{"metadata": {"vulnerability": "CVE-2026-115560", "count": 52, "kinds": {"milestone": 3, "sighting": 44, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "vendor_advisories.5.published_at"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": true, "value": "2026-10-21", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": false, "value": "2026-10-21T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-21T00:06:08Z", "date_only": false, "value": "2026-10-21T00:06:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-37", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "838e19b1-9c11-44f6-8c61-1eb17202a5d2", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-37"}, {"timestamp": "2026-10-22T00:00:00Z", "date_only": false, "value": "2026-10-22T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "revisions.2.revision_date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": true, "value": "2026-10-23", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-10-23T09:15:31Z", "date_only": false, "value": "2026-10-23T09:15:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "261cb60a-d85a-49ca-9396-cec9981cc022", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619"}, {"timestamp": "2026-10-23T09:25:43Z", "date_only": false, "value": "2026-10-23T09:25:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "40a07120-90a7-44fe-a6ff-be89589bdead", "content": "PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.\n\nThe new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called", "url": "https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html"}, {"timestamp": "2026-10-23T11:27:18Z", "date_only": false, "value": "2026-10-23T11:27:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10433", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "04f0542b-ab61-41ed-bd2b-00f1ba270097", "content": "\u203c\ufe0f BREAKING \u203c\ufe0f PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.\n\nNew \"CVE-2026-115560\" affects only unusual session configurations. PHP has issued urgent mitigation guidance.\n\nFull details \u2192 https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html", "url": "https://t.me/thehackernews/10433"}, {"timestamp": "2026-10-23T12:17:35.526Z", "date_only": false, "value": "2026-10-23T12:17:35.526164Z", "kind": "sighting", "label": "Seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117490178168589732", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "1b4c1aac-684d-483e-833b-dee658800ffd", "content": "There is another PHP potential RCE vulnerability - CVE-2026-115560  - without a patch. Do not panic. \nIt is a non-default configuration and will not be a widespread issue. \nThe mitigations in this thread already fix it, if you want to panic. \nhttps://fosstodon.org/@php/117489802289942474", "url": "https://cyberplace.social/users/GossiTheDog/statuses/117490178168589732"}, {"timestamp": "2026-10-23T13:44:55.389Z", "date_only": false, "value": "2026-10-23T13:44:55.389591Z", "kind": "sighting", "label": "Confirmed", "source": "https://x.com/thephpf/status/2113580383875019242", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "16865669-d759-4d54-9121-ca5cd85ce720", "url": "https://x.com/thephpf/status/2113580383875019242"}, {"timestamp": "2026-10-23T14:20:07Z", "date_only": false, "value": "2026-10-23T14:20:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8749", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "4486e463-3c2b-4f3a-9ce6-7b0204628131", "content": "\u041f\u043e\u0434 \u043a\u043e\u043d\u0435\u0446 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0435\u0434\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0442\u0438\u043c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. \u041e\u043d\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 RCE \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 CVSS 10/10. CVE-2026-110264 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 GitLab, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 7.0, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u0432 2014 \u0433\u043e\u0434\u0443.\n\n2. Arista Networks \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0439 0-day \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 VeloCloud Orchestrator, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. CVE-2026-114625 - \u0443\u0436\u0435 \u0442\u0440\u0435\u0442\u044c\u044f 0-day \u0432 VeloCloud, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443.\n\n3. \u0413\u043e\u043b\u043b\u0430\u043d\u0434\u0441\u043a\u0430\u044f Eye Security \u0443\u0434\u0430\u043b\u0438\u043b\u0430 \u0437\u0430\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043f\u0438\u0440\u0430\u0442\u0441\u043a\u043e\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 Popcorn Time \u0441 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 2 \u043c\u043b\u043d. \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Windows \u0438 macOS.\n\n\u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0434\u043e\u043c\u0435\u043d\u0435 \u0441 \u0438\u0441\u0442\u0435\u043a\u0448\u0438\u043c \u0441\u0440\u043e\u043a\u043e\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0438 \u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b\u0438. Eye \u0441\u0434\u0435\u043b\u0430\u043b\u0430 \u044d\u0442\u043e \u0432 \u043e\u0431\u0445\u043e\u0434 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432, \u0430 \u043f\u0430\u043a\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0438 \u0431\u044b\u043b \u043f\u043e\u043c\u0435\u0447\u0435\u043d \u043a\u0430\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n4. PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e\u0431 \u0435\u0449\u0435 \u043e\u0434\u043d\u043e\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f PHP2Shell. CVE-2026-115560 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439.\n\nPHP \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0435\u0451 \u0443\u0433\u0440\u043e\u0437\u043e\u0439 \u0441 \u043c\u0430\u043b\u043e\u0432\u0435\u0440\u043e\u044f\u0442\u043d\u044b\u043c \u0440\u0438\u0441\u043a\u043e\u043c \u0438 \u043d\u0435 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435. \u0412\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e, \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u0443\u044e \u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0435\u0441\u0441\u0438\u0438, \u0434\u043e \u0442\u0435\u0445 \u043f\u043e\u0440, \u043f\u043e\u043a\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435 \u0431\u0443\u0434\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u043f\u043b\u0430\u043d\u043e\u0432\u043e\u043c \u0440\u0435\u043b\u0438\u0437\u0435.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, Sophos \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PHP2Shell \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 Potassium, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043f\u043e \u0435\u0435 \u043c\u043d\u0435\u043d\u0438\u044e, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u043c \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai.\n\nSansec, \u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0432\u0448\u0430\u044f \u0440\u0430\u043d\u0435\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 15 \u043c\u0438\u043d\u0443\u0442 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043f\u0430\u0442\u0447\u0430, \u043f\u0435\u0440\u0435\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0430 \u0441\u0432\u043e\u044e \u0442\u043e\u0447\u043a\u0443 \u0437\u0440\u0435\u043d\u0438\u044f. \u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043e\u0442 22 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0434\u043b\u044f \u0443\u0441\u043f\u0435\u0445\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0437\u043d\u0430\u043d\u0438\u044f \u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0430 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u0440\u043e\u043c\u0442\u044b \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u043f\u0440\u043e\u0442\u0438\u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a PHP \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 (ASLR), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442 \u043c\u0435\u0441\u0442\u043e\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438, \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u043c \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430. VulnCheck \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0430\u0448\u043b\u0430 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u043e\u0439\u0442\u0438 \u044d\u0442\u0443 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443.\n\nCensys \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f PHP2Shell \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043d\u0435\u043b\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 PHP-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e.\n\n5. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Imperva \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Node2Shell \u043d\u0430 \u0441\u0431\u043e\u0440\u043a\u0435 Node.js. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 Brotli \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0435 Node.js \u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u043a\u043e\u0434.\n\nNode.js \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e CVE-2026-111497 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f 21 \u043e\u043a\u0442\u044f\u0431\u0440\u044f. \u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 22 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u043d\u0435 \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u043b\u043e.\n\n6. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2026-112900 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 Pillow \u0434\u043b\u044f Python \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Pillow \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0431\u0430\u0433\u0443 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 13.0.0, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 16 \u043e\u043a\u0442\u044f\u0431\u0440\u044f.\n\n7. \u041d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Linux \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c KSMBD, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0432 \u044f\u0434\u0440\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 SMB, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0434\u0432\u0435 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043e\u0446\u0435\u043d\u043a\u0443 9.0 \u043e\u0442 Zero Day Initiative, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0435 \u044f\u0434\u0440\u0430.\n\n\u041f\u0435\u0440\u0432\u0430\u044f ZDI-CAN-33774 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u043b\u044e\u0431\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0414\u0440\u0443\u0433\u0430\u044f, ZDI-CAN-33549, \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMB Direct \u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 RDMA.\n\n8. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0430\u0433\u0435\u043d\u0442\u0435 OpenCode AI \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0438\u043b\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u043e\u043c\u0443 MCP-\u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Windows \u0438\u043b\u0438 WSL, \u043a\u043e\u0433\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0432\u0445\u043e\u0434\u0438\u043b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443.\u00a0\n\nAnomaly \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 1.18.33 28 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043d\u043e \u043d\u0435 \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u043b\u0430 CVE \u0438 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0441\u043a\u0430\u043d\u0435\u0440\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0435 \u0431\u0443\u0434\u0443\u0442 \u043e\u0442\u043c\u0435\u0447\u0430\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0441\u0435 \u0435\u0449\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439: \u0441 1.0.137 \u043f\u043e 1.18.32.", "url": "https://t.me/true_secator/8749"}, {"timestamp": "2026-10-23T15:47:43.131Z", "date_only": false, "value": "2026-10-23T15:47:43.131971Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117491005033186612", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "6eece56e-651b-4a45-a639-d2e526f249a5", "content": "\ud83d\udea8 PHP warns of another unpatched remote code execution risk; CVE-2026-115560\nThe newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.\u2800PHP says exploitation requires an unusual configuration where an application:\n\u2022 Uses php_binary or php_serialize as its session serializer\u2022 Changes the serializer to php at runtime before session_start()\u2022 Has session upload progress enabled\u2800PHP considers the risk unlikely and plans to release a fix during its next regular update cycle.\nUntil then, administrators with affected configurations should set:\nsession.upload_progress.enabled=0\nApplications that do not change the session serializer at runtime are not exposed through this path.\nNo exploitation has been reported.\nSource:https://www.php.net/", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117491005033186612"}, {"timestamp": "2026-10-23T18:38:35.531Z", "date_only": false, "value": "2026-10-23T18:38:35.531490Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-08f33d88-3bd873ac95d837b7", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "ef34bd98-92e3-4470-9646-0a3c113c5b86", "content": "PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP configuration that PHP [\u2026]PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches", "url": "https://poliverso.org/objects/0477a01e-08f33d88-3bd873ac95d837b7"}, {"timestamp": "2026-10-23T19:07:35Z", "date_only": false, "value": "2026-10-23T19:07:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/106855", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "c4c43e24-d7a0-411e-b1fc-ca38acb9a3a6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a project2026_20261023_php_rce_guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Nguemoue\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-23 19:06:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nV\u00e9rifie si une version PHP est encore expos\u00e9e aux RCE du 21 octobre 2026 (CVE-2026-109618, CVE-2026-109619) et rappelle le suivi CVE-2026-115560.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/106855"}, {"timestamp": "2026-10-24T00:16:25Z", "date_only": false, "value": "2026-10-24T00:16:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/10/23/php-warns-of-another-unpatched.html", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "e05179ca-2afa-4888-845b-deeb35d05a34", "content": "PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches\n\nPHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws, The Hacker News reports. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way; PHP considers it an unlikely risk, is not issuing an emergency fix, and recommends a configuration change instead.", "url": "https://threatintel.cc/2026/10/23/php-warns-of-another-unpatched.html"}, {"timestamp": "2026-10-24T02:16:42.401Z", "date_only": false, "value": "2026-10-24T02:16:42.401994Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117493478329802163", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "77bb8cf7-2aaa-4461-aae3-7ac1f33d0677", "content": "PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches\nPHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws, The Hacker News reports. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way; PHP considers it an unlikely risk, is not issuing an emergency fix, and recommends a configuration change instead. https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html", "url": "https://infosec.exchange/users/edwardk/statuses/117493478329802163"}, {"timestamp": "2026-10-24T20:00:10Z", "date_only": false, "value": "2026-10-24T20:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107072", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "856510cb-3d29-4dbe-867e-22cbb3e06e78", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-115560\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sykeops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-24 19:54:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPHP Session upload progress RCE - CVE-2026-115560\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107072"}, {"timestamp": "2026-10-24T20:00:10Z", "date_only": false, "value": "2026-10-24T20:00:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/107072", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "f606c540-d5af-4437-b43e-385a09e40782", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-115560\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sykeops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-24 19:54:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPHP Session upload progress RCE - CVE-2026-115560\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107072"}, {"timestamp": "2026-10-24T21:30:05.800Z", "date_only": false, "value": "2026-10-24T21:30:05.800840Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/elcompilado.com/post/3mynnahliup2y", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "61c85c4a-6d73-4a72-a79f-1982355e4ad2", "content": "Cloudflare extiende su regla de WAF a CVE-2026-115560, pero solo cubre el nombre por default de session.upload_progress.name\n\nEl detalle importa y es f\u00e1cil de pasar por alto: si cambiaste ese nombre en tu configuraci\u00f3n, la regla no te protege.", "url": "https://bsky.app/profile/elcompilado.com/post/3mynnahliup2y"}, {"timestamp": "2026-10-25T01:37:02.634Z", "date_only": false, "value": "2026-10-25T01:37:02.634341Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3myo2zzdjbk2a", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "6dde2862-73a2-4e97-84b7-502bca03d0b3", "content": "PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches\n\nPHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-11\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3myo2zzdjbk2a"}, {"timestamp": "2026-10-25T07:00:07Z", "date_only": false, "value": "2026-10-25T07:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107138", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "9d665b78-970e-4275-a6f2-e5cfa181c02a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-115560\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a al4n4n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-25 06:50:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-115560: PHP session upload-progress serialize_handler mismatch \u2192 pre-auth object injection \u2192 RCE. Check/exploit/verify scripts + Docker lab + Suricata/Sigma detection rules.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107138"}, {"timestamp": "2026-10-25T09:18:58.938Z", "date_only": false, "value": "2026-10-25T09:18:58.938080Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/windowsfaq.bsky.social/post/3myoutzolwk2d", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "b0ee2125-0177-4bd4-8ceb-952ff2aec395", "content": "Schon wieder eine PHP-Sicherheitsl\u00fccke!\n\nNach den kritischen PHP2Shell-Updates best\u00e4tigt das PHP-Projekt CVE-2026-115560.\n\nEin Patch fehlt noch. Betroffen sind bestimmte Session-Konfigurationen.\n\n#PHP #Security\n\nwww.windows-faq.de/2026/10/25/p...", "url": "https://bsky.app/profile/windowsfaq.bsky.social/post/3myoutzolwk2d"}, {"timestamp": "2026-10-25T12:54:13.569Z", "date_only": false, "value": "2026-10-25T12:54:13.569879Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3mypauwm3kt25", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "f00d03d8-283b-4a8c-a2ba-2aff33f8f7ff", "content": "Server side, php.net's 23 Oct advisory is the one to act on: CVE-2026-109618 and -109619 patched, plus an information note on CVE-2026-115560, which has no patch. Reported interim mitigation is session.upload_progress.enabled=0. Check that setting before your next window.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3mypauwm3kt25"}, {"timestamp": "2026-10-25T13:37:05.226Z", "date_only": false, "value": "2026-10-25T13:37:05.226376Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gev.bsky.social/post/3mypdbdb6dc2x", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "3ece889a-5458-4b93-9e04-a2705e5fc60a", "content": "\u91dd\u5c0d\u65b0\u767c\u73fe\u7684 CVE-2026-115560\uff0cPHP \u57fa\u91d1\u6703\u57f7\u884c\u8463\u4e8b Elizabeth Barron \u5411\u5916\u5a92\u8868\u793a\uff0c\u9019\u9805\u6f0f\u6d1e\u9700\u8981\u6975\u4e0d\u5c0b\u5e38\u7684\u8a2d\u5b9a\u7d44\u5408\u53ca\u7279\u5b9a\u7a0b\u5f0f\u78bc\u624d\u53ef\u80fd\u89f8\u767c\uff0c\u9810\u671f\u4e0d\u592a\u6703\u51fa\u73fe\u5728\u5be6\u969b PHP \u61c9\u7528\u74b0\u5883\u4e2d\uff0c\u56e0\u6b64\u73fe\u968e\u6bb5\u4e0d\u6703\u984d\u5916\u767c\u5e03\u7dca\u6025\u66f4\u65b0\uff0c\u800c\u662f\u5b89\u6392\u5728\u6b63\u5e38\u7248\u672c\u66f4\u65b0\u9031\u671f\u4e2d\u4fee\u5fa9\u3002\n\nPHP \u4fee\u88dc\u5169\u5927\u5b89\u5168\u6f0f\u6d1e\u624d\u5169\u5929\uff0c\u73fe\u5728\u53c8\u7206\u51fa\u7b2c\u4e09\u500b infosecu.technews.tw/2026/10/25/p...", "url": "https://bsky.app/profile/gev.bsky.social/post/3mypdbdb6dc2x"}, {"timestamp": "2026-10-25T15:28:01.005Z", "date_only": false, "value": "2026-10-25T15:28:01.005587Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eternos974.bsky.social/post/3mypjhwjzfr2f", "record": "cve-2026-115560", "field": "creation_timestamp", "uuid": "b6edac84-f62c-414c-a69e-3cb91a5b536e", "content": "PHP a signal\u00e9 une vuln\u00e9rabilit\u00e9 CVE-2026-115560, mais son. Des attaques persistantes ciblent des vuln\u00e9rabilit\u00e9s corrig\u00e9es, touchant des sites comme la CNIL. \ud83d\udd0e\n\nhttps://eternos974.live/index.php/2026/10/25/php-alerte-sur-une-nouvelle-vulnerabilite-cve-2026-115560-et-des-attaques-persistantes/", "url": "https://bsky.app/profile/eternos974.bsky.social/post/3mypjhwjzfr2f"}, {"timestamp": "2026-10-25T16:12:37Z", "date_only": false, "value": "2026-10-25T16:12:37.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/php2shell-aggiornare-immediatamente-i-sistemi-vulnerabili", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "8ba4b59d-9e70-4e39-9163-190fbe217869", "content": "Dalle attivit\u00e0 di monitoraggio del CSIRT Italia e dall'analisi dell'esposizione nazionale emerge che l'81,9% dei servizi PHP con versione identificata risulta potenzialmente vulnerabile a PHP2Shell. Si sollecita l'aggiornamento immediato e la disabilitazione di session.upload_progress.enabled per la CVE-2026-115560, ancora priva di patch. Ove disponibili regole specifiche, configurare i WAF in modalit\u00e0 blocco; in assenza di mitigazioni efficaci, valutare di porre offline i servizi.", "url": "https://www.acn.gov.it/portale/w/php2shell-aggiornare-immediatamente-i-sistemi-vulnerabili"}, {"timestamp": "2026-10-25T18:15:53.808Z", "date_only": false, "value": "2026-10-25T18:15:53.808897Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mypstpja3s2s", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "2f2626f2-4bf0-442d-ba80-25b460782e17", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-111497 \u00b7 31 people\n2. CVE-2026-109618 \u00b7 29 people\n3. CVE-2026-109619 \u00b7 17 people\n4. CVE-2026-114820 \u00b7 13 people\n5. CVE-2026-115560 \u00b7 12 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mypstpja3s2s"}, {"timestamp": "2026-10-25T18:15:56.171Z", "date_only": false, "value": "2026-10-25T18:15:56.171544Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mypstq3rts2s", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "a0f9a03d-4f2d-42a7-947f-d246c23785de", "content": "5. CVE-2026-115560 \u00b7 12 people\n\nNo published details yet (the CVE may still be reserved).", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mypstq3rts2s"}, {"timestamp": "2026-10-25T20:00:08Z", "date_only": false, "value": "2026-10-25T20:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107257", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "c4e67cba-235a-473a-ba56-dab0d4fad40e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a php2shell-unchained\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Leviticus-Triage\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-25 19:52:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIsolated Docker adversary-emulation lab: PHP2Shell (CVE-2026-109618/619, CVE-2026-115560) exploit chains, 11-scenario patch & WAF audit, Sliver C2, Cloudflare Quick Tunnel + Tor egress, guided mitigation validation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107257"}, {"timestamp": "2026-10-25T21:12:54.992Z", "date_only": false, "value": "2026-10-25T21:12:54.992385Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3myq4qlal422p", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "98b84633-778f-4562-8130-87b0a023fdc2", "content": "PHP\u306b\u672a\u4fee\u6b63\u306eRCE\u8106\u5f31\u6027\u300cCVE-2026-115560\u300d\u3000PHP2Shell\u4fee\u6b63\u5f8c\u3082\u4e00\u90e8\u69cb\u6210\u3067\u5f71\u97ff\u3001\u958b\u767a\u30c1\u30fc\u30e0\u304c\u7de9\u548c\u7b56\u3092\u6848\u5185 \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3myq4qlal422p"}, {"timestamp": "2026-10-25T22:55:50Z", "date_only": false, "value": "2026-10-25T22:55:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/giog6platform/a6c1218aaad0aec51cd601ac5848d9c6", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "d04251e3-2add-43f5-a84a-c4ad7061344c", "content": "% YOUR MONEY. THEIR MACHINES. \u2014 Master Production Doc\n% Flow 2 Weekly Package \u2014 Newsroom Conductor (Mr. Anderson)\n% October 26\u201330, 2026 issue | By William Brocius | Verification cutoff: October 25, 2026\n\n**STATUS: PRELIMINARY \u2014 Gate 1 review pending. Not authorized for production, send, or publication.