Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

PHP2Shell drew pre-patch attack attempts; success unconfirmed

2 sources · 2 articlesFirst reported Updated ()1
What's new

October 26: The Register adds that issues reach about PHP 5.4 and about 70% of sites, patches followed weekend leaks, success was unconfirmed as of Friday, and Final Fantasy XIV logins went offline.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP emergency-patched PHP2Shell memory flaws after pre-disclosure attack attempts; experts had not confirmed a successful compromise as of Friday.

Pierluigi Paganini told Security Affairs that attackers began exploiting PHP2Shell, memory-safety flaws in PHP that can allow remote command execution, before public disclosure. AWS researchers detected honeypot attempts four days before patches; he urged log reviews from October 17 and said attempts do not prove compromise. The Register reported emergency PHP Foundation patches on Wednesday after weekend leaks, covering issues that Jessica Lyons said reach about PHP 5.4 and roughly 70 percent of websites. As of Friday, she said experts had not confirmed a successful attack, while some public proofs of concept work and others do not. Sites that cannot patch in place remain exposed unless rebuilt.

Key facts
  • Operators were told to review logs from October 17.
  • Flaws can affect PHP releases back to about version 5.4.
  • Lyons said roughly 70 percent of websites are affected.
  • Coordinated disclosure followed an independent find in August.
  • A third related issue was under discussion by October 26.
  • Final Fantasy XIV login servers were taken offline.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Operators told to review logs from this date. · Security Affairs

What each outlet adds

beyond the shared facts
  • Security AffairsPaganini says pre-disclosure exploitation; October 17 log reviews; attempts are not proof.
  • The RegisterAbout PHP 5.4 and 70% of sites; unconfirmed success; FFXIV offline.
Vendors
PHP
Products
PHP
Organizations
AWSPHP Foundation

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Security AffairsFirst report

    PHP2Shell attack attempts began before public disclosure

    AWS honeypots logged attempts four days before patches; operators are told to review logs from October 17.

  2. · 4d ago The Register · Security

    PHP2Shell patches are out; exploit attempts seen, no confirmed hits

    Memory-safety flaws in PHP back to about 5.4 can yield remote code execution, and some sites cannot patch in place.