# Source: Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

EL MUNDO: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica

**EL MUNDO** · [https://www.elmundo.es/economia/2026/10/21/6ad92780fc6c83a57e8b45a4.html](https://www.elmundo.es/economia/2026/10/21/6ad92780fc6c83a57e8b45a4.html) · published 2026-10-21T21:05:33Z · added by `curator@php.newsroom` · slug `elmundo-economia-2026-10-21-6ad92780fc6c83a57e8b`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). El Mundo (Spanish), 21 October: PHP2Shell is the name the security community gave to two critical PHP flaws in the language behind about 70% of websit...

## What it says, as the collector read it

#### Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/elmundo/economia-2026-10-21-6ad92780fc6c83a57e8b45a4-html`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

El Mundo (Spanish), 21 October: PHP2Shell is the name the security community gave to two critical PHP flaws in the language behind about 70% of websites. The project published the fixed versions on Wednesday with an unusual message: no setting can fully protect, only the update does. It explains CVE-2026-109618 as arising when PHP runs out of memory mid-request and leaves internal structures half built, which the clean-up phase then treats as complete.

> no hay ajuste posible que proteja del todo

_Curator's translation:_ "there is no possible setting that protects completely"

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ El Mundo explains PHP2Shell and how the two memory-lifecycle bugs work. It stresses the project's message that no configuration fully protects and only updating does.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Así es PHP2Shell, el fallo que amenaza a siete de cada diez webs | Actualidad Económica". Selected mechanically, not read by a person.

#### Capture notes

Language `es`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://www.elmundo.es/economia/2026/10/21/6ad92780fc6c83a57e8b45a4.html- `headers.json` d11d72dedf488d63f338b220bf1e083a9cfc1231bb4110475e988078a75c1a29 610 bytes
- `page.html` 6db702efb67e4fa11a991e973643047f7e8b7e9d2239b34ecdf0f14f38653a2d 317,491 bytes
- `provenance.json` 820360a0196ec29e84b026a844ac130042696c47d62cbb1c26d2b283e4da0b49 1,723 bytes
- `rendered.html` 2a8f67b0262ab69428c55fd46024af57ece81cc993d018a913b287dc5a7485dc 514,340 bytes
- `screenshot.jpg` 5ae361a6732ccc588f3f9c516e034ad36f23f8ce3af612af2a590f2b9dd3581a 689,618 bytes
- `text.txt` 3cb32b5c866117283422ed8245edd4c6d8d19e11e737e59bad70938792ccbfcf 14,811 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.18.2 · data as of 2026-10-24T16:05Z · vault commit 8c16a64a7cf6 · https://php.oct.2026.newsroom.sgit.ai/sources/elmundo-economia-2026-10-21-6ad92780fc6c83a57e8b/index.html