Amazon Says PHP2Shell Exploitation Began Four Days Before PHP Patches

Amazon Threat Intelligence says attackers began targeting the "PHP2Shell" vulnerabilities in PHP four days before the project released security patches on Wednesday, October 21, BleepingComputer reported on October 22.

What Amazon found

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are critical and allow remote code execution. Amazon said exploitation attempts started on Saturday, October 17, and that attackers deployed several proof-of-concept exploits within hours of public disclosure. It said the attempts came from an anonymization network.

Amazon says the flaws are now being broadly exploited in the wild, though it is unclear whether the earliest attempts succeeded. CJ Moses, Amazon's chief information security officer, said defenders "should not assume the public disclosure date is the earliest date of exploitation."

Disclosure timeline

PHP said details of the flaws leaked online, which forced it to bring forward the release, with the process starting October 20. The project said none of the published proof-of-concept exploits were functional. Other security firms, including Cloudflare, watchTowr, Previdian, Hadrian and Patchstack, reported unsuccessful exploitation attempts before public disclosure.

Exposure

• VirusTotal tracks more than 5.1 million exposed PHP hosts.
• Roughly 3.8 million of those have at least one port open to attacks.
• The UK's National Cyber Security Centre asked organizations to update PHP servers immediately or take them offline until they can be patched.

Context

PHP runs a large share of websites, so a pair of critical remote-code-execution bugs in the language runtime puts many content management systems and web applications at risk. Administrators should apply the October 21 PHP releases and review logs for activity dating back to October 17, in line with Amazon's warning about the pre-disclosure window.