Act
active
PHP2Shell zero-day exploited 4 days before patches shipped
- Engineer — Act: Patches are now available and exploitation was actively occurring before release — patch PHP2Shell to the latest version immediately and audit any exposed instances for signs of compromise during the 4-day pre-patch window.
- SOC/IR — Act: Pre-patch exploitation means potential compromises predate any patching activity; initiate a retroactive hunt across web server logs and EDR telemetry covering at least the 4 days before Wednesday’s patch release for PHP2Shell-related activity.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.