PHP2Shell Attacks Began Four Days Before Security Patch, Amazon Warns

Amazon Threat Intelligence researchers say attackers began targeting the critical PHP2Shell vulnerabilities four days before PHP developers released security updates on October 21.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to achieve remote code execution (RCE) on vulnerable systems. The PHP Security Team urged administrators to install the updates as soon as they became available.

PHP Core Developer Gina Peter Banyard warned that applying the official security patches was the only permanent defense. The UK’s National Cyber Security Centre (NCSC) also advised organizations to update their PHP servers immediately or take them offline until the patches could be applied.

The PHP team said the coordinated disclosure was disrupted after details about the PHP2Shell vulnerabilities—including both CVE identifiers and mitigation advice provided to some critical infrastructure providers—were leaked online.

Several proof-of-concept exploits were also published before the security update, although the PHP Security Team said none of them worked.

Amazon Threat Intelligence compiled reports from multiple cybersecurity companies, including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack. The researchers detected an unsuccessful exploitation attempt before the vulnerability was publicly disclosed.

PHP2Shell exploitation began before public disclosure

According to Amazon, the first exploitation attempt began on Saturday, October 17—four days before the PHP2Shell patch was released. The attackers deployed multiple PHP2Shell proof-of-concept exploits against a honeypot from an IP address associated with a commercial virtual private network (VPN) and anonymization service.

CJ Moses, AWS Chief Information Security Officer, said the activity suggested that a threat actor obtained information about the vulnerability before its public disclosure:

“The exploitation attempt originated from an IP address associated with a commercial anonymization network. Although this vulnerability was under embargo, targeting the honeypot from an anonymization IP address suggests that the activity was carried out by a threat actor, although it remains unclear how the attacker obtained the exploit information prior to publication.”

Moses said the payloads and choices observed in the anonymization infrastructure were diverse, suggesting that multiple attackers may have been involved. However, technical analysis remains ongoing, and it is unclear whether any of the attempts succeeded against real-world systems.

Although the PHP2Shell vulnerability is “currently being widely exploited,” Moses said the number of successful attacks remains unknown. He cautioned defenders not to assume that the public disclosure date was the earliest date on which the vulnerability was exploited.

Researchers have not confirmed successful compromises

The Dataminr Threat Research and Cyber Engineering (TRACE) team has also reported that activity observed since disclosure has so far been limited to scanning, fingerprinting, and non-functional exploits.

Dataminr said it has not identified any known compromises, but warned that it is only a matter of time before a working proof of concept or successful exploit activity emerges.

PHP, which stands for Hypertext Preprocessor, is an open-source web development language used by up to 80% of all websites on the internet. It also powers popular content management systems (CMSs), including WordPress, Drupal, and Joomla.

VirusTotal estimates that more than 5.1 million PHP hosts are exposed online, with approximately 3.8 million exposing at least one port to potential attack.

Updated October 22 at 17:31 EDT: Added details from Dataminr TRACE.

The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report