No es php.net · No es NVD · No es CISA

Seguimiento de vulnerabilidades PHP

Informe no oficial sobre vulnerabilidades de seguridad en PHP

English简体中文日本語DeutschFrançaisNederlandsEspañol

Alerta de seguridad

PHP2Shell: actualice PHP. Es la única solución completa.

CVE-2026-109618 y CVE-2026-109619 son vulnerabilidades críticas en el propio PHP que permiten ejecución remota de código sin autenticación. El proyecto PHP publicó correcciones el 21 de octubre de 2026 para las ramas con soporte 8.2 a 8.5. Reinicie PHP después de actualizar. Un cortafuegos no es un sustituto.

Pasos para corregir

Seguimiento de caídas

Caídas por PHP2Shell: sitios que se desconectaron y cuándo volvieron

Portales públicos, universidades, plataformas y sitios populares que se desconectaron el 21 y 22 de octubre de 2026, según informes relacionados con PHP2Shell. Aparecer aquí no significa que el sitio fuera comprometido: la mayoría se desconectó por precaución o mantenimiento.

Última actualización

55Sitios seguidos
8Aún caídos
47Recuperados
4h 59mMediana de caída

Por país

  • Países Bajos24
  • Global11
  • Japón5
  • Francia3
  • Finlandia3
  • Reino Unido3
  • Alemania2
  • Bélgica2
  • Austria1
  • Croacia1

Por tipo

  • Sitio web24
  • Gobierno17
  • Plataforma11
  • Universidad3

🕒 Todas las horas en UTC (24 h). La duración va del primer informe de caída al primer informe de vuelta.

Nuestra nota
LIFULL HOME'SJapónPlataforma——CaídoPublicaciones en X Real-estate portal reported offline on X in connection with PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a CDN error, which may reflect regional blocking. [Fuente]2026-10-22 08:35 · 403
SecureW2 MultiOS captive portal breakoutGlobalPlataforma4h 47mRecuperadoPHPocalypse Tracker Network-access vendor took one component (the MultiOS advanced captive portal breakout) offline as a precaution while deploying PHP updates; its status page said its other services stayed up. Our check hit the vendor homepage, which blocks automated requests. [Fuente]2026-10-22 09:55 · 403
at homeJapónPlataforma——CaídoPublicaciones en X Real-estate portal reported in maintenance/offline on X, with posts linking it to PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a bot-check page, so it could not confirm the site's state. [Fuente]2026-10-22 08:41 · 405
SUUMOJapónPlataforma——CaídoPublicaciones en X Real-estate portal reported offline on X in connection with PHP2Shell. The site shows its own system-maintenance page; the operator has not stated a cause. [Fuente]2026-10-22 08:35 · 503
D66 (Dutch political party)Países BajosSitio web2h 47mRecuperadoPHPocalypse Tracker Political party site showed a temporary unavailability page for under three hours. [Fuente]2026-10-22 08:12 · 200
Nespresso Croatia online storeCroaciaSitio web15mRecuperadoPHPocalypse Tracker Online store offline briefly for stated security maintenance. [Fuente]2026-10-22 08:12 · 200
Overheid.nl (Dutch government portal)Países BajosGobierno12h 20mRecuperadoPHPocalypse Tracker Government portal offline for maintenance overnight; back the next morning (UTC). [Fuente]2026-10-22 08:12 · 200
French prefecture websitesFranciaGobierno——CaídoPHPocalypse Tracker Several prefecture sites show a shared maintenance page; others not checked. [Fuente]2026-10-22 08:12 · 200
Belgian Foreign AffairsBélgicaGobierno7h 06mRecuperadoPHPocalypse Tracker Ministry site returned HTTP 503 in four languages; back after midnight (UTC). [Fuente]2026-10-22 08:12 · 302
City of Edinburgh CouncilReino UnidoGobierno5h 06mRecuperadoPHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about five hours. [Fuente]2026-10-22 08:12 · 200
Oxford City CouncilReino UnidoGobierno4h 06mRecuperadoPHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about four hours. [Fuente]2026-10-22 08:12 · 200
Bristol City CouncilReino UnidoGobierno1h 21mRecuperadoPHPocalypse Tracker Council site showed an unavailability notice for under two hours. [Fuente]2026-10-22 08:12 · 200
Port of RotterdamPaíses BajosSitio web2h 36mRecuperadoPHPocalypse Tracker Port authority site temporarily unreachable for under three hours. [Fuente]2026-10-22 08:12 · 301
KNVB (Dutch football association)Países BajosSitio web1h 41mRecuperadoPHPocalypse Tracker Football association sites temporarily unreachable for under two hours. [Fuente]2026-10-22 08:12 · 200
PVV (Dutch political party)Países BajosSitio web8h 36mRecuperadoPHPocalypse Tracker Political party site offline as a stated precaution until the next morning (UTC). [Fuente]2026-10-22 08:12 · 200
GroenLinks-PvdA (Dutch political party)Países BajosSitio web1h 36mRecuperadoPHPocalypse Tracker Political party site offline for under two hours. [Fuente]2026-10-22 08:12 · 403
Scaleway Dedibox Console and APIFranciaPlataforma16h 45mRecuperadoPHPocalypse Tracker Hosting provider put its Dedibox management console and API into emergency maintenance as a precaution while it investigated and patched PHP2Shell. Scaleway said hosted servers and customer data were not affected; it reported the console back after the patches were applied. [Fuente]2026-10-22 09:55 · 302
Acuity SchedulingGlobalPlataforma3h 02mRecuperadoPHPocalypse Tracker Booking platform and login returned HTTP 503 for about three hours, then returned. [Fuente]2026-10-22 08:12 · 200
DriveThruRPGGlobalSitio web7h 11mRecuperadoPHPocalypse Tracker Digital game store offline for maintenance for about seven hours. [Fuente]2026-10-22 08:12 · 403
Sakura Internet (domains and SSL)JapónPlataforma5h 46mRecuperadoPHPocalypse Tracker Domain and SSL control panel under emergency maintenance; notices do not name PHP; hosting and email unaffected. [Fuente]2026-10-22 08:12 · 200
EFRAG (European Financial Reporting Advisory Group)BélgicaGobierno3h 08mRecuperadoPHPocalypse Tracker Site stopped connecting for about three hours, then returned. [Fuente]2026-10-22 08:12 · 301
DeviantArtGlobalSitio web4h 32mRecuperadoPHPocalypse Tracker Art community suspended while applying a software update, then returned. [Fuente]2026-10-22 08:12 · 200
DigiDPaíses BajosGobierno5h 35mRecuperadoPHPocalypse Tracker Government login service offline for about six hours, then returned. [Fuente]2026-10-22 08:12 · 200
MijnOverheidPaíses BajosGobierno3h 35mRecuperadoPHPocalypse Tracker Government citizen portal offline for under four hours, then returned. [Fuente]2026-10-22 08:12 · 200
RTL NieuwsPaíses BajosSitio web3h 32mRecuperadoPHPocalypse Tracker News site offline for under four hours, then returned. [Fuente]2026-10-22 08:12 · 302
Follow the MoneyPaíses BajosSitio web2h 50mRecuperadoPHPocalypse Tracker Investigative news site offline for about three hours, then returned. [Fuente]2026-10-22 08:12 · 200
Platform InvesticoPaíses BajosSitio web1h 44mRecuperadoPHPocalypse Tracker Journalism platform offline for under two hours, then returned. [Fuente]2026-10-22 08:12 · 200
Nederlandse Orde van Advocaten (Dutch bar association)Países BajosGobierno1h 44mRecuperadoPHPocalypse Tracker Bar association site offline for under two hours, then returned. [Fuente]2026-10-22 08:12 · 200
FC TwentePaíses BajosSitio web5h 50mRecuperadoPHPocalypse Tracker Football club site offline for about six hours, then returned. [Fuente]2026-10-22 08:12 · 301
