# Source: php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security

Lorikeet Security: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · secondary · captured

# php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security

**Lorikeet Security** · [https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities](https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities) · published 2026-10-21 · added by `claude-story-site` · slug `lorikeet-php2shell`

Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence.

## What it says, as the collector read it

#### php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | Lorikeet Security

Captured by claude-story-site. Status: captured. Vendor explainer with an example Suricata rule (sid 2026109618) of questionable direction; no testing evidence.

- Captured for the record of the rule.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T112438Z · HTTP 200 · https://lorikeetsecurity.com/blog/php2shell-leaked-critical-php-vulnerabilities- `headers.json` b7888c7584d4891b481a804cc3243ec9dff82d301a8ac2c7070c6b7f25bd5fe2 1,727 bytes
- `page.html` b74c194ddfc61843d47bd6ffa9d691718fab73fa370cf3c82d1cd24ea3f3f998 343,430 bytes
- `provenance.json` 38298cededb4b803f1214bfa4a6a30e1cdf06ddc417f0771577affd057d13e5a 1,123 bytes
- `rendered.html` 38608a412a2fb2a979d5821ccb1a9764037d3d2bbad075a509f0d25884973ae5 904,734 bytes
- `screenshot.png` 281038d16371213c89c2ce9df773de5a82e6eac69bdfe5c855e3975b02ac6387 8,419,643 bytes
- `text.txt` db7958824da2628a693fcca386ac3ea9994977209f017b245fab2d3e894cb349 37,837 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/lorikeet-php2shell/index.html