# One vulnerability, minute by minute.

Discover, verify, disclose, remediate. Here is PHP2Shell, the PHP flaw fixed on 21 October 2026, taken through all four on the day it was fixed.

## From fix to closed in 3 hours 22 minutes

PHP2Shell is CVE-2026-109618 and CVE-2026-109619: unauthenticated remote code execution in PHP, rated CVSS 4.0 9.2. It was fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Halden (shop.halden.example) is illustrative; PHP2Shell, its versions and its dates are real. Sources: [PHP’s advisory](https://www.php.net/archive/2026.php#2026-10-21-5) and [CISA’s Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).

### 13:30:00 UTC · Discover: PHP ships the fix.

Two flaws, one name: PHP2Shell. Both let anyone on the internet run code on a PHP server without logging in. Every supported branch gets a new release at once.

### 13:44:12 UTC · Discover: The advisory becomes a question.

Which servers announce a PHP version older than the fix? And which only look old because their distribution backported the patch? The agents get both questions, and a list of things they must never send.

### 13:51:30 UTC · Discover: We already know where PHP is.

The field was read last week. Rather than scan the internet again, the agents return to every host that announced PHP, Halden’s among them.

### 14:11:07 UTC · Verify: One request, one header.

An ordinary page request to shop.halden.example. The answer names its own version: PHP 8.3.34, two releases behind the fix, built from upstream with no backported patch.

```
GET / HTTP/1.1
Host: shop.halden.example

HTTP/1.1 200 OK
Server: Apache/2.4.58 (Unix)
X-Powered-By: PHP/8.3.34
```

### 14:13:40 UTC · Verify: A second agent, a second network.

Sydney repeats the request from another continent and gets the same answer. Nobody sends the exploit. The version is the proof; whether this exact build can be exploited is for Halden to judge, not for us to try.

### 14:31:02 UTC · Verify: A researcher signs it off.

A person reads the evidence and agrees the severity: critical, as PHP rates it. The front end is Apache, and PHP calls mod_php the highest-risk setup.

### 14:38:00 UTC · Disclose: Disclosed, privately.

To the address in Halden’s security.txt: what we saw, the two requests that saw it, the fix, a stopgap for the hours before the fix, and a reference they can check on this site.

### 16:52:19 UTC · Remediate: Fixed, then checked.

Halden upgrades and replies. The same agent repeats the same request. PHP 8.3.36. Closed in writing, three hours and twenty-two minutes after the fix shipped.

```
HTTP/1.1 200 OK
Server: Apache/2.4.58 (Unix)
X-Powered-By: PHP/8.3.36
```

### 26 Oct 2026 · Afterwards: Five days later, it’s in the wild.

CISA adds both flaws to its catalogue of vulnerabilities known to be exploited. By then Halden had been closed for four days.

## What our agents will never do

- **Read-only requests.** Agents only ask for what your servers already give anyone. Nothing is written, uploaded or changed.
- **No logins, no exploits.** We never guess or reuse passwords, and we never run an exploit to prove a version is vulnerable. PHP2Shell was confirmed from a header, not a payload.
- **The smallest proof.** One request that settles the question is enough. We stop there, and keep only what proves it.
- **A person signs it off.** No disclosure leaves without a researcher reading the evidence and agreeing with the severity.

## Read, don’t test: what famous vulnerabilities give away

Most well-known flaws can be confirmed from what a server already says about itself. Some can’t, and we don’t pretend otherwise.

### Citrix Bleed (CVE-2023-4966)

NetScaler ADC and Gateway, October 2023.

- What the server says: `Login page assets → build 13.1-48.47`
- Verdict: Reported

The login page’s static files carry a fingerprint unique to each build, and published tables map it to the exact version. 13.1-48.47 predates the fix in 13.1-49.15. Nothing is sent but a page view.

### regreSSHion (CVE-2024-6387)

OpenSSH server, July 2024.

- What the server says: `SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13`
- Verdict: Reported, after a second check

Every SSH server announces itself before anyone logs in. 9.6p1 is in the affected range, but Ubuntu patched it as 3ubuntu13.3, so the package suffix decides. A banner is a claim; we read all of it.

### Log4Shell (CVE-2021-44228)

Apache Log4j 2, December 2021.

- What the server says: Nothing a request can see
- Verdict: Not tested

Log4j sits deep inside Java applications and announces nothing. The only way to confirm it from outside is to make the server run a lookup you control, and that is an exploit. So we don’t. When we see a product known to bundle it, we say so, and say we didn’t test.

## How a disclosure lands

Plain text, one finding, evidence attached, and a reference you can [check on this site](https://grey0.com/verify). Every disclosure includes the fix and a re-test you can request by replying.