Replay · real items, sample repos, no LLM involved

PHP2Shell, October 2026: what Briff would have sent

Two critical PHP remote code execution flaws leaked before their coordinated release. php.net gave a day's notice, then shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Three sample repos: a floating php:8.3-fpm image, a pinned php:8.1.31-apache image on an end-of-life line, and an api pinned to php 8.4.26 in .tool-versions. Below are the 3 emails Briff would have sent, each rendered by the production template.

›Sample repos (3)
  • garden.example
    Dockerfile: FROM php:8.3-fpm
composer.json: {"require":{"php":"^8.3"}}
    Scanned: php 8.3+ (composer.json require.php), php 8.3 (Dockerfile)
  • legacy-shop
    Dockerfile: FROM php:8.1.31-apache
    Scanned: php 8.1.31 (Dockerfile)
  • api
    .tool-versions: php 8.4.26
    Scanned: php 8.4.26 (.tool-versions)

Sat 17 Oct 2026

  1. WHAT HAPPENED

    Amazon's MadPot honeypots log a PHP2Shell exploitation attempt

    Four days before disclosure, while the flaws were still under embargo.

    AWS Security Blog

Tue 20 Oct 2026

  1. WHAT HAPPENED

    A Hacker News post leaks two critical PHP RCEs ahead of the embargo

    It quotes the CVE numbers and a 22 October disclosure date; the post is deleted.

    BleepingComputeriTnews

  2. WHAT HAPPENED

    watchTowr confirms the vulnerabilities are real

    watchTowr on X

  3. WHAT HAPPENED

    php.net posts advance notice of a critical security release

    Scheduled for Wednesday 21 October, 14:00 UTC. Two critical vulnerabilities, both CVSS v4.0 9.2; no versions or details yet.

    php.net

  4. WHAT BRIFF SENT

    Urgent email · +28 min after “Upcoming Critical PHP Security Release” appeared

    FromBriff
    SubjectBriff · urgent: Upcoming Critical PHP Security Release

Wed 21 Oct 2026

  1. WHAT HAPPENED

    Cloudflare turns on WAF rules for the known exploit paths

    For every plan, Free included; described as a stopgap, not a fix.

    PPC Land

  2. WHAT HAPPENED

    GitHub advisories GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w are published

    Both critical, CVSS 9.2, patched in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

    GHSA-w8hw-w9fx-j79wGHSA-6wmf-4rv5-p3rp

  3. WHAT HAPPENED

    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released

    CVE-2026-109618 and CVE-2026-109619, CVSS 9.2. Every web SAPI is at risk (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed); mod_php is the worst. PHP 8.1 and older get no release.

    php.net advisoryENISA joint statement

  4. WHAT BRIFF SENT

    Urgent email · +26 min after “PHP security advisory: RCE via stale global state (CVE-2026-109619)” appeared

    FromBriff
    SubjectBriff · urgent: Security advisory: Critical remote code execution vulnerabilities, update now

  5. WHAT HAPPENED

    UK NCSC: take the system offline if you cannot patch

    NCSC

Mon 26 Oct 2026

  1. WHAT BRIFF SENT

    Weekly bulletin · scheduled run, Monday 04:00 UTC

    FromBriff
    SubjectBriff · Weekly · W44: PHP

The items are the ones the sources published, with their dates, read by the same parsers and extractors Briff runs in production. The worker's hourly collect is replayed with a fake clock: an item is collected by the first run after it appeared, matched to the sample repos by runtime, and the urgent pass and the weekly assembly run unchanged. Urgent emails never use a model. In the weekly bulletin the model writes the headline and one line; here the item title stands in, and the action is the deterministic one in both cases.

Run it yourself:

npm run replay -- php2shell --out docs/replay/php2shell.html