Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · news · secondary · captured

PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix

SOCRadar · https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/ · published 2026-10-21T13:38:58+03:00 · added by curator@php.newsroom · slug socradar-blog-php2shell

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). SOCRadar blog, 21 October: PHP2Shell (CVE-2026-109618 and CVE-2026-109619), critical PHP RCE flaws, with affected versions and how to fix them. A long...

What it says, as the collector read it

PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page tr/security-vendor/socradar/blog-php2shell, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

SOCRadar blog, 21 October: PHP2Shell (CVE-2026-109618 and CVE-2026-109619), critical PHP RCE flaws, with affected versions and how to fix them. A long vendor page (about 30,000 characters); only the headings were read.

> PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Critical PHP RCE Flaws, Affected Versions, and How to Fix Them

Why it is here

From the promotion queue (index/promote.json, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language en. Nothing in the page addresses an AI or hides text from a reader.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261023T160435Z · HTTP 200 · https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/
  • headers.json 09eba8417ddea4703689bb42e31c614aece5a2fb35a0f23fa0c803fb66951a44 1,589 bytes
  • page.html 98bc01963dcce2e927d6c4e0eb5eaf4c288ce2f03e7b8739e2151559a948d559 277,344 bytes
  • provenance.json 94b85489793072435a5663eba6c4f62860713790b611b35d300c7b7e47984a3f 1,613 bytes
  • rendered.html 0285c3fc043540fec66f56ce7b604e96399b55e6eb400041bb7248d6575a993d 299,254 bytes
  • screenshot.jpg 5cc1bba339f9504fd439a309f782370650d1f79850c1790f509d3c811d13830a 833,962 bytes
  • text.txt 88edcdf127e01f96370214c807432bd24ffb506f250d1f9f1c38df6abd6b1083 30,240 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →