Search results as returned, 23 October 2026

The six fixed queries of plan.md were sent together at about 17:08 UTC (after the plan's push at 17:07:32 UTC), through the session's web-search tool in its standard mode, which returns a ranked list of titles and URLs and a short machine-written summary, and no raw response. Each list is transcribed below in rank order, as returned. The summaries are the tool's own reading of pages this pass did not open; they are leads, never sources, and are kept only where they name a lead used in the ledger.

1. CVE-2026-109618 exploitation attempts telemetry

1. CVE 2026 109618: https://pasqualepillitteri.it/en/news/tag/CVE-2026-109618
2. Nyc clouds: https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild
3. threatcluster.io: https://threatcluster.io/article/94c4c705
4. SOC Prime Bias: Critical: https://socprime.com/active-threats/cve-2026-1731-analysis/
5. CVE Intelligence: https://socradar.io/free-tools/cve-radar/CVE-2026-19681
6. CVE-2026-72650 Details: https://www.bitsight.com/groma-explorer/cve-2026-72650
7. MAL 2026 4252: https://osv.dev/vulnerability/MAL-2026-4252
8. CVE-2017-9841, exploited in the wild: https://mirage.offseq.com/cve/CVE-2017-9841
9. CVE-2026-9198 Attacker hosts for 2026-08-10: https://jamesbrine.com.au/cve-2026-9198-attacker-hosts-for-2026-08-10/

Tool summary, in short: only result 1 names the CVE, as a tag page without data; the others concern other CVEs.

2. CVE-2026-109619 known exploited vulnerabilities catalog

1. CISA KEV April 2026: https://hivepro.com/wp-content/uploads/2026/05/CISA-KEV-April-2026.pdf
2. CISA KEV January 2026: https://hivepro.com/wp-content/uploads/2026/02/CISA-KEV-January-2026.pdf
3. CISA KEV MARCH 2026: https://hivepro.com/wp-content/uploads/2026/04/CISA-KEV-MARCH-2026.pdf
4. CISA Known Exploited Vulnerability Catalog June 2026: https://hivepro.com/threat-digests/cisa-known-exploited-vulnerability-catalog-june-2026
5. vulnerability.circl.lu: https://vulnerability.circl.lu/sightings/?page=163
6. intel.controlassurance.com: https://intel.controlassurance.com/
7. vulnerability.circl.lu: https://vulnerability.circl.lu/sightings/?page=180
8. db.gcve.eu: https://db.gcve.eu/sightings/?query=N
9. CVE Intelligence: https://socradar.io/free-tools/cve-radar/topics/upload

Tool summary, in short: no result names the CVE; it points to CISA's catalogue page itself, which was not a result.

3. PHP vulnerability exposed servers scan Shadowserver October 2026

1. 2.24M Internet-Facing PHP Hosts, 59% on Versions With No Fix Coming: What We Know About php2shell: https://cybelangel.com/ja/ブログ/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
2. (same title): https://cybelangel.com/ar/مدونة/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
3. (same title): https://cybelangel.com/de/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
4. (same title): https://cybelangel.com/es/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
5. (same title): https://cybelangel.com/fr/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
6. (same title): https://cybelangel.com/blog/critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/
7. 082a0d99 cd6a 41f8 93e1 5c42a4942ce1: https://ground.news/article/082a0d99-cd6a-41f8-93e1-5c42a4942ce1
8. 80,000+ Organizations Had AI Logins Stolen. Is Yours One of Them?: https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/
9. Government websites go dark after AI-discovered flaw sparks security scramble: https://ground.news/article/45394153-23a1-4b45-9bcb-03835d3ec495

Tool summary, in short: no Shadowserver result; CybelAngel's count is the only exposure count found; secondhand claims that Aikido, citing Cloudflare, reports exploitation, and that Sansec predicted mass exploitation within minutes of release.

