PHP2Shell: PHP core flaws exploited four days before patch, with mass shutdowns and a negative time-to-exploit trend
On October 17, an Amazon honeypot captured exploitation of two critical vulnerabilities in PHP core, known as PHP2Shell. The fix shipped on October 21, leaving attackers a four-day head start. Hadrian reported exploitation "in the wild at scale" by patch day, and researchers tied some attempts to a Mirai botnet. No successful compromise had been publicly confirmed at the time of writing, though watchTowr did not expect that to last. The article argues that the patch is no longer the first defensive move: Mandiant puts mean time to exploit at minus seven days, and VulnCheck found 28.96% of known exploited vulnerabilities in 2025 were exploited on or before CVE publication.
Entenda a falha
A vulnerabilidade
PHP2Shell is a pair of critical flaws in PHP core, present in the code since 2012. Wiz confirmed unauthenticated code execution against Drupal and WordPress, so an attacker apparently needs only network reach to an exposed PHP application. The fix shipped on October 21. PHP 8.1 and older get no official updates. Palo Alto Networks counts over 22 million exposed PHP instances, and Silas Cutler estimates about 1.3 million are truly vulnerable. The articles give no CVE IDs for the two PHP flaws. Separately, Node2Shell (CVE-2026-111497) affects Google's Brotli decompression library, bundled by Node.js, Bun, several Linux distributions and two Python packages. The articles give no further detail on it.
Como funciona
The articles do not describe the vulnerable code path in detail. The Calif team started from research on PHP from 2004 and from PHP's behavior when it runs out of memory, and traced the flaw from there. Wiz then adapted a working exploit across PHP versions and applications, reaching code execution in Drupal and WordPress without authentication. The exact step where PHP goes wrong is not given.
Por que é vulnerável
The articles do not state the root cause. They say only that the flaws sat in PHP's code for about 14 years, since 2012, without being caught, and that AI models made it cheaper to read the code and test hypotheses. What the fix changes is not described.
Como foi descoberta
Two teams, Calif and Wiz, reported the flaws, and both used AI models. Calif began with a hypothesis from 2004 PHP research and PHP's out-of-memory behavior. Wiz found its first PHP vulnerability on August 19, 2026 with Gemini 4 Argon and GPT-5.6 Sol, then confirmed code execution on Drupal the next day and WordPress the day after. The embargo leaked before the fix: CVE IDs appeared with an incorrect score, a demo video was published early, and one vendor shipped a fix ahead of schedule. An Amazon honeypot captured exploitation on October 17, four days before the October 21 patch.
Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 06:19.
Detalhes técnicos
- The flaws have been present in PHP code since 2012. The two teams that reported them (Calif and Wiz) both used AI models. Wiz said the models helped adapt a working exploit across PHP versions and applications in hours, with confirmed unauthenticated code execution against Drupal and WordPress.
- Exposure: Palo Alto Networks counts over 22 million internet-exposed PHP instances. Silas Cutler estimates about 1.3 million are actually vulnerable. PHP 8.1 and older receive no official updates, and Cisco Talos estimates around half of PHP systems may never be patched.
- Precautionary shutdowns on October 21 hit government sites in Finland, the Netherlands and France. In Austria, universities, voestalpine and the Burgenland state portal went down, and hosting provider Anexia pulled all managed PHP services. In Belgium, DPG Media, the VUB, several hospitals and the national cyber security center's website went offline.
- AhnLab counted about a hundred GitHub repositories named after the bug within a day. Some were fake exploits and others were "fix" scripts asking to be run as root.
- The embargo leaked before the fix: CVE IDs appeared with an incorrect score, a demo video was published early, and one vendor shipped a fix ahead of schedule.
- Days later, researchers reported Node2Shell (CVE-2026-111497) in Google's Brotli decompression library, bundled by Node.js, Bun, several Linux distributions and two Python packages. The Python fixes shipped without an advisory.
Remediação
- Hunt backward: after patching, review logs from at least October 17, not only October 21.
- Track bundled libraries in the software inventory and reduce internet exposure of management interfaces, file-transfer servers and VPN appliances.
- Pre-define who can approve disabling a module, applying a WAF rule or taking a service offline outside business hours.
- Detect post-exploitation behavior such as a web server spawning a shell, new files in web directories and unexpected outbound connections.
- Patch known exploited vulnerabilities within days; CISA's BOD 26-04 sets three days for US federal agencies.
- Do not run unvetted "fix" scripts from GitHub.
Linha do tempo
-
PHP2Shell: PHP core flaws exploited four days before patch, with mass shutdowns and a negative time-to-exploit trend
ler a análise desta fonte ocultar
On October 17, an Amazon honeypot captured exploitation of two critical vulnerabilities in PHP core, known as PHP2Shell. The fix shipped on October 21, leaving attackers a four-day head start. Hadrian reported exploitation "in the wild at scale" by patch day, and researchers tied some attempts to a Mirai botnet. No successful compromise had been publicly confirmed at the time of writing, though watchTowr did not expect that to last. The article argues that the patch is no longer the first defensive move: Mandiant puts mean time to exploit at minus seven days, and VulnCheck found 28.96% of known exploited vulnerabilities in 2025 were exploited on or before CVE publication.
Technical Details
- The flaws have been present in PHP code since 2012. The two teams that reported them (Calif and Wiz) both used AI models. Wiz said the models helped adapt a working exploit across PHP versions and applications in hours, with confirmed unauthenticated code execution against Drupal and WordPress.
- Exposure: Palo Alto Networks counts over 22 million internet-exposed PHP instances. Silas Cutler estimates about 1.3 million are actually vulnerable. PHP 8.1 and older receive no official updates, and Cisco Talos estimates around half of PHP systems may never be patched.
- Precautionary shutdowns on October 21 hit government sites in Finland, the Netherlands and France. In Austria, universities, voestalpine and the Burgenland state portal went down, and hosting provider Anexia pulled all managed PHP services. In Belgium, DPG Media, the VUB, several hospitals and the national cyber security center's website went offline.
- AhnLab counted about a hundred GitHub repositories named after the bug within a day. Some were fake exploits and others were "fix" scripts asking to be run as root.
- The embargo leaked before the fix: CVE IDs appeared with an incorrect score, a demo video was published early, and one vendor shipped a fix ahead of schedule.
- Days later, researchers reported Node2Shell (CVE-2026-111497) in Google's Brotli decompression library, bundled by Node.js, Bun, several Linux distributions and two Python packages. The Python fixes shipped without an advisory.
Remediation
- Hunt backward: after patching, review logs from at least October 17, not only October 21.
- Track bundled libraries in the software inventory and reduce internet exposure of management interfaces, file-transfer servers and VPN appliances.
- Pre-define who can approve disabling a module, applying a WAF rule or taking a service offline outside business hours.
- Detect post-exploitation behavior such as a web server spawning a shell, new files in web directories and unexpected outbound connections.
- Patch known exploited vulnerabilities within days; CISA's BOD 26-04 sets three days for US federal agencies.
- Do not run unvetted "fix" scripts from GitHub.