The php2shell Week: What Happened, and Why Your Chats Slept Through It

If you follow security news at all, you probably saw the noise in early October. A pair of serious vulnerabilities, nicknamed php2shell by the researchers who found them, hit a core technology that a very large slice of the web runs on. MiocAI runs on that slice. This post is the honest account of what we did about it, with dates, because you should never have to take "we take your security seriously" on faith.

1) The Short Version

The flaws were disclosed on October 7. That same day we shipped protective changes that made the attack path useless against us, including a temporary extra-strict gate on file uploads while the dust settled. Fourteen days later, on October 21, the entire production runtime was rebuilt on the fully patched release, and we took the strict upload gate back out after verifying everything held. We have seen no evidence that anyone got in.

The rest is detail.

2) What Was Actually Broken

Here is the vulnerability in one paragraph, no jargon required. Under a specific combination of server settings, a feature meant for handling file uploads could be abused into storing a malicious file in a place where the server would execute it as code. From there, an attacker could potentially run commands on the affected server. It was bad. It affected a lot of the internet at once, which is why it made headlines.

Two things worth knowing about how it relates to us. First, the flaw was in a platform component, not in anything we built; the fix had to come upstream, and it did. Second, "potentially" was doing real work in that paragraph. Exploiting it required the right conditions, and conditions are things you can control. We controlled ours.

3) What We Did, In Order

October 7, the same day the disclosure dropped. We changed the server configuration so the specific attack path the vulnerabilities rely on simply does not exist here. We also temporarily made upload handling stricter. That was a tradeoff: the tight settings made an entire class of abuse impossible while the permanent fix was still baking, at the cost of some friction for some uploads during those two weeks. We decided that was a trade worth making without asking anyone's permission first. Some decisions you are allowed to make quickly, and this was one.

October 7 through 21. Probing started almost immediately, as it always does when a flaw this big goes public. Scanners knocked on every upload-adjacent door we have, round the clock. Every probe hit the walls we had put up. We logged them and watched the patterns. A script of ours also spent those two weeks hammering on our own defenses, because we wanted the fence kicked by us before anyone else tried.

October 21. The patched release had been out long enough to be trusted, so we rebuilt our whole production runtime on top of it and rolled it out. Then we did the part we are proudest of: we removed the strict upload gate. A lazier operation would have left the gate up forever and called the breakage "new security". We took it down. Your uploads work the way they did before.

4) Why This Never Got Close to Your Data

Even in the worst case, where an attacker had gotten a foothold, your chats are encrypted at rest. That has been the permanent shape of the system since long before this occasion, and it is exactly why we built it that way. Defense that depends on never having a bad week is not defense.

There is also a plainer point. Platforms get probed every single day, vulnerabilities get named and headlined, and what separates a headline from an incident is whether the boring preparation happened earlier, and ours did.

5) What Continues

The monitoring that watched every probe during those two weeks has not been switched off; it watches still, because the next nameable vulnerability is always a matter of when. If you ever want the security posture in more detail, the honest summary is short: checks that assume any single layer can fail, encryption that assumes an intruder is already inside. And fixes that ship the same day, which is the part you can check.

If you read this far as an investor: the scary week was handled by process, on dates you can check. Nothing about it needed luck.

Sleep well. Your chats did.