28a36f66fec14254f9", "bytes": 19901 }, "provenance.json": { "sha256": "6c2047a27366d8503e5879f2b0f2c3944b2955861f810845b58c9686c7784120", "bytes": 871 }, "rendered.html": { "sha256": "1a4e507f0d762ff9c1a560b5ee5c9d49cefcab50d31cb7a71e961b34e611a01a", "bytes": 19945 }, "screenshot.png": { "sha256": "d1297a7617fc41349319a3083ffb2125087cc9d2d9e00983e19af3ea4f21a14d", "bytes": 41256 }, "text.txt": { "sha256": "4bdf3d6eb3f0d3b621b80a040ea09917da9c7b4a435f5ab1d995009e57ed3e92", "bytes": 241 } }, "started_utc": "2026-10-22T08:19:09.716Z", "status": 503, "final_url": "https://www.unige.ch/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "usa-today-php2shell-live", "url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/", "publisher": "USA Today", "kind": "news-live", "title": "Latest on PHP vulnerability as patch gets released, NSA issues warning", "published": "2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata)", "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "986913b020afb8175c71098e3c5ae0a1dd98b5e4946f4fdf9aaae4210d123029", "bytes": 3227 }, "page.html": { "sha256": "2fd5c3af9f85319dbc2a5ed6bcee683a64e480fb1b923b9b1e311ee541d0f299", "bytes": 238686 }, "provenance.json": { "sha256": "2b254772d214775a4d8b0ccdff400e4e98bca7f49709467c73bb13ada1d85c40", "bytes": 1685 }, "rendered.html": { "sha256": "cda4c0f9cd9bc2cb7444c5c9440efa87788e7228859c88e885d1b36f32d4ad76", "bytes": 1301168 }, "screenshot.jpg": { "sha256": "465c18afd0371a4b6dc4990243f5594fdacc682deec3820eeab7b9f325103966", "bytes": 538847 }, "text.txt": { "sha256": "ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355", "bytes": 18287 } }, "started_utc": "2026-10-23T01:37:18.231Z", "status": 200, "final_url": "https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): Cloudflare: atte...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Latest on PHP vulnerability as patch gets released, NSA issues warning\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/news/usa-today/php2shell-live`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: USA Today. Language: en. URL: https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/\n\n## What the page says\n\n_Curator's reading of the capture._\n\nUSA Today's live page on 21 October: the release of the patches, the NSA's warning, governments taking sites down, CERT-EU's advice to take sites down if fixes cannot be applied at once, and a Q&A for readers. Cloudflare's Daniele Molteni says Cloudflare observed exploit attempts, \"including spikes of thousands of attempts\", and attackers modifying tactics to bypass protections, and states that \"Those observations describe attack attempts; they do not, by themselves, establish successful compromises.\" No organisation is named as compromised.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): Cloudflare: attempts \"do not, by themselves, establish successful compromises\"\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "voix-business-cards-rainforest-ip-activity-an", "url": "https://voix.jp/business-cards/rainforest-ip-activity-analysis/", "publisher": "voix", "kind": "news", "title": "RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIX", "published": "2026-10-23T09:16:38+00:00", "captures": [ { "stamp": "20261024T160544Z", "files": { "headers.json": { "sha256": "19c9b0cd27d0cd052155a7af4f2856f249a5401e8acefb2e7effb4b07f5dc626", "bytes": 1034 }, "page.html": { "sha256": "e0bbe671adc77bad60f96f39cf3a1ba4315573b5e78c5a90373eadc6df9ccbd6", "bytes": 110333 }, "provenance.json": { "sha256": "9f4d26c952e32aa982c8e31db8c787cd017d4454ffe563b2e3d6761444e64c91", "bytes": 1707 }, "rendered.html": { "sha256": "873b42ec13cb5d4d5962a2c457a884f2884eb91b9166cef439a0b74c011045bb", "bytes": 112883 }, "screenshot.jpg": { "sha256": "6258f273644324fd5b5031139cac3d2bc9b7a35b991880decb0c8be3076de4d3", "bytes": 585936 }, "text.txt": { "sha256": "3e5e879383dd76ceedde10291eb662d52a451e20b573d86c3b1c0ef1ace3b61a", "bytes": 11610 } }, "started_utc": "2026-10-24T16:22:27.305Z", "status": 200, "final_url": "https://voix.jp/business-cards/rainforest-ip-activity-analysis/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). VOIX (Japanese), 23 October: the Japanese firm RainForest published findings on PHP2Shell. Using its own honeypot network, it cross-checked threat inf...", "raw_sha256": {}, "has_notes": true, "notes_md": "# RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIX\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/voix/business-cards-rainforest-ip-activity-analysis`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nVOIX (Japanese), 23 October: the Japanese firm RainForest published findings on PHP2Shell. Using its own honeypot network, it cross-checked threat information from VulnCheck and Amazon Threat Intelligence and found activity history for 3 of 11 public IP addresses (about 27%); it observed 21 PHP2Shell-related HTTP POST requests from different source IPs; for one address, scanning activity was recorded before the PHP2Shell traffic. The curator did not copy the IP addresses.\n\n> 11の公開IPアドレスのうち約27％にあたる3 IPの活動履歴を確認した\n\n_Curator's translation:_ \"confirmed the activity history of 3 IPs, about 27% of the 11 public IP addresses\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"RainForestが明らかにしたPHP2Shell脆弱性に関連する3つのIPアドレスの活動履歴 - VOIX\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `ja`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "wall-street-articol-it-and-c-important-vulnerabilita", "url": "https://www.wall-street.ro/articol/it-and-c/important-vulnerabilitatea-php2shell-ce-recomanda-expertii-in-tehnologie.html", "publisher": "Wall-Street.ro", "kind": "news", "title": "IMPORTANT Vulnerabilitatea PHP2Shell: ce recomandă experții în tehnologie și unde e expunerea cea mai mare", "published": "not stated in the capture", "captures": [ { "stamp": "20261025T093507Z", "files": { "headers.json": { "sha256": "575efb2794e26eefc288a844f31621c90353ed62cee86e658d368b67a889c4d1", "bytes": 1817 }, "page.html": { "sha256": "3ba1ef988552f2c5c6f8e5e6dfc66644a5f662edb0ecb3a45e1079cad65791c8", "bytes": 183067 }, "provenance.json": { "sha256": "9e41fea08822a6b1432ed7c273ef502cec7d05d38f69c0911952d150f43c7658", "bytes": 1875 }, "rendered.html": { "sha256": "ae5825099ba301faa875a0b8218c5efac8bb93628d588b3bcc950559810d915b", "bytes": 158846 }, "screenshot.jpg": { "sha256": "9cd885983134935381a7ada14d0f10846eec9f89c43218e2b9b35f3019331831", "bytes": 896304 }, "text.txt": { "sha256": "c7b3997e8853ddbaf2dbbedd5d43f3647ed05da0223a4f4e6dbd648be234e0e0", "bytes": 16060 } }, "started_utc": "2026-10-25T09:55:01.964Z", "status": 200, "final_url": "https://www.wall-street.ro/articol/it-and-c/important-vulnerabilitatea-php2shell-ce-recomanda-expertii-in-tehnologie.html" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). Wall-Street.ro (Romanian): important, the PHP2Shell vulnerability, what technology experts recommend and where exposure is highest. The same Zitec tex...", "raw_sha256": {}, "has_notes": true, "notes_md": "# IMPORTANT Vulnerabilitatea PHP2Shell: ce recomandă experții în tehnologie și unde e expunerea cea mai mare\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ro/news/wall-street/articol-it-and-c-important-vulnerabilitatea-php2shell-ce-rec`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nWall-Street.ro (Romanian): important, the PHP2Shell vulnerability, what technology experts recommend and where exposure is highest. The same Zitec text as the Economedia capture: the flaws have been in PHP for over ten years and, per Calif, the behaviour behind the problem was flagged in a bug report in 2020 with no follow-up.\n\n> Vulnerabilitățile, înregistrate ca CVE-2026-109618 și CVE-2026-109619, se regăsesc în PHP de mai bine de zece ani, iar semnalele au existat cu mult înainte de momentul de acum.\n\n_Curator's translation:_ \"The vulnerabilities, registered as CVE-2026-109618 and CVE-2026-109619, have been in PHP for more than ten years, and the signals existed well before now.