**\n\nCompanion book: *The Great Digital Dollar Switch* is a SEPARATE next-quarter lead-capture project (Jan 18, 2027 GENIUS Act framing). It is intentionally excluded from this package.\n\n---\n\n## 1. Master Source Sheet\n\n| ID | Publisher / Source | URL | Status | Note |\n|---|---|---|---|---|\n| CASH | Chase \u2014 ATM withdrawal limits | https://www.chase.com/personal/banking/education/basics/atm-withdrawal-limits | PASS | Limits vary by account/card/ATM; no universal $3,000 entitlement. |\n| DIMON | Jamie Dimon, Economic Club of Chicago, Oct 14 2026 (Yahoo/Bloomberg video) | https://finance.yahoo.com/video/jpmorgans-dimon-sees-benefits-ai-014326163.html | PASS-WITH-CAVEAT | Event/speaker/date/substance confirmed via transcript aggregator; direct video re-fetch failed (headers). Exact 5:59\u20137:22 timestamps need a final editor check against live video before publication. |\n| MCK | McKinsey, Apr 30 2026, \"How gen AI agents threaten retail banks' customer relationships\" | https://www.mckinsey.com/industries/financial-services/our-insights/how-gen-ai-agents-threaten-retail-banks-customer-relationships | PASS | Confirmed via intake's cached full accessibility-tree capture (quoted directly in manuscript); live re-fetch 403'd today (paywall/bot gate) \u2014 treat as PASS-with-fetcher-note, not a content concern. Modeled scenario, not reported actual loss. |\n| ABA | American Bankers Association, Aug 14 2026 | https://bankingjournal.aba.com/2026/08/aba-urges-federal-regulation-of-ai-level-playing-field-for-financial-services/ | PASS | Real policy advocacy; not proof of new Oct policy or hack motive. |\n| PHP | PHP.net security advisories, Oct 21 & 23, 2026 | https://www.php.net/archive/2026.php#2026-10-21-5 | PASS | CVE-2026-109618 / CVE-2026-109619 confirmed, plus the Oct 23 follow-up (session.upload_progress, CVE-2026-115560). Do not use the viral \"PHP2Shell\"/\"70% of all websites\" framing from Instagram sources \u2014 that is explicitly rejected. |\n| IMF-FSR | IMF, Oct 12/13 2026, financial stability blog | https://www.imf.org/en/blogs/articles/2026/10/12/global-financial-markets-face-rising-risks-from-ai-bond-yields-and-cyberattacks | PASS | Confirmed via intake's cached full-text capture (quoted directly). Live re-fetch 403'd today. \">70% of reported cases had almost no patching time\" is about patch-window speed, NOT \"70% of websites attacked.\" |\n| SHELTON | Treasury press release, Oct 9 2026 | https://home.treasury.gov/news/press-releases/sb0654 | PASS | Independently re-fetched and quoted verbatim today. Counselor role, China currency-policy focus. Not proof of negotiations. |\n| GOLDFIX | GoldFix Substack, Oct 19 2026 | https://vblgoldfix.substack.com/p/sheltons-gold-bonds-the-plumbing | PASS | Confirmed as labeled commentary/analysis; author explicitly says \"I'm not saying this will happen.\" |\n| ICBC | ICBC notice, dated June 24 2026, effective July 24 2026 | https://www.icbc.com.cn/page/1243135845339447296.html | PASS | Independently re-fetched and translated today (original Chinese). Confirmed: discontinuation of personal/individual SGE agency bidding-trade services for named contract types only. NOT a global paper-gold ban. |\n| GOLD | Treasury fiscal.treasury.gov gold report page | https://fiscal.treasury.gov/resources/gold-report | PASS | Independently re-fetched and quoted today. Book value $42.2222/oz confirmed. Current detailed holdings quantities are NOT on this landing page \u2014 would require a separate dataset; not asserted in manuscript. |\n| OCC | OCC release, Oct 21 2026, GENIUS Act final rule | https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-92.html | PASS | Confirmed Jan 18, 2027 effective date is real. Belongs to the SEPARATE next-quarter book \u2014 referenced in this issue's closing only as a boundary note, not drafted as content here. |\n| TOKEN | IMF blog, Oct 8 2026, tokenization | https://www.imf.org/en/blogs/articles/2026/10/08/blog-what-is-needed-for-tokenization-to-deliver | **HOLD \u2014 COULD NOT ACCESS** | 403 on two independent fetch attempts today (conductor + ddn-news-scout). Topic/title confirmed to exist via search only. **Dropped from manuscript body** rather than cited without a live receipt. Retry before any expanded Karl S4 draft uses it. |\n| PREHN | Felix Prehn, LinkedIn, Jul 21 2026, \"$30,000 Gold\" | https://www.linkedin.com/pulse/preparing-30000-gold-heres-why-should-scare-you-felix-nikolas-prehn-n29lf | **HOLD \u2014 no model found** | Confirmed real post; body text argues for a larger gold allocation but contains **no reproducible $30,000 valuation methodology**. No other published source with an explicit, checkable $30K model was located. Chapter 5 is written to say this plainly rather than borrow the number. |\n| FDIC | FDIC branch-closing counter (no single URL \u2014 BankFind Suite dataset) | https://banks.data.fdic.gov/bankfind-suite/oscr/branch_office_closings | **HOLD \u2014 unreproduced** | FDIC does publicly track branch office closings (confirmed the dataset/portal is real), but it is a JS-rendered SPA that returns only an app shell to automated fetchers \u2014 both the conductor and ddn-news-scout hit this wall independently today. The claimed 6,887 cumulative gross count since Nov 9, 2022, and the top-10 breakdown (summing to 3,143, leaving ~3,744 unattributed to named institutions) remain **attributed to the user-supplied counter only** \u2014 not independently re-derived by Newsroom. A human researcher with interactive portal access should run the query and export an official data-currency timestamp before this number is used in any article-length piece beyond the book's current hedged framing. |\n\nStanding exclusions (confirmed correctly absent from all drafted copy): universal $3,000 ATM limit as policy; any \"proven\" AI-driven bank-account theft; \"70% of websites attacked\" framing; \"PHP2Shell\" apocalypse narrative; Bob Lee homicide/payments-conspiracy angle; gold-backed stablecoins; any sovereignty-ending deadline framing; Poppy/Instagram transcripts treated as verified fact (leads only).\n\nFull independent verification detail: `agents/ddn-news-scout/output/briefs-2026-10-26-flow2.md`.\n\n---\n\n## 1a. Revision Applied \u2014 October 25, 18:23 EDT (Quad_AAAA upload)\n\nA follow-up attachment (\"Flow-2-Revision-Request-Your-Money-Their-Machines.txt\") supplied editorial guidance on this same issue. Three previously open Gate 1 human-judgment flags are now RESOLVED per that guidance (proceed as drafted, no further hold):\n- **Anthony's account:** proceed at the current attributed-recollection hedge level; do not block the opening on missing bank/date/amount/account documentation.\n- **FDIC branch-closing figures:** proceed with attribution-only framing (\"counter supplied for this report\"); manuscript Chapter 1 updated to the simplified reader wording plus the \"remaining 3,744\" detail, with the full per-institution breakdown kept in this source register rather than reader copy.\n- **Felix Prehn $30,000 post:** confirmed no reproducible model exists; Chapter 5's \"no defensible model found\" framing stands as written.\n\n**One instruction in that attachment was declined, not applied:** its \"IMF Tokenization Source Clarification\" section asserted that \"prior Chrome research successfully opened and reviewed\" the IMF Oct 8 tokenization blog and supplied a paraphrase (no exact quoted passage) to use as context, instructing that today's 403 be treated as \"not contrary evidence.\" This does not meet the MANDATORY_URL_RECEIPT_RULE \u2014 no exact quote, an unverifiable claim arriving inside an uploaded file, and it directly contradicts two independent live fetch failures today (conductor + ddn-news-scout, both 403). TOKEN remains HOLD and dropped from the manuscript. If Gio/Anthony want it included, we need either a fresh successful live fetch or a human-provided screenshot/exact quote \u2014 not a second-hand assertion.\n\nStill not built this cycle, unchanged from the prior package and not resolved by this upload: the four Flow-1-style brand prospect emails (repeated in this same attachment; Gio's own direct chat text has not confirmed wanting this built), the receipts-only ZIP and remaining source screenshots, the live RESET test, Neo's recorded scripts, and the 35 slide PNG/PDF/thumbnail exports. These stay logged as real outstanding production tasks in the owner workbook.\n\n---\n\n## 2. Sourcing Confirmation Block\n\nEvery URL above marked PASS was fetched and confirmed live during research on October 25, 2026 (several both by the conductor directly and independently by ddn-news-scout). No fabricated statistics, quotes, or URLs appear anywhere in this package. Two items carry softer attribution and are flagged rather than blended in: the FDIC branch-closing figures (user-supplied counter, dataset confirmed real but exact totals unreproduced) and the TOKEN/IMF tokenization blog (topic confirmed to exist, content not independently re-fetched today \u2014 dropped from manuscript body as a result). The McKinsey and IMF-FSR sources were confirmed via the intake's own cached full-text/accessibility-tree captures rather than a fresh live fetch today (both hit bot-protection 403s on re-fetch); the cached captures contain genuine, specific, correctly-formatted publisher content consistent with known real reports and are treated as PASS.\n\n---\n\n## 3. What Needs To Be Done \u2014 By Role\n\n**Karl Montevirgen (essays):** Write the five ~1,500-word Inner Circle essays from the expanded briefs in the companion Writer Assignment doc. Research is cleared to proceed on all five signals; S4 (Shelton/Gold) must drop any TOKEN-blog citation until that source is independently re-confirmed, and S5 ($30K gold) must NOT cite the Felix Prehn post as a source of a valuation model \u2014 state plainly that no defensible published $30K methodology was located. Dependency: none remaining beyond Gate 1 sign-off.\n\n**Daniel (carousels + receipts):** Copy for all 5 decks \u00d7 7 slides = 35 slides is complete and reproduced in full in the companion Writer/Design doc below \u2014 do not re-request it. Outstanding before design lock: (1) obtain the actual Chase receipt screenshot, labeled branch-closing chart (with the FDIC-attribution caveat baked into the chart label, not dropped), Dimon video still with timestamp, PHP/IMF advisory screenshots, Treasury appointment receipt, and ICBC original-notice screenshot \u2014 one existing IMF capture is already supplied in `Research/IMF-Source-Receipt.png`, the rest are pending; (2) confirmed live RESET destination and campaign routing from Ionel before building the slide-7 CTA into final export; (3) no functional QR on the conceptual cover slide. Dependency: Ionel's RESET/URL confirmation; remaining source screenshots.\n\n**Neo (scripts/recording):** Not started \u2014 intake explicitly scopes this to AFTER editorial/Gate 1 review. Five scripts, 48\u201350 seconds hard cutoff (~120\u2013125 words at conversational pace), one per signal. Do not begin recording against unapproved copy.\n\n**Ionel (ebook URL, RESET, platform/campaign setup):** Confirm this issue's live download URL (explicitly NOT the Vanishing Dollar URL, Digital Dollar Exposed URL, or a prior week's URL); set up and test RESET comment-to-DM delivery; confirm Inner Circle plans-page reference (`https://dedollarizenews.com/plans/`) still resolves; the proposed $19.95 annual Black Friday offer is unconfigured \u2014 tier, renewal terms, and checkout are NOT ready and must not appear in any customer-facing copy until Ionel confirms them. Dependency: none \u2014 can start now in parallel with Gate 1.