Researchers from the Amazon Threat Intelligence team discovered that attackers began scanning and attempting to exploit critical PHP2Shell vulnerabilities as early as Saturday, October 17 — four days before PHP developers released official security updates on Wednesday, October 21.
Researchers from the Amazon Threat Intelligence team discovered that attackers began scanning and attempting to exploit critical PHP2Shell vulnerabilities as early as Saturday, October 17 — four days before PHP developers released official security updates on Wednesday, October 21.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute arbitrary code on vulnerable servers. According to Amazon, after the public disclosure, there has been massive activity using various proof-of-concept (PoC) exploits via commercial VPNs and anonymizers, writes BleepingComputer.
The PHP security team planned a coordinated disclosure, urging administrators to prepare for updates on October 20. However, the schedule had to be urgently changed due to a data leak : CVE identifiers and security advisories that were previously provided only to critical infrastructure providers were leaked online.
Despite the fact that several public PoC codes appeared on the network before the release of the updates, PHP developers note that none of them were fully functional at that time. Unsuccessful attack attempts were also recorded by specialists from Cloudflare, watchTowr, Previdian, Hadrian and Patchstack. In particular, Cloudflare recorded millions of attempts to exploit the critical vulnerability .
According to AWS Chief Information Security Officer CJ Moses, the first attacks were recorded on special decoy servers from anonymous IP addresses. The variety of payloads and infrastructure used indicates that several hacking groups are involved in the attacks.
“The attempts to launch a honeypot attack from an anonymized IP address while information about the vulnerability was under embargo indicate that the attackers somehow obtained data about the exploit before it was officially disclosed,” noted CJ Moses.
He also emphasized that PHP2Shell vulnerabilities are currently being actively and massively exploited in real-world conditions, and urged security professionals not to focus on the date of the public announcement as the beginning of the threat, but to install the released patches as soon as possible.