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"IMPORTANT Vulnerabilitatea PHP2Shell: ce recomandă experții în tehnologie și unde e expunerea cea mai mare\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "watchtowr-php2shell", "url": "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "publisher": "watchTowr", "kind": "researcher", "title": "watchtowr.com", "published": null, "captures": [ { "stamp": "20261022T111839Z", "files": { "headers.json": { "sha256": "ff01331edab1c463627b7d97ebbf6c6089f2893fb06dcf8f589c2d11416bf603", "bytes": 2911 }, "page.html": { "sha256": "cfe1d709b20d9c9c8d6383853add5bab85c168f532041e5f4733b5cce5fed8f3", "bytes": 456212 }, "provenance.json": { "sha256": "97a66648fa1ef3d782a7e0d1be25a472e3d4248521e20afc78bba0856d9006cb", "bytes": 1001 }, "rendered.html": { "sha256": "afa2a67a0dee2a2d057885312d74f1277ab47cc85f919220d2421a6d6044265d", "bytes": 183693 }, "screenshot.png": { "sha256": "cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee", "bytes": 21632 }, "text.txt": { "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "bytes": 106 } }, "started_utc": "2026-10-22T11:18:39.647Z", "status": 200, "final_url": "chrome-error://chromewebdata/" }, { "stamp": "20261023T232528Z", "files": { "headers.json": { "sha256": "9569e2acde13e8a452b23805f6ba7482845cc4544b0eee5ee3dc0e37aa1ab84d", "bytes": 3172 }, "page.html": { "sha256": "49880f3a542b39683d2008bdad6af97f5fd98e1aa62a7163cd2bcb35a1c7f7d6", "bytes": 461495 }, "provenance.json": { "sha256": "2c8567c9443613c7212763a8699b43fde1826d21f9744b59164606bc69800e5a", "bytes": 1735 }, "rendered.html": { "sha256": "77923dc2a9eeb33d82effb69df89fb6e137ce0ea3ff56fe67959498711bfd051", "bytes": 535286 }, "screenshot.jpg": { "sha256": "2bfb399a3f975123b73f36d938d2c48e0b57c46f1530edd612255273341bfc27", "bytes": 761462 }, "text.txt": { "sha256": "e09524178ed5f328df70485889aa78f37e3bf819682db33e22b4d1a875d1199f", "bytes": 12450 } }, "started_utc": "2026-10-23T23:40:13.817Z", "status": 200, "final_url": "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild.", "raw_sha256": {}, "has_notes": true, "notes_md": "# watchtowr.com\n\nCaptured by claude-story-site. Status: captured. BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild.\n\n- 403 'Access to watchtowr.com was denied'. Content known only second-hand. Retry from another egress.\n" }, { "slug": "watchtowr-php2shell-faq", "url": "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "publisher": "watchTowr", "kind": "researcher", "title": "watchtowr.com", "published": null, "captures": [ { "stamp": "20261022T111847Z", "files": { "headers.json": { "sha256": "0c655abac86df9e59b49a895ed0bc35a702af92b957d5db757df55be64fd9ff8", "bytes": 2908 }, "page.html": { "sha256": "9ad5ad45ab50498bff4fec7104988da089ca1e17cc8145805e57fe493e22893c", "bytes": 457843 }, "provenance.json": { "sha256": "779e5cb94040a7b1083dedc2aa737205276d134f02007caceae9ff3ab737420c", "bytes": 993 }, "rendered.html": { "sha256": "ed77bdfb70c799526cb11ef4c80486ab375a2bebf338de76275278dd5be92f25", "bytes": 183669 }, "screenshot.png": { "sha256": "cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee", "bytes": 21632 }, "text.txt": { "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "bytes": 106 } }, "started_utc": "2026-10-22T11:18:47.417Z", "status": 200, "final_url": "chrome-error://chromewebdata/" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "cad4df531da848990002b6cb29acf493343ce806cbfc1a14d5d8f5cfc4681400", "bytes": 3171 }, "page.html": { "sha256": "a37d6427ad2b41f96406baf00c0582a62bc01a93589026fe41e1674189f6ef2e", "bytes": 463706 }, "provenance.json": { "sha256": "214e9f9b59ac4b19cc20a4783d38bd711654c978f19bde3bbe1cb58b9d002c3b", "bytes": 1723 }, "rendered.html": { "sha256": "ed1654f5460ab4343b5451a30df79efe21e650a9aa2c0e037eeaeb8c6b11c286", "bytes": 481960 }, "screenshot.jpg": { "sha256": "a039228f4e36bf0a2026db2e79fa46bab9461133bdc3789b8082681080cea63a", "bytes": 591741 }, "text.txt": { "sha256": "3c561d0c08e9343f817d78c30427c55eb4a491ccd2a59babcb879a65da8def37", "bytes": 8906 } }, "started_utc": "2026-10-23T16:24:48.429Z", "status": 200, "final_url": "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "BLOCKED: HTTP 403.", "raw_sha256": {}, "has_notes": true, "notes_md": "# watchtowr.com\n\nCaptured by claude-story-site. Status: captured. BLOCKED: HTTP 403.\n\n- 403. Search summary: the FAQ ties exploitation to watchTowr's honeypot network and describes the flaws as disclosed ahead of an expected 22 October announcement.\n" }, { "slug": "watson-wirtschaft-schweiz-322033892-php2shell-laut-bund-kein", "url": "https://www.watson.ch/wirtschaft/schweiz/322033892-php2shell-laut-bund-keine-hackerangriffe-in-der-schweiz-bekannt", "publisher": "Watson", "kind": "news", "title": "PHP2Shell: Laut Bund keine Hackerangriffe in der Schweiz bekannt", "published": null, "captures": [ { "stamp": "20261022T181608Z", "files": { "headers.json": { "sha256": "d076c07a3a2f4ade16f12ce6a3fce3efb319f6cd5ab2345bc1ab3213346ba530", "bytes": 860 }, "page.html": { "sha256": "48610e805d8f58a45344032ed4eee18b235df468dd0fc08045b0f262cff47b63", "bytes": 690448 }, "provenance.json": { "sha256": "b2040a586fb4888425c0d92e3bafe5d567c47fd11670fc929e65fa54f07d585e", "bytes": 1813 }, "rendered.html": { "sha256": "eeb6716159d724161fe63d1b9ea9be7af3f313efd005a75a0c93e95848fc4725", "bytes": 872416 }, "screenshot.jpg": { "sha256": "e4169bfc29bd37d796008bffff79d8dc547e9c37deda057432bc710668e6950e", "bytes": 676413 }, "text.txt": { "sha256": "6fe889c621b7f2e10f0d7e50707cf7b1293585ce07ebcb55833beb176c3e2ac5", "bytes": 8097 } }, "started_utc": "2026-10-22T18:19:44.681Z", "status": 200, "final_url": "https://www.watson.ch/wirtschaft/schweiz/322033892-php2shell-laut-bund-keine-hackerangriffe-in-der-schweiz-bekannt" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "de", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T181608Z. 5 new items in de: Watson (Keystone-SDA) reports the Swiss Federal Office for Cyber Security (BACS) knows of no attacks in Switzerland and has no reliable figures, but confirms PHP applications in the federal administration were affected. ", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Laut Bund keine Hackerangriffe in der Schweiz bekannt\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `ch/news/watson/wirtschaft-schweiz-322033892-php2shell-laut-bund-keine-hacke`, snapshot `20261022T181608Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T181608Z/provenance.json`. Publisher: Watson. Language: de. URL: https://www.watson.ch/wirtschaft/schweiz/322033892-php2shell-laut-bund-keine-hackerangriffe-in-der-schweiz-bekannt\n\n## What the page says\n\n_The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_\n\nWatson (Keystone-SDA) reports the Swiss Federal Office for Cyber Security (BACS) knows of no attacks in Switzerland and has no reliable figures, but confirms PHP applications in the federal administration were affected. It names Basel-Stadt and Swiss universities as having gone offline, and cites dpa on German states, municipalities and hospitals going offline at the BSI's request, plus German MP Marc Henrichmann.\n\n## Verbatim quotes, with the watch reader's translation\n\nEach quote is in the snapshot as served. The English is the source watch reader's translation (`translations/ch/news/watson/wirtschaft-schweiz-322033892-php2shell-laut-bund-keine-hacke.json`), not the publisher's and not checked word for word by the curator.\n\n**agency**: BACS said PHP-based applications in the Swiss federal administration were also affected and the responsible units were told to install updates quickly.\n\n> Auch in der Bundesverwaltung seien PHP-basierte Anwendungen von den Schwachstellen betroffen gewesen. Die zuständigen Stellen seien informiert und zur raschen Installation der Sicherheitsupdates aufgefordert worden.\n\n_Watch reader's translation:_ PHP-based applications in the federal administration were also affected by the vulnerabilities. The responsible units had been informed and asked to install the security updates quickly.\n\n**agency**: BACS told Keystone-SDA it has no reliable figures on affected Swiss websites, shops or internal applications, and knows of no attacks in Switzerland so far.\n\n> Belastbare Zahlen und Daten zu betroffenen Websites, Onlineshops oder internen Anwendungen liegen nicht vor, wie das Bundesamt für Cybersicherheit (BACS) am Donnerstag auf Anfrage der Nachrichtenagentur Keystone-SDA mitteilte.\n\n_Watch reader's translation:_ Reliable figures and data on affected websites, online shops or internal applications are not available, the Federal Office for Cyber Security (BACS) told the news agency Keystone-SDA on Thursday.\n\n**offline**: Websites in Switzerland shut down preventively on Wednesday include the cantonal sites of Basel-Stadt and online services of Swiss universities.\n\n> so unter anderem die kantonalen Webseiten von Basel-Stadt sowie Online-Dienste von Schweizer Universitäten und Hochschulen.\n\n_Watch reader's translation:_ including the cantonal websites of Basel-Stadt and online services of Swiss universities and colleges.\n\n**offline**: Per dpa, several German federal states, municipalities, authorities, universities and hospitals took their websites temporarily offline at the BSI's request.\n\n> Mehrere Bundesländer, Kommunen, Behörden, Universitäten und Spitäler hätten auf Aufforderung des deutschen Bundesamts für Sicherheit in der Informationstechnik hin vorsorglich ihre Websites vorübergehend vom Netz genommen.\n\n_Watch reader's translation:_ Several federal states, municipalities, authorities, universities and hospitals had, at the request of the German Federal Office for Information Security, temporarily taken their websites offline as a precaution.\n\n**official**: Marc Henrichmann, chair of the German Bundestag's Parliamentary Control Panel for the intelligence services, called it one of the most serious security gaps of recent years.\n\n> Der Vorsitzende des Parlamentarischen Kontrollgremiums für die deutsche Geheimdienste, Marc Henrichmann, sprach von der «ernstesten Sicherheitslücken der vergangenen Jahre».\n\n_Watch reader's translation:_ The chair of the Parliamentary Control Panel for the German intelligence services, Marc Henrichmann, spoke of 'the most serious security gaps of recent years'.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): 5 new items in de: Watson (Keystone-SDA) reports the Swiss Federal Office for Cyber Security (BACS) knows of no attacks in Switzerland and has no reliable figures, but confirms PHP applications in the federal administration were affected. \n\nSupports: translations/ch/news/watson/wirtschaft-schweiz-322033892-php2shell-laut-bund-keine-hacke.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "weirdgloop-blog-php2shell", "url": "https://weirdgloop.org/blog/php2shell", "publisher": "Weird Gloop (cookmeplox)", "kind": "vendor", "title": "Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111827Z", "files": { "headers.json": { "sha256": "037e837186e2c7a0cba07dfd9d40f13048c890bbaadc11f106846fa944a5be77", "bytes": 1399 }, "page.html": { "sha256": "a3e0b5fe5b1aa03d078a69481cdf944185f03e1dc6c03dc0691a3e5efc114ea3", "bytes": 13477 }, "provenance.json": { "sha256": "fe3b34860b94853f39a64f8004b2d23fc9efb14b15b7b3ea51cfd4a71b44c2f9", "bytes": 966 }, "rendered.html": { "sha256": "d5e9b3b80f7c33d96ece63b4e16e9256bc7f05dc61993a9ed6673d64d898e28a", "bytes": 13486 }, "screenshot.png": { "sha256": "8014b0889ab8777b9c1ef8b2562da1fe3f4c2d0d858c2727dfe7d79acae1ceaa", "bytes": 369760 }, "text.txt": { "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "bytes": 4262 } }, "started_utc": "2026-10-22T11:18:27.255Z", "status": 200, "final_url": "https://weirdgloop.org/blog/php2shell" }, { "stamp": "20261023T080157Z", "files": { "headers.json": { "sha256": "c5dd775f0cfc5e09754017b41f0ac823475353d4cfd52237b146ed48608d8371", "bytes": 1461 }, "page.html": { "sha256": "d974a801e093822c24a502653b6df2c3dec5197feba2f37adf88049822948d3d", "bytes": 13480 }, "provenance.json": { "sha256": "455402873ad13afe50b64e46dd937b476e49ec4dddd3e42daa108cacfd2f9fea", "bytes": 1546 }, "text.txt": { "sha256": "52f0a619f6b077916c97436152c0dbf919eb15c18f189672a30fcecee0827038", "bytes": 4265 } }, "started_utc": "2026-10-23T08:02:11.531Z", "status": 200, "final_url": "https://weirdgloop.org/blog/php2shell" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Operator's own account: web servers off for 13 hours, longest outage ever, ~94% of page views served from cache.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop\n\nCaptured by claude-story-site. Status: captured. Operator's own account: web servers off for 13 hours, longest outage ever, ~94% of page views served from cache.\n\n- 'we turned off the webservers for all of the wikis hosted by Weird Gloop, until a patch was released 2 hours ago. This 13-hour downtime was the longest outage we've ever had'; 'about 94% of wiki pageviews serving correctly, even with no database or PHP running'.\n- Opinion: 'probably the most significant security vulnerability in the history of the internet'; expects old PHP forums to have been compromised (no case named).\n- About 500 million page views a month, 8 staff.\n" }, { "slug": "wersm-php2shell-legacy-infrastructure-web-risk", "url": "https://wersm.com/php2shell-legacy-infrastructure-web-risk/", "publisher": "wersm", "kind": "news", "title": "PHP2Shell Shows the Risk of Legacy Web Infrastructure", "published": "2026-10-25T12:44:30+00:00", "captures": [ { "stamp": "20261026T013143Z", "files": { "headers.json": { "sha256": "f8d75b0fabbdcb2c0fa38cdd3248ee2ec3326800c81f1069917b85675d658709", "bytes": 1345 }, "page.html": { "sha256": "e9f974977163431242cfbc6004a02c6a4cfae3bc131af0656dbf3271770f5dbe", "bytes": 114248 }, "provenance.json": { "sha256": "ef6e65d08117eda4a783e16978c1521d060d85b764ebbb2100f40f6c5be03504", "bytes": 1636 }, "rendered.html": { "sha256": "de88e6aeca9289667d0cf7b9cf490de62034c87ba46015f5819557c1dfb32c03", "bytes": 428125 }, "screenshot.jpg": { "sha256": "61b432047b7ba659533ec6e3f6e7475245df0395d8b73c60d88e040ea5519c8a", "bytes": 420638 }, "text.txt": { "sha256": "e8ab2d9bb4f16fbe0aaeaaca8be044de7f36eeb785f83f36d6d2cd4ead2cd5e3", "bytes": 5188 } }, "started_utc": "2026-10-26T01:53:49.520Z", "status": 200, "final_url": "https://wersm.com/php2shell-legacy-infrastructure-web-risk/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T013143Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). WeRSM (English), updated 25 October, an opinion piece by Marcel D. arguing that PHP2Shell shows how an old shared layer still puts the web at risk. It...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Shows the Risk of Legacy Web Infrastructure\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `us/news/wersm/php2shell-legacy-infrastructure-web-risk`, snapshot `20261026T013143Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T013143Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nWeRSM (English), updated 25 October, an opinion piece by Marcel D. arguing that PHP2Shell shows how an old shared layer still puts the web at risk. It leans on TechCrunch for the facts: Amazon detected exploitation about a week before the public patches, Cloudflare saw an exponential rise in attempts after disclosure, and Palo Alto Networks and Trail of Bits later reported confirmed compromises and post-exploit activity. It says Calif found the flaws during a security audit and used AI as an aid in the exploitation work, and that the researchers' own explanation stressed their prior knowledge of PHP. The wider internet 'appears to have avoided the mass compromise many defenders feared'.\n\n> TechCrunch also reports that Amazon detected exploitation about a week before the public patches became available, while Cloudflare saw an exponential increase in exploitation attempts after disclosure.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell Shows the Risk of Legacy Web Infrastructure\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "wikimediastatus-page", "url": "https://www.wikimediastatus.net/", "publisher": "wikimediastatus.net", "kind": "news", "title": "Wikimedia Status", "published": null, "captures": [ { "stamp": "20261022T081850Z", "files": { "headers.json": { "sha256": "43b0b5cfcac9a0b20aec9f323980f25fc68c73a4c28cd03779fd05bf1ef170df", "bytes": 2587 }, "page.html": { "sha256": "932bc299819bdcdd36ea74d48217ba41c86685f95b95ef4e681ec151a52a9626", "bytes": 98053 }, "provenance.json": { "sha256": "14eb7c6e76fec0a2d270f7346e0e6f69f27e24c14bb016e7413b30504cc18dc8", "bytes": 910 }, "rendered.html": { "sha256": "bd57bc4e1fab2c0e051a4b7b577e24a15117ce0315f32b8c5ea5af9c6dc67706", "bytes": 232435 }, "screenshot.png": { "sha256": "93eb032f0b0834ff0c5e4ce281e745d4c53afc0c9426480e0cbf541d56996704", "bytes": 309152 }, "text.txt": { "sha256": "13e068d2c2b3665d1ad67a02da3752c77bb617ab952507f4cbc16168b0e1a72f", "bytes": 2228 } }, "started_utc": "2026-10-22T08:18:50.248Z", "status": 200, "final_url": "https://www.wikimediastatus.net/" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "wikipedia-dan-kaminsky", "url": "https://en.wikipedia.org/wiki/Dan_Kaminsky", "publisher": "Wikipedia (English)", "kind": "other", "title": "Dan Kaminsky - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113323Z", "files": { "headers.json": { "sha256": "230fef32ef2b8e3a03fd564dddff422d11bc2aaa9c55bf790e489e49cd1728d0", "bytes": 6516 }, "page.html": { "sha256": "6c89a48790d2570768a3e30b6e6773d391a8726a2ea374490158e9788351b499", "bytes": 239532 }, "provenance.json": { "sha256": "912e913138aa6da2c78cb8a72b6f0f49ff311ecb7d55a3f3ebe018788dc415c7", "bytes": 940 }, "rendered.html": { "sha256": "6965408cf93703569203e0b1fa6278195218e7179ca2f79c981126987636c876", "bytes": 431088 }, "screenshot.png": { "sha256": "615f1446bfe1602439edb7b7273d7e7b74aeb78f40c45e5ef95312ecab6b44d8", "bytes": 2208990 }, "text.txt": { "sha256": "565033cfb92639ca1311f148e4c1fddbec463cd655a7b253b698b0d3bbee7d5b", "bytes": 19564 } }, "started_utc": "2026-10-22T11:33:23.838Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Dan_Kaminsky" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: Dan Kaminsky, for the 2008 DNS flaw.