{"schema":"sb.node.v1","id":"sb:e/6b58f8229d9475da2af04167","kind":"entity","label":{"text":"php2shell","locale":"en"},"identity":{"anchor":"label:en:php2shell","strength":"label"},"asOf":{"knowledgeCutoff":"2026-11-01T20:23:48.604878+00:00","releaseId":"sb-927dba0bb498","snapshot":"deploy 180490e43da6af0dbcd073020f806976d4745e76"},"lens":{"kind":"public"},"build":{"plane":"projected","builtFrom":["entity_graph.slim.json","entity_receipts (deploy asset)","event_graph.json","truth_records (deploy asset)","corroborated_record.json"],"rule":"node-projection.entity@v1"},"standing":{"evidence":{"supporting":139,"separatePublishers":50,"basis":"documents that mention the subject and the outlets that carried them; a mention is evidence the referent is in use, not evidence about any claim","receiptsOnTopic":{"state":"partial","share":0.417,"named":58,"of":139,"basis":"documents whose own title or summary lead names the subject, over every counted document that mentions it anywhere (the entity graph's measurement); receipts are drawn only from rows whose own title or URL names the subject (the entity graph's subject gate)","blind":["only 42% of the 139 documents measured name the subject in their own text; the rest mention it in passing, so standing.evidence.supporting overstates coverage about it"]}},"admission":{"state":"canonical","kind":"receipted","kindBasis":"receipt-on-file","reason":"entity graph provenance 'curated'; promoted from the corpus by the machine rule; the promotion receipt (bars, evidence, snapshot) is on file but its contents are not yet served","policy":"promotion (receipt on file; contents not yet served)","admittedOn":"2026-10-31"},"disposition":{"state":"served","reason":"public record"},"validity":{"from":"2026-10-21","to":"2026-10-31","basis":"first and last day we saw it mentioned; not the subject's own lifetime"},"measurement":{"state":"partial","blind":["assertion coverage 0.158: about 84% of mentions carry no typed assertion"]}},"dimensions":{"domains":["cybersecurity","cloud_computing"],"activeDays":11,"assertions":{}},"up":[],"upNote":"An entity is a root: it is contained by nothing. Pan out by following R.","children":{"count":9,"byKind":{"observation":9},"withheld":{"state":"withheld","count":3,"reason":"3 receipts withheld: no source link (the same rule the topic record applies)"},"items":[{"id":"sb:o/a77528a44c4df8558bef16ef","kind":"observation","label":"SecurityWeek · 2026-10-30 · PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress","url":"https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/31a17d675d211cb4dafd47f2","kind":"observation","label":"MarketScale News · 2026-10-29 · The Early Scale: CISA mandates PHP2Shell patches this week","url":"https://www.marketscale.com/industries/business-services/the-early-scale-2026-10-29","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/b783faa984a7488d87bc5436","kind":"observation","label":"The Register · 2026-10-29 · Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers","url":"https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/cf0745b3d7b85d9cf403eb2b","kind":"observation","label":"Help Net Security · 2026-10-29 · Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls","url":"https://www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/fcc397fa881dfb18bed03fdb","kind":"observation","label":"BleepingComputer · 2026-10-29 · CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/62da78c7be1d158341e7508c","kind":"observation","label":"The Hacker News · 2026-10-29 · Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces","url":"https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/01fde2bbced05187f02afb11","kind":"observation","label":"TechCrunch · 2026-10-28 · Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’","url":"https://techcrunch.com/video/wizs-cto-on-php2shell-and-the-coming-vulnpocalypse/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/64cbdcc9472446578f704073","kind":"observation","label":"BleepingComputer · 2026-10-28 · Even after PHP2Shell, blast radius matters more than a CVSS score","url":"https://www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/4fb2975ccd96adfc88907b42","kind":"observation","label":"SecurityWeek · 2026-10-28 · China-Linked Hackers Exploit PHP2Shell to Root Firewalls","url":"https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}}],"cursor":null,"order":"newest first; we keep the 9 newest receipts for this entity whose own title or URL (the entity graph's subject gate) names it; each says which in match. Its other observations are counted in standing.evidence.supporting but are not addressable in v1"},"relations":{"count":15,"byKind":{"claim":5,"co-mentioned":10},"items":[{"id":"sb:p/27da20af5ad12228654cb982","kind":"claim","label":"CISA confirms PHP2Shell under attack as researchers clock successful exploits — single source","role":"named-in","relationKind":"claim","members":1},{"id":"sb:p/99b9f1da40d1ad8c1027b918","kind":"claim","label":"Linux Kernel Fragnesia CVE-2026-46300 in CISA KEV: Local Root Flaw Chained With PHP2Shell — single source","role":"named-in","relationKind":"claim","members":1},{"id":"sb:p/b14d6804c89eedc720c18ba6","kind":"claim","label":"CISA Warns of PHP2Shell Vulnerabilities Actively Exploited in Attacks — single source","role":"named-in","relationKind":"claim","members":1},{"id":"sb:p/1dba4cdea52ed5aa0ed9d48e","kind":"claim","label":"Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces — single source","role":"named-in","relationKind":"claim","members":1},{"id":"sb:p/24210cf23750973d07e23735","kind":"claim","label":"PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network — single source","role":"named-in","relationKind":"claim","members":1},{"kind":"relation","label":"co-mentioned with ai (79 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/8c70bf77d20f3a04aed2f3d4"},{"kind":"relation","label":"co-mentioned with cve-2026-109618 (58 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/fe83ce7c1b1076ffa9a829c4"},{"kind":"relation","label":"co-mentioned with cve-2026-109619 (57 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/cc327759d9c8f145369c3164"},{"kind":"relation","label":"co-mentioned with openai (54 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/d4fd9630e772b05718b1ce67"},{"kind":"relation","label":"co-mentioned with google (47 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/e4e2027d4c67a0a0f8c263fb"}],"cursor":"c1.eyJpZCI6InNiOmUvNmI1OGY4MjI5ZDk0NzVkYTJhZjA0MTY3IiwibCI6InJlbGF0aW9ucyIsIm8iOjEwLCJrIjpudWxsLCJhIjoiMjAyNi0xMS0wMVQyMDoyMzo0OC42MDQ4NzgrMDA6MDAifQ","order":"situations first, then claims (the subject's own maintained record, then site-wide corroborated clusters; each label ends with its standing), then co-mentions by shared documents, descending. Co-mentions are the ten strongest the entity graph keeps per entity"},"edge":{"state":"continues"},"links":{"rest":"/api/v1/node/e/6b58f8229d9475da2af04167","mcp":"traverse {\"id\":\"sb:e/6b58f8229d9475da2af04167\"}","page":"/entity/php2shell/"},"limits":{"levelsPerCall":1,"pageSize":10,"maxPageSize":50,"membersMax":50,"statement":"One level per call: depth is 1 and only 1, and there is no whole-graph dump. pageSize 1-50 (default 10); a page limit is a cursor, never an edge. Members are listed up to 50. At most 60 traverse calls a minute per caller (runaway-loop protection, not a meter). One knowledge cutoff is served: the deploy's."},"actions":[{"verb":"unfold","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/6b58f8229d9475da2af04167\",\"level\":\"children\"}"},{"verb":"fold","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/6b58f8229d9475da2af04167\"}"},{"verb":"panOut","lit":false,"effect":"read","layer":"free-record","reason":"An entity is a root: it is contained by nothing. Pan out by following R."},{"verb":"follow","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/6b58f8229d9475da2af04167\",\"level\":\"relations\"}"},{"verb":"receipts","lit":false,"effect":"read","layer":"free-record","reason":"receipts are the observations below this node; unfold to reach them"},{"verb":"edge","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/6b58f8229d9475da2af04167\"}"},{"verb":"asOf","lit":false,"effect":"read","layer":"free-record","reason":"v1 serves one knowledge cutoff, this deploy's; walking an earlier cutoff needs retained history, which v1 does not keep"},{"verb":"switchObserver","lit":false,"effect":"read","layer":"free-record","reason":"the public record is the same for every observer; traversal through a Watch's lens is not served in v1"},{"verb":"readOriginal","lit":false,"effect":"read","layer":"free-record","reason":"no translation is applied on this node; every label is the source's own text"},{"verb":"save","lit":false,"effect":"watch-declaration","layer":"watch","reason":"saving applies to a configured Watch; configure one around this node first (free), then save it"},{"verb":"deliver","lit":false,"effect":"watch-declaration","layer":"watch","reason":"delivery applies to a saved Watch"},{"verb":"format","lit":false,"effect":"watch-declaration","layer":"watch","reason":"output format applies to a saved Watch"},{"verb":"deltaR","lit":false,"effect":"read","layer":"watch","reason":"Delta R needs a saved Watch with a previous reading"},{"verb":"read","lit":false,"effect":"read","layer":"one-time-read","reason":"one-time Reads are not offered through this door; use ask"}]}