CISA confirma la explotación activa de PHP2Shell

CISA confirma la explotación activa de PHP2Shell

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page ar/news/muycomputerpro/2026-10-28-cisa-confirma-la-explotacion-activa-de-php2shell, snapshot 20261028T144312Z. Copied byte for byte; every file's sha256 is in captures/20261028T144312Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Spanish IT-trade piece (MuyComputerPRO, 28 October) saying CISA has confirmed active exploitation of PHP2Shell and added both flaws to its Known Exploited Vulnerabilities catalog, ordering federal agencies to update before 29 October 2026. It places this after a Perplexity detection-and-response lead's confirmation on 24 October of remote code execution against honeypot systems, recounts that the issue began in a 2024 audit but was not shown to allow remote code execution until August, cites Censys for more than 32.51 million PHP services still on an affected version, and recommends PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and, until then, temporarily isolating exposed installations.

> ha confirmado la explotación activa de las vulnerabilidades de PHP2Shell y las ha añadido a su catálogo de Vulnerabilidades Explotadas Conocidas (KEV)

_Curator's translation:_ "has confirmed active exploitation of the PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities (KEV) catalog."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "CISA confirma la explotación activa de PHP2Shell". Selected mechanically, not read by a person.

Capture notes

Language es. The captured page is mostly navigation and headline lists around a short article. The article quotes technical detail of a honeypot observation, which is not copied here. Nothing in the page addresses an AI or hides text from a reader.