One vulnerability, minute by minute.

Discover, verify, disclose, remediate. Here is PHP2Shell, the PHP flaw fixed on 21 October 2026, taken through all four on the day it was fixed.

From fix to closed in 3 hours 22 minutes

PHP2Shell is CVE-2026-109618 and CVE-2026-109619: unauthenticated remote code execution in PHP, rated CVSS 4.0 9.2. It was fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Halden (shop.halden.example) is illustrative; PHP2Shell, its versions and its dates are real. Sources: PHP’s advisory and CISA’s Known Exploited Vulnerabilities catalogue.

13:30:00 UTC · Discover: PHP ships the fix.

Two flaws, one name: PHP2Shell. Both let anyone on the internet run code on a PHP server without logging in. Every supported branch gets a new release at once.

13:44:12 UTC · Discover: The advisory becomes a question.

Which servers announce a PHP version older than the fix? And which only look old because their distribution backported the patch? The agents get both questions, and a list of things they must never send.

13:51:30 UTC · Discover: We already know where PHP is.

The field was read last week. Rather than scan the internet again, the agents return to every host that announced PHP, Halden’s among them.

14:11:07 UTC · Verify: One request, one header.

An ordinary page request to shop.halden.example. The answer names its own version: PHP 8.3.34, two releases behind the fix, built from upstream with no backported patch.

GET / HTTP/1.1
Host: shop.halden.example

HTTP/1.1 200 OK
Server: Apache/2.4.58 (Unix)
X-Powered-By: PHP/8.3.34

14:13:40 UTC · Verify: A second agent, a second network.

Sydney repeats the request from another continent and gets the same answer. Nobody sends the exploit. The version is the proof; whether this exact build can be exploited is for Halden to judge, not for us to try.

14:31:02 UTC · Verify: A researcher signs it off.

A person reads the evidence and agrees the severity: critical, as PHP rates it. The front end is Apache, and PHP calls mod_php the highest-risk setup.

14:38:00 UTC · Disclose: Disclosed, privately.

To the address in Halden’s security.txt: what we saw, the two requests that saw it, the fix, a stopgap for the hours before the fix, and a reference they can check on this site.

16:52:19 UTC · Remediate: Fixed, then checked.

Halden upgrades and replies. The same agent repeats the same request. PHP 8.3.36. Closed in writing, three hours and twenty-two minutes after the fix shipped.

HTTP/1.1 200 OK
Server: Apache/2.4.58 (Unix)
X-Powered-By: PHP/8.3.36

26 Oct 2026 · Afterwards: Five days later, it’s in the wild.

CISA adds both flaws to its catalogue of vulnerabilities known to be exploited. By then Halden had been closed for four days.

What our agents will never do

  • Read-only requests. Agents only ask for what your servers already give anyone. Nothing is written, uploaded or changed.
  • No logins, no exploits. We never guess or reuse passwords, and we never run an exploit to prove a version is vulnerable. PHP2Shell was confirmed from a header, not a payload.
  • The smallest proof. One request that settles the question is enough. We stop there, and keep only what proves it.
  • A person signs it off. No disclosure leaves without a researcher reading the evidence and agreeing with the severity.

Read, don’t test: what famous vulnerabilities give away

Most well-known flaws can be confirmed from what a server already says about itself. Some can’t, and we don’t pretend otherwise.

Citrix Bleed (CVE-2023-4966)

NetScaler ADC and Gateway, October 2023.

  • What the server says: Login page assets → build 13.1-48.47
  • Verdict: Reported

The login page’s static files carry a fingerprint unique to each build, and published tables map it to the exact version. 13.1-48.47 predates the fix in 13.1-49.15. Nothing is sent but a page view.

regreSSHion (CVE-2024-6387)

OpenSSH server, July 2024.

  • What the server says: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13
  • Verdict: Reported, after a second check

Every SSH server announces itself before anyone logs in. 9.6p1 is in the affected range, but Ubuntu patched it as 3ubuntu13.3, so the package suffix decides. A banner is a claim; we read all of it.

Log4Shell (CVE-2021-44228)

Apache Log4j 2, December 2021.

  • What the server says: Nothing a request can see
  • Verdict: Not tested

Log4j sits deep inside Java applications and announces nothing. The only way to confirm it from outside is to make the server run a lookup you control, and that is an exploit. So we don’t. When we see a product known to bundle it, we say so, and say we didn’t test.

How a disclosure lands

Plain text, one finding, evidence attached, and a reference you can check on this site. Every disclosure includes the fix and a re-test you can request by replying.