PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget

PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page us/tech-press/techtarget/disclosure-unravels, snapshot 20261023T012042Z. Copied byte for byte; every file's sha256 is in captures/20261023T012042Z/provenance.json. Publisher: TechTarget. Language: en. URL: https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop

What the page says

_Curator's reading of the capture._

TechTarget on how the disclosure unravelled: the leak of the CVE IDs on 20 October brought the release forward to 21 October; Chainguard published fixed images at 07:41 UTC on 21 October, more than six hours early, and the PHP Foundation's criticism is quoted. Chainguard CEO Dan Lorenc does not dispute publishing early but disputes the Foundation's account: he says Chainguard learned on 16 October that a disclosure was coming, independently found the vulnerability that night with an in-house AI harness and a frontier model, joined the coordination channel on 17 October, and published after multiple vendors in the channel reported active exploitation overnight on 20-21 October. Lorenc says Chainguard saw exploitation attempts mainly from Russian and Chinese IP addresses and that many public PoCs were fake. It also reports Amazon's 17 October honeypot hit and Hadrian's "in the wild at scale", and more than 30 UK government services taken offline. No organisation is named as compromised.

Why it is here

From the promotion queue (index/promote.json, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "hard vulnerability to exploit": needs the target's environment

Supports: data/compromise.json on the site (/compromise/)

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.