# Source: CSIRTs Network - php2shell (CNW-2026-04)

ENISA / EU CSIRTs Network (CNW): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · advisory · primary · captured

# CSIRTs Network - php2shell (CNW-2026-04)

**ENISA / EU CSIRTs Network (CNW)** · [https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md](https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md) · published 2026-10-21 · added by `collector-gov` · slug `enisa-cnw-2026-04-php`

EU CSIRTs Network index of national advisories (date 21-October-2026). Lists ~30 national CSIRT alert links. The 'Mitigation' field still holds unfilled template text. The title has a typo: 'CVE-2026-10961'. curl got 403 from GitHub; Playwright got 200.

## What it says, as the collector read it

#### ENISA CSIRTs Network advisory CNW-2026-04 (php2shell)

- On GitHub, enisaeu/CNW, advisories/2026/CNW-2026-04_php.md. Latest commit 5763905 "Update CNW-2026-04_php.md" by Ruhofw. Date field: "21-October-2026".

- Captured 2026-10-22T08:13:29Z (curl got HTTP 403 from GitHub, but the Playwright capture worked).

- Oddities: the heading reads "CVE-2026-109618 en CVE-2026-10961" (a truncated CVE, and Dutch "en"). The Mitigation field is still template placeholder text ("Short description of confirmed mitigation ending with ..."). It is clearly a work in progress.

- Details text is quoted from advisories.ncsc.nl: "believed to be present in all current versions of PHP, and at the very least in all versions from 5 onwards."

- Its member alert list is the best index of national advisories: CERT-AT, CERT.bg, GovCERT.CZ (NUKIB), CFCS (DK), CERT-EE (RIA), CCN-CERT, INCIBE-CERT, CERT-EU, NCSC-FI, CERT-FR (CERTFR-2026-ALE-014), CERT.hr, CERT NCSC (HR), NCSC-HU, NCSC-IE (PDF), ACN/CSIRT Italia, CERT LT (NKSC), CIRCL TR-102, CERT-LV, NCSC-NL, CERT.PL, CNCS (PT), DNSC (RO), CERT-SE, SI-CERT, SK-CERT. The URLs are in the captured rendered.html.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

### Agency rows from this source
- [ENISA CSIRTs Network](../../agencies/index.html): offline none

## The bytes
capture 20261022T081329Z · HTTP 200 · https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md- `headers.json` 4fddd3b1827235c9608b8a4c92566f15c7fde3ea496d7a74061d64b18fdd4072 5,637 bytes
- `page.html` 212f41dffb19edf392212f2ec2997428225cc9da6dbbcf1361dffc30f3ac163f 252,581 bytes
- `provenance.json` ce33999aec2752cab53039232bb4a7da90a38f090b374d68f470a0f9c78f4c7a 1,052 bytes
- `rendered.html` 3d40c318822605660674e8a69d6a51d523c3df892b77cd2ccf520e51bb9ad552 295,999 bytes
- `screenshot.png` 0b9c0e94049921b40590086857c547bc0dea05461fad30201388de32c3f35c8e 451,547 bytes
- `text.txt` dfcaa1afe1c4194c00ff2dc38b4fab496a900ce9b4e770a722b4bae96b886093 3,930 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.8 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/enisa-cnw-2026-04-php/index.html