Amazon Threat Intelligence has revealed that exploitation attempts targeting the critical PHP2Shell vulnerabilities began as early as Saturday, 17 October, four days before official security patches were released on 21 October. The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to achieve remote code execution on vulnerable systems. According to Amazon Web Services Chief Information Security Officer, the earliest known attack originated from an IP address linked to a commercial anonymisation network, suggesting a threat actor had obtained exploit information prior to public disclosure. AWS noted that multiple actors appeared to be involved, given the varying payloads and anonymisation infrastructure observed across different attempts.
The PHP security team’s coordinated disclosure timeline was partially compromised when key details, including the two CVE identifiers and mitigation guidance shared with critical infrastructure providers, leaked online approximately two days before the planned release, forcing the team to bring forward the patch date to 20 October. Whilst some proof-of-concept exploits were published before patches became available, the PHP security team confirmed none were functional at the time. Amazon’s findings align with reports from several other cybersecurity firms, including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack, all of whom detected unsuccessful exploitation attempts ahead of public disclosure.
AWS has since confirmed that PHP2Shell vulnerabilities are now being broadly exploited in the wild, though the number of successful attacks remains unclear. They cautioned that “defenders should not assume the public disclosure date is the earliest date of exploitation,” stressing the importance of proactive patch management. Organisations running PHP installations are strongly urged to immediately apply the available patches (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35) as the window for pre-emptive defence continues to narrow.