Attackers were already exploiting the two PHP2Shell vulnerabilities as early as October 17, four days before the PHP Foundation made them public. Amazon reported this based on data from its own honeypots. Large-scale exploitation is now underway, and while a patch is available, it does not fully mitigate all risks. Amazon advises administrators to check their PHP systems, going back as far as October 17.
Amazon Threat Intelligence detected the first exploit attempt on October 17 at MadPot, the company’s honeypot network that spans the entire internet. The traffic originated from an IP address belonging to a commercial anonymization network. At that time, there was still an embargo in place on CVE-2026-109618 and CVE-2026-109619, which together constitute PHP2Shell. Various parties were aware of the leaks, allowing them to prepare updates for their PHP-based products. However, they were not permitted to disclose the vulnerabilities.
Amazon does not know how the attacker obtained the information. PHP had previously accused Chainguard of leaking information. Details about the vulnerabilities and patched images are said to have been leaked even before the planned disclosure.
Embargo lifted early
Originally, the patches were scheduled to be released today. But on Tuesday evening, information about both CVEs surfaced on Hacker News. The PHP Foundation subsequently moved up the release to Wednesday, October 21, at 4:00 p.m. Amazon had already detected various attack attempts in the hours leading up to this. After the embargo was lifted, additional proof-of-concepts appeared within a few hours. According to Amazon, large-scale exploitation is now underway.
RCE without authentication
Both vulnerabilities are located in the PHP runtime and allow unauthenticated attackers to execute code remotely. According to Tenable, CVE-2026-109618 involves the handling of out-of-memory situations, which can lead to memory corruption. CVE-2026-109619 is a use-after-free issue in which residual state between requests within the same worker can be exploited. Code then runs with the privileges of the web server process, Sophos reports. Applications running on WordPress, Drupal, and Joomla may also be affected.
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. There is no regular official fix for PHP 7.4 through 8.1, while versions 5.4 through 7.3 are end-of-life.
See also: PHP shuts the internet: Why PHP2Shell affects every company