144 sources, 73 of them primary, 137 dated captures and 857 hashed files, from the evidence vault at commit 200d08971937. 10 sources could not be read because the site blocked an automated browser; the block, with the challenge page's hash, is the record. The captures are third-party pages held privately and are not republished; this page links to the originals and lists the SHA-256 of every captured file, so that anyone the vault is later opened to can check that the bytes are the ones the agents saw, at the minute they saw them.
ACN / CSIRT Italia · advisory · secondary · captured · published 2026-10-21 · added by collector-gov · acn-it-php2shell
Alert AL07/261021/CSIRT-ITA, published 21-10-2026. CVSS v4.0 9.2 each (Use After Free). Mitigation: only 'aggiornare i prodotti vulnerabili' (update); it gives no offline advice.
capture 20261022T081354Z · HTTP 200 · https://www.acn.gov.it/portale/w/php2shell-sanate-vulnerabilita-critiche-in-php
headers.json c44211ff9b8440ef6922919056abed0873179324fdf7db7ddf969c8d1dd6bd15 732 bytespage.html 6ab511ebb1dd7a3d6235d88dc71a02c8ecefec27283538cec68a134d33d67440 118,598 bytesprovenance.json b832861c53d09b3d98083bc23e3c4578748f1f8173e2ea7c23bd8c9dfa6f1c8b 1,038 bytesrendered.html 91c9550654c551eeacb33e829fe2246a7307efbcf7cd00d4cf10f5a44413cf07 131,205 bytesscreenshot.png 94246ab38f323d629edf5c1820908d804f7f45f61bc276e7c77e756aa549fc65 687,162 bytestext.txt 19fac2edc25161cd867bda0ea1c8bf8b6ce7625fbdd1e9a9a7cd41bdd8d1bef6 6,137 bytes
ASD's ACSC (Australia) · advisory · primary · captured · published 2026-10-21 (Published); Last reviewed 2026-10-22 · added by collector-gov · acsc-alert-php
Alert Status: Critical. Published 21 Oct 2026, last reviewed 22 Oct 2026. 'Recent update': identify PHP, review php.net, apply updates and mitigations, monitor. NO offline advice. 'not aware of successful active exploitation within Australia'. Says full details were announced 'Thursday 22 October 2026 at 0100 AEDT' (=21 Oct 14:00Z). The body text is stale (pre-patch).
capture 20261022T081658Z · HTTP 200 · https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php
headers.json 3f7c0fe9c702d22193630225a56b0991c08fc52fb05ef53f26ea0f611b798b4e 1,985 bytespage.html 650742fe93abb6dec911f58d21b7cd6d8d82c2d4a7b89eb9745e9a9857bc0c72 1,541,271 bytesprovenance.json 37ce725a8459c6db87ef8d7e3abd3cf92d350bab9e4228852c7d07dd08d65a6f 985 bytesrendered.html 731eef8ce851ccf1650bc66cf3bb8658569c3de13b3a8084c14761658743e931 1,557,700 bytesscreenshot.png 39318847477c383a130dbafc83210dc27ed7ccae88107979ed124e372d67da9d 345,966 bytestext.txt 9370af142ded6de9a44fed4330585d677fde367d90d33ce355e9ebe6a75f7d56 6,299 bytes
ASD's ACSC · government · secondary · captured · published not stated · added by collector-gov · acsc-home
Home at 08:16Z: the PHP alert teaser is dated 22 Oct 2026 with the stale pre-disclosure blurb.
capture 20261022T081604Z · HTTP 200 · https://www.cyber.gov.au/
headers.json 3d448cbb053930039edd6bcb6779264beb2fa8c4c073bc5084ca3a5b0c369a5f 1,937 bytespage.html bd81a8f884e1cbe1f2ae88c146b6198346568f2324677adce3198b5578db19c3 1,854,064 bytesprovenance.json 992e9c6ce0b26d2edb42343e569ac2634e532a277a5e804ec657ed66acda47a9 879 bytesrendered.html e22b8af8cb588bdf894c62c53337db8940108a269e2f517f1d6ffa1886d8d904 1,889,870 bytesscreenshot.png 3f7acad6a96208dca53692a35f83a89e3b21e8266fcd183892673c6e4b3b39b0 723,009 bytestext.txt b7198501ad800f9312359edf414e81c46b1b35f7d0fae787ff629a8f029ad0b9 13,389 bytes
ActuIA · news · secondary · captured · published 2026-10-22 · added by claude-story-site · actuia-anssi-sites-offline
Secondary: 'France's ANSSI orders sites offline'; compare CERT-FR's own wording (isolate, then migrate).
capture 20261022T112454Z · HTTP 200 · https://www.actuia.com/en/news/php-flaws-frances-anssi-orders-sites-offline-after-ai-assisted-discovery/
headers.json ee48005ae8388bf72bebfeea8f3d95100abf6faae001e3c235a5506d2f6dc21e 473 bytespage.html ff30fd43654cd08a1f693e8d4d915c41820729be9a1991d5f4e462d1d0bb22f4 116,023 bytesprovenance.json e9c5fc723d72d43ad18613c74102fa5d72fc2799e91e0f81c2cfbfd51a52d794 1,090 bytesrendered.html 74e68194027420a7a98f41f234f8da46f93ff0e5c77fec86c07d115f15365688 122,914 bytesscreenshot.png f934a67b32d8386b43d01a1a9baece42d7406c36ed9bec407ef19f9a26d73475 1,673,964 bytestext.txt 8f399970329ffcead878dced88dbb206b9677895965091d0efb60334becc9f9a 10,744 bytes
Akamai Security Research · vendor · primary · captured · published 2024 · added by claude-story-site · akamai-blog-cve-2024-4577-one-day
Historical: exploits of the previous PHP core RCE, CVE-2024-4577, seen in the wild one day after disclosure.
capture 20261022T112501Z · HTTP 200 · https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure
headers.json b8600b926f54d0c326ae453a4aa45ee026728ff7329884997710f9d1e5f541cb 5,460 bytespage.html 10bed4c03e0d208afa3e6d6d67c8d2250149138bb4d63e87605d1e28079a5171 279,021 bytesprovenance.json 67c5b82965151100b965313d300e89e4bd9ca9ce8520a47fa8ba174bd637833b 1,084 bytesrendered.html 3aea0cbcf996a4c4d7b0dfe721b61fee812595d5df395a7b8eb1317ca7c0fa8f 478,692 bytesscreenshot.png 5fed6383355ce8c109b539a7e534592d29b584d533df10d4b2228cd9c2431475 2,944,679 bytestext.txt f7a58be0ecaaa8db0b45cf79431fcc8609cd27f52b20baefafb80d760164e567 23,021 bytes
Akamai Security Research · vendor · primary · captured · published 2026-10-21 · added by claude-story-site · akamai-blog-php-core-rce
Adaptive Security Engine rule 3000991 v1 'PHP Remote Code Execution Attack Detected' for both CVEs; existing command-injection rules also blocking weaponised payloads; 'prompt application of vendor patches' is the most effective defence.
capture 20261022T112525Z · HTTP 200 · https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core
headers.json 3ed908175f73e8f392f99df0845982f172ad44c49cb12692c16c1fcf7849d28d 5,850 bytespage.html 8f9e02a272dd67f8a2770e849f8f8118fc34e45f1cd056fd56e4b5a7f9bae592 213,450 bytesprovenance.json c335fab9c5745922bf97664aa64c00fa23b563ae875eeb2c95316f70f3ae758d 1,103 bytesrendered.html 0400fefe0ed144f5140e8077e5e6d9b401d41cad7ef0b66825c4dec6663f4b33 415,118 bytesscreenshot.png 5757611708b507626fda25038e770bb96adb831e42b474d6c5229c30ba0a3a98 609,040 bytestext.txt 2a001600cd450bc582ed42e8355951626ef8ae60e5c4afe233629dbeeaacba5b 5,509 bytes
Arctic Wolf Labs · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · arcticwolf-php2shell-exposure
Vendor guidance on finding and patching exposure.
capture 20261022T112342Z · HTTP 200 · https://arcticwolf.com/resources/blog/arctic-wolf-labs-finding-prioritizing-and-patching-php2shell-exposure/
headers.json cb2dc7b843210683b8616d4f651fe7942a43433cea11e494ec0adb084f793b82 1,052 bytespage.html 62b3d068fbefbb9b312c2418b4a38ef788132d55782e1e41244e77c0bad59726 351,404 bytesprovenance.json 015cfc5316cc7077049a8aee5da1a198699d54f7244e62ab8f7bf89b9e5ac590 1,123 bytesrendered.html 1f059cea13ae6b9fa434e23a67c3e8ec05c47fa9af94ac9c5a476013862adb78 1,342,610 bytesscreenshot.png 0f1c79ead2d73038424318bb8efbe497717653cc82a2b3763f24ce7a95386336 1,555,808 bytestext.txt ef2210c0fd1c35032d70283c91ab44c01c091342c21c9ac55571b12b45f8f75b 10,879 bytes
Armis · vendor · secondary · blocked · published 2026-10-21 · added by claude-story-site · armis-php2shell-find-patch
Vendor guidance on finding and patching.
capture 20261022T112544Z · HTTP 403 · https://www.armis.com/blog/php2shell-how-to-find-prioritize-and-patch-affected-systems/
headers.json beaea17cfe605c6045c7491c7d444b6fc828d614e9fbacea1cc080a269cc4c31 1,990 bytespage.html f8ff0c9e277962b98d66e9cf2027f78e3bfbc4d17999419d62b105822a78c6ba 6,399 bytesprovenance.json 0cdaf4cb11738a799892b7d79d673ed08c085634e8be431b89fd732adde39e19 1,026 bytesrendered.html 64996869be46fe0ae90238d579e23c2599e4293e9f0c15e82d322efe96fde39b 28,992 bytesscreenshot.png 4da50c06b7082cecc3965a33e2fcf67ce4919b97b0730000f14723d2e5ec0321 38,997 bytestext.txt d15eed6dfa57239bfe3d8333949627f35d8011042027db230828460dbf2b4ff3 261 bytes
Amazon (CJ Moses, AWS Security Blog) · vendor · primary · captured · published 2026-10-21 · added by claude-story-site · aws-security-blog-madpot
Primary account of the 17 October honeypot attempt and the 02:00 UTC proof-of-concept attempts; 'PHP2Shell is now being broadly exploited in the wild'.
capture 20261022T111755Z · HTTP 200 · https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
headers.json cd2b6b91c536e98366aa450fc499555f4c46f1fc50e52b619d41fdd8156f7621 961 bytespage.html 94afa0f2233266fa0310186f90425778563bae6747ca3cf284d7d176d5339c8b 1,407,726 bytesprovenance.json 0d0fa2b45ba63031f0e80fc3fdf09aaa336dc7d1bb31664221072c5be8924343 1,223 bytesrendered.html 5e11969294ad2dba28416a6f535b5e0674e071861c00efcd5c7b6dbecd42ee92 1,473,573 bytesscreenshot.png 838da55574a9351f12a7a7ef936be739360c2221877d6e744c1ec445ad70a84a 688,402 bytestext.txt 94315ded6e1175f290a4a7cac71ba39dcf18ada7232367f66c34e1decfb08c7d 8,561 bytes
BBC News · news-live · secondary · captured · published 2026-10-22T06:16:24Z · added by claude-newsroom-lead · bbc-live-ckgel5xp2xv9t
Live page; bbc.co.uk redirects to bbc.com. raw/ holds a curl copy at 07:55Z and its __INITIAL_DATA__. Captures 080453Z and 080526Z have no raw body (the tool's first fallback was blocked by egress); 080559Z is complete. Edited by Kieran Kelly and Imogen James.
capture 20261022T080453Z · HTTP 200 · https://www.bbc.com/news/live/ckgel5xp2xv9t
headers.json 6f92f9cc2df7e178c6a5480cde0a0d07eaa057374c17573ed0539cd2ec5e4f76 5,640 bytespage.html dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981 24 bytesprovenance.json de7ccc50e0cd85c96d0c814a87e22d61df580452ccc7cc08bec00fe2acb36000 1,094 bytesrendered.html e9ae7f01673df9b32a99007f255c2106bc6f4179841891af83732ce54cac1bde 500,416 bytesscreenshot.png a466ce380b452e0a851e07db1d769f1ccb1b41391a8bf001b5febe1a6b0a8352 2,737,568 bytestext.txt df1dbe6b553a8c004f6d950a1d606138f2795062d3225feaa37043d24343bc99 14,389 bytes
capture 20261022T080526Z · HTTP 200 · https://www.bbc.com/news/live/ckgel5xp2xv9t
headers.json d63c60c458f9e0144dfc1ec7336b7e7eb13ac35383008623841bf01030b99175 5,690 bytespage.html dc9a4c45bac2ffecb6c3904ab17c14f29288f0928f0247acd449f62d0b715981 24 bytesprovenance.json b0b6c73c98d7b9af8e3cea8a007eb2212d89e38f80d8fdcb1c99b32cac545a18 1,094 bytesrendered.html b42a90b0ed17266eac83cb8bc81fc6e2321285b3b3dd01c15aed55411ec51255 511,866 bytesscreenshot.png 65eb8a2dd5d93f8ef2399b62dd91d4bae200c41997a77ccae9b9388d33c505bf 3,587,122 bytestext.txt 9ae96265aa96cff67f4da71f5ed410376023b17283d83b617eab7e98d2602738 14,501 bytes
capture 20261022T080559Z · HTTP 200 · https://www.bbc.com/news/live/ckgel5xp2xv9t
headers.json adef455045234df0fcb6936e0b86ce89d83c6b68719892c1e08bc498d0704517 5,647 bytespage.html 50bc0fc20681b834b1a40742cf921b27ceb5356d5ab38b417c7e53513016eefd 501,921 bytesprovenance.json b62c78eb8ac92bd2d3d7bbd6749e8f0c24519b5d2edac76d107af558eaf78d2f 1,092 bytesrendered.html 8ae9c4bca9c7ff8b5037ffa58536c2b75c45efdee1f851d583a80ac5cd05ff5c 501,515 bytesscreenshot.png f3cf0359a5f9aec2edf5dfa6cd060f55f94aa3c64b90f7e260edec02180a434c 2,685,632 bytestext.txt c88b8c5f4c6bc07d2ef85b78d0d66482f0322075621abb0631ef4352932aa97d 14,389 bytes
raw, 2 files with SHA256SUMS
initial-data.json ee7445a58187bcd67df827007a8100941993a24dc3e7eea7e8a45f723a9e3305page.2026-10-22T0755Z.html fe32274b64ee109a7e37fc4c26e37e793dc22481a6122888782c393e01102488
Bloomberg · news · secondary · blocked · published 2026-10-21 · added by claude-story-site · bloomberg-governments-offline
European governments take websites offline; may be paywalled, see capture status.
capture 20261022T112602Z · HTTP 403 · https://www.bloomberg.com/news/articles/2026-10-21/governments-take-websites-offline-after-php-security-warnings
headers.json ebbf488d8ec3cb9e82e0b2850092794fa151b40e36e5527483c925bd8bc043c2 1,744 bytespage.html 42ba14394a9bbfcfd2d92ca9d569ec69f03944659af408f36f57faea50e788d2 13,856 bytesprovenance.json 3c8c1301b67db2b3dbe016f7c0f83861dc5a27d0a02c693c16b232b3a0f0bc56 1,091 bytesrendered.html cf863d12c016944da5fa0f4a5d5a6b20441810b9d390e4cd795477677e22219c 15,882 bytesscreenshot.png 381a9b176a6f0b8aa7805f9ddb22a7cd17826528afa7a41b24b0015b1c3a355e 78,255 bytestext.txt a66e04101bddd06c4cc5019d69b57bd2db4ff7d0a6ecdfe0fbd4d6fc5e05b303 665 bytes
Broadcom (Symantec) Security · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · broadcom-security-php2shell
Vendor explainer.
capture 20261022T112608Z · HTTP 200 · https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619
headers.json 90e7e97292b84a9655eb632719cd295101372dea8bfbbea1c37cac21f29c6083 2,018 bytespage.html ee4999fb83f9cd38b29e33384e6cd904f855429326277bbcaaaa0b5796879cf8 329,468 bytesprovenance.json c676441507e6939f7a352231caebe725dfa363ad55108ae190166cc7123411b0 1,093 bytesrendered.html 087b78f1dbe37ce2b31dc124b10b31a4009ac15969a40407f65afddb1dff30b7 431,453 bytesscreenshot.png a4a4f3fec342e365df75bcdd5a2b61bac1edb4a1417b9a1200702734cd579cff 2,841,458 bytestext.txt ade5eb86aa233a2122f483429993bf21453456fc608ee191949dacc2f7e3a260 13,607 bytes
Calif (Calif Research) · researcher · primary · captured · published 2026-10-21 · added by collector-researchers · calif-php2shell
Calif's own write-up by Ryan Austin (@lcfr_hax). Page has no machine timestamp; story panel dated 'Oct 21, 2026'. Embeds two YouTube exploit demo videos (pfWZrdzvooc 'php2shell exploit demonstration', cE4h79AWbT4 'Exploiting Nginx with PHP-FPM'); videos NOT downloaded. Its timeline omits the leaked/deleted video.
capture 20261022T081033Z · HTTP 200 · https://calif.io/php2shell/
headers.json 1fc0b2864079499b5911e31166e216c1c753a83da9a65d38086609e84372794e 759 bytespage.html 9f3df4d68b9d185563f9b5eec4b1e910f296389f54e02b4f6a25fef2573662a3 68,302 bytesprovenance.json c800836bfdf2759a20495415eb65bff17d26b8d9127d0695f7be27870b1dc67b 906 bytesrendered.html 24e345e4514f5240f94df7537536a5ed14ba6e440cffffae74f8c38c7c8e5644 68,280 bytesscreenshot.png 38990c6ce9af5828a86614d9dff808d621097986d5288e8136bda70412b3ac63 20,097,747 bytestext.txt 23afef81971778f954d3cefb62c4901814afddd6ae0948c941af3edead40ced4 23,876 bytes
Canadian Centre for Cyber Security (CCCS) · advisory · primary · captured · published 2026-10-21 · added by collector-gov · cccs-al26-026
Date: October 21, 2026; Date modified 2026-10-21. 'Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.' PoC available; no active exploitation identified. Also AV26-1070 (PHP security advisory), same date.
capture 20261022T081700Z · HTTP 200 · https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
headers.json 0db6dd151e1887553a32a56de4d1f6a133645e87d6dbee931f362e8a21a370f3 583 bytespage.html 171c897e4a6fde98e73f9d1e221188dae6d0c04b49e8b6a242fba591739a11c9 39,250 bytesprovenance.json 9759aec757d5df865a795a86bf304ffdcc697988c45f47adcc0159a6771a4fa1 1,195 bytesrendered.html d6536d39602e9709a1afb05fb61fad1b88b57a5d1b839a7f5de58c7f3588300c 149,258 bytesscreenshot.png 9df75da37b7ed8ceb13b241f71f041d29c9f33055750a65070c6c785bbe9cdd2 538,343 bytestext.txt 9e7f44cc73e21ad54d1caf36c5273a289839c76ff1e1ac35bf377e4645ad91a2 5,403 bytes
CCCS · government · secondary · captured · published not stated · added by collector-gov · cccs-alerts
Listing page at 08:16Z: AL26-026 and AV26-1070 (PHP), both 2026-10-21.
capture 20261022T081604Z · HTTP 200 · https://www.cyber.gc.ca/en/alerts-advisories
headers.json 43f213e29f0be568c8c4a231d0404fc7c33db33ea4b6d75c538f505a2a139b88 586 bytespage.html b7e604271809b8579356f2e76d4be26c44d1aa9a92893b73efa23358036ba52e 21,909,500 bytesprovenance.json bcff9a25cb070bd8554c2d407548464544b8792a9046b93a670f29e70dc5c6ad 1,026 bytesrendered.html b15a0c243be41ff42e41fd4f94617f75373bce255f915cc57cded297c97ef6a4 50,788,748 bytesscreenshot.png 9029e12095ac74977c8777919e317ffd20cc42da26e60903f1964abddab3774d 494,360 bytestext.txt c226b8df2f21a14934c6c79d53fae9685707e4adcca0fcf2d7b6143e296b2000 3,812 bytes
CCN-CERT (Spain) · advisory · primary · blocked · published not stated · added by collector-gov · ccn-cert-al-11-26
HTTP 403 bot challenge ('Voight-Kampff Browser Test') to both Playwright and curl; WebFetch also got 403. The URL and title come from ENISA CNW-2026-04. The challenge body is saved in raw/.
