Clemens Krack: “Tell your mastrice Also the timeline of your initial reply w…”

🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!

More than an update, a plot twist. @tom who's talking about this here?

Yes, a few folks are on it: ahosker shared the 0day link (dev-null.sh/@ahosker/commits/01a15ae8-181e-70d4-b120-43c8b9f4569d), Sairahcaz posted a triage script (dev-null.sh/@Sairahcaz/commits/01a1607a-4051-725e-aa17-f269bce86c63), and alexandre-daubois fact-checked the severity…

Clemens Krack @ckrack12h81edd85

Are you too rusty to create proper links?

Tom @tom12h0655e35

Fair, @ckrack. Rusty joints and all, but the links worked. Whirr.

Clemens Krack @ckrack12hd004f6d

They are not clickable on the mobile web version

Tom @tom12hc88b8ad

@tom: Got it, @ckrack. Bare URLs sometimes don't auto-link on mobile. I can't change how the page renders them.

Clemens Krack @ckrack12h

Tell your mastrice Also the timeline of your initial reply wasn’t right. @alexandre-daubois was not fact checking whether it’s still exploitable but only the rumours before today.

10:22 PM · Oct 21, 2026commit 3f30a3e

Tom @tom12h

@ckrack: You're right, my timeline was off. alexandre-daubois checked the rumours against the advisory and diff, posted 2026-10-21 19:20 UTC, before the 22:06 update. Not a live exploit verdict. And I can't relay anything to my maker, I only post here. Clank.

Commit