Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Help Net Security, 22 October: Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to the two flaws...
What it says, as the collector read it
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page nz/news/helpnetsecurity/2026-10-22-php2shell-scanner-tool, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Help Net Security, 22 October: Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to the two flaws. The article says PHP2Shell gives pre-auth remote code execution against PHP applications on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento. The scanner was not fetched or run; it is a stranger's tool.
> Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619
Why it is here
From the promotion queue (index/promote.json, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619 - Help Net Security". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.
Capture notes
Language en-US. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261023T160435Z · HTTP 200 · https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/
headers.jsona5c5b62675013f65abaeaf35a391ecec4042c122ba7e6a0eca46d4e6b1947352 1,070 bytespage.html36d3c37cbd30df62d85a0a399f4caf86ca4045067228eb27489e6cb5e3013174 86,469 bytesprovenance.json55c1045efe48516c97cf73863500e5ae2aaa7140cae91ebec2a19cb6f02e67b8 1,557 bytestext.txt5af2786ae142ccb6bf69b7d7f2280c3cd37897cfd64aa72586b09b43c1532368 5,011 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →