https://reddit.com/r/cybersecurity/comments/1xci33z/php2shell_was_probed_4_days_before_disclosure_is/: PHP2Shell was probed 4 days before disclosure. Is anyone doing a look-back hunt, not just patching?
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
PHP PHP<8.5.12, <8.4.27, <8.3.36, <8.2.35
Frequently Asked Questions
1
Which PHP releases have fixed versions available?
Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
2
Are older PHP branches covered by a remediation path?
Source backports are available for PHP 7.4 through 8.1. The provided information does not identify corresponding packaged release versions for those branches.
3
How far back should incident responders review logs?
Review web-server and PHP-FPM logs from 17 October onward. An exploit attempt was observed on that date, before public disclosure.
4
What request patterns should be prioritized during log review?
Prioritize multipart requests and session upload-progress requests, as these are identified as the path used by most attacks observed in the provided information.
5
What should be done besides applying updates?
Identify overlooked PHP deployments, including old virtual hosts, vendor appliances, and staging systems. Rotate secrets that may have been present in PHP process memory, because memory disclosure has been demonstrated without requiring RCE.