Hackers Targeted PHP2Shell Vulnerabilities Days Before Patches Were Released, AWS Reports

Cybersecurity teams are facing fresh concerns after Amazon threat intelligence researchers detected attempts to exploit critical PHP vulnerabilities several days before the security fixes were publicly released. The activity highlights how attackers may begin probing software weaknesses before developers and system administrators have had an opportunity to apply patches.

According to AWS, an exploitation attempt targeting the vulnerabilities was recorded on October 17, 2026—four days before PHP publicly disclosed the fixes on October 21. The activity was observed through MadPot, Amazon's global honeypot network.

The vulnerabilities, collectively nicknamed PHP2Shell, affect the PHP runtime itself and could allow attackers to execute code remotely on vulnerable servers. However, AWS has not established that the pre-disclosure attempt successfully compromised a real-world system.

What Is PHP2Shell?

PHP2Shell refers to two critical security vulnerabilities identified as:

- CVE-2026-109618

- CVE-2026-109619

Both vulnerabilities received a CVSS 4.0 severity score of 9.2 from the PHP security team. They involve memory-handling problems within the PHP runtime that could potentially be abused to execute code remotely or expose sensitive information stored in process memory.

Unlike vulnerabilities limited to a particular website or plugin, these flaws affect PHP itself. That makes them particularly important for organizations operating web applications and services built on the language.

PHP is widely used across the web, including in content management systems and other server-side applications. As a result, vulnerable PHP installations can create a significant security risk for businesses, hosting providers and website operators.

AWS Detected an Exploitation Attempt Before Public Disclosure

Amazon Threat Intelligence reported that its MadPot sensors recorded an attempted PHP2Shell exploit on October 17, four days before the vulnerabilities were publicly disclosed and patched.

The source IP address was associated with a commercial anonymization network. Such networks can be used for legitimate privacy purposes as well as to obscure the origin of suspicious activity, so the connection alone does not identify the person or group responsible.

AWS also detected multiple attempts involving different payloads and anonymized infrastructure around the public release of the vulnerabilities. The variation suggests that multiple actors may have been testing or exploiting the flaws.

Importantly, honeypot observations are evidence of attempted activity against monitored systems—not proof that the attackers successfully compromised production websites.

Why Attacks Before a Patch Matter

Security updates typically follow a coordinated disclosure process. Researchers report vulnerabilities to software maintainers, who prepare fixes and coordinate their release so organizations can update their systems.

However, attackers may discover the same weaknesses independently, obtain information before disclosure or begin experimenting as soon as technical details become available.

The PHP2Shell incident illustrates why organizations cannot assume that a vulnerability is safe simply because its official patch has not yet been published.

Once an exploit becomes publicly known, security teams may have only a short window to update vulnerable systems before attack attempts increase. In this case, AWS observed activity before the public release, reinforcing the importance of monitoring systems throughout the disclosure process.

AI Could Accelerate Exploit Development

Another concern is the growing use of artificial intelligence in cybersecurity research and vulnerability analysis.

AI-assisted tools can help researchers analyze complex code, identify potential weaknesses and explore ways to reproduce software bugs. These capabilities can support defensive research, but they may also help malicious actors develop working exploits more quickly.

The PHP2Shell episode underscores a broader challenge for defenders: the time between discovering a vulnerability, developing an exploit and seeing attacks in security telemetry may continue to shrink.

AI does not automatically turn every vulnerability into a working exploit. Nevertheless, organizations should prepare for faster-moving threats by improving patch management, monitoring and incident response.

Which PHP Versions Are Affected?

PHP's security updates address the vulnerabilities in the following supported release branches:

- PHP 8.5.12

- PHP 8.4.27

- PHP 8.3.36

- PHP 8.2.35

Administrators should upgrade to the appropriate fixed release or a newer supported version. PHP 8.1 and older branches are also reported to be affected, but these versions are end-of-life and do not receive regular official security updates.

Organizations using older releases should plan to move to a supported version or consult their vendor for an appropriate security fix.

What Should Website Owners Do?

Website owners and system administrators should take the following steps:

1. Check PHP versions: Identify PHP installations across web servers, containers and hosting environments.

2. Install security updates: Upgrade vulnerable installations to the appropriate fixed release as soon as possible.

3. Review server logs: Investigate suspicious requests and unexpected activity around the disclosure period.

4. Monitor for compromise: Look for unusual processes, unexpected file changes and other signs of unauthorized access.

5. Prioritize internet-facing systems: Focus first on servers directly exposed to the public internet.

6. Investigate carefully: If compromise is suspected, isolate the affected system where appropriate, preserve logs and follow the organization's incident-response procedures.

Applying the official security update is the primary remediation. Monitoring and other defensive measures are important, but they should not be treated as substitutes for patching.

The Bigger Cybersecurity Lesson

The PHP2Shell incident demonstrates why vulnerability management requires more than waiting for an official security announcement. Attackers may begin probing systems before patches are available, and public disclosure can be followed by a rapid increase in exploit activity.

For organizations that depend on PHP, the priority is to identify vulnerable installations, deploy the appropriate updates and investigate suspicious activity.

Conclusion: AWS's findings provide an important reminder that the public patch date does not necessarily mark the beginning of exploitation. With critical PHP vulnerabilities potentially enabling remote code execution, timely updates and continuous monitoring remain essential to protecting web infrastructure.

Sources: WIRED; Amazon Threat Intelligence; PHP security advisories.

This article is for cybersecurity news and defensive awareness. Vulnerability status and recommended updates may change as vendors publish further guidance.