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Dan Kaminsky - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: Dan Kaminsky, for the 2008 DNS flaw.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-en-mainpage", "url": "https://en.wikipedia.org/wiki/Main_Page", "publisher": "en.wikipedia.org", "kind": "news", "title": "Wikipedia, the free encyclopedia", "published": null, "captures": [ { "stamp": "20261022T081858Z", "files": { "headers.json": { "sha256": "e955926167e0071dc046d0d19f1e93de7c6f689da1fd735810200711d198ec98", "bytes": 6588 }, "page.html": { "sha256": "124c0cf0f5d69d4eb2f539691b78a3d2b7f775276d7d403ce7b41c790d05afc8", "bytes": 256072 }, "provenance.json": { "sha256": "2069c319a6a98a5ea0b1b892cbce10d6403fedecbdbb77caa0b194640df7976e", "bytes": 941 }, "rendered.html": { "sha256": "342d21cca365ec9dca361d699b42b88ffee199c899ee2903183a7b86ad1a441c", "bytes": 417303 }, "screenshot.png": { "sha256": "9e9389a0f25bde4e29d9de15fffef615450272353491c9a719285f4a0cdce022", "bytes": 1270714 }, "text.txt": { "sha256": "e1f68a6602ba7fa72443285d1a741f99af7d3266877b5cb3d6dfcdfe655d35ad", "bytes": 8195 } }, "started_utc": "2026-10-22T08:18:58.117Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Main_Page" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "wikipedia-equifax-breach", "url": "https://en.wikipedia.org/wiki/2017_Equifax_data_breach", "publisher": "Wikipedia (English)", "kind": "other", "title": "2017 Equifax data breach - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113329Z", "files": { "headers.json": { "sha256": "c3bc169ae4d898eb6475902410fddd73fa4ed34ce0daddd19f5f6a5f46ce5742", "bytes": 6561 }, "page.html": { "sha256": "063ebe77541faf5b4a538fb6536569545115ba07e4ece30ec4b609b3f10e0715", "bytes": 357275 }, "provenance.json": { "sha256": "f1e5a749836d6e8fa78cb7d8298991d435408424506415523c68e32f854be7ea", "bytes": 978 }, "rendered.html": { "sha256": "fd59a52a810139932c34d91ab988792d0f289833507ce5edaa59b5f0c50a1403", "bytes": 561514 }, "screenshot.png": { "sha256": "87c5de1374b3c50ce76b221a56993bae2c23023f9774f9bce5dea3822cde37c9", "bytes": 3123746 }, "text.txt": { "sha256": "e38b857233007afea66a356c3b1b109917746f474776fef1897536936986af07", "bytes": 34565 } }, "started_utc": "2026-10-22T11:33:29.720Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/2017_Equifax_data_breach" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the 2017 Equifax breach (Struts CVE-2017-5638).", "raw_sha256": {}, "has_notes": true, "notes_md": "# 2017 Equifax data breach - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the 2017 Equifax breach (Struts CVE-2017-5638).\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-heartbleed", "url": "https://en.wikipedia.org/wiki/Heartbleed", "publisher": "Wikipedia (English)", "kind": "other", "title": "Heartbleed - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113241Z", "files": { "headers.json": { "sha256": "ebf98b097de4ce11194b4121b9de21f82d8c75e7117279bd2b10d469c923f907", "bytes": 6561 }, "page.html": { "sha256": "548f1ff2c768078511e876df9f95289590100729e454fe278693a08fc838717e", "bytes": 833943 }, "provenance.json": { "sha256": "6ce9e63913d1a8ac51b9519d592d2eb038f9cf41bd235baf4008e90594ca666b", "bytes": 932 }, "rendered.html": { "sha256": "7fa05158620c1d78de2df881c24a28d80da7f4244ada06ba16854d311e830cf5", "bytes": 1113858 }, "screenshot.png": { "sha256": "7affc5c7f2af7e59d01dddfa5ae745b2a322d785e9d0e23b518defaf08b9b12c", "bytes": 6147603 }, "text.txt": { "sha256": "335a02e5907d498b4ff7cd3bb3e63c86596c9590ec307cd2b82a13a8d0b9911d", "bytes": 66888 } }, "started_utc": "2026-10-22T11:32:41.345Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Heartbleed" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the Heartbleed article, for the context page.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Heartbleed - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the Heartbleed article, for the context page.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-log4shell", "url": "https://en.wikipedia.org/wiki/Log4Shell", "publisher": "Wikipedia (English)", "kind": "other", "title": "Log4Shell - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113317Z", "files": { "headers.json": { "sha256": "87abc43f478d756f7d6b4f160635cf45fb9be84375d34b71cc12d70e91c81117", "bytes": 6559 }, "page.html": { "sha256": "f21f5113f869aeb05d3c2467525fa6a946a0622c8295ec8ca5e52e2cdee958ad", "bytes": 350814 }, "provenance.json": { "sha256": "d08c417c0b7261fd57ff15f73a65ba91d48121268d596490e7f069b30b449a53", "bytes": 928 }, "rendered.html": { "sha256": "6b9cee027909f277350e142b3d325f5a0575732f0b5e2c76f8c35c9361c214e3", "bytes": 553202 }, "screenshot.png": { "sha256": "a64453cfa8cdf7caa73bdc64dbb02943ed99ea9130ce83fd5c6cdd1cebdb74d5", "bytes": 2405972 }, "text.txt": { "sha256": "cd08f6a7082ea6e3cc172d7738243c4eda26331c8af2aded091e27dca5066058", "bytes": 25890 } }, "started_utc": "2026-10-22T11:33:17.588Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Log4Shell" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "93384855ddaba204221406c48283eee52724b53d5dd8de164e4cd63b773d8031", "bytes": 6588 }, "page.html": { "sha256": "8a2c0743a4acf7df7119376f8eb7cb787134f185ad08b490a4e857818661da0f", "bytes": 349414 }, "provenance.json": { "sha256": "cb59c8ab9d2e3bde3537252dd3fb30f9231bf9b8a30a2f202fab2b6426ca33ca", "bytes": 1647 }, "rendered.html": { "sha256": "f3f241535690f775a0652bce819500eb5e6047e4a2f2c7e4194bacb531c7b636", "bytes": 551718 }, "screenshot.jpg": { "sha256": "223465a3fb231521e37e0934dd81cd07ba7f4ccd357236f735e02bbe80db999c", "bytes": 1137683 }, "text.txt": { "sha256": "2ba8f232d639e2bf4ee509ae602ea5ab3c86726d6f393c94d16fc39b686f71f9", "bytes": 25860 } }, "started_utc": "2026-10-23T16:18:18.593Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Log4Shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the Log4Shell article.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Log4Shell - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the Log4Shell article.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-moveit-breach", "url": "https://en.wikipedia.org/wiki/2023_MOVEit_data_breach", "publisher": "Wikipedia (English)", "kind": "other", "title": "2023 MOVEit data breach - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113336Z", "files": { "headers.json": { "sha256": "5c9771f190e153438296ebd93a2e83ed2e272b0edabfdc8e90270b0e8cc36a0a", "bytes": 6516 }, "page.html": { "sha256": "586dcd3eba4df977cd0483dd2543c14bb75c8097933ea13131fa4b0913ac6847", "bytes": 163389 }, "provenance.json": { "sha256": "9ac856ea4fd003d7c9d3e5784e6ab684a8bc8ccd3c807e4cf1174b414aee3936", "bytes": 974 }, "rendered.html": { "sha256": "bcc9ee65deff5809f27130574759019489d461e3374937d785fd991252a55488", "bytes": 339581 }, "screenshot.png": { "sha256": "3348e9116d0ce06e40962d5c5f4bb2592f0ff8d1b01baab3d3911f1710f8f8f5", "bytes": 1089154 }, "text.txt": { "sha256": "ad5c2515a778a3582e85c270cfbb1178c90a7477c3f38eaf804fa10528942be1", "bytes": 11123 } }, "started_utc": "2026-10-22T11:33:36.760Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/2023_MOVEit_data_breach" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "934c64d49c553613038160a00c8fcc485fd00b415923ce7e1e22afb3b5be7c41", "bytes": 6576 }, "page.html": { "sha256": "f7acb730b3150aaaeb60d022f48615f28d4b9751aacba6e1e1b426953c0b0913", "bytes": 162382 }, "provenance.json": { "sha256": "e2cbf422e2b86074184a03f554b9baaae0a5c919c9b87478a500587761a2ee8b", "bytes": 1717 }, "rendered.html": { "sha256": "cc0f252542136f86d32e45c49fce9ac935cedacfe9004ab88f5a13326807d622", "bytes": 338605 }, "screenshot.jpg": { "sha256": "c3a33842225c4c1375e6068f974c0505192e1294c5237a986d23db93497a1ded", "bytes": 542854 }, "text.txt": { "sha256": "047ae65c996b5fd9a88e4b4cdc857b59143f633632ed49a3dc7991cb7f4d1267", "bytes": 11019 } }, "started_utc": "2026-10-23T16:18:20.599Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/2023_MOVEit_data_breach" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the 2023 MOVEit breach.", "raw_sha256": {}, "has_notes": true, "notes_md": "# 2023 MOVEit data breach - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the 2023 MOVEit breach.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-php2shell", "url": "https://en.wikipedia.org/wiki/PHP2Shell", "publisher": "Wikipedia (English)", "kind": "other", "title": "PHP2Shell - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T112309Z", "files": { "headers.json": { "sha256": "df684951111f873760fab5d20078208e1e989557f1150d9aeaa7966ee6c8ca75", "bytes": 6560 }, "page.html": { "sha256": "f306b23e38d55d74fa6405a49e04b8dd420d7f5795c1b999f7d2303feed2a904", "bytes": 223796 }, "provenance.json": { "sha256": "16395d927a990f7bb2679d0861242bf3705586641c4f2e7bc9b839580b0eaf64", "bytes": 928 }, "rendered.html": { "sha256": "f51281e6ee013358343fd07568c8ef63acc38f4340841c824d6c3941004b14e3", "bytes": 408195 }, "screenshot.png": { "sha256": "ae58953f05c3bd41c5e57931462c15c8213fb7843a0c45d0b9b045b00f4ce8c5", "bytes": 1586902 }, "text.txt": { "sha256": "bbb51bbd069506b09282b45086984565ae875b5d974d121584c8e2b3c912222f", "bytes": 16230 } }, "started_utc": "2026-10-22T11:23:09.510Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/PHP2Shell" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "e2254fb49fc7a7329531a655adc103548d954d74cf59cc4781d1c86e9f61020c", "bytes": 6585 }, "page.html": { "sha256": "a310d7d84e2748ce729107fcef3642e5c4e9c12996a184bb0c9f5cf3590b4681", "bytes": 273715 }, "provenance.json": { "sha256": "3d3536d66a4944740ef6d94c5dced200c2c89313558af830457eee534742f7ca", "bytes": 1646 }, "rendered.html": { "sha256": "ce058df595b4dfbd8f8229172fe343fbd5ddd91cbace3b7671f44af3212ec2f8", "bytes": 464711 }, "screenshot.jpg": { "sha256": "409ba4f4b1053d44542ff9aaf6e33e4e3d5afe13669ce1ea05b3a80a3be8c603", "bytes": 765132 }, "text.txt": { "sha256": "8123fb7cd4cfbb45571a8e05537e0c5d29133a05e1488ed96f323069848ddacc", "bytes": 15524 } }, "started_utc": "2026-10-23T16:18:20.717Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/PHP2Shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the encyclopaedia article, captured as a record of the public account on 22 Oct; says publicly announced 20 Oct and patched the next day.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the encyclopaedia article, captured as a record of the public account on 22 Oct; says publicly announced 20 Oct and patched the next day.\n\n- Tertiary. Its outage list and timing are not used as evidence here, only as a record of what the public account said at capture time.\n" }, { "slug": "wikipedia-shellshock", "url": "https://en.wikipedia.org/wiki/Shellshock_(software_bug)", "publisher": "Wikipedia (English)", "kind": "other", "title": "Shellshock (software bug) - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113310Z", "files": { "headers.json": { "sha256": "f2a4b3ae6fb24202324c3478fe96ec7d871fbf062829bf047dea987ca29a646d", "bytes": 6559 }, "page.html": { "sha256": "800b60bd11e65365ea12c0db8526f932f55188ca76f3f6eaec4ff4833ba26fec", "bytes": 326860 }, "provenance.json": { "sha256": "0468fb94f26b99cb42b1033597a200e955bd047d1d544cf0aa1e63108588a950", "bytes": 977 }, "rendered.html": { "sha256": "2823f220d4e3aa6ce700cdff250ab35732495a32d273c0b6ab24dd2445aa2dc1", "bytes": 522813 }, "screenshot.png": { "sha256": "5f62672b0225c6d055a4a1d802c68a3acf695790ff6f20fee8baaf67f7b5f21a", "bytes": 2735619 }, "text.txt": { "sha256": "300be73066bba3f66a53bc1116a1a3c7bbe5e61695f1ce8a801c112237b61041", "bytes": 27686 } }, "started_utc": "2026-10-22T11:33:10.881Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Shellshock_(software_bug)" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the Shellshock article.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Shellshock (software bug) - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the Shellshock article.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-spring-framework", "url": "https://en.wikipedia.org/wiki/Spring_Framework", "publisher": "Wikipedia (English)", "kind": "other", "title": "Spring Framework - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113341Z", "files": { "headers.json": { "sha256": "93660dd4eb58188f8cdd099a1a9f09f42a33c872d13690748edc637974e623d7", "bytes": 6517 }, "page.html": { "sha256": "242f49c0d152a3caa2f0bf0cbfef5baa6f4dfcc62b890886a6f53576021af63d", "bytes": 622623 }, "provenance.json": { "sha256": "2a065f50a364fdd1cae0a5b064fe9e7fe715a6aabe14d7e11ca72727b5b61330", "bytes": 956 }, "rendered.html": { "sha256": "96223727d419aba6ee0c683f3d172a10324e28762e3f7dcb32d41519da2596a8", "bytes": 896578 }, "screenshot.png": { "sha256": "0601fe81d23975fda4d4036553b0ff37eb4fe8ea9928d9b697df2d4791acf6da", "bytes": 4931001 }, "text.txt": { "sha256": "710060585680e022348a35516ce4f13f4d99c2df75fe72a6ec01fe1a223081d1", "bytes": 49455 } }, "started_utc": "2026-10-22T11:33:41.449Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Spring_Framework" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: Spring Framework (Spring4Shell section).", "raw_sha256": {}, "has_notes": true, "notes_md": "# Spring Framework - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: Spring Framework (Spring4Shell section).\n\n- Tertiary comparator record.\n" }, { "slug": "wired-exploited-days-before-patched", "url": "https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/", "publisher": "WIRED", "kind": "news", "title": "Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED", "published": "2026-10-22T02:24Z (page metadata)", "captures": [ { "stamp": "20261023T012042Z", "files": { "headers.json": { "sha256": "cdea39f9041c102d99987c0678b106458e3ea49746c7b6df268cd29ff1610a17", "bytes": 1668 }, "page.html": { "sha256": "fb4d5d01f6a54a59b38b324364e19dc66eaf270a0528f0468dffebe21b015afc", "bytes": 1245418 }, "provenance.json": { "sha256": "c88e3863ab2f3db40fa3d4bad4d2f8b6c49dc11bb2e0b264727c9de6f242ecf7", "bytes": 1723 }, "rendered.html": { "sha256": "3dfcff4c0800daedd95b55f7510974ced8eac740a0e6ab92d8e0eb5cd206ecf9", "bytes": 1499604 }, "screenshot.jpg": { "sha256": "4d6198142ef9e78fff96238d160eb6750b0c420c9e963ec76b2b13ae49b48d5d", "bytes": 706558 }, "text.txt": { "sha256": "d43b99af65d563ddd047c20c80d5318813eda28abd497763f91dd0a6ab8427cd", "bytes": 9384 } }, "started_utc": "2026-10-23T01:38:55.902Z", "status": 200, "final_url": "https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation: ...", "raw_sha256": {}, "has_notes": true, "notes_md": "# Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/tech-press/wired/exploited-days-before-patched`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: WIRED. Language: en. URL: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/\n\n## What the page says\n\n_Curator's reading of the capture._\n\nWIRED: research published by AWS on the evening of 21 October shows at least one actor attempted to exploit PHP2Shell on 17 October, seen on an AWS honeypot from a commercial anonymisation network; in the hours before disclosure AWS honeypots were hit by multiple attempts from several apparent actors, and AWS CISO CJ Moses says it is unclear whether any would have succeeded on real systems while also saying PHP2Shell \"is now being broadly exploited\". The headline says the flaws were \"exploited\" days before the patch; the body describes attempts. PHP Foundation executive director Elizabeth Barron: \"to our knowledge, there has been no successful attempt at remote code execution.\" Moses argues AI is shrinking the time from patch to working exploit.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ (\"no named organisation has said it was compromised through php2shell\"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation: no successful RCE to its knowledge; Amazon: unclear whether attempts would succeed\n\nSupports: data/compromise.json on the site (/compromise/)\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "wiz-blog-php2shell", "url": "https://www.wiz.io/blog/php2shell-php-rce", "publisher": "Wiz (Wiz Research)", "kind": "researcher", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081047Z", "files": { "headers.json": { "sha256": "f3a7f515bda9ae91541c7792cad2fbb4d5864a7962be4f5db93bccbe8caa2d03", "bytes": 5075 }, "page.html": { "sha256": "32408c9f60071e7bdcf0e702160f6c398d6967cb89fbc81b5f0e0029e34af07b", "bytes": 438665 }, "provenance.json": { "sha256": "4e362d46ccd571e124b20fb3518c8d00076dc508a0146ee5338a7dce931d1fa1", "bytes": 1002 }, "rendered.html": { "sha256": "6db43e32910bdf4bc2b82a93afa5097900aa4a205b5cdde32d1a2510beff4c68", "bytes": 580534 }, "screenshot.png": { "sha256": "4ba83874c540e1f7faf4c817b6b8c3ae1ef61eacda5851a112d6601e47d6d91f", "bytes": 2753995 }, "text.txt": { "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "bytes": 19147 } }, "started_utc": "2026-10-22T08:10:47.953Z", "status": 200, "final_url": "https://www.wiz.io/blog/php2shell-php-rce" }, { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "9a16e711afa57b40119200d4edbace18a1e933561b09e239752b3796525ce1a9", "bytes": 5133 }, "page.html": { "sha256": "76dcb531033b21e366d4f5a6f70f4985f27945ecd9d4483e54929e184f778d47", "bytes": 439659 }, "provenance.json": { "sha256": "e1c70991a21d294d5f694fae2f0a1cccb9fc5d6e7905faacc0d639652e991c31", "bytes": 1537 }, "text.txt": { "sha256": "4c6c2b8a41be8de0fd90fcc8232995625833e085788e2f99ce8ef9789b09635d", "bytes": 19135 } }, "started_utc": "2026-10-23T16:27:23.359Z", "status": 200, "final_url": "https://www.wiz.io/blog/php2shell-php-rce" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Wiz Research post dated October 21, 2026. Source of '70% of the Internet' headline; body basis is 'powers 70% of all websites'. Disclosure timeline: discovered Aug 19, reported Aug 24, PHP ack Sep 21. Credits Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Wiz Research blog: \"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet\"\n\n- URL https://www.wiz.io/blog/php2shell-php-rce ; dated \"October 21, 2026\". Captured 2026-10-22T08:10:47Z, HTTP 200.\n- 70% basis: body says PHP \"powers 70% of all websites in the world\" — a share-of-websites figure (no source cited for it on the page) that the headline turns into \"70% of the Internet\". Conclusion: \"With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated.\"\n- Severity claim: \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n- AI: \"We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability...\" Quote from Raluca Ada Popa, Head of Gemini Security, Google DeepMind. \"a single researcher completed in a week what previously would have taken a world-class team months of work.\"\n- Credits: \"Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification.\"\n- Partners named: \"Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and many others\".\n\n## Wiz's timeline (verbatim)\n- \"August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.\"\n- \"August 20, 2026: Unauthenticated RCE is confirmed against Drupal.\"\n- \"August 21, 2026: Unauthenticated RCE is confirmed against WordPress.\"\n- \"August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.\"\n- \"September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.\"\n- \"October 21, 2026: Patched PHP releases become available.\" / \"Public disclosure.\"\n\n## Notes\n- No mention of the leak, the Calif video or Chainguard.\n- \"September 21 ... begins developing a coordinated fix\" conflicts with the PHP Foundation's account that fixing was \"the top priority\" \"from August 11th onward\" (Daubois: fix PR opened 2026-09-25).\n- The BBC's \"most severe ever found by AI\" wording is not on this page as such; closest is \"arguably in software history\".\n" }, { "slug": "x-eastdakota-php2shell-stats", "url": "https://x.com/eastdakota/status/2113079352682570051", "publisher": "Matthew Prince (@eastdakota), Cloudflare CEO", "kind": "social", "title": "Matthew Prince 🌥 on X: \"Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X", "published": "2026-10-22T01:25Z", "captures": [ { "stamp": "20261022T111808Z", "files": { "headers.json": { "sha256": "d77dc66c0c59c96e2e54ddfecf08d3b1bd24635a9d74435e5e11a42df31beefb", "bytes": 9023 }, "page.html": { "sha256": "957516e4670ab0fa18a3dbfcc6a2a4fb7bf154370fd7b09506a876e6d327f357", "bytes": 143568 }, "provenance.json": { "sha256": "6ef963e6f636da1603f65de2817e02480ed92a2c4d5b330a151bc2d515c21277", "bytes": 1249 }, "rendered.html": { "sha256": "25a31a5f7554396a5640c88efcf0624e0eab811ea96a53cebc603eb9c55925ad", "bytes": 165274 }, "screenshot.png": { "sha256": "7a098d734f074f04d4c95973bd0f4463f3c18bd7aaf274912a6eea795095879c", "bytes": 216866 }, "text.txt": { "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "bytes": 1884 } }, "started_utc": "2026-10-22T11:18:08.749Z", "status": 200, "final_url": "https://x.com/eastdakota/status/2113079352682570051" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Matthew Prince 🌥 on X: \"Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X\n\nCaptured by claude-story-site. Status: captured. Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture.\n\n- Displayed '1:25 · 22 Oct 2026' in a UTC browser. Verbatim: 'In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.'\n- Attempts, not blocks and not compromises. No blocked count.\n" }, { "slug": "x-feross-chainguard", "url": "https://x.com/feross/status/2113043398664015878", "publisher": "Feross Aboukhadijeh (@feross) on X", "kind": "social", "title": "Feross on X: \"Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112105Z", "files": { "headers.json": { "sha256": "c7243f6c403eb56e9b3d6e563eb8a8b216ea9dd8211fb1b22d4707fb94277f57", "bytes": 9023 }, "page.html": { "sha256": "a96f60627079ac4894ec940931bd0fd5f7aafe3bf8894230fb3292b941681412", "bytes": 192869 }, "provenance.json": { "sha256": "a7be68aef95eb2bd14be51e50215f101dd44d0e36eb5539a9393115df9ab4ce2", "bytes": 1233 }, "rendered.html": { "sha256": "61fc4e7f751c5a119c9a9a1081b8c47669ac9fe2d7dfd07833772658c39e8fdf", "bytes": 173209 }, "screenshot.png": { "sha256": "75299998b6abad9947b1d3f6d8ce0f477a1e8980c7f9484bdde10796bfc16bb1", "bytes": 560505 }, "text.txt": { "sha256": "de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6", "bytes": 5709 } }, "started_utc": "2026-10-22T11:21:05.468Z", "status": 200, "final_url": "https://x.com/feross/status/2113043398664015878" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Feross on X: \"Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X\n\nCaptured by claude-story-site. Status: captured. A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.\n\n- Restates the Foundation's account; opinion thread. Captured for the 69% phrasing and the date.\n" }, { "slug": "x-lcfr-hax-hash-tweet", "url": "https://x.com/lcfr_hax/status/2085031675382071483", "publisher": "Ryan Austin (@lcfr_hax), Calif", "kind": "social", "title": "LCFR on X: hash commitment d935be02…", "published": "2026-08-05T15:54Z", "captures": [ { "stamp": "20261022T081603Z", "files": { "headers.json": { "sha256": "ea81d1bf086428a65e67d0551ac1c3aebc53a1cd4c39b43d3ed837bbd8acee28", "bytes": 9022 }, "page.html": { "sha256": "11a7ec8817e3966590490fb928089c210339261afe54cc2f72353dca15f41391", "bytes": 132347 }, "provenance.json": { "sha256": "508544ce2c74aa23119fa27daa5a30b5ae63e47e7cd3e690fb9cf9a54ef7cded", "bytes": 1012 }, "rendered.html": { "sha256": "9a1b5b36d22e9689e136b35c76adc712c6977f4ec6f1bd41655bdb1caff65fac", "bytes": 160702 }, "screenshot.png": { "sha256": "9dfa4845de672eb2ec27885a9cff17fe9af803635a290c1cfc17f6ee5902d54e", "bytes": 262114 }, "text.txt": { "sha256": "2c10f3991caf3a74b21df9d9e0362fd1bab8aefc5113877a412dac999ca36372", "bytes": 1018 } }, "started_utc": "2026-10-22T08:16:03.064Z", "status": 200, "final_url": "https://x.com/lcfr_hax/status/2085031675382071483" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Hash-only tweet shown as '15:54 · 5 Aug 2026' (capture browser in UTC). Cited by Calif's timeline and by X Community Note on OpenAI's post as proof of prior discovery. Pre-image not published here.", "raw_sha256": {}, "has_notes": true, "notes_md": "# @lcfr_hax (Ryan Austin, Calif): hash tweet, 5 Aug 2026\n\n- Text is only a SHA-256-style hex string: \"d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac\". Displayed \"15:54 · 5 Aug 2026\"; 565.5K views at capture.\n- Calif's write-up: \"2026 — August 5 Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.\" It is a priority commitment: it predates Wiz's stated discovery (Aug 19) and the PHP Foundation's record of first reports (Aug 11).\n- Pre-image not published (as far as seen). We cannot verify what the hash commits to. Open question: has Calif released the pre-image?\n- Replies (third-party): @trythreews: \"Let's set the record straight. @lcfr_hax was the first to discover php2shell and develop a working exploit. His work convinced the PHP Foundation to invest in fixing this entire bug class.\"\n- X's own snowflake ID 2085031675382071483 could be decoded to a timestamp for independent confirmation of the date (not done here).