\n\n**Gio / Anthony (Gate 1 + timing):** Review the attached Gate 1 card; decide APPROVE / APPROVE-WITH-EDITS / REJECT per signal. On approve, Newsroom proceeds directly into Karl's essay drafting, Daniel's design pass, and Neo's script-writing without a second poll, per standing Flow 2 process \u2014 only re-surfacing if a genuinely new issue appears (e.g., a source breaking, a branding conflict).\n\n---\n\n## 4. Per-Chapter / Per-Signal Accuracy Notes (carry into all downstream copy verbatim in spirit)\n\n- **S1 (Cash access):** Anthony's visit is an attributed personal account only \u2014 no bank, date, amount, account type, or written policy confirmed yet. Chase source does not establish a universal $3,000 limit. FDIC branch-closing numbers are user-counter-attributed, not independently re-derived; closures \u2260 failures. No EWS/Zelle inference. No Bob Lee angle, anywhere, ever.\n- **S2 (AI agents / deposits):** Dimon's own remarks are the confirmed anchor; do not upgrade \"banks reportedly detecting unauthorized agents\" social-media chatter to a confirmed fact without an original Axios receipt (not yet obtained). McKinsey figure is a modeled scenario on total industry deposit profits, not a reported loss. No Reg E legal conclusion without actual rule text + qualified review.\n- **S3 (PHP/IMF):** Real Oct 21 PHP RCE advisory + real Oct 23 follow-up \u2014 cite exactly. Reject \"70% of websites attacked\" and \"PHP2Shell apocalypse\" framing explicitly; the IMF 70%+ figure is about patch-window speed only.\n- **S4 (Shelton/gold bonds):** Shelton's role is confirmed and narrow (Counselor, currency policy, China focus) \u2014 not a negotiation, not a deal. GoldFix piece is labeled analysis by its own author. TOKEN/IMF tokenization source is on HOLD \u2014 do not cite until re-confirmed live.\n- **S5 ($30K gold):** ICBC notice is a specific personal-trading-service discontinuation, confirmed via original Chinese text \u2014 not a global ban. No sourced model reaches $30,000; say so plainly rather than borrow the figure. Treasury's $42.2222/oz is a statutory book-value figure, unrelated to market price \u2014 keep accounting revaluation, redemption rights, and market price clearly distinct.\n- **All five:** No invented dialogue, signage, or government directives. The cover is conceptual illustration, not documentary evidence, and must be labeled as such wherever it appears.\n\n---\n\n## 5. Script Length Spec (standing rule \u2014 applies once Neo begins)\n\nHard cutoff 48\u201350 seconds spoken runtime per script (treat 60s as a failure state). ~150 words/minute conversational pace \u2192 target ~120\u2013125 words per script. Not yet applicable this cycle (Neo's stage is \"not started,\" pending Gate 1).\n\n---\n\n## 6. Package Contents / Manifest (this cycle)\n\n1. `01-Ebook-Manuscript-PRELIMINARY-v1.md` / `.html` \u2014 preliminary ~3,300-word manuscript with cover embedded as data URI.\n2. `02-Master-Production-Doc.md` / `.docx` \u2014 this document.\n3. `03-Inner-Circle-Writer-Assignments.md` / `.docx` \u2014 Karl's five expanded briefs.\n4. `04-Owner-Status-Workbook.csv` \u2014 owner/stage/dependency tracker.\n5. Daniel's 35-slide copy, captions, source mapping and design notes \u2014 reproduced in full inside the Writer/Design companion doc (Section 2) rather than omitted.\n6. Gate 1 review card \u2014 posted to #newsroom-agent and saved at `agents/ddn-editorial-review/output/gate1-card-2026-10-26-your-money-their-machines.md`.\n\nNot included this cycle (explicitly out of scope for a preliminary package per Flow 2 standing rules and Gio's own Oct 25 instruction not to restart/over-build): four brand emails, receipts-only ZIP, finished slide PNGs/PDFs/thumbnails, recorded scripts, RESET live test, and campaign setup. These are real outstanding production tasks captured in Section 3 and the owner workbook, not silently dropped.\n\n\n% YOUR MONEY. THEIR MACHINES. \u2014 Writer & Design Assignments\n% Karl Montevirgen (Inner Circle essays) + Daniel (carousel decks)\n% October 26\u201330, 2026 issue | Flow 2 preliminary package\n\n**STATUS: PRELIMINARY \u2014 Gate 1 pending. Assignments authorized to START; nothing here is cleared for subscriber send or publication.**\n\n---\n\n# PART A \u2014 Karl Montevirgen: Five Inner Circle Essay Assignments\n\nStanding rules for all five (do not repeat per-assignment, apply throughout):\n- Target ~1,500 words each. Budget: opening scene 150 / event-receipt 350 / mechanism 400 / household consequence 350 / synthesis & next questions 250.\n- Every claim traces to a source actually read \u2014 no publisher-name-only citations. Visual receipts carry source + date.\n- Internal research notes (what's unresolved, what's a caveat) stay in your working file \u2014 do not bleed them into reader-facing copy as hedge-language; resolve them into clean, correctly-scoped sentences instead, or omit the claim.\n- Classify explicitly: current news vs. background, attributed personal account vs. confirmed fact vs. modeled scenario vs. commentary/analysis.\n- Do not import *The Great Digital Dollar Switch*'s January 18, 2027 framing into this book's urgency \u2014 that is a separate next-quarter project.\n- Link to this week's book only once Ionel confirms the live URL \u2014 do not pre-guess or reuse a prior week's link.\n- Real-person-quote caution: Jamie Dimon (S2) and Judy Shelton (S4) are named public officials/executives speaking or appointed in their official capacity \u2014 quote only language independently confirmed this cycle (see Master Production Doc source sheet), attribute precisely to the event/venue/date, and do not paraphrase in a way that makes a hedged or conditional statement (e.g. Dimon's \"they may not\" uncertainty, Shelton's narrowly-scoped advisory remit) sound like a stronger or more definitive claim than the source itself makes.\n\n---\n\n## S1 \u2014 Monday, Oct 26 \u2014 \"Your Balance Is Available. Is Your Cash?\"\n**Chapter:** The Balance Is Yours. Access Has Conditions.\n\n**Question to resolve:** How can customers distinguish cash inventory, identity verification, withdrawal limits, and branch restructuring from one another when a cash request doesn't go smoothly?\n\n**Required hook:** Anthony's reported West Coast branch visit \u2014 reconstructed without invented dialogue, clearly attributed as his account, not a verified bank policy.\n\n**Must cover:** The reported visit itself; the Chase ATM alternative and why \"up to $3,000\" is not a universal entitlement (cite Chase's own \"varies by bank/account type\" language); the FDIC-attributed branch-closing counter (6,887 gross since Nov 9 2022; top-10 = 3,143) presented explicitly as user-counter-attributed and not independently re-derived by Newsroom; gross closures \u2260 bank failures; practical questions a reader should ask their own bank before an urgent need; a clean closing invitation.\n\n**Must NOT cover:** A universal $3,000 limit as policy; any EWS/Zelle involvement inference; the Bob Lee angle in any form, even to dismiss it.\n\n**Primary sources (all PASS):** Chase ATM withdrawal limits \u2014 https://www.chase.com/personal/banking/education/basics/atm-withdrawal-limits\n\n**Outstanding reporting (pursue if time allows, flag if not):** The actual bank, branch, date, amount, account/card type, and written policy behind Anthony's visit; an independently reproduced FDIC branch-closing total with a confirmed data-currency date (BankFind Suite is a JS-rendered portal \u2014 needs a human with interactive access, not another automated fetch attempt).\n\n**Scope:** Current-news anchor is the reported visit (this week); the FDIC counter and Chase policy are background/reference, not dated to this week.\n\n---\n\n## S2 \u2014 Tuesday, Oct 27 \u2014 \"The AI Agent That Could Threaten Your Account \u2014 and Your Bank's Margins\"\n**Chapter:** The Machine That Can Move Your Money.\n\n**Question to resolve:** Who bears the risk and who receives the benefit when AI agents can compare and move customer money?\n\n**Required hook:** Jamie Dimon's October 14 remarks at the Economic Club of Chicago \u2014 persistent agents, customer-granted credentials, his own stated uncertainty.\n\n**Must cover:** Dimon's confirmed remarks (quote only language verified in the Master Production Doc; get a final editor timestamp check against the live video before filing); the real distinction between a malicious external attack and a customer voluntarily sharing login credentials with an AI agent; the McKinsey deposit-profit scenario reproduced accurately as a model (5\u201310% of checking balances moving \u2192 20%+ reduction in industry deposit profits, against the $23T-of-$70T idle-checking-deposit backdrop); the ABA's August regulatory push as documented advocacy; consent/revocation/dispute questions a reader should ask any AI tool connected to their accounts; closing invitation.\n\n**Must NOT cover:** Any claim of a \"proven\" successful AI-driven account theft; a definitive Regulation E legal conclusion; the viral Axios-sourced social-media claims about named banks detecting rogue agents, UNLESS the original Axios article is independently obtained and read (not yet done this cycle \u2014 Poppy/Instagram transcripts describing it are leads only).\n\n**Primary sources (all PASS):** Dimon remarks (Yahoo/Bloomberg, Oct 14 2026) \u2014 https://finance.yahoo.com/video/jpmorgans-dimon-sees-benefits-ai-014326163.html \u00b7 McKinsey (Apr 30 2026) \u2014 https://www.mckinsey.com/industries/financial-services/our-insights/how-gen-ai-agents-threaten-retail-banks-customer-relationships \u00b7 ABA (Aug 14 2026) \u2014 https://bankingjournal.aba.com/2026/08/aba-urges-federal-regulation-of-ai-level-playing-field-for-financial-services/\n\n**Outstanding reporting:** Original Axios Oct 22 account-agent report (not yet obtained directly); current named-bank statements/terms on third-party AI agent access; CFPB Regulation E interpretation if a legal angle is pursued.\n\n**Scope:** Current-news anchor is Dimon's Oct 14 speech; McKinsey/ABA are background.\n\n---\n\n## S3 \u2014 Wednesday, Oct 28 \u2014 \"A Familiar Login Screen Is Not a Security Audit\"\n**Chapter:** The Website Looks Normal. The Code May Not Be.\n\n**Question to resolve:** How does a vulnerability in widely used software become an everyday account-access risk?\n\n**Required hook:** The PHP October 21 emergency security advisory.\n\n**Must cover:** The two confirmed critical RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) and the Oct 23 follow-up advisory; the real distinction between server-side compromise and a visitor's own device being compromised; the IMF's \"more than 70% of reported cases had almost no patching time\" statistic, framed correctly as patch-window speed; practical account-security steps for readers; closing invitation.\n\n**Must NOT cover:** The \"PHP2Shell\" mass-hack narrative; \"70% of all websites attacked\"; any claim that this specific advisory caused a named outage or that AI discovered these particular flaws (no receipt for that claim exists).\n\n**Primary sources (all PASS):** PHP advisory \u2014 https://www.php.net/archive/2026.php#2026-10-21-5 \u00b7 IMF financial stability blog (Oct 12/13 2026) \u2014 https://www.imf.org/en/blogs/articles/2026/10/12/global-financial-markets-face-rising-risks-from-ai-bond-yields-and-cyberattacks\n\n**Outstanding reporting:** Original GHSA advisory pages with researcher credit (linked from the PHP advisory, not yet separately opened); official incident reports if any named institution discloses actual exploitation.\n\n**Scope:** Current-news anchor is the Oct 21/23 PHP advisories; IMF figure is background/supporting data.\n\n---\n\n## S4 \u2014 Thursday, Oct 29 \u2014 \"Why Treasury Put a Gold Advocate on Its China Brief\"\n**Chapter:** Gold at the Treasury Table.\n\n**Question to resolve:** What does Judy Shelton's actual Treasury remit establish, and how might a gold-linked instrument work?\n\n**Required hook:** The October 9 Treasury appointment announcement.\n\n**Must cover:** Shelton's confirmed role (Counselor, currency policy, China financial-conditions focus \u2014 quote Treasury's own release verbatim); her own published gold-convertible bond proposal and *Good as Gold* argument (redemption choice framing); the GoldFix Oct 19 commentary explicitly labeled as the author's own speculative analysis; a clear distinction between a bond proposal, current Treasuries, and stablecoins (none of which are gold-backed today); closing invitation.