How the PHP Flaw Moved from 2024 Audit to October Chaos

A security audit funded by Germany’s sovereign tech agency first turned up signs of a memory problem in PHP back in 2024. The team could not agree on a fix, and the work stalled and restarted for months. PHP later called the delay a structural failure.

Everything changed on August 11, 2026. A firm called Caliph and OpenAI both reported the same root cause on the same day. Wiz came in with more attack paths over the next two months. The PHP Foundation, the researchers, and the big distributors then worked under embargo to prepare a real patch.

On Saturday, October 17, Amazon’s Madpoint Honeypot—a fake server built to catch hackers—logged a PHP-to-shell attempt. It came from an IP on a commercial anonymized network. Nobody had gone public yet, and Amazon says it is still unclear how the actor got the details.

The Days the Embargo Unraveled

On Tuesday, October 20, around 8 a.m. Arizona time, two CVE IDs started circulating online with the wrong release time and a wrong score of 10. No technical details had leaked yet. PHP moved the release up a full day from Thursday to Wednesday at 7 a.m. Arizona/Pacific time, because distributors were still packaging the fix and an immediate drop would have left many people without easy update paths.

Later that same day, around 1 p.m. Pacific time, Caliph—one of the firms that found the bugs—published a video of its exploit working against real targets. The copy spread. PHP said the videos “contributed to accelerated development” of more exploits. Mitigation advice PHP had given a few critical infrastructure providers may have leaked as well.

Overnight from Tuesday into Wednesday, a researcher using a crypto-style name posted that he created both bugs and “lab/field tested” them. The post blew up into the millions.

Chain Guard Breaks the Embargo and the Patch Goes Live

Wednesday, October 21, at 2:41 Arizona time, Chain Guard published a built image containing the fix more than six hours early. PHP said Chain Guard “unilaterally broke the embargo” and that any attacker could now study the fix in binary form while every other PHP user was still waiting for the patch.

Chain Guard CEO Dan Lorex told The Register he did not leak it. His rule is coordinated disclosure “unless there’s evidence of active exploits in the wild.” He said people were already getting hit, so he made the call and made the fixed images free to everybody. He also said he woke up and saw people blaming his company for the whole mess.

At 7 a.m. Pacific time the embargo lifted. PHP shipped versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. It stated there are no complete mitigations; updating is the only safe choice.

Governments Pull Sites Offline as Attack Volume Spikes

Within minutes, governments started taking services offline. The Netherlands took the National Cyber Security Center offline, along with Port Rotterdam, the government portal, and other systems. Japan’s Prime Minister posted on X telling people to check if their public website runs PHP. In the UK, the cyber minister told Parliament that 32 government services were taken offline. The impact reached China and beyond.

The attack curve went vertical. Cloudflare said its firewall rules went live about nine hours before the release, including on the free plan. In the 10 hours before the announcement it saw thousands of attempts, tens of thousands in the first 45 minutes after, hundreds of thousands within two hours, and millions by the end of the day. The Cloudflare CEO’s post passed 1.5 million views that morning.

Amazon later said that after the patch dropped, PHP-to-shell was being broadly exploited in the wild and told everyone to start their investigation from October 17, not from Wednesday.

Millions of Attempts Are Not Millions of Break-Ins

Here is the twist almost nobody is saying out loud: millions of attempts is not millions of break-ins. Watchtower says the exploits being sprayed around mostly do not work or just crash the target. Germany’s cyber agency says it has seen attacks but no successful use, and that it is a little more complicated than expected to exploit. A lot of the news hype claims this is really easy to exploit. It is a real vulnerability, but exploiting it is not trivial, and at the moment it does not look like exploitation has been widespread, according to The Guardian.

As of that morning, census data still showed about 1.5 million internet-facing servers advertising a PHP version older than the fix. Voluntech says at least 1 million run versions PHP itself will not patch. CISA urged everyone to immediately take action: if you have older systems that cannot be patched, take them offline.

The researcher who posted overnight later fired back at critics. He said he did not do anything illegal, he had no contract with any program, and social contracts are meaningless in today’s world. A Middle Eastern threat intelligence account shared the reply; by morning the post had over half a million views.

Cleanup Reality and the Questions Boards Are Asking

A former CISA figure who goes by Blackroom Tech put the boardroom mood in one post that was already circulating in security circles: leadership is asking how they did not know they had all these vulnerable packages. For 30 years, software developers, CISOs, and system admins have been saying systems must be taken down to patch and stay secure. For decades, executives have said no—we need to keep moving forward, we will take the risk, we will pay the insurance claim. This has been the push-pull in the boardroom for decades. Then the story hits the press, the sky appears to be falling, and everyone asks why systems have to come offline.

