PHP2Shell attempts began four days before October 21 patches
First merged summary.
Amazon says PHP2Shell attempts started October 17; patched PHP 8.2–8.5 releases are out, with no confirmed public-sector compromises.
Amazon Threat Intelligence says a PHP2Shell attempt hit its MadPot honeypot on October 17, four days before disclosure of CVE-2026-109618 and CVE-2026-109619, both rated 9.2. The flaws can allow unauthenticated remote code execution on PHP back to 5.4. PHP patched only 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21; earlier branches have no official fixes, and no configuration-only workaround fully addresses both bugs. Cloudflare and Amazon report attempts rising into the millions and broad exploitation after disclosure. Wordfence reports no confirmed compromises, and the UK government says it knows of none in the public sector, while 32 UK services were taken offline as a precaution. Infosecurity cites W3Techs at about 69.7% of sites; Ars reports Wiz’s roughly 70% estimate; BleepingComputer says up to 80%.
- Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
- PHP 8.1 and earlier, including PHP 7 and 5, get no official patches.
- Amazon’s earliest October 21 proof of concept was about 0200 UTC.
- Wordfence logged more than 74,000 attempts and reports no confirmed compromises.
- The NCSC sent 50,000 warnings and urged patching or disconnection.
- Updating WordPress or other apps does not update a vulnerable PHP runtime.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Amazon MadPot records a PHP2Shell exploitation attempt. · Infosecurity Magazine
- Oct 20, 2026A Hacker News post leaked vulnerability details early. · Infosecurity Magazine
- Oct 21, 2026PHP released fixes at 1400 UTC after a one-day warning. · BleepingComputer
- Oct 22, 2026Baroness Lloyd says 32 UK government services are unavailable. · The Register
What each outlet adds
beyond the shared facts- Infosecurity MagazineNames fixed releases and says PHP 8.1 and earlier are unpatched.
- The RegisterUK outages, Chainguard embargo dispute, and VulnCheck’s private exploit.
- WordfenceMore than 74,000 attempts and no known compromises.
- BleepingComputerPHP called early public proofs nonfunctional; VirusTotal host counts.
- Ars TechnicaCalif, Wiz, and OpenAI roles; NSA and White House responses.
Coverage
oldest first · one row per article · UTC- · 8d ago
Infosecurity MagazineFirst report
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
- · 8d ago
Hacker News · security
Hacker News user apologizes for breaking PHP RCE embargo
The poster named CVE-2026-109618 and CVE-2026-109619 before coordinated disclosure, saying contacts denied any embargo.
- · 8d ago
Help Net Security
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |