PHP2Shell timeline: leak, patches, and exploitation attempts

1. 2024, then August 2026

   PHP Foundation account of earlier signs

   The Record reports that the PHP Foundation said signs of the bugs surfaced in 2024, and that an AI review first sparked alarm in August 2026. We have not reproduced that internal timeline beyond The Record’s account.

2. 17 October 2026

   AWS MadPot attempt during the embargo

   Amazon Threat Intelligence says a honeypot saw a PHP2Shell exploitation attempt from an address tied to a commercial anonymization network. AWS says this was four days before public disclosure and that it is unclear how exploit information got out. AWS also says it is unclear whether the attempt would have worked on a real system.

3. 20 October 2026

   Leak reports and an emergency-release announcement

   watchTowr’s FAQ is marked published at 19:35 UTC and, at that moment, expected a vendor announcement on 22 October. Tanium says that on 20 October PHP announced an emergency release after details leaked, and that CERT-EU issued advisory 2026-018 advising isolation of internet-facing PHP apps. We have not opened a CERT-EU original for this page, so that line is attributed to Tanium only. ThreatCluster says the out-of-band release was announced on 20 October for 14:00 UTC on 21 October, and that technical details leaked hours before the release.

4. 21 October 2026, 02:00–08:00 UTC

   Proof-of-concept exploits before the embargo lift

   AWS says the earliest proof-of-concept exploits it identified appeared around 02:00 UTC, with further MadPot attempts from additional anonymized infrastructure through about 08:00 UTC. Payloads and infrastructure differed, which AWS reads as multiple actors. Technical analysis was still ongoing, and success on real-world systems was described as unclear.

5. 21 October 2026, 03:02 UTC

   Cloudflare WAF rules already on

   Cloudflare says free and paid WAF customers were covered by default starting at 03:02 UTC, about nine hours ahead of public disclosure in Cloudflare’s telling, after rules had been in development since early October with the PHP Foundation, Wiz, and OpenAI. Cloudflare says it saw attack traffic and payload changes aimed at the rules.

6. 21 October 2026, 13:40 and 14:00 UTC

   Patches publish

   ENISA’s joint statement says the PHP security team issued updates at 13:40 UTC. AWS says the embargo was set for 14:00 UTC and that the release happened then. php.net, the PHP Foundation, CISA, and the Canadian Cyber Centre all identify the fixed versions as 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Tanium also notes Windows builds on downloads.php.net at 13:47 UTC and an NVD record for CVE-2026-109618 at 14:17 UTC marked Undergoing Analysis. We have not independently clocked those two timestamps.

7. 21 October 2026, later that day

   Government alerts and exploitation claims

   CISA, ENISA, the UK NCSC, and the Canadian Centre for Cyber Security publish alerts. CISA says it had not observed exploitation as of publication. The Canadian centre says open-source reporting indicated a proof of concept, with no active exploitation identified by the centre at that time. watchTowr reports attempts on its sensors. SecurityWeek says those sensors had not shown successful exploitation. Expel’s 20:00 UTC status says neither CVE was in CISA KEV and that Expel had not confirmed customer exploitation. AWS, after the embargo, says the issue was being broadly exploited in the wild, meaning attempts using the new proofs of concept, and still separates that from confirmed success on real systems in the earlier paragraphs of the same post.

8. 22 October 2026

   This site’s cutoff

   watchTowr’s FAQ update of this date still lists CISA KEV as not listed. Our pages were written against sources available on 22 October 2026. If a later KEV addition or a confirmed-intrusion report appears, the advisory pages of CISA and the PHP project outrank this timeline.

The practical consequence AWS draws is worth keeping even if individual clocks differ: do not assume the disclosure date is the first exploitation date, and do not plan a week-long window for an internet-facing critical flaw of this kind. Investigate from at least 17 October if this software was exposed.