capture 20261022T081353Z · HTTP 403 · https://www.ccn-cert.cni.es/es/seguridad-al-dia/alertas-ccn-cert/13200-ccn-cert-al-11-26-actualizacion-inmediata-de-vulnerabilidad-critica-en-php.html error: page.title: Execution context was destroyed, most likely because of a navigation
provenance.json 3499d3985dcda97902ce1e89dd5edffba4a20b56ba01cab266db1e9fc7f50c36 780 bytes
raw, 2 files with SHA256SUMS
curl-body.20261022T0814Z.html a3de1982de0d6d2967b7ac55d2787011ba4fdd8707f4a8e9e25e1b50b345d9f7curl-headers.20261022T0814Z.txt a397cde2f98a7851bb54672621f25f4834926a0250ea5140f65c91110b53d3f8
CERT-EU · advisory · primary · captured · published 2026-10-21 15:20:18 (as stated; timezone not given) · added by collector-gov · certeu-sa-2026-018
v1.0 and v1.1 both 21/10/2026. States the PHP fixes were released '21 October 2026 at 13:30 UTC'. CVSS 9.2 each. Advice: 'patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified.' Notes PoCs are circulating.
capture 20261022T081329Z · HTTP 200 · https://cert.europa.eu/publications/security-advisories/2026-018/
headers.json 035d980d7924b86c61cd912c5ae8e55b5adbdf20e9f99f9c780d7b37e830e596 1,370 bytespage.html 1cc49d8c9b94ac2e09eb5f4e2bcb732a0d1fd4f630eaedad06da28a295978e53 24,504 bytesprovenance.json d5c1ea12a493fd9c195d90ee56eba85c93cd77d6131bce3ac08929d72f275820 999 bytesrendered.html abb92e1078d68ea54089f704855e78b2a71cee27a6244c2d3f26cd1b8c90b759 23,744 bytesscreenshot.png 894baac8f7c1a2e25439f481a468e1c086cf4c783d11e7f020bb354120ef6c99 624,274 bytestext.txt c65c95cf165d9ed7ec5d362642e92dd918c77fdfca1d4f88b303db6a3ab24ae3 7,105 bytes
CERT-FR (ANSSI) · advisory · primary · captured · published 2026-10-21 · added by collector-gov · certfr-2026-ale-014
First and last version 21 Oct 2026. 'Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue...'. Affected: all 5.x, 6.x, 7.x, 8.0, 8.1, and 8.2-8.5 below the fixed versions. Workarounds: session.upload_progress off; block multipart Content-Type at WAF.
capture 20261022T081353Z · HTTP 200 · https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/
headers.json 96a5cd42d4ca38099fc910e8c06f10cfd15f15e6ca7bebdb699b3b7245d08d58 1,075 bytespage.html 91f474e2f0f414b2d8575b91cecd59d880e62f0179033baae665177100fc094a 26,782 bytesprovenance.json 53ea7bfd63a634427908cc6846e7e974b45c9cdc7028b88d7e87d148408ecd59 989 bytesrendered.html f71933fcd112f86a98d8838cc53fa38dabffe5f27a6c4dc7bfc62f9ef6e9aa7c 27,674 bytesscreenshot.png e6ccac8825818ecc2cfd2223035c6c335a3de1c38fad734d7dd292215618cef7 502,064 bytestext.txt f9e9557ab49ddb9598b22d6774d5466de0429deba8720e6e3fba62d778b5d0f3 5,127 bytes
CERT.LV (Latvia) · government · primary · captured · published 2026-10-21T18:25 local (EEST, =15:25Z); updated 2026-10-21T23:00 local (=20:00Z) · added by collector-gov · certlv-php-preventive
Latvia restricted access from abroad to several state digital resources (geo-blocking, possibly until Mon 26 Oct). Update 23:00: the TVP unified website platform is patched and reachable from Latvia; latvija.gov.lv is restricted only from abroad; lsm.lv and 112.lv restored. About 6000 potentially affected resources in Latvia, a few hundred of them public sector. Automated exploitation attempts seen, none successful so far.
capture 20261022T081354Z · HTTP 200 · https://cert.lv/lv/2026/10/saistiba-ar-globali-atklatam-php-ievainojamibam-latvija-ievies-preventivus-pasakumus
headers.json b75279eb611beef16c83a6ab4d307db8ec59d18614d4d21ea1c78320a4346166 737 bytespage.html de622b5e59bf43071dcb45655edbd42b337e97f28b3e41e801ebaacc64a33581 35,634 bytesprovenance.json e046187fdaa6dc172317abf6fa62152e1b5594b3c2d59c75c1de1baafa4667ba 1,158 bytesrendered.html 4f3a30ed3f755cd5965265ba1cc6f1cce9e514537463c1f9d2b87fdfceaaf514 35,482 bytesscreenshot.png 504fd0c9b36378f8039c94b1157842426c17d95ab822429554c1bfc0cdbfb4d2 750,435 bytestext.txt e37a6582c4e6c685ad840001892ea94cd8e91ec107708ce4e7b7110899c2d05e 6,579 bytes
Swiss Federal Office for Cyber Security (BACS / NCSC) · advisory · primary · captured · published 2026-10-21 · added by collector-gov · ch-bacs-warnung-php
Published on 21 October 2026 (the home page teaser shows 20 October 2026). 'If an immediate update is not possible': restrict access; 'Check, particularly for critical applications, whether a temporary disconnection from the internet or taking the system offline is necessary.' Says a WAF alone is not sufficient.
capture 20261022T081700Z · HTTP 200 · https://www.bacs.admin.ch/en/warnung-php-en
headers.json 603765d5dfe2bc360d0d8becb67c71a6a5810ad02fbe68f5d677488189ac7317 6,406 bytespage.html bdef753f8a5972cd0d5af92574637f8edd425df0511ef469bf2c11ee39207e0f 160,186 bytesprovenance.json 1574e8470bf5e04e0a830d2ee1ffd4d728872599f3828cba3399f0b095066f39 984 bytesrendered.html 7400fa0917a78b8192f819815d7bddbc76a93e9ddb57e9ce574cb60b713b4e0b 174,883 bytesscreenshot.png b14b81a2939d7eafc4abdd581e6591629c66d8728ce4402a2c68421d788a9f63 846,454 bytestext.txt 99886a19aead8abe4faab9f41918c8654a2e070c816f856c0dd3e14a194d6890 4,966 bytes
Swiss BACS · government · secondary · captured · published not stated · added by collector-gov · ch-ncsc-home
Redirects to bacs.admin.ch/en; the PHP teaser is dated 20 October 2026.
capture 20261022T081604Z · HTTP 200 · https://www.bacs.admin.ch/en
headers.json 80c563292cf0e8178e58809441cc65504b120a6299d27979fc429c606efaa3fd 6,406 bytespage.html db63fa0b832d6e1c47503189a9e2dd40e5a0dc6e8aab560cae02e8db1f3806f4 683,600 bytesprovenance.json a459bb8ebb915fac015c2f06c8c45177516e9c968f132531f1d20fa7053e7c69 923 bytesrendered.html 772da1668f48bd3c5a4f64e05a57da3b25759fb0029663257cdb7ffef85aec1f 739,577 bytesscreenshot.png 0aaffb075e051c6b2ad0f9f8261010a963e502b32700d1fc07b0cdee4d9a835e 1,095,138 bytestext.txt 29c1b2cfeb73db9702347d8cbb1b37690641e3abf5ddda16da0af6451f54e41b 11,068 bytes
CISA · government · primary · captured · published 2021-12-10 · added by claude-story-site · cisa-alert-log4j-2021
Historical: CISA's alert on Log4j the day it was published.
capture 20261022T113354Z · HTTP 200 · https://www.cisa.gov/news-events/alerts/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce-vulnerability-under-exploitation
headers.json 81c7dcf0ae8dbb9db7007301569c1098a3ef6556dd79a9630d630651daa84547 2,869 bytespage.html 96fb8cf20f99673da75e17b169ced8e990ef1852c39832a988ce04901089dd93 52,975 bytesprovenance.json 3f51e4f7a62ee09109ff3dc36fcb8369a5ad5cc50b151b08368a863938e9bf91 1,209 bytesrendered.html 5badb6aa92a2948ebfdb3e6213117ffa468b50a21ae447dd975d608df7786007 76,046 bytesscreenshot.png 181a9b4f1fb059019f1f42b3d6d7ec914a53307ae7276e8d10637cdd93807b1c 311,343 bytestext.txt 98840739d797dd49ca9582640f9a88007c32812ba8e49d2cc0492e54c138c9e5 2,015 bytes
US Cybersecurity and Infrastructure Security Agency (CISA) · advisory · primary · captured · published 2026-10-21 · added by collector-gov · cisa-alert-php-20261021
CISA Alert, Release Date October 21, 2026. Names CVE-2026-109618/109619 'php2shell'. 'Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.' CISA 'has not observed exploitation ... as of the time of publication'. Not in KEV as of catalog 2026.10.21.
capture 20261022T081353Z · HTTP 200 · https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
headers.json 30fb6764c792111ac226e0fb1ca4f574f5e2faadfc10d2150ae9dfa35ea0858d 2,825 bytespage.html be6b410fc0da16de2c1b96dc3132a195632d636467ab7c859c343494fa7accfa 53,868 bytesprovenance.json ea18f4dbc502d3c87b5d9a6c83d49ff128544ad074140c502f37abff350d9f8a 1,110 bytesrendered.html 0e3e08492a52d48e8ccb18f836df984af4f15f251f6089697676b540458b3371 78,116 bytesscreenshot.png 2724e9107ccae45a888b3531fdc43373b154be3eeadb78841791dcb6a60a34c1 384,239 bytestext.txt 7bf853872a073bde9c2d71a41fbf9bfd3cda8147c278ab15426ebc9c8e627a9f 3,223 bytes
CISA · government · primary · captured · published 2021-12-17 · added by claude-story-site · cisa-ed-22-02-log4j
Historical: Emergency Directive 22-02 on Log4j.
capture 20261022T113402Z · HTTP 404 · https://www.cisa.gov/news-events/directives/ed-22-02-mitigate-apache-log4j-vulnerability
headers.json 1b3806dec260fe8e3a777ba86f9ee746b6edd19e249375bf255f7a5d9697921a 2,712 bytespage.html 601f61af5acf4d62056f2376b007d492c9f77dbc84557f9ea9f9f4a7834691da 47,323 bytesprovenance.json bdfcae4f97b12f4551a9070ae19917243e91048c4e13feb7fb06f939368c8d1c 1,026 bytesrendered.html 4e45e69f1aa1a5d929a2896dce31b78f23be1bbfd88195b6030c0e1a5b7761e5 66,546 bytesscreenshot.png d0899ef76fbd637495baf797c91303c02eaf04c8f12bdfafa20265b9052fe302 186,488 bytestext.txt 74b20e7dc5b8d12bb09978a2b9ab15941b343248ce65584eb76548fd8b68b0d2 1,035 bytes
CISA · government · secondary · captured · published not stated · added by collector-gov · cisa-home
Home page at 08:13Z: the PHP alert (Oct 21, 2026) is top of the news list. No emergency directive is shown.
capture 20261022T081329Z · HTTP 200 · https://www.cisa.gov/
headers.json a76ca34b24fba67b623a4b3e4b5748241af7aac12f07bb31b73a1f88445398b2 2,712 bytespage.html 24ba8c3fe3e00e4445bd9fbbbabf113099d53e872bb4d594e92c8575084cfe31 71,972 bytesprovenance.json 364cc06b578cd41d9fc3e1155cd62c9694ca854bdfe27923863a3a00eb71ee53 877 bytesrendered.html 06fa4013f8e36ab399d6cef932f7d506a073b84357e4e4c40627479b5a3a1fa5 92,635 bytesscreenshot.png ed352cf8665d21d75d282faefdb680a9c65965edae9b6cbf4541c84f9dcbba23 1,291,590 bytestext.txt ab2aa07bb46ba14c14a2f76a312ff7b81e2c8c19ca3588de9313236b10007a34 4,261 bytes
CISA · government · primary · captured · published 2026-10-21T14:04:39Z · added by collector-primary · cisa-kev-catalog
raw/ only (JSON feed). catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39Z. Neither CVE-2026-109618 nor CVE-2026-109619 is listed as of fetch ~08:12Z on 22 Oct.
raw, 1 files with SHA256SUMS
known_exploited_vulnerabilities.json ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b
CISA · advisory · primary · captured · published 2026-10-21T14:04:39Z (catalogVersion 2026.10.21) · added by collector-gov · cisa-kev-json
At 08:15Z on 22 Oct: catalogVersion 2026.10.21, dateReleased 2026-10-21T14:04:39.8983Z, 1754 entries. CVE-2026-109618/109619 NOT in KEV. Raw JSON + headers + SHA256SUMS in raw/.
raw, 2 files with SHA256SUMS
headers.20261022T0816Z.txt e3a7dc7610f87ca2b7829303cd01ef65a3d0d08be833334024807456cc943db9known_exploited_vulnerabilities.20261022T0816Z.json ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b
Cloudflare · vendor · primary · captured · published 2026-10-21 · added by collector-researchers · cloudflare-blog-php2shell-waf
Dated OCTOBER 21, 2026. Says the vulnerability 'was leaked before the official release date and we observed attack traffic targeting our customers'. WAF protection live from Oct 21 03:02 UTC (~9h before disclosure). Lists disclosers as 'Calif.io, Wiz, OpenAI and Quarkslab'. 'PHP is used by almost 70% of websites.'
capture 20261022T081216Z · HTTP 200 · https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
headers.json 904849b322ddad92fccc55d4ce8527d9c4138d07d61937ce1da5602ea2bef244 7,260 bytespage.html 421005107f81d30d16850fdbf830446d6fd544746dfa7d201be9b4bd3f656e72 301,730 bytesprovenance.json 7f98162527014e2989dfaa73146a26c079c634ddf24eff95ae99fad7ea43beb0 1,045 bytesrendered.html a0d3c37cde7c1721a08b028748a412672817c45958d05cc7fedaede582b5537b 373,881 bytesscreenshot.png 1784904e6fdda092941881d0e5c85d73801054f216295ca43b17f76e7f5cd34b 989,488 bytestext.txt 302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823 10,205 bytes
CNCS (Portugal) · advisory · primary · blocked · published not stated · added by collector-gov · cncs-pt-alerta-136114
HTTP 513 'Verifying your browser | DiamWall' challenge to Playwright; curl got a 167-byte stub; WebFetch got a redirect loop. The URL comes from ENISA CNW-2026-04.
capture 20261022T081354Z · HTTP 513 · https://dyn.cncs.gov.pt/pt/alerta-detalhe/art/136114/alerta-de-vulnerabilidade-php
headers.json 5c140f9296dcaee3311e6857332cd02f3ecef21ddea2f8e064632238f0723a07 411 bytespage.html edb193e6b70aacbf1578ad062b6fa5085bfef2f34cbf0fd97aa924338c502db7 1,083 bytesprovenance.json e1e0d3e656a7c6ebfab6919cf39d5574b3af7346b5b2a843039c2dbcb844b2e9 1,028 bytesrendered.html ee72ee19cc622226439df3668a6e44283b40bf5c8a256279d4ca08a5381fe4ad 1,094 bytesscreenshot.png 5950f00ba8371e122d55c0b80325546131c084d32f70aed1fdf1bafdbf9f5d27 39,887 bytestext.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
raw, 2 files with SHA256SUMS
curl-body.20261022T0814Z.html 9171fe017af37f1f055d8e8bac037fc72bf67dd77e534de433be05297a582b0fcurl-headers.20261022T0814Z.txt b246a0bf67a34295b2bb54fc5724574f6176d92a46b05886076810bacd9a7e6c
CNN · news · secondary · captured · published 2026-10-21 · added by claude-story-site · cnn-php2shell-websites-shut
Wikimedia Foundation to CNN: systems 'taken down as a precautionary measure'; '70% of the internet' in the headline.
capture 20261022T112616Z · HTTP 200 · https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl
headers.json ff524b7f55b3e2e8e2a9abaa229a6d5694a59dcdb7346d04d4e47af17c87dc26 2,363 bytespage.html e194020ee0611e31ea5feb275ff76e19b40e03b3a1680e8e7e6ae37b1cdef60e 5,623,694 bytesprovenance.json d46dfcb30fd93dcb98e4468deabbc7c3b555698dc2bcba8c6cbc81fea8306682 1,074 bytesrendered.html 9928b7deeb656b8f9d34f7844cf0e79c2e5a9ea2b05721c03e84a0bc404646d8 5,844,671 bytesscreenshot.png a531b130b77be1e05bf3c9896abfc3abc4a70cc920a819eee04f7665c1a438e9 161,563 bytestext.txt ee49fc4265ae1c7cfb7ed245597071af43f17d437ed08be951d8388502f5a533 8,896 bytes
CVE Program (cveawg API) · cve · primary · captured · published 2008-07-08T23:00:00.000Z · added by claude-story-site · cve-cve-2008-1447
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2008-07-08.
raw, 1 files with SHA256SUMS
cveawg-api.json 4025bae38315c16e5ac26105365646c67c4bce58937a187a627274f023ff1501
CVE Program (cveawg API) · cve · primary · captured · published 2012-05-11T10:00:00.000Z · added by claude-story-site · cve-cve-2012-1823
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2012-05-11.
raw, 1 files with SHA256SUMS
cveawg-api.json fc02a593375ecc025b00f8c4ba49d3227cae19c5ed0c9b78f7771362355abdb0
CVE Program (cveawg API) · cve · primary · captured · published 2014-04-07T00:00:00.000Z · added by claude-story-site · cve-cve-2014-0160
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-04-07.
raw, 1 files with SHA256SUMS
cveawg-api.json b0b80e14890433984e302ac8c3e6fe5d1669bcd52dfd8bd52de6945a2d06dff9
CVE Program (cveawg API) · cve · primary · captured · published 2014-09-24T18:00:00.000Z · added by claude-story-site · cve-cve-2014-6271
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2014-09-24.
raw, 1 files with SHA256SUMS
cveawg-api.json 5f9825de68cb0d172329bdc64da9bd93951aae29803454926d4be7d1ac6d609d
CVE Program (cveawg API) · cve · primary · captured · published 2017-03-11T02:11:00.000Z · added by claude-story-site · cve-cve-2017-5638
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2017-03-11.
raw, 1 files with SHA256SUMS
cveawg-api.json 525b90b7605a6c18ccd4812dbc70dfdcf7f330374648173e0ade5fcb1e1b8d38
CVE Program (cveawg API) · cve · primary · captured · published 2019-10-28T14:19:04.252Z · added by claude-story-site · cve-cve-2019-11043
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2019-10-28.
raw, 1 files with SHA256SUMS
cveawg-api.json e32115c5b48bca1c90fab5a125d64f9067e728bb3ac6e13939ee0886d267e526
CVE Program (cveawg API) · cve · primary · captured · published 2021-12-10T00:00:00.000Z · added by claude-story-site · cve-cve-2021-44228
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2021-12-10.
raw, 1 files with SHA256SUMS
cveawg-api.json cae2ad45ea2739a59680c360555a538019b8f46199c797aed96fba49c073aa89
CVE Program (cveawg API) · cve · primary · captured · published 2022-04-01T22:17:30.000Z · added by claude-story-site · cve-cve-2022-22965
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2022-04-01.
raw, 1 files with SHA256SUMS
cveawg-api.json b38ff19768aa5757d264340669a3c06e4a78e5e2014c813bc509d052e2f267f3
CVE Program (cveawg API) · cve · primary · captured · published 2023-06-02T00:00:00.000Z · added by claude-story-site · cve-cve-2023-34362
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2023-06-02.
raw, 1 files with SHA256SUMS
cveawg-api.json feae1a77086ce7533526a0f9d24afb4c67917deb3363569795ea4bbc57b2abbf
CVE Program (cveawg API) · cve · primary · captured · published 2024-06-09T19:42:36.464Z · added by claude-story-site · cve-cve-2024-4577
Historical comparator for the context page: the CVE record JSON, fetched 22 Oct 2026 with curl; SHA256SUMS in raw/. Published 2024-06-09.
raw, 1 files with SHA256SUMS
cveawg-api.json e8cc1b1dcd1a3333776e9a0f08cd4543bc662e0ee60fc094bda0820f84b114eb
CVE Program (CNA: PHP Group) · cve · primary · captured · published 2026-10-21T13:48:34.845Z · added by collector-primary · cve-cve-2026-109618
CVE record JSON in raw/ (cveawg API). dateReserved 2026-10-12T21:03:58Z, datePublished 2026-10-21T13:48:34Z, dateUpdated 2026-10-21T16:07:52Z at fetch. CISA ADP SSVC at 14:34Z: Exploitation none, Automatable no, Technical Impact total.
capture 20261022T081218Z · HTTP 200 · https://www.cve.org/CVERecord?id=CVE-2026-109618
headers.json 58be2c1dc484c3910605b35d9e612014fc4b6e0c9de9f605d6286d788fde6c7a 1,500 bytespage.html a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50 880 bytesprovenance.json adc09f106ba451478b387bb819c13df4cc15e0ac6f7ab6507a24175c8cc75458 952 bytesrendered.html 37b9582087865e1776a98adadf13b2fd1cda169569affa0d7e113500697e5edb 146,271 bytesscreenshot.png bfb16ac90b930eabd692ee995fc41e848022b6b3ad486b96eaab255d08553229 341,195 bytestext.txt f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b 3,115 bytes
raw, 1 files with SHA256SUMS
cveawg-api.json f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1
CVE Program (CNA: PHP Group) · cve · primary · captured · published 2026-10-21T13:54:43.866Z · added by collector-primary · cve-cve-2026-109619
CVE record JSON in raw/. dateReserved 2026-10-12T21:04:00Z, datePublished 2026-10-21T13:54:43Z, dateUpdated 2026-10-22T08:09:24Z (updated minutes before our fetch; CVE Program container lists oss-security refs incl. 22/2). CISA ADP SSVC: Exploitation none.
capture 20261022T081219Z · HTTP 200 · https://www.cve.org/CVERecord?id=CVE-2026-109619
headers.json 03c46200ee6c4d6c0d0a06fdaae6fb0a376986fa48431cdc5543e5ae073ca8f7 1,500 bytespage.html a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50 880 bytesprovenance.json 7de30cfb3eb2de89b08dcd062e6eee6c14efb0710ba248992dd2c1e2d3636335 952 bytesrendered.html 83e446fe17d5717ad7f281973b506b4ba9e19b1b7cec8a4687132cd84419c71f 150,334 bytesscreenshot.png ae02d0aca995d93891d5bc181141c569b6b465a32272d727709884750ecdb50b 367,927 bytestext.txt 3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5 3,351 bytes
raw, 1 files with SHA256SUMS
cveawg-api.json d045248b93425b1a6f5a0fc29ae36b5cfcd3c8188d969664a0d8e5f82ff05f61
CybelAngel · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · cybelangel-php2shell
Vendor explainer; Cloudflare CTO 07:43 UTC early attacks; Aikido reporting exploitation.
capture 20261022T112625Z · HTTP 200 · https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
headers.json 434967eca3ae83ed546f2b8d4839eeb91ca1b11c8740be1e1e1f3864d5e4f809 1,530 bytespage.html 842333792c959891233e6290ecc0857bfd361fbc9dfb4b377a8325657855a025 169,382 bytesprovenance.json d2e13e8d5bd7b15ee078cbe727f55708366293caa3c4a68445ce1fbd5e206201 1,070 bytesrendered.html 538f2982edeb0859af905cbcf0dc02f6899dcd997e9a7245917ad53e04faa993 174,398 bytesscreenshot.png 64c9ca6ef1602bd645b956fe272f9fcb7d3d50ec0f24b4af5b980edfc9e424d5 1,631,217 bytestext.txt 4ffc5347bfe22fb45007c6d0d169a6cdff75522822604e9d8e0e421fda4e2f27 12,396 bytes
The Cyber Express · news · secondary · captured · published 2026-10-21 · added by claude-story-site · cyberexpress-php2shell-gov-sites
Secondary: Wikimedia quote; government sites hit.
capture 20261022T112646Z · HTTP 200 · https://thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/
headers.json 12ba694e03c07c68e519eee401b1f3c26bbbf5e314d5681dd8dee8202a9ddc2b 1,486 bytespage.html 58d2d840bcff4c80b422282f8358fded7d8d4a8a0ae0005b66dd7ce51049222d 567,233 bytesprovenance.json b259cfb46f07df0edf091ae5b56f255c93846d9656a80d9adbe65e6aa496349f 1,017 bytesrendered.html ed8d3c7588accfa0810ec2d054a01b00bf1c8783e9100bc6f46557783e623fa5 598,469 bytesscreenshot.png d80c357eed47fd016ffe1e5a7866573916c9044f011f6e0e3c7b2487c93d296a 18,579,851 bytestext.txt f45bc7599367343e65c9a0d202d909990a7a802e526f44362042e0de16cf20a6 14,589 bytes
Cybernews · news · secondary · captured · published 2026-10-22 · added by claude-story-site · cybernews-php2shell-millions
Secondary: Cloudflare and Amazon warnings; millions of attempts.
capture 20261022T112703Z · HTTP 200 · https://cybernews.com/security/php2shell-wordpress-amazon-cloudflare-ai-cyberattacks/
headers.json 6be6626f1e9d0a6627adcf4b3cfe7e0e3fbc8107a1ef9772318e3b2f95ccfc6b 2,119 bytespage.html c66a7d30501a36b114a61e46813ab2e0d7ec2dfa4d5fb106f8c5a9ff50ef69b6 264,681 bytesprovenance.json fd6fc60ea011e77252fb66fb924fa6ded42288362364dea1c51a872c9f0a80d3 1,087 bytesrendered.html 396bc3073c8b12fb2dc2ed624d0f38b6fc6dbf885f976267d2e1c0b5b47ef108 268,472 bytesscreenshot.png 4593aadc41abb1ffd9875242e346506becf26679a960c352c74a1b52d2c5f956 2,513,246 bytestext.txt a5ebfc60c25fe8b2c4cf59d2c2b9019703ef75d77de84f502e27df28ea891ceb 7,502 bytes
Dark Reading · news · secondary · captured · published 2026-10-21 · added by claude-story-site · darkreading-php2shell-red-alert
Secondary coverage.
capture 20261022T112357Z · HTTP 200 · https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
headers.json 285a1d8359a3246821411a25457fe0ebe5714a3f3b64d2b0d9594549c5e28ee8 1,005 bytespage.html 6a65a719cc37abf4198febfdb8afedb400656bbab8a87ecbf7979436acde2db7 451,026 bytesprovenance.json 0f49ff38cf40ae508792e69a36322fd852a90a413670686eb09c7abc3bab0e2a 1,078 bytesrendered.html 94b8a23834d88b4202c8131505e4bb6abb7c27095cd873031af7f721a4d155f3 470,067 bytesscreenshot.png 2672b1f34bea1f587b758b2d846512d528d66179b9c6267f491669fb7287326e 2,410,017 bytestext.txt 6db30e279f5f38773c58ae71e0d753d7a7f90fcf4148ea65658c2f967de7f32d 10,175 bytes
Alexandre Daubois (PHP security team / PHP Foundation) · researcher · secondary · captured · published 2026-10-21 · added by collector-researchers · daubois-blog-php2shell-rumors
Personal blog of a PHP Foundation contractor on the PHP security team, dated 21 OCT 2026. Describes anonymous HN post Oct 20, leaked 'PHP2Shell tool' screenshot credited to Calif.IO, the short exploitation video, and watchTowr confirming the CVEs publicly. Gives GHSA advisory opened 2026-08-27 credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion.
capture 20261022T081256Z · HTTP 200 · https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/
headers.json 7f4da02c6bd4388f7475aed4c30ba66fbfd5e93f9e9b69537b21005081745afa 1,049 bytespage.html 8f85e508b569e07d58f4ab54611fc7bb886c13f58b8c0448198f44899bf54d10 22,135 bytesprovenance.json c86d302cfb9e3442fe758ce082c1015c8500db089f7e8350402efbd4b259241d 1,046 bytesrendered.html 8bc8f77f0b030a431c17cfb6048a516fae5d743bcf9af1d571e1a377dbe77fbd 21,926 bytesscreenshot.png c86032b5d2ce179ae664684fe600ba45c0b3ff7003c835716b5cce042a13e514 817,325 bytestext.txt 5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8 8,821 bytes
Dutch IT Leaders · news · secondary · blocked · published 2026-10-21 · added by claude-story-site · dutchitleaders-websites-offline
Dutch: various websites offline over the PHP flaws.
capture 20261022T112724Z · HTTP 403 · https://www.dutchitleaders.nl/news/763189/diverse-websites-offline-door-kritieke-kwetsbaarheden-in-php
headers.json 3d4ed9c4a01097923a5877669d569d5ef394a8cdbe10aac65675668a31143782 1,537 bytespage.html 15b89d416c1e20625b50003213b1a4360e6045761598fec254652a1b5f3873b8 6,469 bytesprovenance.json 8cea400474f5ccc7e7b350c5c9cf809ccb654b95894cae6c78613d5ff0c04d1e 1,061 bytesrendered.html 2f12251c8ab3b803be5a1123525fe94ec19fd2e3ad6daa9bab26759a181be3fe 7,234 bytesscreenshot.png 1e7419104eee208b5ba0cc5f6696749ef060e1608266268dffcbd5d925e8f5ad 20,501 bytestext.txt 28f6003be69e3a9719618a62764a55d30d9d28570363ffd8126d1ef0f32a5803 75 bytes
East Anglian Daily Times (PA) · news · secondary · captured · published 2026-10-21 · added by claude-story-site · eadt-minister-budget-no-breach
A minister: no breach of Budget security after the OBR site was affected.
capture 20261022T112742Z · HTTP 200 · https://www.eadt.co.uk/news/national/26659279.no-breach-budget-security-critical-flaw-found-php-minister-says/
headers.json 4262ef46e445ece7b451c5d9768be9e2c72be47dd23270284566f23c6429c24b 925 bytespage.html 47c1d48da4a78b3172325945c56a5b1bbbdd826cc02ad5b208f097d735b8deb9 291,406 bytesprovenance.json b59efe28603612dd036d6a98ba25b7b39db79e7b4739b163b239131955e26cc7 1,163 bytesrendered.html 790f7f3108d2c3fc28b38ccd146871560b9b62412b719911f578da424f7d70df 451,816 bytesscreenshot.png 5079181e1c5eb09fb0b82305b4599b7b3767e0da3fdd0263cb2fc25a3cd8c349 1,490,164 bytestext.txt 4c8556b5aaedee9f059a9862338d94d85df76b55d648396c2a7f964507cda4dc 7,475 bytes
ENISA / EU CSIRTs Network (CNW) · advisory · primary · captured · published 2026-10-21 · added by collector-gov · enisa-cnw-2026-04-php
EU CSIRTs Network index of national advisories (date 21-October-2026). Lists ~30 national CSIRT alert links. The 'Mitigation' field still holds unfilled template text. The title has a typo: 'CVE-2026-10961'. curl got 403 from GitHub; Playwright got 200.
capture 20261022T081329Z · HTTP 200 · https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md
headers.json 4fddd3b1827235c9608b8a4c92566f15c7fde3ea496d7a74061d64b18fdd4072 5,637 bytespage.html 212f41dffb19edf392212f2ec2997428225cc9da6dbbcf1361dffc30f3ac163f 252,581 bytesprovenance.json ce33999aec2752cab53039232bb4a7da90a38f090b374d68f470a0f9c78f4c7a 1,052 bytesrendered.html 3d40c318822605660674e8a69d6a51d523c3df892b77cd2ccf520e51bb9ad552 295,999 bytesscreenshot.png 0b9c0e94049921b40590086857c547bc0dea05461fad30201388de32c3f35c8e 451,547 bytestext.txt dfcaa1afe1c4194c00ff2dc38b4fab496a900ce9b4e770a722b4bae96b886093 3,930 bytes
Equixly · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · equixly-php2shell-what-we-know
Vendor explainer listing exploitation as disputed and KEV as not listing the CVEs.
capture 20261022T112832Z · HTTP 200 · https://equixly.com/blog/2026/10/21/cve-2026-109618-and-cve-2026-109619-what-we-know-about-php2shell-and-how-to-prepare/
headers.json f7cf1d20d42b031e13757abae43ca1755e99a6e9bb3c4924d4b4d4a220ecc177 916 bytespage.html 850a5ee9c4cc603f0e67b5b759b07fd4fa2a58589e3a5ca3c118bb52bb137f1e 69,255 bytesprovenance.json 9e7737082f0e4348bffb9bbee063d4618149ca26ce04c93ad349a82de0747038 1,174 bytesrendered.html 5f9daf95daffe64c7e40e58452326ecada0b2a45839cc411b569ccd3d8aa0152 137,760 bytesscreenshot.png 4ff3a6bf1cf643f1beaea2676b32f6a8763bd97a1c958c2647e3613fdd247fde 2,260,486 bytestext.txt 34bf72d02f14deb9d0a164cd5ae8b59901f640461fa00f170fb618d727ce337c 14,172 bytes
Fastly · vendor · primary · captured · published 2026-10-21 · added by claude-story-site · fastly-blog-php2shell
Candid on exploitability (PoCs need the binary's layout on x86_64; 32-bit assume compromise), on WAF limits, on signals (segfault bursts, workers spawning /bin/sh) and on more bailout paths to come.
capture 20261022T111906Z · HTTP 200 · https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618
headers.json 6756cb0315f3eede874eb6e0c7c5bf69e9530954bc546eed72665c7d035f47a4 1,049 bytespage.html 811a842d39ce55fe1b7b9ef1e35c767deadda63bbf07044ac6d848812045d8fa 164,855 bytesprovenance.json ea10f0c918a09cb23072d0099d2a206b10c844041a8649ce45f3446a7229ccec 1,117 bytesrendered.html beb13bda9a79b867d0b11deda470a987cd8f76186e6af59cb63333eb6d426839 327,821 bytesscreenshot.png 259708a035d74a2d833a8fe3a555097ecee5678d854a5e5357b94bf20566b7e4 2,470,515 bytestext.txt bacf27615fe1180a00a1b2085b55ead30ce7e828eca5a4aa47c46d0c5808913f 20,043 bytes
Fortinet Community (FortiWeb knowledge base) · vendor · primary · captured · published 2026-10-22T07:55 (article time, timezone not stated) · added by claude-story-site · fortinet-fortiweb-php2shell
FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.
capture 20261022T112039Z · HTTP 200 · https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750
headers.json a0454c866ef8c53658075dd181e88a1d6f0387b633b7e59fcf740b5254c0e7d0 823 bytespage.html d5bc4f5c0a9b665b7bdc4d37c6adebfca47aaab1f93795c3a0551393e25a2531 789,605 bytesprovenance.json ddfff2dafe3e00768857136f2f89239b03664e07eaf4a3282e1552b2b1d65ec1 1,150 bytesrendered.html 2d8aabfc30d2116425651b788f2c8e4d58122738b69721391022332ab628815b 1,208,805 bytesscreenshot.png 03a275af997e6093c4700503437ee405b77df000307b546eda109ddb0f40acff 826,331 bytestext.txt 66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4 6,244 bytes
Blevene (GitHub gist) · code · secondary · captured · published 2026-10-21 · added by claude-story-site · gist-blevene-detection-guide
The most detailed detection guide found: verified ModSecurity tripwire on the upload-progress field, Sigma rules for the arm-phase fatal ('in Unknown on line 0'), FPM segfault correlation, Falco worker-exec rules, and the arm/fire success receipt in the access log.
capture 20261022T112029Z · HTTP 200 · https://gist.github.com/Blevene/472692937d05145d29d17dc3c6edc2a0
headers.json e515879745065efa3f6d82ddfddf934b4dd0528d08c9cd4686517a7909ad53a9 5,398 bytespage.html 638f078193990b68d231d7f9d70c8090f0fa5ea1c6f17144ce040e86005b0e0e 172,916 bytesprovenance.json b55dcda494ff7fa675bdade5d18cd9c720a7f4c91f3c8902067bb528fe41a621 1,010 bytesrendered.html e632d2722b6bc2f11dae20c788c7c087967ff8b1617f9e49874b67f34f3ccbc7 171,073 bytesscreenshot.png 40cb4bc63512079ac9f9922051f970143f708fe8f10a7839fdf8f3a8cebe109d 2,916,589 bytestext.txt e87c134fef2ac6dadce17cc4b2ede04888da65e4c1939814c3e2acc5683ddb81 28,797 bytes
Silas Cutler (GitHub gist) · code · secondary · captured · published not stated · added by claude-story-site · gist-silascutler-censys-query
A Censys query for php2shell exposure.
capture 20261022T112841Z · HTTP 200 · https://gist.github.com/silascutler/c7f04537a79ace89569f979d964af0f9
headers.json 07517141f85eb8c967f82ff329f3ec582d07ba06c068b4f69137e6f1b1bbc2bd 5,405 bytespage.html 6efd8ea91d0aeff2abdb43f40fb4a5695eacdbc5720b7a18c6746858dc3e2b89 126,486 bytesprovenance.json bfd64368239f0a7cf7a26eac489eda86effc8c0e4c6b09653d8eaa7a838bc2aa 1,044 bytesrendered.html d31d94a0e67d4acc2f75d4548fd7bc98b0259d143eb16ec35ff1181b6f3fc0c6 124,729 bytesscreenshot.png fdcd80585ae0e06e894d974485b23ecf187fa65cc7195ccf17f13486b9c5782a 122,357 bytestext.txt 5cea858eacc35a20d7943cf8334baad5fa8b37ed7f19ecbf3416f489935edd49 1,361 bytes
darkfibr (Mike Haddock), GitHub · code · secondary · captured · published 2026-10-21 · added by claude-story-site · github-darkfibr-php2shell-detect
Community detection toolkit: Suricata/Snort rules keyed on request shape (upload-progress field + many array parts), YARA for the public PoC, estate checker.
capture 20261022T111956Z · HTTP 200 · https://github.com/darkfibr/php2shell-detect
headers.json 0032162778e9e13e6056d409874d38d891d76817b61b685b8cac6978d0946ff1 5,443 bytespage.html 47a54e3191d2665698e13d8dd3b157f63a32f0565ae7755ea8bfb9634774ac91 287,088 bytesprovenance.json 1d8350230abbd90feb1f18d64a3d02b15f7b35d71914d26d2207c18cb626d091 1,143 bytesrendered.html e0597533f94146958614e519387471deb149af84b19ea359e01dbd50d4dddbcf 305,777 bytesscreenshot.png eb849fd1179b14a53199521fd46cca0b26c498292d2553acc0d976e79b0e03a7 748,563 bytestext.txt 3592ec9f3bb73cd3a91f3fd0c698fb45375984c5c0326bbcb4f7f7c36b2b8f73 7,156 bytes
PHP (php/php-src GitHub security advisory, published by bukka) · advisory · primary · captured · published 2026-10-21T13:34:13Z · added by collector-primary · github-ghsa-6wmf-4rv5-p3rp
CVSS v4 9.2, same vector as 109618. Use-after-free of worker global state across requests. Confirmed RCE mod_php (PHP 8.5 fatal_error_backtraces path) and session upload progress path on mod_php and FPM. GitHub API blocked; timestamp from page.
capture 20261022T080901Z · HTTP 200 · https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
headers.json 9474439a8ed75c50ba02584a2c67a564bf208b0caa8b2aefe0d7d2704e46c263 5,440 bytespage.html 93ff984c03081442f47f1c338683875fabf1741564d711e2a3862d71cef29fdd 221,023 bytesprovenance.json ab199ddc3636b44804bf4b7da3949fe9d22f000959f8fc04c7f00eb3e416a0bb 1,039 bytesrendered.html 89eb250785b0066130856745323cc48cd37a515b3264c10da91dfee64deb45cb 222,855 bytesscreenshot.png bb279a6b633c6e9d1de5a4778673aa4b3ed7dc5e1a1d9f08a3ba27c30f99820a 1,024,722 bytestext.txt 99d85c973c41c0242c944f052d5f13beee1b0e381b83f8f89416c986099db4fc 13,502 bytes
PHP (php/php-src GitHub security advisory, published by bukka) · advisory · primary · captured · published 2026-10-21T13:34:25Z · added by collector-primary · github-ghsa-w8hw-w9fx-j79w
CVSS v4 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Affected <8.2.35, <8.3.36, <8.4.27, <8.5.12. CWE-416/755/824/1325/1419. GitHub REST API was blocked for this session (repo not attached), so no JSON; timestamp from the page's relative-time element.
capture 20261022T080901Z · HTTP 200 · https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
headers.json a5b68bac81984833a0df448856c563c0abaaf285f4eac25b6fc9a01c0b4d705f 5,447 bytespage.html f429f17d81fee9dced4234a3f88772e1a7fdb87170b5bf5e3c6a016758b2a14e 212,571 bytesprovenance.json bb24fb081f4677b9fb91aac8bf728da3b708aec4d694572ccf432df9c0e5162b 1,035 bytesrendered.html 79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110 214,403 bytesscreenshot.png 4e10459ced9f68c1f9fb25ce9f8c603fad05b9e1981b2b9de3c10c16ade86d77 535,897 bytestext.txt 84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4 6,692 bytes
Lexsah, GitHub · code · secondary · captured · published 2026-10-21 · added by claude-story-site · github-lexsah-php2shell-detection
Blue-team rules (YARA, Sigma, Suricata SIDs 910961801-803, ModSecurity, Falco, auditd) and the server-level session.upload_progress.enabled=Off mitigation.
capture 20261022T112009Z · HTTP 200 · https://github.com/Lexsah/php2shell-detection
headers.json 25e99ec6775270a84bcecf5a232634c2e640ef9246b469967311c1240df22dd7 5,436 bytespage.html 6151205973ed45a3e00af67742bf708f8d42f4caf1171c1b5671e024b730bdbb 288,052 bytesprovenance.json 2560ba2b32e6f1ea7e5feb0e81a7b6db2855392524862a91661362e6410175ca 1,077 bytesrendered.html 14e642e4e762e427c9bd8be65bfd45e0d8e2a3289c65ab7c197e197cc9077a66 301,999 bytesscreenshot.png c5300a3f00d8c04d057f920a6e8ceb48282544a99c967bd855027483a7a4ffc9 779,281 bytestext.txt 10b6edf13054c98d5da298e7bdc04a654d2e0a7fa7fa820047a7996a4887c25e 7,136 bytes
php/php-src on GitHub · code · primary · captured · published 2026-10-18T18:10:24Z · added by collector-primary · github-php-src-branch-7.4-backport
Unofficial minimal source backport for EOL 7.4. '1 commit ahead of ... master'; latest commit 'Avoid state corruption via bailout', commit date 2026-10-18T18:10:24Z. The 8.0 and 8.1 branches are not captured (same naming pattern).
capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
headers.json a849a6e452711b855043ae9fe1fd0982b11d14633681acc628fa56e60ceb8323 5,439 bytespage.html 04dcda73bc626ce33da19b196795fd7c00b63b030f9fd6a530acedcbbe4f2b77 363,416 bytesprovenance.json b879f4cb8fe1d72fc30175af0e12496f9df0b4e09ce90b1de15b99d1e8ed29fc 1,040 bytesrendered.html f6eba14e4661be71a25a3f70b5e988478a727cc6ea78f657fe86284d54d727fd 412,706 bytesscreenshot.png 6a7c4e4d30f1cb137b32490feb57c7053ca293f0f59d4aada14082309c525f0a 759,378 bytestext.txt bd71e98ee89b7c6ca97f0ec6029e0200f86d26f2528387a96c99ac93ea63dc1f 6,550 bytes
php/php-src (git), read from a clone · code · primary · captured · published 2026-10-18T15:26:39Z (authored); 2026-10-21T14:06:22Z (committed) · added by claude-story-site · github-php-src-fix-commit-3584a98bd
git show output of the fix commit (stat, file list, engine/main/session hunks), the 7.4 backport commit and patch, and the merge path to PHP-8.5, from a shallow clone made 22 Oct 2026. SHA256SUMS in raw/. 389 files, +10689/-976; authors Arnaud Le Blanc with Ilija Tovilo, Jakub Zelenka, Nora Dossche, Nicolas Grekas.
raw, 7 files with SHA256SUMS
commit-3584a98bd.NEWS.diff e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855commit-3584a98bd.engine-main-session.patch 26bed812bcc7c89ea684f52d0a2e2a09f7bf516296f31b7065387c3c85013d84commit-3584a98bd.files.txt d9b8465ccfbd22fa5bcd5f1a8c58c11b4af70befe488051f843fd4f45bf559b5commit-3584a98bd.stat.txt 0d696e59634f83a4040532d4c6e4ac9cb5319e1c6e81ac2c76f3b7e9257f2b4bcommit-712e60f9e-PHP-7.4-backport.patch 307e49f52c4f3829e75ce82697b81c6ab771deb7ce0c8ce961159e40026866dacommit-712e60f9e-PHP-7.4-backport.stat.txt 7f5e6289ca2d1a14b2be78ca230e2077f3d5f695bb9d52087773e3df2633e7f0merge-path-3584a98bd-to-PHP-8.5.txt 81c3025511c2f4744d1fcbe1d18fe7da97cfd68b005a6a883efc229a3c91193f
php/php-src on GitHub (release by adoy) · code · primary · captured · published 2026-10-21T14:06:46Z · added by collector-primary · github-php-src-tag-php-8.5.12
GitHub release published 2026-10-21T14:06:46Z by adoy; tag object 2026-10-21 13:35:38 UTC; tagged commit dated 2026-10-19T17:04:37Z.
capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/releases/tag/php-8.5.12
headers.json 5c5686f2496a1b93d144afdd699626ee85dc4af2813a242dbf615446ddb664eb 5,448 bytespage.html 67ce23eedb690c74470175cf0a56c7a573cbd02ec5f27120c3ced5d05fa5eb3b 207,502 bytesprovenance.json 8e480c6bdb33a1d5e82ddf99493ac5149329b2ab40d2fe95c088ba4b9672832a 990 bytesrendered.html 330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa 214,534 bytesscreenshot.png ca5cc2bad8c65a0a5325554ef804f2b83d3fc7a4b7e9c2750dfd7047e564208c 123,213 bytestext.txt 3fa0b4ca147ee06698f340ee959bf381aee7c0fda597bd687ff1f128f4978799 1,184 bytes
php/php-src on GitHub · code · primary · captured · published not stated · added by collector-primary · github-php-src-tags
Tags php-8.5.12, php-8.4.27, php-8.3.36, php-8.2.35 all show 'Verified' and tag dates of 2026-10-21 13:35:38 UTC; php-8.6.0RC4 at 14:57:44 UTC. php-8.5.12RC1 and php-8.4.27RC1 tags also exist.
capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/tags
headers.json c1e8341353ae8ccbb1b8406734139fd6ade271a8ecb16de19cc396443719b543 5,449 bytespage.html 9dd05842513d6ae6569812a9aad0f4abef35733b14f8515c3b86b3d1fac53d49 279,656 bytesprovenance.json fb3a77d83afa6bbbffbf5b0dba33cf24208559ef6dafc50b4fe37998fd225316 928 bytesrendered.html ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9 281,310 bytesscreenshot.png 9208f3cecdd6dd08a577e0172d3a114ac84322533de8e95591e5b0694b085eda 125,085 bytestext.txt 850531b6512cfe4d37a2bb6b7fdcd37ec9cbb42ed6ceea172d081be054e28c61 924 bytes
rjmendez, GitHub · code · secondary · captured · published 2026-10-21 · added by claude-story-site · github-rjmendez-phpup-2026
Detection rules rewritten on 21 Oct after a lab reproduction showed the leaked PoC's mechanism did not match the fix; cites VulnCheck: none of the public PoCs has the correct mechanism.
capture 20261022T112003Z · HTTP 200 · https://github.com/rjmendez/phpup-2026
headers.json 582bbe71ccaa5a3323db8d3d2caec68f5af4561fd8b8b29bd932cbea2126e5cf 5,445 bytespage.html e7e78dc79587fcaf7eac2ce0b48d90575d55f6fdb4313b768f0637f7a5d8ff0c 275,240 bytesprovenance.json 7500ba6175c9e2f09a379b74a283542b6e7e4e637714a2006f0e68a86c44b348 1,048 bytesrendered.html 7bb4a810ad56f4620b7e1f2b14591c31b935a76a017c72cae93435ef05b8d088 302,107 bytesscreenshot.png a69607bd90cb0667ecdd5ab2e0191ae6c1534b599824084514dbcc1055712cde 940,580 bytestext.txt 84742b6e86fb259d4db36361e86d4b739c6cd09184337f365f5e2958271f5379 9,221 bytes
Helsinki Times · news · secondary · captured · published 2026-10-21 · added by claude-story-site · helsinkitimes-finland-shutdown
Valtori began restricting incoming public traffic at 12:45 local; patch scheduled 17:00 Finnish time; restore after checks.
capture 20261022T112845Z · HTTP 200 · https://www.helsinkitimes.fi/finland/finland-news/domestic/29412-government-websites-shut-down-in-finland-over-critical-security-flaws.html
headers.json 8cfe23a4571454de0ce2c8804eef8e57888689f139258fc400bc4074345e22c4 1,424 bytespage.html aae25312014733334061a2a0cedc5e7a800cfd4d711717e78fe9f492a1923fb1 74,712 bytesprovenance.json 616d5f35071adec7fda82e308c994ebebbe96580f9f0d09c2ca595e95eca3565 1,204 bytesrendered.html 86c43a2ba4b2b595bc14316aefdf8f5d08736e778a980690075033168a6258ec 155,636 bytesscreenshot.png 9c23d876698ad3081c6ac7846ed601a071d01e5b57de834755b1ef846cc2d26a 701,429 bytestext.txt 524315badf6e56339623c59b54db482dffa48d62583a026e7134dae4bb30d118 6,660 bytes
Huntress · vendor · primary · captured · published 2026-10-21 · added by claude-story-site · huntress-php2shell-rapid-response
As of 16:30 ET (20:30 UTC) 21 Oct: no exploitation observed on partner systems; no PoC built or reproduced; not aware of public exploit code.
capture 20261022T112853Z · HTTP 200 · https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
headers.json 39dd8f8ed13d1e993a95f88bddf69702d0cd23e3aef38da50d65068f495d1cff 7,379 bytespage.html 39d79180c85ccbc63f3acbf3bb0f076d56933f94e5fa8a5be8dafc3ca3160c7a 913,455 bytesprovenance.json 23031a4937921ef79d80fb4b2546b9d7054028e640b9babec2c44d9f66dee0a2 1,102 bytesrendered.html 41e5af59038a7155953c6809d743ca579e2eeb7cdc503f13f6e3550ea920d970 1,115,188 bytesscreenshot.png a4d89c5787921c4fe23ea13f25dc2d0104756a669450c44aad83ad220d9bc3a7 1,862,920 bytestext.txt a83d744768109a61f623c0d4de5df589cde5c1e0da114b25d62a7321f159455c 17,843 bytes
Imperva Threat Research (Nadav Avital, Bar Menachem) · vendor · primary · captured · published 2026-10-21 · added by claude-story-site · imperva-blog-php2shell
Five demonstrated techniques, three via session upload progress; attack complexity high; ~67 KB memory disclosure; no matching traffic in pre-disclosure monitoring; '69% of websites whose server-side language is known'.
capture 20261022T111855Z · HTTP 200 · https://www.imperva.com/blog/php2shell-vulnerability-updates/
headers.json fa04ad94125d615ccc22bfe0f44544c8737419ff06a9d85acf2e5e4776931849 3,102 bytespage.html b659e89f8fb17c9833c2b8d60454655d038e41bd867043684aff25984c3bf6e2 243,832 bytesprovenance.json a2f25ae502d617f41375750794a46ff83e8a433361944da98d0daab48bd962ec 1,022 bytesrendered.html cb3120b21b6f0c89f3af549534f6b8ce3e381a19e5c6eecce3ec513cb1d18d5a 301,023 bytesscreenshot.png 1f96ba16ce949cfd1d6f4051df3dd2b7910754612bb6fae060c14d96950f9c9e 1,932,384 bytestext.txt 3da873bdb21219a616245663c1c5bfccb9d8d5db507092c70bb2c20519e031e4 15,842 bytes
Insurance Business (Matthew Sellers) · news · secondary · captured · published 2026-10-21 · added by claude-story-site · insurancebusiness-uk-councils-met
Edinburgh and Oxford councils and the Met Police unavailable; Bristol, Lambeth and Barnet errors; Dutch NCSC offline; Valtori; Cloudflare CTO 'STOPGAP only'; Unit 42 22.6 million systems; W3Techs Aug 2026 ~70%.
capture 20261022T112225Z · HTTP 200 · https://www.insurancebusinessmag.com/uk/news/cyber/uk-councils-and-met-police-among-sites-pulled-offline-after-ncsc-alert-594424.aspx
headers.json 3d07c50bb43d9b0530e97433ee53da60ac0afc3cb28ee547618e5cce5e68d8d0 1,370 bytespage.html 3cf31852fd2bdd575e2b3cb127faa507e947fbd823c16befeaca3901daa676a4 223,253 bytesprovenance.json 3d2dc87a1364e14f154fb92ea66b98c53bcf8b335f6ab4488be62bf869fe6071 1,200 bytesrendered.html 2db316644de0dc7e608587a786f6571e83708d928733ae4a8a227c5b31f3b1cd 400,028 bytesscreenshot.png 143c99a16e7b571c7069d3cc0b3396802d75971d4ec8a883b902db2b02a15061 2,153,476 bytestext.txt 89357150e0bc8363b71ef8b709b7e047e0503f20791d7d062a758550609d0d20 7,188 bytes
ITdaily (Jens Jonkers) · news · secondary · captured · published 2026-10-22T09:36 (local, Belgium) · added by claude-story-site · itdaily-php-clumsy-announcement
Secondary: the Foundation 'caught off guard'; 'aware for two years of at least one vulnerability'; Ecosystem Security Team since May 2026; a VUB professor on the disclosure window.
capture 20261022T112142Z · HTTP 200 · https://itdaily.com/blogs/software/php-angry-clumsy-announcement/
headers.json 9c96a4285eed59d7470a9a983facb2964a82b6539cf0dd85887c0cb4b2fb0740 606 bytespage.html c93c7d6384ee8c4a47a08e5ac9e9aa9dc1d96089fc05044a194b1220e7c9d4ed 130,955 bytesprovenance.json ebec1bc848714c197d387275d82b755dbb12649df06083c9d18633217827d2a5 1,049 bytesrendered.html b634233f4e687df8538e68d9f0af3af145ab15dc5bbe966f7a1457f2350eaf4a 134,246 bytesscreenshot.png 5a11124ea720acd8ae8b3af6b0df0a3925b72abfa059d3db627464c578ae2700 1,036,421 bytestext.txt 27772c396e4bd60e2e200b2ba8db0273291060cad355f3927bdcd0ee9c2aa7ad 6,719 bytes
JPCERT/CC (Japan) · advisory · primary · captured · published 2026-10-22 · added by collector-gov · jpcert-at260033
JPCERT-AT-2026-0033, published 2026-10-22, updated 2026-10-22 (wording fix in section V). Advice: apply fixed versions promptly 'after sufficient testing' and investigate for compromise. No offline advice. Says PHP is widely used in Japan. JVN entry also listed 2026-10-22 14:20 JST.
capture 20261022T081700Z · HTTP 200 · https://www.jpcert.or.jp/at/2026/at260033.html
headers.json cbc1e287bde3882e41d91bfa7315dcbaccf9a996c0a383acc62f9095fbe921eb 605 bytespage.html 85db7a09e865158643525fef5aa5cfc69513aaf896fcb2da4562189d43decf44 31,008 bytesprovenance.json 4ba4d01fa5ebe5235184ed530cedbac6cd8985446a10845775da38efa45aa5b9 1,013 bytesrendered.html c4ba52d8393f4189aade005389d1b8c2923eeb29f0d917a7221b5330cff3bf91 30,690 bytesscreenshot.png 99789e60674ab7b0d3f01afbc2012337348a1434417d4820d6c89133f2d6ff64 722,717 bytestext.txt 1fea87241b307f92c5ddc2b16356954d947ec3e0f5ad55158315dc08d98127f5 8,327 bytes
JPCERT/CC · government · secondary · captured · published not stated · added by collector-gov · jpcert-home
Home page at 08:16Z: the PHP alert (2026-10-22) and a JVN item at 2026-10-22 14:20.
capture 20261022T081606Z · HTTP 200 · https://www.jpcert.or.jp/
headers.json ffa0d53fc7fd1c2d4339dd045991caa54d31c4515face33fcad2b50bfbfdb00f 605 bytespage.html 07612f480101608a837f0a0dfff30db2d1f5091eabb55fe048bf6546979e25f7 31,630 bytesprovenance.json deeeef14fce691e60314064b4efa728667689e9676e5263b880005c0cdcc5ca3 917 bytesrendered.html b41d0ff975f9a0815c4626b027f239c76e939b2070f0e7221fdeef67c9615d21 32,010 bytesscreenshot.png 0870f642b705aeed4116685bb2897f814fff8eb758a665a969b80be60f36dc81 1,483,609 bytestext.txt 0e3188607f06a768281c4dd19a88acecbe0e7fe6b5c20a312e9095a2a498dfba 6,293 bytes
LBC · news · secondary · captured · published 2026-10-21 · added by claude-story-site · lbc-uk-websites-offline
Met Police, The Traitors, government sites offline; fixes 'around 3pm UK time'.
capture 20261022T112915Z · HTTP 200 · https://www.lbc.co.uk/article/uk-internet-outage-php-websites-tech-5HjdkDd_2/
headers.json 61fade0ae97f79d231f97a5777f63b2e81a66ef6baadd7a7099a825dd6c29ef2 971 bytespage.html d4ed63db00e26889d772c2570efda5fb8fa6cce84a1d5826b8876ade8bf939bb 95,257 bytesprovenance.json e04ec30a201ba0f120a5f1c48aafef2c90f871816cde4084454cdc63c5244456 1,094 bytesrendered.html e14de8389551e0d0109667c7b79786b3489c9cfa31c36fac97a71f6cf5398cb7 107,817 bytesscreenshot.png 72e82d8825a1870d48523fc0b7ecfd8f99a8f2f981f64bb572699545b7dfd811 1,602,728 bytestext.txt 125176f10b5494a60744d6f6d3c7918b76c38477c6c229b636fbeb00b3bed173 6,376 bytes
Lorikeet Security · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · lorikeet-php2shell
Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence.
capture 20261022T112438Z · HTTP 200 · https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities
headers.json b7888c7584d4891b481a804cc3243ec9dff82d301a8ac2c7070c6b7f25bd5fe2 1,727 bytespage.html b74c194ddfc61843d47bd6ffa9d691718fab73fa370cf3c82d1cd24ea3f3f998 343,430 bytesprovenance.json 38298cededb4b803f1214bfa4a6a30e1cdf06ddc417f0771577affd057d13e5a 1,123 bytesrendered.html 38608a412a2fb2a979d5821ccb1a9764037d3d2bbad075a509f0d25884973ae5 904,734 bytesscreenshot.png 281038d16371213c89c2ce9df773de5a82e6eac69bdfe5c855e3975b02ac6387 8,419,643 bytestext.txt db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349 37,837 bytes
UK National Cyber Security Centre (NCSC) · advisory · primary · captured · published 2026-10-21 · added by collector-gov · ncsc-news-php
NCSC Alert. Page: PUBLISHED 21 October 2026; JSON-LD dateModified 2026-10-22; HTTP last-modified Thu, 22 Oct 2026 07:30:02 GMT. Names CVE-2026-109618 and CVE-2026-109619. Advice: update; else PHP Foundation temporary mitigations; 'If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.' Wording differs from BBC's quote.
capture 20261022T080903Z · HTTP 200 · https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
headers.json 642ad2462903a32f7050dae5e198654e710dadc0a6225333d96370031c7ede4c 852 bytespage.html 2d8e9e72ec5efa695b2d587a4af1bcb75662ead0add90b964cf767e8023ff4f8 225,168 bytesprovenance.json fe3daad10ed2709f256ce5547b2a21d8b35120fe041248d698a63d75652a19fb 1,025 bytesrendered.html 0b839c8974dc2310cc6f85d334620ae5b5cd944842d6de180bf76938f5b6dcf5 761,056 bytesscreenshot.png 260b9c91a3bf1a838fd1a81633415032eacd24ccaf249c11227903c6038b4544 542,775 bytestext.txt a18ceeb011a3fe6f0311d92399618b5231abb0f57f3b94ffd7371cab6eccc339 5,135 bytes
NCSC-NL · advisory · primary · captured · published not stated · added by collector-gov · ncsc-nl-advisories
Final URL advisories.ncsc.nl/. A banner is still the pre-patch text: 'bereid je voor op patchen', patch expected '21 oktober 16:00 Nederlandse tijd'; 'Er is een publieke Proof of Concept (PoC)- code beschikbaar, maar het NCSC heeft nog geen actief misbruik gesignaleerd.' Affects 'alle versies vanaf versie 5'.
