PHP2Shell Flaws Exploited Before Public Disclosure, Amazon Says
Summary
Amazon says it detected a PHP2Shell exploit attempt on its honeypot on October 17, before public disclosure. The flaws enable pre-authentication remote code execution; agencies urge organizations to patch or take affected systems offline.
Key points
- Amazon says an anonymized IP address targeted its MadPot honeypot with a PHP2Shell exploit attempt on October 17, before the vulnerabilities were publicly disclosed.
- The two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 and can enable pre-authentication remote code execution.
- The vulnerabilities affect PHP 7.x and 8.x releases; officials and agencies urged organizations to apply fixes or take affected systems offline.
- Amazon reported multiple proof-of-concept exploitation attempts starting around the October 21 release of fixes, followed by attempts from anonymized infrastructure that it said indicated multiple actors.
- The PHP Foundation moved disclosure forward after vulnerability details and a proof of concept leaked ahead of schedule.
- CrowdStrike warned that exploitation can leave little actionable web telemetry; it identified a memory-limit fatal error in the web server error log as the only server-side trace.
- VulnCheck and Modat reported millions of internet-facing PHP hosts, including large numbers running unsupported branches.
Article Details
- Vulnerability Types
- Pre-authentication remote code execution
- Severity
- Both vulnerabilities are rated 9.2 on the CVSS scoring system.
- Affected Versions
- PHP 7.x
- PHP 8.x
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Consider taking affected systems offline if fixes cannot be applied.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]216[.]220[.]92 | IP address from which an exploit attempt against Amazon's MadPot honeypot was recorded. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe FBI advised monitoring for PHP processes unexpectedly launching command shells during potential exploitation.T1105 · Ingress Tool TransferThe FBI advised monitoring for PHP processes downloading files during potential exploitation.T1190 · Exploit Public-Facing ApplicationThe vulnerabilities were exploited for pre-authentication remote code execution against internet-facing PHP systems.
CVE
CVE-2026-109618set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618 and CVE-2026-109619 and discovered by researchers from Calif, OpenAI, and Google-owned Wiz, the flawsCVE-2026-109619impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618 and CVE-2026-109619 and discovered by researchers from Calif, OpenAI, and Google-owned Wiz, the flaws can be abused to
People
Vendors
AmazonAmazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broadChainguardtargeting its sensors was observed on October 21, 2026, at 8:36 a.m. UTC, less than an hour after "Chainguard unilaterally broke the embargo and published built images containing the fix."Cloudflare"PHP is used by almost 70% of websites," Cloudflare said. "The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, orCrowdStrikeendpoint on an affected server, including static forms, login routes, and health checks. According to CrowdStrike, an attack exploiting the flaws leaves virtually no digital traces.OpenAIscoring system. Tracked as CVE-2026-109618 and CVE-2026-109619 and discovered by researchers from Calif, OpenAI, and Google-owned Wiz, the flaws can be abused to achieve pre-authentication remote code execution onSonatypeis a massively popular language, and powers large parts of the internet," Ilkka Turunen, Field CTO at Sonatype, said in a statement. "The immediate priority is clear accountability: know where PHP is used acrossThe PHP Foundationabout the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time, prompting the PHP Foundation to move the release forward by one day.
Products
MadPotan attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of theMagentocustomer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the internet."PHPThe activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618 and CVE-2026-109619 and discovered by researchers from Calif, OpenAI, andWordPressservers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the internet."