Critical PHP Vulnerabilities Were Under Attack Days Before Security Updates Were Released

The detected exploitation attempts targeting two critical PHP vulnerabilities on October 17, 2026, four days before their public disclosure and security updates.

Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and can enable unauthenticated remote code execution on vulnerable web servers. Both carry CVSS v4.0 scores of 9.2.

The earliest attempt reached Amazon’s MadPot honeypot network from 103.216.220.92, an address associated with commercial anonymization infrastructure.

Amazon assessed that targeting an embargoed vulnerability through anonymized infrastructure suggested threat actor activity.

However, investigators have not established how the attacker obtained exploit information before disclosure.

According to Amazon’s disclosure, proof-of-concept exploits appeared around 02:00 UTC on October 21, approximately 12 hours before the 14:00 UTC embargo lift.

Between 02:00 and 08:00 UTC, MadPot recorded additional attempts from anonymized infrastructure. Differences in payloads and infrastructure suggested multiple actors rather than a single coordinated campaign.

PHP Vulnerabilities

Amazon cautioned that technical analysis is ongoing and that the observed attempts were not confirmed to have succeeded against real-world systems.

After disclosure, additional exploit code appeared within hours and was almost immediately directed at its sensors. The company subsequently described PHP2Shell as broadly exploited in the wild.

CVE-2026-109618 concerns out-of-memory handling. When memory exhaustion interrupts initialization of internal request data, subsequent cleanup can treat partially initialized data as valid, creating a memory-corruption condition that attackers may exploit for remote code execution.

CVE-2026-109619 involves stale global state and use-after-free behavior. State retained from one request can reference freed memory, allowing a subsequent request processed by the same worker to access invalid data.

PHP also identifies memory disclosure as a confirmed impact of this vulnerability.

The exposure extends beyond individual applications because the defects reside in PHP itself. Affected deployment models include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

PHP considers mod_php particularly exposed because demonstrated exploitation can occur before application code executes, making application-level authentication insufficient protection against that attack path.

Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators using distribution packages should consult vendor advisories for corresponding patched builds.

Minimal source backports exist for unsupported PHP 7.4 through 8.1, but these branches receive no official release for the fixes.

Amazon states that upgrading is the only complete remediation for both vulnerabilities; configuration changes cannot fully resolve the combined exposure.

Temporarily blocking multipart file uploads may reduce exposure, but organizations must assess application functionality before deploying that restriction.

Investigations should begin no later than October 17, rather than the advisory date.

Defenders should examine POST requests containing PHP_SESSION_UPLOAD_PROGRESS in uploaded form data, review web server logs, and investigate unexpected process execution or file modifications on application servers.

Amazon’s published indicators include shared anonymization infrastructure, so matching addresses warrant investigation rather than automatic attribution or indiscriminate blocking.

The company also recommends behavior-based detections that remain useful before vulnerability-specific signatures become available.

The incident reinforces Amazon’s warning that critical internet-facing vulnerabilities require mitigation timelines measured in hours.

Its assessment links shrinking exploit-development windows to AI-assisted analysis, although it does not establish that AI produced the observed pre-disclosure attacks.

Indicators of Compromise 

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.