# Source: Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The Star: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star

**The Star** · [https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/22/serious-language-programme-php039s-security-flaw-leaves-internet-websites-at-major-risk-reports-dpa](https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/22/serious-language-programme-php039s-security-flaw-leaves-internet-websites-at-major-risk-reports-dpa) · published 2026-10-22T12:48:00.000Z · added by `curator@php.newsroom` · slug `thestar-aseanplus-aseanplus-news-2026-10-22-seri`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). The Star (Malaysia), a dpa wire report of 22 October: PHP's security flaw leaves websites at major risk. Security experts warned of two critical vulne...

## What it says, as the collector read it

#### Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `my/news/thestar/aseanplus-aseanplus-news-2026-10-22-serious-language-program`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

The Star (Malaysia), a dpa wire report of 22 October: PHP's security flaw leaves websites at major risk. Security experts warned of two critical vulnerabilities in the core of PHP, dubbed PHP2Shell and registered as CVE-2026-109618 and CVE-2026-109619.

> Security experts warned of two critical vulnerabilities in the core of the programming language, dubbed "PHP2Shell" and registered under the official identifiers CVE-2026-109618 and CVE-2026-109619.

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ The Star (Malaysia) runs a dpa wire story from Berlin: PHP2Shell shakes websites worldwide, CERT-EU urges isolation, and the patch is out. Heise Security warned that working exploit scripts would appear within hours and advised disconnecting PHP servers until patched.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "Serious language programme PHP's security flaw leaves internet websites at major risk, reports dpa | The Star". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `en`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/22/serious-language-programme-php039s-security-flaw-leaves-internet-websites-at-major-risk-reports-dpa- `headers.json` 6821f5025b8949aeddbf985a428f0baf8d02f287b669ee066a7dfecdc0ecd764 1,374 bytes
- `page.html` b0bf2d6452f14d74d1e3257844ee35730c93de2f0da5bef61322cda24943076d 423,848 bytes
- `provenance.json` 6de00b038120b27d2949aeaa6f4916ddef07cd08a99baa6b6ddf1e53fd7466ef 1,945 bytes
- `rendered.html` fd7b35fbbccd69663821a4bb016415ce72b4e8e16f05dfc0143461f5f7668bb0 526,354 bytes
- `screenshot.jpg` 7834b934aa582fdd0dc3d3c29742f93983d06719ada07f891f5e5eb6cf24c6f7 544,408 bytes
- `text.txt` 465bf0298d2e3f5d97b451b1816104c3d11790e4a222732501d273842e71bcb0 6,304 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/sources/thestar-aseanplus-aseanplus-news-2026-10-22-seri/index.html