# Source: PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

ICTjournal: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal

**ICTjournal** · [https://www.ictjournal.ch/news/2026-10-22/deux-failles-critiques-dans-php-provoquent-une-mobilisation-mondiale](https://www.ictjournal.ch/news/2026-10-22/deux-failles-critiques-dans-php-provoquent-une-mobilisation-mondiale) · published not stated in the capture · added by `curator@php.newsroom` · slug `ictjournal-news-2026-10-22-deux-failles-critiques-d`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). ICTjournal (French, Switzerland), updated 23 October: thousands of servers remained exposed on 22 October. The firm Risikomonitor examined nearly 690,...

## What it says, as the collector read it

#### PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ch/news/ictjournal/news-2026-10-22-deux-failles-critiques-dans-php-provoquent-u`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

ICTjournal (French, Switzerland), updated 23 October: thousands of servers remained exposed on 22 October. The firm Risikomonitor examined nearly 690,000 servers linked to Switzerland on 22 October and found just over 23,000 (about 3.5%) still affected; the real number could be higher because the PHP version cannot always be determined, and VirusTotal data points the same way. Exploitation attempts were also observed.

> Elle a identifié un peu plus de 23’000 serveurs encore concernés par PHP2Shell, soit environ 3,5%.

_Curator's translation:_ "It identified a little over 23,000 servers still affected by PHP2Shell, about 3.5%."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ ICTjournal summarises the global mobilisation: Cloudflare's attack numbers, Reuters on European takedowns, and the PHP Foundation's admission that the root defect was seen in 2024. It adds that Switzerland's OFCS warned and that UNIGE and EPFL went offline.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: des milliers de serveurs vulnérables, des attaques déjà tentées (update) | ICTjournal". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `fr`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://www.ictjournal.ch/news/2026-10-23/php2shell-des-milliers-de-serveurs-vulnerables-des-attaques-deja-tentees-update- `headers.json` 96cb671877675863e47283b7aa831e49e59f92e987abbaaffb9dff9f9f24fa8a 718 bytes
- `page.html` 2d3d605f3ec7dac7a67f9f8a5af533342b09ddc97904163f4f7fa3e281b93ca6 61,721 bytes
- `provenance.json` 990cfa3359cd3f5ca8b695080c3ce572a5057a16d3669b9c10530ee178a763bd 1,856 bytes
- `rendered.html` 73da345102f334f7291a1d5e5da4b616bf72b1ca52f593496f4ebb15f666efd2 73,106 bytes
- `screenshot.jpg` 495b8e996db403400218a3d2c6d15b646a1ca330baafe4ef396c65bc073300f5 514,029 bytes
- `text.txt` 1eb6afcabd54c35bcf47b491733358b9cdb6263894dcd1fdfd8e17b0c0febb5f 7,901 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/sources/ictjournal-news-2026-10-22-deux-failles-critiques-d/index.html