Timeline
PHP2Shell disclosure timeline
Two years from the first hint to the fix — and a final 24 hours in which the embargo leaked in several places. All times UTC.
Last reviewed 2026-10-22
2024
OSTIF-organised Quarkslab audit of PHP. The OOM problem is first noticed while fixing a different report.
Source: PHP Foundation
2026-05
PHP Foundation forms its Ecosystem Security Team.
Source: PHP Foundation
2026-07
Alexandre Daubois joins the Foundation; Calif starts its audit (30 Jul) under Patch the Planet.
Source: PHP Foundation
2026-08-11
Calif and OpenAI independently report the same OOM root cause.
Source: PHP Foundation
2026-08-19
Wiz Research finds its first PHP bug; unauthenticated RCE on Drupal (Aug 20) and WordPress (Aug 21).
Source: Wiz
2026-08-24
Wiz reports additional attack vectors to the PHP security team.
Source: Wiz / PHP Foundation
2026-09-09
Daniel Scherzer joins the Foundation security effort.
Source: PHP Foundation
2026-09-18
OpenAI reports further vectors.
Source: PHP Foundation
2026-09-21
PHP acknowledges the Wiz reports and starts a coordinated fix.
Source: Wiz
2026-10-20 15:00 UTC
CVE IDs start circulating on forums and social media, with an incorrect CVSS 10.0.
Source: PHP Foundation
2026-10-20 19:30 UTC
PHP publishes its pre-announcement early.
Source: PHP Foundation
2026-10-20 ~20:00 UTC
Calif mistakenly publishes a video showing its proof of concept.
Source: PHP Foundation
2026-10-20 23:00 UTC
Mitigation advice goes out to some critical-infrastructure providers, and may have leaked.
Source: PHP Foundation
2026-10-21 03:02 UTC
Cloudflare WAF rules go live for all plans, including Free.
Source: Cloudflare
2026-10-21 07:41 UTC
Chainguard ships fixed images, breaking the embargo by more than six hours.
Source: PHP Foundation
2026-10-21 11:51 UTC
BambooHR takes its service offline as a precaution (US, Canada, Ireland).
Source: BambooHR status page
2026-10-21 (CEST)
Dutch government and education sites, including DigiD and MijnOverheid, go offline as a precaution.
Source: NOS
2026-10-21 14:00 UTC
Coordinated release: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, plus source backports for 7.4, 8.0, 8.1. Originally planned for Oct 22.
Source: php.net / PHP Foundation
2026-10-21 15:03 UTC
BambooHR reports the fix applied and testing under way.
Source: BambooHR status page
Why the release moved up a day
The coordinated release was set for 22 October, 14:00 UTC. From the afternoon of 20 October the CVE IDs circulated publicly (with a wrong 10.0 score), a proof-of-concept video was published by mistake, and mitigation advice sent to critical-infrastructure providers may have leaked. On the morning of 21 October Chainguard shipped fixed images more than six hours early. PHP released at 14:00 UTC that day.
The PHP Foundation notes that its security team had published 15 CVEs since 1 July and processed more than 100 invalid, duplicate or non-reproducible reports in the same period.
Who did what
Calif
Audit under “Patch the Planet” from 30 July; reported the OOM root cause on 11 August, independently of OpenAI.
OpenAI Codex Security
Reported the same root cause on 11 August and further vectors on 18 September.
Wiz Research
Found additional attack paths from 19 August, demonstrated pre-auth RCE on Drupal, WordPress and Joomla, reported 24 August.
PHP security team
Built the fix (soft/hard OOM limits instead of longjmp) and releases for 8.2–8.5, plus source backports for 7.4–8.1.
PHP Foundation
Funds the Ecosystem Security Team formed in May 2026; published the post-mortem of the disclosure.
Release time in your time zone
| Time zone | Patch released | Date |
|---|---|---|
| UTC | 14:00 | Tue 21 Oct 2026 |
| US Pacific (PDT, UTC−7) | 07:00 | 21 Oct |
| US Central (CDT, UTC−5) | 09:00 | 21 Oct |
| US Eastern (EDT, UTC−4) | 10:00 | 21 Oct — “EST” searches mean this |
| UK (BST, UTC+1) | 15:00 | 21 Oct |
| Central Europe (CEST, UTC+2) | 16:00 | 21 Oct — NL, BE, LU, DE, AT, FR… |
| India (IST, UTC+5:30) | 19:30 | 21 Oct |
| China / HK / SG (UTC+8) | 22:00 | 21 Oct |
| Japan (JST, UTC+9) | 23:00 | 21 Oct |
| Sydney (AEDT, UTC+11) | 01:00 | 22 Oct |
Related
- Affected organisationsPHP2Shell outages and statements from BambooHR, DigiD, MijnOverheid and Cloudflare, plus why the eMudhra incident is separate.
- Technical deep diveThe four bugs behind PHP2Shell, the exploit chain, exposure by SAPI (mod_php, PHP-FPM, FrankenPHP) and how the fix changes PHP’s out-of-memory handling.
- CVSS 9.2 vs 10.0Why PHP2Shell was initially rated CVSS 10.0 and officially scored 9.2. Understand the CVSS 4.0 vector and what it means for your risk.