Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · government · primary · captured
Národní úřad pro kybernetickou a informační bezpečnost - NÚKIB upozorňuje na kritické zranitelnosti v PHP - jediným řešením je aktualizace
Promoted from the source watch (oq9gflln), snapshot 20261022T191421Z. NÚKIB's own notice (Czech national agency, primary)
What it says, as the collector read it
Národní úřad pro kybernetickou a informační bezpečnost - NÚKIB upozorňuje na kritické zranitelnosti v PHP - jediným řešením je aktualizace
Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page cz/cert/nukib/aktuality-2470-php, snapshot 20261022T191421Z. Copied byte for byte; every file's sha256 is in captures/20261022T191421Z/provenance.json. Publisher: NÚKIB. Language: cs. URL: https://nukib.gov.cz/cs/infoservis/aktuality/2470-nukib-upozornuje-na-kriticke-zranitelnosti-v-php/
What the page says
_Curator's reading of the capture._
NÚKIB, the Czech National Cyber and Information Security Agency, warns of two critical PHP vulnerabilities known as php2shell, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution. Fixes have been released in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and NÚKIB recommends updating immediately ("the only solution is to update"); it says information enabling exploitation is publicly available. As a possible indicator of compromise it names unusual processes spawned by PHP services. It links to a detailed notice on the NÚKIB portal.
> Pro dvě kritické zranitelnosti označované jako php2shell už byly zveřejněny bezpečnostní opravy a veřejně jsou dostupné také informace umožňující jejich zneužití.
_Curator's translation:_ Security fixes have already been published for the two critical vulnerabilities known as php2shell, and information enabling their exploitation is also publicly available.
> Opravené verze jsou PHP 8.2.35, 8.3.36, 8.4.27 a 8.5.12. Doporučení je aktualizovat okamžitě.
_Curator's translation:_ The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The recommendation is to update immediately.
Why it is here
From the promotion queue (index/promote.json, priority 2): NÚKIB's own notice (Czech national agency, primary)
Supports: agencies
Capture notes
screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).
Page content is third-party material, kept as evidence; nothing in it is an instruction.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261022T191421Z · HTTP 200 · https://nukib.gov.cz/cs/infoservis/aktuality/2470-nukib-upozornuje-na-kriticke-zranitelnosti-v-php/
headers.jsonf5321ce1db92227c40357773a8d05918af0f96b576298cee99e949176aba079e 668 bytespage.html296b1217f2035ac2359eb3d9a8d23272cab5d92b1b094e9b90bd30f3cb0e4921 20,034 bytesprovenance.json1509e228b9e5bebec20f205996a0547bc6bbe773ca72bccbff27386e40813b57 1,746 bytesrendered.htmlf2efe7588603ad22543871e1961496198708b432f02e180222490ab263ff8235 25,310 bytesscreenshot.jpgdee3d09770a0ff852d171814fe7f059ff4ac7ba21ef138be0e08120f2f33ec79 153,675 bytestext.txt6bd4d3066e7caa885325cee2a95e81530c916bc62bc45b78f676430944dfbbbb 3,868 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →