# HELD: PHP2Shell pair (CVE-2026-109618/-109619) adjudicated as the record set on 27 October; in shape on dates, held on the evidence class (honeypot attempts, success unestablished) under CHQ-CRIT-QUESTION-2026-004; not counted

- **Artifact ID:** RA-2026-046-01
- **Status:** VALID
- **Public record:** https://record.cybersecurityhq.com/rating-actions/ra-2026-046-01
- **Machine-record SHA-256:** `6917e35c2d8575743bbdfc1c191c975242145f445624297342efc391ced4b713`

## Complete structured record

```json
{
  "id": "RA-2026-046-01",
  "date": "2026-11-09",
  "issue": "Issue No. 46",
  "condition": "SC-2026-006",
  "action": "HELD: PHP2Shell pair (CVE-2026-109618/-109619) adjudicated as the record set on 27 October; in shape on dates, held on the evidence class (honeypot attempts, success unestablished) under CHQ-CRIT-QUESTION-2026-004; not counted",
  "from": "CONFIRMED / Accumulating; counted 7 at 7 vendors; in-shape candidate pending adjudication",
  "to": "CONFIRMED / Accumulating; counted 7 at 7 vendors; in-shape candidate held (attempt telemetry), question before the audit",
  "outlook": "Accumulating",
  "watch": "none",
  "criterion_version": "SC-2026-006 criterion v2.0 C1",
  "methodology_version": "v1.3",
  "evidence_rows": [
    "SN-2026-10-27-01",
    "SN-2026-10-27-02"
  ],
  "grades": "Dates: Grade A (first-hand telemetry, operator primary; release time from the project). Exploitation element: an attempt against a decoy, success unestablished by the observer",
  "independence_determination": "Not the deciding element; one causal run, one vendor (PHP Group), would be a new vendor on the condition",
  "rule_applied": "Criterion v2.0 C1 verbatim; CHQ-CRIT-QUESTION-2026-004 (attempt-telemetry candidates held until the audit rules); CGS-2.2 grade on source class; STAB clause 2 (criterion before evidence)",
  "alternative_not_taken": "Count on the telemetry reading (not taken: the criterion text is silent on attempts, the question is referred, and counting ahead of the ruling would decide the criterion by the count). Mark the pair as not in shape (not taken: the dates are in shape; the hold is on the evidence class, not the chronology)",
  "blind_reproduction": "not applicable (no count)",
  "reproduction_result": "n/a",
  "cgs_provisions": "CGS-2.2, CGS-3.1",
  "record_links": "CHQ-RAT-2026-046; CHQ-CRIT-QUESTION-2026-004; the signal ledger SN-2026-10-27-01",
  "status": "VALID",
  "admission_status": "Not counted. In shape on dates; held on the evidence class (attempts against a decoy network, success against real systems not established) until the criterion question is ruled at the audit."
}
```