capture 20261022T081605Z · HTTP 200 · https://advisories.ncsc.nl/
headers.json 3e389f62cb8a1de496ebc873bbcfb98ccf729f22e1ec56c94d0893bba1bef324 884 bytespage.html c0c4e5aa82e2eaec26497f7eb201c72888ecdcb1361964f73aab7b5dcc046c5f 240 bytesprovenance.json cd3655ebd5a05e5e7a94cfc0438e17c9f78418f1c570bf5097613f30ba7612ca 980 bytesrendered.html f008b1f5da4c00459105f979db89eebc16702be90d3a6de1656acfab41951cc6 69,813 bytesscreenshot.png 9bd5b7a047aff8b7f81e8c61b6f1ccc1475f7be1ad89a7d9d32a6f2aee84abbe 611,099 bytestext.txt b7e4ac6caf7d177d8b7e55fa8c587da75a1e78fafc951012d2d2595a6dfa5e8b 8,130 bytes
NCSC-NL (Netherlands National Cyber Security Centre) · advisory · primary · captured · published 2026-10-21T15:25:00Z · added by collector-gov · ncsc-nl-php2shell
README: 'Readme last significant change: 21 October 2026 17:25 CEST TLP:CLEAR' (=15:25Z). Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Links to CERT-EU SA 2026-018 and ENISA CNW-2026-04. Holds the software inventory list (the NCSC UK cites it). Does NOT advise taking systems offline.
capture 20261022T080925Z · HTTP 200 · https://github.com/NCSC-NL/php2shell
headers.json dbef75c6f088a0a21eeac77ab2178aead9e625d6ed750dd4894fc7fb9537f297 5,443 bytespage.html 4e1f8dc6dd2c6d494b9d1229a0de601b0e1096e81337d8a4b5b06fa7c3c293ce 261,528 bytesprovenance.json 939b683f13402c1f5d315ff79800619b30e3780d4eb31bfc2b17282148c8e03a 1,005 bytesrendered.html 323e0a19a3dd13c2b214ff7b1a8553eacac4c17bdfb8b8c1a9bf2032781934db 273,849 bytesscreenshot.png a27d227bafcdfbc38ca5c431a5fb525aa95eeac6e7bfbe31c98ae8057c2e4d64 494,937 bytestext.txt 8944dd45c25fa7c1fc1c6f3e2a646d86fe0849a83248fe1f91cec791a58589e6 4,852 bytes
capture 20261022T084815Z · HTTP 200 · https://github.com/NCSC-NL/php2shell
headers.json dc374a245415e7981501c8d9adea6d18ac20101116a21380bafe62b351dba7c0 5,453 bytespage.html 556efff0dd62f6bdf88e3ed5566f6f2213e828b2bbfeba7eef0b3cd3ac622057 261,276 bytesprovenance.json 7544f40915d6c5cb74cdc60621deee2e3d7773de3a0191201caf4089fbd5d094 1,005 bytesrendered.html 42194f5b28315e862789c25ed7c3a2bbbfa3244da3bb68e8e3ff284f321ccd38 275,802 bytesscreenshot.png c6a14bc8234e3b2b5692240e1f2821e9e80e51e52bd5bec2e89dcf3a7a8a1764 497,834 bytestext.txt f3eec24a226910fb8440714b4f44c40db5c5f7826f3c23b65aece1cc5775712e 4,854 bytes
raw, 3 files with SHA256SUMS
commits-cca173c64ec5.txt 4d4f80bd9da0076e2bd74323e947a05f1e0f1a246a5a25b2874dd9370b4a2ea9php2shell-cca173c64ec5.bundle 4a72bcc9bbc58e886df6eee7cc875bd5deab547f1028f7525a7e7e808859411fsoftware-list-cca173c64ec5.json f0a17e96a336a8782231290acf4ba4a4f4fa469270c59a7c87a95da2207dad01
NCSC-NL (Netherlands National Cyber Security Centre) · government · primary · captured · published generated from the repo's SPDX inventory; commit cca173c64ec5 at 2026-10-22T08:40:58Z · added by claude-newsroom-lead · ncsc-nl-php2shell-software-list
Pointed out by the editor as the source for affected systems. 674 entries at commit cca173c64ec5. CVE-2026-109618: Fix 46, Investigation 418, Vulnerable 206, Not vuln 3. The parsed list, the repo bundle and the tree are in ../ncsc-nl-php2shell/raw/.
capture 20261022T084807Z · HTTP 200 · https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md
headers.json ced0e6933669176a62c459545b9b58df2ecd44f502200c04ac548e8bf513cf2d 5,624 bytespage.html b6810b0801213bba67b7fff83b519ffc971c4271b217cf2ab4083ecee77d2c81 223,836 bytesprovenance.json d02a4a269f2919ede5233e84a57e72d3dc9adb56e4d98d2ca23fb319384925b9 1,059 bytesrendered.html ed0e84fc69079d5df2c192b657719a25a29e9ce62aae2034ece866b27ee6c079 288,875 bytesscreenshot.png c610a27540c7c58e4e02cc90bc268c1a5f5b8bd8295fd543badb47cfcdad0e3c 137,355 bytestext.txt 83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004 1,255 bytes
NCSC New Zealand · advisory · primary · captured · published 2026-10-22T09:15+13:00 (=2026-10-21T20:15Z); updated 10:20am 22-10-26 NZDT (=21:20Z) · added by collector-gov · ncsc-nz-alert-php
TLP:CLEAR. 'The NCSC is aware of reports of active exploitation.' The only agency so far to say this. Advice: update to fixed versions 'as soon as possible'; investigate compromise. No offline advice.
capture 20261022T081700Z · HTTP 200 · https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/
headers.json 5e5b7ef0258116f0d6925dab7f8189e2223e414a58521729043ca4f399ceabcc 1,992 bytespage.html 9f3205c8338c598bedc1fa1f1b0726243fd7cce324d6d0a797a7c55fbd277915 49,604 bytesprovenance.json 7536377248a3645980d9a70e1d2e6c3bb2f1c0e799ff9ccd12b4320bd1724b01 1,049 bytesrendered.html 32cdd5364dd2c631a73c0c834763cf3cb9b776145d2ebf5e4f3376e25e89758e 41,928 bytesscreenshot.png 4dd2cb007efcf0696650ebca1087f184c6ed83297bc6f80dd678d9f6954146ac 528,343 bytestext.txt 992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301 3,799 bytes
NCSC New Zealand · government · secondary · captured · published not stated · added by collector-gov · ncsc-nz-alerts
Listing at 08:16Z: the PHP alert, dated 22 October 2026.
capture 20261022T081605Z · HTTP 200 · https://www.ncsc.govt.nz/alerts/
headers.json 74c848feb39a21fb80f489bb294b8d8a697fe6fdae03a6c61098de514241564c 2,034 bytespage.html 328191a093edcb0fb9ff08b20687f3c271db0b69eb58c770700dbfdfa080da96 75,111 bytesprovenance.json 1e8d90e0d23cf4b63e37636b005fac4be349ebd5ce37cd39f3e8e921d84644fb 894 bytesrendered.html ccc94fffbb92d25658fbb11c5935488c45109113a44b5ec6bf775ad2240cea3f 53,664 bytesscreenshot.png f9033cc86d53addc1cf8ed9db6855d4e30e30eec050db17bec1d47beb99651ee 226,803 bytestext.txt d1c97bbc45ba4cc7861035a6f606f1bc1c7b782b44ce8bdc279c7143640f4a5f 1,276 bytes
Newsweek · news · secondary · captured · published 2026-10-21 · added by claude-story-site · newsweek-php2shell-websites
Secondary: Wikimedia Foundation quote 'taken down a number of other systems as a precautionary measure'; no evidence of US federal sites compromised or offline.
capture 20261022T112237Z · HTTP 200 · https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225
headers.json b6ede4c5fe94adc6fedb71cb10b74af567162d6452ec0218be0bb8c7b17748dd 2,453 bytespage.html 02014f6004d880e2069129f15e86dde9bc0690358b12879271104aa686ed7af0 559,900 bytesprovenance.json 3924e8c0bcf61c3ac2c4018ed3883377b700cd1ff8b1868e156d09adbb78ffc1 1,106 bytesrendered.html ba7e1618e4d6808ff4982067fda5725d0e4c5a6fcfd94dc91b4b6bd65068189d 815,834 bytesscreenshot.png 3d81fb9fa70f4b8446dc70da529dd38f40b9e9caf64fd826a7c1fd282de0d3b0 2,773,005 bytestext.txt 323ccf78f4d6f2d0d0a657e9792a88bb3b05ac66492762caa614e9fe02343294 11,698 bytes
US National Security Agency (NSA) · government · primary · captured · published 2026-10-21 · added by collector-gov · nsa-press-php-4630238
Press release dated Oct. 21, 2026 (no time given). Nicknames the bugs 'PHP2Shell'. Recommends patching, inventory, enhanced logging, replacing EOL PHP; 'If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.' Says the risks 'require immediate patching across United States Government departments and agencies'.
capture 20261022T080954Z · HTTP 200 · https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/
headers.json 97a8c93336e9eaf70c80dd55bf2a30afda4f796323bb1e628388046b2d71ff58 671 bytespage.html 18db3cea62d9017227ca3bc12cc73fe965e84f2a0d946dbc0278c4772dd415f3 98,539 bytesprovenance.json 246b632f5be873be48cc8894fb4abdb03858ee784e155a5f703c690e0c937495 1,286 bytesrendered.html 0e42d4e7ce3e0af33f09f09b458d895320523102285301139861be8ba95f5889 122,356 bytesscreenshot.png 1bc158a28beb2de8ef2533cca0ddffbec42a196ae7094ca2d019ff076cd27725 992,031 bytestext.txt 8a8553ea1ffcd794a5f6a39dea4162c7f84f0737d5061577a3e569cb39b79154 4,995 bytes
NSA Cybersecurity (@NSACyber) · social · primary · captured · published 2026-10-21T13:45:58Z · added by collector-gov · nsa-x-2112903220209098897
First NSA post (pinned). Time from tweet snowflake ID = 2026-10-21T13:45:58Z; the page shows '13:45 · 21 Oct 2026' (UTC browser). 10.1M views at capture. 'If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.'
capture 20261022T080954Z · HTTP 200 · https://x.com/NSACyber/status/2112903220209098897
headers.json 2b72f04731267bb06c6ed80fb9fab697c55697ef2b83303924c315720ed63729 9,020 bytespage.html 49362e7db1112702cb4586ed77daa898c86293d85b5ebe33b7a7dca7db1396a2 139,058 bytesprovenance.json 569e1386915c3d850f140375196be63051f6099dd3eaa803bee46f3d014e8984 1,240 bytesrendered.html a95403e3cb7230cb93a3aad7f6f4a09998596f2636f7516355cf3d52bb8fcf58 162,779 bytesscreenshot.png f9e02ad5c04f114f4ab6cc0cd14b556924d445869fb512f4306683da40d50564 452,042 bytestext.txt 92ebce791a7b35429d2fee94427932a19b1629de3821a52201648a58298d52e7 1,811 bytes
NSA Cybersecurity (@NSACyber) · social · primary · captured · published 2026-10-22T00:43:58Z · added by collector-gov · nsa-x-2113068811058622971
Second NSA post, from the snowflake ID: 2026-10-22T00:43:58Z. It links (t.co/nuXgQ10Fzc) to the NSA press release 4630238. 206.4K views at capture.
capture 20261022T080954Z · HTTP 200 · https://x.com/NSACyber/status/2113068811058622971
headers.json 9292b5863f63684cb58479f72ed4579062a1ff66108183ddfd21a51a34f25f60 9,022 bytespage.html 8b2c9d9cbd6c8cfa6e5614e7900653b6bcddb21e5d8e4a0a880b9613ae9d1bfe 166,142 bytesprovenance.json 0931b8c67b66649c978bd87fd385c5c0e597b091e5e840db5dc9d4d1e1b63c9d 1,154 bytesrendered.html 3a297e1972ba61e2d78a5ca5842af0507e79e8d8b04aa8c7dcfa311794d9242c 167,035 bytesscreenshot.png 846daf6b3e0004aee5355c16bf1ad5d57544d6b38547e5cf26d513a0dc8d168a 224,980 bytestext.txt 899e5ba4af69c5311210a846d98721e674abded497de292dfdc4af17b2ff1bd3 2,052 bytes
NSA Cybersecurity (@NSACyber) · social · secondary · captured · published not stated · added by collector-gov · nsa-x-nsacyber
Profile timeline at 08:09Z: the pinned PHP post plus the UPDATE post; 201.8K followers.
capture 20261022T080925Z · HTTP 200 · https://x.com/NSACyber
headers.json 9fa8661bfa8f332a71ed3f88de6e09033b05073ba537b3d891f1b4209bf1c757 9,022 bytespage.html 35b05885b38c909cd06bc0f6617a32454843249a5c4d5c92274ca3a543b98310 160,043 bytesprovenance.json 0680efdf34c9fb08e25e730dbadcc178f7f0a02d64d82260f9802d4fdaf70a00 893 bytesrendered.html ae4abd70be7db953acec8f33cae64b339eb2729b8661c3191dc88e62eb17ee1d 198,521 bytesscreenshot.png 20541dc8b918cda68c8be3b4a94e4698a53f3edb149d38ba9d8344210189f384 1,255,100 bytestext.txt 5889a1c26173dac8ee58b5269e4f78aeb57dc93520afa220d496e634b5e5b7c0 2,388 bytes
nitter.net · social · secondary · failed · published not stated · added by collector-gov · nsa-x-nsacyber-nitter
Mirror is dead: it serves only the maintainer's 10 Oct 2026 notice about X Corp cease-and-desist letters. xcancel.com/NSACyber returned HTTP 451 via curl (not captured).
capture 20261022T080925Z · HTTP 200 · https://nitter.net/NSACyber
headers.json ab425e76be267227a6680e0572e20c30271e2d99585b0cb665f948349e7e5e22 700 bytespage.html 846a9048bdd79311b1c92ef549dc68d73a61edd0f9832264cea107686a3f53cc 12,341 bytesprovenance.json 5866931f9bcffc1f87e58582a3b73e4fd0fe9414f675213c27278464589fa4c8 895 bytesrendered.html 21e41f57eb9abbe1a4b2db26e202689f711d079cff963c4af7c549714eccd108 12,292 bytesscreenshot.png d179e4f97e7b7e0371b33c4fc9e9dd245980aa3bf0ef5add188775144552c848 162,950 bytestext.txt f4e954159062308642561f65d6f65c068c8ee1001bcafdf6e9388181a78d2d93 1,513 bytes
NIST National Vulnerability Database · cve · primary · captured · published 2026-10-21T14:17:09.357Z · added by collector-primary · nvd-cve-2026-109618
NVD page did not render in two Playwright captures (empty text); the authoritative copy is raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 17:18:24Z, status Modified. Only CNA (security@php.net, Secondary) CVSS v4 9.2; no NIST primary score yet. NVD CWEs: 416, 755, 824, 1325 (no 1419). No CISA KEV fields.
capture 20261022T081218Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618
headers.json f81072c6a6dc3dda5884e2b701c37879b7d8762357ffa7bd4ea88ab95f9e5d6a 1,414 bytespage.html 5218b57d88785ba853fce0de8804f8994d73d4cb3209339fa458c4a5cbb9881f 2,453 bytesprovenance.json f9105904aa37fc65ae54d1cb66b08b59b354c3eb7b20bf7cc925bd7ff4cfce78 935 bytesrendered.html b4880a9e6a29cbee557232a66f9db3531b225dd95a517433c6e326be8bb41e87 2,827 bytesscreenshot.png 442aa587ff9ee582c291e7c7a8bca102504856b7a4db838cb313226e016f993e 106,759 bytestext.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
capture 20261022T081302Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109618
headers.json 5d77eaec3eb1fe5d7fb3a76a35571380e31671576d24b40c26f0f87d75f2c610 1,414 bytespage.html f372c9f8983a6331efb78d85ea53abc653d4bbe75457c02c9a25d9cc1ec2086e 2,453 bytesprovenance.json 578b5687fe8afa3ad4f74ab69b8ca2471a0b0ee0a650e832021623cf9e346931 935 bytesrendered.html 2aa4037a7f7c9c97111573860083b648f53df74a60cea8fc7f9205b76d01f36e 2,827 bytesscreenshot.png 8d848319be976cd91ac761f8f5b19ff3d8547393428ff570f273a774b5094d39 106,512 bytestext.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
raw, 1 files with SHA256SUMS
nvd-api-2.0.json dd864fa6ed53d4b549d2429fad6a22878ddb5a6def44b80cac0628cf4fdab438
NIST National Vulnerability Database · cve · primary · captured · published 2026-10-21T14:17:09.823Z · added by collector-primary · nvd-cve-2026-109619
Page rendered only as 'Loading CVE Information'; use raw/nvd-api-2.0.json. NVD published 14:17:09Z, lastModified 21:17:52Z. CNA CVSS v4 9.2 only; no NIST score. No KEV fields.
capture 20261022T081219Z · HTTP 200 · https://nvd.nist.gov/vuln/detail/cve-2026-109619
headers.json fc8d0ec5d6feaed052fd64b49abaebe2394f7ef3bc2ce70aee91e20e1306822e 1,413 bytespage.html fbdf9ac8177380bc8093bab92baaa18402cc52721b3aaa5b037cb507c15a3bf3 2,453 bytesprovenance.json bad76168518f8666d20502a4cb32e9b3425e785e7abbf63160cbd9081db807b5 944 bytesrendered.html 3784d224686072278cb9ed34c55c7390353818b2d9b35535eb289099d5bb536f 31,323 bytesscreenshot.png 56539f358f1226f93c35cc6828cee0c2edbcda7da8a3fce9e8deaad68f133fea 106,528 bytestext.txt fbcf781e4294ea8f1f693ce52cf0e7c6ff9e8dff930df337294d54fb9f849466 839 bytes
raw, 1 files with SHA256SUMS
nvd-api-2.0.json 627fdaed31c96626e2dcc8af24a6acab1b2da1658bb32b5cf627e30149a0b61c
OpenAI · researcher · primary · blocked · published 2026-10-21 · added by collector-researchers · openai-blog-coordinated-disclosure
openai.com served a Cloudflare 'Just a moment...' challenge (HTTP 403) to capture.mjs, curl and WebFetch at 2026-10-22T08:11Z. The 403 capture folder is kept as the record. Content known only via secondary quotes; another agent should retry. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked.
capture 20261022T081113Z · HTTP 403 · https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
headers.json 7b02609d3cb8321fcd39f1fb944357b1becd2b3914b213682188380e551a576e 1,912 bytespage.html fdf2d9f575486a9ace314ca2636c5ddac6e6cbe0cb71fbd74c561248b86caef2 10,672 bytesprovenance.json 044271cf8e68e02415a432222e0036e63e3bc6ba426046d653313c6cf329a96e 1,012 bytesrendered.html 582d07e3d24a3e25bdb6f9515a3ecee4de66710e90c88b8fe2bb35f6457f1387 11,479 bytesscreenshot.png c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc 13,108 bytestext.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
capture 20261022T112413Z · HTTP 403 · https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
headers.json e4f85b63820ea6efd08d11267c2b64182f40b903e674511097639f35151ff850 1,914 bytespage.html db092a078bc5df2a4c7258208dd350e18d58597541c27492bb6085ddc605b519 10,672 bytesprovenance.json adbd882dc23ca47f5c3ce16c95f07213ed270f28011521f7beade694144a3cb0 1,012 bytesrendered.html 727b7be84beefe987e85a9a6d99200779878441c04443791f3ee6aa992118351 11,479 bytesscreenshot.png c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc 13,108 bytestext.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
OpenAI · researcher · primary · captured · published not stated · added by collector-researchers · openai-patch-the-planet-launch
Cloudflare challenge (403) at 2026-10-22T08:17Z. Launch date reported by secondary sources as June 2026 (unverified); Calif says invitation came by July 30 2026; BBC says PHP Foundation joined in July 2026. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured. Retried by claude-story-site on 22 Oct: captured.
capture 20261022T081658Z · HTTP 403 · https://openai.com/index/patch-the-planet/
headers.json dabb6d316b2a9ca13a6a49cd3d11a59538e1df05d7bd684ec04dd3ff4a830c61 1,920 bytespage.html 1debac9983b263577c7488d66e2818ce992f602955f908219aa39abff4854500 10,484 bytesprovenance.json eecdf8db164ee1e68d9f8e7f6c9705554227dbe3f65fa9ddf547d56f2aa0fb54 940 bytesrendered.html 80b0289e281954fb599df1170766a5d6f8a6bdecad2a5b444dd54e0a109542ab 11,291 bytesscreenshot.png c3713ab2f5047798e977f0bad1562ea67d8aa85432c230ecbeb28d7c937cb5dc 13,108 bytestext.txt e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 bytes
capture 20261022T112430Z · HTTP 200 · https://openai.com/index/patch-the-planet/
headers.json cb97f3646fc464783030ad6f26b7191a2153e7964501252ae1fd40d86db2fbb7 3,536 bytespage.html ad9f31cd0180d78e020821254328f835f4aa9b45f55d380ac5c4ba0e0fbd0a12 471,833 bytesprovenance.json a4668895879d2911dd924db2f462ac177db64b7dd8c7343b68e6f57540c78da8 1,007 bytesrendered.html 66a7a5d479dc9553dcba734583b2b1a930f2ea9a4284417125fb1ec24ff54088 471,423 bytesscreenshot.png d24aaf68ae28b9ffd320d4f4bec241764fe84587ae5932454b99c3780aafe6b2 1,532,182 bytestext.txt 1bc9a32356688dd3f82be20cb4c54b29c9d9d1fd3d04278dcdccb0fe504c2db4 13,908 bytes
oss-security list (replies: Aaron Rainbolt, Yves-Alexis Perez/Debian, Christian Fischer/Greenbone) · forum · secondary · captured · published 2026-10-21T15:24:37Z · added by collector-primary · openwall-oss-security-109619-thread
raw/ curl copies of four replies. Fediverse report (fedi.katze.sh/@elise) that the 8.5.12 fix may be incomplete or a different new bug; Canonical reportedly told by PHP 'unrelated and not a real issue' (second-hand, via Matrix). Greenbone notes 7.4-8.1 are implicitly affected.
raw, 4 files with SHA256SUMS
oss-security-2026-10-21-16.html 6a76141ae5a06584e8c6f6e61f4c455ce078152d6c56ce05206ee1c9ef7acccfoss-security-2026-10-21-17.html 059317aa4a1f458e19196e6add44a6b3106632b82c82f104a5b83d0df6fbe09foss-security-2026-10-21-23.html 39555f34a419becc6a47480eabb369e05f4bac6ce06e9e3843e4dfcb5c99801boss-security-2026-10-22-2.html bbc0f0fc06953b13308925334e39e7808796e46ea9505630917762502996bea2
oss-security list (Alan Coopersmith, Oracle) · advisory · primary · captured · published 2026-10-20T20:22:51Z · added by collector-primary · openwall-oss-security-2026-10-20-34
Date header Tue, 20 Oct 2026 13:22:51 -0700 (= 20:22:51Z). Quotes the php.net pre-announcement verbatim: scheduled 21 Oct 14:00 UTC, two vulns CVSS v4.0 9.2.
capture 20261022T081408Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/20/34
headers.json 716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114 239 bytespage.html 46a94f610255e2ee75ab240c658666ef2589e34e4dd4fcb93b5c5e45fc9917d4 5,800 bytesprovenance.json 04ff8e63e2b72caeb3d48ed4a44ecc28434a0414db9f8d59022e7b75af8ccb40 1,012 bytesrendered.html 5c80dc74b7328496b9f3ee62eef06aa707db7327bd0bcdd7ab9aa4f0c5a5a5d8 6,056 bytesscreenshot.png c03f4fc0fefe0485485685cdf28d3e439a4b167b3022a946ee928be55cd4ee0d 120,872 bytestext.txt 57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392 1,415 bytes
oss-security list (Jakub Zelenka, PHP security team) · advisory · primary · captured · published 2026-10-21T14:41:54Z · added by collector-primary · openwall-oss-security-2026-10-21-6
Date header Wed, 21 Oct 2026 16:41:54 +0200. Official PHP security team announcement.
capture 20261022T081408Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/21/6
headers.json 716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114 239 bytespage.html d43a7569e9b4ff185814a61ed2a17e0b058d4554558a9fee8e3a7a29810169c5 6,170 bytesprovenance.json 9ab3756501428b0a77ed30c1d7ef15298f6a8edb131b1dc1436043a045609b4b 1,024 bytesrendered.html 0686ceff1b17dfaad334b167b4f0fbb9dc9cbcdc897203d210b9a1d7a9630269 6,426 bytesscreenshot.png 6604c447fd5c7db94e64b0c9eeb75cd7301d461bd4f903890db31f9971d20236 146,765 bytestext.txt 2f2d3ff13f3a32b7b624d0c1f0e16f1d9172beabd52d42d7c20e504cb4cf8e4f 1,805 bytes
oss-security list (Jakub Zelenka, PHP security team) · advisory · primary · captured · published 2026-10-21T14:44:06Z · added by collector-primary · openwall-oss-security-2026-10-21-7
Date header Wed, 21 Oct 2026 16:44:06 +0200. Replies at 21/16, 21/17, 21/23, 22/2 are in openwall-oss-security-109619-thread.
capture 20261022T081407Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/21/7
headers.json ffb76440772a63ed2186c00ea575b6e673ca3c7222ae89205c2bbb9de07e38ae 239 bytespage.html 81caae4759a5e9cd8e501221e12f31928874e9d16d7f7e8523e8cb1d36aa69fd 6,323 bytesprovenance.json deeabe8cb21005c2d60c6ffcca6537969877e4411a8d1bbc88503109265756ce 1,028 bytesrendered.html b797761c288a2b59dad8b9bf3c0f4810af1b669a685b93013a7d6edc0e688638 6,579 bytesscreenshot.png d6c5ab360073ebc5769973dc76493c74acf62cdc6e099f668ebffae91de551fa 154,322 bytestext.txt ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384 1,934 bytes
Oxford Chronicle · news · secondary · captured · published 2026-10-21 · added by claude-story-site · oxfordchronicle-councils-offline
Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'; Oxfordshire County Council also down.
capture 20261022T112935Z · HTTP 200 · https://www.oxfordchronicle.co.uk/2026/10/21/oxfordshire-council-websites-offline-amid-critical-global-security-issue/
headers.json ffb2fca308d4c4c89c5593350a364a6121becb966829713a17b3a99c2669d99b 1,048 bytespage.html 7603fb4868cc7b8a8fa437b7e2a8500726acf1332fd3f2252489e8f71471e5a2 472,071 bytesprovenance.json 94eda260baf0d2faf05d45a4bb93b717ed498b664f3b724444bb046dba9ec628 1,169 bytesrendered.html e1614eeb5b71eb2bebf826c3131167eed9cefd83826c53632ff386d1a1a90afa 477,225 bytesscreenshot.png 6e1d23c7119672f3ed76f38b59112885b43f6961b77abd0009ea77015e7ec42d 1,579,440 bytestext.txt 35c847290193f872826f6d65f370bcb6863fafe692817cc449f97431f350ae73 6,281 bytes
OpenAI (Patch the Planet / Daybreak) · researcher · primary · captured · published not stated · added by collector-researchers · patchtheplanet-org
OpenAI microsite. 'An OpenAI Daybreak initiative'; 'In collaboration with Trail of Bits, Calif, HackerOne'. Latest disclosure php2shell links to https://php2shell.com/. No date on page.
capture 20261022T081652Z · HTTP 200 · https://patchtheplanet.org/
headers.json 2efe5a08cc256108fdb7a72a5bdeb92c7596564181f1d63e2e31fd2b71e2a321 563 bytespage.html 280b5c18a8bb8c6254841014830e299d803e1d21ffd98141296156a2b5423bda 2,325 bytesprovenance.json e6def2821be82e7593e0ea8682f9c24fdf763a48424e1814e65b815a1db3a78f 909 bytesrendered.html d347cfa4c1e9dc2c990b725259875a732e38470560bfc51b6bb21da3419d2662 7,680 bytesscreenshot.png 0872d96463aabdeccdeb873b9cb455601fe9cdea8cb6b15f45c65a9e85f1bb75 285,779 bytestext.txt 3e32706fb7c0ed83bb988da8372dbca5e70dbdfebc6135060f3f777805f852ae 1,053 bytes
The PHP Foundation · advisory · primary · captured · published 2026-10-21 · added by collector-primary · php-foundation-blog-security-release
Foundation's account of discovery, 2024 audit origin, leak timeline (20 Oct 15:00Z), Calif video, Chainguard embargo break (21 Oct 07:41Z). Page embeds an r/PHP comment thread (third-party, not Foundation).
capture 20261022T080901Z · HTTP 200 · https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
headers.json c18914982a4c07d0a15b76e052d18c5f77f345016e356ea5cb65e766f0096b0f 857 bytespage.html 6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223 40,324 bytesprovenance.json 2acdcc9ae9ee9e14a8960ed26727dee21b5561915fc6632378e78c9ae27a3f1b 1,218 bytesrendered.html 874a78d766936a3c9d375512a1882ac83f25921f0a1050ed8169c5f37ea72cf2 126,413 bytesscreenshot.png f6eb5d0b42048f1570880df5c5e38adea3d5ee8635a98b8fef51f6234e5d2089 2,631,098 bytestext.txt a1be057adc1c5bfabad6a59007bd08960168346230f03967fba68f2402ab3f04 31,882 bytes
PHP Group (php.net) · advisory · primary · captured · published 2026-10-21 · added by collector-primary · php-net-advisory
Official php.net advisory (archive anchor 2026-10-21-5) plus the 8.2.35/8.3.36/8.4.27/8.5.12 release posts and the 20 Oct pre-announcement on the same page. Feed <published> timestamps (00:05-00:35Z on 21 Oct; 20:32Z on 20 Oct) do not match the Foundation's stated times (release 14:00Z, pre-announcement 19:30Z). raw/ holds feed.atom and a curl copy.
capture 20261022T080901Z · HTTP 200 · https://www.php.net/archive/2026.php#2026-10-21-5
headers.json 42812c4d4f151d93b62d63d08b84b83e50a94a9e2ab79427924d5b5df582cc72 899 bytespage.html 3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555 99,388 bytesprovenance.json b1c9672106ace3646ee3912d7e4e87d94dc91cc5b60b9acc1066295675ce5014 948 bytesrendered.html a8cbeb0c17b3646681217db64cce0e0beb6dc71765bd1bad550f8e20170ef7d0 238,404 bytesscreenshot.png 4727eaed5a4a5a90eb95aed5c3c0093702f427e1aae4bc63ed9ccfea2ca92da4 3,983,360 bytestext.txt df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e 35,947 bytes
raw, 2 files with SHA256SUMS
archive-2026.curl.html 3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555feed.atom 79c12996a433f66b2e2422e32d1dd5d4251c7c24531f75c3a0611f58dc1894a8
PHP Group (php.net) · advisory · primary · captured · published not stated · added by collector-primary · php-net-changelog-8
8.5.12, 8.4.27, 8.3.36, 8.2.35 entries dated '22 Oct 2026' (the original target date), although they were released 21 Oct. Core entry: 'Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).' 8.5.12 and 8.4.27 also carry unrelated bug fixes.
capture 20261022T081558Z · HTTP 200 · https://www.php.net/ChangeLog-8.php
headers.json 7e0f775cb09c408472e389bec122b0fc703a450df430b26aca98e4539caf6f4f 892 bytespage.html 8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68 752,126 bytesprovenance.json 08d9493b6d1480061ad20e23c5ea875c121bb9741f79ccf69dd923284133f1c9 919 bytesrendered.html 03ecb3465829e89ba578ae7bc7f36881fbbd37d9bc77ae5bb3c74bdd15e2d36a 751,162 bytesscreenshot.png 0954e33d2a52ac1470b5c204eaaeea8d8fe811854486542ece88541cf7dbc526 15,023,593 bytestext.txt e39f8d2cb60ee8a58c5400536714b0688b198b31bc07685fd7cdada8f2f0dd70 417,190 bytes
raw, 1 files with SHA256SUMS
ChangeLog-8.curl.html 8d771e4a97a9457c8ff4dfff88d79661cf8b5d520666b8799a944f033e620e68
OpenAI / Wiz / Calif joint microsite (php2shell.com) · researcher · primary · captured · published not stated · added by claude-story-site · php2shell-com
The researchers' joint site: credits, '70% of websites', demonstrated RCE on WordPress, Drupal, Joomla; FPM RCE via application-level paths; memory disclosure.
capture 20261022T111831Z · HTTP 200 · https://www.php2shell.com/
headers.json 95d2d3cfe2f388045327d30e2dd08bb49dd3e8dd426ae09aa80e1261f01cd7ed 1,509 bytespage.html 8c12d8880e5b0e798d3e4457997397a1c0de6b36ab774a8fe46518f3270532a0 284,683 bytesprovenance.json 020c3cad8f308d11c8454cbf625b7310e0958428a69ade312c2cd43d349c2897 952 bytesrendered.html e5958b710931a3753baaa7475dea5c3be9f08677412269976d9e50100e3f9022 506,683 bytesscreenshot.png 77a8c0a27f91ee02eab5575847f4611e6605f030f286c20c51eb4de3cf0f496a 2,152,724 bytestext.txt b1e83b4f0feb87d5abb59bfb76015b154a7b678a51c0e965e06929f1e6b17f48 9,251 bytes
php[architect] · news · secondary · captured · published 2025-09 · added by claude-story-site · phparch-php-security-2025-audit
Background on the 2024 core security audit.
capture 20261022T112947Z · HTTP 200 · https://www.phparch.com/2025/09/php-security-in-2025-lessons-from-the-core-security-audit/
headers.json f94a2cb9fd6c974ab16b7f672856596b84da0ee50036c93a902f055a2efebb3f 1,063 bytespage.html 85b9dacfb542ca35651d775dfe24c41186dfdca2ae5abc86bafcdd1e19b79195 94,581 bytesprovenance.json 4783394753855b623aa99c5c3077af3a72dc1b6dbd18ba5e2e181737ffcbc90b 1,095 bytesrendered.html 8f4192ecc48d4d4fb38e2492bac830525bfcab04ff70a72849ad8ccc35e38358 94,279 bytesscreenshot.png 51293897aa9bc0b5b07dbb244193f6b3da545420a92eb912de4664a8e0ebe245 2,293,707 bytestext.txt 95189f8e2e198e19e39271f1750db73ca525f593abbe9ec363969f3eae4499ec 28,517 bytes
The PHP Foundation · advisory · primary · captured · published 2026-10-21 · added by collector-researchers · phpfoundation-blog-security-release-leak
Dated Oct 21, 2026. Primary account of the leak: CVE IDs circulating Oct 20 ~15:00 UTC; Calif 'mistakenly published a video' ~20:00 UTC; mitigation advice may have leaked; Chainguard broke embargo Oct 21 07:41 UTC. Captured text also contains reader comments below the post (lines ~90 onward) — those are third-party, unverified.
capture 20261022T081244Z · HTTP 200 · https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
headers.json 3b9ca485b393afa38381b67bb251208dca58e32f815fd1aed95ba69e1d88dda3 856 bytespage.html 6b8915a800a5311c06544c4c47fe0e6b69586e9d75aeab49d2922a6a71446223 40,324 bytesprovenance.json 777ac74e8e4915a67c651d019c1cdcf9a099773e9963221b097b676fa5054bde 1,222 bytesrendered.html 074da5662f04df8f88a2efc163726c553f5bb43c8095278a089daa0faf364955 126,414 bytesscreenshot.png 09956999247e6e42a5635bb2b1234a2f8a11f0c66c26b88fafc020c31f3b6cd6 2,630,327 bytestext.txt b9f29cfdc1c0cd65dd505738d06d5f7d590d5d3da95801309990871870d2e0dd 31,883 bytes
Prophet Security · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · prophetsecurity-php2shell-detect
Vendor detection guidance.
capture 20261022T112954Z · HTTP 200 · https://www.prophetsecurity.ai/blog/php2shell
headers.json 3d69271680bbf150bc6fae70fc1287cd80311e2b43424bbf4f428714ecd955b7 1,637 bytespage.html b00c997496adf4b1764b46125a9a74849e83e0baf12ba075d39cc6b0c4493bb0 178,998 bytesprovenance.json c58cd7be80e63d3760a0f31b5507e5a3f5678bcc269f1ef1e986c903224553af 1,025 bytesrendered.html 3ac8595af5225424d4be82b0b063abfb5254d537481410f86cb935ebdb46b2a5 797,451 bytesscreenshot.png 8a43fab6765b4d462f55e613f1f5fec6d081c690d44afd1fc4af635f917078f4 1,773,221 bytestext.txt 2e8efe1d3d72efc2c7357b939ba6e0a4ee639b3fb3cde21efaa44f5f60a00e51 15,452 bytes
Qualys · vendor · secondary · blocked · published 2026-10-20 · added by claude-story-site · qualys-blog-php-preannounce
Published on 20 October on the pre-announcement.
capture 20261022T113004Z · HTTP 403 · https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities
headers.json 9ae7ad7eb7ecad9ff1195f99f730cc79be3ed1abdbb907f73ad003c7d28c5651 628 bytespage.html dd1c2f122d665c4b3fb0be7b2e8e1eb717607b195475efd409f666dfbd979b60 1,486 bytesprovenance.json f3a38995a937d0edc65d7304bf5014e3d946eb475aa675593c5aa03aea58e148 1,110 bytesrendered.html eddbe1ecca686ffa5ca8cfa12c3054e26ecd8eb8c21461faaa9951759d65f41d 1,203 bytesscreenshot.png 88143431c2f2ccebbb073449167e29d4114759e3e211d651114b2d152afd2e9e 10,431 bytestext.txt c6c1266b1b8854e014702a20b4d2b956f885b89fc66f21fad180d33a4c37467d 19 bytes
Quarkslab · researcher · primary · captured · published 2025-04-10 · added by claude-story-site · quarkslab-blog-php-src-audit
Quarkslab's own account of the 2024 php-src audit (OSTIF, Sovereign Tech Agency): findings, two redacted high-severity issues with fixes in progress.
capture 20261022T113008Z · HTTP 200 · https://blog.quarkslab.com/security-audit-of-php-src.html
headers.json 9a1974a3d0e74f6c61049df444eec6f88c921c1df160c4d36547d455f5f69d3a 721 bytespage.html cfffdbab1e24dbeaafa236432ed6653fa2442387aeae475f996cddddb722bb89 28,339 bytesprovenance.json c1a3e69c282c4e578340fa0788f636f5604d1f0d0a6076bac4cd7bd024ee55ca 996 bytesrendered.html 032ff57da663f85dcf219749a2b1849c606efef96c9044684130409249a05e18 27,638 bytesscreenshot.png 84a81db5a451d763ffe7a40817ea3c94e0e0a7d7da3bd0b7c74b2b8b0c912974 932,374 bytestext.txt cd5ccdaf99da0be1676b319643939d20c0a5d17df18eb8f0636eaad6ef7c9321 7,821 bytes
Recorded Future · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · recordedfuture-php2shell
Vendor explainer.
capture 20261022T113014Z · HTTP 200 · https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation
headers.json 3f16adaf8c9cba92536851d7836d4e787039ea13bccb4da34e56759d45f7fbef 1,234 bytespage.html cd54cc52e04832d03115211f9aca789fb9d4861a8460a25a4e6ccc45f2d11f9b 27,860 bytesprovenance.json d044ae83506d9d12bb11b3e2357405fd0be2350bf9782b8f21e5d0bc7134c316 1,034 bytesrendered.html ca1457d1d590d21807ebf2cd64d30304ff3607b8171472c2d205a8fd4365a37c 178,844 bytesscreenshot.png cd745753c1ec28fcaf45c4b291d01045bdf86c88cbd0184e664e196bdd0f8ddc 2,871,582 bytestext.txt f9cb130d64545fe46a477766dce91126405f12d99e8051aff2c05e084a904fe9 18,444 bytes
Reuters factbox, via Global Banking and Finance · news · secondary · captured · published 2026-10-21 · added by claude-story-site · reuters-factbox-websites-offline
Reuters list of websites taken offline: Netherlands, France, Germany, Belgium, Finland and others.
capture 20261022T113026Z · HTTP 200 · https://www.globalbankingandfinance.com/factbox-websites-taken-offline-over-php-risks/
headers.json 8756be9a476cea45bf6f0ba5d6afec78293d9a1c08b04c463ba887aa51643743 1,259 bytespage.html 8c4668f8881f07f4e9fcdaf5498ac560214aa9243a2e163122532b0a80b2d141 214,076 bytesprovenance.json 93bc4bfda9e1316396b718afd5bf442ed65dbddf92c7700d9308c0d04c3c7806 1,084 bytesrendered.html 5732718cdad049baa24fe5d9d7c0e91fd962f71df61672c4e0b3d101b9a262c3 227,694 bytesscreenshot.png 28b7c31e70d01ad1a8ca150a6127d7188c38f431b913c022f6aa6a997c47cc5c 3,456,506 bytestext.txt d562e28995b00a19ceb36a346ffec05542ec675499998931b8936af7ba41d5d3 10,148 bytes
Rijksoverheid (Dutch government) / NCSC-NL · government · primary · captured · published 2026-10-21 · added by claude-story-site · rijksoverheid-ncsc-php-news
Primary: NCSC.NL taken offline 'uit voorzorg'; advises a risk assessment per internet-facing PHP system and considering switching systems off until fixed.
capture 20261022T113033Z · HTTP 200 · https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php
headers.json 02c777fcd4897b76fb5febbe44f6827eac84175c43def883b4074889c879f1e6 2,789 bytespage.html cd5e199ae854bb38177fa187f36f80b267ee93f5b23262122697c7038276e21e 240,904 bytesprovenance.json 41eeb42a42ffe905a45ac1fe625d4acb5b9ba172ca4fd9253d01dc7295a7aa8b 1,072 bytesrendered.html e364ac0a4f3336a54bc2581a182d37db39961f47802adca7c95247e9c0fd4613 244,344 bytesscreenshot.png 0b023dc6a8fca71e18932ef0a168051841129928264b33c1937fff623cab4457 435,918 bytestext.txt 7e10bcf7cb44e5f753e057d6a6d5f07747f231c066728373806fa14d80bff5b3 3,720 bytes
Safeguard (vendor blog) · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · safeguard-how-hard-to-exploit
Secondary analysis of exploit difficulty: a public PoC that failed under test; the upload-progress primitive is real; quotes a PHP core developer on Mastodon that patching is the only mitigation.
capture 20261022T113039Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-how-hard-to-exploit-php-foundation-changes
headers.json f024dda4aca45ee7784179ce10f5502c7cdc1848b68820c5e3ac4d5ae9977fe4 1,910 bytespage.html ca8f171043e3a56f99149b1ffa731bfdd00faa1aca0dde315bab896ba544148f 419,051 bytesprovenance.json dc78d80894e1f67eb84e8f3dbcb4fce3d4687ae21172b11e13dab9e452491777 1,094 bytesrendered.html d50d0675b422cf74595a98594b026b8936b4a597bfdd8e14bf6417f1fb65c089 425,970 bytesscreenshot.png 81bc77d288b0f16b3a5aff9755c8f70d850d79e54d2f786960ea233e942d2e24 3,150,477 bytestext.txt 271a233b1b8e628f66e764b3e3f089b09951d09ecdbb5fb9ef39d619eae623e9 37,594 bytes
Safeguard (vendor blog) · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · safeguard-waf-rules-limits
Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.
capture 20261022T111928Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits
headers.json 0c47d1b3b4483fe3dfbc1d2c92601e2da277c00bd9b13a0b4e1400d532b810f8 1,911 bytespage.html 7ee15349d487eb9f5fb2f578f4e465e1bdd8b44a4f7ecbfc4b2d6da5277b7dda 428,039 bytesprovenance.json a152958c004bbd289d33c79fc1eaf5b3b1aa6442001c31226607d2a25f3b67d4 1,055 bytesrendered.html 9cf1b889fa9c9bfb3bc5a219a58059a1fbb4ad867e796b6d89a2ca8960724e69 436,335 bytesscreenshot.png ec0109ce98dbf571daf5c08aeff60ae7e9957e2fc907b50f17bd9e196ef0c621 3,153,430 bytestext.txt 664a398aae1f5c1df20e43deb46b962fd818b4403c864de8cab55f23c79c193c 36,136 bytes
Sansec · researcher · secondary · captured · published 2026-10-21 · added by claude-story-site · sansec-research-php2shell
Vendor advisory predicting mass exploitation within 15 minutes of release; no IOCs; later accused in a reader comment of leaking a vector in page metadata (unverified).
capture 20261022T113104Z · HTTP 200 · https://sansec.io/research/php2shell
headers.json 2dfd5ab190184ed3ba6295db2882e7dce9719d6048f860a68a011034c1e1e26e 1,167 bytespage.html 60368be8e17445397b0865e1a7c8a7142cd888ffd81aac0b11d7d0644dbaab1d 36,814 bytesprovenance.json 7443427160ac153a29c5b8c8c5278458e0b6c1eb5bc1bb1597d25757d01836bb 978 bytesrendered.html 31f57c6c03a271c045e195256e2d406614c505ca3c3d07ce40c299983be0cc0a 37,783 bytesscreenshot.png 21518bc8c146169d1d397668488e88840c646c1286340aa20808740f0538eed8 1,506,901 bytestext.txt 281e3c508909a7002ae17602fd885f6acbd78e3766d8de3153f1139c7be8d134 9,554 bytes
The Scotsman (Jack Davies) · news · secondary · captured · published 2026-10-21T18:09+01:00 · added by claude-story-site · scotsman-edinburgh-council-offline
Edinburgh council site offline late Wednesday afternoon; spokesperson: 'essential maintenance', 'waiting on an update from our provider'; link not confirmed.
capture 20261022T112150Z · HTTP 200 · https://www.scotsman.com/news/edinburgh-council-website-offline-amid-global-cyber-security-alert-9302652
headers.json 1c3f67fd980359a0bfbaa40d100d35aea3cac3074d6b29d0a1753b16584a605a 1,536 bytespage.html 90aaacae5232524ded421df348d5573c267ac8e950c4e48628bd8ed586c6aedd 262,633 bytesprovenance.json 25e30a911da3a7887aafc5080201b7d8bc5dc8508f1d3a7a2545b1c4d5963ee7 1,118 bytesrendered.html e02581dcf2ba49c3963ed48490b34c813b9558ff27991256fc0f50231be75ac2 712,640 bytesscreenshot.png bb1c80d6965bbdc9c3143e0ff88f84de54ca8c9af02419c854993868a6452a05 2,399,966 bytestext.txt fcdbc39d82bfd477159635a160dc431f569345ad40cd7b1f23b050917f41ddd6 8,754 bytes
SecurityWeek · news · secondary · captured · published 2026-10-22 · added by claude-story-site · securityweek-exploitation-days-before
Secondary: Censys 2.58M hosts / 1.58M versioned / 1.57M unpatched on 21 Oct; nearly 3M by 22 Oct; VirusTotal 5.1M IPs, 1.1M announcing a version; Amazon's 17 Oct attempt; Cloudflare CTO early attacks.
capture 20261022T112314Z · HTTP 200 · https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/
headers.json 20346ce7a28ae2cea09c5ce445b478a4fe9837f2cc4cf97d5ae15a6bcd846d48 1,083 bytespage.html d00e2e5608d37d978b2fa983ffa1087430976a445caa72df9a49b7618dbe9566 168,865 bytesprovenance.json 99114af56492dfd4921ca1b095bf85f256188ccd6d6e17fdaadd7657d629d83b 1,072 bytesrendered.html e493b8fc733dacfc40164c4bb153884e96b82e984e2e3c738c13c536a5edce73 259,915 bytesscreenshot.png e5454077149da3ca0ea83a39c68e30ce9f6f984788c53349e104a0d45dea3fb9 2,097,665 bytestext.txt ac663f2d9dbd0197d3721e1756bdc12e2491cb512eaa32197592ff9792f2632c 13,376 bytes
SecurityWeek · news · secondary · captured · published 2026-10-21 · added by claude-story-site · securityweek-first-attempts-sensors
Secondary: patches land; first exploitation attempts hit sensors.
capture 20261022T112324Z · HTTP 200 · https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/
headers.json dd993a8f1006a3a64fb1decac73db56de8468b6aa2d213379f7b8925a27f83af 1,083 bytespage.html 6d603d0aa60802788b1f163a27b575df0c62e1bb903bca9e6a3c98133e5d095c 169,487 bytesprovenance.json 2dca30a4387489ca9868c223790494256dc26503ee6b709a46643fa881c589e8 1,115 bytesrendered.html f5cdb5755f0b1ab2a897933da2b213a674ccfa76931ab1a19ef6627b79408b15 261,102 bytesscreenshot.png f5f51f0db7037127107f38fdaa5cbdc77c6df0328ef92619061ceb4a76bfb575 2,236,355 bytestext.txt b63772dddccf9cee302313f5dece42bf30d91abdb6f30ca61fb2a38081c85a41 13,245 bytes
SecurityWeek · news · secondary · captured · published 2026-10-21 · added by claude-story-site · securityweek-mass-exploitation-looms
Pre-release: 'mass exploitation looms'; watchTowr and Huntress had not seen exploitation.
capture 20261022T113111Z · HTTP 200 · https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/
headers.json bb347753d4feee250192fd7b5bdc50a5bd970acacdb2bbc50ff7ec8f02e421f5 1,083 bytespage.html cee26b75f5542752d57c034b8a0eccf6b6227242d7619e33a91a35e8d3af8ebb 162,723 bytesprovenance.json f31a296260b932686cb33c7c964e56367479a31e090172999a0b6a20bfac343c 1,111 bytesrendered.html a85f0c144d03bd751e0f5f14784fdfcb65809370f94510720b7abc2d66c06403 254,022 bytesscreenshot.png 65e2d5f0404ae070f6a43772ca24731d6e2b0a1125aac8132107060f194bc2d7 1,822,934 bytestext.txt 693aa4300139d2afc431484c18fe038f9b0b2fb411a89b5defbdad622958e851 9,475 bytes
SentinelOne · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · sentinelone-php2shell
Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing).
capture 20261022T113120Z · HTTP 200 · https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/#cq=i1
headers.json 652bccd3c7747978e637a6cf3ca0dd3adcb9d8d6dff7f6ea1e7529206dfc78b6 6,215 bytespage.html aaf6dfa7fac00ac3a9150b9baee326803df94377bbae974995178f465292bf84 343,729 bytesprovenance.json 2a83e001a66dd0c777afe90a659023a49d81f93cd3c8310b6024faf644b74974 1,146 bytesrendered.html d09c9b7551468ab7f7a69721a397eab5bb3d72b48ef9b756d0427a34c54bc0af 553,092 bytesscreenshot.png aeaf87bfa3d2dea7b44c00746ea38837ee3dbaf866640044a48d46125967360c 3,003,286 bytestext.txt 0e75697fb5149ca627012455a8e06b03535c31e0c70e6ef87501d1beb7d39d69 24,686 bytes
Socket · news · secondary · blocked · published not stated · added by claude-story-site · socket-blog-embargo-dispute
BLOCKED: Cloudflare bot challenge.
capture 20261022T112047Z · HTTP 403 · https://socket.dev/blog/php-embargo-dispute
headers.json a80f2b5ad8ae81c3b83a000871a7819d186da9f1d450b3717ea39deb9bcacc71 1,990 bytespage.html b8ac97a2a385dc96494c44b3886248703441a11d350a683a472b690ffe293803 6,187 bytesprovenance.json 8255345be61952af9d34d90c1a80520fcab5675c9c8ed3951c2aa93bdc5d64db 939 bytesrendered.html 45f09ae7a4bb5f729e0b016d77de302dd1646fe819943e3054160f7bc5552cb1 28,771 bytesscreenshot.png 38b458f2d97ad16e0fe1fa55afc35614ff1c9d6704c168964e2d9c3c625be655 38,311 bytestext.txt 2edb7b291225f9a58dd5ed7546e5c5ead9d84e0c92a9d78e93e06e030687646e 258 bytes
David Lopez-Kurtz (Substack) · other · secondary · captured · published 2026-10 · added by claude-story-site · substack-lopezkurtz-patch-is-the-exploit
Analysis: the audit's public summary lists 27 findings, two redacted, and does not describe an OOM finding.
capture 20261022T113134Z · HTTP 200 · https://davidlopezkurtz.substack.com/p/the-patch-is-the-exploit
headers.json 93831a587e5a9a37a455a49bb5bc1a735ffddbaa9462baecf8483bd621dc0d80 3,448 bytespage.html 77bae2f3d20efe5af0c1bf780b1c2618202d3da7941792444a8fbfed1d4a87f5 224,610 bytesprovenance.json b49aa2b0f632867066da181f78cf57cd3495f0c1c9c7c7634875a04c5f86b5ff 1,023 bytesrendered.html 5a9958401f0de8caa87154eb38d082ae37fe969fe4928862d4e557f4bac4ba1e 263,845 bytesscreenshot.png 4f94dc2329c6fd545b1a600cccfc7b2ce2db41deb2b8288403a9eec27e63dd56 3,979,940 bytestext.txt cb3714dc12f96c969959784164a40f12aa923b46cf56df83aa950a9ea2573330 33,564 bytes
Techzine Global · news · secondary · blocked · published not stated · added by collector-researchers · techzine-php-chainguard
Cloudflare challenge (HTTP 403) at 2026-10-22T08:13Z; 403 capture folder kept. Per search snippet: Chainguard CEO Dan Lorenc does not dispute timeline but denies leaking. Unverified until captured. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked. Retried by claude-story-site on 22 Oct: still blocked.
capture 20261022T081301Z · HTTP 403 · https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1
headers.json e4c1c978fae1d476008a0220bd56d79c287115d6dca754076ac5c220c8403209 1,084 bytespage.html f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd 103 bytesprovenance.json 0b93d24048c39675ef0bec6c63cbadc201cd4c761b3fd85f96538ec7afa93ea9 1,084 bytesrendered.html 8631afb05e141985b74d3ac4fc67eca679d940e50dcd377593b0a5faf473e4a8 29,118 bytesscreenshot.png 83e27bf325b865db2d303c7c20ec30a0a5c0b452145b2b48175a74d4b292d20f 38,816 bytestext.txt a709538005b7efca9f1059e2eeaa4a13cd196d9f8215befc91b286d42f56d334 263 bytes
capture 20261022T112124Z · HTTP 403 · https://www.techzine.eu/news/security/145182/php-accuses-chainguard-in-php2shell/?ki-cf-botcl=1
headers.json 5345616d7653c07e708bb2b1f5f0b9fe2afefd06cca4a63dc7bb7fee0684222a 1,080 bytespage.html f261423d1da97890ff6bfccd31ff4ee0b74f69351cf75095fbe791cb16cbf5bd 103 bytesprovenance.json 8870e433407b07164f7f83ef420dd5307c6c1c525544cc382a43dd9da569c4ac 1,084 bytesrendered.html f9d1600dea692ee1e52186d55f0ac9eee1a19f909c76aec8fa9b5ef26f1278bb 29,118 bytesscreenshot.png 6127fef1895a985b7bcd7168fff19347a8ca8f67cfc409d39a802caebc1fce9c 38,923 bytestext.txt 93f61d068317f6ef84245b70a7d8b8ea0f4b1d351af10fc89a31cbe4ae7eb1da 263 bytes
Tenable · vendor · secondary · captured · published 2026-10-21 · added by claude-story-site · tenable-php2shell-faq
Vendor FAQ; notes Cloudflare's rules cover only traffic routed through Cloudflare.
capture 20261022T112331Z · HTTP 200 · https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
headers.json 5ddfb8ebd67d5b056190eb932bd7230be55b6dcec36b71da7591e9ff3ef787e9 1,390 bytespage.html 0f90e53e8a45f385d5e14f7493f1aa99aff8d34b7405ed43d70a3534381dd264 274,325 bytesprovenance.json f1f23ada9af900931c49744b7cb544a8b730ec5038bd6637c3a3b521f095c4d6 1,155 bytesrendered.html bbc941dd99bd25fbb24457889bb89c0cd2213187cc104c491b15a86ad1167425 469,247 bytesscreenshot.png fb42572ffc60b269206740e6d85216b9fa06d7226bfb49682d148b44740c897c 2,222,099 bytestext.txt 10d98694b9c0243efaf17de612d27de215138873b711598eae3f68ceb9b11b54 16,528 bytes
The Hacker News (Ravie Lakshmanan) · news · secondary · captured · published 2026-10-22 · added by collector-researchers · thehackernews-php2shell-4days
Dated Oct 22, 2026. Quotes Amazon CISO CJ Moses ('post shared with The Hacker News'): MadPot honeypot exploit attempt Oct 17 2026 from anonymization network IP geolocated to Australia; PoC attempts from ~02:00 UTC Oct 21. Says 'details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time' — contrast PHP Foundation 'No technical details leaked'. VulnCheck: PHP on 2,608,039 internet-facing hosts.
capture 20261022T081320Z · HTTP 200 · https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
headers.json 54c094189f50f4afa3962d0e484ef93cf0f92bd1fefb71ae2fec7e63b71b3b14 783 bytespage.html b2b51b3736eab8ebf9fb584770654a563ec0cde9a258c8ccc9b2cac5e2759495 181,180 bytesprovenance.json ef03914e372ab683b87cf258b84ec703ba5cc140e8b724fe1fa547d0f7a066fe 1,081 bytesrendered.html a7caeb00fddc406d6dcfeb68c7fdce453fdb39446eb83daa364cb3f2986a7834 176,478 bytesscreenshot.png 71b28408de124895b1534822f79eff33a445be5296c09203d51f152ef67d089c 2,255,956 bytestext.txt c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4 12,295 bytes
The Hacker News · news · secondary · captured · published 2026-10-20 · added by claude-story-site · thehackernews-php2shell-unpatched-alert
Pre-release coverage of the two unpatched flaws.
capture 20261022T113144Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
headers.json 504e60a31ad0c0649db5fe4d0560bcb64bcea39e2c5d8b374dd60c86235937fb 783 bytespage.html b8297488c796fba8c0c46fbb558121433294b8f8991c457777efa33409b6634e 175,875 bytesprovenance.json 3eccd35b7d04ded29ea8937c2d7870a8be4adac2340d632f92f01cfe630c3147 1,090 bytesrendered.html e34515d9ce5113ec57194450be97a765341affcc8cae816dd5a475c8d200873c 171,094 bytesscreenshot.png 1686d34457b358c5f9a1950a0da921ac4d765a0491953e9383a70b1498568c29 2,281,720 bytestext.txt 33ba8292e26406d7275daee8f4f0b07cf240d878bdcff089c5a9e1d4c21eff6b 10,078 bytes
The Hacker News · news · secondary · captured · published 2026-10-21 · added by claude-story-site · thehackernews-what-protects-you
What protects before the 14:00 UTC patch; no compromise confirmed; public exploit code not shown to work; not in KEV.
capture 20261022T113151Z · HTTP 200 · https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html
headers.json 1d0e37d8f272c2035915a1e3bae5d055fd9d8a9dac4b60116725e2af378e7d7a 783 bytespage.html c3d4ade9c8b6af04990a2ee26114a8665f943ed5142ae7348e38ef3b23d34ab9 180,675 bytesprovenance.json b3b2d8123bee4172bcdb4453abeb515d86f34dd658088159147c1b0b944661d2 1,081 bytesrendered.html 64ef5d20df0ea8dfc700220c350757cc455bcfc017751142819841c35e11ff9c 179,165 bytesscreenshot.png e0e1a25547dc8d319ff4071cceff2950d36aa030ec7f2ab1625d04018d2e39cc 3,022,943 bytestext.txt 2301d254784fd6612f36f844e16a706e2e7ca5f8d8f942f7f36544c59d78d82c 13,774 bytes
The Record (Recorded Future News) · news · secondary · captured · published 2026-10-22 · added by claude-story-site · therecord-php-foundation-statement
Secondary: the Foundation's account that AI review first sparked alarm in August but signs surfaced in 2024.
