x.com/S1r1u5_/status/2113105144917155864
2 corrections found
php2shell: disclosure
This was not just a disclosure. Multiple vendors reported real exploitation activity around the time of disclosure, including attacks seen before or during public release.
Full reasoning
The post classifies php2shell as only a "disclosure," but vendor evidence shows it was already being actively exploited.
- Cloudflare's official write-up says it had deployed protections before public disclosure and that, after the embargo leaked, it "observed attack traffic targeting our customers."
- Amazon Threat Intelligence separately reported that its MadPot honeypots saw a php2shell exploitation attempt on October 17, 2026, which was four days before public disclosure on October 21.
So while the bugs were responsibly reported in August, labeling the October 21 event as merely a disclosure omits the key fact that exploitation had already been observed.
2 sources
- Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog
Cloudflare has developed and deployed web application firewall protections about 9 hours ahead of public disclosure ... we observed attack traffic targeting our customers.
- Amazon Threat Intelligence identifies php2shell exploitation prior to public disclosure in MadPot
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026 ... four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.
emudhra: disclosure
This was not merely a disclosure. Mozilla and eMudhra both described the incident as a compromise of eight intermediate certificate keys.
Full reasoning
The eMudhra incident was more serious than a simple vulnerability disclosure.
- Mozilla's security team said it received a report that private keys associated with eight eMudhra intermediate certificates had been compromised.
- eMudhra's own incident statement likewise says Mozilla reported that the private keys for eight intermediate certificates had been compromised, and eMudhra describes it as a security incident involving those intermediate CAs.
That means the incident was a certificate/key compromise, not just a disclosure of a bug or issue.
2 sources
- Protecting Firefox users following the compromise of eMudhra intermediate certificates - Mozilla Security Blog
On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised.
- eMudhra Statement on Recent Certificate Security Incident | eMudhra
According to Mozilla: On 17 October 2026 at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised.