PHP2Shell Exploitation Attempts Began Four Days Before Patches, Amazon Says

Amazon Threat Intelligence detected PHP2Shell exploitation attempts on October 17, four days before developers released security patches. However, researchers have not established whether those early attempts could successfully compromise real-world systems.

The two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow remote code execution on vulnerable PHP installations. The PHP security team released fixes on October 21 after advising administrators to prepare for urgent updates.

Amazon Detected Attacks Before Public Disclosure

Amazon recorded the earliest attempts through its MadPot honeypot infrastructure while the vulnerabilities remained under embargo.

According to the company, the activity originated from an IP address associated with a commercial anonymisation network. That combination suggested a threat actor was responsible, although investigators do not know how the actor obtained vulnerability information.

Subsequently, Amazon observed attackers deploying multiple proof-of-concept exploits from VPN addresses within hours of disclosure. Differences in payloads and anonymisation services suggested several actors were involved.

Nevertheless, Amazon said technical analysis was ongoing. It could not confirm whether those attempts would have worked against real-world systems.

Researchers Differ on Evidence of Successful Exploitation

Amazon described the vulnerabilities as facing broad exploitation in the wild. However, its findings leave uncertainty around how many attacks, if any, successfully compromised servers.

Meanwhile, Dataminr’s Threat Research and Cyber Engineering team offered a more cautious assessment on October 22. Its researchers reported scanning, fingerprinting and non-working exploits, with no known compromises.

Several other security companies also detected unsuccessful attempts before public disclosure.

These findings distinguish attempted attacks from confirmed intrusions. Although PHP2Shell exploitation attempts began before patches arrived, the available reports do not establish successful early compromises.

Leaked Details Disrupted the Patch Schedule

The PHP security team said leaked information forced it to accelerate its coordinated release process.

Details surfaced online two days before disclosure, including both CVE identifiers and mitigation guidance shared with some critical infrastructure providers. As a result, the team began adjusting its release timetable on October 20.

Proof-of-concept code also appeared before the patches. However, the PHP team said none of those publicly available examples worked.

The leak complicated the response by exposing information while administrators still awaited official fixes.

Administrators Urged to Apply Official PHP Updates

PHP core developer Gina Peter Banyard warned that official security patches provide the only permanent defence against the vulnerabilities.

Similarly, the UK National Cyber Security Centre urged organisations to update affected PHP servers immediately. Organisations unable to patch should take those servers offline until they can secure them.

Amazon also warned defenders against treating the public disclosure date as the earliest possible attack date. Consequently, investigations should account for suspicious activity before the vulnerabilities became public.

Millions of Exposed Hosts Highlight the Potential Reach

PHP supports a substantial share of the web, including websites that use WordPress, Drupal and Joomla.

VirusTotal tracks more than 5.1 million internet-exposed PHP hosts. Of those, roughly 3.8 million have at least one port open to potential attacks.

However, exposure alone does not prove vulnerability or compromise. These figures illustrate the potential scale of the response, rather than the number of systems attackers have successfully breached.