PHP2Shell Exploitation Attempts Began Before Patches, Amazon Says

Summary

Amazon says PHP2Shell exploitation attempts began on October 17, before patches for two PHP RCE flaws were released on October 21. Researchers reported widespread attempts, while some said circulating PoCs failed to achieve RCE.

Key points

Amazon says the first PHP2Shell exploitation attempt it observed targeted a honeypot on October 17, four days before patches were released.
The flaws, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 20; patches followed on October 21.
Amazon, Cloudflare, Hadrian, and Patchstack reported exploitation attempts before or shortly after disclosure. Cloudflare reported a sharp rise in attempts after the announcement.
WatchTowr said circulating PoCs did not achieve RCE, instead failing, checking timing differences, or crashing targets; multiple organizations also reported unsuccessful attempts.
VulnCheck, VirusTotal, and Censys reported large numbers of PHP hosts running unpatched or end-of-life versions, though their estimates and observed populations differed.
CISA urged organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Experts also advised identifying forgotten PHP installations and restricting web-facing processes while patching.

Article Details

Vulnerability Types: Remote code execution
Severity: Critical
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available
Workarounds: Limit what a web-facing process can launch, access, or connect to; restrict PHP processes to only the files and network services required to run the site.