[ { "slug": "acn-it-php2shell", "url": "https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php", "publisher": "ACN / CSIRT Italia", "kind": "advisory", "title": "PHP2Shell: sanate vulnerabilità critiche in PHP (AL07/261021/CSIRT-ITA)", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081354Z", "files": { "headers.json": { "sha256": "c44211ff9b8440ef6922919056abed0873179324fdf7db7ddf969c8d1dd6bd15", "bytes": 732 }, "page.html": { "sha256": "6ab511ebb1dd7a3d6235d88dc71a02c8ecefec27283538cec68a134d33d67440", "bytes": 118598 }, "provenance.json": { "sha256": "b832861c53d09b3d98083bc23e3c4578748f1f8173e2ea7c23bd8c9dfa6f1c8b", "bytes": 1038 }, "rendered.html": { "sha256": "91c9550654c551eeacb33e829fe2246a7307efbcf7cd00d4cf10f5a44413cf07", "bytes": 131205 }, "screenshot.png": { "sha256": "94246ab38f323d629edf5c1820908d804f7f45f61bc276e7c77e756aa549fc65", "bytes": 687162 }, "text.txt": { "sha256": "19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6", "bytes": 6137 } }, "started_utc": "2026-10-22T08:13:54.096Z", "status": 200, "final_url": "https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Alert AL07/261021/CSIRT-ITA, published 21-10-2026. CVSS v4.0 9.2 each (Use After Free). Mitigation: only 'aggiornare i prodotti vulnerabili' (update); it gives no offline advice.", "raw_sha256": {}, "has_notes": true, "notes_md": "# ACN / CSIRT Italia alert AL07/261021/CSIRT-ITA\n\n- \"Pubblicato il 21-10-2026\". Captured 2026-10-22T08:13:54Z.\n- It calls both CVEs \"Use After Free\" with CVSS v4.0 9.2. Affected: 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35 (it does not list EOL branches).\n- Mitigation, verbatim: \"Si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.\" It advises update only, with NO offline or isolation advice.\n" }, { "slug": "acsc-alert-php", "url": "https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php", "publisher": "ASD's ACSC (Australia)", "kind": "advisory", "title": "Critical vulnerabilities in PHP", "published": "2026-10-21 (Published); Last reviewed 2026-10-22", "captures": [ { "stamp": "20261022T081658Z", "files": { "headers.json": { "sha256": "3f7c0fe9c702d22193630225a56b0991c08fc52fb05ef53f26ea0f611b798b4e", "bytes": 1985 }, "page.html": { "sha256": "650742fe93abb6dec911f58d21b7cd6d8d82c2d4a7b89eb9745e9a9857bc0c72", "bytes": 1541271 }, "provenance.json": { "sha256": "37ce725a8459c6db87ef8d7e3abd3cf92d350bab9e4228852c7d07dd08d65a6f", "bytes": 985 }, "rendered.html": { "sha256": "731eef8ce851ccf1650bc66cf3bb8658569c3de13b3a8084c14761658743e931", "bytes": 1557700 }, "screenshot.png": { "sha256": "39318847477c383a130dbafc83210dc27ed7ccae88107979ed124e372d67da9d", "bytes": 345966 }, "text.txt": { "sha256": "9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56", "bytes": 6299 } }, "started_utc": "2026-10-22T08:16:58.765Z", "status": 200, "final_url": "https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Alert Status: Critical. Published 21 Oct 2026, last reviewed 22 Oct 2026. 'Recent update': identify PHP, review php.net, apply updates and mitigations, monitor. NO offline advice. 'not aware of successful active exploitation within Australia'. Says full details were announced 'Thursday 22 October 2026 at 0100 AEDT' (=21 Oct 14:00Z). The body text is stale (pre-patch).", "raw_sha256": {}, "has_notes": true, "notes_md": "# ASD's ACSC alert: Critical vulnerabilities in PHP\n\n- Site title \"CGA\". Plain curl to cyber.gov.au timed out from this egress, but Playwright got 200.\n- \"Alert Status: Critical\". \"Published 21 Oct 2026\". \"Last reviewed 22 Oct 2026\". Captured 2026-10-22T08:16:58Z.\n- Recent update (verbatim): \"Patches have been released ... ASD's ACSC recommends organisations: - Identify PHP within their environments - Review the latest PHP guidance at https://www.php.net/index.php - Apply available security updates and other appropriate mitigations - Monitor PHP applications and related systems for suspicious activity.\"\n- The older body text is still pre-patch: \"Prepare to update and apply security patches as they become available.\" It also says \"full details publicly announced on Thursday 22 October 2026 at 0100 AEDT\" (= 2026-10-21T14:00Z). The summary line still reads \"is set for public disclosure on 22 October 2026.\"\n- \"ASD’s ACSC is not aware of successful active exploitation within Australia\".\n- **No take-offline or isolation advice.** This contradicts the BBC framing that the Australian counterpart issued advice like the NCSC/NSA. The ACSC advice is patch, mitigate and monitor.\n" }, { "slug": "acsc-home", "url": "https://www.cyber.gov.au/", "publisher": "ASD's ACSC", "kind": "government", "title": "cyber.gov.au home", "published": null, "captures": [ { "stamp": "20261022T081604Z", "files": { "headers.json": { "sha256": "3d448cbb053930039edd6bcb6779264beb2fa8c4c073bc5084ca3a5b0c369a5f", "bytes": 1937 }, "page.html": { "sha256": "bd81a8f884e1cbe1f2ae88c146b6198346568f2324677adce3198b5578db19c3", "bytes": 1854064 }, "provenance.json": { "sha256": "992e9c6ce0b26d2edb42343e569ac2634e532a277a5e804ec657ed66acda47a9", "bytes": 879 }, "rendered.html": { "sha256": "e22b8af8cb588bdf894c62c53337db8940108a269e2f517f1d6ffa1886d8d904", "bytes": 1889870 }, "screenshot.png": { "sha256": "3f7acad6a96208dca53692a35f83a89e3b21e8266fcd183892673c6e4b3b39b0", "bytes": 723009 }, "text.txt": { "sha256": "b7198501ad800f9312359edf414e81c46b1b35f7d0fae787ff629a8f029ad0b9", "bytes": 13389 } }, "started_utc": "2026-10-22T08:16:04.649Z", "status": 200, "final_url": "https://www.cyber.gov.au/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Home at 08:16Z: the PHP alert teaser is dated 22 Oct 2026 with the stale pre-disclosure blurb.", "raw_sha256": {}, "has_notes": true, "notes_md": "# cyber.gov.au home\n\nCaptured 08:16Z. Teaser: \"22 Oct 2026 Critical vulnerabilities in PHP. A security release for two critical PHP vulnerabilities is set for public disclosure on 22 October 2026.\"\n" }, { "slug": "actuia-anssi-sites-offline", "url": "https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/", "publisher": "ActuIA", "kind": "news", "title": "PHP flaws: France's ANSSI orders sites offline", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112454Z", "files": { "headers.json": { "sha256": "ee48005ae8388bf72bebfeea8f3d95100abf6faae001e3c235a5506d2f6dc21e", "bytes": 473 }, "page.html": { "sha256": "ff30fd43654cd08a1f693e8d4d915c41820729be9a1991d5f4e462d1d0bb22f4", "bytes": 116023 }, "provenance.json": { "sha256": "e9c5fc723d72d43ad18613c74102fa5d72fc2799e91e0f81c2cfbfd51a52d794", "bytes": 1090 }, "rendered.html": { "sha256": "74e68194027420a7a98f41f234f8da46f93ff0e5c77fec86c07d115f15365688", "bytes": 122914 }, "screenshot.png": { "sha256": "f934a67b32d8386b43d01a1a9baece42d7406c36ed9bec407ef19f9a26d73475", "bytes": 1673964 }, "text.txt": { "sha256": "8f399970329ffcead878dced88dbb206b9677895965091d0efb60334becc9f9a", "bytes": 10744 } }, "started_utc": "2026-10-22T11:24:54.144Z", "status": 200, "final_url": "https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: 'France's ANSSI orders sites offline'; compare CERT-FR's own wording (isolate, then migrate).", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP flaws: France's ANSSI orders sites offline\n\nCaptured by claude-story-site. Status: captured. Secondary: 'France's ANSSI orders sites offline'; compare CERT-FR's own wording (isolate, then migrate).\n\n- The headline overstates CERT-FR's text.\n" }, { "slug": "akamai-blog-cve-2024-4577-one-day", "url": "https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure", "publisher": "Akamai Security Research", "kind": "vendor", "title": "CVE-2024-4577 Exploits in the Wild One Day After Disclosure", "published": "2024", "captures": [ { "stamp": "20261022T112501Z", "files": { "headers.json": { "sha256": "b8600b926f54d0c326ae453a4aa45ee026728ff7329884997710f9d1e5f541cb", "bytes": 5460 }, "page.html": { "sha256": "10bed4c03e0d208afa3e6d6d67c8d2250149138bb4d63e87605d1e28079a5171", "bytes": 279021 }, "provenance.json": { "sha256": "67c5b82965151100b965313d300e89e4bd9ca9ce8520a47fa8ba174bd637833b", "bytes": 1084 }, "rendered.html": { "sha256": "3aea0cbcf996a4c4d7b0dfe721b61fee812595d5df395a7b8eb1317ca7c0fa8f", "bytes": 478692 }, "screenshot.png": { "sha256": "5fed6383355ce8c109b539a7e534592d29b584d533df10d4b2228cd9c2431475", "bytes": 2944679 }, "text.txt": { "sha256": "f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567", "bytes": 23021 } }, "started_utc": "2026-10-22T11:25:01.255Z", "status": 200, "final_url": "https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical: exploits of the previous PHP core RCE, CVE-2024-4577, seen in the wild one day after disclosure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CVE-2024-4577 Exploits in the Wild One Day After Disclosure\n\nCaptured by claude-story-site. Status: captured. Historical: exploits of the previous PHP core RCE, CVE-2024-4577, seen in the wild one day after disclosure.\n\n- Comparator for the context page.\n" }, { "slug": "akamai-blog-php-core-rce", "url": "https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core", "publisher": "Akamai Security Research", "kind": "vendor", "title": "Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112525Z", "files": { "headers.json": { "sha256": "3ed908175f73e8f392f99df0845982f172ad44c49cb12692c16c1fcf7849d28d", "bytes": 5850 }, "page.html": { "sha256": "8f9e02a272dd67f8a2770e849f8f8118fc34e45f1cd056fd56e4b5a7f9bae592", "bytes": 213450 }, "provenance.json": { "sha256": "c335fab9c5745922bf97664aa64c00fa23b563ae875eeb2c95316f70f3ae758d", "bytes": 1103 }, "rendered.html": { "sha256": "0400fefe0ed144f5140e8077e5e6d9b401d41cad7ef0b66825c4dec6663f4b33", "bytes": 415118 }, "screenshot.png": { "sha256": "5757611708b507626fda25038e770bb96adb831e42b474d6c5229c30ba0a3a98", "bytes": 609040 }, "text.txt": { "sha256": "2a001600cd450bc582ed42e8355951626ef8ae60e5c4afe233629dbeeaacba5b", "bytes": 5509 } }, "started_utc": "2026-10-22T11:25:25.138Z", "status": 200, "final_url": "https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai\n\nCaptured by claude-story-site. Status: captured. Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence.\n\n- Primary vendor statement.\n" }, { "slug": "arcticwolf-php2shell-exposure", "url": "https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/", "publisher": "Arctic Wolf Labs", "kind": "vendor", "title": "Finding, Prioritizing, and Patching PHP2Shell Exposure | Arctic Wolf", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112342Z", "files": { "headers.json": { "sha256": "cb2dc7b843210683b8616d4f651fe7942a43433cea11e494ec0adb084f793b82", "bytes": 1052 }, "page.html": { "sha256": "62b3d068fbefbb9b312c2418b4a38ef788132d55782e1e41244e77c0bad59726", "bytes": 351404 }, "provenance.json": { "sha256": "015cfc5316cc7077049a8aee5da1a198699d54f7244e62ab8f7bf89b9e5ac590", "bytes": 1123 }, "rendered.html": { "sha256": "1f059cea13ae6b9fa434e23a67c3e8ec05c47fa9af94ac9c5a476013862adb78", "bytes": 1342610 }, "screenshot.png": { "sha256": "0f1c79ead2d73038424318bb8efbe497717653cc82a2b3763f24ce7a95386336", "bytes": 1555808 }, "text.txt": { "sha256": "ef2210c0fd1c35032d70283c91ab44c01c091342c21c9ac55571b12b45f8f75b", "bytes": 10879 } }, "started_utc": "2026-10-22T11:23:42.940Z", "status": 200, "final_url": "https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor guidance on finding and patching exposure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Finding, Prioritizing, and Patching PHP2Shell Exposure | Arctic Wolf\n\nCaptured by claude-story-site. Status: captured. Vendor guidance on finding and patching exposure.\n\n- Captured for the record.\n" }, { "slug": "armis-php2shell-find-patch", "url": "https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/", "publisher": "Armis", "kind": "vendor", "title": "Just a moment...", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112544Z", "files": { "headers.json": { "sha256": "beaea17cfe605c6045c7491c7d444b6fc828d614e9fbacea1cc080a269cc4c31", "bytes": 1990 }, "page.html": { "sha256": "f8ff0c9e277962b98d66e9cf2027f78e3bfbc4d17999419d62b105822a78c6ba", "bytes": 6399 }, "provenance.json": { "sha256": "0cdaf4cb11738a799892b7d79d673ed08c085634e8be431b89fd732adde39e19", "bytes": 1026 }, "rendered.html": { "sha256": "64996869be46fe0ae90238d579e23c2599e4293e9f0c15e82d322efe96fde39b", "bytes": 28992 }, "screenshot.png": { "sha256": "4da50c06b7082cecc3965a33e2fcf67ce4919b97b0730000f14723d2e5ec0321", "bytes": 38997 }, "text.txt": { "sha256": "d15eed6dfa57239bfe3d8333949627f35d8011042027db230828460dbf2b4ff3", "bytes": 261 } }, "started_utc": "2026-10-22T11:25:44.808Z", "status": 403, "final_url": "https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "Vendor guidance on finding and patching.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Just a moment...\n\nCaptured by claude-story-site. Status: blocked. Vendor guidance on finding and patching.\n\n- Captured for the record.\n" }, { "slug": "aws-security-blog-madpot", "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "publisher": "Amazon (CJ Moses, AWS Security Blog)", "kind": "vendor", "title": "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111755Z", "files": { "headers.json": { "sha256": "cd2b6b91c536e98366aa450fc499555f4c46f1fc50e52b619d41fdd8156f7621", "bytes": 961 }, "page.html": { "sha256": "94afa0f2233266fa0310186f90425778563bae6747ca3cf284d7d176d5339c8b", "bytes": 1407726 }, "provenance.json": { "sha256": "0d0fa2b45ba63031f0e80fc3fdf09aaa336dc7d1bb31664221072c5be8924343", "bytes": 1223 }, "rendered.html": { "sha256": "5e11969294ad2dba28416a6f535b5e0674e071861c00efcd5c7b6dbecd42ee92", "bytes": 1473573 }, "screenshot.png": { "sha256": "838da55574a9351f12a7a7ef936be739360c2221877d6e744c1ec445ad70a84a", "bytes": 688402 }, "text.txt": { "sha256": "94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d", "bytes": 8561 } }, "started_utc": "2026-10-22T11:17:55.526Z", "status": 200, "final_url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Primary account of the 17 October honeypot attempt and the 02:00 UTC proof-of-concept attempts; 'PHP2Shell is now being broadly exploited in the wild'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog\n\nCaptured by claude-story-site. Status: captured. Primary account of the 17 October honeypot attempt and the 02:00 UTC proof-of-concept attempts; 'PHP2Shell is now being broadly exploited in the wild'.\n\n- By CJ Moses, 21 Oct 2026. Verbatim: 'identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure'; 'originated from an IP address associated with a commercial anonymization network'; 'it remains unclear how the actor acquired exploit information prior to disclosure'.\n- 'multiple proof of concept exploits for the vulnerability, with the earliest around 2026-10-21 0200 UTC'; attempts 02:00 to 08:00 UTC from additional anonymised infrastructure, 'multiple actors'; 'it's unclear if any of these attempts would have succeeded in real-world systems'.\n- After release: 'PHP2Shell is now being broadly exploited in the wild.' No counts.\n- Advice: investigate from 17 October; detections that do not rely on a CVE signature; consider blocking multipart uploads where you cannot patch.\n- A reader comment complains AWS managed distributions lacked packages for 10 hours (unverified).\n" }, { "slug": "bbc-live-ckgel5xp2xv9t", "url": "https://www.bbc.co.uk/news/live/ckgel5xp2xv9t", "publisher": "BBC News", "kind": "news-live", "title": "PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live", "published": "2026-10-22T06:16:24Z", "captures": [ { "stamp": "20261022T080453Z", "files": { "headers.json": { "sha256": "6f92f9cc2df7e178c6a5480cde0a0d07eaa057374c17573ed0539cd2ec5e4f76", "bytes": 5640 }, "page.html": { "sha256": "dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981", "bytes": 24 }, "provenance.json": { "sha256": "de7ccc50e0cd85c96d0c814a87e22d61df580452ccc7cc08bec00fe2acb36000", "bytes": 1094 }, "rendered.html": { "sha256": "e9ae7f01673df9b32a99007f255c2106bc6f4179841891af83732ce54cac1bde", "bytes": 500416 }, "screenshot.png": { "sha256": "a466ce380b452e0a851e07db1d769f1ccb1b41391a8bf001b5febe1a6b0a8352", "bytes": 2737568 }, "text.txt": { "sha256": "df1dbe6b553a8c004f6d950a1d606138f2795062d3225feaa37043d24343bc99", "bytes": 14389 } }, "started_utc": "2026-10-22T08:04:53.526Z", "status": 200, "final_url": "https://www.bbc.com/news/live/ckgel5xp2xv9t" }, { "stamp": "20261022T080526Z", "files": { "headers.json": { "sha256": "d63c60c458f9e0144dfc1ec7336b7e7eb13ac35383008623841bf01030b99175", "bytes": 5690 }, "page.html": { "sha256": "dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981", "bytes": 24 }, "provenance.json": { "sha256": "b0b6c73c98d7b9af8e3cea8a007eb2212d89e38f80d8fdcb1c99b32cac545a18", "bytes": 1094 }, "rendered.html": { "sha256": "b42a90b0ed17266eac83cb8bc81fc6e2321285b3b3dd01c15aed55411ec51255", "bytes": 511866 }, "screenshot.png": { "sha256": "65eb8a2dd5d93f8ef2399b62dd91d4bae200c41997a77ccae9b9388d33c505bf", "bytes": 3587122 }, "text.txt": { "sha256": "9ae96265aa96cff67f4da71f5ed410376023b17283d83b617eab7e98d2602738", "bytes": 14501 } }, "started_utc": "2026-10-22T08:05:26.517Z", "status": 200, "final_url": "https://www.bbc.com/news/live/ckgel5xp2xv9t" }, { "stamp": "20261022T080559Z", "files": { "headers.json": { "sha256": "adef455045234df0fcb6936e0b86ce89d83c6b68719892c1e08bc498d0704517", "bytes": 5647 }, "page.html": { "sha256": "50bc0fc20681b834b1a40742cf921b27ceb5356d5ab38b417c7e53513016eefd", "bytes": 501921 }, "provenance.json": { "sha256": "b62c78eb8ac92bd2d3d7bbd6749e8f0c24519b5d2edac76d107af558eaf78d2f", "bytes": 1092 }, "rendered.html": { "sha256": "8ae9c4bca9c7ff8b5037ffa58536c2b75c45efdee1f851d583a80ac5cd05ff5c", "bytes": 501515 }, "screenshot.png": { "sha256": "f3cf0359a5f9aec2edf5dfa6cd060f55f94aa3c64b90f7e260edec02180a434c", "bytes": 2685632 }, "text.txt": { "sha256": "c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d", "bytes": 14389 } }, "started_utc": "2026-10-22T08:05:59.064Z", "status": 200, "final_url": "https://www.bbc.com/news/live/ckgel5xp2xv9t" } ], "status": "captured", "primary": false, "added_by": "claude-newsroom-lead", "notes": "Live page; bbc.co.uk redirects to bbc.com. raw/ holds a curl copy at 07:55Z and its __INITIAL_DATA__. Captures 080453Z and 080526Z have no raw body (the tool's first fallback was blocked by egress); 080559Z is complete. Edited by Kieran Kelly and Imogen James.", "raw_sha256": { "initial-data.json": "ee7445a58187bcd67df827007a8100941993a24dc3e7eea7e8a45f723a9e3305", "page.2026-10-22T0755Z.html": "fe32274b64ee109a7e37fc4c26e37e793dc22481a6122888782c393e01102488" }, "has_notes": true, "notes_md": "# BBC News live page: notes\n\n- URL: https://www.bbc.co.uk/news/live/ckgel5xp2xv9t, which redirects to https://www.bbc.com/news/live/ckgel5xp2xv9t\n- Live since 2026-10-22T06:16Z (seoTimestamps.firstPublished 06:16:24.321Z); edited by Kieran Kelly and Imogen James\n- First copy at 07:55Z (curl): 12 posts, 07:15 to 08:50 BST. See `extracted-text.md`.\n- The 08:00 BST post appeared after 07:55Z: \"No evidence that hackers have exploited flaw so far, says researcher\" (Ryan Austin, Calif).\n\n## Claims attributed here (follow each to its primary source)\n- PHP Foundation: coordinated disclosure \"worked well\" until a leak; Calif \"mistakenly published a video\". Find the foundation's statement.\n- OpenAI \"Patch the Planet\" initiative; the PHP Foundation was accepted in July 2026. Find OpenAI's blog post.\n- Calif found the flaw in August; OpenAI and Wiz found it independently shortly after. Find the Calif and Wiz posts.\n- Wiz: \"roughly 70%\" of the internet affected. The BBC could not verify this.\n- Woodward: \"something like 30 million websites\"\n- NSA cyber (X post): \"two critical vulnerabilities\". Take offline if an update is not feasible.\n- NCSC note: \"Where immediate remediation is not feasible, organisations should consider taking the system offline\". Also EU and Australian counterparts.\n- Amazon and Cloudflare saw probing (Woodward). Find Cloudflare's or AWS's own statement.\n- Affected: Wikipedia (parts taken down), Edinburgh council, French government sites, the University of Geneva (header image), online shops, the BBC.\n- In 2024 PHP Foundation researchers found a theoretical flaw they could not exploit.\n- Not in the blog: CVE IDs, affected versions or SAPIs, the patched releases. Get these from php.net.\n" }, { "slug": "bloomberg-governments-offline", "url": "https://www.bloomberg.com/news/articles/2026-10-21/governments-take-websites-offline-after-php-security-warnings", "publisher": "Bloomberg", "kind": "news", "title": "Bloomberg - Are you a robot?", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112602Z", "files": { "headers.json": { "sha256": "ebbf488d8ec3cb9e82e0b2850092794fa151b40e36e5527483c925bd8bc043c2", "bytes": 1744 }, "page.html": { "sha256": "42ba14394a9bbfcfd2d92ca9d569ec69f03944659af408f36f57faea50e788d2", "bytes": 13856 }, "provenance.json": { "sha256": "3c8c1301b67db2b3dbe016f7c0f83861dc5a27d0a02c693c16b232b3a0f0bc56", "bytes": 1091 }, "rendered.html": { "sha256": "cf863d12c016944da5fa0f4a5d5a6b20441810b9d390e4cd795477677e22219c", "bytes": 15882 }, "screenshot.png": { "sha256": "381a9b176a6f0b8aa7805f9ddb22a7cd17826528afa7a41b24b0015b1c3a355e", "bytes": 78255 }, "text.txt": { "sha256": "a66e04101bddd06c4cc5019d69b57bd2db4ff7d0a6ecdfe0fbd4d6fc5e05b303", "bytes": 665 } }, "started_utc": "2026-10-22T11:26:02.384Z", "status": 403, "final_url": "https://www.bloomberg.com/news/articles/2026-10-21/governments-take-websites-offline-after-php-security-warnings" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "European governments take websites offline; may be paywalled, see capture status.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Bloomberg - Are you a robot?\n\nCaptured by claude-story-site. Status: blocked. European governments take websites offline; may be paywalled, see capture status.\n\n- See provenance for whether the body was served.\n" }, { "slug": "broadcom-security-php2shell", "url": "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619", "publisher": "Broadcom (Symantec) Security", "kind": "vendor", "title": "PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COM", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112608Z", "files": { "headers.json": { "sha256": "90e7e97292b84a9655eb632719cd295101372dea8bfbbea1c37cac21f29c6083", "bytes": 2018 }, "page.html": { "sha256": "ee4999fb83f9cd38b29e33384e6cd904f855429326277bbcaaaa0b5796879cf8", "bytes": 329468 }, "provenance.json": { "sha256": "c676441507e6939f7a352231caebe725dfa363ad55108ae190166cc7123411b0", "bytes": 1093 }, "rendered.html": { "sha256": "087b78f1dbe37ce2b31dc124b10b31a4009ac15969a40407f65afddb1dff30b7", "bytes": 431453 }, "screenshot.png": { "sha256": "a4a4f3fec342e365df75bcdd5a2b61bac1edb4a1417b9a1200702734cd579cff", "bytes": 2841458 }, "text.txt": { "sha256": "ade5eb86aa233a2122f483429993bf21453456fc608ee191949dacc2f7e3a260", "bytes": 13607 } }, "started_utc": "2026-10-22T11:26:08.556Z", "status": 200, "final_url": "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COM\n\nCaptured by claude-story-site. Status: captured. Vendor explainer.\n\n- Captured for the record.\n" }, { "slug": "calif-php2shell", "url": "https://calif.io/php2shell/", "publisher": "Calif (Calif Research)", "kind": "researcher", "title": "php2shell by Calif Research — A tale of two PHP remote vulnerabilities", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081033Z", "files": { "headers.json": { "sha256": "1fc0b2864079499b5911e31166e216c1c753a83da9a65d38086609e84372794e", "bytes": 759 }, "page.html": { "sha256": "9f3df4d68b9d185563f9b5eec4b1e910f296389f54e02b4f6a25fef2573662a3", "bytes": 68302 }, "provenance.json": { "sha256": "c800836bfdf2759a20495415eb65bff17d26b8d9127d0695f7be27870b1dc67b", "bytes": 906 }, "rendered.html": { "sha256": "24e345e4514f5240f94df7537536a5ed14ba6e440cffffae74f8c38c7c8e5644", "bytes": 68280 }, "screenshot.png": { "sha256": "38990c6ce9af5828a86614d9dff808d621097986d5288e8136bda70412b3ac63", "bytes": 20097747 }, "text.txt": { "sha256": "23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4", "bytes": 23876 } }, "started_utc": "2026-10-22T08:10:33.263Z", "status": 200, "final_url": "https://calif.io/php2shell/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Calif's own write-up by Ryan Austin (@lcfr_hax). Page has no machine timestamp; story panel dated 'Oct 21, 2026'. Embeds two YouTube exploit demo videos (pfWZrdzvooc 'php2shell exploit demonstration', cE4h79AWbT4 'Exploiting Nginx with PHP-FPM'); videos NOT downloaded. Its timeline omits the leaked/deleted video.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Calif: \"php2shell by Calif Research\" — notes (collector-researchers)\n\n- URL: https://calif.io/php2shell/ (linked from the calif.io homepage banner \"Calif discovered php2shell\"). Captured 2026-10-22T08:10:33Z, HTTP 200.\n- Date: no machine-readable publish time; the comic timeline's last panel reads \"Oct 21, 2026 and here we are...\". Credits: \"Research and writeup by Ryan Austin (@lcfr_hax) of Calif ... Poster and comic story by Michal Zalewski (@lcamtuf) of Calif.\"\n- Framing: \"two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) discovered by Calif, OpenAI and Wiz\".\n\n## Calif's timeline (verbatim from \"An interesting timeline of events\")\n- \"2026 — August 1 Calif discovered multiple different paths independently leading to RCE that resurfaced the 2024 issues and new trigger points.\"\n- \"2026 — August 5 Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.\" (links https://x.com/lcfr_hax/status/2085031675382071483)\n- \"2026 — August 11 Calif reported the first bug to PHP and started coordinated disclosure process.\"\n- \"2026 — August 14 Calif shared an RCE PoC with PHP.\"\n- \"2026 — August 15 PHP confirmed that the RCE PoC worked as expected.\"\n- \"2026 — August 21 Calif reported the second bug to PHP.\"\n- \"2026 — October 21 Patched versions released.\"\n- Comic panel 4: \"July 30, 2026 Patch the Planet ... OpenAI invited us to join its Patch the Planet initiative ... Stefan connected us with Volker Dusch, who accepted our invitation.\"\n- 2024 panel: \"OSTIF and Quarkslab performed an audit of PHP and rediscovered the same OOM issue. However, exploitation was not proven, hence the bug was not fixed.\"\n\n## AI angle\n- \"No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery.\" Austin: \"I asked my LLM companion for help.\" Model is NOT named on this page (press says GPT-5.6 Sol).\n- \"We were not expecting to find anything critical - everyone and every lab had already done extensive AI assisted audits of this target.\"\n\n## Exploit demos (not downloaded)\n- Page embeds \"Here is a demo video of the exploits running:\" YouTube iframes: youtube-nocookie.com/embed/pfWZrdzvooc (\"php2shell exploit demonstration\") and /embed/cE4h79AWbT4 (\"Exploiting Nginx with PHP-FPM\"). Claims confirmed pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony, WHMCS.\n- Whether pfWZrdzvooc is the same video the PHP Foundation says Calif \"mistakenly published\" on Oct 20 is UNKNOWN. The page does not mention the leak or the deleted video at all.\n\n## Contradictions\n- Calif: discovery Aug 1; first report Aug 11. Fortune repeats Aug 1. PHP Foundation: Calif's audit began July 30, report Aug 11 (agrees).\n- Calif homepage also links two archive.is snapshots (arHsF, spwCf), probably of WSJ/NYT coverage — not checked.\n" }, { "slug": "cccs-al26-026", "url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "publisher": "Canadian Centre for Cyber Security (CCCS)", "kind": "advisory", "title": "AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "0db6dd151e1887553a32a56de4d1f6a133645e87d6dbee931f362e8a21a370f3", "bytes": 583 }, "page.html": { "sha256": "171c897e4a6fde98e73f9d1e221188dae6d0c04b49e8b6a242fba591739a11c9", "bytes": 39250 }, "provenance.json": { "sha256": "9759aec757d5df865a795a86bf304ffdcc697988c45f47adcc0159a6771a4fa1", "bytes": 1195 }, "rendered.html": { "sha256": "d6536d39602e9709a1afb05fb61fad1b88b57a5d1b839a7f5de58c7f3588300c", "bytes": 149258 }, "screenshot.png": { "sha256": "9df75da37b7ed8ceb13b241f71f041d29c9f33055750a65070c6c785bbe9cdd2", "bytes": 538343 }, "text.txt": { "sha256": "9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2", "bytes": 5403 } }, "started_utc": "2026-10-22T08:17:00.039Z", "status": 200, "final_url": "https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Date: October 21, 2026; Date modified 2026-10-21. 'Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.' PoC available; no active exploitation identified. Also AV26-1070 (PHP security advisory), same date.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CCCS AL26-026\n\n- \"Date: October 21, 2026\"; \"Date modified: 2026-10-21\". Captured 2026-10-22T08:17:00Z. The alerts listing (`cccs-alerts`) also shows AV26-1070 \"PHP security advisory\", 2026-10-21. (The listing table labels AL26-026 as \"AV26-026\", a typo on the page.)\n- Verbatim: \"Organizations should identify affected systems and apply the appropriate updates immediately.\" / \"Update affected PHP installations immediately to a fixed, supported release.\" / \"Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.\"\n- Note: the CCCS sentence \"Where immediate remediation is not feasible, organisations should consider ...\" matches the opening of the sentence the BBC attributes to the UK NCSC. The wording is shared across Five Eyes and CERT-EU text (CERT-EU: \"Where that is not feasible, organisations should consider isolating...\"). \n- Exploitation: \"a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.\"\n" }, { "slug": "cccs-alerts", "url": "https://www.cyber.gc.ca/en/alerts-advisories", "publisher": "CCCS", "kind": "government", "title": "Alerts and advisories - Canadian Centre for Cyber Security", "published": null, "captures": [ { "stamp": "20261022T081604Z", "files": { "headers.json": { "sha256": "43f213e29f0be568c8c4a231d0404fc7c33db33ea4b6d75c538f505a2a139b88", "bytes": 586 }, "page.html": { "sha256": "b7e604271809b8579356f2e76d4be26c44d1aa9a92893b73efa23358036ba52e", "bytes": 21909500 }, "provenance.json": { "sha256": "bcff9a25cb070bd8554c2d407548464544b8792a9046b93a670f29e70dc5c6ad", "bytes": 1026 }, "rendered.html": { "sha256": "b15a0c243be41ff42e41fd4f94617f75373bce255f915cc57cded297c97ef6a4", "bytes": 50788748 }, "screenshot.png": { "sha256": "9029e12095ac74977c8777919e317ffd20cc42da26e60903f1964abddab3774d", "bytes": 494360 }, "text.txt": { "sha256": "c226b8df2f21a14934c6c79d53fae9685707e4adcca0fcf2d7b6143e296b2000", "bytes": 3812 } }, "started_utc": "2026-10-22T08:16:04.829Z", "status": 200, "final_url": "https://www.cyber.gc.ca/en/alerts-advisories" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Listing page at 08:16Z: AL26-026 and AV26-1070 (PHP), both 2026-10-21.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CCCS alerts listing\n\nCaptured 08:16Z. It lists AL26-026 (Alert) and AV26-1070 (PHP security advisory), both dated 2026-10-21. The page is very large (about 21 MB).\n" }, { "slug": "ccn-cert-al-11-26", "url": "https://www.ccn-cert.cni.es/es/seguridad-al-dia/alertas-ccn-cert/13200-ccn-cert-al-11-26-actualizacion-inmediata-de-vulnerabilidad-critica-en-php.html", "publisher": "CCN-CERT (Spain)", "kind": "advisory", "title": "CCN-CERT AL 11/26: Actualización inmediata de vulnerabilidad crítica en PHP", "published": null, "captures": [ { "stamp": "20261022T081353Z", "files": { "provenance.json": { "sha256": "3499d3985dcda97902ce1e89dd5edffba4a20b56ba01cab266db1e9fc7f50c36", "bytes": 780 } }, "started_utc": "2026-10-22T08:13:53.323Z", "status": 403, "final_url": "https://www.ccn-cert.cni.es/es/seguridad-al-dia/alertas-ccn-cert/13200-ccn-cert-al-11-26-actualizacion-inmediata-de-vulnerabilidad-critica-en-php.html", "error": "page.title: Execution context was destroyed, most likely because of a navigation" } ], "status": "blocked", "primary": true, "added_by": "collector-gov", "notes": "HTTP 403 bot challenge ('Voight-Kampff Browser Test') to both Playwright and curl; WebFetch also got 403. The URL and title come from ENISA CNW-2026-04. The challenge body is saved in raw/.", "raw_sha256": { "curl-body.20261022T0814Z.html": "a3de1982de0d6d2967b7ac55d2787011ba4fdd8707f4a8e9e25e1b50b345d9f7", "curl-headers.20261022T0814Z.txt": "a397cde2f98a7851bb54672621f25f4834926a0250ea5140f65c91110b53d3f8" }, "has_notes": true, "notes_md": "# CCN-CERT AL 11/26 (blocked)\n\nThe URL comes from the ENISA CNW-2026-04 list. At 08:13-08:14Z, Playwright and curl both got HTTP 403 with a \"Voight-Kampff Browser Test\" bot challenge page (saved in raw/ with SHA256SUMS), and WebFetch got 403 too. The title in the slug (\"actualizacion inmediata de vulnerabilidad critica en php\") points to \"immediate update\" advice, but we have NOT read the content. Another agent with different egress should retry.\n" }, { "slug": "certeu-sa-2026-018", "url": "https://cert.europa.eu/publications/security-advisories/2026-018/", "publisher": "CERT-EU", "kind": "advisory", "title": "Security Advisory 2026-018: Critical Vulnerabilities in PHP", "published": "2026-10-21 15:20:18 (as stated; timezone not given)", "captures": [ { "stamp": "20261022T081329Z", "files": { "headers.json": { "sha256": "035d980d7924b86c61cd912c5ae8e55b5adbdf20e9f99f9c780d7b37e830e596", "bytes": 1370 }, "page.html": { "sha256": "1cc49d8c9b94ac2e09eb5f4e2bcb732a0d1fd4f630eaedad06da28a295978e53", "bytes": 24504 }, "provenance.json": { "sha256": "d5c1ea12a493fd9c195d90ee56eba85c93cd77d6131bce3ac08929d72f275820", "bytes": 999 }, "rendered.html": { "sha256": "abb92e1078d68ea54089f704855e78b2a71cee27a6244c2d3f26cd1b8c90b759", "bytes": 23744 }, "screenshot.png": { "sha256": "894baac8f7c1a2e25439f481a468e1c086cf4c783d11e7f020bb354120ef6c99", "bytes": 624274 }, "text.txt": { "sha256": "c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3", "bytes": 7105 } }, "started_utc": "2026-10-22T08:13:29.027Z", "status": 200, "final_url": "https://cert.europa.eu/publications/security-advisories/2026-018/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "v1.0 and v1.1 both 21/10/2026. States the PHP fixes were released '21 October 2026 at 13:30 UTC'. CVSS 9.2 each. Advice: 'patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.' Notes PoCs are circulating.