cyber.hendryadrian.com
Security Insights · sekoia.com

PHP2Shell Exploitation Observed Four Days Before Patch

· Original article ↗

Summary

An Amazon honeypot recorded PHP2Shell exploitation attempts on Oct. 17, four days before fixes arrived; no successful compromise had been publicly confirmed. The article examines shrinking exploit windows and urges pre-disclosure hunting, asset inventory and exposure-re

Key points

  • An Amazon honeypot captured PHP2Shell exploitation activity on October 17; the fix arrived October 21. No successful compromise had been publicly confirmed at the time of writing.
  • Mandiant’s figures put the average exploit warning period at minus seven days in 2025, compared with roughly two months in 2018–19.
  • The article says AI models helped researchers examine PHP code and adapt working exploits across versions and applications; human researchers still directed and reviewed the work.
  • Researchers reported Node2Shell in Google’s Brotli decompression library; the article says the library was bundled in Node.js, Bun, Linux distributions and Python packages.
  • The article recommends investigating activity from before a vulnerability’s disclosure, tracking bundled libraries, reducing internet exposure and preparing responses for periods before patches exist.
  • It also recommends hunting for post-exploitation signs, including web servers spawning shells, unexpected files in web directories and unusual outbound connections.

Article Details

Topic
Pre-patch exploitation and shrinking vulnerability-response windows, illustrated by PHP2Shell and AI-assisted vulnerability discovery.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers exploited critical vulnerabilities in PHP, which the article describes as affecting internet-facing systems.T1595 · Active ScanningThreat actors were reported scanning for vulnerable systems before the PHP2Shell patch was available.

CVE

CVE-2026-111497may sit in a library nobody knows they use. Days after PHP2Shell, researchers reported “Node2Shell,” CVE-2026-111497. The vulnerability was in Google’s Brotli decompression library. Node.js, Bun, several Linux

People

Silas CutlerProvided an estimate of about 1.3 million hosts that are actually vulnerable to PHP2Shell.

Malware

Miraipatch day, Hadrian reported exploitation "in the wild at scale", and researchers tied some attempts to a Mirai botnet. No successful compromise had been confirmed publicly at the time of writing, but watchTowr's view

Products

Drupal4 Argon and GPT-5.6 Sol on August 19, 2026. The team confirmed unauthenticated code execution against Drupal the next day and WordPress the day after. According to Wiz’s analysis, the models helped adapt a workingNode.jsreported “Node2Shell,” CVE-2026-111497. The vulnerability was in Google’s Brotli decompression library. Node.js, Bun, several Linux distributions, and two Python packages bundled the library. The Python fixes shippedPHPOn October 17, an Amazon honeypot captured exploitation of two critical vulnerabilities in PHP’s core. The fix arrived on October 21.WordPresson August 19, 2026. The team confirmed unauthenticated code execution against Drupal the next day and WordPress the day after. According to Wiz’s analysis, the models helped adapt a working exploit across PHP

Tools

Big SleepThe constraint is already weakening. Google’s Big Sleep agent found an SQLite vulnerability in 2025 that Google said was known to threat actors and close to exploitation. No human hypothesis started that investigation.Gemini 4 ArgonWiz found its first PHP vulnerability with Gemini 4 Argon and GPT-5.6 Sol on August 19, 2026. The team confirmed unauthenticated code execution against Drupal the next day and WordPress the day after. According to Wiz’sOpenAI GPT 5.6 SolWiz found its first PHP vulnerability with Gemini 4 Argon and GPT-5.6 Sol on August 19, 2026. The team confirmed unauthenticated code execution against Drupal the next day and WordPress the day after. According to Wiz’s

Countries

Austriadark. On October 21, government websites in Finland, the Netherlands and France were taken offline. In Austria, universities, the steel maker voestalpine and the Burgenland state portal went down, and the hostingBelgiummanaged PHP service 15 minutes before the patch because the known workarounds did not protect them. In Belgium, DPG Media sites, the VUB, several hospitals and the national cyber security center's own website wentFinlandGovernments and institutions went dark. On October 21, government websites in Finland, the Netherlands and France were taken offline. In Austria, universities, the steel maker voestalpine and the Burgenland state portalFranceGovernments and institutions went dark. On October 21, government websites in Finland, the Netherlands and France were taken offline. In Austria, universities, the steel maker voestalpine and the Burgenland state portalNetherlandsGovernments and institutions went dark. On October 21, government websites in Finland, the Netherlands and France were taken offline. In Austria, universities, the steel maker voestalpine and the Burgenland state portal

Industries

GovernmentGovernments and institutions went dark. On October 21, government websites in Finland, the Netherlands and France were taken offline. In Austria, universities, the steel maker voestalpine and the Burgenland state portalMediaservice 15 minutes before the patch because the known workarounds did not protect them. In Belgium, DPG Media sites, the VUB, several hospitals and the national cyber security center's own website went offline as aSteelwebsites in Finland, the Netherlands and France were taken offline. In Austria, universities, the steel maker voestalpine and the Burgenland state portal went down, and the hosting provider Anexia pulled every

Related Articles