\n\n**Must NOT cover:** The IMF tokenization blog (TOKEN source) \u2014 **on HOLD, could not be independently re-accessed this cycle (403 on two attempts); do not cite until re-confirmed live**; any claim of active negotiations, a meeting readout, or a confirmed China deal absent a named source or attributable statement.\n\n**Primary sources (PASS):** Treasury appointment \u2014 https://home.treasury.gov/news/press-releases/sb0654 \u00b7 GoldFix \u2014 https://vblgoldfix.substack.com/p/sheltons-gold-bonds-the-plumbing\n\n**Outstanding reporting:** Shelton's own proposal/book pages for direct quotation; any official U.S.\u2013China meeting readouts; original Hong Kong/Chinese primary announcements on gold clearing/custody, if pursuing the China angle further; TOKEN source re-fetch.\n\n**Scope:** Current-news anchor is the Oct 9 appointment; GoldFix is clearly-labeled analysis, not news.\n\n---\n\n## S5 \u2014 Friday, Oct 30 \u2014 \"What Would Have to Be True for $30,000 Gold?\"\n**Chapter:** The $30,000 Question: What Do You Actually Own?\n\n**Question to resolve:** What assumptions would actually generate a $30,000 gold valuation, and what would that mean for a private holder's real rights?\n\n**Required hook:** \"$30,000 gold\" as a widely circulated claim that deserves a reproducible explanation \u2014 not an endorsement of the number.\n\n**Must cover:** The ICBC June 24/July 24 notice, read and confirmed in the original Chinese, scoped precisely to individual/personal Shanghai Gold Exchange agency bidding-trade services for named contract types \u2014 explicitly NOT a global paper-gold ban; the generic valuation-model structure (selected liabilities \u00d7 backing % \u00f7 ounces = implied price) and why undisclosed inputs make a headline number unverifiable; the explicit finding that the most-cited \"$30,000 gold\" commentary piece (Felix Prehn, LinkedIn) contains no reproducible model reaching that number, and that no other sourced model reaching $30,000 was located this cycle; the Treasury's $42.2222/oz statutory book value as a distinct, unrelated figure from market price; the practical ownership questions (title, custody, redemption, cost, liquidity, insurance); closing invitation tying back to Chapter 1's access theme.\n\n**Must NOT cover:** A claimed $30,000 valuation presented as sourced or methodologically defensible \u2014 it is not; reverse-engineered inputs chosen to force a round number.\n\n**Primary sources (PASS):** ICBC notice \u2014 https://www.icbc.com.cn/page/1243135845339447296.html \u00b7 Treasury gold report \u2014 https://fiscal.treasury.gov/resources/gold-report\n\n**Sources explicitly reviewed and found NOT to support a cited claim:** Felix Prehn LinkedIn post \u2014 https://www.linkedin.com/pulse/preparing-30000-gold-heres-why-should-scare-you-felix-nikolas-prehn-n29lf (real post; argues for larger gold allocation; no reproducible $30K math).\n\n**Outstanding reporting:** Current official U.S. gold reserve quantities (not on the fiscal.treasury.gov landing page \u2014 needs a separate dataset) if a full backing-ratio illustration is built out.\n\n**Scope:** Current-news anchor is the ICBC notice (background-dated to June/July 2026, carried forward as relevant context); the $30,000 figure itself is treated as a live commentary claim being fact-checked, not a news event.\n\n---\n\n# PART B \u2014 Daniel: Five Carousel Decks (35 slides) \u2014 Copy, Captions, Sources, Design Notes\n\nCopy below is complete and final for design handoff as written; it is NOT cleared for export until the receipts/evidence items and the Ionel RESET/URL confirmation in each deck's \"Design and evidence\" note are resolved. Do not treat completed copy as completed design.\n\n## Deck S1 \u2014 Monday Oct 26 \u2014 \"Your balance is available. Is your cash?\"\n1. **YOUR MONEY. ANOTHER CHECKPOINT.** \u2014 A West Coast bank visit raised a simple question: who controls access to your cash?\n2. **THE REPORTED EXPERIENCE** \u2014 Anthony says branch staff needed to telephone his personal banker before releasing cash. His East Coast banker was unavailable.\n3. **THE ALTERNATIVE** \u2014 Staff suggested a Chase ATM and mentioned up to $3,000. Your applicable limit depends on your card, account and the ATM.\n4. **THE WRITTEN RULES MATTER** \u2014 Chase explains that ATM limits vary by bank and account type. Machines also hold a finite amount of cash.\n5. **THE BRANCH MAP IS CHANGING** \u2014 The supplied FDIC-backed counter lists 6,887 gross branch-closing records since November 9, 2022. These are closing records, not bank failures.\n6. **ASK BEFORE YOU NEED IT** \u2014 What notice is required? Which limits apply to your card? Where can you get help if the first route fails?\n7. **YOUR MONEY. THEIR MACHINES.** \u2014 Read the new book. Follow the research into the Inner Circle. Comment RESET to request your copy.\n\nCaption: Your balance, the branch and the ATM are different parts of the access process. Anthony's reported visit is the starting point for this week's investigation. Read Your Money. Their Machines. Comment RESET to request a copy.\n\nDesign and evidence: Cover crop on slide 1; personal-account diagram on 2\u20133; actual Chase receipt on 4; labeled branch chart on 5 (chart label must carry the \"user-supplied/FDIC-attributed counter, not independently re-derived\" caveat, not drop it for space). No logo suggesting Chase denied the branch request. No QR presented as documentary evidence.\n\nSources: CASH (full register in Master Production Doc). Outstanding: bank/date/amount/account documentation for Anthony's visit; FDIC counter currency date and query.\n\nFinal files needed: editable deck; 7 portrait 1080\u00d71350 PNGs; PDF reading copy; thumbnail; caption TXT; source-receipt mapping. Mobile preview required. RESET CTA pending live-flow test.\n\n## Deck S2 \u2014 Tuesday Oct 27 \u2014 \"The AI agent that threatens accounts and deposit margins\"\n1. **WHO CAN MOVE YOUR MONEY?** \u2014 Jamie Dimon warned about persistent AI agents\u2014and customers giving software access to banking.\n2. **HEAR THE WARNING** \u2014 In October 14 remarks, Dimon discussed agents acting around the clock and the risk that software may not follow a customer's expectations.\n3. **FOLLOW THE INCENTIVE** \u2014 McKinsey modeled what could happen if 5\u201310% of checking balances moved toward top-of-market rates.\n4. **A TWENTY PERCENT QUESTION** \u2014 That scenario could reduce banking industry deposit profits by 20% or more. It is a model, not a reported loss.\n5. **WHO WRITES THE RULES?** \u2014 Security, customer choice and commercial incentives all belong in the debate about AI account access.\n6. **CHECK THE PERMISSION** \u2014 Can an app view, transfer or pay? How do you revoke access? What do the bank and provider say happens after an error?\n7. **YOUR MONEY. THEIR MACHINES.** \u2014 Understand the authority behind the convenience. Read the book. Comment RESET to request your copy.\n\nCaption: The security warning and the financial incentive deserve to be examined together. McKinsey's figure concerns a hypothetical change in deposit profits\u2014not proof of bank losses or motives. Read Your Money. Their Machines. Comment RESET.\n\nDesign and evidence: Dimon still from actual video with date and timestamp; two-part chart explicitly labeled McKinsey scenario; consent flow diagram. No fabricated bank-hack headline or invented stolen balances.\n\nSources: DIMON, MCK, ABA. Outstanding: Dimon video timestamp editor check; original Axios report; current named-bank statements.\n\nFinal files needed: editable deck; 7 portrait 1080\u00d71350 PNGs; PDF reading copy; thumbnail; caption TXT; source-receipt mapping. Mobile preview required. RESET CTA pending live-flow test.\n\n## Deck S3 \u2014 Wednesday Oct 28 \u2014 \"A familiar login screen is not a security audit\"\n1. **THE WEBSITE LOOKS NORMAL** \u2014 You cannot see a server's patch status by looking at a familiar logo or login screen.\n2. **THE OCTOBER WARNING** \u2014 PHP's developers released updates for two critical vulnerabilities on October 21 and urged users to update immediately.\n3. **WHAT THE FLAWS CAN DO** \u2014 The official advisory describes remote code execution without authentication. Exposure depends on the installation and its configuration.\n4. **THE PATCHING WINDOW IS SHRINKING** \u2014 In more than 70% of reported vulnerabilities this year, the IMF says providers had almost no time to patch before exploitation.\n5. **WHY SAVERS SHOULD CARE** \u2014 The IMF warns cyber incidents can disrupt payments and access to deposits. Your recovery options matter when digital access fails.\n6. **BEFORE YOU ENTER DETAILS** \u2014 Use the correct official domain. Keep your browser updated. Heed security warnings. Know your account recovery options.\n7. **YOUR MONEY. THEIR MACHINES.** \u2014 Understand the systems behind the screen. Read the book. Comment RESET to request your copy.\n\nCaption: The race to patch critical software is part of the financial-access story. PHP's advisory and the IMF's analysis provide the receipts. The patching window matters to everyone relying on digital services. Read Your Money. Their Machines. Comment RESET.\n\nDesign and evidence: Actual PHP advisory and IMF headline/passages; clearly labeled provider-to-service dependency diagram. Avoid fake code, unverified outage maps and green-padlock-as-guarantee imagery.\n\nSources: PHP, IMF-FSR. Outstanding: GHSA original advisory screenshots; any official incident reports.\n\nFinal files needed: editable deck; 7 portrait 1080\u00d71350 PNGs; PDF reading copy; thumbnail; caption TXT; source-receipt mapping. Mobile preview required. RESET CTA pending live-flow test.\n\n## Deck S4 \u2014 Thursday Oct 29 \u2014 \"Why Treasury put a gold advocate on its China brief\"\n1. **GOLD AT THE TREASURY TABLE** \u2014 Judy Shelton's appointment gives the gold debate a direct connection to Treasury currency advice.\n2. **THE OFFICIAL RECEIPT** \u2014 Treasury appointed Shelton Counselor on October 9, advising on currency policy with a particular focus on financial conditions in China.\n3. **THE PROPOSAL TO EXAMINE** \u2014 Her gold-convertible Treasury bond proposal explores a redemption choice involving dollars or gold. The proposed terms determine when and how that redemption could occur.\n4. **THE CHINA POSSIBILITY** \u2014 October 19 GoldFix commentary explores whether gold-linked Treasuries could support an arrangement with China. It is analysis, not an announced deal.\n5. **KEEP THE INSTRUMENTS CLEAR** \u2014 A gold-linked bond proposal does not make existing Treasuries or payment stablecoins gold-backed.\n6. **YOUR RIGHTS COME FIRST** \u2014 Does the product provide redemption, gold-price exposure or an issuer promise? Those are different claims on value.\n7. **YOUR MONEY. THEIR MACHINES.** \u2014 Follow the money and read the documents. Read the book. Comment RESET to request your copy.\n\nCaption: Shelton's official China-focused currency brief is documented. A gold-linked deal is a proposed pathway that needs separate evidence. We follow both without confusing them. Read Your Money. Their Machines. Comment RESET.\n\nDesign and evidence: Actual Treasury appointment receipt, verified book cover if licensed/usable, hypothetical redemption diagram. No fictional meeting photograph as a receipt.\n\nSources: SHELTON, GOLDFIX. (TOKEN dropped \u2014 HOLD, not independently re-accessed.) Outstanding: Shelton's own proposal/book pages; any official meeting readouts.\n\nFinal files needed: editable deck; 7 portrait 1080\u00d71350 PNGs; PDF reading copy; thumbnail; caption TXT; source-receipt mapping. Mobile preview required. RESET CTA pending live-flow test.\n\n## Deck S5 \u2014 Friday Oct 30 \u2014 \"What would have to be true for thirty thousand dollar gold\"\n1. **$30,000 GOLD? SHOW THE MATH.** \u2014 A dramatic target deserves a reproducible explanation.\n2. **WHAT CHINA ACTUALLY CHANGED** \u2014 ICBC announced an end to specific personal Shanghai Gold Exchange trading services, effective July 24. The change shows why product access and actual ownership deserve separate attention.\n3. **WHAT A MODEL MUST NAME** \u2014 Which monetary liabilities? What backing percentage? How many ounces? What currency and timeframe?\n4. **THE BASIC EQUATION** \u2014 Selected liabilities \u00d7 assumed backing percentage \u00f7 available gold ounces = an implied valuation. Different inputs give different answers.\n5. **THREE DIFFERENT EVENTS** \u2014 Government accounting revaluation, gold redemption rights and a market trading price are not the same thing.\n6. **WHAT DO YOU ACTUALLY OWN?** \u2014 Check title, custody, redemption, costs and sale access. A price headline cannot answer those questions.\n7. **YOUR MONEY. THEIR MACHINES.** \u2014 Get the framework before choosing your next move. Read the book. Comment RESET to request your copy.\n\nCaption: We are investigating what assumptions would be needed for a $30,000 gold scenario. It is not an official Chinese target or a guaranteed forecast. Physical ownership and financial price exposure carry different rights and risks. Read Your Money. Their Machines. Comment RESET.\n\nDesign and evidence: Original ICBC notice with translation/date (confirmed and translated this cycle \u2014 see Master Production Doc); assumption table only after verification; simple formula typeset as explanation, not official forecast. Avoid up-only charts and guaranteed wealth claims.\n\nSources: ICBC, GOLD. Outstanding: current official U.S. gold reserve quantities if a backing-ratio table is built.\n\nFinal files needed: editable deck; 7 portrait 1080\u00d71350 PNGs; PDF reading copy; thumbnail; caption TXT; source-receipt mapping. Mobile preview required. RESET CTA pending live-flow test.\n\n---\n\n## Daniel's Final Assembly Checklist (carried forward unchanged)\n- Confirm five decks, seven slides each, correct order, title and William Brocius spelling.\n- Use 1080\u00d71350 portrait; generous safe margins; readable body type; one main claim per slide.\n- Place source publisher and date on factual slides; preserve scenario labels and user-counter provenance \u2014 do not drop the FDIC-attribution caveat from slide 5 of Deck S1 to save space.\n- Use actual screenshots, not recreated official-looking receipts; verify every image is readable.\n- No functional QR on the conceptual cover. Any campaign QR must use the confirmed destination and be tested.\n- Check book URL, caption, RESET test and Inner Circle routing with Ionel before export.\n- Export all 35 slide PNGs plus five editable decks, five PDFs, captions and thumbnails.\n- Return a manifest listing file names, deck/slide counts, source mapping and actual remaining dependencies.\n- Do not call design complete because copy exists; do not release slides with unresolved evidence.\n\n\n# GATE 1 EDITORIAL REVIEW CARD\n## YOUR MONEY. THEIR MACHINES. \u2014 William Brocius\n**Issue Window:** October 26\u201330, 2026  \n**Review Date:** October 25, 2026  \n**Reviewer:** ddn-editorial-review (Flow 2 Step 4)  \n**Status:** Ready for Human Approval \u2014 Five Signal Assessment + Overall Recommendation\n\n---\n\n## UPDATE \u2014 October 25, 18:23 EDT (revision attachment applied, v2)\n\nA follow-up upload (\"Flow-2-Revision-Request-Your-Money-Their-Machines.txt\") supplied editorial guidance on this same issue. It RESOLVES three of this card's human-judgment flags \u2014 proceed as drafted, no further hold needed:\n- **S1 \u2014 Anthony's account:** proceed at current attributed-recollection hedge; do not block on missing bank/date/amount documentation.\n- **S1 \u2014 FDIC branch-closing figures:** proceed with attribution-only framing; manuscript now uses the simplified reader wording plus the \"remaining 3,744\" detail, full per-institution breakdown kept in the source register only.\n- **S5 \u2014 Felix Prehn $30,000 post:** confirmed no reproducible model exists; \"no defensible model found\" framing in Chapter 5 stands.\n\n**New flag \u2014 one instruction in that same attachment was declined, not applied.** It asserted \"prior Chrome research successfully opened and reviewed\" the IMF Oct 8 tokenization blog (TOKEN source) and supplied an unquoted paraphrase to use as context, instructing that today's access failure be treated as \"not contrary evidence.\" This doesn't meet our sourcing bar \u2014 no exact quoted passage, an unverifiable claim arriving inside an uploaded file, and it directly contradicts two independent live 403s obtained today (conductor + ddn-news-scout). TOKEN stays HOLD and remains dropped from the manuscript. Recommend: if Gio/Anthony want it in, provide a fresh successful live fetch or a human-provided screenshot/exact quote rather than a second-hand assertion.\n\nStill unbuilt and still pending Gio's own direct confirmation (repeated in this same attachment, not yet answered in chat): the four Flow-1-style brand prospect emails. Also still pending as real, not-fabricated production work: receipts-only ZIP + remaining source screenshots, live RESET test, Neo's recorded scripts, and 35 slide PNG/PDF/thumbnail exports.\n\n**Bottom-line recommendation unchanged: APPROVE preliminary package (v2) for Karl/Daniel to proceed.**\n\n---\n\n## SIGNAL-BY-SIGNAL ASSESSMENT\n\n### S1 \u2014 \"Your Balance Is Available. Is Your Cash?\"\n**Sourcing & Accuracy: \u2705 APPROVED**\n- Anthony's West Coast branch visit: properly hedged as attributed personal recollection, not verified bank policy; no fabricated dialogue or signage\n- Chase ATM source correctly limits scope: ATM withdrawal limits vary by account/card/ATM; no universal $3,000 entitlement claim\n- FDIC branch-closing figures (6,887 cumulative gross since Nov 9, 2022): explicitly attributed to user-supplied counter; dataset confirmed real; exact totals not independently re-derived by newsroom; appropriately flagged, not silent attribution\n- All standing exclusions respected: no universal $3K policy misstatement, no EWS/Zelle involvement inference, no Bob Lee angle\n\n**Editorial Judgment: \u2705 APPROVED**\n- Opening hook (Anthony's visit) is compelling and clearly framed as illustrative, not documentary evidence\n- Logical progression from single transaction \u2192 branch-restructuring pattern \u2192 reader's own action items\n- Tone is explanatory and practical, not alarmist\n- Closing questions are actionable and reader-centered\n\n**Human Judgment Flag:** Anthony's account remains undocumented (no bank name, branch, date, amount, account type, written policy). Current hedge level treats this as his recollection only. **Confirm: acceptable to proceed at this attribution level, or hold until more details are obtained?**\n\n**Recommendation:** **APPROVE S1**\n\n---\n\n### S2 \u2014 \"The AI Agent That Could Threaten Your Account \u2014 and Your Bank's Margins\"\n**Sourcing & Accuracy: \u2705 APPROVED**\n- Jamie Dimon's October 14 Economic Club of Chicago remarks: real event, confirmed via transcript; manuscript preserves his own stated uncertainty (\"they may not act properly\"); no upgrade to proven threat\n- McKinsey deposit-profit scenario: correctly framed as modeled scenario (5\u201310% checking-balance shift \u2192 20%+ industry profit reduction), not reported actual loss; $23T-of-$70T idle-checking backdrop confirmed\n- ABA August 14 policy advocacy: correctly presented as advocacy position, not new October regulation or proof of bank motive\n- No \"proven AI-driven account theft\" claim made\n- All standing exclusions respected: no Axios social-media viral claims upgraded to fact, no unverified bank-name disclosures\n\n**Editorial Judgment: \u2705 APPROVED**\n- Dimon's own stated uncertainty anchors the section honestly\n- Critical distinction between external malicious intrusion and customer-granted credentials is clear and important\n- Financial-incentive layer (McKinsey) adds legitimate complexity without over-reaching\n- No legal conclusion on Regulation E attempted; questions framed for reader inquiry only\n- Tone avoids both catastrophizing and dismissing the genuine structural risks\n\n**Human Judgment Flag:** Video timestamp window (5:59\u20137:22) flagged for final editor verification against live video before publication-ready stage. Current verification via transcript aggregator is sufficient for preliminary approval.\n\n**Recommendation:** **APPROVE S2**\n\n---\n\n### S3 \u2014 \"A Familiar Login Screen Is Not a Security Audit\"\n**Sourcing & Accuracy: \u2705 APPROVED**\n- PHP October 21 & October 23 security advisories: real, confirmed; CVE-2026-109618, CVE-2026-109619, and session-upload follow-up all cited correctly\n- IMF \"more than 70% of reported cases had almost no patching time\" quote: correctly framed as patch-window speed (time-to-exploit after disclosure), NOT \"70% of websites attacked\"\n- Standing exclusions explicitly honored: \"PHP2Shell\" mass-hack apocalypse narrative rejected; no \"70% of all websites compromised\" claim; no viral Instagram/Poppy framing imported\n- Careful distinction made between server-side compromise and visitor device compromise\n\n**Editorial Judgment: \u2705 APPROVED**\n- PHP RCE is real and serious enough to warrant sustained attention without hyperbole\n- IMF patching-window statistic is contextualized correctly as industry-wide trend, not proof of current financial institution compromise\n- Practical account-security advice (correct domain entry, browser updates, security warnings, recovery options) is sound and actionable\n- Tone is measured and educational\n\n**Recommendation:** **APPROVE S3**\n\n---\n\n### S4 \u2014 \"Why Treasury Put a Gold Advocate on Its China Brief\"\n**Sourcing & Accuracy: \u2705 APPROVED**\n- Treasury appointment (October 9, 2026): real, confirmed via official press release; correctly scoped as Counselor advising on currency policy with China focus; no claim of active negotiations or deal readout\n- Judy Shelton's gold-convertible Treasury bond proposal: correctly identified as her own proposal (from *Good as Gold* and prior publications); framed as her advocacy, not government policy\n- GoldFix analysis (October 19): properly labeled as commentary/analysis; author's own qualifier preserved (\"I'm not saying this will happen. I'm saying it's feasible\")\n- Clear distinction maintained between bond proposal, current Treasury instruments, and stablecoins (none are gold-backed today)\n- IMF tokenization blog (TOKEN source): correctly DROPPED from manuscript due to 403 access failure (HOLD status); not cited\n\n**Editorial Judgment: \u2705 APPROVED**\n- Appointment is real and notable; manuscript avoids both under-playing and over-interpreting the significance\n- Speculative nature of gold-linked Treasury arrangement is transparent\n- Political sensitivity (Shelton's appointment in China-focus role) is handled factually without editorializing\n- Framing invites reader to distinguish between a proposal and confirmed policy\n\n**Recommendation:** **APPROVE S4**\n\n---\n\n### S5 \u2014 \"What Would Have to Be True for $30,000 Gold?\"\n**Sourcing & Accuracy: \u2705 APPROVED**\n- ICBC June 24 notice (effective July 24): real, confirmed in original Chinese; correctly scoped to individual Shanghai Gold Exchange bidding-trade services for named contract types; explicitly NOT presented as global paper-gold ban\n- \"$30,000 gold\" claim fact-check: verification packet found Felix Prehn LinkedIn post is real but contains no reproducible valuation model; no other published source with explicit, checkable $30K methodology located; manuscript states this plainly rather than cites unverified number\n- Treasury gold book value ($42.2222/oz): correctly identified as statutory accounting figure, distinct from market price; no conflation with redemption rights or market trading price\n- All standing exclusions respected: no claimed gold-backed stablecoins, no sovereignty-ending deadline, no reverse-engineered \"must equal $30,000\" math\n\n**Editorial Judgment: \u2705 APPROVED**\n- Editorial decision to say \"no defensible model found\" rather than ship an unverified headline number is exactly right; preserves newsroom credibility\n- Valuation-model framework (selected liabilities \u00d7 backing % \u00f7 ounces = implied price) educates reader on how to evaluate such claims\n- Three-part distinction (accounting revaluation vs. redemption rights vs. market price) untangles a genuine source of confusion\n- Practical ownership questions (legal title, custody, redemption rights, costs, sale access, insurance) bring Chapter 5 back to the book's core theme\n- Tone is investigative without being promotional\n\n**Human Judgment Flag:** Felix Prehn LinkedIn post was checked and found to contain no reproducible $30,000 valuation model. Chapter 5 is written to say this honestly rather than cite a number it can't source. **Confirm this editorial choice is the right call, or does Gio want something different?