Sophos and Palo Alto retract PHP2Shell exploitation claims as attacks begin

Five days after critical PHP bugs were disclosed, Sophos and Palo Alto Networks retracted claims of PHP2Shell exploitation. VulnCheck confirmed RCE on PHP 8.2 and 8.3, and Perplexity honeypots logged attacks with memory disclosure against PHP 8.4.26.

• Sophos reported exploitation on October 22 and retracted the assessment the next day
• Unit 42 could not tie post-compromise activity to the specific PHP2Shell CVEs
• VulnCheck achieved code execution on PHP 8.2 and 8.3
• Honeypots saw RCE on PHP 8.4.26 with an 800 KiB cookie dump