PHP2Shell vulnerabilities exploited in wild days before patches, Amazon warns

Attackers targeted critical flaws four days before official fix, researchers say

By LineZotpaper

Published22 October 2026

Updated22 October 2026

Read Time2 min

Sources2 outlets

Amazon Threat Intelligence has reported that attackers began exploiting two critical PHP2Shell vulnerabilities four days before security patches were released on October 21, with multiple threat actors attempting to gain remote code execution on vulnerable systems.

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619, on Saturday, October 17, four days before the PHP security team released patches on October 21. The two critical vulnerabilities allow remote code execution (RCE) on vulnerable systems.

The PHP security team had urged administrators one day earlier to prepare to install the updates as soon as they became available. PHP core developer Gina Peter Banyard warned before disclosure that applying official patches is the only permanent defense. The UK National Cyber Security Centre (NCSC) asked UK organizations to immediately update PHP servers or take them offline until patched.

According to the PHP team, the coordinated disclosure process went according to plan until two days before publication, when some details including CVE IDs and mitigation advice provided to certain critical infrastructure providers leaked online. While some proof-of-concepts were published before patches, the team said none were functional.

Multiple cybersecurity companies including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack detected unsuccessful exploitation attempts before public disclosure. AWS chief information security officer CJ Moses said the exploit attempt he observed originated from an IP address associated with a commercial anonymization network. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Moses said.

He noted that payloads and anonymization infrastructure varied, suggesting multiple actors were involved. Moses also warned that the vulnerabilities are "now being broadly exploited in the wild" and that "defenders should not assume the public disclosure date is the earliest date of exploitation."

PHP powers up to 80% of all websites, including those using WordPress, Drupal, and Joomla. VirusTotal tracks more than 5.1 million PHP hosts exposed online, with roughly 3.8 million having at least one port open to attacks.

Analysis

Why This Matters

PHP powers the majority of websites globally, making these vulnerabilities a broad threat to internet infrastructure.
Attackers exploited the flaws before patches were available, meaning unpatched systems remain at risk.
Organizations that delayed patching after the October 20 warning may already be compromised.

Background

PHP is an open-source scripting language used by an estimated 80% of all websites. The two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution, giving attackers full control of affected servers. The PHP security team followed a coordinated disclosure process with critical infrastructure providers before the October 21 patch release. However, details leaked two days before the planned disclosure, forcing an accelerated release timeline.

Key Perspectives

Amazon Threat Intelligence and AWS: They detected the earliest exploitation attempts and emphasize that attackers had advance knowledge of the vulnerabilities before public disclosure. CJ Moses highlighted that multiple actors were involved and the threat is ongoing. PHP Security Team: They acted quickly to release patches once details leaked, and maintain that the official patches are the only effective defense. They note that leaked proof-of-concepts were not functional. Cybersecurity Community: Companies like Cloudflare and watchTowr detected attempts before disclosure, demonstrating that even with limited functional exploits, attackers were probing for weaknesses. The NCSC urged immediate action, reflecting the high stakes.

What to Watch

How quickly organizations apply the patches: given the widespread exploitation, any delay raises risk.
Whether additional details emerge about the threat actor who obtained exploit information before disclosure.
Potential follow-up vulnerabilities or variations of PHP2Shell as attackers probe related code.

Sources

Amazon says PHP2Shell exploitation began 4 days before patches · BleepingComputer
Hacking attempts surge as websites race to patch PHP issues · Latest Science news

Checked

11 claims in this story checked against 1 source: 8 supported.

Show each claim

Partly supportedThe vulnerabilities were exploited in the wild before patches were released.BleepingComputer: “According to Amazon, the first exploitation attempts began on Saturday, October 17 (four days before the PHP2Shell patches were released)”
SupportedResearchers say attackers targeted the flaws four days before the official fix.BleepingComputer: “According to Amazon, the first exploitation attempts began on Saturday, October 17 (four days before the PHP2Shell patches were released)”
Partly supportedThe opening says multiple threat actors were attempting to gain remote code execution on vulnerable systems.BleepingComputer: “The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems.”
SupportedThe first attempts were on October 17, and the two flaws are CVE-2026-109618 and CVE-2026-109619; patches were released October 21.BleepingComputer: “Tracked as CVE-2026-109618 and CVE-2026-109619, the two critical vulnerabilities let attackers gain remote code execution (RCE) on vulnerable systems. The PHP security team patched them on October 21”
SupportedCJ Moses said the honeypot targeting from an anonymized IP suggested a threat actor, but it was unclear how the actor got exploit information before disclosure.BleepingComputer: “While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,”
SupportedMoses said the vulnerabilities are “now being broadly exploited in the wild.”BleepingComputer: “Moses also said that the PHP2Shell vulnerabilities are “now being broadly exploited in the wild””
SupportedMoses warned that “defenders should not assume the public disclosure date is the earliest date of exploitation.”BleepingComputer: “warned that “defenders should not assume the public disclosure date is the earliest date of exploitation.””
Partly supportedThe PHP team said details leaked two days before publication.BleepingComputer: “everything went according to plan until two days before the coordinated disclosure, when it had to speed up the targeted release date starting October 20 after some details on the PHP2Shell security flaws (including the two CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online.”
SupportedThe PHP security team said proof-of-concepts published before patches were not functional.BleepingComputer: “While some proof of concepts were also published before patches were released, the PHP security team said none were functional.”
SupportedCloudflare, watchTowr, Previdian, Hadrian and Patchstack detected unsuccessful exploitation attempts before public disclosure.BleepingComputer: “multiple cybersecurity companies (including Cloudflare , watchTowr , Previdian , Hadrian , and Patchstack ) detected unsuccessful exploitation attempts before public disclosure.”
SupportedVirusTotal tracks more than 5.1 million exposed PHP hosts, with roughly 3.8 million having at least one port open to attacks.BleepingComputer: “VirusTotal now tracks more than 5.1 million PHP hosts exposed online, with roughly 3.8 million with at least one port open to attacks.”