tl;dr

AI-assisted researchers reported two critical PHP bugs, now called PHP2Shell, to PHP in August 2026. On 17 October, four days before the fix shipped, an Amazon honeypot recorded someone trying to exploit them. Episode 1 asks who got there first. Signals Corps threat researcher Marcus Arnold gives the verdict: “We can’t say the good guys were first. Only that they were early.”

Watch on YouTube

What we covered

What broke (0:54)

PHP2Shell is two bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, fixed in PHP’s 21 October release. Each is rated 9.2 out of 10 (CVSS v4.0), and Wiz describes them as unauthenticated remote code execution. The vulnerable code goes back to PHP 5.4, released in March 2012. Sites on Apache with mod_php are at the highest risk, The Next Web reports, because the attack can run before the site’s own code does.

Estimates of exposure differ widely, partly because each counts something different. Silas Cutler gave a rough estimate of over 1.3 million vulnerable hosts. Cisco Talos estimates that about half of PHP systems won’t get a patch. For scale, W3Techs finds PHP on about seven in ten websites whose server-side language it can identify.

Who reported first (1:58)

Calif reported the first bug to PHP on 11 August. Wiz reported on 24 August with help from Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas. According to OpenAI, Calif found a critical flaw using GPT-5.6 Sol as part of OpenAI’s Patch the Planet program. Calif’s own write-up names no model, and says it used no special harness “or access to models that weren’t generally available to everyone”.

The attempt before the patch (3:14)

Amazon recorded an exploitation attempt on its MadPot honeypots on 17 October. Amazon says “it remains unclear how the actor acquired exploit information prior to disclosure”, and isn’t sure any attempt would have worked on real systems. Signals Corps threat researchers Sarah Andrews and Marcus Arnold walk through three ways the attacker could have got the bugs: finding them independently, a leak in the disclosure chain, or spotting the fix in public code.

The leaks that became public all came after Amazon’s sighting, so none of them explains it. Per the PHP Foundation, the CVE IDs circulated on 20 October with “a wrong CVSS score of 10.0”, Calif “mistakenly published a video”, and on 21 October Chainguard broke the embargo by publishing built images containing the fix, more than six hours before the coordinated release.

The repositories on GitHub (5:17)

php2shell repositories piled up on GitHub the day the fix shipped. AhnLab sampled the top 100 GitHub repositories for “php2shell” on 22 October and found that nearly all were created on 21 October. 61 of those 100 repositories have one star or fewer. AhnLab also warns that one-line “fix” scripts run with root privileges, so one could hide an attack, though it reports no malicious one. JFrog found a prank exploit that looks like malware and only changes your desktop wallpaper.

The defender’s window (6:45)

OpenAI writes that “To our knowledge, frontier AI found these vulnerabilities before attackers did”, calling this a “Defender’s Window”. Sarah and Marcus set that against Mandiant’s M-Trends 2026, which puts the mean time to exploit at an estimated minus seven days, so on average exploitation starts about a week before the patch. Their point: nothing public puts an attacker ahead of the August reports, and nothing proves one wasn’t.

Show notes

The sources we used, in the order the episode uses them: