The Knock Before the Patch — a short story
The first knock came four days before anyone knew there was a door.
On October 17, 2026, a lonely server sat on the internet doing nothing — which was its job. It belonged to Amazon's MadPot, a field of decoy machines dressed up to look like exactly the kind of target an attacker dreams about: real enough to touch, instrumented enough to remember everything. That day, something touched it with a weapon nobody had ever seen — an exploit for a flaw in PHP, the language quietly running much of the web, that had not been announced, numbered, or patched. The flaw was still under embargo, known only to the researchers who had found it and the small team preparing the fix. And yet here was someone, out in the wild, already using it.
How they got it, nobody has said. That question is still open.
The bugs themselves — two of them, later nicknamed PHP2Shell — had been hiding in PHP's own code for years, in the machinery that handles file uploads and form data. An artificial intelligence helped find them: a researcher working with an AI model coaxed the code into bending its own memory, through a malformed upload form, until the server would run instructions from a stranger — no password, no login, no warning. Another research team, at Wiz, had found the same rot independently. Two separate hunters, the same buried flaw.
On October 20 the secret broke. Screenshots of a working attack tool leaked, and the race everyone had hoped to run quietly became a sprint in public. The PHP team moved its release up a day. On October 21 the patches landed — new versions for every supported line — and the same day, governments began pulling services offline as a precaution, firewalls lit up across the internet, and the knocking became a storm. One defender network, Wordfence, counted more than seventy-four thousand attempts against the sites it protects.
And here is the strange, hopeful part of the story: for all that knocking, not one confirmed break-in has been publicly documented. Attempts, everywhere. Breaches, none proven. The sensors saw the fists; the houses that had patched in time held. But the week also taught the older lesson — the busiest target on the field was the decoy, and the defenders learned the shape of the weapon precisely because someone fired it at the one machine built to catch it.
So the story ends with two doors, and both of them are on this page. Behind the first: patch — update PHP, restart it, and check your logs back to the day of that first knock; the exact versions and steps are on the Patch tab. Behind the second: switch — publish the way this very page is published, as plain files with no PHP running at all, so that the next time a knock like this goes around the world, there is no door on your house for it to land on. The Switch tab walks that road, and the Help tab will sort out which door fits you.
Every event in this story is drawn from the verified research behind this site: Amazon's MadPot report, the PHP project's advisories (CVE-2026-109618, CVE-2026-109619), Wiz, Wordfence, Huntress and Censys. What is not known — who knocked first, and how they got the weapon — is left unknown, because it is.