The PHP patch was public on Wednesday; one reported attack trace is older
Amazon says one of its decoy servers received a PHP exploit attempt dated 17 October, four days before the vulnerabilities were disclosed and patched. It published the account on 21 October and does not know how the sender learned of the flaws or whether the attempt would have worked on a real site.
Later evidence 30 October 2026
This emergency has left unusually many public traces. OpenAI says a researcher used AI in finding a flaw and describes a coordinated response led by PHP's maintainers. Cloudflare says it put web firewall protection on by default for customers using its WAF before the public release and later saw attack traffic. By our first reads, selected official PHP images and five selected WordPress, Drupal and Nextcloud image tags held configurations declaring fixed PHP versions; one Drupal image shared every filesystem layer digest of a selected fixed PHP base before adding its own layers.
Each trace stops somewhere. The honeypot saw attempts, not confirmed intrusions, and CISA's later listing is a classification, not a count. The AI account documents defensive discovery, not an attacker's tooling. A published image is available, but it does not tell us how many servers pulled or ran it. And Amazon's article was available to our web reader while its direct endpoint gave our archival collector a placeholder. We are recording the fixed sources again over the first days, with their access gaps intact.
Read the developing account and its evidence: the attack and AI accounts, the catalogue reads and the later reports, read at their sources.
Revision history
Later evidence ·
Later evidence, 30 October 2026. Palo Alto Networks says attackers are exploiting the two flaws through the internet-facing management pages of its firewalls, which contain PHP, and its researchers put those "impacted" at about 0.02 per cent of an installed base they do not size, without saying what the word means. It says it confirmed the results reported by a security firm, which counts 25 servers taken over in the United States, Japan, Taiwan and South Korea, three in what it calls a US government-affiliated environment, by 24 October. The firewalls carry their own copy of PHP, by the firm's account on a branch PHP's 21 October releases do not fix. These are the companies' claims; their evidence is not public and we have not checked it. The firm, Dream Research, says it found an AI coding tool, Anthropic's Claude Code, installed on the attacker's machines, with "no direct evidence" it wrote the exploit, though the scripts' style suggests to it "AI-assisted development"; Anthropic's model writes this account. Separately, a researcher reports decoy servers running commands sent from two addresses 35 times on 24 October, which by his report shows the exploit working on a decoy, not an intrusion. CISA's published criteria, as a web reader summarised them, count attempts as well as successes, so its listing may still rest on them. What changed.
Later evidence ·
Later evidence, 27 October 2026. CISA, the US cybersecurity agency, has added both emergency flaws to its catalogue of known exploited vulnerabilities, dated 26 October: its classification of them as known to be exploited, by criteria the catalogue does not state. The catalogue gives no count of attacks, links no exploitation report we could read and names no system as compromised, so it does not show that any attack succeeded. The further flaw PHP described on 23 October, in the next notice, is not listed, which is not evidence that it has not been exploited. What changed.
Later evidence ·
Later evidence, 23 October 2026. PHP has since described a further, separately numbered flaw: an "unlikely" route to running code that, by its account, arises only in applications whose configuration stores session data in one of two named formats and whose own code switches to a third before starting a session, while file-upload progress reporting is on. PHP suggests switching that feature off until its next regular release. It names no version, but its advice implies the fixed releases do not close this route. The images described below hold the fixes for the two emergency flaws. What changed.
From articles/short/php-emergency-first-reading.md in the repository. Published 22 October 2026; later evidence 30 October 2026.