Patch tonight. Migrate to modern, AI-improved.
PHP2Shell timeline
Last updated: 2026-10-23 · Shawn Gants
| Date (UTC unless noted) | Event | Source |
|---|---|---|
| 2024 | Signs of the OOM problem found while fixing an issue from the Quarkslab audit. The fix stalls. | PHP Foundation |
| Jul 30, 2026 | Calif begins an audit of PHP (Patch the Planet) | PHP Foundation |
| Aug 11, 2026 | Calif (Ryan A) and OpenAI independently report unconditional RCE with the same root cause | PHP Foundation |
| Aug 24, 2026 | Wiz reports further attack vectors | PHP Foundation |
| Sep 18, 2026 | OpenAI reports further attack vectors | PHP Foundation |
| Oct 17, 2026 | First exploitation attempt seen in AWS MadPot honeypots | AWS |
| Oct 20, ~15:00 | CVE IDs leak with a wrong CVSS (10.0) and release time | PHP Foundation |
| Oct 20, 19:30 | PHP pre-announcement. Release moved up to Oct 21 14:00 UTC | PHP Foundation |
| Oct 20 | Drupal publishes PSA-2026-10-20 | Drupal.org |
| Oct 21, 03:02 | Cloudflare WAF protections on by default | Cloudflare |
| Oct 21, 07:41 | Chainguard publishes fixed images before the embargo lifts | PHP Foundation |
| Oct 21 | PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 released. CISA, ENISA and others issue alerts | php.net |
| Oct 21 | AWS: "now being broadly exploited in the wild." CISA, at publication, had not observed exploitation. | AWS |
The Drupal PSA page is dated "2026-October-21" on Drupal.org while its ID says 10-20. This table shows it as published around October 20–21. <!-- verify -->
Use the table with attribution. Download the CSV.
Sources on this page
- S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
- S03: PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security
- S04: Drupal.org PSA-2026-10-20: Critical PHP update on Wednesday, October 21, 2026
- S10: Cloudflare Blog: Cloudflare deploys protections against php2shell vulnerability — verified (search extract)
- S11: AWS Security Blog: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot