# Expert views: what the PHP2Shell fallout teaches about patching and disclosure

The flaws are fixed, but the leaks, the embargo row and the early attacks hold lessons for any firm with a website.

The Assurance Desk, news. Published 23 October 2026.

PHP released fixes for two critical flaws on 21 October 2026, a day earlier than planned, after the CVE IDs began circulating online. Joe Tidy called it an example of how frontier AI cyber defence should not be done. Amazon has since reported an attempt to exploit the flaws four days before they were disclosed ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), [Joe Tidy on Bluesky](https://bsky.app/profile/joetidy.bsky.social/post/3myff7ybius2y) and [aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/), checked 23 October 2026).

## Joe Tidy: an AI story, and not how defence should work

Joe Tidy wrote on Bluesky that this is also an AI story, because the flaws were found with frontier models ([Joe Tidy on Bluesky](https://bsky.app/profile/joetidy.bsky.social/post/3myff7ybius2y), checked 23 October 2026).

Joe Tidy wrote that a leak forced a rushed, panicked patch as criminals raced to build an exploit from it. He did not say who he meant ([Joe Tidy on Bluesky](https://bsky.app/profile/joetidy.bsky.social/post/3myff7ybius2y), checked 23 October 2026).

The PHP Foundation sees the AI side too. It says AI-assisted research means its security team now receives far more reports than before ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), checked 23 October 2026).

> "This is an example of how frontier AI cyber defence should not be done."
> Joe Tidy, Bluesky post excerpt
> Joe Tidy on Bluesky, @joetidy.bsky.social on Bluesky, https://bsky.app/profile/joetidy.bsky.social/post/3myff7ybius2y (checked 23 October 2026)
> ![Joe Tidy, Bluesky profile photo](https://theassurancedesk.com/images/editorial/joe-tidy-bluesky.jpg)
> Portrait source: https://bsky.app/profile/joetidy.bsky.social

## The PHP Foundation's account, and Chainguard's reply

The PHP Foundation published its own account on 21 October 2026. It says the two CVE IDs began circulating on online forums and social media on 20 October, at around 15:00 UTC. The PHP project then moved the release from 22 October to 21 October, at 14:00 UTC ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), checked 23 October 2026).

The Foundation says Calif, one of the security firms that reported the flaws, mistakenly published a video. It says mitigation advice given to a few critical infrastructure providers may have leaked as well ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), checked 23 October 2026).

The Foundation says Chainguard published built images containing the fix at 07:41 UTC on 21 October, more than six hours before the coordinated release. It says this broke the embargo. Like other distributors, Chainguard had received the patch in advance ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), checked 23 October 2026).

Chainguard's chief executive, Dan Lorenc, gave Chainguard's side on LinkedIn. Dan Lorenc wrote that several of the other security vendors in the process confirmed seeing exploits in the wild. Lorenc wrote that he then made the call to ship the fixes and immediately notified the group ([Dan Lorenc on LinkedIn](https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/), checked 23 October 2026).

Dan Lorenc wrote that Chainguard independently found the same issue using its own harness and a frontier model. Lorenc wrote that his decision rested on how easily Chainguard found the flaw and built an exploit. It also rested, he wrote, on how much information was already out and on the evidence shared on active exploits ([Dan Lorenc on LinkedIn](https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/), checked 23 October 2026).

Dan Lorenc wrote that Chainguard made the built artifacts publicly accessible for anyone, not just its customers. Lorenc also wrote that the PHP Foundation and maintainers did an amazing job in a high stress situation. Lorenc wrote that he is sorry his decision led to even more stress for them ([Dan Lorenc on LinkedIn](https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/), checked 23 October 2026).

The Foundation is also open about its own part. It calls the long delay in fixing the underlying problem a structural failure of its decision process and its lack of resources ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), checked 23 October 2026).

**The days around the PHP release**

- 17 October 2026, Global: Amazon sees an attempt to exploit the flaws in its honeypots
- 20 October, around 15:00 UTC, Global: The CVE IDs begin circulating on forums and social media
- 21 October, 07:41 UTC, Global: Chainguard publishes built images with the fix, which the PHP Foundation says broke the embargo
- 21 October, 14:00 UTC, Global: PHP releases the fixes, a day earlier than planned

Times are in UTC. The first entry is Amazon's account. The other entries are the PHP Foundation's account. Chainguard's reply is in the text.

Source: aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog, https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ (checked 23 October 2026); thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language, https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ (checked 23 October 2026)

## Amazon: attacks can start before the advisory

Amazon Threat Intelligence found an attempt to exploit PHP2Shell in its MadPot honeypots, dating to 17 October 2026, four days before public disclosure ([aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/), checked 23 October 2026).

Amazon says it remains unclear how the attacker got the information. It also says it is unclear whether any of the attempts would have succeeded against real systems ([aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/), checked 23 October 2026).

