Last checked: · Source review; separate from content updates.
Short answer: PHP published the fixed releases on . Earlier attempts are attributed reports; vendor package availability has separate records. PHP archive · Amazon report.
Dated events and their sources
Wiz dates its report to the PHP security team to this day. This records Wiz's report, not a claim that it was the first report from any researcher. Wiz disclosure timeline.
Amazon dates an attempt observed in its honeypot telemetry to this day; its report was published on 2026-10-21. The observation does not establish compromise of a particular production server. Amazon report.
PHP published advance notice of a critical security release. PHP release archive.
PHP published the security releases. The Canadian Cyber Centre and Singapore CSA also dated alerts to this day. PHP · Canada · Singapore CSA.
Singapore CSA updated its alert, reporting exploitation attempts. This is an alert update date, not the date every reported attempt occurred. CSA alert.
Find current fixes
Use branch and vendor package status and the platform guides for the exact package and checked-at timestamp. A check time is not a vendor publication date. Content changes appear in the guide changelog.
Common questions
When were the fixed PHP releases published?
PHP published the security releases on 2026-10-21. Vendor package availability is tracked separately in the platform guides.
Were attempts reported before public disclosure?
Amazon reports an attempt dated 2026-10-17 in its telemetry. The report does not establish that a specific customer server was compromised.
Sources: Amazon Threat Intelligence: pre-disclosure observations
Why do advisories describe exploitation differently?
They reflect different observations and publication times. Keep each statement attached to its source and date; this guide uses the wording “exploitation attempts reported”.
Sources: Canadian Cyber Centre: AL26-026 · Singapore CSA: AL-2026-151 · Amazon Threat Intelligence: pre-disclosure observations
Does this timeline confirm my vendor has shipped a fix?
No. Use your platform guide and its checked-at record for the exact package, release and architecture. An upstream release date does not establish vendor package availability.
Sources: Canadian Cyber Centre: AL26-026