4. PHP critical vulnerability services taken offline precaution October 2026

1. php security flaws prompt websites worldwide to shut down temporarily: https://www.guru3d.com/story/php-security-flaws-prompt-websites-worldwide-to-shut-down-temporarily/
2. PHP Vulnerability Fallout After European Government Websites Go Offline: https://www.esecurityplanet.com/threats/news-php-flaws-european-government-websites-offline-emea/
3. yle.fi: https://yle.fi/a/74-20252600
4. pokemon umamusume and other major games taken offline over critical php vulnerability 3420823: https://www.dexerto.com/pokemon/pokemon-umamusume-and-other-major-games-taken-offline-over-critical-php-vulnerability-3420823/
5. php2shell thousands of websites exposed in luxembourg: https://en.paperjam.lu/article/php2shell-thousands-of-websites-exposed-in-luxembourg
6. blue News Logo: https://www.bluewin.ch/en/digital/security-vulnerability-threatens-millions-of-websites-what-does-that-mean-li.3643831
7. Critical PHP vulnerabilities force government websites offline across Europe: https://jang.com.pk/en/74964-critical-php-vulnerabilities-force-government-websites-offline-across-europe-news
8. php security flaws put millions of websites on alert: https://www.analyticsinsight.net/amp/story/news/php-security-flaws-put-millions-of-websites-on-alert
9. newly discovered php vulnerabilities impact bullhorn bamboohr others: https://www.staffingindustry.com/news/global-daily-news/newly-discovered-php-vulnerabilities-impact-bullhorn-bamboohr-others

Tool summary, in short, all from media: Dutch government services (Overheid.nl, MijnOverheid.nl, DigiD) suspended with no indication of exploitation reported; Finnish public web services taken offline as a precaution; French local-government administrative sites taken down; Pokemon Sleep, Pokemon HOME and Cygames titles in emergency maintenance, with no confirmed link for some; BambooHR temporarily offline; Luxembourg's CIRCL advising operators to verify the running version and restart all PHP processes.

5. php2shell honeypot scanning observed

1 to 10. AbuseIPDB pages: https://www.abuseipdb.com/user/102418, then /check/ pages for 210.157.194.29, 66.56.81.35, 84.239.12.23, 66.56.81.219, 212.56.48.98, 185.93.0.213, 103.93.42.28, 142.93.255.74 and 98.98.60.200 (all https://www.abuseipdb.com/check/<address>).

Tool summary, in short: generic honeypot reports, none naming php2shell.

6. PHP 8.5.12 release packaging delay distribution build problem

1. [PHP-WEBMASTER] [web-php] master: Announce PHP 8.5.4: https://discourse.thephp.foundation/t/php-webmaster-web-php-master-announce-php-8-5-4/5230
2. [PHP] PHP 8.5.0beta1 is available for testing: https://discourse.thephp.foundation/t/php-php-8-5-0beta1-is-available-for-testing/3738
3. php.net: https://php.net/releases/5_5_12
4. Release Information: https://php.watch/versions/8.5/releases/8.5.3
5. <feed xmlns='http://www.w3.org/2005/Atom'>: https://git.enea.com/cgit/linux/meta-openembedded.git/atom/meta-oe/recipes-devtools/php?h=master
6. PHP 8.5.5: Downloads, Changelog, News: https://php.watch/versions/8.5/releases/8.5.5
7. PHP 8.5.4: Downloads, Changelog, News: https://php.watch/versions/8.5/releases/8.5.4
8. Release Information: https://php.watch/versions/8.5/releases/8.5.1
9. Package details: https://pkgs.alpinelinux.org/package/edge/community/armv7/php85

Tool summary, in short: nothing on 8.5.12 or a packaging problem; results concern earlier releases.

Selection under the plan's rule

First-party pages about this event, not already retained, at most two per query: query 3's CybelAngel post (rank 6, the English address of the same post as ranks 1 to 5) and SOCRadar's post (rank 8). No other result is a first-party page about this event: queries 1, 2, 5 and 6 returned pages about other CVEs, catalogue digests by a third party, generic listing pages or earlier releases, and query 4 returned only media, whose named primary sources have no URL in the results and so are leads, not opened. No result showed a page carrying the 23 October instruction.