Amazon: PHP2Shell Exploitation Began Days Before Patches
Security researchers at Amazon report that exploitation attempts targeting two critical PHP vulnerabilities began several days before official patches became available.
Radwan AbdulhadiEditor and technology writer
Early Exploitation of PHP2Shell Vulnerabilities
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.
Tracked as CVE-2026-109618 and CVE-2026-109619, the two critical vulnerabilities let attackers gain remote code execution on vulnerable systems. The PHP security team patched them on October 21 after urging admins one day earlier to prepare to install the updates as soon as they became available.
AWS chief information security officer CJ Moses noted that the first exploitation attempts began on Saturday, October 17, originating from an IP address associated with a commercial anonymization network. While the vulnerabilities were under embargo, the targeting of a honeypot from an anonymized IP address suggested threat actor activity, though the exact method of acquiring exploit information prior to disclosure remains unclear.
Leak and Accelerated Disclosure Timeline
The PHP team stated that everything proceeded according to plan until two days before the coordinated disclosure, when details concerning the PHP2Shell security flaws leaked online. This forced developers to accelerate the targeted release date starting October 20.
Prior to the official patch release, PHP core developer Gina Peter Banyard warned that applying official security patches serves as the only permanent defense. Simultaneously, the UK National Cyber Security Centre asked UK organizations to immediately update PHP servers or take them offline until patches could be applied.
Industry Observations and WAF Activity
The Amazon Threat Intelligence report follows multiple cybersecurity organizations—including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack—detecting unsuccessful exploitation attempts ahead of public disclosure.
Cloudflare CEO Matthew Prince reported that across the Cloudflare network, thousands of attempts to exploit the vulnerability were recorded in the ten hours before public announcement, a figure that surged to tens of thousands within 45 minutes after the announcement and eventually reached millions.
WatchTowr head of threat intelligence Jake Knott stated that broad exploitation attempts and proof-of-concept exploit code were rapidly shared on GitHub and social platforms, though many circulating exploits either failed to function, tested for timing-based differences, or crashed targets.
Widespread Exposure Across Internet-Facing Hosts
Platforms such as Censys, VulnCheck, and VirusTotal reported that millions of internet-facing hosts were running unpatched software releases around the time of disclosure. Out of millions of observed hosts, a substantial portion reported identifiable PHP versions running end-of-life iterations.
Researchers compared the scale of PHP2Shell to past major security incidents, noting that while remediation involves straightforward configuration pushes and web application firewall rules, identifying forgotten shadow systems and unpatched installations remains a primary challenge for defenders.
Sources
- BleepingComputerAmazon says PHP2Shell exploitation began 4 days before patches
- SecurityWeekPHP2Shell Exploitation Started Days Before Patches
Continue chronologically
Related entity coverage
Related stories
PHP2Shell Exploits Highlight Need to Limit Blast Radius
Following rapid exploitation of PHP2Shell, security experts urge organizations to limit identity reach and blast radius rather than relying solely on patching.
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
Critical PHP Vulnerabilities Threaten Websites Worldwide
Security patches roll out for two critical PHP vulnerabilities rated 9.2, impacting millions of sites and prompting warnings from cybersecurity agencies.
Will AI expose the rickety infrastructure of the internet?
An analysis of recent critical PHP vulnerabilities and how the rise of artificial intelligence may expose foundational weaknesses in web infrastructure.
