Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
Blog: PHP2Shell: a Timeline
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261025T114552Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Daniel Scherzer's blog (English), 22 October: 'PHP2Shell: a Timeline'. The author is a PHP release manager (for 8.5) who says he was privy to internal...
What it says, as the collector read it
Blog: PHP2Shell: a Timeline
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page int/community/scherzer-dev/wikipedia-ref-15-blog-20261022-php2shell-timeline, snapshot 20261025T114552Z. Copied byte for byte; every file's sha256 is in captures/20261025T114552Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Daniel Scherzer's blog (English), 22 October: 'PHP2Shell: a Timeline'. The author is a PHP release manager (for 8.5) who says he was privy to internal discussions and lists only events and times verifiable from public information, mostly git history, GitHub logs and PHP Foundation posts, without judgement. Discovery: a 2024 security-audit tag in php-src (Quarkslab audit); a PHP developer in 2024 found the first signs of the out-of-memory problem; the PHP Foundation formed an Ecosystem Security Team on 18 May 2026; Calif began auditing PHP on 30 July under Patch the Planet, started finding code paths on 1 August, and on 11 August reported an unconditional remote code execution with the same cause as the 2024 finding, followed by reports from other organisations. Release: tags and tarballs for 8.2.35, 8.3.36, 8.4.27 and 8.5.12 were made on Monday 19 October (07:30 to 17:19 UTC) but not published; the release was due Thursday 22 October 14:00 UTC; about 15:00 UTC on Tuesday 20 October online discussion of the CVE IDs, with some wrong details, led to it being moved to Wednesday 21 October, same time; a pre-announcement was posted at 19:25 and 19:33 UTC; about 20:00 Calif published a proof-of-concept video, later deleted but copied (a copy was online at 20:27). On 21 October Chainguard published patched PHP before release (07:41 UTC per the PHP Foundation; Hacker News reports say builds were available from 06:07); the fixes were published between 13:31 and 13:35 UTC, with source-only backports for 7.4, 8.0 and 8.1. Fixes had been shared under embargo with several vendors beforehand.
> The coordinated releases were originally scheduled for 14:00 UTC on Thursday, October 22
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Blog: PHP2Shell: a Timeline". Selected mechanically, not read by a person.
Capture notes
Language en. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| The fixes were scheduled for 14:00 UTC on 21 October and were published between 13:31 and 13:35 UTC CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. Revised by the correspondent on 26 October 2026: the release manager's own timeline (22 October) gives 13:31 (tarballs), 13:33 (announcements), 13:34 (GitHub advisories) and 13:35 (php-src), matching the tags' stamps; 14:00 UTC was the scheduled time, which BleepingComputer and others repeat. Status from disputed to confirmed, the claim reworded to say both. fact timeline → | PHP 8.5's release manager, Daniel Scherzer, from the repositories' history; the GitHub tags and advisories (13:34 to 13:35 UTC); php.net pre-announcement (scheduled 14:00 UTC); CERT-EU (13:30 UTC) | confirmed | A5 Confirmed●●●●●○ measures differently | 7/9 | oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net scherzer.dev |
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261025T114552Z · HTTP 200 · https://scherzer.dev/Blog/20261022-php2shell-timeline
headers.jsondf672020539aff4161e5fa395ad7356be37b6291ca4c15998360123c4afbe5ab 306 bytespage.html5faf1793608886a1a169ea16b95d497aac7de2306a41c12606f41020070b4fee 24,467 bytesprovenance.jsonb123be8972cc2ab5076749eb5602d1783bb0a7db8a1e72762977a84b0d96df91 1,649 bytesrendered.htmlf204f70da72668f2c7ba06e5151e5fa31bb3e171c7e34a9ffa5b50536558abf7 24,408 bytesscreenshot.jpgdc89167758e71b8ebe3b395bdaa27b1adf95330bfaa5f22ac4f48a9e8cc334ed 494,679 bytestext.txtddee9f1e0bb292593c2674f5c54c40a85174c075d2ec55017124b0b23519a5f3 8,835 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →