About this site

What this site is

PHP2Shell Live collects public information about CVE-2026-109618 and CVE-2026-109619 and places it in a dated, source-linked record. It is written for developers, system administrators and security practitioners who need to answer three questions quickly: what is confirmed, what should I do, and where did that claim come from?

“Live” means the record is maintained over time. It does not mean this site has attack telemetry, a global remediation rate, a victim map or a real-time monitoring service. It does not.

Editorial policy

Key technical facts are taken from primary sources: the project or vendor that owns the software, a government or CERT advisory, or a structured advisory record. Media reporting is used for timeline and context, and is followed back to its primary source. Social posts are treated as discovery leads.

Every key fact carries an evidence label. “Confirmed by primary source” means a primary document supports the claim. “Vendor report” and “Media report” mean the claim is attributed, not adopted as confirmed. “Unconfirmed” means the site could not verify it. These are evidence categories, not confidence percentages.

The site separates four things that are often collapsed: a proof of concept, laboratory exploitation, an observed exploitation attempt, and a confirmed compromise. It also separates patch status from exploitation status and from KEV status. A patch release does not mean every host installed it; a KEV listing does not provide a victim count; KEV absence does not prove no exploitation occurred.

When sources conflict, the record states the conflict. It does not let the most recently fetched page overwrite an earlier verified fact. When a source gives only a date, the site displays only a date.

Corrections

Substantive changes are recorded in each page’s revision history. A correction that changes a fact is called out explicitly; a copy edit is not. The timeline may add a separate “Correction” entry when a previously circulated claim is materially wrong, as with the leaked CVSS 10.0 figure.

Send corrections and source suggestions to contact@php2shell.live, or use the contact page. The same address is for site feedback and partnership enquiries. There is no contact form, and no response time is promised. Do not send sensitive information to an address you have not verified independently.

How the content was compiled

This edition was compiled with software assistance: sources were retrieved, read and cross-checked, then the summaries, labels and diagrams were drafted and reviewed against those sources. Automated collection is limited to official feeds and metadata. It does not write the published analysis, and it does not publish candidate material without review.

The site does not use a paid search API or a hosted language-model API at runtime. There is no server-side application or database behind the public pages.

Licensing and attribution

The original text, layout and SVG diagrams on this site were created for PHP2Shell Live. They may be quoted with attribution and a link to the page. The diagrams are original illustrations based on the cited advisories; they are not copied vendor figures.

Linked articles, advisories and reports remain the property of their publishers. This site does not republish their full text. Short factual summaries and links are provided so readers can consult the original. Trademarks and product names belong to their owners.

Privacy

There are no cookies, advertising scripts, analytics, tracking pixels or third-party embeds. The theme choice is stored in the browser's localStorage as a local preference; it is not a cookie and is not sent to this site or a third party. Search runs against a local index fetched from this site; search terms are not sent to a third party. The only external requests are the ones a reader chooses to make by following an outbound source link.

The site is static. It does not have a login, comment system, newsletter or contact form; correspondence is by email. No personal data is collected by the pages themselves. A hosting provider may keep standard access logs under its own policy; that is outside this site’s code.

Limits and disclaimer

This is a public-information record, not legal advice, not a security assessment of any particular system, and not a substitute for the official advisory or your vendor’s instructions. Configuration examples are illustrative; package names, service names and directive scope vary by platform.

The research cut-off for this edition is 23 October 2026, 15:45 UTC. Events after that time are not covered until a refresh and review. “No confirmed compromise” is bounded by the sources reviewed; it is not a claim that no compromise occurred.

Contact and provenance

Contact: contact@php2shell.live. The contact page explains what to send and what not to send. No response time is promised.

This site is not affiliated with the PHP Group, the PHP Foundation, any security vendor, or any government agency. It does not speak for them.