Cybersecurity researchers at Amazon Threat Intelligence confirmed that attackers began targeting critical PHP2Shell vulnerabilities four full days before the official release of security patches.
The two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute remote code (RCE) on affected systems. The PHP development team rushed to release the necessary patches on October 21, one day after urging system administrators to prepare to install the updates as soon as they became available.
Vulnerability details leak and accelerated timeline
The PHP team explained that events accelerated contrary to the original plan two days before the full disclosure, following the leak of technical details regarding the PHP2Shell vulnerabilities online, which included CVE identifiers and mitigation advice directed at certain critical infrastructure providers. Although some proof-of-concept (PoC) exploits were published before the updates were released, the PHP team noted that they lacked any actual functional capability to breach systems at that time.
Field exploitation and its origins
The Amazon report came after multiple security companies, including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack, detected failed exploitation attempts that preceded the public disclosure. According to statements by CJ Moses, Chief Information Security Officer at Amazon Web Services (AWS), the first attempts began on Saturday, October 17, from IP addresses belonging to a commercial anonymity network.
Moses added that the actual payloads and the infrastructure used to mask identities varied in a way that suggests the involvement of multiple threat actors, warning defenders against relying on the public disclosure date as the earliest date for the start of the attacks, and confirming that the vulnerabilities are currently being widely exploited in the wild.
What does this mean for systems and websites?
PHP (Hypertext Preprocessor) serves as the open-source programming foundation that powers about 80% of all websites on the internet, including popular content management platforms such as WordPress, Drupal, and Joomla. Data from the VirusTotal platform indicates the existence of more than 5.1 million PHP servers exposed online, including about 3.8 million servers that have at least one port open to potential attacks, making the potential impact extremely widespread.