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP\n\n- Stated \"Release Date: 21-10-2026 15:20:18\" (no timezone; CERT-EU is in Brussels, so probably CEST = 13:20Z, but that is not stated). History: v1.0 \"Initial publication\" and v1.1 \"Updates with additional information\", both 21/10/2026.\n- Captured 2026-10-22T08:13:29Z.\n- Key claims (verbatim):\n - \"On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP\"\n - \"The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35\"\n - \"Technical details are now being discussed publicly, and initial proofs of concept (PoCs) have begun to circulate. This raises the likelihood that attackers are already exploiting the vulnerabilities.\"\n - CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), CVSS 9.2, OOM memory corruption; CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), CVSS 9.2, stale global state.\n - \"The PHP team considers mod_php the highest-risk setup.\"\n- Exact advice: \"CERT-EU advises organisations to patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.\" Repeated under Recommendations as \"isolating internet-facing resources from public networks\".\n- Temporary mitigations: memory_limit=-1 set via php_admin_value; low post_max_size; proxy-level request limits; cgroup memory limit (not RLIMIT_AS); session.upload_progress.enabled=0 and restart workers; on 8.5 fatal_error_backtraces=0.\n- Notes \"rpms.remirepo.net ... will not have updates on release day\".\n- Its references include a Mastodon post by @GossiTheDog (cyberplace.social/@GossiTheDog/117474220875882526) and an X post by watchTowr (x.com/watchtowrcyber/status/2112611507749982605) as \"public reports\". Those are for the social/researcher collectors.\n- Differs from CERT-FR on the release time: CERT-FR quotes PHP's pre-announcement of 16:00 Paris (14:00 UTC); CERT-EU says released 13:30 UTC.\n" }, { "slug": "certfr-2026-ale-014", "url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/", "publisher": "CERT-FR (ANSSI)", "kind": "advisory", "title": "[Màj] Multiples vulnérabilités dans PHP (CERTFR-2026-ALE-014)", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081353Z", "files": { "headers.json": { "sha256": "96a5cd42d4ca38099fc910e8c06f10cfd15f15e6ca7bebdb699b3b7245d08d58", "bytes": 1075 }, "page.html": { "sha256": "91f474e2f0f414b2d8575b91cecd59d880e62f0179033baae665177100fc094a", "bytes": 26782 }, "provenance.json": { "sha256": "53ea7bfd63a634427908cc6846e7e974b45c9cdc7028b88d7e87d148408ecd59", "bytes": 989 }, "rendered.html": { "sha256": "f71933fcd112f86a98d8838cc53fa38dabffe5f27a6c4dc7bfc62f9ef6e9aa7c", "bytes": 27674 }, "screenshot.png": { "sha256": "e6ccac8825818ecc2cfd2223035c6c335a3de1c38fad734d7dd292215618cef7", "bytes": 502064 }, "text.txt": { "sha256": "f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3", "bytes": 5127 } }, "started_utc": "2026-10-22T08:13:53.978Z", "status": 200, "final_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "First and last version 21 Oct 2026. 'Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue...'. Affected: all 5.x, 6.x, 7.x, 8.0, 8.1, and 8.2-8.5 below the fixed versions. Workarounds: session.upload_progress off; block multipart Content-Type at WAF.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CERT-FR alert CERTFR-2026-ALE-014: [Màj] Multiples vulnérabilités dans PHP\n\n- New domain: cert.cyber.gouv.fr (the old www.cert.ssi.gouv.fr redirects with a 302).\n- \"Date de la première version 21 octobre 2026\"; \"Date de la dernière version 21 octobre 2026\". Two versions: the initial one, then \"Mises à jour des risques, des systèmes affectés et ajout des correctifs de sécurité\".\n- Captured 2026-10-22T08:13:53Z.\n- Key lines (verbatim, French):\n - \"L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC).\" (This is PHP's pre-announced time; CERT-EU says the fixes came out at 13:30 UTC.)\n - Advice: \"Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue et avec les derniers correctifs de sécurité dès publication du correctif éditeur.\" In English: CERT-FR recommends isolating affected equipment, then migrating to a maintained, patched version once the vendor fix is out.\n - Workarounds \"non qualifiés par le CERT-FR\": session.upload_progress.enabled = Off (plus php_admin_flag for FPM); \"bloquer toutes requêtes HTTP dont l'en-tête contient un Content-Type positionné à la valeur multipart\", or failing that, monitor such requests; can be done at a WAF.\n- Affected: \"PHP toutes versions 5.x, 6.x, 7.x, 8.0.x, 8.1.x\" plus 8.2 to 8.5 below the fixed versions.\n- Also references CERTFR-2026-AVI-1359 and the reflex sheet CERTFR-2025-RFX-002 (edge-device compromise containment).\n- Of all the agencies, CERT-FR's advice is the closest to \"isolate first\": isolate, THEN migrate.\n" }, { "slug": "certlv-php-preventive", "url": "https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus", "publisher": "CERT.LV (Latvia)", "kind": "government", "title": "Saistībā ar globāli atklātām PHP ievainojamībām Latvijā ievieš preventīvus pasākumus", "published": "2026-10-21T18:25 local (EEST, =15:25Z); updated 2026-10-21T23:00 local (=20:00Z)", "captures": [ { "stamp": "20261022T081354Z", "files": { "headers.json": { "sha256": "b75279eb611beef16c83a6ab4d307db8ec59d18614d4d21ea1c78320a4346166", "bytes": 737 }, "page.html": { "sha256": "de622b5e59bf43071dcb45655edbd42b337e97f28b3e41e801ebaacc64a33581", "bytes": 35634 }, "provenance.json": { "sha256": "e046187fdaa6dc172317abf6fa62152e1b5594b3c2d59c75c1de1baafa4667ba", "bytes": 1158 }, "rendered.html": { "sha256": "4f3a30ed3f755cd5965265ba1cc6f1cce9e514537463c1f9d2b87fdfceaaf514", "bytes": 35482 }, "screenshot.png": { "sha256": "504fd0c9b36378f8039c94b1157842426c17d95ab822429554c1bfc0cdbfb4d2", "bytes": 750435 }, "text.txt": { "sha256": "e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e", "bytes": 6579 } }, "started_utc": "2026-10-22T08:13:54.539Z", "status": 200, "final_url": "https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Latvia restricted access from abroad to several state digital resources (geo-blocking, possibly until Mon 26 Oct). Update 23:00: the TVP unified website platform is patched and reachable from Latvia; latvija.gov.lv is restricted only from abroad; lsm.lv and 112.lv restored. About 6000 potentially affected resources in Latvia, a few hundred of them public sector. Automated exploitation attempts seen, none successful so far.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CERT.LV: Latvia introduces preventive measures over the PHP vulnerabilities\n\n- Page date 2026-10-21. \"[Informācija publicēta 21.10.2026, plkst. 18:25]\" = published 18:25 local (EEST, UTC+3), so 15:25Z. \"[Informācija papildināta: 21.10.2026, plkst. 23:00]\" = updated 23:00 local, so 20:00Z. The UTC conversion is ours.\n- Captured 2026-10-22T08:13:54Z. The text is Latvian; the translations below are ours, so check them before publishing.\n- Original post (18:25): to protect state information systems, \"pieņemts lēmums uz laiku ierobežot piekļuvi vairākiem valsts digitālajiem resursiem no ārvalstīm\". A decision was made to temporarily restrict access to several state digital resources FROM ABROAD. Applied selectively. \"Piekļuves ierobežojumi varētu būt spēkā līdz pirmdienai, 26. oktobrim\". The restrictions may last until Monday 26 October. Residents in Latvia should not be affected. No known compromise in Latvia.\n- Advice: update to 8.5.12/8.4.27/8.3.36/8.2.35. \"Sistēmām, kuras nav iespējams atjaunināt uz drošu PHP versiju, ir jāierobežo piekļuve no interneta, nepieļaujot to publisku pieejamību līdz drošības risku novēršanai.\" Systems that cannot be updated MUST have internet access restricted, with no public availability until the risk is removed.\n- Update (23:00): the unified website platform (TVP) for state and municipal sites is patched and reachable again from Latvia. Latvija.gov.lv is reachable from Latvia and restricted only from abroad. lsm.lv (public broadcaster) and 112.lv have been restored. Other state resources keep their foreign-access restrictions. \"Kopumā Latvijā identificēti aptuveni 6000 potenciāli ietekmētu resursu, no kuriem tikai daži simti ir valsts sektorā.\" Around 6,000 potentially affected resources in Latvia, a few hundred of them in the state sector. \"Latvijā jau ir konstatēti automatizēti mēģinājumi izmantot PHP ievainojamības, taču līdz šim nav ziņu par sekmīgiem uzbrukumiem.\" Automated exploitation attempts have been seen in Latvia; no successful attacks reported so far.\n- This is a concrete case of government services being taken off the public internet: geo-blocked, not fully down. lsm.lv and 112.lv were evidently restricted too (they were \"restored\").\n" }, { "slug": "ch-bacs-warnung-php", "url": "https://www.bacs.admin.ch/en/warnung-php-en", "publisher": "Swiss Federal Office for Cyber Security (BACS / NCSC)", "kind": "advisory", "title": "Critical vulnerabilities in PHP: Install security updates immediately", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "603765d5dfe2bc360d0d8becb67c71a6a5810ad02fbe68f5d677488189ac7317", "bytes": 6406 }, "page.html": { "sha256": "bdef753f8a5972cd0d5af92574637f8edd425df0511ef469bf2c11ee39207e0f", "bytes": 160186 }, "provenance.json": { "sha256": "1574e8470bf5e04e0a830d2ee1ffd4d728872599f3828cba3399f0b095066f39", "bytes": 984 }, "rendered.html": { "sha256": "7400fa0917a78b8192f819815d7bddbc76a93e9ddb57e9ce574cb60b713b4e0b", "bytes": 174883 }, "screenshot.png": { "sha256": "b14b81a2939d7eafc4abdd581e6591629c66d8728ce4402a2c68421d788a9f63", "bytes": 846454 }, "text.txt": { "sha256": "99886a19aead8abe4faab9f41918c8654a2e070c816f856c0dd3e14a194d6890", "bytes": 4966 } }, "started_utc": "2026-10-22T08:17:00.344Z", "status": 200, "final_url": "https://www.bacs.admin.ch/en/warnung-php-en" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Published on 21 October 2026 (the home page teaser shows 20 October 2026). 'If an immediate update is not possible': restrict access; 'Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.' Says a WAF alone is not sufficient.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Swiss BACS (NCSC) warning\n\n- ncsc.admin.ch now redirects to bacs.admin.ch. The page says \"Published on 21 October 2026\", but the home-page teaser (`ch-ncsc-home`) is dated \"20 October 2026\", so the page was probably first posted on the 20th (pre-announcement) and rewritten after the patch. Captured 2026-10-22T08:17:00Z.\n- Verbatim: \"Install updates immediately\"; \"After the update, restart the affected PHP services ... Containers may need to be rebuilt\"; \"If an immediate update is not possible: Where possible, restrict access to the affected applications to only those people and systems that actually require it. Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.\"; \"Even a web application firewall alone is not sufficient.\" (This contrasts with CISA: \"A web application firewall may provide some protection\".)\n" }, { "slug": "ch-ncsc-home", "url": "https://www.ncsc.admin.ch/ncsc/en/home.html", "publisher": "Swiss BACS", "kind": "government", "title": "BACS home", "published": null, "captures": [ { "stamp": "20261022T081604Z", "files": { "headers.json": { "sha256": "80c563292cf0e8178e58809441cc65504b120a6299d27979fc429c606efaa3fd", "bytes": 6406 }, "page.html": { "sha256": "db63fa0b832d6e1c47503189a9e2dd40e5a0dc6e8aab560cae02e8db1f3806f4", "bytes": 683600 }, "provenance.json": { "sha256": "a459bb8ebb915fac015c2f06c8c45177516e9c968f132531f1d20fa7053e7c69", "bytes": 923 }, "rendered.html": { "sha256": "772da1668f48bd3c5a4f64e05a57da3b25759fb0029663257cdb7ffef85aec1f", "bytes": 739577 }, "screenshot.png": { "sha256": "0aaffb075e051c6b2ad0f9f8261010a963e502b32700d1fc07b0cdee4d9a835e", "bytes": 1095138 }, "text.txt": { "sha256": "29c1b2cfeb73db9702347d8cbb1b37690641e3abf5ddda16da0af6451f54e41b", "bytes": 11068 } }, "started_utc": "2026-10-22T08:16:04.981Z", "status": 200, "final_url": "https://www.bacs.admin.ch/en" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Redirects to bacs.admin.ch/en; the PHP teaser is dated 20 October 2026.", "raw_sha256": {}, "has_notes": true, "notes_md": "# BACS home\n\nncsc.admin.ch redirects to https://www.bacs.admin.ch/en. Captured 08:16Z. The PHP warning teaser is dated \"20 October 2026\".\n" }, { "slug": "cisa-alert-log4j-2021", "url": "https://www.cisa.gov/news-events/alerts/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce-vulnerability-under-exploitation", "publisher": "CISA", "kind": "government", "title": "Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation | CISA", "published": "2021-12-10", "captures": [ { "stamp": "20261022T113354Z", "files": { "headers.json": { "sha256": "81c7dcf0ae8dbb9db7007301569c1098a3ef6556dd79a9630d630651daa84547", "bytes": 2869 }, "page.html": { "sha256": "96fb8cf20f99673da75e17b169ced8e990ef1852c39832a988ce04901089dd93", "bytes": 52975 }, "provenance.json": { "sha256": "3f51e4f7a62ee09109ff3dc36fcb8369a5ad5cc50b151b08368a863938e9bf91", "bytes": 1209 }, "rendered.html": { "sha256": "5badb6aa92a2948ebfdb3e6213117ffa468b50a21ae447dd975d608df7786007", "bytes": 76046 }, "screenshot.png": { "sha256": "181a9b4f1fb059019f1f42b3d6d7ec914a53307ae7276e8d10637cdd93807b1c", "bytes": 311343 }, "text.txt": { "sha256": "98840739d797dd49ca9582640f9a88007c32812ba8e49d2cc0492e54c138c9e5", "bytes": 2015 } }, "started_utc": "2026-10-22T11:33:54.579Z", "status": 200, "final_url": "https://www.cisa.gov/news-events/alerts/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce-vulnerability-under-exploitation" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical: CISA's alert on Log4j the day it was published.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation | CISA\n\nCaptured by claude-story-site. Status: captured. Historical: CISA's alert on Log4j the day it was published.\n\n- Comparator for the context page.\n" }, { "slug": "cisa-alert-php-20261021", "url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "publisher": "US Cybersecurity and Infrastructure Security Agency (CISA)", "kind": "advisory", "title": "Critical Vulnerabilities in PHP Require Immediate Patching", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081353Z", "files": { "headers.json": { "sha256": "30fb6764c792111ac226e0fb1ca4f574f5e2faadfc10d2150ae9dfa35ea0858d", "bytes": 2825 }, "page.html": { "sha256": "be6b410fc0da16de2c1b96dc3132a195632d636467ab7c859c343494fa7accfa", "bytes": 53868 }, "provenance.json": { "sha256": "ea18f4dbc502d3c87b5d9a6c83d49ff128544ad074140c502f37abff350d9f8a", "bytes": 1110 }, "rendered.html": { "sha256": "0e3e08492a52d48e8ccb18f836df984af4f15f251f6089697676b540458b3371", "bytes": 78116 }, "screenshot.png": { "sha256": "2724e9107ccae45a888b3531fdc43373b154be3eeadb78841791dcb6a60a34c1", "bytes": 384239 }, "text.txt": { "sha256": "7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f", "bytes": 3223 } }, "started_utc": "2026-10-22T08:13:53.254Z", "status": 200, "final_url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "CISA Alert, Release Date October 21, 2026. Names CVE-2026-109618/109619 'php2shell'. 'Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.' CISA 'has not observed exploitation ... as of the time of publication'. Not in KEV as of catalog 2026.10.21.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching\n\n- URL: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching. \"Release Date October 21, 2026\" (no time given).\n- Captured 2026-10-22T08:13:53Z with Playwright. Plain curl to www.cisa.gov returns 403 (Akamai), but the headless browser gets 200. The CISA home page (`cisa-home`) lists it at the top as \"OCT 21, 2026 ALERT\".\n- Exact advice, verbatim:\n - \"CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.\"\n - \"Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35\"\n - \"Identify and inventory systems running any version of PHP across your organization.\"\n - \"Apply the patch immediately, prioritizing internet-facing systems.\"\n - \"Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.\"\n - \"A web application firewall may provide some protection until systems are updated or patched.\"\n - \"Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.\"\n- Exploitation: \"While CISA has not observed exploitation of these vulnerabilities as of the time of publication\".\n- The CISA offline advice is the most absolute (\"should take ... offline\"), and it explicitly covers EOL 8.1 and older. No emergency directive found (see `cisa-kev-json`).\n" }, { "slug": "cisa-ed-22-02-log4j", "url": "https://www.cisa.gov/news-events/directives/ed-22-02-mitigate-apache-log4j-vulnerability", "publisher": "CISA", "kind": "government", "title": "Page Not Found | CISA", "published": "2021-12-17", "captures": [ { "stamp": "20261022T113402Z", "files": { "headers.json": { "sha256": "1b3806dec260fe8e3a777ba86f9ee746b6edd19e249375bf255f7a5d9697921a", "bytes": 2712 }, "page.html": { "sha256": "601f61af5acf4d62056f2376b007d492c9f77dbc84557f9ea9f9f4a7834691da", "bytes": 47323 }, "provenance.json": { "sha256": "bdfcae4f97b12f4551a9070ae19917243e91048c4e13feb7fb06f939368c8d1c", "bytes": 1026 }, "rendered.html": { "sha256": "4e45e69f1aa1a5d929a2896dce31b78f23be1bbfd88195b6030c0e1a5b7761e5", "bytes": 66546 }, "screenshot.png": { "sha256": "d0899ef76fbd637495baf797c91303c02eaf04c8f12bdfafa20265b9052fe302", "bytes": 186488 }, "text.txt": { "sha256": "74b20e7dc5b8d12bb09978a2b9ab15941b343248ce65584eb76548fd8b68b0d2", "bytes": 1035 } }, "started_utc": "2026-10-22T11:34:02.805Z", "status": 404, "final_url": "https://www.cisa.gov/news-events/directives/ed-22-02-mitigate-apache-log4j-vulnerability" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical: Emergency Directive 22-02 on Log4j.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Page Not Found | CISA\n\nCaptured by claude-story-site. Status: captured. Historical: Emergency Directive 22-02 on Log4j.\n\n- Comparator: an emergency directive, which php2shell has not had.\n" }, { "slug": "cisa-home", "url": "https://www.cisa.gov/", "publisher": "CISA", "kind": "government", "title": "Home Page | CISA", "published": null, "captures": [ { "stamp": "20261022T081329Z", "files": { "headers.json": { "sha256": "a76ca34b24fba67b623a4b3e4b5748241af7aac12f07bb31b73a1f88445398b2", "bytes": 2712 }, "page.html": { "sha256": "24ba8c3fe3e00e4445bd9fbbbabf113099d53e872bb4d594e92c8575084cfe31", "bytes": 71972 }, "provenance.json": { "sha256": "364cc06b578cd41d9fc3e1155cd62c9694ca854bdfe27923863a3a00eb71ee53", "bytes": 877 }, "rendered.html": { "sha256": "06fa4013f8e36ab399d6cef932f7d506a073b84357e4e4c40627479b5a3a1fa5", "bytes": 92635 }, "screenshot.png": { "sha256": "ed352cf8665d21d75d282faefdb680a9c65965edae9b6cbf4541c84f9dcbba23", "bytes": 1291590 }, "text.txt": { "sha256": "ab2aa07bb46ba14c14a2f76a312ff7b81e2c8c19ca3588de9313236b10007a34", "bytes": 4261 } }, "started_utc": "2026-10-22T08:13:29.093Z", "status": 200, "final_url": "https://www.cisa.gov/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Home page at 08:13Z: the PHP alert (Oct 21, 2026) is top of the news list. No emergency directive is shown.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CISA home page\n\nCaptured at 08:13Z to show placement. The top news item is \"Critical Vulnerabilities in PHP Require Immediate Patching\", ALERT, OCT 21, 2026. Next is AA26-293A #StopRansomware: SafePay (Oct 20). No PHP emergency directive is visible.\n" }, { "slug": "cisa-kev-catalog", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "publisher": "CISA", "kind": "government", "title": "Known Exploited Vulnerabilities Catalog (JSON feed)", "published": "2026-10-21T14:04:39Z", "captures": [], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "raw/ only (JSON feed). catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39Z. Neither CVE-2026-109618 nor CVE-2026-109619 is listed as of fetch ~08:12Z on 22 Oct.", "raw_sha256": { "known_exploited_vulnerabilities.json": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b" }, "has_notes": true, "notes_md": "# CISA KEV catalog snapshot: notes\n- Fetched ~2026-10-22T08:12Z. catalogVersion \"2026.10.21\", dateReleased \"2026-10-21T14:04:39.8983Z\".\n- Neither CVE-2026-109618 nor CVE-2026-109619 appears. This is a negative finding as of that time. KEV listing would need evidence of exploitation; CISA's own ADP SSVC on 21 Oct 14:34Z said Exploitation \"none\".\n- Re-check later; this file is a point-in-time snapshot only.\n" }, { "slug": "cisa-kev-json", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "publisher": "CISA", "kind": "advisory", "title": "CISA Known Exploited Vulnerabilities catalog (JSON feed)", "published": "2026-10-21T14:04:39Z (catalogVersion 2026.10.21)", "captures": [], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "At 08:15Z on 22 Oct: catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39.8983Z, 1754 entries. CVE-2026-109618/109619 NOT in KEV. Raw JSON + headers + SHA256SUMS in raw/.", "raw_sha256": { "headers.20261022T0816Z.txt": "e3a7dc7610f87ca2b7829303cd01ef65a3d0d08be833334024807456cc943db9", "known_exploited_vulnerabilities.20261022T0816Z.json": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b" }, "has_notes": true, "notes_md": "# CISA KEV catalog (JSON)\n\n- Fetched with curl about 08:15Z on 22 Oct 2026 and saved in raw/ (headers, JSON, SHA256SUMS).\n- `catalogVersion` 2026.10.21, `dateReleased` 2026-10-21T14:04:39.8983Z, `count` 1754; last-modified Wed, 21 Oct 2026 14:04:39 GMT.\n- **Neither CVE-2026-109618 nor CVE-2026-109619 is in the catalog.** That fits CISA alert text \"has not observed exploitation\". The latest additions are dated 2026-10-20 (Plex, SiteGuard, Siemens).\n- Older PHP entries in the catalog: CVE-2024-4577, CVE-2019-11043, CVE-2012-1823.\n- No CISA emergency directive for PHP was found (the home page lists none). Re-check KEV later today.\n" }, { "slug": "cloudflare-blog-php2shell-waf", "url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "publisher": "Cloudflare", "kind": "vendor", "title": "Cloudflare deploys protections against php2shell vulnerability", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081216Z", "files": { "headers.json": { "sha256": "904849b322ddad92fccc55d4ce8527d9c4138d07d61937ce1da5602ea2bef244", "bytes": 7260 }, "page.html": { "sha256": "421005107f81d30d16850fdbf830446d6fd544746dfa7d201be9b4bd3f656e72", "bytes": 301730 }, "provenance.json": { "sha256": "7f98162527014e2989dfaa73146a26c079c634ddf24eff95ae99fad7ea43beb0", "bytes": 1045 }, "rendered.html": { "sha256": "a0d3c37cde7c1721a08b028748a412672817c45958d05cc7fedaede582b5537b", "bytes": 373881 }, "screenshot.png": { "sha256": "1784904e6fdda092941881d0e5c85d73801054f216295ca43b17f76e7f5cd34b", "bytes": 989488 }, "text.txt": { "sha256": "302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823", "bytes": 10205 } }, "started_utc": "2026-10-22T08:12:16.713Z", "status": 200, "final_url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Dated OCTOBER 21, 2026. Says the vulnerability 'was leaked before the official release date and we observed attack traffic targeting our customers'. WAF protection live from Oct 21 03:02 UTC (~9h before disclosure). Lists disclosers as 'Calif.io, Wiz, OpenAI and Quarkslab'. 'PHP is used by almost 70% of websites.'", "raw_sha256": {}, "has_notes": true, "notes_md": "# Cloudflare blog: \"Cloudflare deploys protections against php2shell vulnerability\"\n\n- URL https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ ; dated \"OCTOBER 21, 2026\". Captured 2026-10-22T08:12:16Z.\n- Disclosers: \"Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities\" — the only researcher-beat source naming Quarkslab as a 2026 discloser (others credit Quarkslab for the 2024 audit only).\n- Probing / leak: \"Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections\".\n- Timing: WAF protections developed \"since early October 2026\", \"deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC\".\n- 70%: \"PHP is used by almost 70% of websites.\" (websites, not \"the internet\").\n- No attack volumes in the post. Volumes attributed to Matthew Prince (thousands -> millions) in secondary coverage are NOT in this post — find his X post.\n- Partners: \"working with PHP foundation, OpenAI and Wiz among others\".\n" }, { "slug": "cncs-pt-alerta-136114", "url": "https://dyn.cncs.gov.pt/pt/alerta-detalhe/art/136114/alerta-de-vulnerabilidade-php", "publisher": "CNCS (Portugal)", "kind": "advisory", "title": "Alerta de Vulnerabilidade PHP (CNCS)", "published": null, "captures": [ { "stamp": "20261022T081354Z", "files": { "headers.json": { "sha256": "5c140f9296dcaee3311e6857332cd02f3ecef21ddea2f8e064632238f0723a07", "bytes": 411 }, "page.html": { "sha256": "edb193e6b70aacbf1578ad062b6fa5085bfef2f34cbf0fd97aa924338c502db7", "bytes": 1083 }, "provenance.json": { "sha256": "e1e0d3e656a7c6ebfab6919cf39d5574b3af7346b5b2a843039c2dbcb844b2e9", "bytes": 1028 }, "rendered.html": { "sha256": "ee72ee19cc622226439df3668a6e44283b40bf5c8a256279d4ca08a5381fe4ad", "bytes": 1094 }, "screenshot.png": { "sha256": "5950f00ba8371e122d55c0b80325546131c084d32f70aed1fdf1bafdbf9f5d27", "bytes": 39887 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:13:54.066Z", "status": 513, "final_url": "https://dyn.cncs.gov.pt/pt/alerta-detalhe/art/136114/alerta-de-vulnerabilidade-php" } ], "status": "blocked", "primary": true, "added_by": "collector-gov", "notes": "HTTP 513 'Verifying your browser | DiamWall' challenge to Playwright; curl got a 167-byte stub; WebFetch got a redirect loop. The URL comes from ENISA CNW-2026-04.", "raw_sha256": { "curl-body.20261022T0814Z.html": "9171fe017af37f1f055d8e8bac037fc72bf67dd77e534de433be05297a582b0f", "curl-headers.20261022T0814Z.txt": "b246a0bf67a34295b2bb54fc5724574f6176d92a46b05886076810bacd9a7e6c" }, "has_notes": true, "notes_md": "# CNCS Portugal alert 136114 (blocked)\n\nThe URL comes from ENISA CNW-2026-04. Playwright got HTTP 513 with \"Verifying your browser | DiamWall\" (that capture is kept as a record of the block). curl got a 167-byte body (in raw/). WebFetch hit a redirect loop. The content has NOT been read.\n" }, { "slug": "cnn-php2shell-websites-shut", "url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl", "publisher": "CNN", "kind": "news", "title": "Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112616Z", "files": { "headers.json": { "sha256": "ff524b7f55b3e2e8e2a9abaa229a6d5694a59dcdb7346d04d4e47af17c87dc26", "bytes": 2363 }, "page.html": { "sha256": "e194020ee0611e31ea5feb275ff76e19b40e03b3a1680e8e7e6ae37b1cdef60e", "bytes": 5623694 }, "provenance.json": { "sha256": "d46dfcb30fd93dcb98e4468deabbc7c3b555698dc2bcba8c6cbc81fea8306682", "bytes": 1074 }, "rendered.html": { "sha256": "9928b7deeb656b8f9d34f7844cf0e79c2e5a9ea2b05721c03e84a0bc404646d8", "bytes": 5844671 }, "screenshot.png": { "sha256": "a531b130b77be1e05bf3c9896abfc3abc4a70cc920a819eee04f7665c1a438e9", "bytes": 161563 }, "text.txt": { "sha256": "ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533", "bytes": 8896 } }, "started_utc": "2026-10-22T11:26:16.594Z", "status": 200, "final_url": "https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Wikimedia Foundation to CNN: systems 'taken down as a precautionary measure'; '70% of the internet' in the headline.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business\n\nCaptured by claude-story-site. Status: captured. Wikimedia Foundation to CNN: systems 'taken down as a precautionary measure'; '70% of the internet' in the headline.\n\n- Captured for the Wikimedia quote.\n" }, { "slug": "cve-cve-2008-1447", "url": "https://cveawg.mitre.org/api/cve/CVE-2008-1447", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2008-1447 (DNS cache poisoning, Kaminsky)", "published": "2008-07-08T23:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2008-07-08.", "raw_sha256": { "cveawg-api.json": "4025bae38315c16e5ac26105365646c67c4bce58937a187a627274f023ff1501" }, "has_notes": true, "notes_md": "# CVE-2008-1447 (DNS cache poisoning, Kaminsky)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2008-07-08T23:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2012-1823", "url": "https://cveawg.mitre.org/api/cve/CVE-2012-1823", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2012-1823 (php-cgi query string)", "published": "2012-05-11T10:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2012-05-11.", "raw_sha256": { "cveawg-api.json": "fc02a593375ecc025b00f8c4ba49d3227cae19c5ed0c9b78f7771362355abdb0" }, "has_notes": true, "notes_md": "# CVE-2012-1823 (php-cgi query string)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2012-05-11T10:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2014-0160", "url": "https://cveawg.mitre.org/api/cve/CVE-2014-0160", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2014-0160 (Heartbleed)", "published": "2014-04-07T00:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-04-07.", "raw_sha256": { "cveawg-api.json": "b0b80e14890433984e302ac8c3e6fe5d1669bcd52dfd8bd52de6945a2d06dff9" }, "has_notes": true, "notes_md": "# CVE-2014-0160 (Heartbleed)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2014-04-07T00:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2014-6271", "url": "https://cveawg.mitre.org/api/cve/CVE-2014-6271", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2014-6271 (Shellshock)", "published": "2014-09-24T18:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-09-24.", "raw_sha256": { "cveawg-api.json": "5f9825de68cb0d172329bdc64da9bd93951aae29803454926d4be7d1ac6d609d" }, "has_notes": true, "notes_md": "# CVE-2014-6271 (Shellshock)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2014-09-24T18:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2017-5638", "url": "https://cveawg.mitre.org/api/cve/CVE-2017-5638", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2017-5638 (Apache Struts)", "published": "2017-03-11T02:11:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2017-03-11.", "raw_sha256": { "cveawg-api.json": "525b90b7605a6c18ccd4812dbc70dfdcf7f330374648173e0ade5fcb1e1b8d38" }, "has_notes": true, "notes_md": "# CVE-2017-5638 (Apache Struts)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2017-03-11T02:11:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2019-11043", "url": "https://cveawg.mitre.org/api/cve/CVE-2019-11043", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2019-11043 (PHP-FPM underflow)", "published": "2019-10-28T14:19:04.252Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2019-10-28.", "raw_sha256": { "cveawg-api.json": "e32115c5b48bca1c90fab5a125d64f9067e728bb3ac6e13939ee0886d267e526" }, "has_notes": true, "notes_md": "# CVE-2019-11043 (PHP-FPM underflow)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2019-10-28T14:19:04.252Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2021-44228", "url": "https://cveawg.mitre.org/api/cve/CVE-2021-44228", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2021-44228 (Log4Shell)", "published": "2021-12-10T00:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2021-12-10.", "raw_sha256": { "cveawg-api.json": "cae2ad45ea2739a59680c360555a538019b8f46199c797aed96fba49c073aa89" }, "has_notes": true, "notes_md": "# CVE-2021-44228 (Log4Shell)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2021-12-10T00:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2022-22965", "url": "https://cveawg.mitre.org/api/cve/CVE-2022-22965", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2022-22965 (Spring4Shell)", "published": "2022-04-01T22:17:30.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2022-04-01.", "raw_sha256": { "cveawg-api.json": "b38ff19768aa5757d264340669a3c06e4a78e5e2014c813bc509d052e2f267f3" }, "has_notes": true, "notes_md": "# CVE-2022-22965 (Spring4Shell)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2022-04-01T22:17:30.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2023-34362", "url": "https://cveawg.mitre.org/api/cve/CVE-2023-34362", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2023-34362 (MOVEit Transfer)", "published": "2023-06-02T00:00:00.000Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2023-06-02.", "raw_sha256": { "cveawg-api.json": "feae1a77086ce7533526a0f9d24afb4c67917deb3363569795ea4bbc57b2abbf" }, "has_notes": true, "notes_md": "# CVE-2023-34362 (MOVEit Transfer)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2023-06-02T00:00:00.000Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2024-4577", "url": "https://cveawg.mitre.org/api/cve/CVE-2024-4577", "publisher": "CVE Program (cveawg API)", "kind": "cve", "title": "CVE-2024-4577 (PHP-CGI argument injection)", "published": "2024-06-09T19:42:36.464Z", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2024-06-09.", "raw_sha256": { "cveawg-api.json": "e8cc1b1dcd1a3333776e9a0f08cd4543bc662e0ee60fc094bda0820f84b114eb" }, "has_notes": true, "notes_md": "# CVE-2024-4577 (PHP-CGI argument injection)\n\n- CVE record fetched from the cveawg API by claude-story-site on 22 Oct 2026 as a historical comparator. Published 2024-06-09T19:42:36.464Z. The KEV row, if any, is in the captured KEV catalog (cisa-kev-json).