Amazon’s Threat Intelligence team has revealed that an attempt to exploit the PHP2Shell vulnerabilities occurred prior to their official disclosure. Detected on October 17, 2026, this attempt targeted Amazon’s MadPot honeypot service. Following the release of patches, the vulnerabilities have been subject to widespread exploitation.
Early Exploitation Detected
The exploit attempt, as reported by CJ Moses, CISO of Amazon Integrated Security, originated from an IP tied to a commercial anonymization network. Although under embargo at the time, the targeting of a honeypot using an anonymized IP suggests involvement by a threat actor, the exact means of acquiring exploit information remain unknown.
Amazon identified the source IP as “103.216.220[.]92,” located in Australia, and described the activity as an isolated probe. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were identified by researchers from Calif, OpenAI, and Wiz. These flaws allow pre-authentication remote code execution, impacting PHP releases from the 7.x and 8.x series.
Significant Risk to PHP Systems
CrowdStrike highlighted the severity of these vulnerabilities, noting that attacks leave minimal digital traces. The flaws do not require bypassing authentication, stealing sessions, or discovering vulnerable endpoints, making them particularly dangerous. With no application code execution, server logs show no anomalies, complicating detection efforts.
The PHP Foundation had initially planned to disclose these vulnerabilities on October 22, 2026, but a leak of details and proof-of-concept exploits prompted an earlier release. The vulnerabilities impact critical PHP components like memory management and error handling, posing challenges for fixing without disrupting compatibility or performance.
Global Response and Recommendations
Following the vulnerability disclosure, Amazon reported multiple exploitation attempts, beginning on October 21, 2026. These attempts involved various threat actors utilizing anonymized infrastructure, with additional activity recorded from several IP addresses across different regions.
Cybersecurity agencies worldwide, including the U.K. National Cyber Security Centre and the U.S. Cybersecurity and Infrastructure Security Agency, have issued warnings urging organizations to apply the patches promptly. The U.S. FBI and NSA further emphasized the vulnerabilities’ potential to allow unauthorized access to server file systems and databases.
PHP’s widespread use, powering nearly 70% of websites, exacerbates the risk posed by PHP2Shell vulnerabilities. Major platforms like WordPress and Magento are particularly vulnerable, highlighting the urgent need for organizations to secure their PHP systems.
Future Outlook and Mitigation Strategies
With PHP present in millions of online systems, the scale of potential impact is vast. Organizations are advised to ensure accountability for PHP use across services and products, quickly deploying patches to mitigate risks. The landscape of vulnerabilities and exploitation is changing, with AI-assisted analysis accelerating the timeframe for developing working exploits.
Security vendors and government agencies have provided extensive guidance and mitigations to address these vulnerabilities. The rapid progression from patch to exploit underscores the importance of proactive security measures and the need for ongoing vigilance in the face of evolving threats.