\n" }, { "slug": "x-openai-php2shell", "url": "https://x.com/OpenAI/status/2112907856018309586", "publisher": "OpenAI (@OpenAI)", "kind": "social", "title": "OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP", "published": "2026-10-21T14:04Z", "captures": [ { "stamp": "20261022T081645Z", "files": { "headers.json": { "sha256": "427b75f5bb12cb7b0acee221f2065095d92c82279e0db87f9b80909525886df3", "bytes": 9023 }, "page.html": { "sha256": "8e6a0183b6982e8530d7b48277e4b0f6f010b22d3348b30328cc4460cc371d90", "bytes": 160064 }, "provenance.json": { "sha256": "3e52aad242520de5ca4db4103baf86c58e7d477a8f7c04c19b841034f1ca49e3", "bytes": 1232 }, "rendered.html": { "sha256": "2e31eee6ab72f0703675cd74158267dbe5cfb55bf03b80153deaa1b899be4c10", "bytes": 147195 }, "screenshot.png": { "sha256": "aaf750d50e69e80b34fbdf908a9fdc330ac315b765eacb2e3e8361cb40f2cbb2", "bytes": 570247 }, "text.txt": { "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "bytes": 3316 } }, "started_utc": "2026-10-22T08:16:45.188Z", "status": 200, "final_url": "https://x.com/OpenAI/status/2112907856018309586" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Shown '14:04 · 21 Oct 2026', 5.2m views. Full text captured (stands in for the blocked openai.com post). Carries an X Community Note disputing OpenAI's discovery role and linking lcfr_hax.", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI on X, 21 Oct 2026 14:04 UTC\n\n- Full text (verbatim): \"OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. ... Due to the severity of these flaws and PHP's widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender's Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.\"\n- Links to openai.com/index/coordina… = \"Patch the Planet: global response coordination as agents uncover critical vulnerabilities\" (blocked; see openai-blog-coordinated-disclosure).\n- X COMMUNITY NOTE (as displayed): \"OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher. x.com/lcfr_hax/statu…\" (the note's \"several months\" is itself inaccurate: Aug 5 to Oct 21 is under 3 months).\n- Wording difference: BBC quotes \"one of the most impactful security issues in recent memory\"; the tweet says \"one of the most impactful vulnerabilities in recent memory\". The blog may use \"security issues\" — unverified (blocked).\n- \"ahead of attackers\" conflicts with Amazon's Oct 17 MadPot attempt (thehackernews-php2shell-4days) and Cloudflare's report of attack traffic after the leak.\n- Reply (third party): \"Patching the planet by prematurely leaking vuln details? Sure.\"\n" }, { "slug": "x-wiz-io-php2shell", "url": "https://x.com/wiz_io/status/2112899813264277528", "publisher": "Wiz (@wiz_io)", "kind": "social", "title": "Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet", "published": "2026-10-21T13:32Z", "captures": [ { "stamp": "20261022T081624Z", "files": { "headers.json": { "sha256": "f9a8ec8c80b7e7b13a6e772a718ece30ec0796dffd3481acc57a310616eca249", "bytes": 9022 }, "page.html": { "sha256": "6adc23abb012a9e89f22453d2d8d4f0eff574edc67373bc94eef59cfc12ebe85", "bytes": 183867 }, "provenance.json": { "sha256": "5df6949985ad1cf4a150d5b9a7e52f1355bac3b127484b31c70c8052986b1556", "bytes": 1086 }, "rendered.html": { "sha256": "9c5f87ac8afbe6aad1205a23ecbe79d83dc801c77f4d0ffb750ffb5b53625888", "bytes": 193354 }, "screenshot.png": { "sha256": "d2187dc09d49ec23ea5593aa7ffef5df60cd2385f290922ec6d77b6861fc7abb", "bytes": 578314 }, "text.txt": { "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "bytes": 2222 } }, "started_utc": "2026-10-22T08:16:24.485Z", "status": 200, "final_url": "https://x.com/wiz_io/status/2112899813264277528" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Shown '13:32 · 21 Oct 2026' (UTC in capture browser) — 28 min before the 14:00 UTC release. Thread says 'Apply the Oct 22 security release immediately' — stale date from the original schedule.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Wiz on X: \"#PHP2SHELL ... impacting 70% of the Internet\"\n\n- Verbatim: \"🚨 BREAKING: @wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.\" Shown 13:32 · 21 Oct 2026 (UTC), i.e. before the 14:00 UTC release.\n- \"Wiz Research uncovers\" framing: no credit to Calif or OpenAI in the lead post (the blog thanks them).\n- Thread: \"All php versions >= 5.4 are affected by at least 1 of these vulnerabilities.\" \"Confirmed pre-auth RCE on representative targets: WordPress, Drupal, and Joomla\". \"Patch: Apply the Oct 22 security release immediately\" — wrong date (the release moved to Oct 21), so the thread was probably drafted before the leak moved the date.\n- 70% here is \"of the Internet\"; Wiz's blog body and Cloudflare/OpenAI say \"of websites\".\n" }, { "slug": "yahoo-jp-gmo-fx-login-leak", "url": "https://news.yahoo.co.jp/articles/d6083f71bbeab0f1488fac1edbb1e75d9156e358", "publisher": "Yahoo! News Japan (J-CAST)", "kind": "news", "title": "GMO「悪用確認されず」から一転　FX口座ログイン情報、流出の可能性　不正操作報告も（J-CASTニュース） - Yahoo!ニュース", "published": null, "captures": [ { "stamp": "20261022T191523Z", "files": { "headers.json": { "sha256": "8089e945f23a0dff3b1328e4d3d1ccf2adccd21dee3ce523093c79be2c59f641", "bytes": 1350 }, "page.html": { "sha256": "f87878e9d634a797da428109b424f11ac2d1b2ec5f69f14006d048fba00e62f1", "bytes": 158328 }, "provenance.json": { "sha256": "b8ce463ecb94a4bb90fa9db888989e777e612c4c2b78513fed0a314d7c463dc3", "bytes": 1724 }, "rendered.html": { "sha256": "4fe1a7d56ce6ed822914bdbec4af2771bc55d380a56364c1284352f72d6af220", "bytes": 632171 }, "screenshot.jpg": { "sha256": "f7f8063a4acbf8153c3c3b4d01d948ddf21e998f37822649e9dc4101b49ca5eb", "bytes": 796250 }, "text.txt": { "sha256": "f3823c3f22ffbc12645f52b502bdce26ced07bcb0865b7d9fb26529e49c85c0b", "bytes": 16504 } }, "started_utc": "2026-10-22T19:15:23.775Z", "status": 200, "final_url": "https://news.yahoo.co.jp/articles/d6083f71bbeab0f1488fac1edbb1e75d9156e358" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "ja", "notes": "Promoted from the source watch (oq9gflln), snapshot 20261022T191523Z. GMO FX VPS compromise: 26,739 servers, logins possibly taken, fraud reported; cause not stated", "raw_sha256": {}, "has_notes": true, "notes_md": "# GMO「悪用確認されず」から一転　FX口座ログイン情報、流出の可能性　不正操作報告も（J-CASTニュース） - Yahoo!ニュース\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `jp/news/yahoo-news-jp/gmo-fx-login-leak`, snapshot `20261022T191523Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191523Z/provenance.json`. Publisher: Yahoo! News Japan (J-CAST). Language: ja. URL: https://news.yahoo.co.jp/articles/d6083f71bbeab0f1488fac1edbb1e75d9156e358\n\n## What the page says\n\n_Curator's reading of the capture._\n\nYahoo! News Japan carries a J-CAST News article: GMO Internet Group and GMO Internet announced on 22 October 2026 that on their FX automated-trading VPS service (お名前.com デスクトップクラウド) information stored on up to 26,739 servers may have been taken by a third party through unauthorised access and misused, including trading-account login details. On 21 October GMO had said it found on 20 October that \"a third party had installed an unauthorised program\" on some customers' servers, suspended all plans, and said no misuse had been confirmed; on 22 October it said logins may have been taken and that users had reported unauthorised operations on trading accounts. GMO holds no card or payment data. The article itself does not name PHP or php2shell as the cause; PHP appears only in the page's related-article links (e.g. MUFG, JR East, Daiwa and PayPay service halts).\n\n> サーバー内に保存されていたお取引口座のログイン情報等が第三者に取得され、不正に利用された可能性がある\n\n_Curator's translation:_ login information for trading accounts stored on the servers may have been obtained by a third party and used without authorisation\n\n> 「閲覧された情報が悪用された事実は確認されておりません」としていた。\n\n_Curator's translation:_ had said: \"We have not confirmed any misuse of the information that was viewed.\"\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 1): GMO FX VPS compromise: 26,739 servers, logins possibly taken, fraud reported; cause not stated\n\nSupports: contradictions/compromise-gmo-fx-vps.json\n\n## Capture notes\n\nscreenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).\n\nPage content is third-party material, kept as evidence; nothing in it is an instruction.