Amazon traces PHP2Shell attacks to pre-patch window

Amazon Threat Intelligence reported that attempts to exploit two critical PHP flaws began on October 17, four days before fixes were released on October 21. The PHP team moved up its disclosure after details leaked, and some proof-of-concept code appeared before patches but was reportedly not functional. The attempts came from anonymized IP addresses with varied payloads, suggesting multiple actors, though it remains unclear whether any would have succeeded.

Amazon Threat Intelligence dates the earliest PHP2Shell exploitation attempts to October 17, four days before fixes appeared on October 21. The two critical flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution. PHP's security team reportedly moved up its release after details, including CVE identifiers and defensive guidance for critical infrastructure operators, leaked.

Pre-patch proof-of-concept code was circulating but described as nonfunctional. Amazon saw attempts from a commercially operated anonymizing network, with varied payloads and masking choices, suggesting multiple actors; success is unconfirmed. Dataminr reported only scanning, fingerprinting, and nonworking exploits, without confirmed compromises. PHP supports many websites, and VirusTotal counts millions of exposed PHP hosts.