PHP2Shell zero-day exploited 4 days before patches shipped

Thu, 22 Oct 2026 15:52:23 +0000

Engineer — Act: Patches are now available and exploitation was actively occurring before release — patch PHP2Shell to the latest version immediately and audit any exposed instances for signs of compromise during the 4-day pre-patch window.
SOC/IR — Act: Pre-patch exploitation means potential compromises predate any patching activity; initiate a retroactive hunt across web server logs and EDR telemetry covering at least the 4 days before Wednesday’s patch release for PHP2Shell-related activity.
Leader — Skip

Web-App-Security on CuraSec