Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · leak · reported
watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release
Fact-check
A4 Corroborated●●●●○○ · Event · verdict: holds
Daubois says watchTowr confirmed the bugs and posted both CVE numbers; CybelAngel (via The Repository) independently says watchTowr named both CVEs, and Huntress quotes the same watchTowr line. CERT-EU lists the watchTowr X post as a public report; its ID 2112611507749982605 decodes to 2026-10-20T18:26:48Z, before the 19:30 UTC pre-announcement and the release. The post itself is not captured and watchtowr.com returns 403.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| daubois-blog-php2shell-rumors | carries | “we were all supposed to wait until Thursday at 11am ET”, confirmed in public that the bugs were real and posted both CVE numbers. | 5ef17f9886aa93f7 |
| certeu-sa-2026-018 | partial | [3] https://x.com/watchtowrcyber/status/2112611507749982605 | c65c95cf165d9ed7 |
| cybelangel-php2shell | carries | watchTowr confirms the leaked vulnerabilities are real and names CVE-2026-109618 and CVE-2026-109619 | 4ffc5347bfe22fb4 |
| huntress-php2shell-rapid-response | partial | Within a few hours, our good friends over at watchTowr confirmed the leak, writing that the vulnerabilities were real | a83d744768109a61 |
Open tickets: Finding-81.
Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Daubois publishes What the PHP2Shell rumors got wrong, from inside the PHP security team
- 2026-10-21 15:20 UTCCERT-EU publishes Security Advisory 2026-018: Critical Vulnerabilities in PHP
- 2026-10-22 08:12 UTCSaved into the evidence vault: Daubois
- 2026-10-22 08:13 UTCSaved into the evidence vault: CERT-EU
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release Who says it: Daubois; CERT-EU lists a watchTowr X post among public reports Status: reported Topic: leak Sources: daubois-blog-php2shell-rumors, certeu-sa-2026-018