Researchers at Amazon Threat Intelligence have documented that threat actors began exploiting PHP2Shell flaws before official fixes became available, marking a significant acceleration in the attack timeline. The two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, enable remote code execution on affected systems. The PHP security team released patches on October 21, one day after publicly urging administrators to prepare for immediate deployment.
Both flaws allow attackers to execute arbitrary code on vulnerable installations. PHP core developer Gina Peter Banyard emphasized that applying the official security patches represents the only reliable mitigation strategy. The UK National Cyber Security Centre (NCSC) instructed organizations within the country to either upgrade their PHP servers immediately or take them offline pending patching.
The PHP team accelerated its disclosure schedule two days before the planned coordinated release after sensitive information surfaced online. Details about the PHP2Shell vulnerabilities, including the CVE identifiers and mitigation guidance shared with critical infrastructure operators, leaked prematurely. This forced the team to move the targeted release date forward to October 20. Although proof-of-concept code appeared before patches shipped, the PHP security team stated that none of the released versions were operational.
Multiple security firms, including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack, had already identified unsuccessful exploitation attempts prior to public disclosure.
Attacks traced to anonymized infrastructure
According to Amazon's findings, the initial exploitation activity commenced on Saturday, October 17—four days before the PHP2Shell patches went live. Attackers deployed multiple proof-of-concept exploits within hours of disclosure, originating from VPN addresses.
The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.
CJ Moses, AWS chief information security officer
Moses noted that the varying payloads and anonymization methods indicate involvement by multiple attackers. Technical investigation continues into whether any of these attempts would have succeeded against production systems.
The PHP2Shell vulnerabilities are now being broadly exploited in the wild
CJ Moses
Moses cautioned defenders against assuming that public disclosure marks the beginning of real-world attacks, underscoring the importance of treating the actual exploitation timeline as potentially earlier.
Exposure across millions of PHP installations
PHP (Hypertext Preprocessor) is an open-source programming language for web development that underpins approximately 80% of all websites globally. Major content management systems including WordPress, Drupal, and Joomla rely on PHP.
VirusTotal currently identifies more than 5.1 million PHP hosts accessible on the internet, with roughly 3.8 million having at least one port exposed to potential attacks.