PHP2Shell exploitation attempts and remediation
The gist
PHP shipped fixes for two critical 9.2-rated flaws on Oct 21, 2026.
PHP powers most of the web, and many affected firms stayed exposed.
How it unfolded
- Aug 2026Researchers at Calif, Google Cloud's Wiz and OpenAI's Patch the Planet project discover the two flaws and report them to PHP.
- Oct 17, 2026Amazon Threat Intelligence confirms it observed a PHP2Shell exploitation attempt in MadPot, an internal AWS honeypot system.
- Oct 20, 2026A pseudonymous Hacker News forum user leaks information about the flaws before patches are ready; the PHP team announces an out-of-band release for Oct 21 at 14:00 UTC.