# Source: 全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

ijiwei: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# 全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站

**ijiwei** · [https://www.ijiwei.com/n/1122779](https://www.ijiwei.com/n/1122779) · published not stated in the capture · added by `curator@php.newsroom` · slug `ijiwei-n-1122779`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T093507Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Ijiwei (Chinese): 'tonight's thunderclap' for the global internet: the AI-found PHP flaw PHP2Shell forced emergency site closures at government and co...

## What it says, as the collector read it

#### 全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `hk/news/ijiwei/n-1122779`, snapshot `20261025T093507Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T093507Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Ijiwei (Chinese): 'tonight's thunderclap' for the global internet: the AI-found PHP flaw PHP2Shell forced emergency site closures at government and corporate sites in several countries. On 21 October 2026 a rare security storm swept the internet; the two flaws are rated 9.2 on CVSS v4.0 and let an attacker run code on a server with only a crafted request and no credentials; sites closed included those in Finland and the Netherlands. Summarising OpenAI's own blog, it says OpenAI led for two months a coalition of PHP maintainers, security researchers and vendors; that Calif's researchers found a key flaw in August 2026 with OpenAI's GPT-5.6 Sol in the 'Patch the Planet' open-source audit programme; that Wiz independently found and reported both flaws, verifying them with a combination of Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; that OpenAI called it one of the most impactful security issues in recent memory and warned similar findings will rise sharply in coming months; and that OpenAI announced a 'Daybreak' subscription programme with $1 billion of subsidy for organisations protecting critical infrastructure, with a PHP version-detection tool and a Codex skill. On the leak, it says PHP planned to disclose on 22 October, but on 20 October details and a proof-of-concept tool named PHP2Shell leaked online; watchTowr confirmed it and its CEO said the company had reproduced both flaws; PHP announced on 20 October an emergency update for 21 October 14:00 UTC, and heise reported the disclosure had been due on 22 October.

> 2026年10月21日，一场罕见的安全风暴席卷全球互联网。

_Curator's translation:_ "On 21 October 2026 a rare security storm swept the global internet."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "全球互联网“今夜惊雷”：AI发现的PHP高危漏洞“PHP2Shell”引发多国政企网站紧急关站". Selected mechanically, not read by a person.

#### Capture notes

Language `zh`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261025T093507Z · HTTP 200 · https://www.ijiwei.com/n/1122779- `headers.json` 5ec30cc89903a98a18ce31d694e214f7557d14ee3a125ffa489c7f986bc6d027 900 bytes
- `page.html` 046759baedb82af3710da90268e93e0acd32baeabff10e48a49119a69cdd7c81 61,676 bytes
- `provenance.json` 77ef7f748cf8427119071cf49933d2cd667c654a61c5ddd538303cad878b5995 1,552 bytes
- `rendered.html` b3e02665079d0f7252efa4a5eff1a1b0bf54b892054d68dc7f3698d581b22861 60,937 bytes
- `screenshot.jpg` 4cc32df55be0c48a7ac54a1f61139756ebe69eb28558584d298189df7b883753 945,195 bytes
- `text.txt` 0f6f2bf8436c2b42a5258fe1041aa70afc7a0a8d8421ab76d174467df65b0d0f 17,220 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.0 · data as of 2026-10-25T09:35Z · vault commit 87795d121200 · https://php.oct.2026.newsroom.sgit.ai/sources/ijiwei-n-1122779/index.html