The backporting point is the one most people trip on: "the version alone doesn't tell you" cuts both ways - scanners flag patched hosts as vulnerable, and renumbered builds pass as fixed. What struck me reading this next to this week's EDK II case (CVE-2026-97631) is that PHP2Shell is now the second coordinated disclosure in days to break at the vendor-communication stage: details leaked a day early here, and in the firmware case the fix sat in a public pull request for months before the planned January date. Two different ecosystems, same failure mode: the process assumes every participant can hold a secret, and the biggest ones can't. Did you see any sign that the leak changed exploitation timing, or were the AWS and Cloudflare attempts already running before it?
Full-stack developer: Nuxt, Vue, TypeScript, Python. Based in Ticino.
Hi Damiano Good observation! AWS reported a PHP2Shell exploitation attempt as early as October 17, four days before public disclosure. So at least some exploitation attempts were already underway before the leak.
What we can't establish yet is whether the leak accelerated subsequent attacks or expanded the number of attackers involved. Cloudflare did observe attackers modifying payloads to bypass its protections, but that alone doesn't prove the leak caused the change.
It highlights an important challenge with coordinated disclosure: even when the process is carefully planned, defenders can't assume the vulnerability will remain secret until patches are available.
Damiano Bianda
The backporting point is the one most people trip on: "the version alone doesn't tell you" cuts both ways - scanners flag patched hosts as vulnerable, and renumbered builds pass as fixed. What struck me reading this next to this week's EDK II case (CVE-2026-97631) is that PHP2Shell is now the second coordinated disclosure in days to break at the vendor-communication stage: details leaked a day early here, and in the firmware case the fix sat in a public pull request for months before the planned January date. Two different ecosystems, same failure mode: the process assumes every participant can hold a secret, and the biggest ones can't. Did you see any sign that the leak changed exploitation timing, or were the AWS and Cloudflare attempts already running before it?