PHP2Shell Exploitation Started Days Before Patches

Threat actors started probing for servers affected by two critical remote code execution (RCE) vulnerabilities in PHP four days before the fixes, Amazon reports.

Patches for the two flaws, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, were released on October 21, after the PHP Foundation and industry partners scrambled for weeks to build, verify, and validate them.

On October 20, both issues were leaked online, which accelerated the circulation of proof-of-concept (PoC) exploits. Multiple organizations observed the activity, but said the exploitation attempts were unsuccessful.

According to Amazon, the first PHP2Shell exploitation occurred on October 17, while the security defects were still under embargo, and originated from a commercial anonymization network.

“The targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Amazon says.

Roughly 12 hours before the public disclosure, Amazon identified multiple PoCs for PHP2Shell from additional anonymized infrastructure. The variations in payloads and origin suggest that multiple threat actors were getting involved.

“Once the embargo was lifted and the patch was released, additional proof-of-concept exploits appeared within hours, and we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild,” Amazon notes.

WatchTowr too observed mass exploitation shortly after the patches were released, albeit none of the circulating PoCs achieve RCE.

“In an entirely predictable chain of events, WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub. The exploits being sprayed indiscriminately either don’t work at all, test for timing-based differences, or crash the target,” WatchTowr head of threat intelligence Jake Knott said in an emailed statement.

Hadrian, Patchstack and Cloudflare all reported seeing exploitation attempts hours before the fixes were released.

“In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said early on Thursday. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

Additionally, JFrog has observed fake PoC exploits and prank malware being published on GitHub. 

VulnCheck told SecurityWeek that at least one Chinese IP address unsuccessfully attempted to exploit PHP2Shell to deploy a webshell.

According to VulnCheck, VirusTotal, and Censys, more than 1 million PHP servers were running unpatched software releases as of October 21.

Out of 2.58 million internet-facing hosts seen on October 21, roughly 1.58 million were reporting identifiable PHP versions, and approximately 1.57 million were not patched, Censys says. As of October 22, the platform tracks nearly 3 million internet-facing hosts running PHP.

VulnCheck was seeing more than 2.6 million internet-facing hosts running PHP, nearly all of which were vulnerable. At least 1 million run end-of-life (EoL) PHP versions: more than 700,000 are PHP 3.x – 7.3 and nearly 400,000 are PHP 7.4, 8.0, or 8.1.

VirusTotal says it sees roughly 5.1 million IP addresses running PHP, but only 1.1 million of them announce a version in an HTTP header. Of these, only approximately 272,000 run a supported PHP version, while the majority (around 758,000) run an EoL iteration (PHP 5.4 to 8.1).

Most of these PHP hosts (~920,000) are in the US. The good news is they run on a handful of providers, including AWS, DigitalOcean, Alibaba, OVHcloud, and Hetzner, so remediation would involve simple configuration pushes and WAF rules.

Cybersecurity community response

On Wednesday, the US cybersecurity agency CISA urged organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, which include fixes for both PHP2Shell flaws.

“Organizations will struggle to patch quickly, but the harder problem is finding everything that needs patching. Events like this expose forgotten applications, shadow systems and PHP installations that network owners may not even know exist,” BlueVoyant CISO John Harbaugh said.

Because in some configurations the vulnerabilities can be exploited to execute code before the security checks run, all stakeholders should apply the emergency updates immediately and start investigating for signs of compromise, says ThreatLocker co-founder and CTO Michael Jenkins.

“Until every system is patched, controls that limit what a web-facing process can launch, access, or connect to can reduce an attacker’s options. Those controls are a backstop, not a substitute for patching, and should remain in place afterward. A PHP process generally needs access only to the files and network services required to run the site. Restricting everything else can help prevent a compromised web server from becoming a gateway into the broader business,” Jenkins added.

According to Forescout threat hunting senior manager Sai Molige and Expel principal threat researcher (and former hacker) Marcus Hutchins, PHP2Shell is comparable to Log4Shell.

“PHP2Shell has the potential to become a Log4Shell-scale event, but for a different reason. With Log4j, the main problem was finding a library you didn’t know you had. With PHP, much of the forgotten infrastructure will be found, but won’t have an upstream fix. The durable lesson from Log4j is that organizations should treat ‘How quickly can we identify where we run X?’ as a measurable capability separate from patching speed,” Molige said.

“I’d say PHP2Shell is like 50% the way towards Log4J. Massive wide-ranging impact. Worse direct exploitation. Shorter tail & indirect exploitation due to not being as deeply embedded in 3rd party software as Log4J was,” Hutchins said.

Related: Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Related: Memory Bugs Account for Most of Chrome’s 353 New Security Fixes

Related: ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets

Related: Context Is King in the Fight Against Modern Cyberattacks