capture 20261022T113158Z · HTTP 200 · https://therecord.media/php-foundation-statement-critical-vulnerabilities
headers.json 2257c81e7400eff589569be8295f608e775b7e305c9af66d1e8d4a8f580c7229 914 bytespage.html 8849918ee23ea9f6e709c68d21726ff22f31b4e88bf3fc8d6c2d67f55d338d81 92,120 bytesprovenance.json e26d3d9bab095c3530be9242fd010f71c6efd72f0f561f48cc26892f32df92cb 1,122 bytesrendered.html 387866a008c5068d55372962daa2904c6bee30821494b4c30a467aaa1c775383 96,511 bytesscreenshot.png 31f0aeaac3e78e1ab3c579a6217361b9148b439f02245b029c43c19d4f7f759a 1,498,927 bytestext.txt 28c72344e03a5a79b2ee018193bbd930283c78444f9cffcea3dc7a422c49051e 7,717 bytes
The Register · news · secondary · captured · published 2026-10-22 · added by claude-story-site · theregister-php-blames-chainguard
Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.
capture 20261022T113204Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611
headers.json f037ca6b2e792623b19de3cc87220576a70faf147d1140a31fe0f0a22fa34d1e 610 bytespage.html f7f24a70afadc30edf03beb3e697086d5126ad7f5ddf2875c2e5c54bc07208a5 183,584 bytesprovenance.json 28bb52465a44cfdc683cafd60ae043da8145a2e31fa1e280fa7ed7b81e417e32 1,225 bytesrendered.html 3729f08f3b948bc4af5a39a2b7351e38db6eeafbbcb982556755e5929dabb56d 197,763 bytesscreenshot.png d7c98b6141ded745143bbb5bc018fb02e07f795ab320a20434e063f150a3b875 1,745,666 bytestext.txt b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca 13,215 bytes
TPO.nl · news · secondary · captured · published 2026-10-21 · added by claude-story-site · tpo-nl-digid-offline
Dutch: DigiD, MijnOverheid and the Tweede Kamer offline.
capture 20261022T113213Z · HTTP 200 · https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/
headers.json 3b4fb879e9421d7c88e3feb33a0521286d51f96fea6fe5ce5a04f9a54f055b3b 826 bytespage.html 1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad 233,569 bytesprovenance.json e8a125363be8a52f4be95819b63112af3af8ea3317977ed509fbe2a52b0e31df 1,020 bytesrendered.html d32cd4732dc20dda8b4464a52f471b942ec7756397f0ff01d40dd7344843c936 407,728 bytesscreenshot.png 50d028e45666fd51dea41fe9359edc265ec4671d4ca742a6acc17eb2ef119a4d 1,351,320 bytestext.txt 2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb 3,796 bytes
watchTowr · researcher · primary · captured · published not stated · added by claude-story-site · watchtowr-php2shell
BLOCKED: HTTP 403 to the capture tool. Search summaries say watchTowr reports active exploitation attempts and lists the flaws as exploited in the wild.
capture 20261022T111839Z · HTTP 200 · chrome-error://chromewebdata/
headers.json ff01331edab1c463627b7d97ebbf6c6089f2893fb06dcf8f589c2d11416bf603 2,911 bytespage.html cfe1d709b20d9c9c8d6383853add5bab85c168f532041e5f4733b5cce5fed8f3 456,212 bytesprovenance.json 97a66648fa1ef3d782a7e0d1be25a472e3d4248521e20afc78bba0856d9006cb 1,001 bytesrendered.html afa2a67a0dee2a2d057885312d74f1277ab47cc85f919220d2421a6d6044265d 183,693 bytesscreenshot.png cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee 21,632 bytestext.txt 1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab 106 bytes
watchTowr · researcher · primary · captured · published not stated · added by claude-story-site · watchtowr-php2shell-faq
BLOCKED: HTTP 403.
capture 20261022T111847Z · HTTP 200 · chrome-error://chromewebdata/
headers.json 0c655abac86df9e59b49a895ed0bc35a702af92b957d5db757df55be64fd9ff8 2,908 bytespage.html 9ad5ad45ab50498bff4fec7104988da089ca1e17cc8145805e57fe493e22893c 457,843 bytesprovenance.json 779e5cb94040a7b1083dedc2aa737205276d134f02007caceae9ff3ab737420c 993 bytesrendered.html ed77bdfb70c799526cb11ef4c80486ab375a2bebf338de76275278dd5be92f25 183,669 bytesscreenshot.png cf4d945cb2330cd935081e252fc10d1572223e7a321e3d7f8c1e4e333a7737ee 21,632 bytestext.txt 1837b6e2c766cabd6d7c651bca1ee976260ea128783d9173159ed738d75ff2ab 106 bytes
Weird Gloop (cookmeplox) · vendor · primary · captured · published 2026-10-21 · added by claude-story-site · weirdgloop-blog-php2shell
Operator's own account: web servers off for 13 hours, longest outage ever, ~94% of page views served from cache.
capture 20261022T111827Z · HTTP 200 · https://weirdgloop.org/blog/php2shell
headers.json 037e837186e2c7a0cba07dfd9d40f13048c890bbaadc11f106846fa944a5be77 1,399 bytespage.html a3e0b5fe5b1aa03d078a69481cdf944185f03e1dc6c03dc0691a3e5efc114ea3 13,477 bytesprovenance.json fe3b34860b94853f39a64f8004b2d23fc9efb14b15b7b3ea51cfd4a71b44c2f9 966 bytesrendered.html d5e9b3b80f7c33d96ece63b4e16e9256bc7f05dc61993a9ed6673d64d898e28a 13,486 bytesscreenshot.png 8014b0889ab8777b9c1ef8b2562da1fe3f4c2d0d858c2727dfe7d79acae1ceaa 369,760 bytestext.txt 6bd492a6220e8eea4b3f89a098f09f546ccd4df2f38848c651a016aa215ae962 4,262 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-dan-kaminsky
Tertiary: Dan Kaminsky, for the 2008 DNS flaw.
capture 20261022T113323Z · HTTP 200 · https://en.wikipedia.org/wiki/Dan_Kaminsky
headers.json 230fef32ef2b8e3a03fd564dddff422d11bc2aaa9c55bf790e489e49cd1728d0 6,516 bytespage.html 6c89a48790d2570768a3e30b6e6773d391a8726a2ea374490158e9788351b499 239,532 bytesprovenance.json 912e913138aa6da2c78cb8a72b6f0f49ff311ecb7d55a3f3ebe018788dc415c7 940 bytesrendered.html 6965408cf93703569203e0b1fa6278195218e7179ca2f79c981126987636c876 431,088 bytesscreenshot.png 615f1446bfe1602439edb7b7273d7e7b74aeb78f40c45e5ef95312ecab6b44d8 2,208,990 bytestext.txt 565033cfb92639ca1311f148e4c1fddbec463cd655a7b253b698b0d3bbee7d5b 19,564 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-equifax-breach
Tertiary: the 2017 Equifax breach (Struts CVE-2017-5638).
capture 20261022T113329Z · HTTP 200 · https://en.wikipedia.org/wiki/2017_Equifax_data_breach
headers.json c3bc169ae4d898eb6475902410fddd73fa4ed34ce0daddd19f5f6a5f46ce5742 6,561 bytespage.html 063ebe77541faf5b4a538fb6536569545115ba07e4ece30ec4b609b3f10e0715 357,275 bytesprovenance.json f1e5a749836d6e8fa78cb7d8298991d435408424506415523c68e32f854be7ea 978 bytesrendered.html fd59a52a810139932c34d91ab988792d0f289833507ce5edaa59b5f0c50a1403 561,514 bytesscreenshot.png 87c5de1374b3c50ce76b221a56993bae2c23023f9774f9bce5dea3822cde37c9 3,123,746 bytestext.txt e38b857233007afea66a356c3b1b109917746f474776fef1897536936986af07 34,565 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-heartbleed
Tertiary: the Heartbleed article, for the context page.
capture 20261022T113241Z · HTTP 200 · https://en.wikipedia.org/wiki/Heartbleed
headers.json ebf98b097de4ce11194b4121b9de21f82d8c75e7117279bd2b10d469c923f907 6,561 bytespage.html 548f1ff2c768078511e876df9f95289590100729e454fe278693a08fc838717e 833,943 bytesprovenance.json 6ce9e63913d1a8ac51b9519d592d2eb038f9cf41bd235baf4008e90594ca666b 932 bytesrendered.html 7fa05158620c1d78de2df881c24a28d80da7f4244ada06ba16854d311e830cf5 1,113,858 bytesscreenshot.png 7affc5c7f2af7e59d01dddfa5ae745b2a322d785e9d0e23b518defaf08b9b12c 6,147,603 bytestext.txt 335a02e5907d498b4ff7cd3bb3e63c86596c9590ec307cd2b82a13a8d0b9911d 66,888 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-log4shell
Tertiary: the Log4Shell article.
capture 20261022T113317Z · HTTP 200 · https://en.wikipedia.org/wiki/Log4Shell
headers.json 87abc43f478d756f7d6b4f160635cf45fb9be84375d34b71cc12d70e91c81117 6,559 bytespage.html f21f5113f869aeb05d3c2467525fa6a946a0622c8295ec8ca5e52e2cdee958ad 350,814 bytesprovenance.json d08c417c0b7261fd57ff15f73a65ba91d48121268d596490e7f069b30b449a53 928 bytesrendered.html 6b9cee027909f277350e142b3d325f5a0575732f0b5e2c76f8c35c9361c214e3 553,202 bytesscreenshot.png a64453cfa8cdf7caa73bdc64dbb02943ed99ea9130ce83fd5c6cdd1cebdb74d5 2,405,972 bytestext.txt cd08f6a7082ea6e3cc172d7738243c4eda26331c8af2aded091e27dca5066058 25,890 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-moveit-breach
Tertiary: the 2023 MOVEit breach.
capture 20261022T113336Z · HTTP 200 · https://en.wikipedia.org/wiki/2023_MOVEit_data_breach
headers.json 5c9771f190e153438296ebd93a2e83ed2e272b0edabfdc8e90270b0e8cc36a0a 6,516 bytespage.html 586dcd3eba4df977cd0483dd2543c14bb75c8097933ea13131fa4b0913ac6847 163,389 bytesprovenance.json 9ac856ea4fd003d7c9d3e5784e6ab684a8bc8ccd3c807e4cf1174b414aee3936 974 bytesrendered.html bcc9ee65deff5809f27130574759019489d461e3374937d785fd991252a55488 339,581 bytesscreenshot.png 3348e9116d0ce06e40962d5c5f4bb2592f0ff8d1b01baab3d3911f1710f8f8f5 1,089,154 bytestext.txt ad5c2515a778a3582e85c270cfbb1178c90a7477c3f38eaf804fa10528942be1 11,123 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-php2shell
Tertiary: the encyclopaedia article, captured as a record of the public account on 22 Oct; says publicly announced 20 Oct and patched the next day.
capture 20261022T112309Z · HTTP 200 · https://en.wikipedia.org/wiki/PHP2Shell
headers.json df684951111f873760fab5d20078208e1e989557f1150d9aeaa7966ee6c8ca75 6,560 bytespage.html f306b23e38d55d74fa6405a49e04b8dd420d7f5795c1b999f7d2303feed2a904 223,796 bytesprovenance.json 16395d927a990f7bb2679d0861242bf3705586641c4f2e7bc9b839580b0eaf64 928 bytesrendered.html f51281e6ee013358343fd07568c8ef63acc38f4340841c824d6c3941004b14e3 408,195 bytesscreenshot.png ae58953f05c3bd41c5e57931462c15c8213fb7843a0c45d0b9b045b00f4ce8c5 1,586,902 bytestext.txt bbb51bbd069506b09282b45086984565ae875b5d974d121584c8e2b3c912222f 16,230 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-shellshock
Tertiary: the Shellshock article.
capture 20261022T113310Z · HTTP 200 · https://en.wikipedia.org/wiki/Shellshock_(software_bug)
headers.json f2a4b3ae6fb24202324c3478fe96ec7d871fbf062829bf047dea987ca29a646d 6,559 bytespage.html 800b60bd11e65365ea12c0db8526f932f55188ca76f3f6eaec4ff4833ba26fec 326,860 bytesprovenance.json 0468fb94f26b99cb42b1033597a200e955bd047d1d544cf0aa1e63108588a950 977 bytesrendered.html 2823f220d4e3aa6ce700cdff250ab35732495a32d273c0b6ab24dd2445aa2dc1 522,813 bytesscreenshot.png 5f62672b0225c6d055a4a1d802c68a3acf695790ff6f20fee8baaf67f7b5f21a 2,735,619 bytestext.txt 300be73066bba3f66a53bc1116a1a3c7bbe5e61695f1ce8a801c112237b61041 27,686 bytes
Wikipedia (English) · other · secondary · captured · published not stated · added by claude-story-site · wikipedia-spring-framework
Tertiary: Spring Framework (Spring4Shell section).
capture 20261022T113341Z · HTTP 200 · https://en.wikipedia.org/wiki/Spring_Framework
headers.json 93660dd4eb58188f8cdd099a1a9f09f42a33c872d13690748edc637974e623d7 6,517 bytespage.html 242f49c0d152a3caa2f0bf0cbfef5baa6f4dfcc62b890886a6f53576021af63d 622,623 bytesprovenance.json 2a065f50a364fdd1cae0a5b064fe9e7fe715a6aabe14d7e11ca72727b5b61330 956 bytesrendered.html 96223727d419aba6ee0c683f3d172a10324e28762e3f7dcb32d41519da2596a8 896,578 bytesscreenshot.png 0601fe81d23975fda4d4036553b0ff37eb4fe8ea9928d9b697df2d4791acf6da 4,931,001 bytestext.txt 710060585680e022348a35516ce4f13f4d99c2df75fe72a6ec01fe1a223081d1 49,455 bytes
Wiz (Wiz Research) · researcher · primary · captured · published 2026-10-21 · added by collector-researchers · wiz-blog-php2shell
Wiz Research post dated October 21, 2026. Source of '70% of the Internet' headline; body basis is 'powers 70% of all websites'. Disclosure timeline: discovered Aug 19, reported Aug 24, PHP ack Sep 21. Credits Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas.
capture 20261022T081047Z · HTTP 200 · https://www.wiz.io/blog/php2shell-php-rce
headers.json f3a7f515bda9ae91541c7792cad2fbb4d5864a7962be4f5db93bccbe8caa2d03 5,075 bytespage.html 32408c9f60071e7bdcf0e702160f6c398d6967cb89fbc81b5f0e0029e34af07b 438,665 bytesprovenance.json 4e362d46ccd571e124b20fb3518c8d00076dc508a0146ee5338a7dce931d1fa1 1,002 bytesrendered.html 6db43e32910bdf4bc2b82a93afa5097900aa4a205b5cdde32d1a2510beff4c68 580,534 bytesscreenshot.png 4ba83874c540e1f7faf4c817b6b8c3ae1ef61eacda5851a112d6601e47d6d91f 2,753,995 bytestext.txt e3568b6f88c93f6bb08eebe3c8811f9fd283212f7331b287d5170b91d6bad1ea 19,147 bytes
Matthew Prince (@eastdakota), Cloudflare CEO · social · primary · captured · published 2026-10-22T01:25Z · added by claude-story-site · x-eastdakota-php2shell-stats
Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture.
capture 20261022T111808Z · HTTP 200 · https://x.com/eastdakota/status/2113079352682570051
headers.json d77dc66c0c59c96e2e54ddfecf08d3b1bd24635a9d74435e5e11a42df31beefb 9,023 bytespage.html 957516e4670ab0fa18a3dbfcc6a2a4fb7bf154370fd7b09506a876e6d327f357 143,568 bytesprovenance.json 6ef963e6f636da1603f65de2817e02480ed92a2c4d5b330a151bc2d515c21277 1,249 bytesrendered.html 25a31a5f7554396a5640c88efcf0624e0eab811ea96a53cebc603eb9c55925ad 165,274 bytesscreenshot.png 7a098d734f074f04d4c95973bd0f4463f3c18bd7aaf274912a6eea795095879c 216,866 bytestext.txt 4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3 1,884 bytes
Feross Aboukhadijeh (@feross) on X · social · secondary · captured · published 2026-10-22 · added by claude-story-site · x-feross-chainguard
A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.
capture 20261022T112105Z · HTTP 200 · https://x.com/feross/status/2113043398664015878
headers.json c7243f6c403eb56e9b3d6e563eb8a8b216ea9dd8211fb1b22d4707fb94277f57 9,023 bytespage.html a96f60627079ac4894ec940931bd0fd5f7aafe3bf8894230fb3292b941681412 192,869 bytesprovenance.json a7be68aef95eb2bd14be51e50215f101dd44d0e36eb5539a9393115df9ab4ce2 1,233 bytesrendered.html 61fc4e7f751c5a119c9a9a1081b8c47669ac9fe2d7dfd07833772658c39e8fdf 173,209 bytesscreenshot.png 75299998b6abad9947b1d3f6d8ce0f477a1e8980c7f9484bdde10796bfc16bb1 560,505 bytestext.txt de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6 5,709 bytes
OpenAI (@OpenAI) · social · primary · captured · published 2026-10-21T14:04Z · added by collector-researchers · x-openai-php2shell
Shown '14:04 · 21 Oct 2026', 5.2m views. Full text captured (stands in for the blocked openai.com post). Carries an X Community Note disputing OpenAI's discovery role and linking lcfr_hax.
capture 20261022T081645Z · HTTP 200 · https://x.com/OpenAI/status/2112907856018309586
headers.json 427b75f5bb12cb7b0acee221f2065095d92c82279e0db87f9b80909525886df3 9,023 bytespage.html 8e6a0183b6982e8530d7b48277e4b0f6f010b22d3348b30328cc4460cc371d90 160,064 bytesprovenance.json 3e52aad242520de5ca4db4103baf86c58e7d477a8f7c04c19b841034f1ca49e3 1,232 bytesrendered.html 2e31eee6ab72f0703675cd74158267dbe5cfb55bf03b80153deaa1b899be4c10 147,195 bytesscreenshot.png aaf750d50e69e80b34fbdf908a9fdc330ac315b765eacb2e3e8361cb40f2cbb2 570,247 bytestext.txt 785b7cae55e3748b3d11e002f9b254408a57849c1ef08eb9fcc16a2cd196f189 3,316 bytes
Wiz (@wiz_io) · social · primary · captured · published 2026-10-21T13:32Z · added by collector-researchers · x-wiz-io-php2shell
Shown '13:32 · 21 Oct 2026' (UTC in capture browser) — 28 min before the 14:00 UTC release. Thread says 'Apply the Oct 22 security release immediately' — stale date from the original schedule.
capture 20261022T081624Z · HTTP 200 · https://x.com/wiz_io/status/2112899813264277528
headers.json f9a8ec8c80b7e7b13a6e772a718ece30ec0796dffd3481acc57a310616eca249 9,022 bytespage.html 6adc23abb012a9e89f22453d2d8d4f0eff574edc67373bc94eef59cfc12ebe85 183,867 bytesprovenance.json 5df6949985ad1cf4a150d5b9a7e52f1355bac3b127484b31c70c8052986b1556 1,086 bytesrendered.html 9c5f87ac8afbe6aad1205a23ecbe79d83dc801c77f4d0ffb750ffb5b53625888 193,354 bytesscreenshot.png d2187dc09d49ec23ea5593aa7ffef5df60cd2385f290922ec6d77b6861fc7abb 578,314 bytestext.txt 6c17977662815b0cb25a32e0987d1b1f95942156825b0cc616dc43a3f7f46809 2,222 bytes
Yle (Finnish public broadcaster) · news · secondary · captured · published 2026-10-21 · added by claude-story-site · yle-finland-government-sites-shut
Finland temporarily shuts government websites as a precaution; Valtori; NCSC-FI rated 9.2, no sign of exploitation.
capture 20261022T113225Z · HTTP 200 · https://yle.fi/a/74-20252600
headers.json 629207adb678c676219268f5339e1768a1aa4af6f503c8ab3dc33a9690a1dc94 4,002 bytespage.html 2845424a60768d77b6561e42e259b0675624771b8b77baa4741fbaf4cd0103c8 325,894 bytesprovenance.json e77236132533b194633ab7767e55f09e2854beb49c9ce44fc2725e3606534e78 1,011 bytesrendered.html 156e30b543681b560d3356d18ca5ff9531fa172e3e81f59ceae7ec8662120dd9 269,020 bytesscreenshot.png f6f90718b94a07351d302934a8a237c2e0360d1ac9ae51e79faf8a29afdaf46e 2,031,875 bytestext.txt 720785d651f827be6d44f009bb84e15924a410299bf53fbe4f193194c1c30a57 6,283 bytes