GoKawiilPHP2Shell flaws expose gap between disclosure speed and patch timelines
Researchers at Calif and Wiz, aided by OpenAI and Google models, discovered two remote code execution vulnerabilities in PHP dating back to 2012, now dubbed PHP2Shell. Amazon detected exploitation attempts days before PHP's October 21 patch, and attack traffic kept climbing afterward, prompting CISA to add both flaws to its known exploited vulnerabilities list on October 26. Industry data cited shows median fix times for known exploited bugs run 21 to 43 days, far slower than the pace at which attackers are now acting.
GoKawiil's interpretation of the reporting above, not reported fact.
The timeline suggests exploitation can begin before a patch even exists, undercutting the traditional assumption that disclosure gives defenders a head start. This could strengthen the case, as the author argues, for enterprises to invest less in finding every bug faster and more in limiting what compromised systems can access via identity and access controls. Because PHP is embedded in many appliances and hosting panels, remediation may lag well beyond typical timelines, prolonging exposure industry-wide.
- Two PHP remote code execution flaws, dating to 2012, were found using AI-assisted research and exploited before and after patching.
- Exploitation activity outpaced patching, with attacks observed before and immediately after the October 21 fix.
- Average vulnerability remediation times of 21-43 days highlight a structural gap that favors limiting post-exploit access over faster patching alone.
YubiKey 5C NFC Security Key — Since the article emphasizes identity as the real control plane after a breach, hardware-backed authentication like the YubiKey is a concrete way to limit what a compromised credential can actually do. It enforces strong, phishing-resistant verification for privileged accounts and API access, reducing blast radius even when application-layer defenses fail. A practical step enterprises can take right now while patching cycles catch up.”} <- fix trailing quote mentally, not literal. {
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-28
Published there as: “Even after PHP2Shell, blast radius matters more than a CVSS score”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.