Source · advisory · primary · captured

CSIRTs Network - php2shell (CNW-2026-04)

ENISA / EU CSIRTs Network (CNW) · https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md · published 2026-10-21 · added by collector-gov · slug enisa-cnw-2026-04-php

EU CSIRTs Network index of national advisories (date 21-October-2026). Lists ~30 national CSIRT alert links. The 'Mitigation' field still holds unfilled template text. The title has a typo: 'CVE-2026-10961'. curl got 403 from GitHub; Playwright got 200.

What it says, as the collector read it

ENISA CSIRTs Network advisory CNW-2026-04 (php2shell)

  • On GitHub, enisaeu/CNW, advisories/2026/CNW-2026-04_php.md. Latest commit 5763905 "Update CNW-2026-04_php.md" by Ruhofw. Date field: "21-October-2026".
  • Captured 2026-10-22T08:13:29Z (curl got HTTP 403 from GitHub, but the Playwright capture worked).
  • Oddities: the heading reads "CVE-2026-109618 en CVE-2026-10961" (a truncated CVE, and Dutch "en"). The Mitigation field is still template placeholder text ("Short description of confirmed mitigation ending with ..."). It is clearly a work in progress.
  • Details text is quoted from advisories.ncsc.nl: "believed to be present in all current versions of PHP, and at the very least in all versions from 5 onwards."
  • Its member alert list is the best index of national advisories: CERT-AT, CERT.bg, GovCERT.CZ (NUKIB), CFCS (DK), CERT-EE (RIA), CCN-CERT, INCIBE-CERT, CERT-EU, NCSC-FI, CERT-FR (CERTFR-2026-ALE-014), CERT.hr, CERT NCSC (HR), NCSC-HU, NCSC-IE (PDF), ACN/CSIRT Italia, CERT LT (NKSC), CIRCL TR-102, CERT-LV, NCSC-NL, CERT.PL, CNCS (PT), DNSC (RO), CERT-SE, SI-CERT, SK-CERT. The URLs are in the captured rendered.html.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

Agency rows from this source

The bytes

capture 20261022T081329Z · HTTP 200 · https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md
  • headers.json 4fddd3b1827235c9608b8a4c92566f15c7fde3ea496d7a74061d64b18fdd4072 5,637 bytes
  • page.html 212f41dffb19edf392212f2ec2997428225cc9da6dbbcf1361dffc30f3ac163f 252,581 bytes
  • provenance.json ce33999aec2752cab53039232bb4a7da90a38f090b374d68f470a0f9c78f4c7a 1,052 bytes
  • rendered.html 3d40c318822605660674e8a69d6a51d523c3df892b77cd2ccf520e51bb9ad552 295,999 bytes
  • screenshot.png 0b9c0e94049921b40590086857c547bc0dea05461fad30201388de32c3f35c8e 451,547 bytes
  • text.txt dfcaa1afe1c4194c00ff2dc38b4fab496a900ce9b4e770a722b4bae96b886093 3,930 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →