Attackers Targeted Critical PHP Flaws Days Before Public Disclosure, Amazon Reports

Amazon's Threat Intelligence team says it recorded an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on 17 October 2026, against its MadPot honeypot service. The attempt came from an IP address linked to a commercial anonymisation network and geolocated to Australia. Amazon's CJ Moses said it is unclear how the actor obtained exploit information while the flaws were still under embargo. Details and a proof-of-concept exploit later leaked ahead of the planned 22 October disclosure, and the PHP Foundation brought its release forward by one day.

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP core and are both rated 9.2 on the CVSS scale. They can allow remote code execution without authentication. They are present in every PHP release from the 7.x and 8.x series, and put every reachable PHP endpoint on an affected server at risk, including static forms, login routes and health checks. The flaws were found by researchers from Calif, OpenAI and Wiz.

CrowdStrike warns that exploitation leaves virtually no trace. The exposure does not depend on the CMS, framework or plug-ins in use, and logs record no anomalies. The only server-side sign is a single memory-limit fatal error in the web server's error log, which is often dismissed as noise. That leaves defenders with little web telemetry to identify compromised endpoints. The flaws are now under broad exploitation following the release of patches.