# Source: Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Hírstart: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek

**Hírstart** · [https://www.hirstart.hu/hk/20261023_php2shell_teendok_nas-okon_tuzfalakon_es_kontenerekben](https://www.hirstart.hu/hk/20261023_php2shell_teendok_nas-okon_tuzfalakon_es_kontenerekben) · published 2026-10-23T11:13:04Z · added by `curator@php.newsroom` · slug `hirstart-hk-20261023-php2shell-teendok-nas-okon-t`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T160544Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Hirstart (Hungarian), 23 October: critical PHP vulnerabilities allow remote code execution and emergency fixes have arrived. The two flaws known as PH...

## What it says, as the collector read it

#### Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hu/news/hirstart/hk-20261023-php2shell-teendok-nas-okon-tuzfalakon-es-kontene`, snapshot `20261024T160544Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T160544Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Hirstart (Hungarian), 23 October: critical PHP vulnerabilities allow remote code execution and emergency fixes have arrived. The two flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) can enable unauthenticated remote code execution and can also affect the interfaces of NAS devices, firewalls, Nextcloud containers and other systems running PHP; its headings mirror the Notebookcheck guide for QNAP, Nextcloud and OPNsense users.

> A PHP2Shell néven ismert két kritikus sérülékenység (CVE-2026-109618 és CVE-2026-109619) hitelesítés nélküli távoli kódfuttatást tehet lehetővé.

_Curator's translation:_ "The two critical vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) may allow unauthenticated remote code execution."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Kritikus PHP-sebezhetőségek távoli kódfuttatást tesznek lehetővé, sürgősségi javítások érkeztek". Selected mechanically, not read by a person.

#### Capture notes

Language `hu`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261024T160544Z · HTTP 200 · https://www.hirstart.hu/hk/20261023_php2shell_teendok_nas-okon_tuzfalakon_es_kontenerekben- `headers.json` 2db7370fdab40bc9a9a4acdae3c2c5b230c6e95413991805d84e27fd31d57978 465 bytes
- `page.html` 1006cf7188a8ab3d687f180726d550bf2874a5272fa182a3041fc21735221d09 59,671 bytes
- `provenance.json` d151f3c553342126780dbdc75d6aa359c820dddc2dcd4d14f6336af02b31e682 1,802 bytes
- `rendered.html` c48ec79c64dae358f4aa21af151a988954dab1f40f721bc7242ba0ccd9166274 101,084 bytes
- `screenshot.jpg` c41822fdf6b30319321b96b661bf4516286cdf9c834a48e9106708cda3613729 138,042 bytes
- `text.txt` ab29456ac75278c1be923d0c72c710d4c6cf502363c548d622d8e48ce7a69fc2 1,858 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.0 · data as of 2026-10-25T09:35Z · vault commit 87795d121200 · https://php.oct.2026.newsroom.sgit.ai/sources/hirstart-hk-20261023-php2shell-teendok-nas-okon-t/index.html