Skip to main content
CybersecurityHQ Structural Conditions Board
Primary navigation
Issue 46 · as of Issue No. 46, 12 November 2026 (observation cutoff 9 November 2026; collection closed 9 November, 16:28 UTC) · Snapshot ea7de8184295

HELD: PHP2Shell pair (CVE-2026-109618/-109619) adjudicated as the record set on 27 October; in shape on dates, held on the evidence class (honeypot attempts, success unestablished) under CHQ-CRIT-QUESTION-2026-004; not counted

id
RA-2026-046-01
date
2026-11-09
issue
Issue No. 46
condition
SC-2026-006
action
HELD: PHP2Shell pair (CVE-2026-109618/-109619) adjudicated as the record set on 27 October; in shape on dates, held on the evidence class (honeypot attempts, success unestablished) under CHQ-CRIT-QUESTION-2026-004; not counted
from
CONFIRMED / Accumulating; counted 7 at 7 vendors; in-shape candidate pending adjudication
to
CONFIRMED / Accumulating; counted 7 at 7 vendors; in-shape candidate held (attempt telemetry), question before the audit
outlook
Accumulating
watch
none
criterion version
SC-2026-006 criterion v2.0 C1
methodology version
v1.3
evidence rows
  • SN-2026-10-27-01
  • SN-2026-10-27-02
grades
Dates: Grade A (first-hand telemetry, operator primary; release time from the project). Exploitation element: an attempt against a decoy, success unestablished by the observer
independence determination
Not the deciding element; one causal run, one vendor (PHP Group), would be a new vendor on the condition
rule applied
Criterion v2.0 C1 verbatim; CHQ-CRIT-QUESTION-2026-004 (attempt-telemetry candidates held until the audit rules); CGS-2.2 grade on source class; STAB clause 2 (criterion before evidence)
alternative not taken
Count on the telemetry reading (not taken: the criterion text is silent on attempts, the question is referred, and counting ahead of the ruling would decide the criterion by the count). Mark the pair as not in shape (not taken: the dates are in shape; the hold is on the evidence class, not the chronology)
blind reproduction
not applicable (no count)
reproduction result
n/a
cgs provisions
CGS-2.2, CGS-3.1
record links
CHQ-RAT-2026-046; CHQ-CRIT-QUESTION-2026-004; the signal ledger SN-2026-10-27-01
status
VALID
admission status
Not counted. In shape on dates; held on the evidence class (attempts against a decoy network, success against real systems not established) until the criterion question is ruled at the audit.