Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R03

R03: Exploitation outpaces patching

Because probing began before disclosure and the last PHP core flaw was exploited in the wild a day after its release, attackers may reach unpatched servers faster than operators can update them, resulting in compromises in the window between release and patch.

Rating 20 critical · Likelihood 4 Likely · Impact 5 Severe · Kind Security · Acceptance not recorded

Basis. Probing confirmed; the 2024 precedent was exploited within a day; KEV has not listed php2shell.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

Stakeholder	Part	Why	Its register
Organisations running PHP	owner	Their patch time is the window.	26 risks
Threat intelligence and detection	informer	Sees attempts first.	4 risks
US: CISA and the NSA	regulator	A KEV listing starts the federal clock.	2 risks
Security lead and AppSec	treater	Watches for the shift from probing to compromise.	6 risks

The risks this one is made of

Risk	Rating	Kind	Assigned to	Controls
R03-2 Mass scanning and mutated payloads after the leak	20 critical	Security	WAF vendors treater, Organisations running PHP owner	MITRE ATT&CK T1595.002, NIST CSF 2.0 DE.CM-01, CIS Controls 13.10
R03-1 Attempts before disclosure	15 high	Security	Threat intelligence and detection informer, Security lead and AppSec owner	NIST CSF 2.0 ID.RA-02, ISO/IEC 27001 A.5.7, NIST SP 800-53 SI-4, PCI DSS 12.10.1
R03-3 Exploited in the wild without anyone being able to show it	12 high	Governance	Threat intelligence and detection informer, US: CISA and the NSA regulator, Board and executives owner	CISA KEV and BOD 22-01 KEV-entry, NIST CSF 2.0 ID.RA-02, NIST CSF 2.0 GV.RR-01
R03-4 Detections built on a proof of concept with the wrong mechanism	12 high	Security	Threat intelligence and detection treater, Security lead and AppSec owner	NIST SP 800-53 RA-5, SOC 2 CC7.1, NIST CSF 2.0 ID.RA-01

What it arises from

Exploitation that cannot yet be seen. Honeypots and edge networks see attempts; nobody has shown a compromise, and KEV waits for one. Absence of evidence is read as safety.
The allocator's longjmp-based bailout on out-of-memory. An out-of-memory error unwinds by longjmp and can leave request memory in a state that cleanup later reads.

The evidence

Claim	Status	Fact-check	Sources
Amazon and Cloudflare saw sites being probed for the flaw	confirmed	A5 Confirmed	BBC News Cloudflare Amazon
An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; proof-of-concept attempts began about 02:00 UTC on 21 October from multiple actors; after release 'PHP2Shell is now being broadly exploited in the wild'	reported	A2 Reported	Amazon THN
The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell is not in KEV after one day	confirmed	A2 Reported	CISA CVE record Akamai Security Research
CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog	confirmed	A6 Established	CISA CISA CVE record
Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads	reported	A2 Reported	Cloudflare

Treatments

Treatment	Status	Where
Patch within days, not the 14-day Cyber Essentials window	partial	If you run PHP: the steps, in order, with their sources
Watch the signals ladder for the move from exposed to exploited	in place	The second stories: exposed, attempted, exploited, and what was within reach

The standards that govern it

Framework	Control	What it asks	Family
CISA KEV and BOD 22-01	KEV-entry	A CVE enters the catalogue on reliable evidence of active exploitation	Practice and technique
CISA KEV and BOD 22-01	BOD22-01	Federal agencies remediate catalogued vulnerabilities by the due date set	Practice and technique
NIST CSF 2.0	DE.CM-01	Networks and network services are monitored to find potentially adverse events	Frameworks and control catalogues
NIST SP 800-53	SI-4	System monitoring	Frameworks and control catalogues
MITRE ATT&CK	T1595.002	Active scanning: vulnerability scanning	Practice and technique
ISO/IEC 27001	A.8.16	Monitoring activities	Management-system standards
ISO/IEC 27001	A.5.7	Threat intelligence	Management-system standards

The stories that tell it

On this site: Exploitation signals, in order · The second stories: exposed, attempted, exploited, and what was within reach