Amazon Says PHP2Shell Exploitation Began Four Days Before Patches

Summary

Amazon says attackers first targeted the PHP2Shell flaws on October 17, four days before patches were released. Exploitation is now widespread, but how many attempts succeeded remains unclear.

Key points

Amazon Threat Intelligence says the first PHP2Shell exploitation attempts occurred on October 17, four days before patches for CVE-2026-109618 and CVE-2026-109619 were released.
The critical flaws enable remote code execution on vulnerable systems; PHP released patches on October 21.
Amazon says attackers deployed multiple proof-of-concept exploits hours after public disclosure, and exploitation is now broad.
Attempts came from anonymized VPN IP addresses. Amazon said varying payloads and anonymization infrastructure suggest multiple actors, but its technical analysis is ongoing.
Amazon said it is unclear whether the observed attempts would have succeeded against real-world systems or how many attacks have succeeded.
The PHP security team said leaked vulnerability details prompted it to accelerate the coordinated release; it said pre-patch proof-of-concept exploits published online were not functional.
PHP administrators were urged to install the official patches immediately or take affected servers offline until they can be patched.

Article Details

Event Type: Active exploitation of two critical PHP2Shell remote-code-execution vulnerabilities began before patches were released.
Impact: Attackers targeted vulnerable PHP systems and deployed multiple proof-of-concept exploits after disclosure. Amazon reported broad exploitation in the wild, but the number of successful attacks and whether the observed attempts would succeed on real-world systems remain unclear.