\n" }, { "slug": "cve-cve-2026-109618", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109618", "publisher": "CVE Program (CNA: PHP Group)", "kind": "cve", "title": "CVE-2026-109618: RCE via OOM corruption", "published": "2026-10-21T13:48:34.845Z", "captures": [ { "stamp": "20261022T081218Z", "files": { "headers.json": { "sha256": "58be2c1dc484c3910605b35d9e612014fc4b6e0c9de9f605d6286d788fde6c7a", "bytes": 1500 }, "page.html": { "sha256": "a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50", "bytes": 880 }, "provenance.json": { "sha256": "adc09f106ba451478b387bb819c13df4cc15e0ac6f7ab6507a24175c8cc75458", "bytes": 952 }, "rendered.html": { "sha256": "37b9582087865e1776a98adadf13b2fd1cda169569affa0d7e113500697e5edb", "bytes": 146271 }, "screenshot.png": { "sha256": "bfb16ac90b930eabd692ee995fc41e848022b6b3ad486b96eaab255d08553229", "bytes": 341195 }, "text.txt": { "sha256": "f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b", "bytes": 3115 } }, "started_utc": "2026-10-22T08:12:18.626Z", "status": 200, "final_url": "https://www.cve.org/CVERecord?id=CVE-2026-109618" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVE record JSON in raw/ (cveawg API). dateReserved 2026-10-12T21:03:58Z, datePublished 2026-10-21T13:48:34Z, dateUpdated 2026-10-21T16:07:52Z at fetch. CISA ADP SSVC at 14:34Z: Exploitation none, Automatable no, Technical Impact total.", "raw_sha256": { "cveawg-api.json": "f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1" }, "has_notes": true, "notes_md": "# CVE-2026-109618 (cve.org record): notes\n- Page captured 08:12Z; raw/cveawg-api.json is the full CVE JSON 5.2 record, fetched 08:11Z.\n- CNA: PHP Group (assignerShortName \"php\"). Title \"RCE via OOM corruption\".\n- Description (verbatim): \"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\"\n- Affected: 8.2.* lessThan 8.2.35; 8.3.* lessThan 8.3.36; 8.4.* lessThan 8.4.27; 8.5.* lessThan 8.5.12; defaultStatus \"unaffected\".\n- CVSS v4.0 9.2, AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.\n- Reserved 2026-10-12T21:03:58Z; published 2026-10-21T13:48:34Z.\n- CISA ADP (Vulnrichment) SSVC 2026-10-21T14:34:39Z: Exploitation \"none\", Automatable \"no\", Technical Impact \"total\". ADP reference: https://www.wiz.io/blog/php2shell-php-rce.\n- Odd: defaultStatus \"unaffected\" means 7.4-8.1 read as unaffected in the record, though php.net published backports for 7.4/8.0/8.1 (see the oss-security reply from Greenbone).\n" }, { "slug": "cve-cve-2026-109619", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109619", "publisher": "CVE Program (CNA: PHP Group)", "kind": "cve", "title": "CVE-2026-109619: RCE via stale global state", "published": "2026-10-21T13:54:43.866Z", "captures": [ { "stamp": "20261022T081219Z", "files": { "headers.json": { "sha256": "03c46200ee6c4d6c0d0a06fdaae6fb0a376986fa48431cdc5543e5ae073ca8f7", "bytes": 1500 }, "page.html": { "sha256": "a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50", "bytes": 880 }, "provenance.json": { "sha256": "7de30cfb3eb2de89b08dcd062e6eee6c14efb0710ba248992dd2c1e2d3636335", "bytes": 952 }, "rendered.html": { "sha256": "83e446fe17d5717ad7f281973b506b4ba9e19b1b7cec8a4687132cd84419c71f", "bytes": 150334 }, "screenshot.png": { "sha256": "ae02d0aca995d93891d5bc181141c569b6b465a32272d727709884750ecdb50b", "bytes": 367927 }, "text.txt": { "sha256": "3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5", "bytes": 3351 } }, "started_utc": "2026-10-22T08:12:19.207Z", "status": 200, "final_url": "https://www.cve.org/CVERecord?id=CVE-2026-109619" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVE record JSON in raw/. dateReserved 2026-10-12T21:04:00Z, datePublished 2026-10-21T13:54:43Z, dateUpdated 2026-10-22T08:09:24Z (updated minutes before our fetch; CVE Program container lists oss-security refs incl. 22/2). CISA ADP SSVC: Exploitation none.", "raw_sha256": { "cveawg-api.json": "d045248b93425b1a6f5a0fc29ae36b5cfcd3c8188d969664a0d8e5f82ff05f61" }, "has_notes": true, "notes_md": "# CVE-2026-109619 (cve.org record): notes\n- Captured 08:12Z; raw/cveawg-api.json fetched 08:11Z.\n- CNA PHP Group. Title \"RCE via stale global state\".\n- Description (verbatim): \"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).\"\n- Affected ranges identical to 109618 (8.2 <8.2.35, 8.3 <8.3.36, 8.4 <8.4.27, 8.5 <8.5.12). CVSS v4.0 9.2, same vector.\n- Reserved 2026-10-12T21:04:00Z; published 2026-10-21T13:54:43Z; updated 2026-10-22T08:09:24Z.\n- CISA ADP SSVC 14:34:42Z: Exploitation \"none\". CVE Program container references oss-security 2026/10/21/7, /16, /17, /23, 2026/10/22/2.\n- Same 7.4-8.1 caveat as 109618.\n" }, { "slug": "cybelangel-php2shell", "url": "https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/", "publisher": "CybelAngel", "kind": "vendor", "title": "What We Know About php2shell [Critical update]", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112625Z", "files": { "headers.json": { "sha256": "434967eca3ae83ed546f2b8d4839eeb91ca1b11c8740be1e1e1f3864d5e4f809", "bytes": 1530 }, "page.html": { "sha256": "842333792c959891233e6290ecc0857bfd361fbc9dfb4b377a8325657855a025", "bytes": 169382 }, "provenance.json": { "sha256": "d2e13e8d5bd7b15ee078cbe727f55708366293caa3c4a68445ce1fbd5e206201", "bytes": 1070 }, "rendered.html": { "sha256": "538f2982edeb0859af905cbcf0dc02f6899dcd997e9a7245917ad53e04faa993", "bytes": 174398 }, "screenshot.png": { "sha256": "64c9ca6ef1602bd645b956fe272f9fcb7d3d50ec0f24b4af5b980edfc9e424d5", "bytes": 1631217 }, "text.txt": { "sha256": "4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27", "bytes": 12396 } }, "started_utc": "2026-10-22T11:26:25.691Z", "status": 200, "final_url": "https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer; Cloudflare CTO 07:43 UTC early attacks; Aikido reporting exploitation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# What We Know About php2shell [Critical update]\n\nCaptured by claude-story-site. Status: captured. Vendor explainer; Cloudflare CTO 07:43 UTC early attacks; Aikido reporting exploitation.\n\n- Captured for the 07:43 UTC reference.\n" }, { "slug": "cyberexpress-php2shell-gov-sites", "url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/", "publisher": "The Cyber Express", "kind": "news", "title": "PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112646Z", "files": { "headers.json": { "sha256": "12ba694e03c07c68e519eee401b1f3c26bbbf5e314d5681dd8dee8202a9ddc2b", "bytes": 1486 }, "page.html": { "sha256": "58d2d840bcff4c80b422282f8358fded7d8d4a8a0ae0005b66dd7ce51049222d", "bytes": 567233 }, "provenance.json": { "sha256": "b259cfb46f07df0edf091ae5b56f255c93846d9656a80d9adbe65e6aa496349f", "bytes": 1017 }, "rendered.html": { "sha256": "ed8d3c7588accfa0810ec2d054a01b00bf1c8783e9100bc6f46557783e623fa5", "bytes": 598469 }, "screenshot.png": { "sha256": "d80c357eed47fd016ffe1e5a7866573916c9044f011f6e0e3c7b2487c93d296a", "bytes": 18579851 }, "text.txt": { "sha256": "f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6", "bytes": 14589 } }, "started_utc": "2026-10-22T11:26:46.647Z", "status": 200, "final_url": "https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Wikimedia quote; government sites hit.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites\n\nCaptured by claude-story-site. Status: captured. Secondary: Wikimedia quote; government sites hit.\n\n- Captured for the Wikimedia quote.\n" }, { "slug": "cybernews-php2shell-millions", "url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/", "publisher": "Cybernews", "kind": "news", "title": "PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernews", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112703Z", "files": { "headers.json": { "sha256": "6be6626f1e9d0a6627adcf4b3cfe7e0e3fbc8107a1ef9772318e3b2f95ccfc6b", "bytes": 2119 }, "page.html": { "sha256": "c66a7d30501a36b114a61e46813ab2e0d7ec2dfa4d5fb106f8c5a9ff50ef69b6", "bytes": 264681 }, "provenance.json": { "sha256": "fd6fc60ea011e77252fb66fb924fa6ded42288362364dea1c51a872c9f0a80d3", "bytes": 1087 }, "rendered.html": { "sha256": "396bc3073c8b12fb2dc2ed624d0f38b6fc6dbf885f976267d2e1c0b5b47ef108", "bytes": 268472 }, "screenshot.png": { "sha256": "4593aadc41abb1ffd9875242e346506becf26679a960c352c74a1b52d2c5f956", "bytes": 2513246 }, "text.txt": { "sha256": "a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb", "bytes": 7502 } }, "started_utc": "2026-10-22T11:27:03.688Z", "status": 200, "final_url": "https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Cloudflare and Amazon warnings; millions of attempts.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernews\n\nCaptured by claude-story-site. Status: captured. Secondary: Cloudflare and Amazon warnings; millions of attempts.\n\n- Captured for the record.\n" }, { "slug": "darkreading-php2shell-red-alert", "url": "https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry", "publisher": "Dark Reading", "kind": "news", "title": "'PHP2Shell' Bugs Signal Red Alert for Security Industry", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112357Z", "files": { "headers.json": { "sha256": "285a1d8359a3246821411a25457fe0ebe5714a3f3b64d2b0d9594549c5e28ee8", "bytes": 1005 }, "page.html": { "sha256": "6a65a719cc37abf4198febfdb8afedb400656bbab8a87ecbf7979436acde2db7", "bytes": 451026 }, "provenance.json": { "sha256": "0f49ff38cf40ae508792e69a36322fd852a90a413670686eb09c7abc3bab0e2a", "bytes": 1078 }, "rendered.html": { "sha256": "94b8a23834d88b4202c8131505e4bb6abb7c27095cd873031af7f721a4d155f3", "bytes": 470067 }, "screenshot.png": { "sha256": "2672b1f34bea1f587b758b2d846512d528d66179b9c6267f491669fb7287326e", "bytes": 2410017 }, "text.txt": { "sha256": "6db30e279f5f38773c58ae71e0d753d7a7f90fcf4148ea65658c2f967de7f32d", "bytes": 10175 } }, "started_utc": "2026-10-22T11:23:57.547Z", "status": 200, "final_url": "https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary coverage.", "raw_sha256": {}, "has_notes": true, "notes_md": "# 'PHP2Shell' Bugs Signal Red Alert for Security Industry\n\nCaptured by claude-story-site. Status: captured. Secondary coverage.\n\n- Captured for the record.\n" }, { "slug": "daubois-blog-php2shell-rumors", "url": "https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/", "publisher": "Alexandre Daubois (PHP security team / PHP Foundation)", "kind": "researcher", "title": "What the PHP2Shell rumors got wrong, from inside the PHP security team", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081256Z", "files": { "headers.json": { "sha256": "7f4da02c6bd4388f7475aed4c30ba66fbfd5e93f9e9b69537b21005081745afa", "bytes": 1049 }, "page.html": { "sha256": "8f85e508b569e07d58f4ab54611fc7bb886c13f58b8c0448198f44899bf54d10", "bytes": 22135 }, "provenance.json": { "sha256": "c86d302cfb9e3442fe758ce082c1015c8500db089f7e8350402efbd4b259241d", "bytes": 1046 }, "rendered.html": { "sha256": "8bc8f77f0b030a431c17cfb6048a516fae5d743bcf9af1d571e1a377dbe77fbd", "bytes": 21926 }, "screenshot.png": { "sha256": "c86032b5d2ce179ae664684fe600ba45c0b3ff7003c835716b5cce042a13e514", "bytes": 817325 }, "text.txt": { "sha256": "5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8", "bytes": 8821 } }, "started_utc": "2026-10-22T08:12:56.219Z", "status": 200, "final_url": "https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/" } ], "status": "captured", "primary": false, "added_by": "collector-researchers", "notes": "Personal blog of a PHP Foundation contractor on the PHP security team, dated 21 OCT 2026. Describes anonymous HN post Oct 20, leaked 'PHP2Shell tool' screenshot credited to Calif.IO, the short exploitation video, and watchTowr confirming the CVEs publicly. Gives GHSA advisory opened 2026-08-27 credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Alexandre Daubois: \"What the PHP2Shell rumors got wrong, from inside the PHP security team\"\n\n- URL https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/ ; \"BLOG · 21 OCT 2026\", \"REV 2026.10.21\". Author joined the PHP Foundation in July 2026 to help the security team (per the Foundation's post). Personal blog, not an official statement.\n- How the leak happened (verbatim): \"An anonymous Hacker News post citing a reliable source went up on October 20 and came down, but screenshots of it had already reached X and Mastodon. A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down the same way. Then watchTowr, writing that 'we were all supposed to wait until Thursday at 11am ET', confirmed in public that the bugs were real and posted both CVE numbers.\"\n- Says the CVSS 10.0 traces to \"Florian Roth's post, as Phoenix Security relayed it\" and to watchTowr via Cyber Daily.\n- Facts box: \"Advisory opened: 2026-08-27, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion\"; \"Fix PR opened: 2026-09-25, final commit 01a40e89fbfc authored 2026-10-18\"; \"Leak and advance notice: 2026-10-20\"; \"Published: 2026-10-21, 14:00 UTC\".\n- Contradiction: the PHP Foundation says \"No technical details leaked\" with the CVE IDs, yet Daubois describes a leaked tool screenshot and advisory. Also \"tomash-areion\" is a fourth credited reporter not named elsewhere on this beat.\n" }, { "slug": "dutchitleaders-websites-offline", "url": "https://www.dutchitleaders.nl/news/763189/diverse-websites-offline-door-kritieke-kwetsbaarheden-in-php", "publisher": "Dutch IT Leaders", "kind": "news", "title": "Just a moment...", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112724Z", "files": { "headers.json": { "sha256": "3d4ed9c4a01097923a5877669d569d5ef394a8cdbe10aac65675668a31143782", "bytes": 1537 }, "page.html": { "sha256": "15b89d416c1e20625b50003213b1a4360e6045761598fec254652a1b5f3873b8", "bytes": 6469 }, "provenance.json": { "sha256": "8cea400474f5ccc7e7b350c5c9cf809ccb654b95894cae6c78613d5ff0c04d1e", "bytes": 1061 }, "rendered.html": { "sha256": "2f12251c8ab3b803be5a1123525fe94ec19fd2e3ad6daa9bab26759a181be3fe", "bytes": 7234 }, "screenshot.png": { "sha256": "1e7419104eee208b5ba0cc5f6696749ef060e1608266268dffcbd5d925e8f5ad", "bytes": 20501 }, "text.txt": { "sha256": "28f6003be69e3a9719618a62764a55d30d9d28570363ffd8126d1ef0f32a5803", "bytes": 75 } }, "started_utc": "2026-10-22T11:27:24.402Z", "status": 403, "final_url": "https://www.dutchitleaders.nl/news/763189/diverse-websites-offline-door-kritieke-kwetsbaarheden-in-php" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "Dutch: various websites offline over the PHP flaws.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Just a moment...\n\nCaptured by claude-story-site. Status: blocked. Dutch: various websites offline over the PHP flaws.\n\n- Secondary Dutch coverage.\n" }, { "slug": "eadt-minister-budget-no-breach", "url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/", "publisher": "East Anglian Daily Times (PA)", "kind": "news", "title": "No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112742Z", "files": { "headers.json": { "sha256": "4262ef46e445ece7b451c5d9768be9e2c72be47dd23270284566f23c6429c24b", "bytes": 925 }, "page.html": { "sha256": "47c1d48da4a78b3172325945c56a5b1bbbdd826cc02ad5b208f097d735b8deb9", "bytes": 291406 }, "provenance.json": { "sha256": "b59efe28603612dd036d6a98ba25b7b39db79e7b4739b163b239131955e26cc7", "bytes": 1163 }, "rendered.html": { "sha256": "790f7f3108d2c3fc28b38ccd146871560b9b62412b719911f578da424f7d70df", "bytes": 451816 }, "screenshot.png": { "sha256": "5079181e1c5eb09fb0b82305b4599b7b3767e0da3fdd0263cb2fc25a3cd8c349", "bytes": 1490164 }, "text.txt": { "sha256": "4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc", "bytes": 7475 } }, "started_utc": "2026-10-22T11:27:42.075Z", "status": 200, "final_url": "https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "A minister: no breach of Budget security after the OBR site was affected.", "raw_sha256": {}, "has_notes": true, "notes_md": "# No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times\n\nCaptured by claude-story-site. Status: captured. A minister: no breach of Budget security after the OBR site was affected.\n\n- Captured for the OBR statement.\n" }, { "slug": "enisa-cnw-2026-04-php", "url": "https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md", "publisher": "ENISA / EU CSIRTs Network (CNW)", "kind": "advisory", "title": "CSIRTs Network - php2shell (CNW-2026-04)", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081329Z", "files": { "headers.json": { "sha256": "4fddd3b1827235c9608b8a4c92566f15c7fde3ea496d7a74061d64b18fdd4072", "bytes": 5637 }, "page.html": { "sha256": "212f41dffb19edf392212f2ec2997428225cc9da6dbbcf1361dffc30f3ac163f", "bytes": 252581 }, "provenance.json": { "sha256": "ce33999aec2752cab53039232bb4a7da90a38f090b374d68f470a0f9c78f4c7a", "bytes": 1052 }, "rendered.html": { "sha256": "3d40c318822605660674e8a69d6a51d523c3df892b77cd2ccf520e51bb9ad552", "bytes": 295999 }, "screenshot.png": { "sha256": "0b9c0e94049921b40590086857c547bc0dea05461fad30201388de32c3f35c8e", "bytes": 451547 }, "text.txt": { "sha256": "dfcaa1afe1c4194c00ff2dc38b4fab496a900ce9b4e770a722b4bae96b886093", "bytes": 3930 } }, "started_utc": "2026-10-22T08:13:29.042Z", "status": 200, "final_url": "https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "EU CSIRTs Network index of national advisories (date 21-October-2026). Lists ~30 national CSIRT alert links. The 'Mitigation' field still holds unfilled template text. The title has a typo: 'CVE-2026-10961'. curl got 403 from GitHub; Playwright got 200.", "raw_sha256": {}, "has_notes": true, "notes_md": "# ENISA CSIRTs Network advisory CNW-2026-04 (php2shell)\n\n- On GitHub, enisaeu/CNW, advisories/2026/CNW-2026-04_php.md. Latest commit 5763905 \"Update CNW-2026-04_php.md\" by Ruhofw. Date field: \"21-October-2026\".\n- Captured 2026-10-22T08:13:29Z (curl got HTTP 403 from GitHub, but the Playwright capture worked).\n- Oddities: the heading reads \"CVE-2026-109618 en CVE-2026-10961\" (a truncated CVE, and Dutch \"en\"). The Mitigation field is still template placeholder text (\"Short description of confirmed mitigation ending with ...\"). It is clearly a work in progress.\n- Details text is quoted from advisories.ncsc.nl: \"believed to be present in all current versions of PHP, and at the very least in all versions from 5 onwards.\"\n- Its member alert list is the best index of national advisories: CERT-AT, CERT.bg, GovCERT.CZ (NUKIB), CFCS (DK), CERT-EE (RIA), CCN-CERT, INCIBE-CERT, CERT-EU, NCSC-FI, CERT-FR (CERTFR-2026-ALE-014), CERT.hr, CERT NCSC (HR), NCSC-HU, NCSC-IE (PDF), ACN/CSIRT Italia, CERT LT (NKSC), CIRCL TR-102, CERT-LV, NCSC-NL, CERT.PL, CNCS (PT), DNSC (RO), CERT-SE, SI-CERT, SK-CERT. The URLs are in the captured rendered.html.\n" }, { "slug": "equixly-php2shell-what-we-know", "url": "https://equixly.com/blog/2026/10/21/cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell-and-how-to-prepare/", "publisher": "Equixly", "kind": "vendor", "title": "CVE-2026-109618 and CVE-2026-109619: What we know about PHP2Shell and how to prepare | Equixly", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112832Z", "files": { "headers.json": { "sha256": "f7cf1d20d42b031e13757abae43ca1755e99a6e9bb3c4924d4b4d4a220ecc177", "bytes": 916 }, "page.html": { "sha256": "850a5ee9c4cc603f0e67b5b759b07fd4fa2a58589e3a5ca3c118bb52bb137f1e", "bytes": 69255 }, "provenance.json": { "sha256": "9e7737082f0e4348bffb9bbee063d4618149ca26ce04c93ad349a82de0747038", "bytes": 1174 }, "rendered.html": { "sha256": "5f9daf95daffe64c7e40e58452326ecada0b2a45839cc411b569ccd3d8aa0152", "bytes": 137760 }, "screenshot.png": { "sha256": "4ff3a6bf1cf643f1beaea2676b32f6a8763bd97a1c958c2647e3613fdd247fde", "bytes": 2260486 }, "text.txt": { "sha256": "34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c", "bytes": 14172 } }, "started_utc": "2026-10-22T11:28:32.586Z", "status": 200, "final_url": "https://equixly.com/blog/2026/10/21/cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell-and-how-to-prepare/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer listing exploitation as disputed and KEV as not listing the CVEs.", "raw_sha256": {}, "has_notes": true, "notes_md": "# CVE-2026-109618 and CVE-2026-109619: What we know about PHP2Shell and how to prepare | Equixly\n\nCaptured by claude-story-site. Status: captured. Vendor explainer listing exploitation as disputed and KEV as not listing the CVEs.\n\n- Captured for the record.\n" }, { "slug": "fastly-blog-php2shell", "url": "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618", "publisher": "Fastly", "kind": "vendor", "title": "Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastly", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111906Z", "files": { "headers.json": { "sha256": "6756cb0315f3eede874eb6e0c7c5bf69e9530954bc546eed72665c7d035f47a4", "bytes": 1049 }, "page.html": { "sha256": "811a842d39ce55fe1b7b9ef1e35c767deadda63bbf07044ac6d848812045d8fa", "bytes": 164855 }, "provenance.json": { "sha256": "ea10f0c918a09cb23072d0099d2a206b10c844041a8649ce45f3446a7229ccec", "bytes": 1117 }, "rendered.html": { "sha256": "beb13bda9a79b867d0b11deda470a987cd8f76186e6af59cb63333eb6d426839", "bytes": 327821 }, "screenshot.png": { "sha256": "259708a035d74a2d833a8fe3a555097ecee5678d854a5e5357b94bf20566b7e4", "bytes": 2470515 }, "text.txt": { "sha256": "bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f", "bytes": 20043 } }, "started_utc": "2026-10-22T11:19:06.288Z", "status": 200, "final_url": "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Candid on exploitability (PoCs need the binary's layout on x86_64; 32-bit assume compromise), on WAF limits, on signals (segfault bursts, workers spawning /bin/sh) and on more bailout paths to come.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastly\n\nCaptured by claude-story-site. Status: captured. Candid on exploitability (PoCs need the binary's layout on x86_64; 32-bit assume compromise), on WAF limits, on signals (segfault bursts, workers spawning /bin/sh) and on more bailout paths to come.\n\n- 'the existing PoCs require knowledge of the specific, running PHP binary and address space layout on the server for an attack to yield code execution on x86_64, so most deployments may be \"safe\" from RCE. Do not assume this holds true for you. If you operate a 32-bit PHP application, you should likely assume compromise.'\n- 'The PHP source tree calls the zend_bailout mechanism many places'; 'Patching the specific paths that researchers demonstrated does not make the mechanism safe.'\n- 'assume active mitigation will only serve as partial protection and may require blocking a substantial portion of legitimate traffic'.\n- Signals: empty field names with deep nesting; PHP_SESSION_UPLOAD_PROGRESS field; clusters of Apache segfaults then one slow 200; mod_php worker executing /bin/sh -c.\n- Settings: max_input_nesting_level=4; session.upload_progress.enabled=0; pm.max_requests=50.\n- Says PHP published patches for 7.4, 8.0 and 8.1 'for integration by package distributors'.\n" }, { "slug": "fortinet-fortiweb-php2shell", "url": "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750", "publisher": "Fortinet Community (FortiWeb knowledge base)", "kind": "vendor", "title": "How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community", "published": "2026-10-22T07:55 (article time, timezone not stated)", "captures": [ { "stamp": "20261022T112039Z", "files": { "headers.json": { "sha256": "a0454c866ef8c53658075dd181e88a1d6f0387b633b7e59fcf740b5254c0e7d0", "bytes": 823 }, "page.html": { "sha256": "d5bc4f5c0a9b665b7bdc4d37c6adebfca47aaab1f93795c3a0551393e25a2531", "bytes": 789605 }, "provenance.json": { "sha256": "ddfff2dafe3e00768857136f2f89239b03664e07eaf4a3282e1552b2b1d65ec1", "bytes": 1150 }, "rendered.html": { "sha256": "2d8aabfc30d2116425651b788f2c8e4d58122738b69721391022332ab628815b", "bytes": 1208805 }, "screenshot.png": { "sha256": "03a275af997e6093c4700503437ee405b77df000307b546eda109ddb0f40acff", "bytes": 826331 }, "text.txt": { "sha256": "66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4", "bytes": 6244 } }, "started_utc": "2026-10-22T11:20:39.481Z", "status": 200, "final_url": "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.", "raw_sha256": {}, "has_notes": true, "notes_md": "# How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community\n\nCaptured by claude-story-site. Status: captured. FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.\n\n- Article 230750, created 10/22/2026 07:55. Signatures 'part of the Known Exploit category'; 'By default, the signatures are in Alert Only mode'.\n" }, { "slug": "gist-blevene-detection-guide", "url": "https://gist.github.com/Blevene/472692937d05145d29d17dc3c6edc2a0", "publisher": "Blevene (GitHub gist)", "kind": "code", "title": "PHP2Shell: Detection Opportunities · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112029Z", "files": { "headers.json": { "sha256": "e515879745065efa3f6d82ddfddf934b4dd0528d08c9cd4686517a7909ad53a9", "bytes": 5398 }, "page.html": { "sha256": "638f078193990b68d231d7f9d70c8090f0fa5ea1c6f17144ce040e86005b0e0e", "bytes": 172916 }, "provenance.json": { "sha256": "b55dcda494ff7fa675bdade5d18cd9c720a7f4c91f3c8902067bb528fe41a621", "bytes": 1010 }, "rendered.html": { "sha256": "e632d2722b6bc2f11dae20c788c7c087967ff8b1617f9e49874b67f34f3ccbc7", "bytes": 171073 }, "screenshot.png": { "sha256": "40cb4bc63512079ac9f9922051f970143f708fe8f10a7839fdf8f3a8cebe109d", "bytes": 2916589 }, "text.txt": { "sha256": "e87c134fef2ac6dadce17cc4b2ede04888da65e4c1939814c3e2acc5683ddb81", "bytes": 28797 } }, "started_utc": "2026-10-22T11:20:29.810Z", "status": 200, "final_url": "https://gist.github.com/Blevene/472692937d05145d29d17dc3c6edc2a0" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "The most detailed detection guide found: verified ModSecurity tripwire on the upload-progress field, Sigma rules for the arm-phase fatal ('in Unknown on line 0'), FPM segfault correlation, Falco worker-exec rules, and the arm/fire success receipt in the access log.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Detection Opportunities · GitHub\n\nCaptured by claude-story-site. Status: captured. The most detailed detection guide found: verified ModSecurity tripwire on the upload-progress field, Sigma rules for the arm-phase fatal ('in Unknown on line 0'), FPM segfault correlation, Falco worker-exec rules, and the arm/fire success receipt in the access log.\n\n- 'ModSecurity leaves REQUEST_BODY empty for multipart requests, so that rule never fires. Use the field-name rule.'\n- 'a genuine memory-limit fatal cites the script ... in Unknown on line 0 means the bailout happened outside any script — the multipart parse.'\n- 'reliable exploitation needs several attempts per target ... a burst of fatal-then-fire pairs is a tuned attacker. The SUCCESS receipt is visible in the ACCESS LOG: an arm-fatal burst followed by a fire that returns 2xx'.\n- Reproduction ran on PHP 8.4.4's CLI server; nginx/FPM/Apache behaviour mapped, not observed.\n" }, { "slug": "gist-silascutler-censys-query", "url": "https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9", "publisher": "Silas Cutler (GitHub gist)", "kind": "code", "title": "PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 ) · GitHub", "published": null, "captures": [ { "stamp": "20261022T112841Z", "files": { "headers.json": { "sha256": "07517141f85eb8c967f82ff329f3ec582d07ba06c068b4f69137e6f1b1bbc2bd", "bytes": 5405 }, "page.html": { "sha256": "6efd8ea91d0aeff2abdb43f40fb4a5695eacdbc5720b7a18c6746858dc3e2b89", "bytes": 126486 }, "provenance.json": { "sha256": "bfd64368239f0a7cf7a26eac489eda86effc8c0e4c6b09653d8eaa7a838bc2aa", "bytes": 1044 }, "rendered.html": { "sha256": "d31d94a0e67d4acc2f75d4548fd7bc98b0259d143eb16ec35ff1181b6f3fc0c6", "bytes": 124729 }, "screenshot.png": { "sha256": "fdcd80585ae0e06e894d974485b23ecf187fa65cc7195ccf17f13486b9c5782a", "bytes": 122357 }, "text.txt": { "sha256": "5cea858eacc35a20d7943cf8334baad5fa8b37ed7f19ecbf3416f489935edd49", "bytes": 1361 } }, "started_utc": "2026-10-22T11:28:41.000Z", "status": 200, "final_url": "https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "A Censys query for php2shell exposure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 ) · GitHub\n\nCaptured by claude-story-site. Status: captured. A Censys query for php2shell exposure.\n\n- The query only; no counts.\n" }, { "slug": "github-darkfibr-php2shell-detect", "url": "https://github.com/darkfibr/php2shell-detect", "publisher": "darkfibr (Mike Haddock), GitHub", "kind": "code", "title": "GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111956Z", "files": { "headers.json": { "sha256": "0032162778e9e13e6056d409874d38d891d76817b61b685b8cac6978d0946ff1", "bytes": 5443 }, "page.html": { "sha256": "47a54e3191d2665698e13d8dd3b157f63a32f0565ae7755ea8bfb9634774ac91", "bytes": 287088 }, "provenance.json": { "sha256": "1d8350230abbd90feb1f18d64a3d02b15f7b35d71914d26d2207c18cb626d091", "bytes": 1143 }, "rendered.html": { "sha256": "e0597533f94146958614e519387471deb149af84b19ea359e01dbd50d4dddbcf", "bytes": 305777 }, "screenshot.png": { "sha256": "eb849fd1179b14a53199521fd46cca0b26c498292d2553acc0d976e79b0e03a7", "bytes": 748563 }, "text.txt": { "sha256": "3592ec9f3bb73cd3a91f3fd0c698fb45375984c5c0326bbcb4f7f7c36b2b8f73", "bytes": 7156 } }, "started_utc": "2026-10-22T11:19:56.952Z", "status": 200, "final_url": "https://github.com/darkfibr/php2shell-detect" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Community detection toolkit: Suricata/Snort rules keyed on request shape (upload-progress field + many array parts), YARA for the public PoC, estate checker.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub\n\nCaptured by claude-story-site. Status: captured. Community detection toolkit: Suricata/Snort rules keyed on request shape (upload-progress field + many array parts), YARA for the public PoC, estate checker.\n\n- 'The public PoC is polite — it announces itself: User-Agent: php2shell-109619'. Shape rules survive UA stripping: 'progress field + >=100 array-form parts'.\n- 'A log hit is an attempt, not a compromise.' 'nginx's default format never records Content-Type or bodies, so shape attempts are invisible there.'\n- Says 8.2 and older received no fix, which is wrong (8.2.35 exists).\n" }, { "slug": "github-ghsa-6wmf-4rv5-p3rp", "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp", "publisher": "PHP (php/php-src GitHub security advisory, published by bukka)", "kind": "advisory", "title": "RCE via stale global state (CVE-2026-109619)", "published": "2026-10-21T13:34:13Z", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "9474439a8ed75c50ba02584a2c67a564bf208b0caa8b2aefe0d7d2704e46c263", "bytes": 5440 }, "page.html": { "sha256": "93ff984c03081442f47f1c338683875fabf1741564d711e2a3862d71cef29fdd", "bytes": 221023 }, "provenance.json": { "sha256": "ab199ddc3636b44804bf4b7da3949fe9d22f000959f8fc04c7f00eb3e416a0bb", "bytes": 1039 }, "rendered.html": { "sha256": "89eb250785b0066130856745323cc48cd37a515b3264c10da91dfee64deb45cb", "bytes": 222855 }, "screenshot.png": { "sha256": "bb279a6b633c6e9d1de5a4778673aa4b3ed7dc5e1a1d9f08a3ba27c30f99820a", "bytes": 1024722 }, "text.txt": { "sha256": "99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc", "bytes": 13502 } }, "started_utc": "2026-10-22T08:09:01.710Z", "status": 200, "final_url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVSS v4 9.2, same vector as 109618. Use-after-free of worker global state across requests. Confirmed RCE mod_php (PHP 8.5 fatal_error_backtraces path) and session upload progress path on mod_php and FPM. GitHub API blocked; timestamp from page.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): notes\n\n- URL: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp. Title \"RCE via stale global state\". Published by bukka; page time element 2026-10-21T13:34:13Z. Captured 2026-10-22T08:09Z. GitHub API blocked for this session.\n\n## Key facts (verbatim)\n- Affected \"< 8.2.35 / < 8.3.36 / < 8.4.27 / < 8.5.12\"; patched 8.2.35, 8.3.36, 8.4.27, 8.5.12.\n- \"Critical 9.2 / 10\", \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"CVE-2026-109619\". CWE-416/755/824/1325/1419 (same list as 109618).\n- Credits: reporters sagitzadik-wiz, tomash-areion, lcfr-hax, amyb-oai; remediation developers arnaud-lb, iluuu1994, bukka, ndossche.\n- Class: worker global state referring to freed request memory, \"causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE).\" Needs a producer and a consumer in different requests on the same worker.\n- Confirmed cases: \"PHP 8.5 fatal error backtrace: confirmed ... the basis of the confirmed mod_php exploitation\"; \"Session upload progress lifecycle: confirmed\"; \"Session lifecycle RCE was validated against mod_php and FPM.\"\n- \"Session upload progress is enabled by default, and no application call to session_start() is required.\"\n- Mitigations: fatal_error_backtraces=0 (8.5), session.upload_progress.enabled=0, pm.max_requests=1; \"Updating ... is the only reliable mitigation.\"\n- \"The confirmed impact is unauthenticated heap use-after-free, memory disclosure and remote code execution with the web worker's privileges.\"\n" }, { "slug": "github-ghsa-w8hw-w9fx-j79w", "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "publisher": "PHP (php/php-src GitHub security advisory, published by bukka)", "kind": "advisory", "title": "RCE via OOM corruption (CVE-2026-109618)", "published": "2026-10-21T13:34:25Z", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "a5b68bac81984833a0df448856c563c0abaaf285f4eac25b6fc9a01c0b4d705f", "bytes": 5447 }, "page.html": { "sha256": "f429f17d81fee9dced4234a3f88772e1a7fdb87170b5bf5e3c6a016758b2a14e", "bytes": 212571 }, "provenance.json": { "sha256": "bb24fb081f4677b9fb91aac8bf728da3b708aec4d694572ccf432df9c0e5162b", "bytes": 1035 }, "rendered.html": { "sha256": "79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110", "bytes": 214403 }, "screenshot.png": { "sha256": "4e10459ced9f68c1f9fb25ce9f8c603fad05b9e1981b2b9de3c10c16ade86d77", "bytes": 535897 }, "text.txt": { "sha256": "84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4", "bytes": 6692 } }, "started_utc": "2026-10-22T08:09:01.427Z", "status": 200, "final_url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "CVSS v4 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Affected <8.2.35, <8.3.36, <8.4.27, <8.5.12. CWE-416/755/824/1325/1419. GitHub REST API was blocked for this session (repo not attached), so no JSON; timestamp from the page's relative-time element.