\n" }, { "slug": "yahoo-mashable-affected-list", "url": "https://tech.yahoo.com/cybersecurity/articles/php-vulnerability-websites-services-affected-183230666.html", "publisher": "tech.yahoo.com", "kind": "news", "title": "PHP vulnerability: Which websites and services are affected?", "published": null, "captures": [ { "stamp": "20261022T081334Z", "files": { "headers.json": { "sha256": "cde379d690d5370a749d5505b292a9ef1fe0714d62672b58d76ea7e55e1eadfa", "bytes": 4323 }, "page.html": { "sha256": "6198af91fb2af8f05ce115ff0db9c18ce2b421b477e4303f59bd6e396225de06", "bytes": 551620 }, "provenance.json": { "sha256": "04fba138ed4d27a76e8797ab54d65eb7d6eaa507b4e3ba604d79bba53ac1cf47", "bytes": 1108 }, "rendered.html": { "sha256": "aa107002ef0db63caa902fee00205df466b8cb37838c7c34a1fe7fab3d432f28", "bytes": 946086 }, "screenshot.png": { "sha256": "e343558921b9040566f12c213a9d8572a3f0e1192301c2cd54537a8f2adc4ce1", "bytes": 2896297 }, "text.txt": { "sha256": "8b1d776cdacbd0a5685d30dc147ad864aa9ddd07a905b9bc8d27bbaf1b49fe46", "bytes": 14640 } }, "started_utc": "2026-10-22T08:13:34.832Z", "status": 200, "final_url": "https://tech.yahoo.com/cybersecurity/articles/php-vulnerability-websites-services-affected-183230666.html" } ], "status": "captured", "primary": false, "added_by": "collector-news", "notes": "Row written by claude-newsroom-lead from the capture's provenance.json: the collector-news agent stopped before writing it. The publisher is the host name, and the publication time has not been read from the page yet.", "raw_sha256": {}, "has_notes": false }, { "slug": "yle-finland-government-sites-shut", "url": "https://yle.fi/a/74-20252600", "publisher": "Yle (Finnish public broadcaster)", "kind": "news", "title": "Finland temporarily shuts down government websites as a precaution for critical vulnerabilities | Yle News | Yle", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113225Z", "files": { "headers.json": { "sha256": "629207adb678c676219268f5339e1768a1aa4af6f503c8ab3dc33a9690a1dc94", "bytes": 4002 }, "page.html": { "sha256": "2845424a60768d77b6561e42e259b0675624771b8b77baa4741fbaf4cd0103c8", "bytes": 325894 }, "provenance.json": { "sha256": "e77236132533b194633ab7767e55f09e2854beb49c9ce44fc2725e3606534e78", "bytes": 1011 }, "rendered.html": { "sha256": "156e30b543681b560d3356d18ca5ff9531fa172e3e81f59ceae7ec8662120dd9", "bytes": 269020 }, "screenshot.png": { "sha256": "f6f90718b94a07351d302934a8a237c2e0360d1ac9ae51e79faf8a29afdaf46e", "bytes": 2031875 }, "text.txt": { "sha256": "720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57", "bytes": 6283 } }, "started_utc": "2026-10-22T11:32:25.530Z", "status": 200, "final_url": "https://yle.fi/a/74-20252600" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Finland temporarily shuts government websites as a precaution; Valtori; NCSC-FI rated 9.2, no sign of exploitation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Finland temporarily shuts down government websites as a precaution for critical vulnerabilities | Yle News | Yle\n\nCaptured by claude-story-site. Status: captured. Finland temporarily shuts government websites as a precaution; Valtori; NCSC-FI rated 9.2, no sign of exploitation.\n\n- Precautionary, early afternoon local time.\n" }, { "slug": "yugatech-news-ai-helps-uncover-php2shell-flaws-th", "url": "https://www.yugatech.com/news/ai-helps-uncover-php2shell-flaws-that-put-websites-worldwide-at-risk/", "publisher": "YugaTech", "kind": "news", "title": "AI Helps Uncover PHP2Shell Flaws That Put Websites Worldwide at Risk » YugaTech | Philippines Tech News & Reviews", "published": "2026-10-26T07:33:20+00:00", "captures": [ { "stamp": "20261026T121439Z", "files": { "headers.json": { "sha256": "68f7ea5beb10f02d508e28dc18b2374adc013486705e5fa237d625a09faeb724", "bytes": 1601 }, "page.html": { "sha256": "b6d1675fb094fb0e23a25dbd37c9c342fc2912ebe083cd5dc29361352a08a28f", "bytes": 304272 }, "provenance.json": { "sha256": "4035076f13a18c54480a6739a4178f9f1e35109c16835b628d1f9d6dbb20ff8f", "bytes": 1826 }, "rendered.html": { "sha256": "30203664a2061c0a650ee53e12cc0de6cf95265b3ed548f6429d3d8eb1437b63", "bytes": 316655 }, "screenshot.jpg": { "sha256": "bd2833ba376a2d23698aba4db6d7460a23481b277a94cba80a82837910d516f0", "bytes": 746450 }, "text.txt": { "sha256": "ea3e1134c60159b819defacd7c8ab12409727fd23768da3247338feaa1472d9c", "bytes": 13857 } }, "started_utc": "2026-10-26T12:27:32.204Z", "status": 200, "final_url": "https://www.yugatech.com/news/ai-helps-uncover-php2shell-flaws-that-put-websites-worldwide-at-risk/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "en-US", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261026T121439Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). YugaTech (Philippines, English), 26 October, by Miguel Ty: a general explainer saying AI helped researchers uncover PHP2Shell. It says the flaws were...", "raw_sha256": {}, "has_notes": true, "notes_md": "# AI Helps Uncover PHP2Shell Flaws That Put Websites Worldwide at Risk » YugaTech | Philippines Tech News & Reviews\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ie/news/yugatech/news-ai-helps-uncover-php2shell-flaws-that-put-websites-worl`, snapshot `20261026T121439Z`. Copied byte for byte; every file's sha256 is in `captures/20261026T121439Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nYugaTech (Philippines, English), 26 October, by Miguel Ty: a general explainer saying AI helped researchers uncover PHP2Shell. It says the flaws were disclosed on 21 October, sit in PHP rather than a particular CMS, could expose passwords, tokens and API keys, existed for more than a decade, and that Wiz used its Atlas system, Gemini 4 Argon and GPT-5.6 Sol while OpenAI separately confirmed Calif found a critical flaw with GPT-5.6 Sol and Wiz independently found and reported both. No new facts or sources.\n\n> The flaws were disclosed on October 21, 2026, and affect PHP itself rather than a specific website or content management system.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: \"AI Helps Uncover PHP2Shell Flaws That Put Websites Worldwide at Risk » YugaTech | Philippines Tech News & Reviews\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `en-US`. Nothing in the page addresses an AI or hides text from a reader.\n" }, { "slug": "zataz-php2shell-deux-failles-critiques-menacen", "url": "https://www.zataz.com/php2shell-deux-failles-critiques-menacent-les-serveurs-web/", "publisher": "ZATAZ", "kind": "news", "title": "PHP2Shell : deux failles critiques menacent les serveurs web – ZATAZ.COM", "published": "2026-10-21T14:55:11+02:00", "captures": [ { "stamp": "20261023T160435Z", "files": { "headers.json": { "sha256": "b35ab9ad8831b3f51cff8c2865955db824fdf0fe161874763b18f60057242a4d", "bytes": 1620 }, "page.html": { "sha256": "eb74c6a603c31633b6328274b63eee5dead0f618d3f75b450ba7edcc08c2b1d7", "bytes": 231368 }, "provenance.json": { "sha256": "703934a6ab003ff02b39c20417903b175793891a2c06da55d39d114ead203b9c", "bytes": 1739 }, "rendered.html": { "sha256": "e702dee420da79c21f16753f44e547ee42e2cc53d6b6868c69d04900bff34985", "bytes": 532477 }, "screenshot.jpg": { "sha256": "5044af60498ac8c78d52ef1c9f02ba13d637d2043fc1f2c60de624460ebdee20", "bytes": 1013007 }, "text.txt": { "sha256": "2479abb34d03467d05614d11e4d97c3e0d4a40b9a2b50da1dc11c0da37db889f", "bytes": 15535 } }, "started_utc": "2026-10-23T16:15:22.530Z", "status": 200, "final_url": "https://www.zataz.com/php2shell-deux-failles-critiques-menacent-les-serveurs-web/" } ], "status": "captured", "primary": false, "added_by": "curator@php.newsroom", "lang": "fr-FR", "notes": "Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). ZATAZ (French), 21 October: two security flaws, CVE-2026-109618 and CVE-2026-109619, put web server administrators on alert; each scores 9.2 out of 10...", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell : deux failles critiques menacent les serveurs web – ZATAZ.COM\n\nPromoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `fr/news/zataz/php2shell-deux-failles-critiques-menacent-les-serveurs-web`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.\n\n## What the page says\n\n_Curator's reading of the capture._\n\nZATAZ (French), 21 October: two security flaws, CVE-2026-109618 and CVE-2026-109619, put web server administrators on alert; each scores 9.2 out of 10 on CVSS v4.0. It cites CERT-EU on what an attacker could do.\n\n> Deux failles de sécurité, identifiées sous les références CVE-2026-109618 et CVE-2026-109619, placent les administrateurs de serveurs web en état d’alerte.\n\n_Curator's translation:_ \"Two security flaws, identified under the references CVE-2026-109618 and CVE-2026-109619, put web server administrators on alert.\"\n\n_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ ZATAZ's pre-release explainer (21 Oct) covers the two CVEs, CERT-EU's RCE assessment, and the need to inventory PHP installations before the 16:00 fixes.\n\n## Why it is here\n\nFrom the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: \"PHP2Shell : deux failles critiques menacent les serveurs web – ZATAZ.COM\". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.\n\n## Capture notes\n\nLanguage `fr-FR`. Nothing in the page addresses an AI or hides text from a reader.\n" } ]