# Source: PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

TechTarget: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget

**TechTarget** · [https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop](https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop) · published not stated · added by `curator@php.newsroom` · slug `techtarget-disclosure-unravels`

Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "hard vulnerabil...

## What it says, as the collector read it

#### PHP2Shell disclosure unravels after leaks forced early patch drop | TechTarget

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/tech-press/techtarget/disclosure-unravels`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: TechTarget. Language: en. URL: https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop

#### What the page says

_Curator's reading of the capture._

TechTarget on how the disclosure unravelled: the leak of the CVE IDs on 20 October brought the release forward to 21 October; Chainguard published fixed images at 07:41 UTC on 21 October, more than six hours early, and the PHP Foundation's criticism is quoted. Chainguard CEO Dan Lorenc does not dispute publishing early but disputes the Foundation's account: he says Chainguard learned on 16 October that a disclosure was coming, independently found the vulnerability that night with an in-house AI harness and a frontier model, joined the coordination channel on 17 October, and published after multiple vendors in the channel reported active exploitation overnight on 20-21 October. Lorenc says Chainguard saw exploitation attempts mainly from Russian and Chinese IP addresses and that many public PoCs were fake. It also reports Amazon's 17 October honeypot hit and Hadrian's "in the wild at scale", and more than 30 UK government services taken offline. No organisation is named as compromised.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "hard vulnerability to exploit": needs the target's environment

Supports: data/compromise.json on the site (/compromise/)

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T012042Z · HTTP 200 · https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop- `headers.json` 87d33c4caf1882ea5e9811dcd54795674e0daed96eda7777f7747cbeee38db5a 649 bytes
- `page.html` 0223170b84edc3cf77a3901e446e8f957010d65649c750657d38ee5bf934a171 328,498 bytes
- `provenance.json` 69ff5c6742e78f811ceeedfb7649bef62e0bd8b0e55f6aa02961068734c0df60 1,749 bytes
- `rendered.html` 0fc25e764308756339016f1356395c2d0c9df502cb917185f4a3f0c7740568cf 353,658 bytes
- `screenshot.jpg` bb1a9c86e83b49f116612264096508106615025ce4df63205f5f31aaa75c0d6a 729,081 bytes
- `text.txt` c186055de6bb1abc70e426281fe382563363ff7b1fe80ba32542b4b9a45f9374 10,677 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/techtarget-disclosure-unravels/index.html