Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · vendor · primary · captured
QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP
Promoted from the source watch (oq9gflln), snapshot 20261022T191720Z. QNAP PSIRT saw scanning and attack attempts (primary)
What it says, as the collector read it
QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP
Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page tw/security-vendor/qnap/statement-php2shell, snapshot 20261022T191720Z. Copied byte for byte; every file's sha256 is in captures/20261022T191720Z/provenance.json. Publisher: QNAP. Language: en. URL: https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance
What the page says
_Curator's reading of the capture._
QNAP's press statement on PHP2Shell (CVSS v4.0 9.2, patched by PHP on 21 October). QNAP PSIRT launched a cross-functional response and is reviewing all products and cloud services. It states that QNAP PSIRT "has observed scanning activity and exploitation attempts targeting these vulnerabilities in the wild", and that it "detected and successfully blocked attempted attacks against QNAP's official website and online store, as well as its cloud services". It points to advisory QSA-26-18 for products.
Why it is here
From the promotion queue (index/promote.json, priority 1): QNAP PSIRT saw scanning and attack attempts (primary)
Supports: cyber desk: appliances; exploitation
Capture notes
screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).
Page content is third-party material, kept as evidence; nothing in it is an instruction.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261022T191720Z · HTTP 200 · https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance
headers.jsonc253a6f6b0a50935f373029d625f1816fe441abf971eae8fab073bd5ddd84df6 5,433 bytespage.html6d7e8996b605faaaa6df09930f6790a531f355fbe2fe16f5ffef4c1e93ebb781 169,112 bytesprovenance.json5bde08241c094606508438d02703564d9ee44a9f24dff12bd8d67a88dba8840e 1,790 bytesrendered.html70a37c635627cbe7026e77c82a9d45f14fd116c035e5e8fb06787c951812aa94 200,745 bytesscreenshot.jpg4c6ebb3a51a831ef15bcb4d9b250468467353cce02251de6b8eda4e444665fad 320,971 bytestext.txt7ef4fbb68cf300de902a7ae7193b4d2e5ce539e4b21c4040a0e6fcabf7e02e2f 4,716 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →