Amazon says PHP2Shell exploitation began 4 days before patches

PHP2Shell exploitation started before defenders received the official fixes. Amazon Threat Intelligence identified the first attempts on Saturday, October 17. The PHP security team released patches on October 21, so attackers moved at least four days ahead of the public fix.

This timing matters because organizations often use the disclosure date as their emergency starting point. Here, that assumption could leave vulnerable servers exposed while attackers were already testing them. Amazon observed targeting of a honeypot from an IP linked to a commercial anonymization network.

After disclosure, attackers deployed several proof-of-concept exploits from VPN IP addresses. Amazon described the vulnerabilities as broadly exploited in the wild, but said it remains unclear how many attempts succeeded. Dataminr reported only scanning, fingerprinting, and non-working exploits, with no known compromises. Defenders therefore needed to patch immediately, or take servers offline.

The PHP2Shell name covers two critical vulnerabilities in PHP. They are tracked as CVE-2026-109618 and CVE-2026-109619. Their central danger is remote code execution, or RCE. This means an attacker can cause a vulnerable system to run attacker-chosen code without being physically present.

For example, an attacker could send a specially crafted request to an exposed PHP server. If the flaw accepts and processes that request unsafely, the server may execute the attacker’s instructions. The article does not describe the exact technical trigger, but it confirms that both vulnerabilities allow RCE on vulnerable systems.

RCE is especially serious because code runs inside the target’s environment. Depending on permissions and other defenses, an attacker could affect applications, data, or services. The PHP team said official security patches are the only permanent defense. The NCSC urged organizations to update PHP servers immediately or take them offline until patching was possible.

Amazon’s evidence points to exploitation activity before the public disclosure. Its researchers recorded the first attempts against a honeypot on October 17, four days before patches were released. The source IP was associated with a commercial anonymization network, which Amazon said suggested a threat actor was targeting the honeypot.

Hours after disclosure, attackers deployed multiple PHP2Shell proof-of-concept exploits from VPN IP addresses. Their payloads and anonymization choices varied, suggesting several actors rather than one coordinated source. Amazon’s CJ Moses said the activity was under technical analysis and that the attackers’ route to the leaked information was still unclear.

Success remains uncertain. Amazon did not know whether the pre-disclosure attempts could have worked against real systems. Dataminr reported scanning, fingerprinting, and non-working exploits after disclosure, with no known compromises. Amazon nevertheless warned that defenders should not treat public disclosure as the earliest possible exploitation date.

Leaving a vulnerable PHP server online gives attackers more time to test and use a working exploit. Because PHP2Shell enables remote code execution, an attacker could make the server run unauthorized instructions. The severity depends on the server’s permissions, connected systems, and other defenses, but the initial foothold could threaten applications and information hosted there.

A practical example would be an internet-facing PHP server receiving an exploit request. If the request succeeds, the attacker could execute code through the server’s PHP process. From there, the attacker might alter services, access data available to that process, or use the server as a platform for further actions. Those possibilities follow from RCE; the article does not report a specific successful attack.

The current evidence is mixed. Amazon called PHP2Shell broadly exploited in the wild, while Dataminr saw only scanning, fingerprinting, and non-working exploits, with no known compromises. Organizations were urged to patch immediately or take servers offline until they could patch.

The article describes a very large internet-facing PHP population. VirusTotal tracks more than 5.1 million PHP hosts exposed online. Roughly 3.8 million of those have at least one port open to attacks. These figures show why a critical PHP flaw can create urgent, worldwide pressure on defenders.

An exposed host is visible online, while an open port provides a possible network entry point. That does not prove the host is vulnerable or compromised. It does show that many systems may be reachable for scanning and attack attempts. PHP also powers up to 80% of websites, including sites using WordPress, Drupal, and Joomla.

The scale makes rapid patching important. Amazon saw scanning and exploit activity around PHP2Shell before and after disclosure. Dataminr said observed activity remained limited to scanning, fingerprinting, and non-working exploits, with no known compromises. Still, the report warned that working proof-of-concept code or successful exploitation was likely to emerge.

Coordinated disclosure and embargoes are designed to reduce the danger between discovering a flaw and fixing it. Security teams can prepare patches, alerts, and mitigation advice before technical details become widely available. Administrators then have a better chance to update systems before attackers can build reliable exploits.

The PHP team said its release plan was working until details leaked two days before coordinated disclosure. The leak included the two CVE identifiers and mitigation advice given to some critical infrastructure providers. PHP then moved up the targeted release date, beginning October 20. Some proof-of-concept code appeared early, although the team said none was functional.

The timing showed the cost of losing secrecy. Amazon detected exploitation attempts on October 17, before the October 21 patches. The article does not claim the leak caused those attempts, and Amazon said the source of the attackers’ information remains unclear. Still, early exposure reduced defenders’ preparation time and increased urgency.

PHP is a server-side language used to build web applications. Typically, a web server receives a browser request and passes PHP-related work to a PHP runtime. That runtime executes the application code, may access data or services, and returns a result for the web server to send back. The article identifies PHP as an open-source language powering up to 80% of websites.

A vulnerability in this processing path can make the server treat attacker-controlled input as executable instructions. In that situation, a crafted remote request may cause the PHP runtime to run code chosen by the attacker. This is the mechanism behind remote code execution. The article does not provide the precise PHP2Shell input or processing bug.

The danger reaches beyond a single web page because the code runs within the server environment. Its impact depends on the process’s permissions and accessible resources. That is why the PHP team called official patches the only permanent defense, while the NCSC advised taking unpatched PHP servers offline.