In practice, some organizations that integrate with third-party PHP systems saw those systems taken down as soon as the news hit, then brought back once the patch was available. That is the correct behavior. Others had clients screaming about the downtime even though the responsible step had been taken. WordPress sites were among the larger footprints that needed rapid patching. When many people tried to update within minutes of the release, PHP servers kept timing out; responsible teams had to wait an hour or two.

Amazon’s threat intelligence noted that an embargo protects defenders only until someone else finds the same bug. Coordinated disclosure remains the right model, but defenders should not assume the public disclosure date is the earliest date of exploits. They need to go back further. The time from patch to working exploit is shrinking for structural reasons. In the past, most observed exploitation came after a public proof of concept; a small number of capable actors built exploits and everyone else waited.

What the Embargo Break and AI Change About Disclosure

The PHP Foundation said Chain Guard disregarded weeks of work by many parties toward a coordinated disclosure. Chain Guard had received the fix for the two critical issues under embargo like every other distributor, then published built images more than six hours early. From that point any attacker could study the fix in binary form.

The first signs dated to the 2024 German-funded audit, and the release turned into chaos: a flaw reference leaked on October 20, a security company published an attack video, and Chain Guard broke the embargo. The security of a language that powers banks, shops, and public services rests on a small group of developers. Those same public services that states had to shut down that morning rely on a handful of people to protect the servers.

On the researcher who published: he clarified that he did nothing illegal and had no contract or agreement with any program or platform, and that social contracts have no value. Legally he is right—there is no law forcing coordination before publishing. Coordinated or responsible disclosure has never been a law; it is a security community custom so affected parties can release an update before the exploit becomes available to everybody. It has been a gentleman’s agreement.

The speaker agrees 100 percent that the embargo period for zero-days should never be broken by trusted parties. At the same time, the security industry needs to reevaluate how much time these embargoes can realistically afford to wait now that cyber models exist. During a recent KVM escape vulnerability, it was possible to independently discover the issue within a few hours simply by giving a semi-redacted tweet from security researchers to a cyber monitor. The embargo was respected and details were not shared, but if that could be done, anyone motivated enough can do it. Embargo periods need to be measured in hours, not weeks or months. Disclosures now travel as fast as rumors. Humans have to sleep. AI can find a vulnerability and report it, but getting a fix deployed, coordinated, and out to distributors still takes human time. That line between what AI can do and what still requires people is becoming clearer.

The Uncomfortable Boardroom Conversation and the Practical Path Forward

This morning, boardrooms across many places are having uncomfortable conversations. Leadership asks how the organization did not know it had all these vulnerable software packages. Technical people who have been constrained for years by the same leadership—on patching, updating, documentation, and asset management—are the ones being asked to explain. How can you protect assets if you do not know how many you have, what they are, and where they are? Budgets have gone to other priorities. Production systems cannot come down in the middle of the day. Overtime is not approved. The result is that updates that require downtime do not happen cleanly.

Companies that brag about how secure they are often are not, in reality. That is not the fault of the technical staff; it is the fault of the people at the top who are supposed to be managing the business, including its security, and who rarely get called out. This is not the moment to lay off the people who will help clean up the vulnerabilities that still need patching in the coming days, weeks, and months. This incident is a precursor. More will come. Stop focusing on projects that do not protect what already exists and start investing in the people and the ability to move quickly. Nimble teams that can patch and respond are the ones that stay strongest. Security has to be first, not an afterthought. Listen to the cybersecurity staff.

The cleanup is not finished when the patch is applied. Organizations that treat the public disclosure date as the start of their investigation, or that patch and assume they are safe without checking for earlier activity, are the ones most likely to get hurt.

Conclusion

Yesterday was the leak and the patch. Today is the cleanup. Most companies get hurt in this phase because they apply the update, feel safe, and never check whether someone got in earlier. Updating remains the only safe choice, as there are no complete mitigations. Millions of attempts do not equal millions of successful break-ins, but the gap between public disclosure and the first real activity is shrinking. Organizations that treat security as an afterthought, refuse downtime for patching, and fail to know their assets will keep facing the same boardroom questions. Nimble teams that can move quickly and put security first are the ones positioned to handle what comes next.