# Source: PHP2Shell: qué le puede pasar a tu web si no actualizas PHP, aunque WordPress, los plugins y el login estén al día

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

WWWhat's new: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell: qué le puede pasar a tu web si no actualizas PHP, aunque WordPress, los plugins y el login estén al día

**WWWhat's new** · [https://wwwhatsnew.com/2026/10/21/php2shell-que-pasa-si-no-actualizas-php/](https://wwwhatsnew.com/2026/10/21/php2shell-que-pasa-si-no-actualizas-php/) · published 2026-10-21T21:17:09+00:00 · added by `curator@php.newsroom` · slug `wwwhatsnew-2026-10-21-php2shell-que-pasa-si-no-actu`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T070559Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). WWWhat's new (Spain, Spanish), 21 October, a webmaster-facing explainer of what the two flaws mean even for sites with WordPress, plugins and login up...

## What it says, as the collector read it

#### PHP2Shell: qué le puede pasar a tu web si no actualizas PHP, aunque WordPress, los plugins y el login estén al día

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ar/news/wwwhatsnew/2026-10-21-php2shell-que-pasa-si-no-actualizas-php`, snapshot `20261025T070559Z`. Copied byte for byte; every file's sha256 is in `captures/20261025T070559Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

WWWhat's new (Spain, Spanish), 21 October, a webmaster-facing explainer of what the two flaws mean even for sites with WordPress, plugins and login up to date. It gives the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), Wiz's statement that every release of the last decade from PHP 5.4 is affected by at least one, and describes the two classes of fault in general terms (failing requests that leave internal state half-prepared, and references to freed memory from an earlier request). It relays the PHP Foundation's timeline (the two identifiers circulating around 15:00 UTC on 20 October with a wrong publication time and a wrong score of 10; the release moved forward a day to 21 October at 14:00 UTC; one reporting firm published a proof-of-concept video by mistake), Cloudflare's WAF protections from 03:02 UTC on 21 October, DigiD and MijnOverheid taken offline as a precaution in the Netherlands (via NOS and The Hacker News) and BambooHR shutting its service in the US, Canada and Ireland, and Wiz's account of finding its first flaw on 19 August with its Wiz Atlas tool and the Gemini 4 Argon and GPT-5.6 Sol models. It adds that PHP 8.1 and earlier get no project patches (minimal source patches exist for 7.4, 8.0 and 8.1), PHP 8.2 loses support on 31 December 2026, and the Foundation has published 15 CVEs since 1 July. The author's own commentary is marked as his reading.

> Hay intentos de ataque documentados, pero ninguna intrusión confirmada públicamente a fecha de publicación.

_Curator's translation:_ "There are documented attempts at attack, but no publicly confirmed intrusion as of publication."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: qué le puede pasar a tu web si no actualizas PHP, aunque WordPress, los plugins y el login estén al día". Selected mechanically, not read by a person.

#### Capture notes

Language `es`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261025T070559Z · HTTP 200 · https://wwwhatsnew.com/2026/10/21/php2shell-que-pasa-si-no-actualizas-php/- `headers.json` ef17a4ef6c4a1892f95683978d05430f56da370ee9226de88d877da2767fef6e 644 bytes
- `page.html` 599559185d87dd4b6edac9196e877a9722271206859bede7e043c856c78ba12e 68,939 bytes
- `provenance.json` 1ec1b57f3dea270ce8096dac3c0f042a73900d08907d8558a54cd3e355573755 1,765 bytes
- `rendered.html` c1d4b13121ec746d9886b5dd87226d48b638c1360214016ee47a037c0442dbd8 603,893 bytes
- `screenshot.jpg` 88255a99e1bfe5e1bf41cc6a8cc0450d0b1559427e99fe60444b2661f71c6388 649,032 bytes
- `text.txt` ae25a960556c5940370c8ceb4428fd74fee35ff626b977ad52b13fd410b682ee 9,854 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.45 · data as of 2026-10-27T09:43Z · vault commit 55b47c4d6af1 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/wwwhatsnew-2026-10-21-php2shell-que-pasa-si-no-actu/index.html