# Source: CISA confirma la explotación activa de PHP2Shell

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

MuyComputerPRO: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# CISA confirma la explotación activa de PHP2Shell

**MuyComputerPRO** · [https://www.muycomputerpro.com/2026/10/28/cisa-confirma-la-explotacion-activa-de-php2shell-la-mayor-vulnerabilidad-del-momento](https://www.muycomputerpro.com/2026/10/28/cisa-confirma-la-explotacion-activa-de-php2shell-la-mayor-vulnerabilidad-del-momento) · published 2026-10-28 · added by `curator@php.newsroom` · slug `muycomputerpro-2026-10-28-cisa-confirma-la-explotacion`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261028T144312Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). A Spanish IT-trade piece (MuyComputerPRO, 28 October) saying CISA has confirmed active exploitation of PHP2Shell and added both flaws to its Known Exp...

## What it says, as the collector read it

#### CISA confirma la explotación activa de PHP2Shell

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/muycomputerpro/2026-10-28-cisa-confirma-la-explotacion-activa-de-php2shell`, snapshot `20261028T144312Z`. Copied byte for byte; every file's sha256 is in `captures/20261028T144312Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A Spanish IT-trade piece (MuyComputerPRO, 28 October) saying CISA has confirmed active exploitation of PHP2Shell and added both flaws to its Known Exploited Vulnerabilities catalog, ordering federal agencies to update before 29 October 2026. It places this after a Perplexity detection-and-response lead's confirmation on 24 October of remote code execution against honeypot systems, recounts that the issue began in a 2024 audit but was not shown to allow remote code execution until August, cites Censys for more than 32.51 million PHP services still on an affected version, and recommends PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and, until then, temporarily isolating exposed installations.

> ha confirmado la explotación activa de las vulnerabilidades de PHP2Shell y las ha añadido a su catálogo de Vulnerabilidades Explotadas Conocidas (KEV)

_Curator's translation:_ "has confirmed active exploitation of the PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities (KEV) catalog."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "CISA confirma la explotación activa de PHP2Shell". Selected mechanically, not read by a person.

#### Capture notes

Language `es`. The captured page is mostly navigation and headline lists around a short article. The article quotes technical detail of a honeypot observation, which is not copied here. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261028T144312Z · HTTP 200 · https://www.muycomputerpro.com/2026/10/28/cisa-confirma-la-explotacion-activa-de-php2shell-la-mayor-vulnerabilidad-del-momento- `headers.json` cc362248cfa6840e78fa0186762a9981091035d9bfb3d901e65b3bf2a9408c6a 1,141 bytes
- `page.html` 53fdaaf887a32deb2a7f7c1888b946eb27028e944ed218febd853addc9129919 202,605 bytes
- `provenance.json` aa86dcc488df7f271f37080fef1e84ac4634cd093dd601b4950e032d4d02a685 1,830 bytes
- `rendered.html` 75116287545988a25a0ea7d7c6ec5445956a9cdd6fa7009eb465a378d4a7adb2 229,479 bytes
- `screenshot.jpg` ba52905b37408fb20479847ab15a70b7325d598acd656295e309016ac6d76085 545,906 bytes
- `text.txt` 62d4d80d34dc348ded2eaf7bf43b27264ab5cd7f6a44dcd16405c8b6be31b6b8 8,558 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.51 · data as of 2026-10-28T17:15Z · vault commit 75668aedfb6d · https://refs.php.oct.2026.newsroom.sgit.ai/sources/muycomputerpro-2026-10-28-cisa-confirma-la-explotacion/index.html