In a recent development, threat actors have been found targeting servers with two major remote code execution (RCE) vulnerabilities in PHP, known as PHP2Shell, days before official patches were available. According to reports from Amazon, these attempts started on October 17, even though the patches were released on October 21.
Early Exploitation Attempts
Patches for the PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were officially released after extensive work by the PHP Foundation and industry partners. However, on October 20, information about these vulnerabilities was leaked online, leading to the rapid spread of proof-of-concept (PoC) exploits. While several organizations observed these activities, they reported that the initial attempts at exploitation were ineffective.
Amazon’s analysis indicates that the first exploitation of PHP2Shell occurred while the vulnerabilities were still under embargo. This activity originated from a commercial anonymization network, suggesting the involvement of sophisticated threat actors. The exact method by which these actors obtained exploit information remains unknown.
Impact and Response
Following the public disclosure, Amazon detected multiple PoCs sourced from various anonymized infrastructures, implying the involvement of several threat actors. Within hours of the patch release, additional PoCs emerged and were quickly used against detection systems. The widespread exploitation of PHP2Shell, however, did not immediately result in successful RCE attacks.
Organizations like WatchTowr and Cloudflare reported seeing mass exploitation efforts shortly after the patches were made public. Despite the high volume of attempts, many PoCs were found to be ineffective, either failing entirely or causing target systems to crash.
Community and Industry Reaction
The cybersecurity community has swiftly responded to the PHP2Shell vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommended immediate updates to PHP versions that include the necessary fixes. Security experts have emphasized the importance of quick patching, while also highlighting the challenge of identifying all systems that require updates.
ThreatLocker and BlueVoyant have advised organizations to apply emergency updates and start examining their systems for potential compromises. Implementing controls to limit what web-facing processes can access may help mitigate the risk until all systems are secured.
Comparison to Past Vulnerabilities
Security professionals have drawn parallels between PHP2Shell and the notorious Log4Shell vulnerability. While PHP2Shell presents a significant threat due to its wide-ranging impact, it differs from Log4Shell in terms of its integration within third-party software. Experts suggest that organizations should develop capabilities to quickly identify affected systems as a separate measure from patching speed, a lesson learned from the Log4Shell incident.
Although PHP2Shell has not yet reached the full impact of Log4Shell, it underscores the critical need for continuous monitoring and rapid response in the evolving cybersecurity landscape.
