Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor | Haber.com
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Haber.com (Turkish), 22 October: the Presidency's Cybersecurity Directorate says nationwide preventive measures against the PHP2Shell risks were put i...
What it says, as the collector read it
Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor | Haber.com
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page tr/news/haber/teknoloji-siber-guvenlik-baskanligi-ndan-php2shell-aciklamas, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Haber.com (Turkish), 22 October: the Presidency's Cybersecurity Directorate says nationwide preventive measures against the PHP2Shell risks were put into effect quickly, and announced that there was no security problem at e-Devlet Kapisi, the national e-government portal with more than 69 million users, and that its services continued uninterrupted.
> Uluslararası alanda “PHP2Shell” olarak adlandırılan risklere karşı ülke genelinde önleyici tedbirlerin hızla devreye sokulduğunu belirten Başkanlık, 69 milyondan fazla kullanıcısı bulunan e-Devlet Kapısı’nda herhangi bir güvenlik sorunu bulunmadığını ve hizmetlerin kesintisiz sürdüğünü duyurdu.
_Curator's translation:_ "The Directorate, noting that preventive measures against the risks called 'PHP2Shell' internationally were rapidly put into effect across the country, announced that there was no security problem at the e-Devlet Gateway, which has more than 69 million users, and that services continued uninterrupted."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Siber Güvenlik Başkanlığı’ndan 'PHP2Shell' Açıklaması: e-Devlet Kapısı Güvende, Hizmetler Kesintisiz Sürüyor | Haber.com". Selected mechanically, not read by a person.
Capture notes
Language tr-TR. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| As of 09:35 UTC on 25 October, no named organisation has said it was compromised through php2shell. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts. A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (10:35 BST) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. fact timeline → | this site, from every captured source in the evidence vault (418 sources, head 87795d121200), as of its latest capture at 09:35 UTC on 25 October | reported | A4 Corroborated●●●●○○ | 6/23 | CISA CISA Huntress Amazon SecurityWeek SecurityWeek Recorded Future Imperva Threat Research Weird Gloop Paperjam PCMag IT Social Lupa.cz Yahoo! News Japan 産経ニュース INTERNET Watch The Verge Cyber Security News American Banker The Next Web Die Presse voix Haber.com |
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261023T160435Z · HTTP 200 · https://www.haber.com/teknoloji/siber-guvenlik-baskanligi-ndan-php2shell-aciklamasi-e-devlet-kapisi-guvende-hizmetler-kesintisiz-suruyor-29322
headers.json1abc5d38558f9c38852a8f79ccb5e80f7fdba10b2f57d703842a4e7eef8a6a8d 2,605 bytespage.html68c81fad10eabeea9fd14eb051f14ea08ce3bc53c2480200b7dcd3e84a40359c 181,974 bytesprovenance.json98afb98a78ea0bbedf960ca4e620dbb66511a19177a372ed0fa732bf9d176d8e 1,926 bytesrendered.html65672f53fd75c7e1d187995bfab8ed2ada2ddf5bdf9153d9eb4fa723d61103f2 353,789 bytesscreenshot.jpgc536ff88079d18729488673a8f62e1c91bd21aed0249909276ee3eb1a972abbc 677,102 bytestext.txt2825ea23dc0ee99dad084b327460a78610b626aa1f93bcd95017881a08fbcea9 12,513 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →