Post

Eric Geller
@ericjgeller.com

OpenAI, whose model helped researchers discover the vulnerabilities: "Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory." openai.com/index/coordi...

openai.comPatch the Planet: global response coordination as agents uncover critical vulnerabilitiesPatch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.
Eric Geller
@ericjgeller.com

White House statement: "This discovery demonstrates exactly why American leadership in [AI] is so critical. ... The Administration is tracking and coordinating with federal agencies and leading [AI] labs to expedite the release of the fix and protect American networks and critical infrastructure."

Eric Geller
@ericjgeller.com

I've asked major agencies how they're dealing with the PHP vulnerabilities. No one has given me an answer. HHS referred me to NSA, which is strange, since CISA is supposed to be in charge of managing incidents like this.

Eric Geller
@ericjgeller.com

Amazon says its telemetry shows attempts to exploit the PHP vulnerabilities on Oct. 17, four days before they were disclosed. aws.amazon.com/blogs/securi...

aws.amazon.comAmazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web ServicesAmazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The expl...
Eric Geller
@ericjgeller.com

So far, the only major federal agency that has responded to my PHP inquiry is NASA. A spokesperson says "NASA assessing and patching website software as needed, in accordance with vendors’ release instructions." They directed me to CISA for more info (unlike HHS, which directed me to NSA).

Eric Geller
@ericjgeller.com

🔥🔥 In a blog post about the process that led up to the disclosure of the PHP2Shell vulnerabilities, the PHP Foundation slams Chainguard for "unilaterally [breaking] the embargo." "This disregarded weeks of work by many parties toward a coordinated disclosure." thephp.foundation/blog/2026/10...

4 reposts16 likes

Paco Hope
@paco.infosec.exchange.ap.brid.gy

@ericjgeller.com AWS saw exploitation in their honeypots 4 days before the announcement. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

aws.amazon.comAmazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web ServicesAmazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address […]
Eric Geller
@ericjgeller.com

Second agency—EPA—gets back to me about PHP2Shell. Spokesperson: "EPA has completed its assessment of the recently disclosed PHP vulnerabilities across its websites and servers. EPA is continuing to monitor its environment and will address any identified risks in accordance with CISA directives."