PHP2Shell : deux failles critiques PHP corrigées en urgence

PHP2Shell : deux failles critiques PHP corrigées en urgence

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page fr/news/coinacademy/actu-php-php2shell-frailles-critiques-urgence, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Coin Academy (French), 21 October, before the patches: two critical PHP flaws and an emergency fix expected that Wednesday. It says watchTowr's researchers state they are remote code execution flaws where an attacker could take control of a server without access, and that no exploitation had been reported at that stage.

> Les chercheurs de watchTowr affirment qu’il s’agit de failles d’exécution de code à distance (RCE)

_Curator's translation:_ "watchTowr's researchers say these are remote code execution (RCE) flaws"

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ CoinAcademy's pre-release explainer (21 Oct) covers the Hacker News leak, watchTowr's confirmation, unconfirmed version claims and the expected version numbers. It cites a Mallory/Shodan count of exposed servers running PHP 8.1 or older.

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell : deux failles critiques PHP corrigées en urgence". Selected mechanically, not read by a person.

Capture notes

Language fr. Nothing in the page addresses an AI or hides text from a reader.