The PHP Foundation's own timeline lists four leaks before the patch. One of them came from the firm credited with finding the flaws

On Wednesday we wrote that the head start on PHP2Shell ended a day early because the CVE identifiers leaked. That was accurate and it was about a quarter of the story.

The PHP Foundation published a post-mortem the same day with a timestamped timeline. It lists four separate disclosures of information during the embargo, and names a vendor. Amazon has since said its honeypot logged a probe three days before the first of them.

The timeline, in the Foundation's own times

Four disclosures inside the embargo, all within 17 hours: the identifiers at 15:00 UTC on 20 October, a proof-of-concept video at 20:00, mitigation advice at 23:00, and built images carrying the fix at 07:41 the next morning. The coordinated release was at 14:00 on 21 October.

20 October, around 15:00 UTC. The two CVE identifiers began circulating on forums and social media, carrying a wrong release time and a CVSS of 10.0. The real score is 9.2. The Foundation's assessment of this first leak is narrow and worth keeping: "No technical details leaked."

20 October, 19:30 UTC. PHP brought its pre-announcement forward and moved the release from 22 October to 21 October at 14:00. Distributors were still packaging the fix, so a one-day move was judged the best available compromise.

20 October, around 20:00 UTC. Calif "mistakenly published a video" showing its proof of concept running against several targets. The Foundation says the video revealed limited additional detail, but that copies spread and it accelerated proof-of-concept development the next day.

20 October, 23:00 UTC. Mitigation advice given to some critical infrastructure providers may also have leaked.

21 October, 07:41 UTC. Chainguard, in the Foundation's words, "unilaterally broke the embargo" and published built images containing the fix, more than six hours before the coordinated release.

The finder published the video

Calif is the firm OpenAI credited with identifying one of the two flaws using GPT-5.6 Sol. At around 20:00 UTC on 20 October it "mistakenly published a video" showing its proof of concept running against several targets, and the Foundation says copies spread and accelerated proof-of-concept development the following day.

It is the same firm whose researchers took a 1988-vintage OpenBSD counter to local root earlier this month. A demonstration video posted by mistake is an ordinary human error, and the Foundation treats it as one.

But it belongs in any honest account of the week, because the argument being made around PHP2Shell is that AI-assisted discovery bought defenders time. Some of that time was spent by one of the finders.

Six hours of binary diff

The Chainguard paragraph is the sharpest thing in the post-mortem: "Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release." And then: "This disregarded weeks of work by many parties toward a coordinated disclosure."

Chainguard's chief executive has not disputed the timeline. He says the company moved early because he believed exploits were already in the wild, that Chainguard found the bug independently with its own tooling and an AI model, and he apologised for the pressure the episode put on maintainers. A Foundation board member has disputed that the exploit reports were real.

Both positions can be held honestly and only one of them can be right, and nobody outside the embargo can settle it.

Somebody was probing on 17 October

Amazon's threat intelligence team says its MadPot honeypot recorded an attempt against these flaws on 17 October, four days before disclosure, from an address on a commercial anonymisation network. A spokesperson described it as largely a one-off probe.

Amazon's chief information security officer, CJ Moses, said "the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor", and that "it remains unclear how the actor acquired exploit information prior to disclosure".

That date sits before every entry in the Foundation's timeline.

The admission underneath all of it

The post-mortem also says the fix for the out-of-memory flaw stalled for months inside the project, and calls that "a structural failure".

The security team is moving to majority decisions. An Ecosystem Security Team was created in May. Two engineers joined in July and September, and the project now has an AI Security Engineer in Residence. After a scan with one AI system, the team added another for validating reports and exploits, alongside sanitizer builds and reproduction environments matching CI on every supported platform.

A window that lasts weeks is worth less than a review process that does not stall for months, and the Foundation is the party saying so.

What to do

• Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 if you have not. Nothing in this changes that.
• If you run Apache with mod_php, treat this as the more urgent configuration. The Foundation says full remote code execution was demonstrated there with default settings, before any application code runs.
• Check your logs back to 17 October, not to the 21st. That is now the earliest known probe.
• If you are a packager or a vendor, the operational lesson is the 07:41 one. Shipping early publishes the diff.

What is not established

• How the actor behind the 17 October probe obtained information. Amazon says it does not know.
• Whether that probe is connected to any of the four leaks, or predates them entirely.
• Whether exploits really were in the wild when Chainguard decided to ship. The two sides disagree and no evidence has been published either way.
• How far back the flaws reach. The Foundation lists the patched branches and does not give an affected range.
• Whether anyone has been compromised through either flaw.
• What the reported exploitation volumes actually represent, since attempt counts and successful exploitation are different measurements.