# Source: Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

WIRED: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED

**WIRED** · [https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/](https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/) · published 2026-10-22T02:24Z (page metadata) · added by `curator@php.newsroom` · slug `wired-exploited-days-before-patched`

Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation: ...

## What it says, as the collector read it

#### Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/tech-press/wired/exploited-days-before-patched`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: WIRED. Language: en. URL: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/

#### What the page says

_Curator's reading of the capture._

WIRED: research published by AWS on the evening of 21 October shows at least one actor attempted to exploit PHP2Shell on 17 October, seen on an AWS honeypot from a commercial anonymisation network; in the hours before disclosure AWS honeypots were hit by multiple attempts from several apparent actors, and AWS CISO CJ Moses says it is unclear whether any would have succeeded on real systems while also saying PHP2Shell "is now being broadly exploited". The headline says the flaws were "exploited" days before the patch; the body describes attempts. PHP Foundation executive director Elizabeth Barron: "to our knowledge, there has been no successful attempt at remote code execution." Moses argues AI is shrinking the time from patch to working exploit.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation: no successful RCE to its knowledge; Amazon: unclear whether attempts would succeed

Supports: data/compromise.json on the site (/compromise/)

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T012042Z · HTTP 200 · https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/- `headers.json` cdea39f9041c102d99987c0678b106458e3ea49746c7b6df268cd29ff1610a17 1,668 bytes
- `page.html` fb4d5d01f6a54a59b38b324364e19dc66eaf270a0528f0468dffebe21b015afc 1,245,418 bytes
- `provenance.json` c88e3863ab2f3db40fa3d4bad4d2f8b6c49dc11bb2e0b264727c9de6f242ecf7 1,723 bytes
- `rendered.html` 3dfcff4c0800daedd95b55f7510974ced8eac740a0e6ab92d8e0eb5cd206ecf9 1,499,604 bytes
- `screenshot.jpg` 4d6198142ef9e78fff96238d160eb6750b0c420c9e963ec76b2b13ae49b48d5d 706,558 bytes
- `text.txt` d43b99af65d563ddd047c20c80d5318813eda28abd497763f91dd0a6ab8427cd 9,384 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/wired-exploited-days-before-patched/index.html