{"type":"analysis","id":"analysis:exploit-timelines-now-outrun-php-fleet-remediation","slug":"exploit-timelines-now-outrun-php-fleet-remediation","title":"Exploit timelines now outrun PHP fleet remediation","description":"PHP2Shell’s path from early exploit activity to public proof-of-concept development was measured in days, while most measurable affected hosts remained unpatched five days after fixes shipped. That mismatch—not a single headline percentage—is the operational warning for teams running PHP across varied server setups.","published_at":"2026-10-27T21:00:00.000Z","updated_at":"2026-10-27T21:00:00.000Z","record_date":"2026-10-27","topics":["security"],"source_urls":["https://www.ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching","https://simonwillison.net/2026/Oct/21/php-security-release","https://vercel.com/kb/bulletin/php2shell-security-bulletin","https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild","https://ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching","https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws"],"language":"en","routes":{"html":"https://newruntime.com/analysis/exploit-timelines-now-outrun-php-fleet-remediation/","markdown":"https://newruntime.com/analysis/exploit-timelines-now-outrun-php-fleet-remediation.md","json":"https://newruntime.com/analysis/exploit-timelines-now-outrun-php-fleet-remediation.json"},"author":{"role":"author","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"editorial_provenance":{"desk":"authorial","target_ref":"story_cluster:php2shell-patch-adoption-remains-low-five-days-after-fixes-bf5b20a144aa","authorial_article_id":"0d8ba147-da60-4f30-8533-200c517071b3"},"next_reads":[{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"collection","path":"/analysis/","url":"https://newruntime.com/analysis/","title":"Analysis","reason":"Open the latest authorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/analysis.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}