Felix Laurent
A Hacker News user apologized today for leaking two critical PHP flaws early, and a Coin Bureau post seen by ~26k people frames him as the man who blew the coordinated release. We checked the timeline against PHP's own statement, the researchers and the security vendors. His post was one of at least three leaks, and Amazon saw an exploit attempt four days before any of them went public.
What PHP2Shell is
PHP2Shell is two remote code execution flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. PHP rates each 9.2 on CVSS v4.0. They were found independently by Calif, as part of OpenAI's "Patch the Planet" program, and by Wiz. OpenAI says Calif found one of them with GPT-5.6 Sol.
The fix shipped on Oct 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. watchTowr says older unsupported branches, PHP 5 included, are affected too.
The claim
On Oct 20, Hacker News user petecooper posted that two PHP RCE flaws with a CVSS of 10.0 would be disclosed on Oct 22. The post named both CVE IDs and was later deleted. PHP published an advance notice that evening and moved the release to Oct 21, 14:00 UTC. watchTowr says the original plan was Thursday, Oct 22, 11am ET.
Today petecooper returned with "Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry." He says his contact told him there was no embargo, and that her contact had told her the same thing.
What the PHP2Shell embargo timeline shows
The public record shows at least three early leaks, and one attack that came before all of them:
PHP says Chainguard broke the embargo by more than six hours. It had received the patch in advance as a distributor, so anyone could study the fix in binary form before the release.
The exploit video that the Coin Bureau post lists as a consequence of the leak came from Calif, one of the two teams that found the bugs.
What the attack numbers measure
Cloudflare CEO Matthew Prince posted the counts on X on Oct 21: thousands of exploit attempts across Cloudflare's network in the 10 hours before disclosure, tens of thousands in the first 45 minutes after, hundreds of thousands within two hours, then millions.
These are attempts, not break-ins. Recorded Future says the extent of successful exploitation is unclear and confirmed indicators of compromise are limited. watchTowr reports exploitation in the wild.
Cloudflare says its WAF rules were live for free and paid customers from Oct 21, 03:02 UTC, about nine hours before disclosure, and that attackers were mutating payloads to get past them.
The sites that went offline
The outages were precautionary, not hacks. Finland and other European governments took sites down on Oct 21. Banks, airlines and rail operators in Japan suspended online services on Oct 22, and Japan's finance ministry paused some web content while it patched.
What is still missing
Three questions are still open:
- PHP has not said how the CVE IDs reached petecooper's contact, or who else on the distribution list passed them on
- No vendor has published a count of confirmed compromises
- PHP still has to say whether it will change how it shares patches with distributors before release
Until then, the leak story rests on one apology and one vendor's early build.
Sources
- Tell HN: I unknowingly broke the PHP RCE embargo
- Hacker News thread on PHP's security release, with the PHP Foundation's Chainguard statement
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
- CNBC: PHP2Shell, what is it
- The Register: AWS reveals attacks began before disclosure
- Cloudflare blog: protections against PHP2Shell
- PHP security advisory: PHP2Shell (CVE-2026-109618, CVE-2026-109619), republished by Vercel
