Recent reports from Amazon Threat Intelligence reveal that hackers attempted to exploit critical vulnerabilities in PHP systems days before official patches were released. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were targeted by a threat actor on October 17, 2026, prior to their public disclosure on October 21, 2026.
Early Exploitation of PHP Vulnerabilities
The vulnerabilities, collectively known as PHP2Shell, pose a significant risk as they allow for remote code execution on compromised servers. Recorded by MadPot, Amazon’s honeypot network, the initial attack was traced back to an IP address associated with an anonymization service. This raises questions about how the attacker acquired information about these vulnerabilities before they were officially disclosed.
Details and Impact of PHP2Shell Vulnerabilities
The PHP2Shell vulnerabilities affect the way PHP handles memory and request data. CVE-2026-109618 is linked to an out-of-memory condition that leaves internal data incomplete, while CVE-2026-109619 involves a stale state in long-running PHP workers. These flaws could enable attackers to execute code remotely without authentication. The PHP security team promptly addressed these issues with updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Response and Recommendations
Amazon Web Services (AWS) documented multiple exploitation attempts shortly before the patch release. The first proof-of-concept activity was detected about 12 hours before the vulnerabilities were publicly announced. AWS observed varied payloads and infrastructure, suggesting involvement from multiple actors. The organization recommends that teams review server activities from October 17 onwards and update PHP runtimes immediately.
Security teams should verify that all production environments are running the patched PHP versions. This includes checking web servers and managed hosting environments to ensure they are not relying on outdated PHP versions. If immediate updates are not feasible, AWS advises restricting multi-part file uploads as a temporary measure, though this is not a comprehensive solution.
Conclusion and Future Outlook
The early attempts to exploit these vulnerabilities emphasize the importance of proactive security measures. Organizations should not rely solely on public disclosure dates to assess risks, as attackers may act on vulnerabilities before they are formally announced. Continuous monitoring and swift application of security patches are crucial in safeguarding systems against such threats.
