# Fact: watchTowr confirmed in public that the bugs were real and posted both CVE number

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · leak · reported

# watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release

**Who says it:** Daubois; CERT-EU lists a watchTowr X post among public reports · **Sources:** [Daubois](../../sources/daubois-blog-php2shell-rumors/index.html) [CERT-EU](../../sources/certeu-sa-2026-018/index.html)

## Fact-check

**A4** Corroborated●●●●○○ · Event · verdict: **holds**

Daubois says watchTowr confirmed the bugs and posted both CVE numbers; CybelAngel (via The Repository) independently says watchTowr named both CVEs, and Huntress quotes the same watchTowr line. CERT-EU lists the watchTowr X post as a public report; its ID 2112611507749982605 decodes to 2026-10-20T18:26:48Z, before the 19:30 UTC pre-announcement and the release. The post itself is not captured and watchtowr.com returns 403.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [daubois-blog-php2shell-rumors](../../sources/daubois-blog-php2shell-rumors/index.html) | carries | *“we were all supposed to wait until Thursday at 11am ET”, confirmed in public that the bugs were real and posted both CVE numbers.* | 5ef17f9886aa93f7 |
| [certeu-sa-2026-018](../../sources/certeu-sa-2026-018/index.html) | partial | *[3] https://x.com/watchtowrcyber/status/2112611507749982605* | c65c95cf165d9ed7 |
| [cybelangel-php2shell](../../sources/cybelangel-php2shell/index.html) | carries | *watchTowr confirms the leaked vulnerabilities are real and names CVE-2026-109618 and CVE-2026-109619* | 4ffc5347bfe22fb4 |
| [huntress-php2shell-rapid-response](../../sources/huntress-php2shell-rapid-response/index.html) | partial | *Within a few hours, our good friends over at watchTowr confirmed the leak, writing that the vulnerabilities were real* | a83d744768109a61 |

Open tickets: [Finding-81](../../factcheck/index.html#Finding-81).

Graded in Run-1, resting on captures up to 2026-10-22 11:28 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Daubois publishes [What the PHP2Shell rumors got wrong, from inside the PHP security team](../../sources/daubois-blog-php2shell-rumors/index.html)
- 2026-10-21 15:20 UTCCERT-EU publishes [Security Advisory 2026-018: Critical Vulnerabilities in PHP](../../sources/certeu-sa-2026-018/index.html)
- 2026-10-22 08:12 UTCSaved into the evidence vault: Daubois
- 2026-10-22 08:13 UTCSaved into the evidence vault: CERT-EU
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisor
And on [every claim](../../claims/index.html#leak-watchtowr).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release
Who says it: Daubois; CERT-EU lists a watchTowr X post among public reports
Status: reported
Topic: leak
Sources: daubois-blog-php2shell-rumors, certeu-sa-2026-018
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/leak-watchtowr/index.html