Amazon says PHP2Shell exploitation began 4 days before patches

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.

Tracked as CVE-2026-109618 and CVE-2026-109619, the two critical vulnerabilities let attackers gain remote code execution (RCE) on vulnerable systems. The PHP security team patched them on October 21 after urging admins one day earlier to prepare to install the updates as soon as they became available.

PHP core developer Gina Peter Banyard warned before disclosure that applying the official security patches is the only permanent defense, while the UK National Cyber Security Centre (NCSC) asked UK organizations to immediately update PHP servers or take them offline until they can be patched.

The PHP team says that everything went according to plan until two days before the coordinated disclosure, when it had to speed up the targeted release date starting October 20 after some details on the PHP2Shell security flaws (including the two CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online.

While some proof of concepts were also published before patches were released, the PHP security team said none were functional.

Amazon Threat Intelligence's report comes after multiple cybersecurity companies (including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack) detected unsuccessful exploitation attempts before public disclosure.

"Broadly exploited in the wild"

According to Amazon, the first exploitation attempts began on Saturday, October 17 (four days before the PHP2Shell patches were released), and attackers deployed multiple proof-of-concept PHP2Shell exploits hours after disclosure from VPN IP addresses.

"The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," said AWS chief information security officer CJ Moses.

"The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems."

Moses also said that the PHP2Shell vulnerabilities are "now being broadly exploited in the wild" and warned that "defenders should not assume the public disclosure date is the earliest date of exploitation."

PHP (Hypertext Preprocessor) is an open-source web development language that powers up to 80% of all websites on the Internet, including those using popular Content Management Systems (CMS) like WordPress, Drupal, and Joomla.

VirusTotal now tracks more than 5.1 million PHP hosts exposed online, with roughly 3.8 million with at least one port open to attacks.