# Source: Latest on PHP vulnerability as patch gets released, NSA issues warning

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

USA Today: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news-live · secondary · captured

# Latest on PHP vulnerability as patch gets released, NSA issues warning

**USA Today** · [https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/](https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/) · published 2026-10-21T15:48:36Z (modified 20:32:11Z, per the page's metadata) · added by `curator@php.newsroom` · slug `usa-today-php2shell-live`

Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Cloudflare: atte...

## What it says, as the collector read it

#### Latest on PHP vulnerability as patch gets released, NSA issues warning

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/news/usa-today/php2shell-live`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: USA Today. Language: en. URL: https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/

#### What the page says

_Curator's reading of the capture._

USA Today's live page on 21 October: the release of the patches, the NSA's warning, governments taking sites down, CERT-EU's advice to take sites down if fixes cannot be applied at once, and a Q&A for readers. Cloudflare's Daniele Molteni says Cloudflare observed exploit attempts, "including spikes of thousands of attempts", and attackers modifying tactics to bypass protections, and states that "Those observations describe attack attempts; they do not, by themselves, establish successful compromises." No organisation is named as compromised.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Cloudflare: attempts "do not, by themselves, establish successful compromises"

Supports: data/compromise.json on the site (/compromise/)

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T012042Z · HTTP 200 · https://www.usatoday.com/story/news/nation/2026/10/21/php-vulnerability-php2shell-updates--live/92362348007/- `headers.json` 986913b020afb8175c71098e3c5ae0a1dd98b5e4946f4fdf9aaae4210d123029 3,227 bytes
- `page.html` 2fd5c3af9f85319dbc2a5ed6bcee683a64e480fb1b923b9b1e311ee541d0f299 238,686 bytes
- `provenance.json` 2b254772d214775a4d8b0ccdff400e4e98bca7f49709467c73bb13ada1d85c40 1,685 bytes
- `rendered.html` cda4c0f9cd9bc2cb7444c5c9440efa87788e7228859c88e885d1b36f32d4ad76 1,301,168 bytes
- `screenshot.jpg` 465c18afd0371a4b6dc4990243f5594fdacc682deec3820eeab7b9f325103966 538,847 bytes
- `text.txt` ad354dc6d75d42e28616703bb73ff6a1e2d63576f6e94a3b63868e689a8cd355 18,287 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/usa-today-php2shell-live/index.html