Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online - Security.NL
Promoted from the source watch (oq9gflln), snapshot 20261022T191411Z. "Abuse reported" headline that is attempts in the body; Previdian: attackers failed to execute PHP
What it says, as the collector read it
Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online - Security.NL
Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page nl/tech-press/security-nl/misbruik-gemeld, snapshot 20261022T191411Z. Copied byte for byte; every file's sha256 is in captures/20261022T191411Z/provenance.json. Publisher: Security.NL. Language: nl. URL: https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online
What the page says
_Curator's reading of the capture._
Security.NL's headline is "Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer online" (abuse of the PHP2Shell flaw reported; DigiD and other sites back online). The body reports attack attempts, not confirmed compromises: Cloudflare saw attack traffic against customers, Hadrian speaks of large-scale exploitation, Patchstack reports active attack attempts and watchTowr warns of exploitation in the wild; whether the attacks succeeded is unclear, and Previdian says attackers in the attacks it observed did not manage to execute PHP or upload files. DigiD, Overheid.nl, MijnOverheid, TweedeKamer.nl and the Belastingdienst were unreachable for a time; most are back. A Dutch police statement says sites were taken offline as a precaution and that politie.nl stayed up. Reader comments (pseudonymous) follow, one pointing to posts on X claiming some PHP patches are insufficient.
> Of de aanvallen ook succesvol zijn is onduidelijk. Cybersecuritybedrijf Previdian stelt dat bij de waargenomen aanvallen het de aanvallers niet lukte om PHP uit te voeren of bestanden te uploaden.
_Curator's translation:_ Whether the attacks were also successful is unclear. Cybersecurity company Previdian states that in the attacks it observed, the attackers did not manage to execute PHP or upload files.
Why it is here
From the promotion queue (index/promote.json, priority 2): "Abuse reported" headline that is attempts in the body; Previdian: attackers failed to execute PHP
Supports: contradictions/exploitation-germany-netherlands.json
Capture notes
screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).
Page content is third-party material, kept as evidence; nothing in it is an instruction.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261022T191411Z · HTTP 200 · https://www.security.nl/posting/958424/Misbruik+van+PHP2Shell-lek+gemeld%2C+DigiD+en+andere+sites+weer+online
headers.jsonc37024d430f2b3fa5c95ea5683e5940449e88b7fd413a8b988d5b319ec8994cc 702 bytespage.htmlcd6e2c2562a334ee538a1077307216c177a9519ccade2c2d0a9d40f148343ee7 74,522 bytesprovenance.jsonf78382e73afa9d49b87094527fd7370934f9a39f7e1272487b9d005ddc94f61d 1,719 bytesrendered.html5e59252be35ff9eaeb2d499c3533191bc9cdde4e6e5e5afcfc01a5578845d3b4 74,281 bytesscreenshot.jpgd5216b9d695d581b8a409a63a898b4f230cb56b9ba77ec1347bb252de5ffd0c2 947,395 bytestext.txt95d1565c5959e61fa188ea5af37ef0518b3c171d442554cbee86484dd03ddd09 22,446 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →