PHP2Shell: Attackers Tried to Exploit Critical PHP Flaws Days Before They Were Made Public

Amazon's threat intelligence team has confirmed it observed an attempt to exploit two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell) on October 17. That was four days before the planned public disclosure. The flaws could let an unauthenticated attacker run code remotely and take over a server. They affect any PHP version released in the last decade, back to 5.4. The attempt hit MadPot, an AWS honeypot system used to study cybercrime, and came from an IP address linked to a commercial anonymization network. Amazon says this points to a threat actor, though it is unclear how they learned of the flaws early.

PHP is used by about 69.7% of websites whose server-side language is known, including platforms such as WordPress, Drupal, Joomla and Magento. The bugs were found in August by researchers at Calif and Google Cloud's Wiz, working with OpenAI's Patch the Planet project. Patches were due on October 21, but a pseudonymous Hacker News user leaked details on October 20. French public administrations, the Dutch National Cyber Security Centre and the University of Vienna took websites offline to prepare for patching.

Amazon also reported multiple proof-of-concept exploits on October 21, about 12 hours before the scheduled 2pm GMT disclosure. The earliest appeared around 2am GMT, with more attempts against its sensors between 2am and 8am GMT from additional infrastructure. The flaws are now being exploited in the wild at scale.