Someone tried to exploit two critical PHP flaws four days before the patches were released. Amazon Threat Intelligence said on Wednesday that it detected an exploitation attempt dating back to Oct. 17, 2026, while the PHP2Shell vulnerabilities were still under embargo.
The attempt targeted MadPot, Amazon’s internal honeypot system, which the company uses to watch for cyberattacks. Amazon said the PHP2Shell vulnerabilities are now coming under broad exploitation in the wild following the release of the patches on Oct. 21. The early probe shows that at least one attacker had working knowledge of the PHP2Shell vulnerabilities before the public knew they existed.
PHP2Shell vulnerabilities hit PHP core
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, sit in the core of the PHP programming language. The PHP project rates each at 9.2 on version 4.0 of the Common Vulnerability Scoring System. Both allow unauthenticated remote code execution, which means an attacker can run commands on a server without logging in first.
The PHP2Shell vulnerabilities affect every PHP release in the 7.x and 8.x series. That puts at risk every reachable PHP endpoint on an affected server, including static forms, login routes and health checks. CrowdStrike said an attack exploiting the flaws leaves virtually no digital traces. “There is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover,” the company said, adding that the exposure does not depend on the CMS, framework or plug-ins in use.
The scale of exposure is large. PHP is used by about 69.7% of websites whose server-side programming language is known, according to W3Techs data. That includes content management systems like WordPress, Drupal, Joomla and Magento. Palo Alto Networks counts 22.6 million exposed instances as potentially vulnerable, based on its own telemetry.
How the PHP2Shell vulnerabilities were found before the patch
Amazon traced the Oct. 17 attempt to the IP address 103.216.220.92, geolocated to Australia and associated with a commercial anonymization network. “The exploit attempt originated from an IP address associated with a commercial anonymization network,” said CJ Moses, CISO of Amazon Integrated Security, in a post shared with The Hacker News. “While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.”
An Amazon spokesperson told The Hacker News that the activity was largely a one-off probe. Amazon also noted that varying payloads and anonymization infrastructure suggest multiple actors may be involved, though its technical analysis is still going. The company said it is unclear whether the observed attempts would have succeeded against real-world systems.
Amazon was not alone in seeing early activity. Cloudflare, watchTowr, Previdian, Hadrian and Patchstack all detected unsuccessful exploitation attempts before public disclosure. The PHP security team said the coordinated release went according to plan until two days before disclosure, when it had to speed up the release starting Oct. 20. Some details, including the two CVE IDs and mitigation advice given to critical infrastructure providers, had leaked on the Hacker News forum. The PHP team said proof-of-concept exploits published before the patches were not functional.
The PHP2Shell vulnerabilities were discovered in August by security researchers at Calif and Google-owned Wiz, with collaboration from OpenAI’s Patch the Planet project. Public disclosure was scheduled for Oct. 21, when the PHP Foundation planned to release the security patches.
What admins should do about PHP2Shell vulnerabilities
The fixes shipped on Oct. 21, 2026, in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP security team published minimal source backports for PHP 7.4 through 8.1, which will not get official releases. Before disclosure, PHP core developer Gina Peter Banyard warned that applying the official security patches is the only permanent defense.
The UK National Cyber Security Centre asked UK organizations to immediately update PHP servers or take them offline until they can be patched. Singapore’s Cyber Security Agency issued an alert the same day as the fix, telling organizations to patch immediately. After the disclosure, several organizations, including French public administrations, the Dutch National Cyber Security Centre and the University of Vienna, had taken websites offline to prepare.
With the PHP2Shell vulnerabilities now exploited at scale, unpatched servers are the main risk. Amazon said attackers deployed multiple proof-of-concept exploits within hours of public disclosure. For anyone running PHP, the patches are the priority.