Escondidos más de una década en el lenguaje que mueve el 70% de las webs: investigadores con la IA de OpenAI y Google destapan PHP2Shell, dos fallos críticos

Escondidos más de una década en el lenguaje que mueve el 70% de las webs: investigadores con la IA de OpenAI y Google destapan PHP2Shell, dos fallos críticos

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page cl/news/okdiario/techy-php2shell-fallos-criticos-php-ia-openai-google-2064091, snapshot 20261028T171512Z. Copied byte for byte; every file's sha256 is in captures/20261028T171512Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Spanish tech-news explainer (Okdiario, 28 October) on how PHP2Shell was found with AI models. It gives the patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), says almost every version since PHP 5.4 has at least one of the flaws and that the PHP project sees the greatest risk with Apache and mod_php, and sets out the discoverers' own timelines: according to Calif, OpenAI invited it into the Patch the Planet programme on 30 July, a Calif researcher found several attack paths on 1 August, Calif told PHP of the first flaw on 11 August, sent a demonstration three days later that PHP confirmed on 15 August, and filed a second report on 21 August; according to Wiz, it found the same flaws independently, the first on 19 August, and reported on 24 August. It reports Wiz's use of its own tool with two AI models, Wiz's comparison with Heartbleed and Log4Shell, and Calif's more modest account of the machines' role.

> El 11 de agosto, Calif avisó a PHP del primer fallo.

_Curator's translation:_ "On 11 August, Calif warned PHP of the first flaw."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Escondidos más de una década en el lenguaje que mueve el 70% de las webs: investigadores con la IA de OpenAI y Google destapan PHP2Shell, dos fallos críticos". Selected mechanically, not read by a person.

Capture notes

Language es. Secondhand on the discoverers' blogs and OpenAI's statement. The page describes how the flaws work and lists applications the researchers say they took over; none of that is copied into the notes. Nothing in the page addresses an AI or hides text from a reader.