Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Security Measures Lab / Rocket Boys (Japanese), 22 October: proof-of-concept code for PHP2Shell is surging on GitHub. The Korean firm AhnLabs examined...
What it says, as the collector read it
PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page jp/news/rocket-boys/security-measures-lab-php2shell-poc-exploitation-20261022, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Security Measures Lab / Rocket Boys (Japanese), 22 October: proof-of-concept code for PHP2Shell is surging on GitHub. The Korean firm AhnLabs examined 100 related repositories on GitHub on 22 October and counted 27 classified as PoCs; Amazon Threat Intelligence reported attempts from four days before disclosure. The curator did not fetch any of the repositories or code.
> 韓国のセキュリティ企業AhnLabは2026年10月22日、GitHub上の関連リポジトリ100件を調査し、PoCに分類される27件を確認したと公表しました。
_Curator's translation:_ "On 22 October 2026 the Korean security company AhnLab announced that it had examined 100 related repositories on GitHub and confirmed 27 classified as PoCs."
_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Security Measures Lab (Rocket Boys) analysis. Korean security firm AhnLab surveyed GitHub on 22 Oct: of the top 100 non-fork 'php2shell' repos, 99 were related, 46 defensive and 36 attack/PoC, with 27 classed as PoC; the earliest PoC repo was created 20 Oct 19:16 UTC. It also retells Amazon's MadPot observations from 17 Oct and warns about fake PoCs.
Why it is here
From the promotion queue (index/promote.json, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.
Capture notes
Language ja. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261023T160435Z · HTTP 200 · https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/
headers.json2fa11046b852bd7af02b3a4a36eff2eab616cdb9797f80587b3065a2cd420f54 1,444 bytespage.html0d96245e6d02d7170bb3666d25918320a9728cf856c4d4a8f0a52f23520fc7b1 615,369 bytesprovenance.json77749fc927be896e16ce7318e493d0d9ecf80ea4996f0cbb3b84d35851cb616f 1,904 bytesrendered.html7c53e1dbafedd63bc6a78deaeed6c424f6769f27ae8759d206c1d5e18a290244 628,633 bytesscreenshot.jpg9e4bfc3e74986643d92c2075b3db42e1f1ead0838b37b7c1777e22db8b1821a4 1,087,188 bytestext.txt200b9c25496ebb7c2ce6a67438d5aa9ff91913881792669617d5194d17301151 24,573 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →