Source · researcher · secondary · captured

What the PHP2Shell rumors got wrong, from inside the PHP security team

Alexandre Daubois (PHP security team / PHP Foundation) · https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/ · published 2026-10-21 · added by collector-researchers · slug daubois-blog-php2shell-rumors

Personal blog of a PHP Foundation contractor on the PHP security team, dated 21 OCT 2026. Describes anonymous HN post Oct 20, leaked 'PHP2Shell tool' screenshot credited to Calif.IO, the short exploitation video, and watchTowr confirming the CVEs publicly. Gives GHSA advisory opened 2026-08-27 credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion.

What it says, as the collector read it

Alexandre Daubois: "What the PHP2Shell rumors got wrong, from inside the PHP security team"

URL https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/ ; "BLOG · 21 OCT 2026", "REV 2026.10.21". Author joined the PHP Foundation in July 2026 to help the security team (per the Foundation's post). Personal blog, not an official statement.
How the leak happened (verbatim): "An anonymous Hacker News post citing a reliable source went up on October 20 and came down, but screenshots of it had already reached X and Mastodon. A screenshot of the PHP2Shell tool, credited to Calif.IO, leaked alongside the advisory, and a short exploitation video went up and came down the same way. Then watchTowr, writing that 'we were all supposed to wait until Thursday at 11am ET', confirmed in public that the bugs were real and posted both CVE numbers."
Says the CVSS 10.0 traces to "Florian Roth's post, as Phoenix Security relayed it" and to watchTowr via Cyber Daily.
Facts box: "Advisory opened: 2026-08-27, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion"; "Fix PR opened: 2026-09-25, final commit 01a40e89fbfc authored 2026-10-18"; "Leak and advance notice: 2026-10-20"; "Published: 2026-10-21, 14:00 UTC".
Contradiction: the PHP Foundation says "No technical details leaked" with the CVE IDs, yet Daubois describes a leaked tool screenshot and advisory. Also "tomash-areion" is a fourth credited reporter not named elsewhere on this beat.

Claims that cite it

Claim	Who says it	Status	Primary	Sources
The flaws are CVSS 10.0 The PHP Foundation: 'a wrong CVSS score of 10.0 (the actual score is 9.2)'. Daubois traces it to a social post relayed by Phoenix Security and to watchTowr via Cyber Daily.	social posts on 20 October, relayed by a vendor and a news site	contradicted	1/2	PHP Foundation Daubois
The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion tomash-areion is not named in the PHP Foundation's thanks and appears nowhere else on this beat.	GitHub security advisories	confirmed	2/3	PHP PHP Daubois
The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault.	Alexandre Daubois (PHP security team, personal blog)	reported	0/1	Daubois
watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release	Daubois; CERT-EU lists a watchTowr X post among public reports	reported	1/2	Daubois CERT-EU
The fixes were released at 14:00 UTC on 21 October CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times.	php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)	disputed	7/8	oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net

Events that cite it

When	Event	Time is
2026-08-27	The GitHub security advisory is opened, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion.	stated
2026-09-25	The fix pull request is opened.	stated
2026-10-18	The final fix commit is authored; the 7.4 backport branch's commit is dated 18:10:24Z.	stated
2026-10-20 15:00 UTC	The two CVE IDs begin circulating on forums and social media with a wrong release time and a wrong CVSS of 10.0. Per Daubois: an anonymous Hacker News post, then screenshots, a 'PHP2Shell tool' screenshot credited to Calif.io, a short exploitation video, and watchTowr posting both CVE numbers.	stated
2026-10-21 14:00 UTC	The planned release time. php.net's advisory 'Critical remote code execution vulnerabilities, update now' and the four release posts go up.	stated
2026-10-21	CISA alert 'Critical Vulnerabilities in PHP Require Immediate Patching': take systems offline if you cannot update. NSA press release 'PHP2Shell'. UK NCSC alert. CCCS AL26-026. CERT-FR ALE-014. ACN AL07/261021. Cloudflare, Wiz, Calif, the PHP Foundation and Daubois publish their accounts.	stated

The bytes

capture 20261022T081256Z · HTTP 200 · https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

headers.json 7f4da02c6bd4388f7475aed4c30ba66fbfd5e93f9e9b69537b21005081745afa 1,049 bytes
page.html 8f85e508b569e07d58f4ab54611fc7bb886c13f58b8c0448198f44899bf54d10 22,135 bytes
provenance.json c86d302cfb9e3442fe758ce082c1015c8500db089f7e8350402efbd4b259241d 1,046 bytes
rendered.html 8bc8f77f0b030a431c17cfb6048a516fae5d743bcf9af1d571e1a377dbe77fbd 21,926 bytes
screenshot.png c86032b5d2ce179ae664684fe600ba45c0b3ff7003c835716b5cce042a13e514 817,325 bytes
text.txt 5ef17f9886aa93f7f15ab1f6657ef6991a8ec008e5e309bdde5b5e51d961c4d8 8,821 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →