PHP2Shell: qué le puede pasar a tu web si no actualizas PHP, aunque WordPress, los plugins y el login estén al día

PHP2Shell: qué le puede pasar a tu web si no actualizas PHP, aunque WordPress, los plugins y el login estén al día

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page ar/news/wwwhatsnew/2026-10-21-php2shell-que-pasa-si-no-actualizas-php, snapshot 20261025T070559Z. Copied byte for byte; every file's sha256 is in captures/20261025T070559Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

WWWhat's new (Spain, Spanish), 21 October, a webmaster-facing explainer of what the two flaws mean even for sites with WordPress, plugins and login up to date. It gives the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), Wiz's statement that every release of the last decade from PHP 5.4 is affected by at least one, and describes the two classes of fault in general terms (failing requests that leave internal state half-prepared, and references to freed memory from an earlier request). It relays the PHP Foundation's timeline (the two identifiers circulating around 15:00 UTC on 20 October with a wrong publication time and a wrong score of 10; the release moved forward a day to 21 October at 14:00 UTC; one reporting firm published a proof-of-concept video by mistake), Cloudflare's WAF protections from 03:02 UTC on 21 October, DigiD and MijnOverheid taken offline as a precaution in the Netherlands (via NOS and The Hacker News) and BambooHR shutting its service in the US, Canada and Ireland, and Wiz's account of finding its first flaw on 19 August with its Wiz Atlas tool and the Gemini 4 Argon and GPT-5.6 Sol models. It adds that PHP 8.1 and earlier get no project patches (minimal source patches exist for 7.4, 8.0 and 8.1), PHP 8.2 loses support on 31 December 2026, and the Foundation has published 15 CVEs since 1 July. The author's own commentary is marked as his reading.

> Hay intentos de ataque documentados, pero ninguna intrusión confirmada públicamente a fecha de publicación.

_Curator's translation:_ "There are documented attempts at attack, but no publicly confirmed intrusion as of publication."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: qué le puede pasar a tu web si no actualizas PHP, aunque WordPress, los plugins y el login estén al día". Selected mechanically, not read by a person.

Capture notes

Language es. Nothing in the page addresses an AI or hides text from a reader.