# Source: PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

データ・マックス: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News

**データ・マックス** · [https://www.data-max.co.jp/article/87622](https://www.data-max.co.jp/article/87622) · published not stated in the capture · added by `curator@php.newsroom` · slug `data-max-article-87622`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). NetIB-News / Data Max (Japanese), part one of an explainer: what the serious PHP vulnerability PHP2Shell is, in terms anyone can follow, and what may...

## What it says, as the collector read it

#### PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/data-max/article-87622`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

NetIB-News / Data Max (Japanese), part one of an explainer: what the serious PHP vulnerability PHP2Shell is, in terms anyone can follow, and what may happen next. It says a serious vulnerability was found in PHP that could let an outsider run arbitrary code on a server without authentication, and that the two flaws, CVE-2026-109618 and CVE-2026-109619, combined are called PHP2Shell.

> 世界中のホームページやネットサービスを支えるプログラム言語「PHP」に、認証なしで外部からサーバー上で任意のコードを実行される恐れのある重大な脆弱性が見つかった。

_Curator's translation:_ "A serious vulnerability was found in the programming language PHP, which underpins homepages and net services around the world, that could allow arbitrary code to be run from outside on a server without authentication."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHPの重大な脆弱性「PHP2Shell」とは何か～誰でもわかる解説と、これから起こりうること（前）｜NetIB-News". Selected mechanically, not read by a person.

#### Capture notes

Language `ja`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261025T093507Z · HTTP 200 · https://www.data-max.co.jp/article/87622- `headers.json` 8df4fbe37278f6743b0a102d5dfc781000d076efb21b2edf5e767bc993ec6c86 481 bytes
- `page.html` a7530533f16fb33e58f71f79538ec1f2f401bb6fd421afbadfa0c062a9df3684 75,084 bytes
- `provenance.json` ebdbf9616e6023bd5a40fd808759096ff5dc0a107da6c87f4ddbfa3a80b294ff 1,612 bytes
- `rendered.html` 66c6bc747270cdab603672bfb6383b9dcef2b20273dd0e4a573b3a362408abf9 121,987 bytes
- `screenshot.jpg` e230aca7695d8112ecffdeb0c85686e6220f59bad8ed05b6067419a76c0a4dd2 869,515 bytes
- `text.txt` d7145bababb0f5db514157ec8cc247cac9399a81962ee78d639a643a2e177d72 15,510 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.0 · data as of 2026-10-25T09:35Z · vault commit 87795d121200 · https://php.oct.2026.newsroom.sgit.ai/sources/data-max-article-87622/index.html