PHP2Shell day 3: the exploitation curve, the embargo leak, and a second supply-chain shock

Day three of the PHP2Shell disclosure cycle, and the numbers are in. Cloudflare CEO Matthew Prince published network-level exploitation stats that put hard data on what most of us suspected: scanners were already running before the embargo lifted.

The exploitation curve, in four numbers

From Prince's post on October 22, across the Cloudflare network:

Pre-announcement exploitation of an embargoed bug is the part to sit with. The October 21 patch release was preceded by a leak: a security researcher posted an early write-up without knowing the disclosure was under embargo, and the timeline moved up. watchTowr's threat briefing confirms live exploitation attempts in the wild against CVE-2026-109618 and CVE-2026-109619 — both unauthenticated RCE in stock PHP 8.2–8.5, CVSS 9.2.

If you administer PHP and haven't patched since October 21: 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are the fixed releases, and our day-one breakdown covers the interim mitigations (memory-limit hardening, post_max_size caps, proxy-level body limits).

The embargo leak is its own case study

The leak itself (an early write-up that broke the PHP RCE embargo) turned into a community pile-on against the researcher within hours. The lesson for disclosure processes is structural: embargoes that can be broken by one blog post have no redundancy. If your org coordinates disclosures, assume the window will collapse early and stage your comms, patches, and detection rules for a day-one-anyway world. The teams that patched inside the embargo window were the only ones the leak didn't matter to.

Same 48 hours: the eMudhra CA fiasco

The second shock Prince flagged landed on schedule. A researcher showed that eight eMudhra/emSign CA private keys were trivially guessable — one of the root keys reportedly used the literal number 4. Within five days:

1. Chrome and Firefox moved to distrust the affected ECC root
2. Roughly 30,000 certificates fell under the withdrawal
3. eMudhra announced its exit from the global SSL/TLS business entirely

The operational takeaway lands on language runtimes: Go, Rust, Python, and Node all shipped trust-store fixes. If your CI pulls certifi or any bundled CA list, update it the same day — the fix is in package updates already.

The 48-hour checklist

For ops:

• PHP patched to the fixed releases above (or PHP removed if unused — Prince's explicit advice)
• CA trust stores refreshed in every language runtime and container base image
• WAF rules for memory-limit exhaustion patterns, per the day-one mitigations

For red teams:

• The public PoC against Apache mod_php 8.4.26 is the reference: confirm your perimeter actually blocks the trigger primitives (oversized bodies, multipart teardown paths) rather than assuming patch status
• Feed the fix commits to an agent tier for variant hunting — the day-one workflow stands, and unst33r-deepseek handles the diff-triage loop

Study public PoCs only in isolated labs you own, per the acceptable-use policy.