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GHSA-w8hw-w9fx-j79w (CVE-2026-109618): notes\n\n- URL: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w. Title \"RCE via OOM corruption\". \"Critical bukka published\". Page time element: 2026-10-21T13:34:25Z. Captured 2026-10-22T08:09Z.\n- GitHub REST API (repos/php/php-src/security-advisories/..., /advisories/...) was refused for this session (repository not attached), so no JSON was saved.\n\n## Key facts (verbatim)\n- Affected versions: \"< 8.2.35 / < 8.3.36 / < 8.4.27 / < 8.5.12\". Patched: \"8.2.35 8.3.36 8.4.27 8.5.12\".\n- Severity \"Critical 9.2 / 10\", \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\". CVE ID \"CVE-2026-109618\".\n- Weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419.\n- Credits: reporters lcfr-hax, sagitzadik-wiz, tomash-areion, amyb-oai; remediation developers arnaud-lb, iluuu1994, bukka, ndossche.\n- Class: \"PHP uses longjmp() for out-of-memory (OOM) errors ... leaves the request memory in an invalid state ... lead to remote code execution (RCE).\"\n- SAPIs: mod_php unconditionally runs request shutdown even when startup failed: \"This happens entirely before any application-specific code begins execution.\" FPM: \"susceptible, though no complete FPM exploit has been demonstrated for this SAPI.\" FrankenPHP \"likely susceptible\"; LSAPI \"application-specific exploits being likely but unvalidated\".\n- Fix: removes longjmp() for OOM; \"delayed, graceful soft OOM\" at next VM safe point plus hard OOM via _exit() at a higher threshold.\n- \"Complete remote code execution was validated over HTTP against mod_php with default PHP input and memory limits\".\n\n## Contradiction\n- The Foundation blog says RCE \"was also confirmed on PHP-FPM through application-level code paths\"; this GHSA says \"no complete FPM exploit has been demonstrated for this SAPI\". (Possibly the blog conflates with the 109619 session path validated on FPM.)\n- The reporter handle \"tomash-areion\" is not named in the Foundation's thanks list.\n" }, { "slug": "github-lexsah-php2shell-detection", "url": "https://github.com/Lexsah/php2shell-detection", "publisher": "Lexsah, GitHub", "kind": "code", "title": "GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112009Z", "files": { "headers.json": { "sha256": "25e99ec6775270a84bcecf5a232634c2e640ef9246b469967311c1240df22dd7", "bytes": 5436 }, "page.html": { "sha256": "6151205973ed45a3e00af67742bf708f8d42f4caf1171c1b5671e024b730bdbb", "bytes": 288052 }, "provenance.json": { "sha256": "2560ba2b32e6f1ea7e5feb0e81a7b6db2855392524862a91661362e6410175ca", "bytes": 1077 }, "rendered.html": { "sha256": "14e642e4e762e427c9bd8be65bfd45e0d8e2a3289c65ab7c197e197cc9077a66", "bytes": 301999 }, "screenshot.png": { "sha256": "c5300a3f00d8c04d057f920a6e8ceb48282544a99c967bd855027483a7a4ffc9", "bytes": 779281 }, "text.txt": { "sha256": "10b6edf13054c98d5da298e7bdc04a654d2e0a7fa7fa820047a7996a4887c25e", "bytes": 7136 } }, "started_utc": "2026-10-22T11:20:09.792Z", "status": 200, "final_url": "https://github.com/Lexsah/php2shell-detection" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Blue-team rules (YARA, Sigma, Suricata SIDs 910961801-803, ModSecurity, Falco, auditd) and the server-level session.upload_progress.enabled=Off mitigation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub\n\nCaptured by claude-story-site. Status: captured. Blue-team rules (YARA, Sigma, Suricata SIDs 910961801-803, ModSecurity, Falco, auditd) and the server-level session.upload_progress.enabled=Off mitigation.\n\n- 'It is a PHP_INI_PERDIR setting: ini_set() / auto_prepend_file cannot change it, and the upload-progress handler runs while the request body is parsed, i.e. before any of your PHP code executes.'\n- 'User-Agent strings are trivially changed. Treat UA rules as a high-confidence/low-coverage signal and the body + process rules as the durable ones.'\n" }, { "slug": "github-php-src-branch-7.4-backport", "url": "https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619", "publisher": "php/php-src on GitHub", "kind": "code", "title": "Branch PHP-7.4-CVE-2026-109618-109619", "published": "2026-10-18T18:10:24Z", "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "a849a6e452711b855043ae9fe1fd0982b11d14633681acc628fa56e60ceb8323", "bytes": 5439 }, "page.html": { "sha256": "04dcda73bc626ce33da19b196795fd7c00b63b030f9fd6a530acedcbbe4f2b77", "bytes": 363416 }, "provenance.json": { "sha256": "b879f4cb8fe1d72fc30175af0e12496f9df0b4e09ce90b1de15b99d1e8ed29fc", "bytes": 1040 }, "rendered.html": { "sha256": "f6eba14e4661be71a25a3f70b5e988478a727cc6ea78f657fe86284d54d727fd", "bytes": 412706 }, "screenshot.png": { "sha256": "6a7c4e4d30f1cb137b32490feb57c7053ca293f0f59d4aada14082309c525f0a", "bytes": 759378 }, "text.txt": { "sha256": "bd71e98ee89b7c6ca97f0ec6029e0200f86d26f2528387a96c99ac93ea63dc1f", "bytes": 6550 } }, "started_utc": "2026-10-22T08:15:58.995Z", "status": 200, "final_url": "https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Unofficial minimal source backport for EOL 7.4. '1 commit ahead of ... master'; latest commit 'Avoid state corruption via bailout', commit date 2026-10-18T18:10:24Z. The 8.0 and 8.1 branches are not captured (same naming pattern).", "raw_sha256": {}, "has_notes": true, "notes_md": "# php-src branch PHP-7.4-CVE-2026-109618-109619: notes\n- Linked from the php.net advisory as a \"minimal source-backport\" for PHP 7.4 (EOL). The branch is \"1 commit ahead of and 34022 commits behind master\". Latest commit \"Avoid state corruption via bailout\", dated 2026-10-18T18:10:24Z.\n- The PHP-8.0- and PHP-8.1-CVE-2026-109618-109619 branches are linked the same way but were not captured.\n- Implication: PHP 7.4-8.1 are affected but are not listed in the CVE records (defaultStatus \"unaffected\").\n- curl to github.com returned 403 from the egress proxy. Playwright worked.\n" }, { "slug": "github-php-src-fix-commit-3584a98bd", "url": "https://github.com/php/php-src/commit/3584a98bda0f2c0d367255b046798b0d3a221a19", "publisher": "php/php-src (git), read from a clone", "kind": "code", "title": "Commit 3584a98bd: Avoid state corruption via bailout (the php2shell fix) and the PHP-7.4 backport 712e60f9e", "published": "2026-10-18T15:26:39Z (authored); 2026-10-21T14:06:22Z (committed)", "captures": [], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "git show output of the fix commit (stat, file list, engine/main/session hunks), the 7.4 backport commit and patch, and the merge path to PHP-8.5, from a shallow clone made 22 Oct 2026. SHA256SUMS in raw/. 389 files, +10689/-976; authors Arnaud Le Blanc with Ilija Tovilo, Jakub Zelenka, Nora Dossche, Nicolas Grekas.", "raw_sha256": { "commit-3584a98bd.NEWS.diff": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "commit-3584a98bd.engine-main-session.patch": "26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84", "commit-3584a98bd.files.txt": "d9b8465ccfbd22fa5bcd5f1a8c58c11b4af70befe488051f843fd4f45bf559b5", "commit-3584a98bd.stat.txt": "0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4b", "commit-712e60f9e-PHP-7.4-backport.patch": "307e49f52c4f3829e75ce82697b81c6ab771deb7ce0c8ce961159e40026866da", "commit-712e60f9e-PHP-7.4-backport.stat.txt": "7f5e6289ca2d1a14b2be78ca230e2077f3d5f695bb9d52087773e3df2633e7f0", "merge-path-3584a98bd-to-PHP-8.5.txt": "81c3025511c2f4744d1fcbe1d18fe7da97cfd68b005a6a883efc229a3c91193f" }, "has_notes": true, "notes_md": "# The fix commit, read from the repository\n\n- Clone: `git clone --depth 1 https://github.com/php/php-src`, then tags php-8.5.11, php-8.5.12, php-8.4.26, php-8.4.27 and branches PHP-8.5, PHP-8.4 (depth 80) and PHP-7.4-CVE-2026-109618-109619 (depth 50).\n- Fix: 3584a98bda0f2c0d367255b046798b0d3a221a19, \"Avoid state corruption via bailout\", author Arnaud Le Blanc, authored 2026-10-18T17:26:39+02:00, committed 2026-10-21T16:06:22+02:00, parent 512c04e39f. Co-authors Ilija Tovilo, Jakub Zelenka, Nora Dossche, Nicolas Grekas. Body: \"Replace bailout on OOM with UnwindExit; Properly reset various globals that may be accessed during startup; Fix GHSA-w8hw-w9fx-j79w; Fix GHSA-6wmf-4rv5-p3rp\".\n- 389 files, 10689 insertions, 976 deletions; 113 non-test files; Zend/ 96, ext/standard 52, tests 34, ext/mbstring 30, ext/gd 19, ext/date 17, ext/soap 14, main/ 7, ext/session 5, sapi/ 5.\n- Merge path on PHP-8.5: Ilija Tovilo merges PHP-8.2 into PHP-8.3 at 2026-10-21T14:12:35Z, PHP-8.3 into PHP-8.4 at 14:27:03Z, PHP-8.4 into PHP-8.5 at 14:30:04Z; NEWS entry a34a205c2 authored 2026-10-18T15:34:31Z.\n- 7.4 backport: 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2, same title, authored 2026-10-18T18:09:54Z, \"Minimal mitigation for EOL version\", 17 files (Zend/zend_alloc.c +68, main/rfc1867.c +39, Zend/zend_types.h, Zend/zend_execute_API.c, Zend/zend_hash.c, Zend/zend_vm_def.h, main/php_variables.c, main/main.c, main/SAPI.c, ext/session/session.c, and headers).\n- Mechanism (from the diff): zend_mm_check_limit replaces the bailout; a soft limit queues a delayed OOM (zend_mm_delayed_error) handled at the next VM safe point by zend_handle_delayed_oom via zend_throw_unwind_exit; a hard limit (memory_hard_limit_percent) ends the process with _exit; fallible allocations return NULL; globals reset in shutdown_executor, php_request_shutdown and sapi_deactivate; new ini max_multipart_body_parts; rfc1867 keeps only Content-Disposition and Content-Type headers and ignores duplicates.\n- rjmendez's repository names the fix commit as 82f8f31b16a; not reconciled with 3584a98bd (possibly the PHP-8.2 commit before merge, or a cherry-pick).\n- Not reached: 2024 history (shallow clone).\n" }, { "slug": "github-php-src-tag-php-8.5.12", "url": "https://github.com/php/php-src/releases/tag/php-8.5.12", "publisher": "php/php-src on GitHub (release by adoy)", "kind": "code", "title": "Release PHP 8.5.12", "published": "2026-10-21T14:06:46Z", "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "5c5686f2496a1b93d144afdd699626ee85dc4af2813a242dbf615446ddb664eb", "bytes": 5448 }, "page.html": { "sha256": "67ce23eedb690c74470175cf0a56c7a573cbd02ec5f27120c3ced5d05fa5eb3b", "bytes": 207502 }, "provenance.json": { "sha256": "8e480c6bdb33a1d5e82ddf99493ac5149329b2ab40d2fe95c088ba4b9672832a", "bytes": 990 }, "rendered.html": { "sha256": "330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa", "bytes": 214534 }, "screenshot.png": { "sha256": "ca5cc2bad8c65a0a5325554ef804f2b83d3fc7a4b7e9c2750dfd7047e564208c", "bytes": 123213 }, "text.txt": { "sha256": "3fa0b4ca147ee06698f340ee959bf381aee7c0fda597bd687ff1f128f4978799", "bytes": 1184 } }, "started_utc": "2026-10-22T08:15:58.781Z", "status": 200, "final_url": "https://github.com/php/php-src/releases/tag/php-8.5.12" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "GitHub release published 2026-10-21T14:06:46Z by adoy; tag object 2026-10-21 13:35:38 UTC; tagged commit dated 2026-10-19T17:04:37Z.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub release php-8.5.12: notes\n- \"adoy released this\", relative-time 2026-10-21T14:06:46Z (about 7 minutes after the planned 14:00 UTC). Tag 2026-10-21 13:35:38 UTC; the tagged commit is from 2026-10-19T17:04:37Z (prepared under embargo).\n- Body repeats php.net: \"This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.\"\n" }, { "slug": "github-php-src-tags", "url": "https://github.com/php/php-src/tags", "publisher": "php/php-src on GitHub", "kind": "code", "title": "Tags · php/php-src", "published": null, "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "c1e8341353ae8ccbb1b8406734139fd6ade271a8ecb16de19cc396443719b543", "bytes": 5449 }, "page.html": { "sha256": "9dd05842513d6ae6569812a9aad0f4abef35733b14f8515c3b86b3d1fac53d49", "bytes": 279656 }, "provenance.json": { "sha256": "fb3a77d83afa6bbbffbf5b0dba33cf24208559ef6dafc50b4fe37998fd225316", "bytes": 928 }, "rendered.html": { "sha256": "ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9", "bytes": 281310 }, "screenshot.png": { "sha256": "9208f3cecdd6dd08a577e0172d3a114ac84322533de8e95591e5b0694b085eda", "bytes": 125085 }, "text.txt": { "sha256": "850531b6512cfe4d37a2bb6b7fdcd37ec9cbb42ed6ceea172d081be054e28c61", "bytes": 924 } }, "started_utc": "2026-10-22T08:15:58.646Z", "status": 200, "final_url": "https://github.com/php/php-src/tags" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Tags php-8.5.12, php-8.4.27, php-8.3.36, php-8.2.35 all show 'Verified' and tag dates of 2026-10-21 13:35:38 UTC; php-8.6.0RC4 at 14:57:44 UTC. php-8.5.12RC1 and php-8.4.27RC1 tags also exist.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php-src tags list: notes\n- Captured 08:15Z. php-8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 are \"Verified\" (signed). Tag timestamps 2026-10-21 13:35:38 UTC. Underlying commits 19 Oct (14:00Z-17:04Z).\n- RC tags php-8.5.12RC1 and php-8.4.27RC1 exist. Normal release practice; were they published before the embargo lifted? Not checked.\n" }, { "slug": "github-rjmendez-phpup-2026", "url": "https://github.com/rjmendez/phpup-2026", "publisher": "rjmendez, GitHub", "kind": "code", "title": "GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112003Z", "files": { "headers.json": { "sha256": "582bbe71ccaa5a3323db8d3d2caec68f5af4561fd8b8b29bd932cbea2126e5cf", "bytes": 5445 }, "page.html": { "sha256": "e7e78dc79587fcaf7eac2ce0b48d90575d55f6fdb4313b768f0637f7a5d8ff0c", "bytes": 275240 }, "provenance.json": { "sha256": "7500ba6175c9e2f09a379b74a283542b6e7e4e637714a2006f0e68a86c44b348", "bytes": 1048 }, "rendered.html": { "sha256": "7bb4a810ad56f4620b7e1f2b14591c31b935a76a017c72cae93435ef05b8d088", "bytes": 302107 }, "screenshot.png": { "sha256": "a69607bd90cb0667ecdd5ab2e0191ae6c1534b599824084514dbcc1055712cde", "bytes": 940580 }, "text.txt": { "sha256": "84742b6e86fb259d4db36361e86d4b739c6cd09184337f365f5e2958271f5379", "bytes": 9221 } }, "started_utc": "2026-10-22T11:20:03.281Z", "status": 200, "final_url": "https://github.com/rjmendez/phpup-2026" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Detection rules rewritten on 21 Oct after a lab reproduction showed the leaked PoC's mechanism did not match the fix; cites VulnCheck: none of the public PoCs has the correct mechanism.", "raw_sha256": {}, "has_notes": true, "notes_md": "# GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub\n\nCaptured by claude-story-site. Status: captured. Detection rules rewritten on 21 Oct after a lab reproduction showed the leaked PoC's mechanism did not match the fix; cites VulnCheck: none of the public PoCs has the correct mechanism.\n\n- '2026-10-21 rewrite. This repo previously described a single-request, multipart-stall heap-spray mechanism ... derived from the leaked PoC artifact's own claims ... That mechanism is deleted, not caveated - it doesn't match the real fix, a real lab reproduction of its precondition produced a clean 200 OK, and VulnCheck independently reports that none of the public PoCs they reviewed have the correct mechanism.'\n- Names the fix commit as 82f8f31b16a (a different hash from the 3584a98bd this site found on PHP-8.5; likely the PHP-8.2 commit or a cherry-pick; not reconciled).\n- Suricata SIDs 9109627, 9109633, 9109637 active; others retired. 'the cross-request same worker requirement is not visible from any standard web/WAF/MDE log source'.\n" }, { "slug": "helsinkitimes-finland-shutdown", "url": "https://www.helsinkitimes.fi/finland/finland-news/domestic/29412-government-websites-shut-down-in-finland-over-critical-security-flaws.html", "publisher": "Helsinki Times", "kind": "news", "title": "Government websites shut down in Finland over critical security flaws - Helsinki Times", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112845Z", "files": { "headers.json": { "sha256": "8cfe23a4571454de0ce2c8804eef8e57888689f139258fc400bc4074345e22c4", "bytes": 1424 }, "page.html": { "sha256": "aae25312014733334061a2a0cedc5e7a800cfd4d711717e78fe9f492a1923fb1", "bytes": 74712 }, "provenance.json": { "sha256": "616d5f35071adec7fda82e308c994ebebbe96580f9f0d09c2ca595e95eca3565", "bytes": 1204 }, "rendered.html": { "sha256": "86c43a2ba4b2b595bc14316aefdf8f5d08736e778a980690075033168a6258ec", "bytes": 155636 }, "screenshot.png": { "sha256": "9c23d876698ad3081c6ac7846ed601a071d01e5b57de834755b1ef846cc2d26a", "bytes": 701429 }, "text.txt": { "sha256": "524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118", "bytes": 6660 } }, "started_utc": "2026-10-22T11:28:45.384Z", "status": 200, "final_url": "https://www.helsinkitimes.fi/finland/finland-news/domestic/29412-government-websites-shut-down-in-finland-over-critical-security-flaws.html" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Valtori began restricting incoming public traffic at 12:45 local; patch scheduled 17:00 Finnish time; restore after checks.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Government websites shut down in Finland over critical security flaws - Helsinki Times\n\nCaptured by claude-story-site. Status: captured. Valtori began restricting incoming public traffic at 12:45 local; patch scheduled 17:00 Finnish time; restore after checks.\n\n- 12:45 EEST = 09:45 UTC (this site's conversion).\n" }, { "slug": "huntress-php2shell-rapid-response", "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "publisher": "Huntress", "kind": "vendor", "title": "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112853Z", "files": { "headers.json": { "sha256": "39dd8f8ed13d1e993a95f88bddf69702d0cd23e3aef38da50d65068f495d1cff", "bytes": 7379 }, "page.html": { "sha256": "39d79180c85ccbc63f3acbf3bb0f076d56933f94e5fa8a5be8dafc3ca3160c7a", "bytes": 913455 }, "provenance.json": { "sha256": "23031a4937921ef79d80fb4b2546b9d7054028e640b9babec2c44d9f66dee0a2", "bytes": 1102 }, "rendered.html": { "sha256": "41e5af59038a7155953c6809d743ca579e2eeb7cdc503f13f6e3550ea920d970", "bytes": 1115188 }, "screenshot.png": { "sha256": "a4d89c5787921c4fe23ea13f25dc2d0104756a669450c44aad83ad220d9bc3a7", "bytes": 1862920 }, "text.txt": { "sha256": "a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c", "bytes": 17843 } }, "started_utc": "2026-10-22T11:28:53.508Z", "status": 200, "final_url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress\n\nCaptured by claude-story-site. Status: captured. As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code.\n\n- Primary negative finding from a managed-detection vendor.\n" }, { "slug": "imperva-blog-php2shell", "url": "https://www.imperva.com/blog/php2shell-vulnerability-updates/", "publisher": "Imperva Threat Research (Nadav Avital, Bar Menachem)", "kind": "vendor", "title": "PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111855Z", "files": { "headers.json": { "sha256": "fa04ad94125d615ccc22bfe0f44544c8737419ff06a9d85acf2e5e4776931849", "bytes": 3102 }, "page.html": { "sha256": "b659e89f8fb17c9833c2b8d60454655d038e41bd867043684aff25984c3bf6e2", "bytes": 243832 }, "provenance.json": { "sha256": "a2f25ae502d617f41375750794a46ff83e8a433361944da98d0daab48bd962ec", "bytes": 1022 }, "rendered.html": { "sha256": "cb3120b21b6f0c89f3af549534f6b8ce3e381a19e5c6eecce3ec513cb1d18d5a", "bytes": 301023 }, "screenshot.png": { "sha256": "1f96ba16ce949cfd1d6f4051df3dd2b7910754612bb6fae060c14d96950f9c9e", "bytes": 1932384 }, "text.txt": { "sha256": "3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4", "bytes": 15842 } }, "started_utc": "2026-10-22T11:18:55.149Z", "status": 200, "final_url": "https://www.imperva.com/blog/php2shell-vulnerability-updates/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Five demonstrated techniques, three via session upload progress; attack complexity high; ~67 KB memory disclosure; no matching traffic in pre-disclosure monitoring; '69% of websites whose server-side language is known'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva\n\nCaptured by claude-story-site. Status: captured. Five demonstrated techniques, three via session upload progress; attack complexity high; ~67 KB memory disclosure; no matching traffic in pre-disclosure monitoring; '69% of websites whose server-side language is known'.\n\n- 'Researchers from Wiz, OpenAI, and Calif jointly disclosed PHP2Shell'; involves 'session handling, OPcache class caching, and fatal-error backtrace generation'.\n- 'Triggering the bug is much easier than turning it into code execution.' 'A later request must reach the same Apache worker and place carefully shaped data'.\n- 'Three of the five demonstrated exploitation techniques use PHP's session upload-progress feature'; 'An attack can expose approximately 67 KB of process memory'.\n- 'During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.'\n- Settings: disable OPcache and upload progress as temporary measures; least privilege; IR checklist (child processes, file changes, outbound connections).\n" }, { "slug": "insurancebusiness-uk-councils-met", "url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx", "publisher": "Insurance Business (Matthew Sellers)", "kind": "news", "title": "UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112225Z", "files": { "headers.json": { "sha256": "3d07c50bb43d9b0530e97433ee53da60ac0afc3cb28ee547618e5cce5e68d8d0", "bytes": 1370 }, "page.html": { "sha256": "3cf31852fd2bdd575e2b3cb127faa507e947fbd823c16befeaca3901daa676a4", "bytes": 223253 }, "provenance.json": { "sha256": "3d2dc87a1364e14f154fb92ea66b98c53bcf8b335f6ab4488be62bf869fe6071", "bytes": 1200 }, "rendered.html": { "sha256": "2db316644de0dc7e608587a786f6571e83708d928733ae4a8a227c5b31f3b1cd", "bytes": 400028 }, "screenshot.png": { "sha256": "143c99a16e7b571c7069d3cc0b3396802d75971d4ec8a883b902db2b02a15061", "bytes": 2153476 }, "text.txt": { "sha256": "89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20", "bytes": 7188 } }, "started_utc": "2026-10-22T11:22:25.194Z", "status": 200, "final_url": "https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Edinburgh and Oxford councils and the Met Police unavailable; Bristol, Lambeth and Barnet errors; Dutch NCSC offline; Valtori; Cloudflare CTO 'STOPGAP only'; Unit 42 22.6 million systems; W3Techs Aug 2026 ~70%.", "raw_sha256": {}, "has_notes": true, "notes_md": "# UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business\n\nCaptured by claude-story-site. Status: captured. Edinburgh and Oxford councils and the Met Police unavailable; Bristol, Lambeth and Barnet errors; Dutch NCSC offline; Valtori; Cloudflare CTO 'STOPGAP only'; Unit 42 22.6 million systems; W3Techs Aug 2026 ~70%.\n\n- 'Palo Alto Networks' Unit 42 has counted more than 22.6 million internet-facing systems that could be vulnerable.' Method not given.\n- 'According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified.' The one page on this beat that names the survey.\n- Insurance angle: aggregation event; business-interruption cover for precautionary shutdowns depends on wording.\n" }, { "slug": "itdaily-php-clumsy-announcement", "url": "https://itdaily.com/blogs/software/php-angry-clumsy-announcement/", "publisher": "ITdaily (Jens Jonkers)", "kind": "news", "title": "PHP Foundation angered by ‘clumsy’ disclosure of vulnerabilities - ITdaily", "published": "2026-10-22T09:36 (local, Belgium)", "captures": [ { "stamp": "20261022T112142Z", "files": { "headers.json": { "sha256": "9c96a4285eed59d7470a9a983facb2964a82b6539cf0dd85887c0cb4b2fb0740", "bytes": 606 }, "page.html": { "sha256": "c93c7d6384ee8c4a47a08e5ac9e9aa9dc1d96089fc05044a194b1220e7c9d4ed", "bytes": 130955 }, "provenance.json": { "sha256": "ebec1bc848714c197d387275d82b755dbb12649df06083c9d18633217827d2a5", "bytes": 1049 }, "rendered.html": { "sha256": "b634233f4e687df8538e68d9f0af3af145ab15dc5bbe966f7a1457f2350eaf4a", "bytes": 134246 }, "screenshot.png": { "sha256": "5a11124ea720acd8ae8b3af6b0df0a3925b72abfa059d3db627464c578ae2700", "bytes": 1036421 }, "text.txt": { "sha256": "27772c396e4bd60e2e200b2ba8db0273291060cad355f3927bdcd0ee9c2aa7ad", "bytes": 6719 } }, "started_utc": "2026-10-22T11:21:42.604Z", "status": 200, "final_url": "https://itdaily.com/blogs/software/php-angry-clumsy-announcement/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: the Foundation 'caught off guard'; 'aware for two years of at least one vulnerability'; Ecosystem Security Team since May 2026; a VUB professor on the disclosure window.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Foundation angered by ‘clumsy’ disclosure of vulnerabilities - ITdaily\n\nCaptured by claude-story-site. Status: captured. Secondary: the Foundation 'caught off guard'; 'aware for two years of at least one vulnerability'; Ecosystem Security Team since May 2026; a VUB professor on the disclosure window.\n\n- 'In 2024, an audit by Quarkslab found the first signs of the memory issue. At the time, there was no known attack path'. 'the delay was a structural failure'. Quotes Vincent Ginis (VUB) via vrtnws on the public-but-unmitigated window.\n" }, { "slug": "jpcert-at260033", "url": "https://www.jpcert.or.jp/at/2026/at260033.html", "publisher": "JPCERT/CC (Japan)", "kind": "advisory", "title": "PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (JPCERT-AT-2026-0033)", "published": "2026-10-22", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "cbc1e287bde3882e41d91bfa7315dcbaccf9a996c0a383acc62f9095fbe921eb", "bytes": 605 }, "page.html": { "sha256": "85db7a09e865158643525fef5aa5cfc69513aaf896fcb2da4562189d43decf44", "bytes": 31008 }, "provenance.json": { "sha256": "4ba4d01fa5ebe5235184ed530cedbac6cd8985446a10845775da38efa45aa5b9", "bytes": 1013 }, "rendered.html": { "sha256": "c4ba52d8393f4189aade005389d1b8c2923eeb29f0d917a7221b5330cff3bf91", "bytes": 30690 }, "screenshot.png": { "sha256": "99789e60674ab7b0d3f01afbc2012337348a1434417d4820d6c89133f2d6ff64", "bytes": 722717 }, "text.txt": { "sha256": "1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5", "bytes": 8327 } }, "started_utc": "2026-10-22T08:17:00.449Z", "status": 200, "final_url": "https://www.jpcert.or.jp/at/2026/at260033.html" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "JPCERT-AT-2026-0033, published 2026-10-22, updated 2026-10-22 (wording fix in section V). Advice: apply fixed versions promptly 'after sufficient testing' and investigate for compromise. No offline advice. Says PHP is widely used in Japan. JVN entry also listed 2026-10-22 14:20 JST.", "raw_sha256": {}, "has_notes": true, "notes_md": "# JPCERT/CC alert JPCERT-AT-2026-0033\n\n- \"2026-10-22（公開）\"; \"2026-10-22（更新）\". Revision log: \"2026-10-22 「V. 侵害調査」の一部の表現を修正\" (a wording fix in the compromise-investigation section). Captured 2026-10-22T08:17:00Z. The JPCERT home page (`jpcert-home`) also lists a JVN entry at \"2026-10-22 14:20\" JST (=05:20Z).\n- Advice (JA, verbatim): \"速やかに対策の適用および侵害有無の調査を実施してください\" (apply countermeasures promptly and investigate whether you have been compromised). Also: \"十分なテストを実施の上、速やかに修正済みバージョンを適用してください\" (after sufficient testing, apply the fixed version promptly). Upgrade from 8.1 and older is recommended.\n- No offline advice. JPCERT also warns that there are several exploit paths, so one detection rule may miss attacks, and a lack of traces does not prove no compromise.\n" }, { "slug": "jpcert-home", "url": "https://www.jpcert.or.jp/", "publisher": "JPCERT/CC", "kind": "government", "title": "JPCERT home", "published": null, "captures": [ { "stamp": "20261022T081606Z", "files": { "headers.json": { "sha256": "ffa0d53fc7fd1c2d4339dd045991caa54d31c4515face33fcad2b50bfbfdb00f", "bytes": 605 }, "page.html": { "sha256": "07612f480101608a837f0a0dfff30db2d1f5091eabb55fe048bf6546979e25f7", "bytes": 31630 }, "provenance.json": { "sha256": "deeeef14fce691e60314064b4efa728667689e9676e5263b880005c0cdcc5ca3", "bytes": 917 }, "rendered.html": { "sha256": "b41d0ff975f9a0815c4626b027f239c76e939b2070f0e7221fdeef67c9615d21", "bytes": 32010 }, "screenshot.png": { "sha256": "0870f642b705aeed4116685bb2897f814fff8eb758a665a969b80be60f36dc81", "bytes": 1483609 }, "text.txt": { "sha256": "0e3188607f06a768281c4dd19a88acecbe0e7fe6b5c20a312e9095a2a498dfba", "bytes": 6293 } }, "started_utc": "2026-10-22T08:16:06.057Z", "status": 200, "final_url": "https://www.jpcert.or.jp/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Home page at 08:16Z: the PHP alert (2026-10-22) and a JVN item at 2026-10-22 14:20.", "raw_sha256": {}, "has_notes": true, "notes_md": "# JPCERT home\n\nCaptured 08:16Z for context. It lists the PHP 注意喚起 dated 2026-10-22 and a JVN vulnerability note at 2026-10-22 14:20 JST.\n" }, { "slug": "lbc-uk-websites-offline", "url": "https://www.lbc.co.uk/article/uk-internet-outage-php-websites-tech-5HjdkDd_2/", "publisher": "LBC", "kind": "news", "title": "Websites taken offline as ‘critical’ security flaw hits Met Police, Traitors and government sites | LBC", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112915Z", "files": { "headers.json": { "sha256": "61fade0ae97f79d231f97a5777f63b2e81a66ef6baadd7a7099a825dd6c29ef2", "bytes": 971 }, "page.html": { "sha256": "d4ed63db00e26889d772c2570efda5fb8fa6cce84a1d5826b8876ade8bf939bb", "bytes": 95257 }, "provenance.json": { "sha256": "e04ec30a201ba0f120a5f1c48aafef2c90f871816cde4084454cdc63c5244456", "bytes": 1094 }, "rendered.html": { "sha256": "e14de8389551e0d0109667c7b79786b3489c9cfa31c36fac97a71f6cf5398cb7", "bytes": 107817 }, "screenshot.png": { "sha256": "72e82d8825a1870d48523fc0b7ecfd8f99a8f2f981f64bb572699545b7dfd811", "bytes": 1602728 }, "text.txt": { "sha256": "125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173", "bytes": 6376 } }, "started_utc": "2026-10-22T11:29:15.399Z", "status": 200, "final_url": "https://www.lbc.co.uk/article/uk-internet-outage-php-websites-tech-5HjdkDd_2/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Met Police, The Traitors, government sites offline; fixes 'around 3pm UK time'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Websites taken offline as ‘critical’ security flaw hits Met Police, Traitors and government sites | LBC\n\nCaptured by claude-story-site. Status: captured. Met Police, The Traitors, government sites offline; fixes 'around 3pm UK time'.\n\n- Captured for the UK list.\n" }, { "slug": "lorikeet-php2shell", "url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities", "publisher": "Lorikeet Security", "kind": "vendor", "title": "php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112438Z", "files": { "headers.json": { "sha256": "b7888c7584d4891b481a804cc3243ec9dff82d301a8ac2c7070c6b7f25bd5fe2", "bytes": 1727 }, "page.html": { "sha256": "b74c194ddfc61843d47bd6ffa9d691718fab73fa370cf3c82d1cd24ea3f3f998", "bytes": 343430 }, "provenance.json": { "sha256": "38298cededb4b803f1214bfa4a6a30e1cdf06ddc417f0771577affd057d13e5a", "bytes": 1123 }, "rendered.html": { "sha256": "38608a412a2fb2a979d5821ccb1a9764037d3d2bbad075a509f0d25884973ae5", "bytes": 904734 }, "screenshot.png": { "sha256": "281038d16371213c89c2ce9df773de5a82e6eac69bdfe5c855e3975b02ac6387", "bytes": 8419643 }, "text.txt": { "sha256": "db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349", "bytes": 37837 } }, "started_utc": "2026-10-22T11:24:38.602Z", "status": 200, "final_url": "https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security\n\nCaptured by claude-story-site. Status: captured. Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence.\n\n- Captured for the record of the rule.\n" }, { "slug": "ncsc-news-php", "url": "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "publisher": "UK National Cyber Security Centre (NCSC)", "kind": "advisory", "title": "Critical security issue affecting PHP", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080903Z", "files": { "headers.json": { "sha256": "642ad2462903a32f7050dae5e198654e710dadc0a6225333d96370031c7ede4c", "bytes": 852 }, "page.html": { "sha256": "2d8e9e72ec5efa695b2d587a4af1bcb75662ead0add90b964cf767e8023ff4f8", "bytes": 225168 }, "provenance.json": { "sha256": "fe3daad10ed2709f256ce5547b2a21d8b35120fe041248d698a63d75652a19fb", "bytes": 1025 }, "rendered.html": { "sha256": "0b839c8974dc2310cc6f85d334620ae5b5cd944842d6de180bf76938f5b6dcf5", "bytes": 761056 }, "screenshot.png": { "sha256": "260b9c91a3bf1a838fd1a81633415032eacd24ccaf249c11227903c6038b4544", "bytes": 542775 }, "text.txt": { "sha256": "a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339", "bytes": 5135 } }, "started_utc": "2026-10-22T08:09:03.936Z", "status": 200, "final_url": "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "NCSC Alert. Page: PUBLISHED 21 October 2026; JSON-LD dateModified 2026-10-22; HTTP last-modified Thu, 22 Oct 2026 07:30:02 GMT. Names CVE-2026-109618 and CVE-2026-109619. Advice: update; else PHP Foundation temporary mitigations; 'If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.' Wording differs from BBC's quote.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC (UK) alert: Critical security issue affecting PHP\n\n- URL: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (NEWS TYPE: Alert)\n- Stated: \"PUBLISHED 21 October 2026\". JSON-LD `datePublished` 2026-10-21, `dateModified` 2026-10-22. HTTP `last-modified: Thu, 22 Oct 2026 07:30:02 GMT`. The NCSC all-feed RSS lists it as `Wed, 21 Oct 2026 12:00:00 +0000`, but every item in that feed is 12:00, so the time is a placeholder and only the date counts.