PHP2Shell disclosure unravels after leaks forced early patch drop

Multi-party discovery

While AI developers highlighted the discovery as a victory for defensive capabilities, the timeline leading to the patch release reveals a growing challenge in modern multi-party vulnerability coordination.

"I've been a part of a small group, including several colleagues at OpenAI, Calif, Wiz and the PHP maintainers working behind the scenes on this for the past month or so," said Clint Gibler, head of OpenAI's cyber research team, in a post today.

Gibler explained that security firm Calif first discovered the vulnerability class on Aug. 11 while working through OpenAI's "Patch the Planet" initiative, with Wiz and OpenAI independently discovering the bug in subsequent weeks.

However, after weeks of planning, the coordinated disclosure quickly unraveled.

Disclosure breakdown

"We were intending for the patch to go live Thursday [Oct. 22], but a rumor/leak started Tuesday, and then immediately people everywhere began their own vuln hunting and trying to create PoC exploits, so the PHP maintainers pulled the patch release up a day," Gibler said. "We predicted this could happen, but it was pretty crazy to observe in real time."

According to official details from the PHP Foundation, the leak began on Tuesday, Oct. 20, when CVE IDs began circulating on online forums. In response, the PHP project brought its release forward to Oct. 21.

The situation escalated when Calif inadvertently published a proof-of-concept video demonstrating the exploit against active targets. Although quickly deleted, the PHP Foundation said copies circulated widely across social media.

The embargo broke down further on Oct. 21 at 07:41 UTC -- more than six hours before the scheduled release -- when distributor Chainguard published images containing the fix.

"Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed," the PHP Foundation said. "Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."

Chainguard CEO Dan Lorenc did not dispute that his company published the images ahead of schedule. However, he argued against the Foundation's characterization that it did so because it had received the patch early for customer benefit, noting that the builds were released publicly rather than restricted to Chainguard customers.

In an interview with TechTarget, Lorenc said Chainguard learned on Friday, Oct. 16 that a PHP disclosure was coming, then independently found the same vulnerability that night using an in-house AI harness and a frontier model, before being formally added to the coordination channel on Saturday. From there, he said, Chainguard helped test patches alongside other researchers and network vendors through the weekend.

Lorenc said the decision to publish came after multiple vendors in the disclosure channel reported seeing active exploitation overnight on Oct. 20 into Oct. 21, while PHP maintainers -- based in Europe -- were asleep. After a call with other researchers involved in the discovery, he said he decided to ship the fixed builds publicly, judging that evidence of in-the-wild exploitation justified an early release under coordinated disclosure norms.

"This decision was based on how easily we were able to independently discover the vulnerability and build an exploit, how much information was already out there on the coming vulnerabilities and fixes, and the evidence shared on active exploits in the wild," Lorenc wrote on LinkedIn, adding that he regretted the added stress his decision caused the PHP Foundation and maintainers.

Exploits detected days before disclosure

Regardless of the internal disclosure issues, telemetry shows that threat actors were probing for the flaw well before either the Oct. 20 leak or the official Oct. 21 disclosure.

Amazon Threat Intelligence reported that its MadPot honeypot network detected initial PHP2Shell exploitation attempts as early as Saturday, Oct. 17 -- four days prior to the public release.

"The targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," said CJ Moses, chief information security officer at AWS.

Meanwhile, Cloudflare CEO Matthew Prince reported on X: "In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within two hours, and millions now."

Security firm Hadrian similarly warned on October 21 that PHP2Shell was being exploited "in the wild at scale," noting that most observed attacks abused PHP's session upload-progress mechanism.

Lorenc added that Chainguard has observed exploitation attempts primarily from Russian and Chinese IP addresses, and while proof-of-concept exploits have circulated on platforms such as GitHub, many have been fake or have been taken down before reaching functional status.

However, he noted that it's a "hard vulnerability to exploit," and the attacker needs to know the specific environment the target is running -- for example, whether the victim is on Debian, Ubuntu or a particular container image -- to build a working exploit. He added that "anyone sophisticated" is capable of doing this.

Rethinking coordinated disclosure in the AI Era

The chaotic timeline highlights how the rise of AI-assisted vulnerability discovery is straining traditional embargo models.

Art Manion, co-chair of FIRST's vulnerability coordination SIG and former vulnerability analysis manager at Carnegie Mellon's CERT Coordination Center, noted that AI models accelerate co-discovery risks.

"The recent PHP vulnerabilities are yet another example of independent co-discovery by multiple researchers," Manion said. "Co-discovery has always been a (frequently underestimated) concern, but the capabilities of current frontier models increase the chances of co-discovery."

He added: "This leads us to reconsider the risk reduction value of long coordinated vulnerability disclosure embargoes and adds additional pressure to already stressed vulnerability management processes."

As security teams work through the backlog of unpatched servers, PHP2Shell's unraveling disclosure serves as a warning that, in an era of automated, AI-accelerated discovery, prolonged embargoes may create a false sense of security for defenders while threat actors silently move ahead.