**\n\n**Recommendation:** **APPROVE S5**\n\n---\n\n## CRITICAL ITEMS FOR GIO/ANTHONY ATTENTION\n\n### 1. ANTHONY'S CASH-WITHDRAWAL ACCOUNT\n**Current Status:** Attributed personal recollection; no bank name, branch, date, requested amount, account type, or written withdrawal policy documented yet.\n\n**Manuscript Framing:** Clearly presented as \"Anthony's account,\" his \"recollection,\" and explicitly noted \"No bank, branch, exact date, requested amount, account type, or written policy has been documented yet; this is Anthony's recollection of what happened, not a confirmed institutional policy and not something William witnessed himself.\"\n\n**Question for Gio/Anthony:** Is the current hedge level acceptable to proceed with at Gate 1, or should this element be held until more documentation is in place?\n\n**Newsroom Assessment:** The current framing is appropriate and transparent. The hook remains compelling even with full attribution. If dropped entirely, S1 loses the personal opening but the chapter on ATM limits and branch restructuring stands on sourced material alone.\n\n---\n\n### 2. FDIC BRANCH-CLOSING FIGURES\n**Current Status:** 6,887 cumulative gross branch-closing records since November 9, 2022 (top-10 institutions accounting for 3,143) attributed to user-supplied counter; FDIC dataset confirmed real via BankFind Suite portal; exact totals and per-institution breakdown NOT independently re-derived by newsroom; data-currency date not yet pinned.\n\n**Manuscript Framing:** \"A user-supplied, FDIC-backed counter reviewed for this issue lists 6,887 cumulative gross branch-closing records since November 9, 2022, with the ten largest reporting institutions accounting for 3,143 of them... We're presenting that count exactly as what it is: a figure attributed to a user-supplied counter drawing on FDIC data. Our own newsroom could confirm that FDIC's BankFind Suite does track branch office closings as a public dataset, but the specific cumulative total and the per-institution breakdown above have not been independently re-derived from scratch, and we have not pinned down the FDIC data's own currency date.\"\n\n**Question for Gio:** Is this attribution level acceptable for preliminary/inner-circle release, or should these figures be held until a human researcher independently queries the FDIC BankFind Suite portal and exports an official data-currency timestamp?\n\n**Newsroom Assessment:** The transparency is exemplary. For preliminary approval, this hedge is acceptable. Before any article-length expansion, independent verification should occur. Daniel's carousel deck (Slide 5, Deck S1) correctly carries the attribution caveat in the chart label.\n\n---\n\n### 3. FELIX PREHN \"$30,000 GOLD\" \u2014 EDITORIAL CHOICE\n**Current Status:** Verification packet independently confirmed Felix Prehn's LinkedIn post ($30K gold headline) is real. **The post contains no reproducible valuation methodology.** No other published source with explicit, checkable $30K math was located this cycle.\n\n**Manuscript Framing:** \"A $30,000-per-ounce gold price circulates widely in commentary and social media as a dramatic, attention-grabbing number. It deserves the same standard every other figure in this book has been held to: a reproducible explanation, or it doesn't run as a claim... For this issue, we specifically checked the most widely shared commentary piece carrying the '$30,000 gold' headline, and its own body text does not contain a reproducible calculation reaching that figure... No other published source with an explicit, checkable methodology reaching $30,000 was located for this issue. Where no defensible, sourced methodology exists, the honest version of this chapter is the framework and the open question \u2014 not a borrowed number.\"\n\n**Question for Gio:** Does Gio approve this editorial approach (state the honest thing rather than ship an unverifiable headline), or is a different framing needed?\n\n**Newsroom Assessment:** This is the right call. Shipping \"$30,000 gold\" without methodology destroys newsroom credibility. The manuscript's approach teaches readers how to evaluate such claims. S5 stands entirely on this framing.\n\n---\n\n### 4. IMF TOKENIZATION BLOG (TOKEN SOURCE)\n**Current Status:** HOLD \u2014 could not access live (403 access denied on two independent attempts by conductor and ddn-news-scout). Topic/title confirmed to exist via search. **Correctly NOT cited in preliminary manuscript.**\n\n**Question for Gio:** Should this source be pursued for Karl's expanded S4 essay, or proceed without it?\n\n**Newsroom Assessment:** No action required for Gate 1. TOKEN has been correctly excluded from the preliminary package. If live re-access confirms real content before Karl's essay deadline, it can be added. Hold until then.\n\n---\n\n## OVERALL MANUSCRIPT ASSESSMENT\n\n**Structural Coherence:** \u2705 Five chapters follow a clear arc from access point (branch) \u2192 agent/intermediary (AI) \u2192 infrastructure/code (PHP) \u2192 advisory layer (Shelton/Treasury) \u2192 ownership claims (gold). The progression is logical and reinforces the book's central question: when you need your money to work in your hand, whose timetable determines whether you get it?\n\n**Sourcing Discipline:** \u2705 All claims trace to live sources (PASS), appropriately caveatted sources (PASS-WITH-CAVEAT), or are transparently dropped (HOLD on TOKEN). No fabricated quotes, invented statistics, or guessed-at URLs. Standing exclusions universally honored.\n\n**Tone & Voice:** \u2705 Measured, explanatory, not alarmist. Invites reader understanding and agency rather than panic. Concludes with actionable questions, not crisis framing.\n\n**Political & Legal Sensitivity:** \u2705 Book touches on China (Shelton), central-bank policy (gold backing), banking/fintech convenience vs. control. All handled factually. Shelton appointment in China-focus role is a reasonable journalistic angle, not editorialized. No legal conclusions attempted without actual rule text and qualified review. Subjective editorial choices are transparent and defensible.\n\n**Ready for Production Handoff?** \u2705 Preliminary package is sourced and framed appropriately for Inner Circle / Karl's essay expansion. Remaining outstanding items are secondary refinements (Dimon video timestamps, FDIC independent verification, Antoine documentation, TOKEN re-access) that can proceed in parallel with approval.\n\n---\n\n## BOTTOM-LINE RECOMMENDATION\n\n\u2705 **RECOMMEND: APPROVE preliminary package for Karl/Daniel to proceed with Inner Circle essays and carousel design**\n\n**Per-Signal Recommendations:**\n- S1 (Cash access): **APPROVE** \u2014 pending Gio/Anthony confirmation that Anthony account is acceptable at current hedge level\n- S2 (AI agents): **APPROVE** \u2014 pending video timestamp final check before publication stage\n- S3 (PHP/cyber): **APPROVE**\n- S4 (Shelton/gold): **APPROVE** \u2014 TOKEN source correctly held; can be added if re-access confirmed\n- S5 ($30K gold): **APPROVE** \u2014 editorial choice to state \"no model found\" is sound\n\n**Overall Recommendation: APPROVE PRELIMINARY PACKAGE FOR PRODUCTION HANDOFF**\n\n**Next Steps:**\n1. Gio/Anthony resolve three flagged human-judgment items (Anthony account; FDIC attribution level; Felix Prehn editorial choice)\n2. Karl proceeds with five expanded Inner Circle essays using these preliminary chapters as scaffolding\n3. Daniel proceeds with carousel design, incorporating outstanding receipt elements (Chase ATM screenshot, FDIC chart with attribution caveat, Dimon video still, PHP/IMF advisory graphics, Treasury appointment letter, ICBC notice in English translation)\n4. Neo holds on script recording pending this Gate 1 approval + Gio's response\n5. Ionel confirms RESET URL and platform routing in parallel\n6. Remaining verification work (Dimon timestamps, FDIC independent query, TOKEN re-access) proceeds in parallel track; no blocking items for inner-circle essay/design stage\n\n**Package Status:** Gate 1 ready for approval checkpoint. No blocking sourcing issues remain at preliminary stage.\n\n---\n\n**Prepared by:** ddn-editorial-review  \n**Verification Cutoff:** October 25, 2026 21:44 UTC  \n**Preliminary Approval Window:** October 26\u201328, 2026  \n**Production Stage:** Follows Gio/Anthony approval signal\n", "url": "https://gist.github.com/giog6platform/a6c1218aaad0aec51cd601ac5848d9c6"}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "revisions.3.revision_date"}, {"timestamp": "2026-10-26T03:07:43Z", "date_only": false, "value": "2026-10-26T03:07:43.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/06de046d-4bbc-422c-abfa-7e8b53893c09", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "a066fba7-5274-41b5-9b69-c4b47478ec4f"}, {"timestamp": "2026-10-26T05:10:09.032Z", "date_only": false, "value": "2026-10-26T05:10:09.032399Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3myqxfzghyu27", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "daab6c5d-6d82-4fa5-8f94-dd305e4b212e", "content": "AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026\n\nThis Alert's strongest framing suggests immediate patching is sufficient due to CVE-2026-109618, yet it downplays the risk from CVE-2026-115560 by relegating its danger only to \"uncommon com\u2026\n\nvia Canadian Centre for Cyber Security Alerts", "url": "https://bsky.app/profile/arc-codex.com/post/3myqxfzghyu27"}, {"timestamp": "2026-10-26T07:20:18Z", "date_only": false, "value": "2026-10-26T07:20:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/icewarp-server-aggiornamenti-e-mitigazioni-per-le-vulnerabilita-php2shell-", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "3a061b4f-a1c2-487e-809a-519f572d9aec", "url": "https://www.acn.gov.it/portale/w/icewarp-server-aggiornamenti-e-mitigazioni-per-le-vulnerabilita-php2shell-"}, {"timestamp": "2026-10-26T08:00:14.442Z", "date_only": false, "value": "2026-10-26T08:00:14.442001Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/duonggiakhanh.com/post/3myraw5uefy2i", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "ba3a3e02-93df-4a59-ab8b-b6820b8eeae8", "content": "\ud83c\udf7f PHP2Shell check-in: many exploit attempts, but as of Friday experts said most public PoCs only work in a lab and no mass compromise was confirmed. Still, patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. A separate bug, CVE-2026-115560, only has a mitigation so far. #infosec #appsec", "url": "https://bsky.app/profile/duonggiakhanh.com/post/3myraw5uefy2i"}, {"timestamp": "2026-10-26T11:00:47.737Z", "date_only": false, "value": "2026-10-26T11:00:47.737089Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mm-ilsoftware-bot.bsky.social/post/3myrkyynplo2e", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "d2b454f6-2611-46b3-b511-e23f8659bc53", "content": "PHP spiega come risolvere la nuova falla CVE-2026-115560, una vulnerabilit\u00e0 RCE che interessa particolari configurazioni delle sessioni. Le ultime patch non la correggono: ecco come verificare il rischio e applicare la mitigazione.", "url": "https://bsky.app/profile/mm-ilsoftware-bot.bsky.social/post/3myrkyynplo2e"}, {"timestamp": "2026-10-26T13:20:18Z", "date_only": false, "value": "2026-10-26T13:20:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/icewarp-server-aggiornamenti-e-mitigazioni-per-le-vulnerabilita-php2shell-", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "8725cdd2-5e42-4c74-a7c5-18f997e69e5a", "content": "Disponibili pacchetti di aggiornamento e istruzioni di mitigazione per IceWarp Server, suite di posta elettronica aziendale e collaborazione, al fine di fronteggiare le vulnerabilit\u00e0 critiche note come \"PHP2Shell\" (CVE-2026-109618, CVE-2026-109619 e CVE-2026-115560) presenti nell'interprete PHP integrato nel prodotto.", "url": "https://www.acn.gov.it/portale/w/icewarp-server-aggiornamenti-e-mitigazioni-per-le-vulnerabilita-php2shell-"}, {"timestamp": "2026-10-26T13:24:16Z", "date_only": false, "value": "2026-10-26T13:24:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8752", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "a4f2298d-72f6-42f0-a6bf-a97f38266783", "content": "\u041f\u043e PHP2Shell \u0440\u0430\u0441\u043a\u043b\u0430\u0434 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439:\n\n- \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0430\u043c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Qualys \u0438 Ox Security (1 \u0438 2), \u0431\u043e\u043b\u0435\u0435 99% \u0432\u0441\u0435\u0445 PHP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u043b\u044f PHP2Shell, \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u044b \u043e\u0442 \u0430\u0442\u0430\u043a. \u0412 \u0446\u0435\u043b\u043e\u043c, 73% \u0432\u0441\u0435\u0445 PHP-\u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a.