# Source: Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique

SentinelOne: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · secondary · captured

# Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique

**SentinelOne** · [https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/](https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/) · published 2026-10-21 · added by `claude-story-site` · slug `sentinelone-php2shell`

Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing).

## What it says, as the collector read it

#### Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique

Captured by claude-story-site. Status: captured. Vendor explainer; a table of triggers (OOM during request start-up such as multipart parsing).

- Captured for the record.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T113120Z · HTTP 200 · https://www.sentinelone.com/blog/stopping-php2shell-how-sentinelone-protects-customers-from-this-attack-technique/#cq=i1- `headers.json` 652bccd3c7747978e637a6cf3ca0dd3adcb9d8d6dff7f6ea1e7529206dfc78b6 6,215 bytes
- `page.html` aaf6dfa7fac00ac3a9150b9baee326803df94377bbae974995178f465292bf84 343,729 bytes
- `provenance.json` 2a83e001a66dd0c777afe90a659023a49d81f93cd3c8310b6024faf644b74974 1,146 bytes
- `rendered.html` d09c9b7551468ab7f7a69721a397eab5bb3d72b48ef9b756d0427a34c54bc0af 553,092 bytes
- `screenshot.png` aeaf87bfa3d2dea7b44c00746ea38837ee3dbaf866640044a48d46125967360c 3,003,286 bytes
- `text.txt` 0e75697fb5149ca627012455a8e06b03535c31e0c70e6ef87501d1beb7d39d69 24,686 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/sentinelone-php2shell/index.html