PHP2Shell timeline
18 dated entries from the first audit signal in 2024 to the exploitation and exposure reports of 22 October. Event dates are kept separate from article publication dates. Only entries with a published time show one.
Entries dated the same day without a published time are shown in editorial order, not as a proven causal sequence. The site does not invent hours or minutes. “Local time” converts only entries whose source published a timezone-aware timestamp.
- 23 October 2026Advisory Confirmed by primary source
PHP flags an unpatched session-upload RCE as a separate issue
PHP published an informational advisory for CVE-2026-115560. The stated path requires a runtime change to session.serialize_handler before session_start() while session upload progress is enabled. The control is session.upload_progress.enabled=0; PHP plans a full advisory with the next regular release and has not published affected versions or a severity score.
- 23 October 2026Exploitation report Media report
Attack traffic reaches millions; successful exploitation still unconfirmed
Security Affairs, citing Censys, reported more than 34.4 million internet-facing PHP services still on vulnerable versions on 23 October. Cloudflare had recorded millions of exploit attempts by 22 October, but the reporting found no confirmed successful real-world RCE. The counts are service counts, not organisations or victims.
- 22 October 2026Research Vendor report
Researchers flag fake PoCs, prank repositories and an unconfirmed AWS claim
JFrog found public 'PoC' repositories that were pranks, including one that changed the victim's wallpaper. VulnCheck reported at least one failed webshell deployment attempt. Bitdefender said it had not observed exploitation and flagged a reported AWS observation from 17 October as not independently confirmed.
- 22 October 2026Research Media report
Exposure estimates vary widely; they are host counts, not victim counts
Censys estimated roughly 1.57 million unpatched hosts among about 2.58 million internet-facing hosts on 21 October. VulnCheck counted more than 2.6 million PHP hosts, nearly all vulnerable. VirusTotal counted about 5.1 million PHP-facing IPs but only 1.1 million advertising a version. The populations and methods differ, so the figures should not be combined or read as confirmed compromises.
- Mitigation Vendor report
Cloudflare activates managed WAF rules about nine hours before disclosure
Cloudflare says its managed protections went live at 03:02 UTC on 21 October, about nine hours before public disclosure, and that it observed attack traffic targeting customers. Cloudflare also says customers should patch even with WAF protection.
Time published by Cloudflare in UTC.
- 21 October 2026Patch Confirmed by primary source
PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12
The four releases fix both PHP2Shell CVEs. PHP says every installation serving web requests is at risk, with Apache mod_php highest risk. PHP 8.1 and older receive no upstream release; minimal source backports exist for 7.4, 8.0 and 8.1.
The PHP archive's embedded timestamp, the GitHub advisory timestamps and CERT-EU's text give different times. This site records 21 October only and does not assert a release time.
- 21 October 2026Advisory Confirmed by primary source
CERT-EU publishes advisory 2026-018
CERT-EU advised organisations to patch immediately and to isolate internet-facing applications if patching was not immediately possible. It noted that temporary mitigations do not make an installation safe and that products embedding PHP may also be affected.
- 21 October 2026Advisory Confirmed by primary source
UK NCSC: any PHP version is affected; consider taking systems offline
The UK NCSC said organisations using any version of PHP are affected, told them not to limit discovery to outdated versions, and advised considering taking a system offline if mitigations cannot be applied quickly. The alert was updated on 22 October.
- 21 October 2026Advisory Media report
CISA says it had not observed exploitation; KEV check finds neither CVE
CISA said it had not observed exploitation at the time of publication and urged immediate patching, according to CyberScoop. A direct check of CISA's official KEV JSON feed, catalog version 2026.10.21, found neither CVE. Some secondary reports claimed a KEV listing; this site could not verify that against the official feed and does not repeat it as fact. This entry records the dated 21 October check; the current KEV status is maintained on the PHP2Shell dossier.
- 21 October 2026Disclosure Media report
Chainguard publishes images containing the fix before the coordinated release
The PHP Foundation says Chainguard published built images containing the fix more than six hours early, allowing attackers to study the patch in binary form. Chainguard's CEO described the decision as a judgment call in reporting by The Record.
- 21 October 2026Disclosure Media report
PHP Foundation calls the delay a 'structural failure'
The PHP Foundation said the delay was a structural failure caused by its security team's decision process and lack of resources. It described competing fixes with backward-compatibility, denial-of-service and extension-ecosystem costs. It also said it had not identified functional exploits at the time of release.
- 21 October 2026Exploitation report Vendor report
Exploit attempts scale after disclosure; circulating PoCs are unreliable
Cloudflare's CEO reported tens of thousands of attempts within 45 minutes of the announcement, hundreds of thousands within two hours and millions by Thursday. WatchTowr said none of the circulating PoCs it tested achieved RCE; they failed, tested timing or crashed targets. Hadrian reported large-scale attempts abusing the session upload-progress path. No confirmed successful compromise was reported at publication.
- 20 October 2026Disclosure Media report
CVE identifiers and technical details leak; PHP moves the release up a day
CVE identifiers and technical details circulated publicly on 20 October, before the coordinated release. The PHP Foundation says the leak included an incorrect release time and an incorrect severity of 10.0. PHP moved disclosure forward by one day.
- 20 October 2026Advisory Confirmed by primary source
PHP publishes an advance notice for 21 October
PHP gave advance notice of a security release scheduled for 21 October 2026 at 14:00 UTC. It described two critical vulnerabilities, both rated CVSS v4.0 9.2, without naming the affected versions.
- 20 October 2026Correction Confirmed by primary source
Leaked severity of 10.0 is corrected to the official 9.2
Early social-media posts about the leak used a CVSS score of 10.0. Both PHP advisories publish CVSS v4.0 9.2. The higher figure was not the vendor's score. This entry records the correction rather than repeating the leak as fact.
- 17 October 2026Exploitation report Vendor report
Amazon honeypot records an exploitation attempt four days before patches
Amazon observed an exploitation attempt on 17 October 2026 against a honeypot, coming from a commercial anonymisation network. The activity predates both the leak and the public advisory. An attempt is not evidence that the target was compromised.
- 11 August 2026Research Media report
Researcher report raises priority; further variants found
A Calif researcher reported the bugs on 11 August 2026. The PHP Foundation says fixing them became the top priority from that date, after OpenAI, Wiz and Trail of Bits independently surfaced related issues. This is the Foundation's account as reported by The Record.
- 2024 Date precision: year onlyResearch Media report
External audit finds early signs of the memory-handling weakness
The PHP Foundation says signs of the memory-handling problem appeared during a 2024 external security audit. At the time no concrete exploit vector was found and other issues took priority, according to its account reported by The Record.
Year only. The cited reporting does not give a month or day.
No events match these filters.
Clear the filters to see all 18 entries.