Party
watchTowr
confirmed the CVE numbers in public on 20 October, per Daubois
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release | Daubois; CERT-EU lists a watchTowr X post among public reports | reported | 1/2 | Daubois CERT-EU |
| watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild watchtowr.com returns HTTP 403 to this site's capture tool; known only from search summaries. | watchTowr | unverified | 2/2 | watchTowr watchTowr |
Its sources in the vault
- What the PHP2Shell rumors got wrong, from inside the PHP security team Alexandre Daubois (PHP security team / PHP Foundation)
- Security Advisory 2026-018: Critical Vulnerabilities in PHP CERT-EU