PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet

PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page ar/news/muycomputer/2026-10-21-php2shell-el-fallo-de-php-que-ha-puesto-en-jaque, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

MuyComputer (Spanish), 21 October: PHP2Shell, the PHP flaw that has put the Internet in check. The incident has its origin in two vulnerabilities in PHP's engine, CVE-2026-109618 and CVE-2026-109619, severity 9.2, which under certain conditions allow remote code execution without authentication, even when the affected applications themselves are secure. A long page (about 21,000 characters); the opening was read.

> El incidente, conocido como PHP2Shell, tiene su origen en dos vulnerabilidades del motor de PHP, identificadas como CVE-2026-109618 y CVE-2026-109619, con una gravedad de 9,2 sobre 10.

_Curator's translation:_ "The incident, known as PHP2Shell, originates in two vulnerabilities in PHP's engine, identified as CVE-2026-109618 and CVE-2026-109619, with a severity of 9.2 out of 10."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ MuyComputer gives a long technical explainer of CVE-2026-109618/109619, which SAPIs are exposed, and how the problem first identified in 2024 grew into a global emergency. It mentions precautionary disconnections only in general terms.

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: el fallo de PHP que ha puesto en jaque a Internet". Selected mechanically, not read by a person.

Capture notes

Language es. Nothing in the page addresses an AI or hides text from a reader.