# Source: La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

MONCLOA.COM: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial

**MONCLOA.COM** · [https://www.moncloa.com/2026/10/22/vulnerabilidad-php2shell-fallo-critico-ia-3453167/](https://www.moncloa.com/2026/10/22/vulnerabilidad-php2shell-fallo-critico-ia-3453167/) · published 2026-10-22T09:55:12+02:00 · added by `curator@php.newsroom` · slug `moncloa-2026-10-22-vulnerabilidad-php2shell-fall`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Moncloa.com (Spanish), 22 October: the AI discovers the PHP2Shell vulnerability, the critical PHP flaw that exposes 70% of the world's web. It says an...

## What it says, as the collector read it

#### La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/moncloa/2026-10-22-vulnerabilidad-php2shell-fallo-critico-ia-3453167`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Moncloa.com (Spanish), 22 October: the AI discovers the PHP2Shell vulnerability, the critical PHP flaw that exposes 70% of the world's web. It says an OpenAI model found the flaw, that it affects banks, shops and public services, and that the coordinated patch arrives 'this Thursday 22 October' after a Chainguard leak, following two months of work under embargo. The patch was in fact released on Wednesday 21 October; the outlet's date is wrong, and its 'Chainguard leak' wording is its own.

> El parche coordinado llega este jueves 22 de octubre tras una filtración de Chainguard.

_Curator's translation:_ "The coordinated patch arrives this Thursday 22 October after a Chainguard leak."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Moncloa.com explains PHP2Shell, the AI discovery and the Chainguard leak. It then gives a generic Spanish angle: SMEs, online shops and administration portals are exposed, and INCIBE and CCN-CERT are the bodies expected to issue alerts.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "La IA descubre la vulnerabilidad PHP2Shell: el fallo crítico de PHP que expone al 70% de la web mundial". Selected mechanically, not read by a person.

#### Capture notes

Language `es`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://www.moncloa.com/2026/10/22/vulnerabilidad-php2shell-fallo-critico-ia-3453167/- `headers.json` 43425b1dbaa35825bffd5af2d6c40ecf455de6acb0c0f380c999f15a33c1e6a0 3,015 bytes
- `page.html` a218ae80394ff14f952df41dbe2190a8453767a9809e136d6a63a95513e8ea42 836,913 bytes
- `provenance.json` 9e0107b70d9d92bcadeebd216ff30a4fcc520affdf6724a2c4047bdae0b3421d 1,786 bytes
- `rendered.html` 61bc44b62bef2214661ea769e869132d05fc419dbbcaefb8495d77aff9fe489a 836,519 bytes
- `screenshot.jpg` 26c53f68097b0952bbe0c13d10af60373e00d3c30e7193a0233f91d1d7c6e35f 540,124 bytes
- `text.txt` b6c5efbb52b2517a92d8c5f05ccf4f3df911394881bc73fef1287e6822f69626 8,169 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/moncloa-2026-10-22-vulnerabilidad-php2shell-fall/index.html