Amazon detected PHP2Shell targeting before public vulnerability disclosure
Amazon Threat Intelligence detected an attempted exploit of the PHP2Shell vulnerabilities against its MadPot honeypot on October 17, 2026, four days before the flaws were publicly disclosed. The activity originated from 103.216.220[.]92, an IP address geolocated to Australia and associated with a commercial anonymization network.
The issues, CVE-2026-109618 and CVE-2026-109619, are PHP core vulnerabilities rated 9.2 on the CVSS scale. Researchers from Calif, OpenAI and Google-owned Wiz discovered the flaws, which can enable pre-authentication remote code execution on affected systems.
Early activity and a shortened disclosure timetable
Amazon Integrated Security CISO CJ Moses said that targeting a honeypot through anonymized infrastructure while the vulnerability was under embargo suggested threat-actor activity, although it remains unknown how exploit information was obtained before disclosure. The original coordinated-release time was October 22 at 2:00 p.m. UTC.
A leak of the CVE identifiers and a proof-of-concept exploit caused the PHP Foundation to bring the release forward by one day. Amazon then identified multiple PHP2Shell proof-of-concept exploits on the day fixes were released, beginning at about 2:00 a.m. UTC on October 21. Further attempts through anonymized infrastructure followed during the next six hours, and Amazon said the variety of payloads indicated multiple actors.
ELLIO recorded its first PHP2Shell request at 8:36 a.m. UTC on October 21, less than an hour after Chainguard published built images containing the fix. The PHP Foundation said Chainguard had received the patch early to allow customers to update at disclosure, but publishing the images allowed attackers to study the change in binary form while other users were still waiting for the release.
Broad exposure and limited web-layer evidence
The weaknesses affect every PHP release in the 7.x and 8.x series. PHP Foundation said the defects sit in memory management and error handling, areas touched by nearly every request. This means reachable static forms, login routes and health checks can be exposed on an affected server; the risk does not depend on a particular CMS, framework or plug-in.
CrowdStrike warned that exploitation can leave very little digital evidence. It said worker processes may remain stable, responses may return HTTP 200, and application logs may show no anomalies because application code did not run. The only server-side clue may be a memory-limit fatal in the web server error log, an event that can be treated as routine noise.
Cloudflare said PHP is used by almost 70% of websites and noted that PHP2Shell can expose customer data, execute malicious code or disrupt services. VulnCheck identified PHP on 2,608,039 internet-facing hosts, including more than 700,000 running PHP 3.x through 7.3, about 400,000 on versions 7.4, 8.0 or 8.1, and 403,000 on supported 8.2 through 8.5 branches.
Operational response
The U.K. National Cyber Security Centre and the U.S. Cybersecurity and Infrastructure Security Agency urged organizations to apply fixes promptly or consider taking affected systems offline. The FBI advised monitoring for PHP processes that unexpectedly launch command shells or download files, while the NSA said the vulnerabilities could offer a direct path to a server file system or database.
For businesses, the immediate task is to inventory PHP across services and products, establish who owns each remediation, deploy the available fixed packages, and validate process-monitoring coverage. Teams should not rely solely on application logs or normal HTTP responses when assessing potential PHP2Shell exposure.