At the time of the release, the PHP security team had not found any working exploits. CISA said it had not seen exploitation when it published its alert on 21 October 2026 ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) and [cisa.gov, Critical Vulnerabilities in PHP Require Immediate Patching, CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching), checked 23 October 2026).

Amazon's view is that an embargo protects defenders only until someone else finds the same bug. It says coordinated disclosure is still the right model. It also says AI-assisted analysis makes it cheaper to turn a patch into a working exploit ([aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/), checked 23 October 2026).

## Graham Cluley: asking questions is the right instinct

Graham Cluley wrote on Bluesky that hundreds of people were mocking Joe Tidy for admitting he did not know what PHP was ([Graham Cluley on Bluesky](https://bsky.app/profile/grahamcluley.com/post/3myjx3a4wn224), checked 23 October 2026).

Graham Cluley's view is that asking questions is what good journalists do, and pile-ons are what bad communities do ([Graham Cluley on Bluesky](https://bsky.app/profile/grahamcluley.com/post/3myjx3a4wn224), checked 23 October 2026).

The same instinct helps a firm that buys its website from a supplier. PHP says Linux distributions and long-term support vendors received the patches in advance, so check with your vendor for updated packages ([php.net, PHP: News Archive, 2026](https://www.php.net/archive/2026.php), checked 23 October 2026).

CISA says PHP is often part of other software, so it may not be easy to see where it runs. The NCSC asks organisations to watch for updates from vendors of appliances and services that may bundle PHP ([cisa.gov, Critical Vulnerabilities in PHP Require Immediate Patching, CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) and [NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 23 October 2026).

Amazon advises starting any investigation from the earliest known exploitation, which for PHP2Shell means from at least 17 October. The NCSC advises checking for evidence of compromise and for backdoors ([aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) and [NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 23 October 2026).

**Questions to ask your web supplier**

- Have the PHP updates from our vendor been applied to our website and other systems?
- Do any of our appliances or services bundle PHP, and has the vendor sent an update?
- Do we still run PHP 8.1 or older, which no longer gets updates from the PHP project?
- When will we move off PHP 8.2, which reaches end of life on 31 December 2026?
- Has anyone checked for signs of attack from at least 17 October?

Built from the advice of PHP, CISA, the NCSC and Amazon. Your supplier may answer some of them for you.

Source: php.net, PHP: News Archive, 2026, https://www.php.net/archive/2026.php (checked 23 October 2026); cisa.gov, Critical Vulnerabilities in PHP Require Immediate Patching, CISA, https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching (checked 23 October 2026); NCSC, Critical security issue affecting PHP, https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (checked 23 October 2026); aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog, https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ (checked 23 October 2026)

> "Asking questions is what good journalists do. Pile-ons are what bad communities do."
> Graham Cluley, Bluesky post excerpt
> Graham Cluley on Bluesky, @grahamcluley.com on Bluesky, https://bsky.app/profile/grahamcluley.com/post/3myjx3a4wn224 (checked 23 October 2026)

## What happens next

The PHP security team is changing its processes so that decisions can be made by majority. The Foundation is also changing processes so its leadership can help steer a stuck fix to a timely resolution ([thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), checked 23 October 2026).

PHP now suggests turning off session upload progress until its next regular bugfix release, to protect against an unlikely further attack route. It says this further issue is unlikely in practice, so it is handling it in the regular release cycle ([php.net, PHP: News Archive, 2026](https://www.php.net/archive/2026.php), checked 23 October 2026).

The NCSC says it will continue to monitor for any impact on UK organisations. For firms that want a way for researchers to report flaws to them, the NCSC Vulnerability Disclosure Toolkit covers the basics ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 23 October 2026).

## Read next

- [Cyber security: the section](https://theassurancedesk.com/cyber-security)
- [Who patches your website: you, your web agency or your host?](https://theassurancedesk.com/guides/who-patches-your-website)
- [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check)
- [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down)
- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident)

## Sources

- thephp.foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, Supporting, Advancing, and Developing the PHP Language: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ (checked 23 October 2026)
- Joe Tidy on Bluesky: https://bsky.app/profile/joetidy.bsky.social/post/3myff7ybius2y (checked 23 October 2026)
- aws.amazon.com, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ (checked 23 October 2026)
- Dan Lorenc on LinkedIn: https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/ (checked 23 October 2026)
- cisa.gov, Critical Vulnerabilities in PHP Require Immediate Patching, CISA: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching (checked 23 October 2026)
- Graham Cluley on Bluesky: https://bsky.app/profile/grahamcluley.com/post/3myjx3a4wn224 (checked 23 October 2026)
- php.net, PHP: News Archive, 2026: https://www.php.net/archive/2026.php (checked 23 October 2026)
- NCSC, Critical security issue affecting PHP: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (checked 23 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.