Fortuna SittardPaíses BajosSitio web4h 05mRecuperadoPHPocalypse Tracker Football club site offline for about four hours, then returned. [Fuente]2026-10-22 08:12 · 301
Politievakbond ACP (police union)Países BajosSitio web16h 34mRecuperadoPHPocalypse Tracker Police union site offline until the next morning (UTC). [Fuente]2026-10-22 08:12 · 301
KNMP (Dutch pharmacists' association)Países BajosSitio web2h 20mRecuperadoPHPocalypse Tracker Pharmacists' association site offline for about two hours, then returned. [Fuente]2026-10-22 08:12 · 200
Scouting NederlandPaíses BajosSitio web1h 44mRecuperadoPHPocalypse Tracker Scouting association site offline for under two hours, then returned. [Fuente]2026-10-22 08:12 · 200
Kustwacht (Netherlands Coastguard)Países BajosGobierno4h 35mRecuperadoPHPocalypse Tracker Coastguard site showed an unavailability page with emergency numbers; back later that day. [Fuente]2026-10-22 08:12 · 301
Security.NLPaíses BajosSitio web6h 05mRecuperadoPHPocalypse Tracker Security news site switched to maintenance mode, citing PHP2Shell as the reason. [Fuente]2026-10-22 08:12 · 200
easybillAlemaniaPlataforma2h 20mRecuperadoPHPocalypse Tracker Invoicing web app offline (HTTP 503) as a stated precaution; vendor said data was safe. [Fuente]2026-10-22 08:12 · 302
Choice of GamesGlobalSitio web2h 20mRecuperadoPHPocalypse Tracker Game publisher site showed a temporary 503 page, then returned. [Fuente]2026-10-22 08:12 · 200
CNIL (French data protection authority)FranciaGobierno——CaídoPHPocalypse Tracker Data protection authority site returns a maintenance page (HTTP 503) with no stated reason. [Fuente]2026-10-22 08:12 · 503
Tweede Kamer (Dutch parliament)Países BajosGobierno8h 02mRecuperadoPHPocalypse Tracker Parliament website showed a maintenance notice; back the same evening. [Fuente]2026-10-22 08:12 · 200
NCSC (Dutch national cyber security centre)Países BajosGobierno7h 02mRecuperadoPHPocalypse Tracker National cyber security centre site taken offline; back the same evening. [Fuente]2026-10-22 08:12 · 200
Autoriteit Persoonsgegevens (Dutch data protection authority)Países BajosGobierno——CaídoPHPocalypse Tracker Data protection authority site offline; no recovery recorded by the source. [Fuente]2026-10-22 08:12 · timeout
Valtori (Finnish central government web services)FinlandiaGobierno18h 07mRecuperadoPHPocalypse Tracker Shared government web services offline; recovery recorded the next morning (UTC). [Fuente]2026-10-22 08:12 · timeout
National Land Survey of FinlandFinlandiaGobierno——CaídoPHPocalypse Tracker Land survey agency site shown as down; no recovery recorded by the source. [Fuente]2026-10-22 08:12 · 503
University of ViennaAustriaUniversidad4h 17mRecuperadoPHPocalypse Tracker University website offline for a few hours, then returned. [Fuente]2026-10-22 08:12 · 200
University of FreiburgAlemaniaUniversidad21h 01mRecuperadoPHPocalypse Tracker Home page carried a computing-centre notice about the PHP flaws; the tracker saw the regular home page again on 22 Oct at 08:10 UTC. [Fuente]2026-10-22 08:24 · 301
Haaga-Helia University of Applied SciencesFinlandiaUniversidad22h 46mRecuperadoPHPocalypse Tracker University took its website, Moodle and study guide offline for a day-long critical security update; the PHPocalypse Tracker recorded the study guide working again on 22 Oct at 09:55 UTC. [Fuente]2026-10-22 10:07 · 301
TweakersPaíses BajosSitio web4h 59mRecuperadoPHPocalypse Tracker Tech news site offline for about five hours, then returned. [Fuente]2026-10-22 08:12 · 403
Fur AffinityGlobalSitio web11h 47mRecuperadoPHPocalypse Tracker Art community offline until late evening (UTC). [Fuente]2026-10-22 08:12 · 403
PinboardGlobalSitio web12h 02mRecuperadoPHPocalypse Tracker Bookmarking service offline until late evening (UTC). [Fuente]2026-10-22 08:12 · 200
Miraheze (all wikis)GlobalPlataforma10h 02mRecuperadoPHPocalypse Tracker Wiki farm offline across all hosted wikis, then returned. [Fuente]2026-10-22 08:12 · 301
4chanGlobalSitio web11h 47mRecuperadoPHPocalypse Tracker Imageboard offline until late evening (UTC). [Fuente]2026-10-22 08:12 · 302
NotuBiz council portalsPaíses BajosPlataforma——CaídoPHPocalypse Tracker Council meeting portals run by NotuBiz went offline; reported in connection with PHP2Shell. [Fuente]2026-10-22 08:12 · 301
explain xkcdGlobalSitio web9h 59mRecuperadoPHPocalypse Tracker Community wiki went offline for several hours, then returned. [Fuente]2026-10-22 08:12 · 301
Star Citizen WikiGlobalSitio web4h 59mRecuperadoPHPocalypse Tracker Fan wiki taken offline for about five hours, then returned. [Fuente]2026-10-22 08:12 · 200
CodmonJapónPlataforma9h 41mRecuperadoPHPocalypse Tracker Childcare communication service stopped under emergency maintenance; restored by the evening (UTC). [Fuente]2026-10-22 08:12 · 200

«Nuestra comprobación» es una sola petición de estado HTTP por sitio a la hora indicada: no es un escaneo ni una prueba de vulnerabilidades. Un 403 o un tiempo de espera puede indicar que el sitio bloquea peticiones automáticas.

Informar de un sitio que quedó fuera de línea

¿Conoce un sitio que quedó fuera de línea en relación con PHP2Shell, o que ya volvió? Cuéntenoslo. Cada envío se revisa a mano antes de aparecer en la tabla con la etiqueta «Informe de usuario (revisado)».

Preguntas

¿Fueron hackeados estos sitios mediante PHP2Shell?

No según las fuentes. La mayoría mostró avisos de mantenimiento o precaución mientras actualizaba PHP.

¿De dónde salen los datos?

Del PHPocalypse Tracker (dominio público); cada fila enlaza su fuente original.

¿En qué zona horaria están las horas?

En UTC. 17:05 UTC son las 19:05 en Madrid (CEST).

¿Cada cuánto se actualiza?

Durante el día, aproximadamente cada 10 minutos, tras verificar.