\n- Captured 2026-10-22T08:09Z (capture 20261022T080903Z).\n- CVEs named: CVE-2026-109618 and CVE-2026-109619. Links to GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w (php/php-src), and to NCSC-NL's php2shell repo (https://github.com/NCSC-NL/php2shell).\n\n## Exact advice (priority actions, verbatim)\n1. \"Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions...\"\n2. \"Update to the latest version of PHP and continue to monitor for future updates.\"\n3. \"If you are unable to update to a version with the security update applied, the PHP Foundation have provided temporary mitigations.\"\n4. \"If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.\"\n5. \"If you are unable to update or disable the system immediately then you should assess the system for any evidence of compromise ... and look for backdoors installed by an attacker.\"\n6. Monitor third-party vendors that bundle PHP; points to the NCSC-NL inventory.\n\n## Oddities\n- The BBC live page quotes the NCSC as saying \"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.\" That sentence is NOT on the page as captured at 08:09Z. The page carries the offline advice as step 4 (quoted above). The page was modified on 22 Oct (last-modified 07:30:02 GMT), so the BBC may have quoted an earlier version, or a different NCSC note. Open question: find an earlier copy (Wayback?).\n- \"Organisations using any version of PHP are affected\".\n" }, { "slug": "ncsc-nl-advisories", "url": "https://advisories.ncsc.nl/advisories", "publisher": "NCSC-NL", "kind": "advisory", "title": "NCSC NL | Security Advisories (PHP banner: Ernstige kwetsbaarheden in PHP: bereid je voor op patchen)", "published": null, "captures": [ { "stamp": "20261022T081605Z", "files": { "headers.json": { "sha256": "3e389f62cb8a1de496ebc873bbcfb98ccf729f22e1ec56c94d0893bba1bef324", "bytes": 884 }, "page.html": { "sha256": "c0c4e5aa82e2eaec26497f7eb201c72888ecdcb1361964f73aab7b5dcc046c5f", "bytes": 240 }, "provenance.json": { "sha256": "cd3655ebd5a05e5e7a94cfc0438e17c9f78418f1c570bf5097613f30ba7612ca", "bytes": 980 }, "rendered.html": { "sha256": "f008b1f5da4c00459105f979db89eebc16702be90d3a6de1656acfab41951cc6", "bytes": 69813 }, "screenshot.png": { "sha256": "9bd5b7a047aff8b7f81e8c61b6f1ccc1475f7be1ad89a7d9d32a6f2aee84abbe", "bytes": 611099 }, "text.txt": { "sha256": "b7e4ac6caf7d177d8b7e55fa8c587da75a1e78fafc951012d2d2595a6dfa5e8b", "bytes": 8130 } }, "started_utc": "2026-10-22T08:16:05.152Z", "status": 200, "final_url": "https://advisories.ncsc.nl/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Final URL advisories.ncsc.nl/. A banner is still the pre-patch text: 'bereid je voor op patchen', patch expected '21 oktober 16:00 Nederlandse tijd'; 'Er is een publieke Proof of Concept (PoC)- code beschikbaar, maar het NCSC heeft nog geen actief misbruik gesignaleerd.' Affects 'alle versies vanaf versie 5'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC-NL advisories portal (PHP banner)\n\nCaptured 08:16Z. The PHP banner is still the pre-patch version: \"Ernstige kwetsbaarheden in PHP: bereid je voor op patchen\" (serious PHP flaws: prepare to patch). It advises preparing for \"een komende patch op 21 oktober 16:00 Nederlandse tijd\" (=14:00Z) and says \"Dit tijdstip kan eventueel worden vervroegd\" (that time may be brought forward). It says a public PoC exists but NCSC-NL has seen no active abuse (\"nog geen actief misbruik gesignaleerd\"). It names WordPress, Joomla, Drupal, Zabbix and Roundcube as PHP-based. ENISA CNW quotes this text. No offline advice was seen in the captured part. We did not identify the individual NCSC-2026-xxxx advisory URL.\n" }, { "slug": "ncsc-nl-php2shell", "url": "https://github.com/NCSC-NL/php2shell", "publisher": "NCSC-NL (Netherlands National Cyber Security Centre)", "kind": "advisory", "title": "NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilities", "published": "2026-10-21T15:25:00Z", "captures": [ { "stamp": "20261022T080925Z", "files": { "headers.json": { "sha256": "dbef75c6f088a0a21eeac77ab2178aead9e625d6ed750dd4894fc7fb9537f297", "bytes": 5443 }, "page.html": { "sha256": "4e1f8dc6dd2c6d494b9d1229a0de601b0e1096e81337d8a4b5b06fa7c3c293ce", "bytes": 261528 }, "provenance.json": { "sha256": "939b683f13402c1f5d315ff79800619b30e3780d4eb31bfc2b17282148c8e03a", "bytes": 1005 }, "rendered.html": { "sha256": "323e0a19a3dd13c2b214ff7b1a8553eacac4c17bdfb8b8c1a9bf2032781934db", "bytes": 273849 }, "screenshot.png": { "sha256": "a27d227bafcdfbc38ca5c431a5fb525aa95eeac6e7bfbe31c98ae8057c2e4d64", "bytes": 494937 }, "text.txt": { "sha256": "8944dd45c25fa7c1fc1c6f3e2a646d86fe0849a83248fe1f91cec791a58589e6", "bytes": 4852 } }, "started_utc": "2026-10-22T08:09:25.035Z", "status": 200, "final_url": "https://github.com/NCSC-NL/php2shell" }, { "stamp": "20261022T084815Z", "files": { "headers.json": { "sha256": "dc374a245415e7981501c8d9adea6d18ac20101116a21380bafe62b351dba7c0", "bytes": 5453 }, "page.html": { "sha256": "556efff0dd62f6bdf88e3ed5566f6f2213e828b2bbfeba7eef0b3cd3ac622057", "bytes": 261276 }, "provenance.json": { "sha256": "7544f40915d6c5cb74cdc60621deee2e3d7773de3a0191201caf4089fbd5d094", "bytes": 1005 }, "rendered.html": { "sha256": "42194f5b28315e862789c25ed7c3a2bbbfa3244da3bb68e8e3ff284f321ccd38", "bytes": 275802 }, "screenshot.png": { "sha256": "c6a14bc8234e3b2b5692240e1f2821e9e80e51e52bd5bec2e89dcf3a7a8a1764", "bytes": 497834 }, "text.txt": { "sha256": "f3eec24a226910fb8440714b4f44c40db5c5f7826f3c23b65aece1cc5775712e", "bytes": 4854 } }, "started_utc": "2026-10-22T08:48:15.774Z", "status": 200, "final_url": "https://github.com/NCSC-NL/php2shell" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "README: 'Readme last significant change: 21 October 2026 17:25 CEST TLP:CLEAR' (=15:25Z). Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Links to CERT-EU SA 2026-018 and ENISA CNW-2026-04. Holds the software inventory list (the NCSC UK cites it). Does NOT advise taking systems offline.", "raw_sha256": { "commits-cca173c64ec5.txt": "4d4f80bd9da0076e2bd74323e947a05f1e0f1a246a5a25b2874dd9370b4a2ea9", "php2shell-cca173c64ec5.bundle": "4a72bcc9bbc58e886df6eee7cc875bd5deab547f1028f7525a7e7e808859411f", "software-list-cca173c64ec5.json": "f0a17e96a336a8782231290acf4ba4a4f4fa469270c59a7c87a95da2207dad01" }, "has_notes": true, "notes_md": "# NCSC-NL php2shell GitHub repository\n\n- https://github.com/NCSC-NL/php2shell (EUPL-1.2). At the 08:09Z capture: 145 stars, 40 forks, 6 contributors.\n- \"Readme last significant change: 21 October 2026 17:25 CEST TLP:CLEAR\"\n- It says the CVEs are \"tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619\".\n- Fixed releases: \"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35\". Source backports for 7.4, 8.0 and 8.1. Affected SAPIs: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed, with the \"risk highest for mod_php\".\n- Recommended actions (verbatim): \"Identify PHP-based applications and their runtime versions...\"; \"Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply vendor-provided backported packages.\"; \"If immediate patching is not possible, follow PHP's temporary mitigations, including disabling session.upload_progress, restarting workers, and reviewing the official memory_limit, post_max_size and PHP 8.5 fatal_error_backtraces guidance. PHP states that these measures are not complete fixes.\"\n- NCSC-NL does NOT advise taking systems offline, which sets it apart from the NCSC (UK) and the NSA.\n- Links: CERT-EU SA 2026-018, ENISA CNW advisories/2026/CNW-2026-04_php.md, and php.net archive #2026-10-21-5.\n\n## Added by claude-newsroom-lead, 2026-10-22T08:48Z (the editor pointed to this repo for affected systems)\n- `raw/php2shell-cca173c64ec5.bundle`: a git bundle of the whole repository, all refs, with 52 commits (`git clone php2shell-cca173c64ec5.bundle`). HEAD is cca173c64ec5db9211fcbd0fcf3a57c22cfbc2fb, committed 2026-10-22T10:40:58+02:00 (the merge of PR #10).\n- `raw/tree-cca173c64ec5/`: the files at that commit. `raw/commits-cca173c64ec5.txt`: the log.\n- `raw/software-list-cca173c64ec5.json`: software/software_list_*.md parsed into rows (supplier, product, version, a status per CVE, notes, links). 674 entries: 206 Vulnerable, 46 Fix, 418 Investigation, 3 Not vuln, and 1 runtime anchor with no status. The list is generated from software/spdx/PHP_Downstream_Inventory.spdx3.json (VEX). NCSC-NL says entries are \"investigation leads\" until a vendor or upstream source backs them.\n- The README calls the CVEs CVE-2026-109618 and CVE-2026-109619. The repo holds cPanel detection and mitigation (detection_mitigation/cpanel/php2shell-mitigate.sh).\n- Licence EUPL-1.2.\n" }, { "slug": "ncsc-nl-php2shell-software-list", "url": "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md", "publisher": "NCSC-NL (Netherlands National Cyber Security Centre)", "kind": "government", "title": "List of software with PHP dependency potentially affected by php2shell CVEs", "published": "generated from the repo's SPDX inventory; commit cca173c64ec5 at 2026-10-22T08:40:58Z", "captures": [ { "stamp": "20261022T084807Z", "files": { "headers.json": { "sha256": "ced0e6933669176a62c459545b9b58df2ecd44f502200c04ac548e8bf513cf2d", "bytes": 5624 }, "page.html": { "sha256": "b6810b0801213bba67b7fff83b519ffc971c4271b217cf2ab4083ecee77d2c81", "bytes": 223836 }, "provenance.json": { "sha256": "d02a4a269f2919ede5233e84a57e72d3dc9adb56e4d98d2ca23fb319384925b9", "bytes": 1059 }, "rendered.html": { "sha256": "ed0e84fc69079d5df2c192b657719a25a29e9ce62aae2034ece866b27ee6c079", "bytes": 288875 }, "screenshot.png": { "sha256": "c610a27540c7c58e4e02cc90bc268c1a5f5b8bd8295fd543badb47cfcdad0e3c", "bytes": 137355 }, "text.txt": { "sha256": "83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004", "bytes": 1255 } }, "started_utc": "2026-10-22T08:48:07.746Z", "status": 200, "final_url": "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md" } ], "status": "captured", "primary": true, "added_by": "claude-newsroom-lead", "notes": "Pointed out by the editor as the source for affected systems. 674 entries at commit cca173c64ec5. CVE-2026-109618: Fix 46, Investigation 418, Vulnerable 206, Not vuln 3. The parsed list, the repo bundle and the tree are in ../ncsc-nl-php2shell/raw/.", "raw_sha256": {}, "has_notes": false }, { "slug": "ncsc-nz-alert-php", "url": "https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/", "publisher": "NCSC New Zealand", "kind": "advisory", "title": "UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP", "published": "2026-10-22T09:15+13:00 (=2026-10-21T20:15Z); updated 10:20am 22-10-26 NZDT (=21:20Z)", "captures": [ { "stamp": "20261022T081700Z", "files": { "headers.json": { "sha256": "5e5b7ef0258116f0d6925dab7f8189e2223e414a58521729043ca4f399ceabcc", "bytes": 1992 }, "page.html": { "sha256": "9f3205c8338c598bedc1fa1f1b0726243fd7cce324d6d0a797a7c55fbd277915", "bytes": 49604 }, "provenance.json": { "sha256": "7536377248a3645980d9a70e1d2e6c3bb2f1c0e799ff9ccd12b4320bd1724b01", "bytes": 1049 }, "rendered.html": { "sha256": "32cdd5364dd2c631a73c0c834763cf3cb9b776145d2ebf5e4f3376e25e89758e", "bytes": 41928 }, "screenshot.png": { "sha256": "4dd2cb007efcf0696650ebca1087f184c6ed83297bc6f80dd678d9f6954146ac", "bytes": 528343 }, "text.txt": { "sha256": "992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301", "bytes": 3799 } }, "started_utc": "2026-10-22T08:17:00.193Z", "status": 200, "final_url": "https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "TLP:CLEAR. 'The NCSC is aware of reports of active exploitation.' The only agency so far to say this. Advice: update to fixed versions 'as soon as possible'; investigate compromise. No offline advice.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC NZ alert\n\n- \"9:15AM, 22 October 2026\" (NZDT, UTC+13, so 2026-10-21T20:15Z; our conversion). \"(Updated 10:20am, 22-10-26)\" = 21:20Z. TLP Clear. Captured 2026-10-22T08:17:00Z.\n- **\"The NCSC is aware of reports of active exploitation.\"** Every other agency says no exploitation has been seen (CISA, CCCS, ACSC in Australia, CERT.LV \"no successful\"). NZ does not say whose reports. Flag this as a discrepancy.\n- Advice: \"Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.\" / \"apply the remediation as soon as possible\" / \"investigate unauthorised access or compromise\". The update notes that firewalls, edge devices and embedded platforms need separate vendor remediation. No offline advice.\n" }, { "slug": "ncsc-nz-alerts", "url": "https://www.ncsc.govt.nz/alerts/", "publisher": "NCSC New Zealand", "kind": "government", "title": "Alerts listing", "published": null, "captures": [ { "stamp": "20261022T081605Z", "files": { "headers.json": { "sha256": "74c848feb39a21fb80f489bb294b8d8a697fe6fdae03a6c61098de514241564c", "bytes": 2034 }, "page.html": { "sha256": "328191a093edcb0fb9ff08b20687f3c271db0b69eb58c770700dbfdfa080da96", "bytes": 75111 }, "provenance.json": { "sha256": "1e8d90e0d23cf4b63e37636b005fac4be349ebd5ce37cd39f3e8e921d84644fb", "bytes": 894 }, "rendered.html": { "sha256": "ccc94fffbb92d25658fbb11c5935488c45109113a44b5ec6bf775ad2240cea3f", "bytes": 53664 }, "screenshot.png": { "sha256": "f9033cc86d53addc1cf8ed9db6855d4e30e30eec050db17bec1d47beb99651ee", "bytes": 226803 }, "text.txt": { "sha256": "d1c97bbc45ba4cc7861035a6f606f1bc1c7b782b44ce8bdc279c7143640f4a5f", "bytes": 1276 } }, "started_utc": "2026-10-22T08:16:05.652Z", "status": 200, "final_url": "https://www.ncsc.govt.nz/alerts/" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Listing at 08:16Z: the PHP alert, dated 22 October 2026.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC NZ alerts listing\n\nCaptured 08:16Z. Top item: \"CVE-2026-109618 and CVE-2026-109619 affecting PHP\", 22 OCTOBER 2026.\n" }, { "slug": "newsweek-php2shell-websites", "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "publisher": "Newsweek", "kind": "news", "title": "PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112237Z", "files": { "headers.json": { "sha256": "b6ede4c5fe94adc6fedb71cb10b74af567162d6452ec0218be0bb8c7b17748dd", "bytes": 2453 }, "page.html": { "sha256": "02014f6004d880e2069129f15e86dde9bc0690358b12879271104aa686ed7af0", "bytes": 559900 }, "provenance.json": { "sha256": "3924e8c0bcf61c3ac2c4018ed3883377b700cd1ff8b1868e156d09adbb78ffc1", "bytes": 1106 }, "rendered.html": { "sha256": "ba7e1618e4d6808ff4982067fda5725d0e4c5a6fcfd94dc91b4b6bd65068189d", "bytes": 815834 }, "screenshot.png": { "sha256": "3d81fb9fa70f4b8446dc70da529dd38f40b9e9caf64fd826a7c1fd282de0d3b0", "bytes": 2773005 }, "text.txt": { "sha256": "323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294", "bytes": 11698 } }, "started_utc": "2026-10-22T11:22:37.989Z", "status": 200, "final_url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Wikimedia Foundation quote 'taken down a number of other systems as a precautionary measure'; no evidence of US federal sites compromised or offline.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek\n\nCaptured by claude-story-site. Status: captured. Secondary: Wikimedia Foundation quote 'taken down a number of other systems as a precautionary measure'; no evidence of US federal sites compromised or offline.\n\n- Captured for the Wikimedia quote and the federal-sites line.\n" }, { "slug": "nsa-press-php-4630238", "url": "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/", "publisher": "US National Security Agency (NSA)", "kind": "government", "title": "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080954Z", "files": { "headers.json": { "sha256": "97a8c93336e9eaf70c80dd55bf2a30afda4f796323bb1e628388046b2d71ff58", "bytes": 671 }, "page.html": { "sha256": "18db3cea62d9017227ca3bc12cc73fe965e84f2a0d946dbc0278c4772dd415f3", "bytes": 98539 }, "provenance.json": { "sha256": "246b632f5be873be48cc8894fb4abdb03858ee784e155a5f703c690e0c937495", "bytes": 1286 }, "rendered.html": { "sha256": "0e42d4e7ce3e0af33f09f09b458d895320523102285301139861be8ba95f5889", "bytes": 122356 }, "screenshot.png": { "sha256": "1bc158a28beb2de8ef2533cca0ddffbec42a196ae7094ca2d019ff076cd27725", "bytes": 992031 }, "text.txt": { "sha256": "8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154", "bytes": 4995 } }, "started_utc": "2026-10-22T08:09:54.641Z", "status": 200, "final_url": "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Press release dated Oct. 21, 2026 (no time given). Nicknames the bugs 'PHP2Shell'. Recommends patching, inventory, enhanced logging, replacing EOL PHP; 'If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.' Says the risks 'require immediate patching across United States Government departments and agencies'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA press release: Critical Patches Recommended for PHP Vulnerabilities\n\n- Dated Oct. 21, 2026 (meta datePublished \"Oct. 21, 2026\"); no time given. The X UPDATE post linking to it went out 2026-10-22T00:43:58Z, so the release was presumably up by then.\n- Captured 2026-10-22T08:09:54Z.\n- Key verbatim lines:\n - \"vulnerabilities, collectively nicknamed “PHP2Shell,”\"\n - \"PHP released their open-source software patch Wednesday, October 21, 2026.\"\n - \"All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions.\"\n - Mitigations: \"Adding enhanced logging within network/operational environments\"; \"Replacing end-of-life PHP services which will not be compatible with patching\"\n - \"If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.\"\n - \"“PHP2Shell” could allow attackers to take control of affected web servers without prior access or authentication.\"\n - \"These risks are serious enough to require immediate patching across United States Government departments and agencies.\"\n - \"NSA will continue to work with experts across the intelligence community (IC), including CISA\"\n- No CVE IDs are named in the release.\n" }, { "slug": "nsa-x-2112903220209098897", "url": "https://x.com/NSACyber/status/2112903220209098897", "publisher": "NSA Cybersecurity (@NSACyber)", "kind": "social", "title": "NSA Cyber on X: Effective Immediately ... two critical vulnerabilities", "published": "2026-10-21T13:45:58Z", "captures": [ { "stamp": "20261022T080954Z", "files": { "headers.json": { "sha256": "2b72f04731267bb06c6ed80fb9fab697c55697ef2b83303924c315720ed63729", "bytes": 9020 }, "page.html": { "sha256": "49362e7db1112702cb4586ed77daa898c86293d85b5ebe33b7a7dca7db1396a2", "bytes": 139058 }, "provenance.json": { "sha256": "569e1386915c3d850f140375196be63051f6099dd3eaa803bee46f3d014e8984", "bytes": 1240 }, "rendered.html": { "sha256": "a95403e3cb7230cb93a3aad7f6f4a09998596f2636f7516355cf3d52bb8fcf58", "bytes": 162779 }, "screenshot.png": { "sha256": "f9e02ad5c04f114f4ab6cc0cd14b556924d445869fb512f4306683da40d50564", "bytes": 452042 }, "text.txt": { "sha256": "92ebce791a7b35429d2fee94427932a19b1629de3821a52201648a58298d52e7", "bytes": 1811 } }, "started_utc": "2026-10-22T08:09:54.553Z", "status": 200, "final_url": "https://x.com/NSACyber/status/2112903220209098897" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "First NSA post (pinned). Time from tweet snowflake ID = 2026-10-21T13:45:58Z; the page shows '13:45 · 21 Oct 2026' (UTC browser). 10.1M views at capture. 'If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.'", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA Cyber X post 1 (the \"two critical vulnerabilities\" post)\n\n- URL: https://x.com/NSACyber/status/2112903220209098897. Also pinned on the profile (captured as `nsa-x-nsacyber`).\n- Posted 2026-10-21T13:45:58Z (decoded from the snowflake ID: (id>>22)+1288834974657 ms). The page shows \"13:45 · 21 Oct 2026\"; the capture browser ran in UTC.\n- Captured 2026-10-22T08:09:54Z. Counts at capture: 10.1M views, 1.1K replies, 9.5K reposts, 63K likes, 15K bookmarks.\n- Full text, verbatim (the typo \"it is recommend\" is in the original):\n > Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.\n- Note the timing. The post says \"be prepared for an update\", so it reads as if it came before the patch, or with it. The NSA press release says PHP released its patch \"Wednesday, October 21, 2026\".\n- Mirrors: nitter.net now serves only a shutdown notice (X C&D letters, update dated 10 Oct 2026), captured as `nsa-x-nsacyber-nitter`. xcancel.com returned HTTP 451 to curl.\n" }, { "slug": "nsa-x-2113068811058622971", "url": "https://x.com/NSACyber/status/2113068811058622971", "publisher": "NSA Cybersecurity (@NSACyber)", "kind": "social", "title": "NSA Cyber on X: UPDATE: Specific mitigation guidance ... now available", "published": "2026-10-22T00:43:58Z", "captures": [ { "stamp": "20261022T080954Z", "files": { "headers.json": { "sha256": "9292b5863f63684cb58479f72ed4579062a1ff66108183ddfd21a51a34f25f60", "bytes": 9022 }, "page.html": { "sha256": "8b2c9d9cbd6c8cfa6e5614e7900653b6bcddb21e5d8e4a0a880b9613ae9d1bfe", "bytes": 166142 }, "provenance.json": { "sha256": "0931b8c67b66649c978bd87fd385c5c0e597b091e5e840db5dc9d4d1e1b63c9d", "bytes": 1154 }, "rendered.html": { "sha256": "3a297e1972ba61e2d78a5ca5842af0507e79e8d8b04aa8c7dcfa311794d9242c", "bytes": 167035 }, "screenshot.png": { "sha256": "846daf6b3e0004aee5355c16bf1ad5d57544d6b38547e5cf26d513a0dc8d168a", "bytes": 224980 }, "text.txt": { "sha256": "899e5ba4af69c5311210a846d98721e674abded497de292dfdc4af17b2ff1bd3", "bytes": 2052 } }, "started_utc": "2026-10-22T08:09:54.577Z", "status": 200, "final_url": "https://x.com/NSACyber/status/2113068811058622971" } ], "status": "captured", "primary": true, "added_by": "collector-gov", "notes": "Second NSA post, from the snowflake ID: 2026-10-22T00:43:58Z. It links (t.co/nuXgQ10Fzc) to the NSA press release 4630238. 206.4K views at capture.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA Cyber X post 2 (UPDATE)\n\n- URL: https://x.com/NSACyber/status/2113068811058622971. Posted 2026-10-22T00:43:58Z (snowflake). The page shows \"0:43 · 22 Oct 2026\".\n- Verbatim: \"UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: https://t.co/nuXgQ10Fzc\". It links to nsa.gov press release Article/4630238 (`nsa-press-php-4630238`).\n- 206.4K views at the 08:09Z capture. The replies are unverified chatter (e.g. one claims GoDaddy reseller support said its servers are unpatched). Do not use them.\n" }, { "slug": "nsa-x-nsacyber", "url": "https://x.com/NSACyber", "publisher": "NSA Cybersecurity (@NSACyber)", "kind": "social", "title": "NSA Cyber (@NSACyber) / X profile timeline", "published": null, "captures": [ { "stamp": "20261022T080925Z", "files": { "headers.json": { "sha256": "9fa8661bfa8f332a71ed3f88de6e09033b05073ba537b3d891f1b4209bf1c757", "bytes": 9022 }, "page.html": { "sha256": "35b05885b38c909cd06bc0f6617a32454843249a5c4d5c92274ca3a543b98310", "bytes": 160043 }, "provenance.json": { "sha256": "0680efdf34c9fb08e25e730dbadcc178f7f0a02d64d82260f9802d4fdaf70a00", "bytes": 893 }, "rendered.html": { "sha256": "ae4abd70be7db953acec8f33cae64b339eb2729b8661c3191dc88e62eb17ee1d", "bytes": 198521 }, "screenshot.png": { "sha256": "20541dc8b918cda68c8be3b4a94e4698a53f3edb149d38ba9d8344210189f384", "bytes": 1255100 }, "text.txt": { "sha256": "5889a1c26173dac8ee58b5269e4f78aeb57dc93520afa220d496e634b5e5b7c0", "bytes": 2388 } }, "started_utc": "2026-10-22T08:09:25.014Z", "status": 200, "final_url": "https://x.com/NSACyber" } ], "status": "captured", "primary": false, "added_by": "collector-gov", "notes": "Profile timeline at 08:09Z: the pinned PHP post plus the UPDATE post; 201.8K followers.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NSA Cyber X profile\n\nThe timeline at capture shows the pinned post 2112903220209098897 (18h) and the UPDATE post 2113068811058622971 (7h). No other PHP posts. Captured to keep the profile context.\n" }, { "slug": "nsa-x-nsacyber-nitter", "url": "https://nitter.net/NSACyber", "publisher": "nitter.net", "kind": "social", "title": "nitter.net (shutdown notice, no tweets)", "published": null, "captures": [ { "stamp": "20261022T080925Z", "files": { "headers.json": { "sha256": "ab425e76be267227a6680e0572e20c30271e2d99585b0cb665f948349e7e5e22", "bytes": 700 }, "page.html": { "sha256": "846a9048bdd79311b1c92ef549dc68d73a61edd0f9832264cea107686a3f53cc", "bytes": 12341 }, "provenance.json": { "sha256": "5866931f9bcffc1f87e58582a3b73e4fd0fe9414f675213c27278464589fa4c8", "bytes": 895 }, "rendered.html": { "sha256": "21e41f57eb9abbe1a4b2db26e202689f711d079cff963c4af7c549714eccd108", "bytes": 12292 }, "screenshot.png": { "sha256": "d179e4f97e7b7e0371b33c4fc9e9dd245980aa3bf0ef5add188775144552c848", "bytes": 162950 }, "text.txt": { "sha256": "f4e954159062308642561f65d6f65c068c8ee1001bcafdf6e9388181a78d2d93", "bytes": 1513 } }, "started_utc": "2026-10-22T08:09:25.054Z", "status": 200, "final_url": "https://nitter.net/NSACyber" } ], "status": "failed", "primary": false, "added_by": "collector-gov", "notes": "Mirror is dead: it serves only the maintainer's 10 Oct 2026 notice about X Corp cease-and-desist letters. xcancel.com/NSACyber returned HTTP 451 via curl (not captured).", "raw_sha256": {}, "has_notes": true, "notes_md": "# nitter mirror attempt\n\nnitter.net/NSACyber returned 200, but the page is only a shutdown/legal notice (\"UPDATE Oct 10th ... X Corp. sent cease and desist letters\"). It holds no NSA content. xcancel.com/NSACyber returned HTTP 451 (Unavailable For Legal Reasons) to curl. X itself was reachable directly, so the posts were captured from x.com.\n" }, { "slug": "nvd-cve-2026-109618", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618", "publisher": "NIST National Vulnerability Database", "kind": "cve", "title": "NVD - CVE-2026-109618", "published": "2026-10-21T14:17:09.357Z", "captures": [ { "stamp": "20261022T081218Z", "files": { "headers.json": { "sha256": "f81072c6a6dc3dda5884e2b701c37879b7d8762357ffa7bd4ea88ab95f9e5d6a", "bytes": 1414 }, "page.html": { "sha256": "5218b57d88785ba853fce0de8804f8994d73d4cb3209339fa458c4a5cbb9881f", "bytes": 2453 }, "provenance.json": { "sha256": "f9105904aa37fc65ae54d1cb66b08b59b354c3eb7b20bf7cc925bd7ff4cfce78", "bytes": 935 }, "rendered.html": { "sha256": "b4880a9e6a29cbee557232a66f9db3531b225dd95a517433c6e326be8bb41e87", "bytes": 2827 }, "screenshot.png": { "sha256": "442aa587ff9ee582c291e7c7a8bca102504856b7a4db838cb313226e016f993e", "bytes": 106759 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:12:18.530Z", "status": 200, "final_url": "https://nvd.nist.gov/vuln/detail/cve-2026-109618" }, { "stamp": "20261022T081302Z", "files": { "headers.json": { "sha256": "5d77eaec3eb1fe5d7fb3a76a35571380e31671576d24b40c26f0f87d75f2c610", "bytes": 1414 }, "page.html": { "sha256": "f372c9f8983a6331efb78d85ea53abc653d4bbe75457c02c9a25d9cc1ec2086e", "bytes": 2453 }, "provenance.json": { "sha256": "578b5687fe8afa3ad4f74ab69b8ca2471a0b0ee0a650e832021623cf9e346931", "bytes": 935 }, "rendered.html": { "sha256": "2aa4037a7f7c9c97111573860083b648f53df74a60cea8fc7f9205b76d01f36e", "bytes": 2827 }, "screenshot.png": { "sha256": "8d848319be976cd91ac761f8f5b19ff3d8547393428ff570f273a774b5094d39", "bytes": 106512 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:13:02.594Z", "status": 200, "final_url": "https://nvd.nist.gov/vuln/detail/cve-2026-109618" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "NVD page did not render in two Playwright captures (empty text); the authoritative copy is raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 17:18:24Z, status Modified. Only CNA (security@php.net, Secondary) CVSS v4 9.2; no NIST primary score yet. NVD CWEs: 416, 755, 824, 1325 (no 1419). No CISA KEV fields.", "raw_sha256": { "nvd-api-2.0.json": "dd864fa6ed53d4b549d2429fad6a22878ddb5a6def44b80cac0628cf4fdab438" }, "has_notes": true, "notes_md": "# NVD CVE-2026-109618: notes\n- The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / \"Loading CVE Information\"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).\n- See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type \"Secondary\", baseScore 9.2, \"CRITICAL\"). There is no NIST primary assessment and no CPE configuration yet.\n- NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.\n- No cisaExploitAdd field (not in KEV at fetch time).\n" }, { "slug": "nvd-cve-2026-109619", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619", "publisher": "NIST National Vulnerability Database", "kind": "cve", "title": "NVD - CVE-2026-109619", "published": "2026-10-21T14:17:09.823Z", "captures": [ { "stamp": "20261022T081219Z", "files": { "headers.json": { "sha256": "fc8d0ec5d6feaed052fd64b49abaebe2394f7ef3bc2ce70aee91e20e1306822e", "bytes": 1413 }, "page.html": { "sha256": "fbdf9ac8177380bc8093bab92baaa18402cc52721b3aaa5b037cb507c15a3bf3", "bytes": 2453 }, "provenance.json": { "sha256": "bad76168518f8666d20502a4cb32e9b3425e785e7abbf63160cbd9081db807b5", "bytes": 944 }, "rendered.html": { "sha256": "3784d224686072278cb9ed34c55c7390353818b2d9b35535eb289099d5bb536f", "bytes": 31323 }, "screenshot.png": { "sha256": "56539f358f1226f93c35cc6828cee0c2edbcda7da8a3fce9e8deaad68f133fea", "bytes": 106528 }, "text.txt": { "sha256": "fbcf781e4294ea8f1f693ce52cf0e7c6ff9e8dff930df337294d54fb9f849466", "bytes": 839 } }, "started_utc": "2026-10-22T08:12:19.279Z", "status": 200, "final_url": "https://nvd.nist.gov/vuln/detail/cve-2026-109619" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Page rendered only as 'Loading CVE Information'; use raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 21:17:52Z. CNA CVSS v4 9.2 only; no NIST score. No KEV fields.", "raw_sha256": { "nvd-api-2.0.json": "627fdaed31c96626e2dcc8af24a6acab1b2da1658bb32b5cf627e30149a0b61c" }, "has_notes": true, "notes_md": "# NVD CVE-2026-109619: notes\n- The NVD detail page is JavaScript-rendered and did not render in our headless captures (blank / \"Loading CVE Information\"). The captures are kept as a record of the attempt; use raw/nvd-api-2.0.json (fetched 08:11Z from services.nvd.nist.gov/rest/json/cves/2.0).\n- See source.json for published/lastModified. NVD shows only the CNA's CVSS v4.0 score (security@php.net, type \"Secondary\", baseScore 9.2, \"CRITICAL\"). There is no NIST primary assessment and no CPE configuration yet.\n- NVD weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325. The GHSA also lists CWE-1419.\n- No cisaExploitAdd field (not in KEV at fetch time).\n" }, { "slug": "openai-blog-coordinated-disclosure", "url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/", "publisher": "OpenAI", "kind": "researcher", "title": "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081113Z", "files": { "headers.json": { "sha256": "7b02609d3cb8321fcd39f1fb944357b1becd2b3914b213682188380e551a576e", "bytes": 1912 }, "page.html": { "sha256": "fdf2d9f575486a9ace314ca2636c5ddac6e6cbe0cb71fbd74c561248b86caef2", "bytes": 10672 }, "provenance.json": { "sha256": "044271cf8e68e02415a432222e0036e63e3bc6ba426046d653313c6cf329a96e", "bytes": 1012 }, "rendered.html": { "sha256": "582d07e3d24a3e25bdb6f9515a3ecee4de66710e90c88b8fe2bb35f6457f1387", "bytes": 11479 }, "screenshot.png": { "sha256": "c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc", "bytes": 13108 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:11:13.594Z", "status": 403, "final_url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/" }, { "stamp": "20261022T112413Z", "files": { "headers.json": { "sha256": "e4f85b63820ea6efd08d11267c2b64182f40b903e674511097639f35151ff850", "bytes": 1914 }, "page.html": { "sha256": "db092a078bc5df2a4c7258208dd350e18d58597541c27492bb6085ddc605b519", "bytes": 10672 }, "provenance.json": { "sha256": "adbd882dc23ca47f5c3ce16c95f07213ed270f28011521f7beade694144a3cb0", "bytes": 1012 }, "rendered.html": { "sha256": "727b7be84beefe987e85a9a6d99200779878441c04443791f3ee6aa992118351", "bytes": 11479 }, "screenshot.png": { "sha256": "c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc", "bytes": 13108 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T11:24:13.137Z", "status": 403, "final_url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/" } ], "status": "blocked", "primary": true, "added_by": "collector-researchers", "notes": "openai.com served a Cloudflare 'Just a moment...' challenge (HTTP 403) to capture.mjs, curl and WebFetch at 2026-10-22T08:11Z. The 403 capture folder is kept as the record. Content known only via secondary quotes; another agent should retry. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked.", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI: \"Patch the Planet: global response coordination as agents uncover critical vulnerabilities\" — BLOCKED\n\n- URL https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ (found via web search; title as indexed). Every fetch at 2026-10-22T08:11Z got a Cloudflare challenge page (\"Just a moment...\", HTTP 403): capture.mjs, curl and WebFetch. The 403 capture is kept as the record of the attempt.\n- archive.org was also unreachable (TLS connection reset via proxy), so no Wayback copy could be checked.\n- What is known only second-hand (search-result snippets, unverified wording):\n - Published Oct 21, 2026.\n - \"Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities.\"\n - OpenAI X post (x.com/OpenAI/status/2112907856018309586): \"OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and s[ecurity providers]...\"\n - Launched patchtheplanet.org and a \"php2shell-checker\" (Codex skill + Node script) on GitHub.\n - \"one of the most impactful security issues in recent memory\" (quoted by The Hacker News and the BBC).\n- Contradiction to chase: the PHP Foundation says \"OpenAI independently reported the same root cause on the same day\" (Aug 11) and further vectors Sept 18 (OpenAI Codex Security, Amy Burnett). Secondary reports of OpenAI's post reportedly credit only Calif and Wiz with discovery.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n" }, { "slug": "openai-community-php-flaws", "url": "https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490", "publisher": "OpenAI Developer Community (user 'sps', Leader)", "kind": "forum", "title": "OpenAI models help researchers uncover critical PHP security flaws", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081721Z", "files": { "headers.json": { "sha256": "86f75f0dcbf3bc611bd0c24cc8c87f49138270eaac36ff55f379acd57638d537", "bytes": 1273 }, "page.html": { "sha256": "9b1e1cbea269bc3fe068f7344d39a81937b9ec473044047d9d0700cb653af679", "bytes": 296980 }, "provenance.json": { "sha256": "1394b5dabf1a6c5064c6bd0a2a0750815ffb787cf14f7155f7a1c680a5566c8d", "bytes": 1153 }, "rendered.html": { "sha256": "f20e90bdf364618ef6f4900343a7e3abbdb5e6006e628ae4e80a8b92bd8bdf47", "bytes": 624051 }, "screenshot.png": { "sha256": "e3138cd2f1d4e9539051514491c494acd19c7c4afffabe913081dd1ef8d3a691", "bytes": 370209 }, "text.txt": { "sha256": "43afe7a0a3b96a86e52cbeea1c6ae41560bab1566da848fc4f9067152f739cd5", "bytes": 3504 } }, "started_utc": "2026-10-22T08:17:21.331Z", "status": 200, "final_url": "https://community.openai.com/t/openai-models-help-researchers-uncover-critical-php-security-flaws/1408490" } ], "status": "captured", "primary": false, "added_by": "collector-researchers", "notes": "Forum repost of OpenAI's announcement text, Oct 21; links https://github.com/openai/php2shell-checker (Codex skill).", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI Developer Community repost (Oct 21)\n\n- User \"sps\" (Leader badge) reposts OpenAI's announcement text, tagged gpt-5.6-sol. Adds: \"If you are wondering whether your website is affected, we have packaged a Codex skill to help check... https://github.com/openai/php2shell-checker\". Secondary to the X post; useful as an accessible copy while openai.com is blocked.\n" }, { "slug": "openai-patch-the-planet-launch", "url": "https://openai.com/index/patch-the-planet/", "publisher": "OpenAI", "kind": "researcher", "title": "Patch the Planet (launch announcement)", "published": null, "captures": [ { "stamp": "20261022T081658Z", "files": { "headers.json": { "sha256": "dabb6d316b2a9ca13a6a49cd3d11a59538e1df05d7bd684ec04dd3ff4a830c61", "bytes": 1920 }, "page.html": { "sha256": "1debac9983b263577c7488d66e2818ce992f602955f908219aa39abff4854500", "bytes": 10484 }, "provenance.json": { "sha256": "eecdf8db164ee1e68d9f8e7f6c9705554227dbe3f65fa9ddf547d56f2aa0fb54", "bytes": 940 }, "rendered.html": { "sha256": "80b0289e281954fb599df1170766a5d6f8a6bdecad2a5b444dd54e0a109542ab", "bytes": 11291 }, "screenshot.png": { "sha256": "c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc", "bytes": 13108 }, "text.txt": { "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "bytes": 0 } }, "started_utc": "2026-10-22T08:16:58.833Z", "status": 403, "final_url": "https://openai.com/index/patch-the-planet/" }, { "stamp": "20261022T112430Z", "files": { "headers.json": { "sha256": "cb97f3646fc464783030ad6f26b7191a2153e7964501252ae1fd40d86db2fbb7", "bytes": 3536 }, "page.html": { "sha256": "ad9f31cd0180d78e020821254328f835f4aa9b45f55d380ac5c4ba0e0fbd0a12", "bytes": 471833 }, "provenance.json": { "sha256": "a4668895879d2911dd924db2f462ac177db64b7dd8c7343b68e6f57540c78da8", "bytes": 1007 }, "rendered.html": { "sha256": "66a7a5d479dc9553dcba734583b2b1a930f2ea9a4284417125fb1ec24ff54088", "bytes": 471423 }, "screenshot.png": { "sha256": "d24aaf68ae28b9ffd320d4f4bec241764fe84587ae5932454b99c3780aafe6b2", "bytes": 1532182 }, "text.txt": { "sha256": "1bc9a32356688dd3f82be20cb4c54b29c9d9d1fd3d04278dcdccb0fe504c2db4", "bytes": 13908 } }, "started_utc": "2026-10-22T11:24:30.611Z", "status": 200, "final_url": "https://openai.com/index/patch-the-planet/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Cloudflare challenge (403) at 2026-10-22T08:17Z. Launch date reported by secondary sources as June 2026 (unverified); Calif says invitation came by July 30 2026; BBC says PHP Foundation joined in July 2026. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured.", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI \"Patch the Planet\" launch post — BLOCKED\n\n- https://openai.com/index/patch-the-planet/ — Cloudflare challenge 403 at 2026-10-22T08:16:58Z. The 403 capture is kept.\n- Secondary (unverified, search snippets): a Daybreak initiative built with Trail of Bits, with HackerOne and Calif as partners; early projects cURL, Python, Go, aiohttp, Sigstore, pyca/cryptography; model \"GPT-5.5-Cyber\". Launch reportedly June 22, 2026 (one snippet). This differs from the BBC framing that the PHP Foundation \"joined\" in July: the Foundation says it \"got the PHP project into the Patch the Planet program\", and Calif says \"OpenAI invited us\".\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n\n\n## Retry by claude-story-site, 22 Oct\n- Retried by claude-story-site; see provenance.\n" }, { "slug": "openwall-oss-security-109619-thread", "url": "https://www.openwall.com/lists/oss-security/2026/10/21/16", "publisher": "oss-security list (replies: Aaron Rainbolt, Yves-Alexis Perez/Debian, Christian Fischer/Greenbone)", "kind": "forum", "title": "Re: CVE-2026-109619 thread (21/16, 21/17, 21/23, 22/2)", "published": "2026-10-21T15:24:37Z", "captures": [], "status": "captured", "primary": false, "added_by": "collector-primary", "notes": "raw/ curl copies of four replies. Fediverse report (fedi.katze.sh/@elise) that the 8.5.12 fix may be incomplete or a different new bug; Canonical reportedly told by PHP 'unrelated and not a real issue' (second-hand, via Matrix). Greenbone notes 7.4-8.1 are implicitly affected.", "raw_sha256": { "oss-security-2026-10-21-16.html": "6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccf", "oss-security-2026-10-21-17.html": "059317aa4a1f458e19196e6add44a6b3106632b82c82f104a5b83d0df6fbe09f", "oss-security-2026-10-21-23.html": "39555f34a419becc6a47480eabb369e05f4bac6ce06e9e3843e4dfcb5c99801b", "oss-security-2026-10-22-2.html": "bbc0f0fc06953b13308925334e39e7808796e46ea9505630917762502996bea2" }, "has_notes": true, "notes_md": "# oss-security replies to the CVE-2026-109619 announcement: notes\n- Captured with curl only (raw/), ~08:14Z on 22 Oct. These are third-party replies, not PHP statements.\n- 21/16, Aaron Rainbolt, 21 Oct 10:24:37 -0500 (15:24Z): \"While not yet fully confirmed, the Fediverse is reporting that the fix to at least PHP 8.5.12 may be incomplete: https://fedi.katze.sh/@elise/117479383739450605\"\n- 21/17, Yves-Alexis Perez (Debian), 17:41:56 +0200 (15:41Z): @elise also said it seems to be a *different* vulnerability: \"there's no way this is the same vuln, this is another one.\" (https://fedi.katze.sh/@elise/117478655339557825)\n- 21/23, Rainbolt, 12:29:01 -0500 (17:29Z): per #security:ubuntu.com Matrix, Canonical asked PHP and \"was told that it's 'unrelated and not a real issue'\". Second-hand and unconfirmed on-list.\n- 22/2, Christian Fischer (Greenbone), 22 Oct 08:45:47 +0200 (06:45Z): the subject \"PHP 8.2-8.5\" could imply that older versions are unaffected, but the php.net backports to 7.4/8.0/8.1 imply that \"at least versions down to 7.4 are affected as well\".\n- OPEN: is there a third PHP bug, or an incomplete fix in 8.5.12? Not confirmed by PHP on-list as of capture. The fedi.katze.sh posts should be captured by the social collector.\n" }, { "slug": "openwall-oss-security-2026-10-20-34", "url": "https://www.openwall.com/lists/oss-security/2026/10/20/34", "publisher": "oss-security list (Alan Coopersmith, Oracle)", "kind": "advisory", "title": "Upcoming Critical PHP Security Release", "published": "2026-10-20T20:22:51Z", "captures": [ { "stamp": "20261022T081408Z", "files": { "headers.json": { "sha256": "716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114", "bytes": 239 }, "page.html": { "sha256": "46a94f610255e2ee75ab240c658666ef2589e34e4dd4fcb93b5c5e45fc9917d4", "bytes": 5800 }, "provenance.json": { "sha256": "04ff8e63e2b72caeb3d48ed4a44ecc28434a0414db9f8d59022e7b75af8ccb40", "bytes": 1012 }, "rendered.html": { "sha256": "5c80dc74b7328496b9f3ee62eef06aa707db7327bd0bcdd7ab9aa4f0c5a5a5d8", "bytes": 6056 }, "screenshot.png": { "sha256": "c03f4fc0fefe0485485685cdf28d3e439a4b167b3022a946ee928be55cd4ee0d", "bytes": 120872 }, "text.txt": { "sha256": "57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392", "bytes": 1415 } }, "started_utc": "2026-10-22T08:14:08.402Z", "status": 200, "final_url": "https://www.openwall.com/lists/oss-security/2026/10/20/34" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Date header Tue, 20 Oct 2026 13:22:51 -0700 (= 20:22:51Z). Quotes the php.net pre-announcement verbatim: scheduled 21 Oct 14:00 UTC, two vulns CVSS v4.0 9.2.", "raw_sha256": {}, "has_notes": true, "notes_md": "# oss-security 2026/10/20/34: notes\n- Posted by Alan Coopersmith (Oracle). Date: Tue, 20 Oct 2026 13:22:51 -0700 = 20:22:51Z.\n- Relays the php.net pre-announcement verbatim: \"It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.\" \"It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.\" \"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.\"\n- Timing evidence: the php.net pre-announcement was public by 20:22Z on 20 Oct. That fits the Foundation's \"19:30 UTC\" and contradicts php.net's own feed timestamp of 20:32:00+00:00.\n" }, { "slug": "openwall-oss-security-2026-10-21-6", "url": "https://www.openwall.com/lists/oss-security/2026/10/21/6", "publisher": "oss-security list (Jakub Zelenka, PHP security team)", "kind": "advisory", "title": "CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption", "published": "2026-10-21T14:41:54Z", "captures": [ { "stamp": "20261022T081408Z", "files": { "headers.json": { "sha256": "716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114", "bytes": 239 }, "page.html": { "sha256": "d43a7569e9b4ff185814a61ed2a17e0b058d4554558a9fee8e3a7a29810169c5", "bytes": 6170 }, "provenance.json": { "sha256": "9ab3756501428b0a77ed30c1d7ef15298f6a8edb131b1dc1436043a045609b4b", "bytes": 1024 }, "rendered.html": { "sha256": "0686ceff1b17dfaad334b167b4f0fbb9dc9cbcdc897203d210b9a1d7a9630269", "bytes": 6426 }, "screenshot.png": { "sha256": "6604c447fd5c7db94e64b0c9eeb75cd7301d461bd4f903890db31f9971d20236", "bytes": 146765 }, "text.txt": { "sha256": "2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f", "bytes": 1805 } }, "started_utc": "2026-10-22T08:14:08.516Z", "status": 200, "final_url": "https://www.openwall.com/lists/oss-security/2026/10/21/6" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Date header Wed, 21 Oct 2026 16:41:54 +0200. Official PHP security team announcement.", "raw_sha256": {}, "has_notes": true, "notes_md": "# oss-security 2026/10/21/6: notes\n- From Jakub Zelenka (PHP security team; GitHub handle bukka, who published both GHSAs). Date 21 Oct 2026 16:41:54 +0200 = 14:41:54Z.\n- Verbatim: \"CVE: CVE-2026-109618 / Severity: Critical (CVSS v4.0: 9.2)\". \"Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, and PHP 8.5 before 8.5.12.\"\n- \"Unauthenticated RCE has been demonstrated over HTTP against Apache mod_php, before application code executes. Source analysis also indicates FPM susceptibility, although a complete FPM exploit has not been demonstrated.\"\n- \"Updating is the only complete mitigation.\"\n" }, { "slug": "openwall-oss-security-2026-10-21-7", "url": "https://www.openwall.com/lists/oss-security/2026/10/21/7", "publisher": "oss-security list (Jakub Zelenka, PHP security team)", "kind": "advisory", "title": "CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state", "published": "2026-10-21T14:44:06Z", "captures": [ { "stamp": "20261022T081407Z", "files": { "headers.json": { "sha256": "ffb76440772a63ed2186c00ea575b6e673ca3c7222ae89205c2bbb9de07e38ae", "bytes": 239 }, "page.html": { "sha256": "81caae4759a5e9cd8e501221e12f31928874e9d16d7f7e8523e8cb1d36aa69fd", "bytes": 6323 }, "provenance.json": { "sha256": "deeabe8cb21005c2d60c6ffcca6537969877e4411a8d1bbc88503109265756ce", "bytes": 1028 }, "rendered.html": { "sha256": "b797761c288a2b59dad8b9bf3c0f4810af1b669a685b93013a7d6edc0e688638", "bytes": 6579 }, "screenshot.png": { "sha256": "d6c5ab360073ebc5769973dc76493c74acf62cdc6e099f668ebffae91de551fa", "bytes": 154322 }, "text.txt": { "sha256": "ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384", "bytes": 1934 } }, "started_utc": "2026-10-22T08:14:07.371Z", "status": 200, "final_url": "https://www.openwall.com/lists/oss-security/2026/10/21/7" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Date header Wed, 21 Oct 2026 16:44:06 +0200. Replies at 21/16, 21/17, 21/23, 22/2 are in openwall-oss-security-109619-thread.", "raw_sha256": {}, "has_notes": true, "notes_md": "# oss-security 2026/10/21/7: notes\n- From Jakub Zelenka. Date 21 Oct 2026 16:44:06 +0200 = 14:44:06Z. (A reply at 21/16 quotes it as sent \"10:11 AM\" -0500 = 15:11Z. The quoted time does not match the Date header; it may be the reply client's own receive or display time.)\n- Verbatim: \"CVE: CVE-2026-109619 / Severity: Critical (CVSS v4.0: 9.2)\", same affected ranges.\n- \"Unauthenticated RCE has been demonstrated against Apache mod_php and PHP-FPM. Exploitability depends on the affected state, configuration, and application behavior.\"\n- \"Updating is the only reliable mitigation; there is no complete generic configuration workaround.\"\n" }, { "slug": "oxfordchronicle-councils-offline", "url": "https://www.oxfordchronicle.co.uk/2026/10/21/oxfordshire-council-websites-offline-amid-critical-global-security-issue/", "publisher": "Oxford Chronicle", "kind": "news", "title": "Oxfordshire council websites offline amid critical global security issue | Oxford Chronicle", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112935Z", "files": { "headers.json": { "sha256": "ffb2fca308d4c4c89c5593350a364a6121becb966829713a17b3a99c2669d99b", "bytes": 1048 }, "page.html": { "sha256": "7603fb4868cc7b8a8fa437b7e2a8500726acf1332fd3f2252489e8f71471e5a2", "bytes": 472071 }, "provenance.json": { "sha256": "94eda260baf0d2faf05d45a4bb93b717ed498b664f3b724444bb046dba9ec628", "bytes": 1169 }, "rendered.html": { "sha256": "e1614eeb5b71eb2bebf826c3131167eed9cefd83826c53632ff386d1a1a90afa", "bytes": 477225 }, "screenshot.png": { "sha256": "6e1d23c7119672f3ed76f38b59112885b43f6961b77abd0009ea77015e7ec42d", "bytes": 1579440 }, "text.txt": { "sha256": "35c847290193f872826f6d65f370bcb6863fafe692817cc449f97431f350ae73", "bytes": 6281 } }, "started_utc": "2026-10-22T11:29:35.741Z", "status": 200, "final_url": "https://www.oxfordchronicle.co.uk/2026/10/21/oxfordshire-council-websites-offline-amid-critical-global-security-issue/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'; Oxfordshire County Council also down.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Oxfordshire council websites offline amid critical global security issue | Oxford Chronicle\n\nCaptured by claude-story-site. Status: captured. Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'; Oxfordshire County Council also down.\n\n- Quotes the council's social post.\n" }, { "slug": "patchtheplanet-org", "url": "https://patchtheplanet.org/", "publisher": "OpenAI (Patch the Planet / Daybreak)", "kind": "researcher", "title": "Patch the Planet — OpenAI", "published": null, "captures": [ { "stamp": "20261022T081652Z", "files": { "headers.json": { "sha256": "2efe5a08cc256108fdb7a72a5bdeb92c7596564181f1d63e2e31fd2b71e2a321", "bytes": 563 }, "page.html": { "sha256": "280b5c18a8bb8c6254841014830e299d803e1d21ffd98141296156a2b5423bda", "bytes": 2325 }, "provenance.json": { "sha256": "e6def2821be82e7593e0ea8682f9c24fdf763a48424e1814e65b815a1db3a78f", "bytes": 909 }, "rendered.html": { "sha256": "d347cfa4c1e9dc2c990b725259875a732e38470560bfc51b6bb21da3419d2662", "bytes": 7680 }, "screenshot.png": { "sha256": "0872d96463aabdeccdeb873b9cb455601fe9cdea8cb6b15f45c65a9e85f1bb75", "bytes": 285779 }, "text.txt": { "sha256": "3e32706fb7c0ed83bb988da8372dbca5e70dbdfebc6135060f3f777805f852ae", "bytes": 1053 } }, "started_utc": "2026-10-22T08:16:52.643Z", "status": 200, "final_url": "https://patchtheplanet.org/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "OpenAI microsite. 'An OpenAI Daybreak initiative'; 'In collaboration with Trail of Bits, Calif, HackerOne'. Latest disclosure php2shell links to https://php2shell.com/. No date on page.", "raw_sha256": {}, "has_notes": true, "notes_md": "# patchtheplanet.org (OpenAI)\n\n- Title \"Patch the Planet — OpenAI\". \"An OpenAI Daybreak initiative\". \"In collaboration with Trail of Bits, Calif, HackerOne\". \"Every finding is reviewed by a person, and maintainers stay in control of their code and releases.\"\n- \"Latest disclosure: php2shell\", \"CVE-2026-109618 · CVE-2026-109619\", linking https://php2shell.com/ (not yet captured — whose site is it?). \"Read the announcement\" links https://openai.com/index/patch-the-planet/ (blocked). Trail of Bits page https://trailofbits.com/patch-the-planet/.\n- No dates on the page.\n" }, { "slug": "php-foundation-blog-security-release", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "publisher": "The PHP Foundation", "kind": "advisory", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "c18914982a4c07d0a15b76e052d18c5f77f345016e356ea5cb65e766f0096b0f", "bytes": 857 }, "page.html": { "sha256": "6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223", "bytes": 40324 }, "provenance.json": { "sha256": "2acdcc9ae9ee9e14a8960ed26727dee21b5561915fc6632378e78c9ae27a3f1b", "bytes": 1218 }, "rendered.html": { "sha256": "874a78d766936a3c9d375512a1882ac83f25921f0a1050ed8169c5f37ea72cf2", "bytes": 126413 }, "screenshot.png": { "sha256": "f6eb5d0b42048f1570880df5c5e38adea3d5ee8635a98b8fef51f6234e5d2089", "bytes": 2631098 }, "text.txt": { "sha256": "a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04", "bytes": 31882 } }, "started_utc": "2026-10-22T08:09:01.670Z", "status": 200, "final_url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Foundation's account of discovery, 2024 audit origin, leak timeline (20 Oct 15:00Z), Calif video, Chainguard embargo break (21 Oct 07:41Z). Page embeds an r/PHP comment thread (third-party, not Foundation).", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Foundation blog: notes\n\n- URL: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/\n- \"Published on Oct 21, 2026\", by \"The PHP Foundation\". Captured 2026-10-22T08:09Z.\n- The rendered page also embeds an r/PHP thread (third-party comments, e.g. a claim that the first in-the-wild exploit was at 08:36 UTC citing ellio.tech). That is not Foundation content.\n\n## Key wording (verbatim)\n- \"CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption ... On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.\"\n- \"CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state ... A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.\"\n- 2024 audit: Sovereign Tech Agency funding, via OSTIF, carried out by Quarkslab; a Foundation-contracted core developer \"found the first signs of the OOM problem behind CVE-2026-109618\". \"the delay was a structural failure\".\n- \"security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution ... OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th.\"\n- Also mentions scanning with \"Anthropic's Claude Mythos\" via Alpha-Omega, and \"OpenAI's Daybreak Red\" for validation; Trail of Bits also auditing.\n- \"On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.\" Pre-announcement \"published it at 19:30 UTC\". Release moved \"from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC.\"\n- \"As a result of the leak and pre-announcement around 20:00 UTC, Calif ... mistakenly published a video.\"\n- \"Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well.\" \"did not identify any functional exploits at the time of release/public disclosure.\"\n- \"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.\"\n- Thanks: \"Calif, especially Ryan A, Wiz, OpenAI Codex Security, especially Amy Burnett, OSTIF, and Quarkslab\".\n\n## Contradictions\n- BBC: Calif found it in August, OpenAI and Wiz \"shortly after\". Foundation: OpenAI reported the same root cause the same day (11 Aug); Wiz 24 Aug.\n- Pre-announcement 19:30 UTC here vs php.net feed timestamp 20:32 UTC.\n- The note's order of OpenAI 18 Sep then Wiz 24 Aug is as written (non-chronological).\n" }, { "slug": "php-net-advisory", "url": "https://www.php.net/archive/2026.php#2026-10-21-5", "publisher": "PHP Group (php.net)", "kind": "advisory", "title": "Security advisory: Critical remote code execution vulnerabilities, update now", "published": "2026-10-21", "captures": [ { "stamp": "20261022T080901Z", "files": { "headers.json": { "sha256": "42812c4d4f151d93b62d63d08b84b83e50a94a9e2ab79427924d5b5df582cc72", "bytes": 899 }, "page.html": { "sha256": "3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555", "bytes": 99388 }, "provenance.json": { "sha256": "b1c9672106ace3646ee3912d7e4e87d94dc91cc5b60b9acc1066295675ce5014", "bytes": 948 }, "rendered.html": { "sha256": "a8cbeb0c17b3646681217db64cce0e0beb6dc71765bd1bad550f8e20170ef7d0", "bytes": 238404 }, "screenshot.png": { "sha256": "4727eaed5a4a5a90eb95aed5c3c0093702f427e1aae4bc63ed9ccfea2ca92da4", "bytes": 3983360 }, "text.txt": { "sha256": "df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e", "bytes": 35947 } }, "started_utc": "2026-10-22T08:09:01.544Z", "status": 200, "final_url": "https://www.php.net/archive/2026.php#2026-10-21-5" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "Official php.net advisory (archive anchor 2026-10-21-5) plus the 8.2.35/8.3.36/8.4.27/8.5.12 release posts and the 20 Oct pre-announcement on the same page. Feed timestamps (00:05-00:35Z on 21 Oct; 20:32Z on 20 Oct) do not match the Foundation's stated times (release 14:00Z, pre-announcement 19:30Z). raw/ holds feed.atom and a curl copy.", "raw_sha256": { "archive-2026.curl.html": "3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555", "feed.atom": "79c12996a433f66b2e2422e32d1dd5d4251c7c24531f75c3a0611f58dc1894a8" }, "has_notes": true, "notes_md": "# php.net security advisory: notes\n\n- URL: https://www.php.net/archive/2026.php#2026-10-21-5 (news archive; the same page holds the four release posts and the 20 Oct pre-announcement)\n- Captured 2026-10-22T08:09Z (capture.mjs); raw/feed.atom and raw/archive-2026.curl.html fetched with curl ~08:07-08:12Z.\n- Publisher: the PHP Group / php.net. Date on the page: \"21 Oct 2026\".\n\n## Key wording (verbatim)\n- \"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.\"\n- \"Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.\"\n- \"RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)\"\n- \"RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)\"\n- \"PHP 8.1 and older no longer receive updates from the PHP project.\" Minimal source backports were published as branches PHP-7.4/8.0/8.1-CVE-2026-109618-109619 on php/php-src.\n- remirepo: \"The repo will not have updates today.\"\n- Mitigations: memory_limit=-1, low post_max_size (8M / 32M), session.upload_progress.enabled=0, on 8.5 fatal_error_backtraces=0. \"only an update is a complete solution\".\n- Pre-announcement (anchor 2026-10-20-1, \"Upcoming Critical PHP Security Release\"): \"It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.\" \"It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.\"\n\n## Oddities\n- Atom feed timestamps: advisory 2026-10-21T00:35:26+00:00; 8.2.35 00:05:37; 8.3.36 00:14:54; 8.4.27 00:20:54; 8.5.12 00:24:52; pre-announcement 2026-10-20T20:32:00+00:00. The Foundation blog says the pre-announcement went out at 19:30 UTC and the release at 14:00 UTC on 21 Oct, and GHSAs show 13:34Z. The php.net timestamps are the entry-creation times written by the authoring script, not verified publish times; do not use them as publication times without checking the php/web-php commit history.\n- php.net's own date is 21 Oct; the BBC frames disclosure as 22 Oct (UK morning coverage). The original target date was 22 Oct 14:00 UTC (per Foundation blog).\n" }, { "slug": "php-net-changelog-8", "url": "https://www.php.net/ChangeLog-8.php", "publisher": "PHP Group (php.net)", "kind": "advisory", "title": "PHP 8 ChangeLog", "published": null, "captures": [ { "stamp": "20261022T081558Z", "files": { "headers.json": { "sha256": "7e0f775cb09c408472e389bec122b0fc703a450df430b26aca98e4539caf6f4f", "bytes": 892 }, "page.html": { "sha256": "8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68", "bytes": 752126 }, "provenance.json": { "sha256": "08d9493b6d1480061ad20e23c5ea875c121bb9741f79ccf69dd923284133f1c9", "bytes": 919 }, "rendered.html": { "sha256": "03ecb3465829e89ba578ae7bc7f36881fbbd37d9bc77ae5bb3c74bdd15e2d36a", "bytes": 751162 }, "screenshot.png": { "sha256": "0954e33d2a52ac1470b5c204eaaeea8d8fe811854486542ece88541cf7dbc526", "bytes": 15023593 }, "text.txt": { "sha256": "e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70", "bytes": 417190 } }, "started_utc": "2026-10-22T08:15:58.596Z", "status": 200, "final_url": "https://www.php.net/ChangeLog-8.php" } ], "status": "captured", "primary": true, "added_by": "collector-primary", "notes": "8.5.12, 8.4.27, 8.3.36, 8.2.35 entries dated '22 Oct 2026' (the original target date), although they were released 21 Oct. Core entry: 'Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).' 8.5.12 and 8.4.27 also carry unrelated bug fixes.", "raw_sha256": { "ChangeLog-8.curl.html": "8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68" }, "has_notes": true, "notes_md": "# php.net PHP 8 ChangeLog: notes\n- Captured 08:15Z (and curl copy in raw/).\n- Each of \"Version 8.5.12\", \"Version 8.4.27\", \"Version 8.3.36\" and \"Version 8.2.35\" is dated \"22 Oct 2026\". The release actually shipped on 21 Oct (php.net news, GitHub release at 14:06Z). The ChangeLog keeps the originally planned date, and nobody has corrected it.\n- Security line (verbatim, identical in all four): \"Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).\" CVE IDs are not printed on these lines, unlike earlier entries (e.g. 8.3.35 lists CVE-2026-91768).\n- 8.3.36 and 8.2.35 contain only the security fix. 8.5.12 and 8.4.27 bundle normal bug fixes (GH-23644, GH-21999, GH-23980, a dl() use-after-free, etc.).\n- The fix is \"bailout\": PHP's zend_bailout (longjmp) mechanism, consistent with the GHSA's description of removing longjmp() for OOM.\n" }, { "slug": "php2shell-com", "url": "https://www.php2shell.com/", "publisher": "OpenAI / Wiz / Calif joint microsite (php2shell.com)", "kind": "researcher", "title": "PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web", "published": null, "captures": [ { "stamp": "20261022T111831Z", "files": { "headers.json": { "sha256": "95d2d3cfe2f388045327d30e2dd08bb49dd3e8dd426ae09aa80e1261f01cd7ed", "bytes": 1509 }, "page.html": { "sha256": "8c12d8880e5b0e798d3e4457997397a1c0de6b36ab774a8fe46518f3270532a0", "bytes": 284683 }, "provenance.json": { "sha256": "020c3cad8f308d11c8454cbf625b7310e0958428a69ade312c2cd43d349c2897", "bytes": 952 }, "rendered.html": { "sha256": "e5958b710931a3753baaa7475dea5c3be9f08677412269976d9e50100e3f9022", "bytes": 506683 }, "screenshot.png": { "sha256": "77a8c0a27f91ee02eab5575847f4611e6605f030f286c20c51eb4de3cf0f496a", "bytes": 2152724 }, "text.txt": { "sha256": "b1e83b4f0feb87d5abb59bfb76015b154a7b678a51c0e965e06929f1e6b17f48", "bytes": 9251 } }, "started_utc": "2026-10-22T11:18:31.290Z", "status": 200, "final_url": "https://www.php2shell.com/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web\n\nCaptured by claude-story-site. Status: captured. The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure.\n\n- Credits: Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld, Tomer Schwartz); OpenAI Codex Security (Amy Burnett); Calif (Ryan A.). Linked from patchtheplanet.org.\n- 'PHP powers approximately 70% of websites'; 'a simple Hello World application running on an affected PHP version' is affected.\n- 'PHP-FPM RCE was confirmed through application-level code paths.' 'Upgrading PHP is the only complete remediation.'\n- No date on the page.\n" }, { "slug": "phparch-php-security-2025-audit", "url": "https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/", "publisher": "php[architect]", "kind": "news", "title": "PHP Security in 2025: Lessons from the Core Security Audit | PHP Architect", "published": "2025-09", "captures": [ { "stamp": "20261022T112947Z", "files": { "headers.json": { "sha256": "f94a2cb9fd6c974ab16b7f672856596b84da0ee50036c93a902f055a2efebb3f", "bytes": 1063 }, "page.html": { "sha256": "85b9dacfb542ca35651d775dfe24c41186dfdca2ae5abc86bafcdd1e19b79195", "bytes": 94581 }, "provenance.json": { "sha256": "4783394753855b623aa99c5c3077af3a72dc1b6dbd18ba5e2e181737ffcbc90b", "bytes": 1095 }, "rendered.html": { "sha256": "8f4192ecc48d4d4fb38e2492bac830525bfcab04ff70a72849ad8ccc35e38358", "bytes": 94279 }, "screenshot.png": { "sha256": "51293897aa9bc0b5b07dbb244193f6b3da545420a92eb912de4664a8e0ebe245", "bytes": 2293707 }, "text.txt": { "sha256": "95189f8e2e198e19e39271f1750db73ca525f593abbe9ec363969f3eae4499ec", "bytes": 28517 } }, "started_utc": "2026-10-22T11:29:47.363Z", "status": 200, "final_url": "https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Background on the 2024 core security audit.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Security in 2025: Lessons from the Core Security Audit | PHP Architect\n\nCaptured by claude-story-site. Status: captured. Background on the 2024 core security audit.\n\n- Captured for the record.\n" }, { "slug": "phpfoundation-blog-security-release-leak", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "publisher": "The PHP Foundation", "kind": "advisory", "title": "Today's PHP Security Release, and How We're Strengthening PHP Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081244Z", "files": { "headers.json": { "sha256": "3b9ca485b393afa38381b67bb251208dca58e32f815fd1aed95ba69e1d88dda3", "bytes": 856 }, "page.html": { "sha256": "6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223", "bytes": 40324 }, "provenance.json": { "sha256": "777ac74e8e4915a67c651d019c1cdcf9a099773e9963221b097b676fa5054bde", "bytes": 1222 }, "rendered.html": { "sha256": "074da5662f04df8f88a2efc163726c553f5bb43c8095278a089daa0faf364955", "bytes": 126414 }, "screenshot.png": { "sha256": "09956999247e6e42a5635bb2b1234a2f8a11f0c66c26b88fafc020c31f3b6cd6", "bytes": 2630327 }, "text.txt": { "sha256": "b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd", "bytes": 31883 } }, "started_utc": "2026-10-22T08:12:44.668Z", "status": 200, "final_url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Dated Oct 21, 2026. Primary account of the leak: CVE IDs circulating Oct 20 ~15:00 UTC; Calif 'mistakenly published a video' ~20:00 UTC; mitigation advice may have leaked; Chainguard broke embargo Oct 21 07:41 UTC. Captured text also contains reader comments below the post (lines ~90 onward) — those are third-party, unverified.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP Foundation blog, 21 Oct 2026: the leak and the discovery timeline (collector-researchers)\n\nCaptured for the researchers/leak beat; the advisory collectors may hold their own copy.\n\n## Discovery (verbatim)\n- 2024: \"While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found\".\n- \"The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th. More recently, Trail of Bits has also been auditing PHP.\"\n- Tools: \"Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos ... OpenAI's Daybreak Red for validating reports and exploits\".\n- Thanks \"OpenAI Codex Security, especially Amy Burnett\".\n\n## Leak (verbatim, section \"Leak and disrupted disclosure\")\n- \"The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date.\"\n- \"On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked.\" Pre-announcement moved to 19:30 UTC; release moved from Oct 22 14:00 UTC to Oct 21 14:00 UTC.\n- \"As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs\".\n- \"Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well.\"\n- \"did not identify any functional exploits at the time of release/public disclosure.\"\n- \"On October 21st at 07:41 UTC ... Chainguard unilaterally broke the embargo and published built images containing the fix.\"\n\n## Odd / follow up\n- Does not say WHO first leaked the CVE IDs, nor where. Daubois (same team) points to an anonymous Hacker News post.\n- Text capture includes reader comments under the post (third-party; e.g. a commenter claims \"sansec.io leaked one of the attack vectors ... in their page's metadata\"; another notes ELLIO's first in-the-wild hit 55 min after Chainguard). Unverified.\n" }, { "slug": "prophetsecurity-php2shell-detect", "url": "https://www.prophetsecurity.ai/blog/php2shell", "publisher": "Prophet Security", "kind": "vendor", "title": "php2shell: Detecting and Investigating CVE-2026-109618 and CVE-2026-109619 | Prophet Security", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112954Z", "files": { "headers.json": { "sha256": "3d69271680bbf150bc6fae70fc1287cd80311e2b43424bbf4f428714ecd955b7", "bytes": 1637 }, "page.html": { "sha256": "b00c997496adf4b1764b46125a9a74849e83e0baf12ba075d39cc6b0c4493bb0", "bytes": 178998 }, "provenance.json": { "sha256": "c58cd7be80e63d3760a0f31b5507e5a3f5678bcc269f1ef1e986c903224553af", "bytes": 1025 }, "rendered.html": { "sha256": "3ac8595af5225424d4be82b0b063abfb5254d537481410f86cb935ebdb46b2a5", "bytes": 797451 }, "screenshot.png": { "sha256": "8a43fab6765b4d462f55e613f1f5fec6d081c690d44afd1fc4af635f917078f4", "bytes": 1773221 }, "text.txt": { "sha256": "2e8efe1d3d72efc2c7357b939ba6e0a4ee639b3fb3cde21efaa44f5f60a00e51", "bytes": 15452 } }, "started_utc": "2026-10-22T11:29:54.934Z", "status": 200, "final_url": "https://www.prophetsecurity.ai/blog/php2shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor detection guidance.