- Engineer — Act: Patches are now available and exploitation was actively occurring before release — patch PHP2Shell to the latest version immediately and audit any exposed instances for signs of compromise during the 4-day pre-patch window.
- SOC/IR — Act: Pre-patch exploitation means potential compromises predate any patching activity; initiate a retroactive hunt across web server logs and EDR telemetry covering at least the 4 days before Wednesday’s patch release for PHP2Shell-related activity.
- Leader — Skip