Las fallas críticas de PHP ya se explotan en servidores reales: qué versión instalar

Las fallas críticas de PHP ya se explotan en servidores reales: qué versión instalar

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page co/news/enter/chips-bits-fallas-criticas-php2shell-explotadas-que-version, snapshot 20261027T071509Z. Copied byte for byte; every file's sha256 is in captures/20261027T071509Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

ENTER.CO (Colombia, Spanish), 26 October, a piece headed 'the critical PHP flaws are already exploited on real servers'. It says that on Monday 26 October, five days after the patches, successful exploitation was confirmed: the case was documented by Adel Karimi of Perplexity with honeypots that recorded remote code execution against Apache with mod_php and PHP 8.4.26, in which the attacker obtained server memory and then ran a command; Marcus Hutchins of Expel called it the best-quality confirmation he had seen, and until then several security firms had seen only failed attempts or scans. It repeats the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the project's minimal source backports for 7.4, 8.0 and 8.1, mitigation measures for a third flaw (CVE-2026-115560) published on Friday that has no patch yet, and says Colombia's ColCERT issued critical alert AL-20261021-123 on 21 October, counting 8,699 internet-exposed PHP services in the country, mostly on ISP and telecom networks, a measure of exposure and not of vulnerable or attacked servers. It cites BleepingComputer, the PHP Foundation and Más Colombia as sources.

> El caso lo documentó Adel Karimi, de Perplexity, con honeypots (servidores trampa) que registraron una ejecución remota de código contra un Apache con mod_php y PHP 8.4.26.

_Curator's translation:_ "The case was documented by Adel Karimi, of Perplexity, with honeypots (decoy servers) that recorded remote code execution against an Apache with mod_php and PHP 8.4.26."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Las fallas críticas de PHP ya se explotan en servidores reales: qué versión instalar". Selected mechanically, not read by a person.

Capture notes

Language es. The article's byline is an 'AI-powered journalist' persona, which the site states is an editorial pseudonym under a human editor's supervision, with an AI-generated photo: a statement about how the piece was made, and the facts are second-hand from BleepingComputer. Nothing in the article text addresses an AI or hides text from a reader.