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell: Detecting and Investigating CVE-2026-109618 and CVE-2026-109619 | Prophet Security\n\nCaptured by claude-story-site. Status: captured. Vendor detection guidance.\n\n- Captured for the record.\n" }, { "slug": "qualys-blog-php-preannounce", "url": "https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities", "publisher": "Qualys", "kind": "vendor", "title": "403 Forbidden", "published": "2026-10-20", "captures": [ { "stamp": "20261022T113004Z", "files": { "headers.json": { "sha256": "9ae7ad7eb7ecad9ff1195f99f730cc79be3ed1abdbb907f73ad003c7d28c5651", "bytes": 628 }, "page.html": { "sha256": "dd1c2f122d665c4b3fb0be7b2e8e1eb717607b195475efd409f666dfbd979b60", "bytes": 1486 }, "provenance.json": { "sha256": "f3a38995a937d0edc65d7304bf5014e3d946eb475aa675593c5aa03aea58e148", "bytes": 1110 }, "rendered.html": { "sha256": "eddbe1ecca686ffa5ca8cfa12c3054e26ecd8eb8c21461faaa9951759d65f41d", "bytes": 1203 }, "screenshot.png": { "sha256": "88143431c2f2ccebbb073449167e29d4114759e3e211d651114b2d152afd2e9e", "bytes": 10431 }, "text.txt": { "sha256": "c6c1266b1b8854e014702a20b4d2b956f885b89fc66f21fad180d33a4c37467d", "bytes": 19 } }, "started_utc": "2026-10-22T11:30:04.759Z", "status": 403, "final_url": "https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "Published on 20 October on the pre-announcement.", "raw_sha256": {}, "has_notes": true, "notes_md": "# 403 Forbidden\n\nCaptured by claude-story-site. Status: blocked. Published on 20 October on the pre-announcement.\n\n- A dated pre-release artefact.\n" }, { "slug": "quarkslab-blog-php-src-audit", "url": "https://blog.quarkslab.com/security-audit-of-php-src.html", "publisher": "Quarkslab", "kind": "researcher", "title": "Security audit of PHP-SRC - Quarkslab's blog", "published": "2025-04-10", "captures": [ { "stamp": "20261022T113008Z", "files": { "headers.json": { "sha256": "9a1974a3d0e74f6c61049df444eec6f88c921c1df160c4d36547d455f5f69d3a", "bytes": 721 }, "page.html": { "sha256": "cfffdbab1e24dbeaafa236432ed6653fa2442387aeae475f996cddddb722bb89", "bytes": 28339 }, "provenance.json": { "sha256": "c1a3e69c282c4e578340fa0788f636f5604d1f0d0a6076bac4cd7bd024ee55ca", "bytes": 996 }, "rendered.html": { "sha256": "032ff57da663f85dcf219749a2b1849c606efef96c9044684130409249a05e18", "bytes": 27638 }, "screenshot.png": { "sha256": "84a81db5a451d763ffe7a40817ea3c94e0e0a7d7da3bd0b7c74b2b8b0c912974", "bytes": 932374 }, "text.txt": { "sha256": "cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321", "bytes": 7821 } }, "started_utc": "2026-10-22T11:30:08.092Z", "status": 200, "final_url": "https://blog.quarkslab.com/security-audit-of-php-src.html" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Quarkslab's own account of the 2024 php-src audit (OSTIF, Sovereign Tech Agency): findings, two redacted high-severity issues with fixes in progress.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Security audit of PHP-SRC - Quarkslab's blog\n\nCaptured by claude-story-site. Status: captured. Quarkslab's own account of the 2024 php-src audit (OSTIF, Sovereign Tech Agency): findings, two redacted high-severity issues with fixes in progress.\n\n- Primary for the 2024 audit. Does not describe an out-of-memory finding as such.\n" }, { "slug": "recordedfuture-php2shell", "url": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "publisher": "Recorded Future", "kind": "vendor", "title": "PHP2Shell Exploitation: Two Critical PHP Flaws Explained", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113014Z", "files": { "headers.json": { "sha256": "3f16adaf8c9cba92536851d7836d4e787039ea13bccb4da34e56759d45f7fbef", "bytes": 1234 }, "page.html": { "sha256": "cd54cc52e04832d03115211f9aca789fb9d4861a8460a25a4e6ccc45f2d11f9b", "bytes": 27860 }, "provenance.json": { "sha256": "d044ae83506d9d12bb11b3e2357405fd0be2350bf9782b8f21e5d0bc7134c316", "bytes": 1034 }, "rendered.html": { "sha256": "ca1457d1d590d21807ebf2cd64d30304ff3607b8171472c2d205a8fd4365a37c", "bytes": 178844 }, "screenshot.png": { "sha256": "cd745753c1ec28fcaf45c4b291d01045bdf86c88cbd0184e664e196bdd0f8ddc", "bytes": 2871582 }, "text.txt": { "sha256": "f9cb130d64545fe46a477766dce91126405f12d99e8051aff2c05e084a904fe9", "bytes": 18444 } }, "started_utc": "2026-10-22T11:30:14.282Z", "status": 200, "final_url": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Exploitation: Two Critical PHP Flaws Explained\n\nCaptured by claude-story-site. Status: captured. Vendor explainer.\n\n- Captured for the record.\n" }, { "slug": "reuters-factbox-websites-offline", "url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/", "publisher": "Reuters factbox, via Global Banking and Finance", "kind": "news", "title": "Global Websites Offline Amid PHP Security Flaws: Finance Sector Impact", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113026Z", "files": { "headers.json": { "sha256": "8756be9a476cea45bf6f0ba5d6afec78293d9a1c08b04c463ba887aa51643743", "bytes": 1259 }, "page.html": { "sha256": "8c4668f8881f07f4e9fcdaf5498ac560214aa9243a2e163122532b0a80b2d141", "bytes": 214076 }, "provenance.json": { "sha256": "93bc4bfda9e1316396b718afd5bf442ed65dbddf92c7700d9308c0d04c3c7806", "bytes": 1084 }, "rendered.html": { "sha256": "5732718cdad049baa24fe5d9d7c0e91fd962f71df61672c4e0b3d101b9a262c3", "bytes": 227694 }, "screenshot.png": { "sha256": "28b7c31e70d01ad1a8ca150a6127d7188c38f431b913c022f6aa6a997c47cc5c", "bytes": 3456506 }, "text.txt": { "sha256": "d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3", "bytes": 10148 } }, "started_utc": "2026-10-22T11:30:26.047Z", "status": 200, "final_url": "https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Reuters list of websites taken offline: Netherlands, France, Germany, Belgium, Finland and others.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Global Websites Offline Amid PHP Security Flaws: Finance Sector Impact\n\nCaptured by claude-story-site. Status: captured. Reuters list of websites taken offline: Netherlands, France, Germany, Belgium, Finland and others.\n\n- A syndicated copy; Reuters' own page not captured.\n" }, { "slug": "rijksoverheid-ncsc-php-news", "url": "https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php", "publisher": "Rijksoverheid (Dutch government) / NCSC-NL", "kind": "government", "title": "NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113033Z", "files": { "headers.json": { "sha256": "02c777fcd4897b76fb5febbe44f6827eac84175c43def883b4074889c879f1e6", "bytes": 2789 }, "page.html": { "sha256": "cd5e199ae854bb38177fa187f36f80b267ee93f5b23262122697c7038276e21e", "bytes": 240904 }, "provenance.json": { "sha256": "41eeb42a42ffe905a45ac1fe625d4acb5b9ba172ca4fd9253d01dc7295a7aa8b", "bytes": 1072 }, "rendered.html": { "sha256": "e364ac0a4f3336a54bc2581a182d37db39961f47802adca7c95247e9c0fd4613", "bytes": 244344 }, "screenshot.png": { "sha256": "0b023dc6a8fca71e18932ef0a168051841129928264b33c1937fff623cab4457", "bytes": 435918 }, "text.txt": { "sha256": "7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3", "bytes": 3720 } }, "started_utc": "2026-10-22T11:30:33.461Z", "status": 200, "final_url": "https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Primary: NCSC.NL taken offline 'uit voorzorg'; advises a risk assessment per internet-facing PHP system and considering switching systems off until fixed.", "raw_sha256": {}, "has_notes": true, "notes_md": "# NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl\n\nCaptured by claude-story-site. Status: captured. Primary: NCSC.NL taken offline 'uit voorzorg'; advises a risk assessment per internet-facing PHP system and considering switching systems off until fixed.\n\n- Verbatim (Dutch): 'uit voorzorg de website NCSC.NL tijdelijk offline gehaald'; 'een risicoafweging te maken per systeem'. Translation is this site's.\n" }, { "slug": "safeguard-how-hard-to-exploit", "url": "https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes", "publisher": "Safeguard (vendor blog)", "kind": "vendor", "title": "PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113039Z", "files": { "headers.json": { "sha256": "f024dda4aca45ee7784179ce10f5502c7cdc1848b68820c5e3ac4d5ae9977fe4", "bytes": 1910 }, "page.html": { "sha256": "ca8f171043e3a56f99149b1ffa731bfdd00faa1aca0dde315bab896ba544148f", "bytes": 419051 }, "provenance.json": { "sha256": "dc78d80894e1f67eb84e8f3dbcb4fce3d4687ae21172b11e13dab9e452491777", "bytes": 1094 }, "rendered.html": { "sha256": "d50d0675b422cf74595a98594b026b8936b4a597bfdd8e14bf6417f1fb65c089", "bytes": 425970 }, "screenshot.png": { "sha256": "81bc77d288b0f16b3a5aff9755c8f70d850d79e54d2f786960ea233e942d2e24", "bytes": 3150477 }, "text.txt": { "sha256": "271a233b1b8e628f66e764b3e3f089b09951d09ecdbb5fb9ef39d619eae623e9", "bytes": 37594 } }, "started_utc": "2026-10-22T11:30:39.560Z", "status": 200, "final_url": "https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog\n\nCaptured by claude-story-site. Status: captured. Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation.\n\n- Secondary; cites Kostas's test of the PoC and Gina Peter Banyard's Mastodon post (neither captured).\n" }, { "slug": "safeguard-waf-rules-limits", "url": "https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits", "publisher": "Safeguard (vendor blog)", "kind": "vendor", "title": "PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111928Z", "files": { "headers.json": { "sha256": "0c47d1b3b4483fe3dfbc1d2c92601e2da277c00bd9b13a0b4e1400d532b810f8", "bytes": 1911 }, "page.html": { "sha256": "7ee15349d487eb9f5fb2f578f4e465e1bdd8b44a4f7ecbfc4b2d6da5277b7dda", "bytes": 428039 }, "provenance.json": { "sha256": "a152958c004bbd289d33c79fc1eaf5b3b1aa6442001c31226607d2a25f3b67d4", "bytes": 1055 }, "rendered.html": { "sha256": "9cf1b889fa9c9bfb3bc5a219a58059a1fbb4ad867e796b6d89a2ca8960724e69", "bytes": 436335 }, "screenshot.png": { "sha256": "ec0109ce98dbf571daf5c08aeff60ae7e9957e2fc907b50f17bd9e196ef0c621", "bytes": 3153430 }, "text.txt": { "sha256": "664a398aae1f5c1df20e43deb46b962fd818b4403c864de8cab55f23c79c193c", "bytes": 36136 } }, "started_utc": "2026-10-22T11:19:28.763Z", "status": 200, "final_url": "https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog\n\nCaptured by claude-story-site. Status: captured. Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.\n\n- A vendor's round-up, not tested. Records Cloudflare's seven rules per ruleset plus a response-side rule, 03:02 UTC; Akamai 3000991; no AWS managed rule found.\n- 'A response rule cannot undo code that already ran.' 'The WAF only sees what passes through it.'\n- Note: the page's navigation lists model prices, including Anthropic models; irrelevant to the story.\n" }, { "slug": "sansec-research-php2shell", "url": "https://sansec.io/research/php2shell", "publisher": "Sansec", "kind": "researcher", "title": "PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansec", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113104Z", "files": { "headers.json": { "sha256": "2dfd5ab190184ed3ba6295db2882e7dce9719d6048f860a68a011034c1e1e26e", "bytes": 1167 }, "page.html": { "sha256": "60368be8e17445397b0865e1a7c8a7142cd888ffd81aac0b11d7d0644dbaab1d", "bytes": 36814 }, "provenance.json": { "sha256": "7443427160ac153a29c5b8c8c5278458e0b6c1eb5bc1bb1597d25757d01836bb", "bytes": 978 }, "rendered.html": { "sha256": "31f57c6c03a271c045e195256e2d406614c505ca3c3d07ce40c299983be0cc0a", "bytes": 37783 }, "screenshot.png": { "sha256": "21518bc8c146169d1d397668488e88840c646c1286340aa20808740f0538eed8", "bytes": 1506901 }, "text.txt": { "sha256": "281e3c508909a7002ae17602fd885f6acbd78e3766d8de3153f1139c7be8d134", "bytes": 9554 } }, "started_utc": "2026-10-22T11:31:04.850Z", "status": 200, "final_url": "https://sansec.io/research/php2shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor advisory predicting mass exploitation within 15 minutes of release; no IOCs; later accused in a reader comment of leaking a vector in page metadata (unverified).", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansec\n\nCaptured by claude-story-site. Status: captured. Vendor advisory predicting mass exploitation within 15 minutes of release; no IOCs; later accused in a reader comment of leaking a vector in page metadata (unverified).\n\n- Captured for the prediction and the record.\n" }, { "slug": "scotsman-edinburgh-council-offline", "url": "https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652", "publisher": "The Scotsman (Jack Davies)", "kind": "news", "title": "Edinburgh council website offline amid global cyber security alert", "published": "2026-10-21T18:09+01:00", "captures": [ { "stamp": "20261022T112150Z", "files": { "headers.json": { "sha256": "1c3f67fd980359a0bfbaa40d100d35aea3cac3074d6b29d0a1753b16584a605a", "bytes": 1536 }, "page.html": { "sha256": "90aaacae5232524ded421df348d5573c267ac8e950c4e48628bd8ed586c6aedd", "bytes": 262633 }, "provenance.json": { "sha256": "25e30a911da3a7887aafc5080201b7d8bc5dc8508f1d3a7a2545b1c4d5963ee7", "bytes": 1118 }, "rendered.html": { "sha256": "e02581dcf2ba49c3963ed48490b34c813b9558ff27991256fc0f50231be75ac2", "bytes": 712640 }, "screenshot.png": { "sha256": "bb1c80d6965bbdc9c3143e0ff88f84de54ca8c9af02419c854993868a6452a05", "bytes": 2399966 }, "text.txt": { "sha256": "fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6", "bytes": 8754 } }, "started_utc": "2026-10-22T11:21:50.230Z", "status": 200, "final_url": "https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Edinburgh council site offline late Wednesday afternoon; spokesperson: 'essential maintenance', 'waiting on an update from our provider'; link not confirmed.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Edinburgh council website offline amid global cyber security alert\n\nCaptured by claude-story-site. Status: captured. Edinburgh council site offline late Wednesday afternoon; spokesperson: 'essential maintenance', 'waiting on an update from our provider'; link not confirmed.\n\n- Published 21 Oct 2026 18:09 BST. The council 'yet to confirm whether it is linked to the cyber security alert'.\n" }, { "slug": "securityweek-exploitation-days-before", "url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "publisher": "SecurityWeek", "kind": "news", "title": "PHP2Shell Exploitation Started Days Before Patches - SecurityWeek", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112314Z", "files": { "headers.json": { "sha256": "20346ce7a28ae2cea09c5ce445b478a4fe9837f2cc4cf97d5ae15a6bcd846d48", "bytes": 1083 }, "page.html": { "sha256": "d00e2e5608d37d978b2fa983ffa1087430976a445caa72df9a49b7618dbe9566", "bytes": 168865 }, "provenance.json": { "sha256": "99114af56492dfd4921ca1b095bf85f256188ccd6d6e17fdaadd7657d629d83b", "bytes": 1072 }, "rendered.html": { "sha256": "e493b8fc733dacfc40164c4bb153884e96b82e984e2e3c738c13c536a5edce73", "bytes": 259915 }, "screenshot.png": { "sha256": "e5454077149da3ca0ea83a39c68e30ce9f6f984788c53349e104a0d45dea3fb9", "bytes": 2097665 }, "text.txt": { "sha256": "ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c", "bytes": 13376 } }, "started_utc": "2026-10-22T11:23:14.866Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Exploitation Started Days Before Patches - SecurityWeek\n\nCaptured by claude-story-site. Status: captured. Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.\n\n- The Censys and VirusTotal figures come through this page; Censys's own post was not found.\n" }, { "slug": "securityweek-first-attempts-sensors", "url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/", "publisher": "SecurityWeek", "kind": "news", "title": "PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112324Z", "files": { "headers.json": { "sha256": "dd993a8f1006a3a64fb1decac73db56de8468b6aa2d213379f7b8925a27f83af", "bytes": 1083 }, "page.html": { "sha256": "6d603d0aa60802788b1f163a27b575df0c62e1bb903bca9e6a3c98133e5d095c", "bytes": 169487 }, "provenance.json": { "sha256": "2dca30a4387489ca9868c223790494256dc26503ee6b709a46643fa881c589e8", "bytes": 1115 }, "rendered.html": { "sha256": "f5cdb5755f0b1ab2a897933da2b213a674ccfa76931ab1a19ef6627b79408b15", "bytes": 261102 }, "screenshot.png": { "sha256": "f5f51f0db7037127107f38fdaa5cbdc77c6df0328ef92619061ceb4a76bfb575", "bytes": 2236355 }, "text.txt": { "sha256": "b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41", "bytes": 13245 } }, "started_utc": "2026-10-22T11:23:24.252Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: patches land; first exploitation attempts hit sensors.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek\n\nCaptured by claude-story-site. Status: captured. Secondary: patches land; first exploitation attempts hit sensors.\n\n- Captured for the record.\n" }, { "slug": "securityweek-mass-exploitation-looms", "url": "https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/", "publisher": "SecurityWeek", "kind": "news", "title": "PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeek", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113111Z", "files": { "headers.json": { "sha256": "bb347753d4feee250192fd7b5bdc50a5bd970acacdb2bbc50ff7ec8f02e421f5", "bytes": 1083 }, "page.html": { "sha256": "cee26b75f5542752d57c034b8a0eccf6b6227242d7619e33a91a35e8d3af8ebb", "bytes": 162723 }, "provenance.json": { "sha256": "f31a296260b932686cb33c7c964e56367479a31e090172999a0b6a20bfac343c", "bytes": 1111 }, "rendered.html": { "sha256": "a85f0c144d03bd751e0f5f14784fdfcb65809370f94510720b7abc2d66c06403", "bytes": 254022 }, "screenshot.png": { "sha256": "65e2d5f0404ae070f6a43772ca24731d6e2b0a1125aac8132107060f194bc2d7", "bytes": 1822934 }, "text.txt": { "sha256": "693aa4300139d2afc431484c18fe038f9b0b2fb411a89b5defbdad622958e851", "bytes": 9475 } }, "started_utc": "2026-10-22T11:31:11.120Z", "status": 200, "final_url": "https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Pre-release: 'mass exploitation looms'; watchTowr and Huntress had not seen exploitation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeek\n\nCaptured by claude-story-site. Status: captured. Pre-release: 'mass exploitation looms'; watchTowr and Huntress had not seen exploitation.\n\n- Captured for the record.\n" }, { "slug": "sentinelone-php2shell", "url": "https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/", "publisher": "SentinelOne", "kind": "vendor", "title": "Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113120Z", "files": { "headers.json": { "sha256": "652bccd3c7747978e637a6cf3ca0dd3adcb9d8d6dff7f6ea1e7529206dfc78b6", "bytes": 6215 }, "page.html": { "sha256": "aaf6dfa7fac00ac3a9150b9baee326803df94377bbae974995178f465292bf84", "bytes": 343729 }, "provenance.json": { "sha256": "2a83e001a66dd0c777afe90a659023a49d81f93cd3c8310b6024faf644b74974", "bytes": 1146 }, "rendered.html": { "sha256": "d09c9b7551468ab7f7a69721a397eab5bb3d72b48ef9b756d0427a34c54bc0af", "bytes": 553092 }, "screenshot.png": { "sha256": "aeaf87bfa3d2dea7b44c00746ea38837ee3dbaf866640044a48d46125967360c", "bytes": 3003286 }, "text.txt": { "sha256": "0e75697fb5149ca627012455a8e06b03535c31e0c70e6ef87501d1beb7d39d69", "bytes": 24686 } }, "started_utc": "2026-10-22T11:31:20.524Z", "status": 200, "final_url": "https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/#cq=i1" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing).", "raw_sha256": {}, "has_notes": true, "notes_md": "# Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique\n\nCaptured by claude-story-site. Status: captured. Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing).\n\n- Captured for the record.\n" }, { "slug": "socket-blog-embargo-dispute", "url": "https://socket.dev/blog/php-embargo-dispute", "publisher": "Socket", "kind": "news", "title": "Just a moment...", "published": null, "captures": [ { "stamp": "20261022T112047Z", "files": { "headers.json": { "sha256": "a80f2b5ad8ae81c3b83a000871a7819d186da9f1d450b3717ea39deb9bcacc71", "bytes": 1990 }, "page.html": { "sha256": "b8ac97a2a385dc96494c44b3886248703441a11d350a683a472b690ffe293803", "bytes": 6187 }, "provenance.json": { "sha256": "8255345be61952af9d34d90c1a80520fcab5675c9c8ed3951c2aa93bdc5d64db", "bytes": 939 }, "rendered.html": { "sha256": "45f09ae7a4bb5f729e0b016d77de302dd1646fe819943e3054160f7bc5552cb1", "bytes": 28771 }, "screenshot.png": { "sha256": "38b458f2d97ad16e0fe1fa55afc35614ff1c9d6704c168964e2d9c3c625be655", "bytes": 38311 }, "text.txt": { "sha256": "2edb7b291225f9a58dd5ed7546e5c5ead9d84e0c92a9d78e93e06e030687646e", "bytes": 258 } }, "started_utc": "2026-10-22T11:20:47.891Z", "status": 403, "final_url": "https://socket.dev/blog/php-embargo-dispute" } ], "status": "blocked", "primary": false, "added_by": "claude-story-site", "notes": "BLOCKED: Cloudflare bot challenge.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Just a moment...\n\nCaptured by claude-story-site. Status: blocked. BLOCKED: Cloudflare bot challenge.\n\n- Cloudflare 'Performing security verification'. Not read. Search summary: Lorenc accepts the timeline, denies leaking, cites exploits in the wild.\n" }, { "slug": "substack-lopezkurtz-patch-is-the-exploit", "url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit", "publisher": "David Lopez-Kurtz (Substack)", "kind": "other", "title": "The Patch Is the Exploit - by David Lopez-Kurtz", "published": "2026-10", "captures": [ { "stamp": "20261022T113134Z", "files": { "headers.json": { "sha256": "93831a587e5a9a37a455a49bb5bc1a735ffddbaa9462baecf8483bd621dc0d80", "bytes": 3448 }, "page.html": { "sha256": "77bae2f3d20efe5af0c1bf780b1c2618202d3da7941792444a8fbfed1d4a87f5", "bytes": 224610 }, "provenance.json": { "sha256": "b49aa2b0f632867066da181f78cf57cd3495f0c1c9c7c7634875a04c5f86b5ff", "bytes": 1023 }, "rendered.html": { "sha256": "5a9958401f0de8caa87154eb38d082ae37fe969fe4928862d4e557f4bac4ba1e", "bytes": 263845 }, "screenshot.png": { "sha256": "4f94dc2329c6fd545b1a600cccfc7b2ce2db41deb2b8288403a9eec27e63dd56", "bytes": 3979940 }, "text.txt": { "sha256": "cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330", "bytes": 33564 } }, "started_utc": "2026-10-22T11:31:34.359Z", "status": 200, "final_url": "https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding.", "raw_sha256": {}, "has_notes": true, "notes_md": "# The Patch Is the Exploit - by David Lopez-Kurtz\n\nCaptured by claude-story-site. Status: captured. Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding.\n\n- Opinion piece; one specific checkable claim about the audit summary.\n" }, { "slug": "techzine-php-chainguard", "url": "https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/", "publisher": "Techzine Global", "kind": "news", "title": "PHP accuses Chainguard in PHP2shell", "published": null, "captures": [ { "stamp": "20261022T081301Z", "files": { "headers.json": { "sha256": "e4c1c978fae1d476008a0220bd56d79c287115d6dca754076ac5c220c8403209", "bytes": 1084 }, "page.html": { "sha256": "f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd", "bytes": 103 }, "provenance.json": { "sha256": "0b93d24048c39675ef0bec6c63cbadc201cd4c761b3fd85f96538ec7afa93ea9", "bytes": 1084 }, "rendered.html": { "sha256": "8631afb05e141985b74d3ac4fc67eca679d940e50dcd377593b0a5faf473e4a8", "bytes": 29118 }, "screenshot.png": { "sha256": "83e27bf325b865db2d303c7c20ec30a0a5c0b452145b2b48175a74d4b292d20f", "bytes": 38816 }, "text.txt": { "sha256": "a709538005b7efca9f1059e2eeaa4a13cd196d9f8215befc91b286d42f56d334", "bytes": 263 } }, "started_utc": "2026-10-22T08:13:01.646Z", "status": 403, "final_url": "https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1" }, { "stamp": "20261022T112124Z", "files": { "headers.json": { "sha256": "5345616d7653c07e708bb2b1f5f0b9fe2afefd06cca4a63dc7bb7fee0684222a", "bytes": 1080 }, "page.html": { "sha256": "f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd", "bytes": 103 }, "provenance.json": { "sha256": "8870e433407b07164f7f83ef420dd5307c6c1c525544cc382a43dd9da569c4ac", "bytes": 1084 }, "rendered.html": { "sha256": "f9d1600dea692ee1e52186d55f0ac9eee1a19f909c76aec8fa9b5ef26f1278bb", "bytes": 29118 }, "screenshot.png": { "sha256": "6127fef1895a985b7bcd7168fff19347a8ca8f67cfc409d39a802caebc1fce9c", "bytes": 38923 }, "text.txt": { "sha256": "93f61d068317f6ef84245b70a7d8b8ea0f4b1d351af10fc89a31cbe4ae7eb1da", "bytes": 263 } }, "started_utc": "2026-10-22T11:21:24.429Z", "status": 403, "final_url": "https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1" } ], "status": "blocked", "primary": false, "added_by": "collector-researchers", "notes": "Cloudflare challenge (HTTP 403) at 2026-10-22T08:13Z; 403 capture folder kept. Per search snippet: Chainguard CEO Dan Lorenc does not dispute timeline but denies leaking. Unverified until captured. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Techzine Global: \"PHP accuses Chainguard in PHP2shell\" — BLOCKED\n\n- Cloudflare challenge (403) at 2026-10-22T08:13Z. Snippet only (unverified): Chainguard CEO Dan Lorenc \"does not dispute the timeline but denies\" leaking; Chainguard says patched images were built overnight. Retry, and look for Lorenc's own posts on X/Bluesky.\n\n\n## Retry by claude-story-site, 22 Oct\n- Second attempt, same challenge page. The Register carries Lorenc's statements instead.\n\n\n## Retry by claude-story-site, 22 Oct\n- Second attempt, same challenge page. The Register carries Lorenc's statements instead.\n\n\n## Retry by claude-story-site, 22 Oct\n- Second attempt, same challenge page. The Register carries Lorenc's statements instead.\n" }, { "slug": "tenable-php2shell-faq", "url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "publisher": "Tenable", "kind": "vendor", "title": "php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®", "published": "2026-10-21", "captures": [ { "stamp": "20261022T112331Z", "files": { "headers.json": { "sha256": "5ddfb8ebd67d5b056190eb932bd7230be55b6dcec36b71da7591e9ff3ef787e9", "bytes": 1390 }, "page.html": { "sha256": "0f90e53e8a45f385d5e14f7493f1aa99aff8d34b7405ed43d70a3534381dd264", "bytes": 274325 }, "provenance.json": { "sha256": "f1f23ada9af900931c49744b7cb544a8b730ec5038bd6637c3a3b521f095c4d6", "bytes": 1155 }, "rendered.html": { "sha256": "bbc941dd99bd25fbb24457889bb89c0cd2213187cc104c491b15a86ad1167425", "bytes": 469247 }, "screenshot.png": { "sha256": "fb42572ffc60b269206740e6d85216b9fa06d7226bfb49682d148b44740c897c", "bytes": 2222099 }, "text.txt": { "sha256": "10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54", "bytes": 16528 } }, "started_utc": "2026-10-22T11:23:31.380Z", "status": 200, "final_url": "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Vendor FAQ; notes Cloudflare's rules cover only traffic routed through Cloudflare.", "raw_sha256": {}, "has_notes": true, "notes_md": "# php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®\n\nCaptured by claude-story-site. Status: captured. Vendor FAQ; notes Cloudflare's rules cover only traffic routed through Cloudflare.\n\n- Captured for the record.\n" }, { "slug": "thehackernews-php2shell-4days", "url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html", "publisher": "The Hacker News (Ravie Lakshmanan)", "kind": "news", "title": "Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed", "published": "2026-10-22", "captures": [ { "stamp": "20261022T081320Z", "files": { "headers.json": { "sha256": "54c094189f50f4afa3962d0e484ef93cf0f92bd1fefb71ae2fec7e63b71b3b14", "bytes": 783 }, "page.html": { "sha256": "b2b51b3736eab8ebf9fb584770654a563ec0cde9a258c8ccc9b2cac5e2759495", "bytes": 181180 }, "provenance.json": { "sha256": "ef03914e372ab683b87cf258b84ec703ba5cc140e8b724fe1fa547d0f7a066fe", "bytes": 1081 }, "rendered.html": { "sha256": "a7caeb00fddc406d6dcfeb68c7fdce453fdb39446eb83daa364cb3f2986a7834", "bytes": 176478 }, "screenshot.png": { "sha256": "71b28408de124895b1534822f79eff33a445be5296c09203d51f152ef67d089c", "bytes": 2255956 }, "text.txt": { "sha256": "c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4", "bytes": 12295 } }, "started_utc": "2026-10-22T08:13:20.228Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html" } ], "status": "captured", "primary": false, "added_by": "collector-researchers", "notes": "Dated Oct 22, 2026. Quotes Amazon CISO CJ Moses ('post shared with The Hacker News'): MadPot honeypot exploit attempt Oct 17 2026 from anonymization network IP geolocated to Australia; PoC attempts from ~02:00 UTC Oct 21. Says 'details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time' — contrast PHP Foundation 'No technical details leaked'. VulnCheck: PHP on 2,608,039 internet-facing hosts.", "raw_sha256": {}, "has_notes": true, "notes_md": "# The Hacker News: Amazon saw a PHP2Shell exploit attempt 4 days before disclosure\n\n- Ravie Lakshmanan, Oct 22, 2026. Captured 08:13:20Z.\n- CJ Moses (CISO, Amazon Integrated Security), \"in a post shared with The Hacker News\": \"The exploit attempt originated from an IP address associated with a commercial anonymization network ... While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.\" Date Oct 17, 2026, MadPot; IP geolocated to Australia (IOC omitted here).\n- Amazon: PoC attempts from ~02:00 UTC Oct 21, then six hours of attempts from anonymised infrastructure; \"multiple threat actors\".\n- ELLIO: first sensor hit Oct 21 08:36 UTC.\n- Leak wording differs: THN says \"details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time\"; PHP Foundation said \"No technical details leaked\" (with the CVE IDs), the video came later.\n- Size: VulnCheck counts PHP on 2,608,039 internet-facing hosts — a far smaller, host-based number than \"70% of websites\" or \"30 million websites\".\n- Primary AWS post not yet found (THN does not link one). The AWS Security Blog post is still to be located.\n" }, { "slug": "thehackernews-php2shell-unpatched-alert", "url": "https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html", "publisher": "The Hacker News", "kind": "news", "title": "PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert", "published": "2026-10-20", "captures": [ { "stamp": "20261022T113144Z", "files": { "headers.json": { "sha256": "504e60a31ad0c0649db5fe4d0560bcb64bcea39e2c5d8b374dd60c86235937fb", "bytes": 783 }, "page.html": { "sha256": "b8297488c796fba8c0c46fbb558121433294b8f8991c457777efa33409b6634e", "bytes": 175875 }, "provenance.json": { "sha256": "3eccd35b7d04ded29ea8937c2d7870a8be4adac2340d632f92f01cfe630c3147", "bytes": 1090 }, "rendered.html": { "sha256": "e34515d9ce5113ec57194450be97a765341affcc8cae816dd5a475c8d200873c", "bytes": 171094 }, "screenshot.png": { "sha256": "1686d34457b358c5f9a1950a0da921ac4d765a0491953e9383a70b1498568c29", "bytes": 2281720 }, "text.txt": { "sha256": "33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b", "bytes": 10078 } }, "started_utc": "2026-10-22T11:31:44.588Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Pre-release coverage of the two unpatched flaws.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert\n\nCaptured by claude-story-site. Status: captured. Pre-release coverage of the two unpatched flaws.\n\n- Captured for the record of pre-release framing.\n" }, { "slug": "thehackernews-what-protects-you", "url": "https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html", "publisher": "The Hacker News", "kind": "news", "title": "PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113151Z", "files": { "headers.json": { "sha256": "1d0e37d8f272c2035915a1e3bae5d055fd9d8a9dac4b60116725e2af378e7d7a", "bytes": 783 }, "page.html": { "sha256": "c3d4ade9c8b6af04990a2ee26114a8665f943ed5142ae7348e38ef3b23d34ab9", "bytes": 180675 }, "provenance.json": { "sha256": "b3b2d8123bee4172bcdb4453abeb515d86f34dd658088159147c1b0b944661d2", "bytes": 1081 }, "rendered.html": { "sha256": "64ef5d20df0ea8dfc700220c350757cc455bcfc017751142819841c35e11ff9c", "bytes": 179165 }, "screenshot.png": { "sha256": "e0e1a25547dc8d319ff4071cceff2950d36aa030ec7f2ab1625d04018d2e39cc", "bytes": 3022943 }, "text.txt": { "sha256": "2301d254784fd6612f36f844e16a706e2e7ca5f8d8f942f7f36544c59d78d82c", "bytes": 13774 } }, "started_utc": "2026-10-22T11:31:51.209Z", "status": 200, "final_url": "https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "What protects before the 14:00 UTC patch; no compromise confirmed; public exploit code not shown to work; not in KEV.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't\n\nCaptured by claude-story-site. Status: captured. What protects before the 14:00 UTC patch; no compromise confirmed; public exploit code not shown to work; not in KEV.\n\n- Captured for the pre-release state.\n" }, { "slug": "therecord-php-foundation-statement", "url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities", "publisher": "The Record (Recorded Future News)", "kind": "news", "title": "PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Record from Recorded Future News", "published": "2026-10-22", "captures": [ { "stamp": "20261022T113158Z", "files": { "headers.json": { "sha256": "2257c81e7400eff589569be8295f608e775b7e305c9af66d1e8d4a8f580c7229", "bytes": 914 }, "page.html": { "sha256": "8849918ee23ea9f6e709c68d21726ff22f31b4e88bf3fc8d6c2d67f55d338d81", "bytes": 92120 }, "provenance.json": { "sha256": "e26d3d9bab095c3530be9242fd010f71c6efd72f0f561f48cc26892f32df92cb", "bytes": 1122 }, "rendered.html": { "sha256": "387866a008c5068d55372962daa2904c6bee30821494b4c30a467aaa1c775383", "bytes": 96511 }, "screenshot.png": { "sha256": "31f0aeaac3e78e1ab3c579a6217361b9148b439f02245b029c43c19d4f7f759a", "bytes": 1498927 }, "text.txt": { "sha256": "28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e", "bytes": 7717 } }, "started_utc": "2026-10-22T11:31:58.430Z", "status": 200, "final_url": "https://therecord.media/php-foundation-statement-critical-vulnerabilities" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Secondary: the Foundation's account that AI review first sparked alarm in August but signs surfaced in 2024.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Record from Recorded Future News\n\nCaptured by claude-story-site. Status: captured. Secondary: the Foundation's account that AI review first sparked alarm in August but signs surfaced in 2024.\n\n- Captured for the record.\n" }, { "slug": "theregister-php-blames-chainguard", "url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611", "publisher": "The Register", "kind": "news", "title": "PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk", "published": "2026-10-22", "captures": [ { "stamp": "20261022T113204Z", "files": { "headers.json": { "sha256": "f037ca6b2e792623b19de3cc87220576a70faf147d1140a31fe0f0a22fa34d1e", "bytes": 610 }, "page.html": { "sha256": "f7f24a70afadc30edf03beb3e697086d5126ad7f5ddf2875c2e5c54bc07208a5", "bytes": 183584 }, "provenance.json": { "sha256": "28bb52465a44cfdc683cafd60ae043da8145a2e31fa1e280fa7ed7b81e417e32", "bytes": 1225 }, "rendered.html": { "sha256": "3729f08f3b948bc4af5a39a2b7351e38db6eeafbbcb982556755e5929dabb56d", "bytes": 197763 }, "screenshot.png": { "sha256": "d7c98b6141ded745143bbb5bc018fb02e07f795ab320a20434e063f150a3b875", "bytes": 1745666 }, "text.txt": { "sha256": "b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca", "bytes": 13215 } }, "started_utc": "2026-10-22T11:32:04.104Z", "status": 200, "final_url": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk\n\nCaptured by claude-story-site. Status: captured. Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.\n\n- Secondary but the fullest account of Chainguard's side. Lorenc did not name vendors or publish evidence.\n" }, { "slug": "tpo-nl-digid-offline", "url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/", "publisher": "TPO.nl", "kind": "news", "title": "PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113213Z", "files": { "headers.json": { "sha256": "3b4fb879e9421d7c88e3feb33a0521286d51f96fea6fe5ce5a04f9a54f055b3b", "bytes": 826 }, "page.html": { "sha256": "1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad", "bytes": 233569 }, "provenance.json": { "sha256": "e8a125363be8a52f4be95819b63112af3af8ea3317977ed509fbe2a52b0e31df", "bytes": 1020 }, "rendered.html": { "sha256": "d32cd4732dc20dda8b4464a52f471b942ec7756397f0ff01d40dd7344843c936", "bytes": 407728 }, "screenshot.png": { "sha256": "50d028e45666fd51dea41fe9359edc265ec4671d4ca742a6acc17eb2ef119a4d", "bytes": 1351320 }, "text.txt": { "sha256": "2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb", "bytes": 3796 } }, "started_utc": "2026-10-22T11:32:13.597Z", "status": 200, "final_url": "https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Dutch: DigiD, MijnOverheid and the Tweede Kamer offline.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL\n\nCaptured by claude-story-site. Status: captured. Dutch: DigiD, MijnOverheid and the Tweede Kamer offline.\n\n- Secondary Dutch coverage.\n" }, { "slug": "watchtowr-php2shell", "url": "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "publisher": "watchTowr", "kind": "researcher", "title": "watchtowr.com", "published": null, "captures": [ { "stamp": "20261022T111839Z", "files": { "headers.json": { "sha256": "ff01331edab1c463627b7d97ebbf6c6089f2893fb06dcf8f589c2d11416bf603", "bytes": 2911 }, "page.html": { "sha256": "cfe1d709b20d9c9c8d6383853add5bab85c168f532041e5f4733b5cce5fed8f3", "bytes": 456212 }, "provenance.json": { "sha256": "97a66648fa1ef3d782a7e0d1be25a472e3d4248521e20afc78bba0856d9006cb", "bytes": 1001 }, "rendered.html": { "sha256": "afa2a67a0dee2a2d057885312d74f1277ab47cc85f919220d2421a6d6044265d", "bytes": 183693 }, "screenshot.png": { "sha256": "cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee", "bytes": 21632 }, "text.txt": { "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "bytes": 106 } }, "started_utc": "2026-10-22T11:18:39.647Z", "status": 200, "final_url": "chrome-error://chromewebdata/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild.", "raw_sha256": {}, "has_notes": true, "notes_md": "# watchtowr.com\n\nCaptured by claude-story-site. Status: captured. BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild.\n\n- 403 'Access to watchtowr.com was denied'. Content known only second-hand. Retry from another egress.\n" }, { "slug": "watchtowr-php2shell-faq", "url": "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "publisher": "watchTowr", "kind": "researcher", "title": "watchtowr.com", "published": null, "captures": [ { "stamp": "20261022T111847Z", "files": { "headers.json": { "sha256": "0c655abac86df9e59b49a895ed0bc35a702af92b957d5db757df55be64fd9ff8", "bytes": 2908 }, "page.html": { "sha256": "9ad5ad45ab50498bff4fec7104988da089ca1e17cc8145805e57fe493e22893c", "bytes": 457843 }, "provenance.json": { "sha256": "779e5cb94040a7b1083dedc2aa737205276d134f02007caceae9ff3ab737420c", "bytes": 993 }, "rendered.html": { "sha256": "ed77bdfb70c799526cb11ef4c80486ab375a2bebf338de76275278dd5be92f25", "bytes": 183669 }, "screenshot.png": { "sha256": "cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee", "bytes": 21632 }, "text.txt": { "sha256": "1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab", "bytes": 106 } }, "started_utc": "2026-10-22T11:18:47.417Z", "status": 200, "final_url": "chrome-error://chromewebdata/" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "BLOCKED: HTTP 403.", "raw_sha256": {}, "has_notes": true, "notes_md": "# watchtowr.com\n\nCaptured by claude-story-site. Status: captured. BLOCKED: HTTP 403.\n\n- 403. Search summary: the FAQ ties exploitation to watchTowr's honeypot network and describes the flaws as disclosed ahead of an expected 22 October announcement.\n" }, { "slug": "weirdgloop-blog-php2shell", "url": "https://weirdgloop.org/blog/php2shell", "publisher": "Weird Gloop (cookmeplox)", "kind": "vendor", "title": "Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop", "published": "2026-10-21", "captures": [ { "stamp": "20261022T111827Z", "files": { "headers.json": { "sha256": "037e837186e2c7a0cba07dfd9d40f13048c890bbaadc11f106846fa944a5be77", "bytes": 1399 }, "page.html": { "sha256": "a3e0b5fe5b1aa03d078a69481cdf944185f03e1dc6c03dc0691a3e5efc114ea3", "bytes": 13477 }, "provenance.json": { "sha256": "fe3b34860b94853f39a64f8004b2d23fc9efb14b15b7b3ea51cfd4a71b44c2f9", "bytes": 966 }, "rendered.html": { "sha256": "d5e9b3b80f7c33d96ece63b4e16e9256bc7f05dc61993a9ed6673d64d898e28a", "bytes": 13486 }, "screenshot.png": { "sha256": "8014b0889ab8777b9c1ef8b2562da1fe3f4c2d0d858c2727dfe7d79acae1ceaa", "bytes": 369760 }, "text.txt": { "sha256": "6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962", "bytes": 4262 } }, "started_utc": "2026-10-22T11:18:27.255Z", "status": 200, "final_url": "https://weirdgloop.org/blog/php2shell" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Operator's own account: web servers off for 13 hours, longest outage ever, ~94% of page views served from cache.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop\n\nCaptured by claude-story-site. Status: captured. Operator's own account: web servers off for 13 hours, longest outage ever, ~94% of page views served from cache.\n\n- 'we turned off the webservers for all of the wikis hosted by Weird Gloop, until a patch was released 2 hours ago. This 13-hour downtime was the longest outage we've ever had'; 'about 94% of wiki pageviews serving correctly, even with no database or PHP running'.\n- Opinion: 'probably the most significant security vulnerability in the history of the internet'; expects old PHP forums to have been compromised (no case named).\n- About 500 million page views a month, 8 staff.\n" }, { "slug": "wikipedia-dan-kaminsky", "url": "https://en.wikipedia.org/wiki/Dan_Kaminsky", "publisher": "Wikipedia (English)", "kind": "other", "title": "Dan Kaminsky - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113323Z", "files": { "headers.json": { "sha256": "230fef32ef2b8e3a03fd564dddff422d11bc2aaa9c55bf790e489e49cd1728d0", "bytes": 6516 }, "page.html": { "sha256": "6c89a48790d2570768a3e30b6e6773d391a8726a2ea374490158e9788351b499", "bytes": 239532 }, "provenance.json": { "sha256": "912e913138aa6da2c78cb8a72b6f0f49ff311ecb7d55a3f3ebe018788dc415c7", "bytes": 940 }, "rendered.html": { "sha256": "6965408cf93703569203e0b1fa6278195218e7179ca2f79c981126987636c876", "bytes": 431088 }, "screenshot.png": { "sha256": "615f1446bfe1602439edb7b7273d7e7b74aeb78f40c45e5ef95312ecab6b44d8", "bytes": 2208990 }, "text.txt": { "sha256": "565033cfb92639ca1311f148e4c1fddbec463cd655a7b253b698b0d3bbee7d5b", "bytes": 19564 } }, "started_utc": "2026-10-22T11:33:23.838Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Dan_Kaminsky" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: Dan Kaminsky, for the 2008 DNS flaw.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Dan Kaminsky - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: Dan Kaminsky, for the 2008 DNS flaw.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-equifax-breach", "url": "https://en.wikipedia.org/wiki/2017_Equifax_data_breach", "publisher": "Wikipedia (English)", "kind": "other", "title": "2017 Equifax data breach - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113329Z", "files": { "headers.json": { "sha256": "c3bc169ae4d898eb6475902410fddd73fa4ed34ce0daddd19f5f6a5f46ce5742", "bytes": 6561 }, "page.html": { "sha256": "063ebe77541faf5b4a538fb6536569545115ba07e4ece30ec4b609b3f10e0715", "bytes": 357275 }, "provenance.json": { "sha256": "f1e5a749836d6e8fa78cb7d8298991d435408424506415523c68e32f854be7ea", "bytes": 978 }, "rendered.html": { "sha256": "fd59a52a810139932c34d91ab988792d0f289833507ce5edaa59b5f0c50a1403", "bytes": 561514 }, "screenshot.png": { "sha256": "87c5de1374b3c50ce76b221a56993bae2c23023f9774f9bce5dea3822cde37c9", "bytes": 3123746 }, "text.txt": { "sha256": "e38b857233007afea66a356c3b1b109917746f474776fef1897536936986af07", "bytes": 34565 } }, "started_utc": "2026-10-22T11:33:29.720Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/2017_Equifax_data_breach" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the 2017 Equifax breach (Struts CVE-2017-5638).", "raw_sha256": {}, "has_notes": true, "notes_md": "# 2017 Equifax data breach - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the 2017 Equifax breach (Struts CVE-2017-5638).\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-heartbleed", "url": "https://en.wikipedia.org/wiki/Heartbleed", "publisher": "Wikipedia (English)", "kind": "other", "title": "Heartbleed - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113241Z", "files": { "headers.json": { "sha256": "ebf98b097de4ce11194b4121b9de21f82d8c75e7117279bd2b10d469c923f907", "bytes": 6561 }, "page.html": { "sha256": "548f1ff2c768078511e876df9f95289590100729e454fe278693a08fc838717e", "bytes": 833943 }, "provenance.json": { "sha256": "6ce9e63913d1a8ac51b9519d592d2eb038f9cf41bd235baf4008e90594ca666b", "bytes": 932 }, "rendered.html": { "sha256": "7fa05158620c1d78de2df881c24a28d80da7f4244ada06ba16854d311e830cf5", "bytes": 1113858 }, "screenshot.png": { "sha256": "7affc5c7f2af7e59d01dddfa5ae745b2a322d785e9d0e23b518defaf08b9b12c", "bytes": 6147603 }, "text.txt": { "sha256": "335a02e5907d498b4ff7cd3bb3e63c86596c9590ec307cd2b82a13a8d0b9911d", "bytes": 66888 } }, "started_utc": "2026-10-22T11:32:41.345Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Heartbleed" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the Heartbleed article, for the context page.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Heartbleed - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the Heartbleed article, for the context page.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-log4shell", "url": "https://en.wikipedia.org/wiki/Log4Shell", "publisher": "Wikipedia (English)", "kind": "other", "title": "Log4Shell - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113317Z", "files": { "headers.json": { "sha256": "87abc43f478d756f7d6b4f160635cf45fb9be84375d34b71cc12d70e91c81117", "bytes": 6559 }, "page.html": { "sha256": "f21f5113f869aeb05d3c2467525fa6a946a0622c8295ec8ca5e52e2cdee958ad", "bytes": 350814 }, "provenance.json": { "sha256": "d08c417c0b7261fd57ff15f73a65ba91d48121268d596490e7f069b30b449a53", "bytes": 928 }, "rendered.html": { "sha256": "6b9cee027909f277350e142b3d325f5a0575732f0b5e2c76f8c35c9361c214e3", "bytes": 553202 }, "screenshot.png": { "sha256": "a64453cfa8cdf7caa73bdc64dbb02943ed99ea9130ce83fd5c6cdd1cebdb74d5", "bytes": 2405972 }, "text.txt": { "sha256": "cd08f6a7082ea6e3cc172d7738243c4eda26331c8af2aded091e27dca5066058", "bytes": 25890 } }, "started_utc": "2026-10-22T11:33:17.588Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Log4Shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the Log4Shell article.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Log4Shell - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the Log4Shell article.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-moveit-breach", "url": "https://en.wikipedia.org/wiki/2023_MOVEit_data_breach", "publisher": "Wikipedia (English)", "kind": "other", "title": "2023 MOVEit data breach - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113336Z", "files": { "headers.json": { "sha256": "5c9771f190e153438296ebd93a2e83ed2e272b0edabfdc8e90270b0e8cc36a0a", "bytes": 6516 }, "page.html": { "sha256": "586dcd3eba4df977cd0483dd2543c14bb75c8097933ea13131fa4b0913ac6847", "bytes": 163389 }, "provenance.json": { "sha256": "9ac856ea4fd003d7c9d3e5784e6ab684a8bc8ccd3c807e4cf1174b414aee3936", "bytes": 974 }, "rendered.html": { "sha256": "bcc9ee65deff5809f27130574759019489d461e3374937d785fd991252a55488", "bytes": 339581 }, "screenshot.png": { "sha256": "3348e9116d0ce06e40962d5c5f4bb2592f0ff8d1b01baab3d3911f1710f8f8f5", "bytes": 1089154 }, "text.txt": { "sha256": "ad5c2515a778a3582e85c270cfbb1178c90a7477c3f38eaf804fa10528942be1", "bytes": 11123 } }, "started_utc": "2026-10-22T11:33:36.760Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/2023_MOVEit_data_breach" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the 2023 MOVEit breach.", "raw_sha256": {}, "has_notes": true, "notes_md": "# 2023 MOVEit data breach - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the 2023 MOVEit breach.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-php2shell", "url": "https://en.wikipedia.org/wiki/PHP2Shell", "publisher": "Wikipedia (English)", "kind": "other", "title": "PHP2Shell - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T112309Z", "files": { "headers.json": { "sha256": "df684951111f873760fab5d20078208e1e989557f1150d9aeaa7966ee6c8ca75", "bytes": 6560 }, "page.html": { "sha256": "f306b23e38d55d74fa6405a49e04b8dd420d7f5795c1b999f7d2303feed2a904", "bytes": 223796 }, "provenance.json": { "sha256": "16395d927a990f7bb2679d0861242bf3705586641c4f2e7bc9b839580b0eaf64", "bytes": 928 }, "rendered.html": { "sha256": "f51281e6ee013358343fd07568c8ef63acc38f4340841c824d6c3941004b14e3", "bytes": 408195 }, "screenshot.png": { "sha256": "ae58953f05c3bd41c5e57931462c15c8213fb7843a0c45d0b9b045b00f4ce8c5", "bytes": 1586902 }, "text.txt": { "sha256": "bbb51bbd069506b09282b45086984565ae875b5d974d121584c8e2b3c912222f", "bytes": 16230 } }, "started_utc": "2026-10-22T11:23:09.510Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/PHP2Shell" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the encyclopaedia article, captured as a record of the public account on 22 Oct; says publicly announced 20 Oct and patched the next day.", "raw_sha256": {}, "has_notes": true, "notes_md": "# PHP2Shell - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the encyclopaedia article, captured as a record of the public account on 22 Oct; says publicly announced 20 Oct and patched the next day.\n\n- Tertiary. Its outage list and timing are not used as evidence here, only as a record of what the public account said at capture time.\n" }, { "slug": "wikipedia-shellshock", "url": "https://en.wikipedia.org/wiki/Shellshock_(software_bug)", "publisher": "Wikipedia (English)", "kind": "other", "title": "Shellshock (software bug) - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113310Z", "files": { "headers.json": { "sha256": "f2a4b3ae6fb24202324c3478fe96ec7d871fbf062829bf047dea987ca29a646d", "bytes": 6559 }, "page.html": { "sha256": "800b60bd11e65365ea12c0db8526f932f55188ca76f3f6eaec4ff4833ba26fec", "bytes": 326860 }, "provenance.json": { "sha256": "0468fb94f26b99cb42b1033597a200e955bd047d1d544cf0aa1e63108588a950", "bytes": 977 }, "rendered.html": { "sha256": "2823f220d4e3aa6ce700cdff250ab35732495a32d273c0b6ab24dd2445aa2dc1", "bytes": 522813 }, "screenshot.png": { "sha256": "5f62672b0225c6d055a4a1d802c68a3acf695790ff6f20fee8baaf67f7b5f21a", "bytes": 2735619 }, "text.txt": { "sha256": "300be73066bba3f66a53bc1116a1a3c7bbe5e61695f1ce8a801c112237b61041", "bytes": 27686 } }, "started_utc": "2026-10-22T11:33:10.881Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Shellshock_(software_bug)" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: the Shellshock article.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Shellshock (software bug) - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: the Shellshock article.\n\n- Tertiary comparator record.\n" }, { "slug": "wikipedia-spring-framework", "url": "https://en.wikipedia.org/wiki/Spring_Framework", "publisher": "Wikipedia (English)", "kind": "other", "title": "Spring Framework - Wikipedia", "published": null, "captures": [ { "stamp": "20261022T113341Z", "files": { "headers.json": { "sha256": "93660dd4eb58188f8cdd099a1a9f09f42a33c872d13690748edc637974e623d7", "bytes": 6517 }, "page.html": { "sha256": "242f49c0d152a3caa2f0bf0cbfef5baa6f4dfcc62b890886a6f53576021af63d", "bytes": 622623 }, "provenance.json": { "sha256": "2a065f50a364fdd1cae0a5b064fe9e7fe715a6aabe14d7e11ca72727b5b61330", "bytes": 956 }, "rendered.html": { "sha256": "96223727d419aba6ee0c683f3d172a10324e28762e3f7dcb32d41519da2596a8", "bytes": 896578 }, "screenshot.png": { "sha256": "0601fe81d23975fda4d4036553b0ff37eb4fe8ea9928d9b697df2d4791acf6da", "bytes": 4931001 }, "text.txt": { "sha256": "710060585680e022348a35516ce4f13f4d99c2df75fe72a6ec01fe1a223081d1", "bytes": 49455 } }, "started_utc": "2026-10-22T11:33:41.449Z", "status": 200, "final_url": "https://en.wikipedia.org/wiki/Spring_Framework" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Tertiary: Spring Framework (Spring4Shell section).", "raw_sha256": {}, "has_notes": true, "notes_md": "# Spring Framework - Wikipedia\n\nCaptured by claude-story-site. Status: captured. Tertiary: Spring Framework (Spring4Shell section).\n\n- Tertiary comparator record.\n" }, { "slug": "wiz-blog-php2shell", "url": "https://www.wiz.io/blog/php2shell-php-rce", "publisher": "Wiz (Wiz Research)", "kind": "researcher", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", "published": "2026-10-21", "captures": [ { "stamp": "20261022T081047Z", "files": { "headers.json": { "sha256": "f3a7f515bda9ae91541c7792cad2fbb4d5864a7962be4f5db93bccbe8caa2d03", "bytes": 5075 }, "page.html": { "sha256": "32408c9f60071e7bdcf0e702160f6c398d6967cb89fbc81b5f0e0029e34af07b", "bytes": 438665 }, "provenance.json": { "sha256": "4e362d46ccd571e124b20fb3518c8d00076dc508a0146ee5338a7dce931d1fa1", "bytes": 1002 }, "rendered.html": { "sha256": "6db43e32910bdf4bc2b82a93afa5097900aa4a205b5cdde32d1a2510beff4c68", "bytes": 580534 }, "screenshot.png": { "sha256": "4ba83874c540e1f7faf4c817b6b8c3ae1ef61eacda5851a112d6601e47d6d91f", "bytes": 2753995 }, "text.txt": { "sha256": "e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea", "bytes": 19147 } }, "started_utc": "2026-10-22T08:10:47.953Z", "status": 200, "final_url": "https://www.wiz.io/blog/php2shell-php-rce" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Wiz Research post dated October 21, 2026. Source of '70% of the Internet' headline; body basis is 'powers 70% of all websites'. Disclosure timeline: discovered Aug 19, reported Aug 24, PHP ack Sep 21. Credits Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Wiz Research blog: \"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet\"\n\n- URL https://www.wiz.io/blog/php2shell-php-rce ; dated \"October 21, 2026\". Captured 2026-10-22T08:10:47Z, HTTP 200.\n- 70% basis: body says PHP \"powers 70% of all websites in the world\" — a share-of-websites figure (no source cited for it on the page) that the headline turns into \"70% of the Internet\". Conclusion: \"With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated.\"\n- Severity claim: \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\n- AI: \"We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability...\" Quote from Raluca Ada Popa, Head of Gemini Security, Google DeepMind. \"a single researcher completed in a week what previously would have taken a world-class team months of work.\"\n- Credits: \"Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification.\"\n- Partners named: \"Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and many others\".\n\n## Wiz's timeline (verbatim)\n- \"August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.\"\n- \"August 20, 2026: Unauthenticated RCE is confirmed against Drupal.\"\n- \"August 21, 2026: Unauthenticated RCE is confirmed against WordPress.\"\n- \"August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.\"\n- \"September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.\"\n- \"October 21, 2026: Patched PHP releases become available.\" / \"Public disclosure.\"\n\n## Notes\n- No mention of the leak, the Calif video or Chainguard.\n- \"September 21 ... begins developing a coordinated fix\" conflicts with the PHP Foundation's account that fixing was \"the top priority\" \"from August 11th onward\" (Daubois: fix PR opened 2026-09-25).\n- The BBC's \"most severe ever found by AI\" wording is not on this page as such; closest is \"arguably in software history\".\n" }, { "slug": "x-eastdakota-php2shell-stats", "url": "https://x.com/eastdakota/status/2113079352682570051", "publisher": "Matthew Prince (@eastdakota), Cloudflare CEO", "kind": "social", "title": "Matthew Prince 🌥 on X: \"Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X", "published": "2026-10-22T01:25Z", "captures": [ { "stamp": "20261022T111808Z", "files": { "headers.json": { "sha256": "d77dc66c0c59c96e2e54ddfecf08d3b1bd24635a9d74435e5e11a42df31beefb", "bytes": 9023 }, "page.html": { "sha256": "957516e4670ab0fa18a3dbfcc6a2a4fb7bf154370fd7b09506a876e6d327f357", "bytes": 143568 }, "provenance.json": { "sha256": "6ef963e6f636da1603f65de2817e02480ed92a2c4d5b330a151bc2d515c21277", "bytes": 1249 }, "rendered.html": { "sha256": "25a31a5f7554396a5640c88efcf0624e0eab811ea96a53cebc603eb9c55925ad", "bytes": 165274 }, "screenshot.png": { "sha256": "7a098d734f074f04d4c95973bd0f4463f3c18bd7aaf274912a6eea795095879c", "bytes": 216866 }, "text.txt": { "sha256": "4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3", "bytes": 1884 } }, "started_utc": "2026-10-22T11:18:08.749Z", "status": 200, "final_url": "https://x.com/eastdakota/status/2113079352682570051" } ], "status": "captured", "primary": true, "added_by": "claude-story-site", "notes": "Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Matthew Prince 🌥 on X: \"Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X\n\nCaptured by claude-story-site. Status: captured. Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture.\n\n- Displayed '1:25 · 22 Oct 2026' in a UTC browser. Verbatim: 'In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.'\n- Attempts, not blocks and not compromises. No blocked count.\n" }, { "slug": "x-feross-chainguard", "url": "https://x.com/feross/status/2113043398664015878", "publisher": "Feross Aboukhadijeh (@feross) on X", "kind": "social", "title": "Feross on X: \"Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X", "published": "2026-10-22", "captures": [ { "stamp": "20261022T112105Z", "files": { "headers.json": { "sha256": "c7243f6c403eb56e9b3d6e563eb8a8b216ea9dd8211fb1b22d4707fb94277f57", "bytes": 9023 }, "page.html": { "sha256": "a96f60627079ac4894ec940931bd0fd5f7aafe3bf8894230fb3292b941681412", "bytes": 192869 }, "provenance.json": { "sha256": "a7be68aef95eb2bd14be51e50215f101dd44d0e36eb5539a9393115df9ab4ce2", "bytes": 1233 }, "rendered.html": { "sha256": "61fc4e7f751c5a119c9a9a1081b8c47669ac9fe2d7dfd07833772658c39e8fdf", "bytes": 173209 }, "screenshot.png": { "sha256": "75299998b6abad9947b1d3f6d8ce0f477a1e8980c7f9484bdde10796bfc16bb1", "bytes": 560505 }, "text.txt": { "sha256": "de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6", "bytes": 5709 } }, "started_utc": "2026-10-22T11:21:05.468Z", "status": 200, "final_url": "https://x.com/feross/status/2113043398664015878" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Feross on X: \"Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X\n\nCaptured by claude-story-site. Status: captured. A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.\n\n- Restates the Foundation's account; opinion thread. Captured for the 69% phrasing and the date.\n" }, { "slug": "x-lcfr-hax-hash-tweet", "url": "https://x.com/lcfr_hax/status/2085031675382071483", "publisher": "Ryan Austin (@lcfr_hax), Calif", "kind": "social", "title": "LCFR on X: hash commitment d935be02…", "published": "2026-08-05T15:54Z", "captures": [ { "stamp": "20261022T081603Z", "files": { "headers.json": { "sha256": "ea81d1bf086428a65e67d0551ac1c3aebc53a1cd4c39b43d3ed837bbd8acee28", "bytes": 9022 }, "page.html": { "sha256": "11a7ec8817e3966590490fb928089c210339261afe54cc2f72353dca15f41391", "bytes": 132347 }, "provenance.json": { "sha256": "508544ce2c74aa23119fa27daa5a30b5ae63e47e7cd3e690fb9cf9a54ef7cded", "bytes": 1012 }, "rendered.html": { "sha256": "9a1b5b36d22e9689e136b35c76adc712c6977f4ec6f1bd41655bdb1caff65fac", "bytes": 160702 }, "screenshot.png": { "sha256": "9dfa4845de672eb2ec27885a9cff17fe9af803635a290c1cfc17f6ee5902d54e", "bytes": 262114 }, "text.txt": { "sha256": "2c10f3991caf3a74b21df9d9e0362fd1bab8aefc5113877a412dac999ca36372", "bytes": 1018 } }, "started_utc": "2026-10-22T08:16:03.064Z", "status": 200, "final_url": "https://x.com/lcfr_hax/status/2085031675382071483" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Hash-only tweet shown as '15:54 · 5 Aug 2026' (capture browser in UTC). Cited by Calif's timeline and by X Community Note on OpenAI's post as proof of prior discovery. Pre-image not published here.", "raw_sha256": {}, "has_notes": true, "notes_md": "# @lcfr_hax (Ryan Austin, Calif): hash tweet, 5 Aug 2026\n\n- Text is only a SHA-256-style hex string: \"d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac\". Displayed \"15:54 · 5 Aug 2026\"; 565.5K views at capture.\n- Calif's write-up: \"2026 — August 5 Calif researcher Ryan Austin (@lcfr_hax) tweeted hash of one finding.\" It is a priority commitment: it predates Wiz's stated discovery (Aug 19) and the PHP Foundation's record of first reports (Aug 11).\n- Pre-image not published (as far as seen). We cannot verify what the hash commits to. Open question: has Calif released the pre-image?\n- Replies (third-party): @trythreews: \"Let's set the record straight. @lcfr_hax was the first to discover php2shell and develop a working exploit. His work convinced the PHP Foundation to invest in fixing this entire bug class.\"\n- X's own snowflake ID 2085031675382071483 could be decoded to a timestamp for independent confirmation of the date (not done here).\n" }, { "slug": "x-openai-php2shell", "url": "https://x.com/OpenAI/status/2112907856018309586", "publisher": "OpenAI (@OpenAI)", "kind": "social", "title": "OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP", "published": "2026-10-21T14:04Z", "captures": [ { "stamp": "20261022T081645Z", "files": { "headers.json": { "sha256": "427b75f5bb12cb7b0acee221f2065095d92c82279e0db87f9b80909525886df3", "bytes": 9023 }, "page.html": { "sha256": "8e6a0183b6982e8530d7b48277e4b0f6f010b22d3348b30328cc4460cc371d90", "bytes": 160064 }, "provenance.json": { "sha256": "3e52aad242520de5ca4db4103baf86c58e7d477a8f7c04c19b841034f1ca49e3", "bytes": 1232 }, "rendered.html": { "sha256": "2e31eee6ab72f0703675cd74158267dbe5cfb55bf03b80153deaa1b899be4c10", "bytes": 147195 }, "screenshot.png": { "sha256": "aaf750d50e69e80b34fbdf908a9fdc330ac315b765eacb2e3e8361cb40f2cbb2", "bytes": 570247 }, "text.txt": { "sha256": "785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189", "bytes": 3316 } }, "started_utc": "2026-10-22T08:16:45.188Z", "status": 200, "final_url": "https://x.com/OpenAI/status/2112907856018309586" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Shown '14:04 · 21 Oct 2026', 5.2m views. Full text captured (stands in for the blocked openai.com post). Carries an X Community Note disputing OpenAI's discovery role and linking lcfr_hax.", "raw_sha256": {}, "has_notes": true, "notes_md": "# OpenAI on X, 21 Oct 2026 14:04 UTC\n\n- Full text (verbatim): \"OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. ... Due to the severity of these flaws and PHP's widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender's Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.\"\n- Links to openai.com/index/coordina… = \"Patch the Planet: global response coordination as agents uncover critical vulnerabilities\" (blocked; see openai-blog-coordinated-disclosure).\n- X COMMUNITY NOTE (as displayed): \"OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher. x.com/lcfr_hax/statu…\" (the note's \"several months\" is itself inaccurate: Aug 5 to Oct 21 is under 3 months).\n- Wording difference: BBC quotes \"one of the most impactful security issues in recent memory\"; the tweet says \"one of the most impactful vulnerabilities in recent memory\". The blog may use \"security issues\" — unverified (blocked).\n- \"ahead of attackers\" conflicts with Amazon's Oct 17 MadPot attempt (thehackernews-php2shell-4days) and Cloudflare's report of attack traffic after the leak.\n- Reply (third party): \"Patching the planet by prematurely leaking vuln details? Sure.\"\n" }, { "slug": "x-wiz-io-php2shell", "url": "https://x.com/wiz_io/status/2112899813264277528", "publisher": "Wiz (@wiz_io)", "kind": "social", "title": "Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet", "published": "2026-10-21T13:32Z", "captures": [ { "stamp": "20261022T081624Z", "files": { "headers.json": { "sha256": "f9a8ec8c80b7e7b13a6e772a718ece30ec0796dffd3481acc57a310616eca249", "bytes": 9022 }, "page.html": { "sha256": "6adc23abb012a9e89f22453d2d8d4f0eff574edc67373bc94eef59cfc12ebe85", "bytes": 183867 }, "provenance.json": { "sha256": "5df6949985ad1cf4a150d5b9a7e52f1355bac3b127484b31c70c8052986b1556", "bytes": 1086 }, "rendered.html": { "sha256": "9c5f87ac8afbe6aad1205a23ecbe79d83dc801c77f4d0ffb750ffb5b53625888", "bytes": 193354 }, "screenshot.png": { "sha256": "d2187dc09d49ec23ea5593aa7ffef5df60cd2385f290922ec6d77b6861fc7abb", "bytes": 578314 }, "text.txt": { "sha256": "6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809", "bytes": 2222 } }, "started_utc": "2026-10-22T08:16:24.485Z", "status": 200, "final_url": "https://x.com/wiz_io/status/2112899813264277528" } ], "status": "captured", "primary": true, "added_by": "collector-researchers", "notes": "Shown '13:32 · 21 Oct 2026' (UTC in capture browser) — 28 min before the 14:00 UTC release. Thread says 'Apply the Oct 22 security release immediately' — stale date from the original schedule.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Wiz on X: \"#PHP2SHELL ... impacting 70% of the Internet\"\n\n- Verbatim: \"🚨 BREAKING: @wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.\" Shown 13:32 · 21 Oct 2026 (UTC), i.e. before the 14:00 UTC release.\n- \"Wiz Research uncovers\" framing: no credit to Calif or OpenAI in the lead post (the blog thanks them).\n- Thread: \"All php versions >= 5.4 are affected by at least 1 of these vulnerabilities.\" \"Confirmed pre-auth RCE on representative targets: WordPress, Drupal, and Joomla\". \"Patch: Apply the Oct 22 security release immediately\" — wrong date (the release moved to Oct 21), so the thread was probably drafted before the leak moved the date.\n- 70% here is \"of the Internet\"; Wiz's blog body and Cloudflare/OpenAI say \"of websites\".\n" }, { "slug": "yle-finland-government-sites-shut", "url": "https://yle.fi/a/74-20252600", "publisher": "Yle (Finnish public broadcaster)", "kind": "news", "title": "Finland temporarily shuts down government websites as a precaution for critical vulnerabilities | Yle News | Yle", "published": "2026-10-21", "captures": [ { "stamp": "20261022T113225Z", "files": { "headers.json": { "sha256": "629207adb678c676219268f5339e1768a1aa4af6f503c8ab3dc33a9690a1dc94", "bytes": 4002 }, "page.html": { "sha256": "2845424a60768d77b6561e42e259b0675624771b8b77baa4741fbaf4cd0103c8", "bytes": 325894 }, "provenance.json": { "sha256": "e77236132533b194633ab7767e55f09e2854beb49c9ce44fc2725e3606534e78", "bytes": 1011 }, "rendered.html": { "sha256": "156e30b543681b560d3356d18ca5ff9531fa172e3e81f59ceae7ec8662120dd9", "bytes": 269020 }, "screenshot.png": { "sha256": "f6f90718b94a07351d302934a8a237c2e0360d1ac9ae51e79faf8a29afdaf46e", "bytes": 2031875 }, "text.txt": { "sha256": "720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57", "bytes": 6283 } }, "started_utc": "2026-10-22T11:32:25.530Z", "status": 200, "final_url": "https://yle.fi/a/74-20252600" } ], "status": "captured", "primary": false, "added_by": "claude-story-site", "notes": "Finland temporarily shuts government websites as a precaution; Valtori; NCSC-FI rated 9.2, no sign of exploitation.", "raw_sha256": {}, "has_notes": true, "notes_md": "# Finland temporarily shuts down government websites as a precaution for critical vulnerabilities | Yle News | Yle\n\nCaptured by claude-story-site. Status: captured. Finland temporarily shuts government websites as a precaution; Valtori; NCSC-FI rated 9.2, no sign of exploitation.\n\n- Precautionary, early afternoon local time.\n" } ]