PHP2Shell Timeline: From a Quiet August Report to a Leak, Early Attacks and a Day-Early Patch

Later that evening Calif mistakenly published a proof-of-concept video with limited extra detail, per the same account. PHP also says Chainguard published built images containing the fix at 07:41 UTC on 21 October, more than six hours before the release. Chainguard's chief executive, Dan Lorenc, says the company did not leak anything and shipped after rumours spread. That dispute is unresolved.

What happened on 21 October?

Cloudflare says it switched on default WAF protection at 03:02 UTC, about nine hours before public disclosure, and saw attack traffic aimed at its customers before the release, according to its blog. Patchstack's timeline records hosting partners reporting active exploitation incidents at 07:34 UTC, Cloudflare's chief technology officer reporting early attacks at 07:43 UTC, and PHP releasing 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 13:52 UTC. Huntress said at 4:30 pm Eastern that it had seen no exploitation on partner systems.

What did Amazon see on 17 October?

Amazon Threat Intelligence says its MadPot honeypots logged an exploitation attempt on 17 October, four days before disclosure, from an address tied to a commercial anonymisation network, as Infosecurity Magazine reported. Amazon says it is unclear how the actor learned of the bugs, and that whether the early attempts could have worked on real systems is unknown. It later recorded proof-of-concept attempts from about 02:00 UTC on 21 October that varied enough to suggest several actors.

Was anyone actually breached?

The sources disagree, and none names a victim. watchTowr's honeypots caught attempts against both flaws and, per SecurityWeek, none had succeeded, though its threat intelligence lead did not expect that to last. Hadrian said it saw exploitation at scale, mostly aimed at the session upload-progress path. Patchstack said hosting partners reported incidents, yet its own telemetry at 13:57 UTC showed probing and no hard evidence of breaches. Sansec said mass exploitation looked less likely than first feared because public proof-of-concept code reportedly fails against a default install, a claim that sits against Amazon's warning of broad exploitation.

Neither CVE was in CISA's known-exploited catalogue as of the latest reports. The honest status for now is attempts confirmed, compromises unproven. For what to do about it, see our guides for site owners and hosts and security teams.