Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R02 The coordinated disclosure broke before the fix was ready / R02-1

R02-1: The CVE IDs and the proof-of-concept video circulated before release

Because the CVE IDs circulated from an anonymous post and a proof-of-concept video was published by mistake, attackers knew the target and saw it work before any fix existed, resulting in scanning that began ahead of the release.

Rating 20 critical · Likelihood 5 Happening · Impact 4 Major · Kind Disclosure process · Acceptance not recorded

Basis. Reported by the PHP Foundation and the security team's own account.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

Stakeholder	Part	Why	Its register
Calif	source	Published the video, according to the Foundation.	1 risk
The PHP security team	owner	Decides how the embargo responds.	7 risks
Edge, WAF and detection vendors	treater	Shipped rules within hours of the leak.	8 risks

What it arises from

One embargo shared by many parties. Four independent finders, a coalition, early advice to critical infrastructure and image builders: every party is a place the secret can leave by.

The evidence

Claim	Status	Fact-check	Sources
On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked	reported	A2 Reported	PHP Foundation PHP Foundation
The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down	reported	A2 Reported	Daubois
watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release	reported	A4 Corroborated	Daubois CERT-EU
Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs'	reported	A3 Echoed	PHP Foundation PHP Foundation BBC News Calif

Treatments

Treatment	Status	Where
Edge rules live before disclosure	partial	Detection and defence: what blocks php2shell and what shows it

The standards that govern it

Framework	Control	What it asks	Family
ISO/IEC 29147 and 30111	29147:coordination	Coordinating disclosure with other vendors and parties under embargo	Practice and technique
NIST CSF 2.0	ID.RA-08	Processes for receiving, analysing and responding to vulnerability disclosures are established	Frameworks and control catalogues

The stories that tell it

Where php2shell stands: many sites dark, millions of attempts, no confirmed breach
php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof (through The coordinated disclosure broke before the fix was ready)

On this site: How the coordinated disclosure broke