# Source: PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

合同会社ロケットボーイズ: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab

**合同会社ロケットボーイズ** · [https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/](https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/) · published 2026-10-22T14:56:52+00:00 · added by `curator@php.newsroom` · slug `rocket-boys-security-measures-lab-php2shell-poc-expl`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). Security Measures Lab / Rocket Boys (Japanese), 22 October: proof-of-concept code for PHP2Shell is surging on GitHub. The Korean firm AhnLabs examined...

## What it says, as the collector read it

#### PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/rocket-boys/security-measures-lab-php2shell-poc-exploitation-20261022`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Security Measures Lab / Rocket Boys (Japanese), 22 October: proof-of-concept code for PHP2Shell is surging on GitHub. The Korean firm AhnLabs examined 100 related repositories on GitHub on 22 October and counted 27 classified as PoCs; Amazon Threat Intelligence reported attempts from four days before disclosure. The curator did not fetch any of the repositories or code.

> 韓国のセキュリティ企業AhnLabは2026年10月22日、GitHub上の関連リポジトリ100件を調査し、PoCに分類される27件を確認したと公表しました。

_Curator's translation:_ "On 22 October 2026 the Korean security company AhnLab announced that it had examined 100 related repositories on GitHub and confirmed 27 classified as PoCs."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Security Measures Lab (Rocket Boys) analysis. Korean security firm AhnLab surveyed GitHub on 22 Oct: of the top 100 non-fork 'php2shell' repos, 99 were related, 46 defensive and 36 attack/PoC, with 27 classed as PoC; the earliest PoC repo was created 20 Oct 19:16 UTC. It also retells Amazon's MadPot observations from 17 Oct and warns about fake PoCs.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell(CVE-2026-109618／CVE-2026-109619)のPoCがGitHubで急増、27件を確認 Amazonは公表4日前からサイバー攻撃の試行を観測|セキュリティとITのニュース-セキュリティ対策Lab". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `ja`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://rocket-boys.co.jp/security-measures-lab/php2shell_poc_exploitation_20261022/- `headers.json` 2fa11046b852bd7af02b3a4a36eff2eab616cdb9797f80587b3065a2cd420f54 1,444 bytes
- `page.html` 0d96245e6d02d7170bb3666d25918320a9728cf856c4d4a8f0a52f23520fc7b1 615,369 bytes
- `provenance.json` 77749fc927be896e16ce7318e493d0d9ecf80ea4996f0cbb3b84d35851cb616f 1,904 bytes
- `rendered.html` 7c53e1dbafedd63bc6a78deaeed6c424f6769f27ae8759d206c1d5e18a290244 628,633 bytes
- `screenshot.jpg` 9e4bfc3e74986643d92c2075b3db42e1f1ead0838b37b7c1777e22db8b1821a4 1,087,188 bytes
- `text.txt` 200b9c25496ebb7c2ce6a67438d5aa9ff91913881792669617d5194d17301151 24,573 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.14.5 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/sources/rocket-boys-security-measures-lab-php2shell-poc-expl/index.html