PHP2Shell Exposes Challenges in Coordinated Disclosure as Exploitation and Patching Accelerate

Summary

Aikido reviews PHP2Shell’s disclosure and patch timeline, reporting widespread exploitation attempts and uneven patching. Censys counted 32.5 million affected PHP services and 11.2 million fixed as of Oct. 27 among services reporting versions.

Key points

After the CVE IDs leaked on Oct. 20, PHP moved its planned patch release forward a day and published fixes on Oct. 21.
Censys data cited by Aikido showed 11.2 million PHP services had updated to a fixed version and 32.5 million still ran an affected version as of Oct. 27; more than 60 million services did not report a version.
Aikido reports widespread exploitation attempts. In a public test, a participant broke into researcher James Pavur’s unpatched PHP 8.4.26 server about three hours after it began serving a page.
Amazon reportedly said the first exploitation attempts began Oct. 17, before PHP’s Oct. 20 pre-announcement.
Aikido says an out-of-memory issue had appeared in a 2024 audit by OSTIF and Quarkslab; Calif and Wiz later independently found the flaws in 2026 and reported proof of exploitation.
Trail of Bits reportedly built a working exploit in a day with Codex; Aikido argues AI may compress the time from vulnerability disclosure to exploitation.
The article advises teams to inventory runtimes and dependencies, monitor timely advisories, and prepare to patch quickly; it also describes backported fixes and early WAF rules.

Article Details

Event Type: Coordinated disclosure and widespread exploitation of PHP2Shell vulnerabilities
Impact: As of October 27, about 32.5 million PHP services were still running an affected version, while roughly 11.2 million had moved to a fixed version. More than 60 million services did not report a version, so the article says total exposure was likely higher. Exploitation attempts were widespread, and successful attempts had been reported; Amazon said the first attempts began on October 17.