# Source: Las fallas críticas de PHP ya se explotan en servidores reales: qué versión instalar

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

ENTER.CO: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Las fallas críticas de PHP ya se explotan en servidores reales: qué versión instalar

**ENTER.CO** · [https://www.enter.co/chips-bits/fallas-criticas-php2shell-explotadas-que-version-instalar/](https://www.enter.co/chips-bits/fallas-criticas-php2shell-explotadas-que-version-instalar/) · published 2026-10-26T15:24:44+00:00 · added by `curator@php.newsroom` · slug `enter-chips-bits-fallas-criticas-php2shell-exp`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261027T071509Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). ENTER.CO (Colombia, Spanish), 26 October, a piece headed 'the critical PHP flaws are already exploited on real servers'. It says that on Monday 26 Oct...

## What it says, as the collector read it

#### Las fallas críticas de PHP ya se explotan en servidores reales: qué versión instalar

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `co/news/enter/chips-bits-fallas-criticas-php2shell-explotadas-que-version`, snapshot `20261027T071509Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T071509Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

ENTER.CO (Colombia, Spanish), 26 October, a piece headed 'the critical PHP flaws are already exploited on real servers'. It says that on Monday 26 October, five days after the patches, successful exploitation was confirmed: the case was documented by Adel Karimi of Perplexity with honeypots that recorded remote code execution against Apache with mod_php and PHP 8.4.26, in which the attacker obtained server memory and then ran a command; Marcus Hutchins of Expel called it the best-quality confirmation he had seen, and until then several security firms had seen only failed attempts or scans. It repeats the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), the project's minimal source backports for 7.4, 8.0 and 8.1, mitigation measures for a third flaw (CVE-2026-115560) published on Friday that has no patch yet, and says Colombia's ColCERT issued critical alert AL-20261021-123 on 21 October, counting 8,699 internet-exposed PHP services in the country, mostly on ISP and telecom networks, a measure of exposure and not of vulnerable or attacked servers. It cites BleepingComputer, the PHP Foundation and Más Colombia as sources.

> El caso lo documentó Adel Karimi, de Perplexity, con honeypots (servidores trampa) que registraron una ejecución remota de código contra un Apache con mod_php y PHP 8.4.26.

_Curator's translation:_ "The case was documented by Adel Karimi, of Perplexity, with honeypots (decoy servers) that recorded remote code execution against an Apache with mod_php and PHP 8.4.26."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Las fallas críticas de PHP ya se explotan en servidores reales: qué versión instalar". Selected mechanically, not read by a person.

#### Capture notes

Language `es`. The article's byline is an 'AI-powered journalist' persona, which the site states is an editorial pseudonym under a human editor's supervision, with an AI-generated photo: a statement about how the piece was made, and the facts are second-hand from BleepingComputer. Nothing in the article text addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T071509Z · HTTP 200 · https://www.enter.co/chips-bits/fallas-criticas-php2shell-explotadas-que-version-instalar/- `headers.json` ee11accfa3fa6ae852a8606789938f57f91d480ad43a6de91695755ef0863db7 1,114 bytes
- `page.html` a2719b2d584ee0df7b1d43742fd55c5f264eadcc050c992527fa57f691fdc940 127,964 bytes
- `provenance.json` a4b9882ac26c6a2286e0810600d3f604a7721409c398fa56a6dda59ba0e48647 1,770 bytes
- `rendered.html` d20cd808bf47d383c4bd0317d545ede1c6e7d4a32c898a61a4bb16128b638dd6 219,468 bytes
- `screenshot.jpg` 03b496a43ab068f39ea6af0e5d1d85579afd9e671a2abadb9106aa1e384bf60e 440,018 bytes
- `text.txt` 076ebb796da670146e22cb3ce03cd8917ffa497a6d49ff088b650a19e3846aa2 10,852 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.45 · data as of 2026-10-27T09:43Z · vault commit 55b47c4d6af1 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/enter-chips-bits-fallas-criticas-php2shell-exp/index.html