Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.

"The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News.

"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure."

The attempt, Amazon said, was recorded from "103.216.220[.]92," an IP address geolocated to Australia.

The activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618 and CVE-2026-109619 and discovered by researchers from Calif, OpenAI, and Google-owned Wiz, the flaws can be abused to achieve pre-authentication remote code execution on affected systems.

The shortcomings are present in every PHP release from the 7.x and 8.x series, and pose a risk to every reachable PHP endpoint on an affected server, including static forms, login routes, and health checks. According to CrowdStrike, an attack exploiting the flaws leaves virtually no digital traces.

"There is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover," CrowdStrike said. "The exposure is independent of the CMS, framework, or plug-ins in use."

"Worker processes remain stable, responses return HTTP 200, and application logs record no anomalies, because no application code ever ran. The only server-side trace is a single memory-limit fatal in the web server's error log, which is routinely dismissed as noise, leaving defenders without actionable web telemetry to identify compromised endpoints."

Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC, details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time, prompting the PHP Foundation to move the release forward by one day.

"Both issues sit in parts of PHP that nearly every request touches: memory management and error handling," the PHP Foundation said. "Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions."

Amazon said it detected multiple PoC exploits for PHP2Shell coinciding with the day of the release of the fixes, with the earliest attempt flagged around October 21, 2026, at 2 a.m. UTC.

This was followed by additional exploitation attempts from anonymized infrastructure over the next six hours. The variety of payloads and the anonymization infrastructure used indicate that multiple threat actors are involved, Amazon Threat Intelligence said.

The attempts have been recorded from the following IP addresses on October 21, 2026 -

• 31.223.184[.]166
• 37.19.200[.]5
• 134.209.159[.]64
• 103.114.163[.]188
• 95.217.98[.]37

According to ELLIO, the first PHP2Shell request targeting its sensors was observed on October 21, 2026, at 8:36 a.m. UTC, less than an hour after "Chainguard unilaterally broke the embargo and published built images containing the fix."

"Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed," the PHP Foundation said. "Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."

The severity of the vulnerabilities has prompted warnings from international cybersecurity agencies such as the U.K. National Cyber Security Centre (NCSC) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), urging organizations to apply the fixes as soon as possible or consider taking them offline.

"Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files," the U.S. Federal Bureau of Investigation (FBI) said in an X post. "Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation."

In a similar alert, the U.S. National Security Agency (NSA) said the vulnerabilities can provide threat actors with a direct path to the server's file system or database. OpenAI, which described the flaws as "one of the most impactful security issues in recent memory," has released a Codex skill to check if a website or local PHP binary is vulnerable to PHP2Shell.

With PHP powering a majority of the websites in the world, the vast attack surface, coupled with the severity and ease of exploitation of the PHP2Shell flaws, poses major risks as it allows unauthenticated attackers to execute code and steal sensitive data.

"PHP is used by almost 70% of websites," Cloudflare said. "The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the internet."

VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3. Another set of about 400,000 hosts run PHP versions 7.4, 8.0, or 8.1, while 403,000 hosts run supported 8.2 through 8.5 branches.

"PHP is a massively popular language, and powers large parts of the internet," Ilkka Turunen, Field CTO at Sonatype, said in a statement. "The immediate priority is clear accountability: know where PHP is used across your services and products, who owns remediation, and how quickly fixes can be deployed."

"It is likely there is a long tail of environments needing to apply this patch as PHP is bundled into many other operating system distributions, as well as is found in many historic environments."

Some of the other notable developments are listed below -

• WebOps platform Pantheon said it has blocked over 60,000 suspicious requests probing the vulnerability.
• VulnCheck has identified two hosts, 85.11.167[.]243 and 45.198.224[.]169, with the user-agent "php2shell-scan/109618" weaponizing CVE-2026-109618 to target its honeypots, while 109.71.252[.]97 has leveraged both the flaws.
• Cloudflare has observed attack traffic targeting its customers, with threat actors "mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic."
• CloudLinux has released fixed packages for ea-php52 through ea-php85 and every alt-php version.
• Additional guidance and mitigations have been published by numerous security and software vendors, including Akamai, Amazon Web Services (AWS), Arctic Wolf, Automattic, Cisco Talos, Corelight, CyCognito, Fastly, Google Cloud, Hadrian, Imperva, Kaspersky, Microsoft Azure, NetSPI, Orca Security, OX Security, Palo Alto Networks Unit 42, Pentest Tools, Rapid7, ReliaQuest, SOCRadar, Searchlight Cyber, Sophos, Tanium, Vercel, watchTowr, and Zscaler.

"The time from patch to working exploit is shrinking for structural reasons," Moses said. "In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them.."

"That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.