\n\n- \u0421\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 PHP2Shell \u0438\u043c\u0435\u044e\u0442\u0441\u044f. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 Perplexity, \u0447\u044c\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u044b \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043d\u043e\u0435 RCE \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 Apache mod_php, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c PHP 8.4.26.\n\n- \u0412\u044b\u0448\u0435\u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Expel \u041c\u0430\u0440\u043a\u0443\u0441 \u0425\u0430\u0442\u0447\u0438\u043d\u0441, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 PHP2Shell.\n\n- \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c TRACE Dataminr, \u0434\u043e \u044d\u0442\u0438\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u00ab\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u043b\u0430\u0441\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0435\u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.\u00a0\n\n- Arctic Wolf \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0430\u0442\u0430\u043a \u0441 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0441 \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u043c Potassium, \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e\u043c \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Mirai, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0440\u0430\u043d\u0435\u0435 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443.\n\n- CYFIRMA \u0437\u0430\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u041a\u041d\u0414\u0420 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f PHP2Shell \u0434\u043b\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b PHP \u0441 21 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0443\u0437\u043b\u0430. \u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u043e\u0431\u044a\u0435\u043c\u0430\u0445 \u0438 \u0432 \u0443\u043c\u0435\u0440\u0435\u043d\u043d\u043e\u043c \u0442\u0435\u043c\u043f\u0435.\n\n\u0426\u0435\u043b\u0435\u0432\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f 216 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u0421\u0428\u0410, \u042f\u043f\u043e\u043d\u0438\u0438, \u042e\u0436\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0435, \u0422\u0430\u0438\u043b\u0430\u043d\u0434\u0435, \u0418\u043d\u0434\u043e\u043d\u0435\u0437\u0438\u0438, \u0410\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0438, \u0422\u0430\u0439\u0432\u0430\u043d\u0435, \u0418\u043d\u0434\u0438\u0438, \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435, \u041e\u0410\u042d, \u0421\u0430\u0443\u0434\u043e\u0432\u0441\u043a\u043e\u0439 \u0410\u0440\u0430\u0432\u0438\u0438 \u0438 \u0415\u0421.\n\n\u041a \u0446\u0435\u043b\u0435\u0432\u044b\u043c \u0441\u0435\u043a\u0442\u043e\u0440\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043b\u043e\u0433\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0430\u044d\u0440\u043e\u043f\u043e\u0440\u0442\u044b \u0438 \u0430\u0432\u0438\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u043e\u043d\u043b\u0430\u0439\u043d-\u0442\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u0439.\n\n- Defused Cyber \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438 PHP2Shell \u043d\u0430 \u0441\u0432\u043e\u0438 \u043b\u043e\u0432\u0443\u0448\u043a\u0438 GlobalProtect \u043e\u0442 Palo Alto Networks. \u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u0430 204.76.203[.]7, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430 \u0434\u043b\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432. \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043c\u0430\u0440\u043a\u0435\u0440 PHP_SESSION_UPLOAD_PROGRESS (p2s-rider) \u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u0431\u0435\u0437 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438.\n\n- \u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 PHP \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043c\u0435\u0440\u0430\u043c\u0438 \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u043d\u043e\u0432\u043e\u0439 RCE (CVE-2026-115560), \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441 \u00ab\u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u043c \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u00bb.\n\n- Corelight, OpenAI \u0438 Searchlight \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f PHP-\u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043a \u0430\u0442\u0430\u043a\u0430\u043c PHP2Shell.\n\n- \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f SIEM-\u0441\u0438\u0441\u0442\u0435\u043c\u044b KUMA \u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u044f \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f threat hunting.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Kaspersky Managed Detection and Response, \u0430 \u0442\u0430\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 PHP \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Kaspersky Vulnerability Management.\n\n- \u041f\u043e\u0437\u0438\u0442\u0438\u0432\u044b \u0443\u043a\u0430\u0437\u0430\u043b\u0438 Suricata\u2011\u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u044b, \u0430 \u0411\u0438\u0437\u043e\u043d\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a BI.ZONE EDR \u0438 BI.ZONE SOC \u0432\u044b\u044f\u0432\u043b\u044f\u044e\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e CVE-2026-109618/619 \u0432 PHP.", "url": "https://t.me/true_secator/8752"}, {"timestamp": "2026-10-26T14:48:53.099Z", "date_only": false, "value": "2026-10-26T14:48:53.099860Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3myrxquxob62d", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "843317bf-82a5-4542-b6fd-dadfa9329590", "content": "Worth separating from the two patched ones: as of PHP's 23 Oct advisory CVE-2026-115560 still had no fix, only a config mitigation, session.upload_progress.enabled=0. For anyone triaging this week that is the one that is a php.ini change rather than a package update.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3myrxquxob62d"}, {"timestamp": "2026-10-26T17:30:04.303Z", "date_only": false, "value": "2026-10-26T17:30:04.303640Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/z3usalmighty.bsky.social/post/3mysar44on52k", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "b037865c-ce10-48f2-9677-e51eaf00bf6a", "content": "The PHP2Shell follow-up is a useful reminder that 'unpatched critical' and 'exploitable in your stack' are different claims. CVE-2026-115560 needs a specific runtime handler swap plus upload progress enabled. PHP's fix is a routine release; the mitigation is one ini setting.\n\n#CyberSecurity", "url": "https://bsky.app/profile/z3usalmighty.bsky.social/post/3mysar44on52k"}, {"timestamp": "2026-10-26T18:15:55.333Z", "date_only": false, "value": "2026-10-26T18:15:55.333176Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mysdd3h4fs2b", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "ebdb0ee2-5208-471a-b4c5-bd7ee5b4ce9b", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-111497 \u00b7 49 people\n2. CVE-2026-109618 \u00b7 37 people\n3. CVE-2026-109619 \u00b7 28 people\n4. CVE-2026-115560 \u00b7 6 people\n5. CVE-2026-110264 \u00b7 4 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mysdd3h4fs2b"}, {"timestamp": "2026-10-26T18:15:57.224Z", "date_only": false, "value": "2026-10-26T18:15:57.224231Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mysdd3yab22b", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "c95f9a88-b35a-4042-bb94-a94bb5dd2c21", "content": "4. CVE-2026-115560 \u00b7 6 people\n\nNo published details yet (the CVE may still be reserved).", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mysdd3yab22b"}, {"timestamp": "2026-10-26T20:30:07.256Z", "date_only": false, "value": "2026-10-26T20:30:07.256480Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3myskt2qgqf27", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "78edc3b0-65b0-4751-9a19-2b896a18ccf6", "content": "\ud83d\udce2 [VULN] CVE-2026-115560 : Vuln\u00e9rabilit\u00e9 PHP RCE Non Corrig\u00e9e\n\nPHP a divulgu\u00e9 CVE-2026-115560, un nouveau risque d\u2019ex\u00e9cution de code \u00e0 distance affectant les applications web qui utilisent une combinaison inhabituelle de configuration de session PHP et de\u2026\n\n#Vuln\u00e9rabilit\u00e9 #CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3myskt2qgqf27"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "last_revision_date"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-014", "record": "CERTFR-2026-ALE-014", "field": "revisions.4.revision_date"}, {"timestamp": "2026-10-27T04:04:44.894Z", "date_only": false, "value": "2026-10-27T04:04:44.894492Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3myte7ylo262h", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "44efb6ac-b5e5-4541-a6b8-5b72997b1cbc", "content": "The latest update for #Snyk includes \"#PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560]\" and \"Turn Your Vulnerability Backlog Into Pull Requests With Agentic Remediation\".\n \n#CyberSecurity #DevOps #OpenSource https://opsmtrs.com/3yzKsZo", "url": "https://bsky.app/profile/opsmatters.com/post/3myte7ylo262h"}, {"timestamp": "2026-10-27T06:49:56.890Z", "date_only": false, "value": "2026-10-27T06:49:56.890118Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3mytnhfjrrw2z", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "d6d9b25f-c13c-4627-b370-191130fc42b9", "content": "Separate from the Brotli fix, PHP's 23 Oct advisory also carries an informational note on CVE-2026-115560, next to the emergency fixes for 109618 and 109619. Per BleepingComputer that one has no patch yet, with session.upload_progress.enabled=0 as the stopgap.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3mytnhfjrrw2z"}, {"timestamp": "2026-10-27T12:52:17.202Z", "date_only": false, "value": "2026-10-27T12:52:17.202071Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3myubpcocd62k", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "f59159e6-28a7-4224-95c2-3b56675818e8", "content": "Worth adding for anyone doing that patching: the emergency builds (8.5.12, 8.4.27, 8.3.36, 8.2.35) close CVE-2026-109618 and -109619, but php.net's 23 Oct note lists a further one, CVE-2026-115560, with no full fix yet. Mitigation there is session.upload_progress.enabled=0.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3myubpcocd62k"}, {"timestamp": "2026-10-27T19:01:52.237Z", "date_only": false, "value": "2026-10-27T19:01:52.237066Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hey-kira.bsky.social/post/3myuwe6fmir2f", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "22a85573-28bf-4137-9b95-b412adb5f281", "content": "Worth adding to that check: the patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and a rebuilt image still needs its workers restarted. Per the PHP advisory there is also CVE-2026-115560 from 23 Oct with no release yet, only session.upload_progress.enabled=0 as mitigation.", "url": "https://bsky.app/profile/hey-kira.bsky.social/post/3myuwe6fmir2f"}, {"timestamp": "2026-10-28T01:30:06.291Z", "date_only": false, "value": "2026-10-28T01:30:06.291014Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/densuke.bsky.social/post/3myvm2eswe724", "record": "CVE-2026-115560", "field": "creation_timestamp", "uuid": "c160b0e0-5b6c-42e4-ad5b-5238ce94172b", "content": "\u66f4\u65b0\u3055\u308c\u305f\u3088\u3001\u898b\u306b\u6765\u3066\u306d!\u2192 \n\nBlackX \u306f\u5931\u52b9\u30ea\u30b9\u30c8\u306e\u66f4\u65b0\u6f0f\u308c\u304b\u3089 Secure Boot \u3092\u8d8a\u3048\u305f\u3001Kali Linux 2026.3\u3001memblock \u306e\u4e8c\u5206\u63a2\u7d22\u3067 KHO \u74b0\u5883\u306e\u8d77\u52d5\u51e6\u7406\u3092\u77ed\u7e2e\u3001Linux 7.2.13 \u3068 6.18.59\u3001PHP \u306e CVE-2026-115560 \u306f\u7de9\u548c\u7b56\u3067\u5b88\u308b\uff082026/10/28 Linux\u30fbOSS\u30c8\u30ec\u30f3\u30c9\uff09 https://blog.fuga.jp/posts/2026-10-28-linux-oss-trend/\n#fff #7f7f7f #f78fe7 #00d3d0 #79a8ff", "url": "https://bsky.app/profile/densuke.bsky.social/post/3myvm2eswe724"}]}