N環球 
Amazon: PHP2Shell attacks began four days before patches, now broadly exploited
Amazon Threat Intelligence says exploit attempts against the critical PHP2Shell flaws started on Oct. 17, four days before patches shipped — and the flaws are now being broadly exploited in the wild.
Why it matters
PHP powers up to 80% of websites worldwide, including WordPress, Drupal and Joomla. The two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow pre-authentication remote code execution. Amazon confirmed attackers didn't wait for public disclosure: the first exploit attempt arrived on Oct. 17, four days before the PHP Foundation shipped patches on Oct. 21. The assumption that the disclosure date marks the start of attacks no longer holds — defenders must start their investigations from Oct. 17.
Full report
Amazon's threat intelligence team disclosed in a security blog post on Oct. 22 that its MadPot honeypot network recorded the first PHP2Shell exploit attempt on Oct. 17, while the vulnerabilities were still under embargo (public release was 14:00 UTC on Oct. 21). The attempt came from an IP address tied to a commercial anonymization network. "It remains unclear how the actor acquired exploit information prior to disclosure," said CJ Moses, Amazon's chief information security officer.
On Oct. 21 itself, Amazon saw multiple proof-of-concept exploits, the earliest about 12 hours before the patch release. Payloads and anonymized infrastructure varied, suggesting several distinct actors. Within hours of the patch shipping, fresh exploits were turned on Amazon's sensors. Amazon now describes PHP2Shell as "being broadly exploited in the wild," and attempts seen by Cloudflare have climbed into the millions.
Dataminr said the same day that observed activity remains limited to scanning, fingerprinting and non-working exploits, with no known compromises — but working exploits are only a matter of time.
Background
The flaws affect every PHP 7.x and 8.x release and were discovered by researchers from Calif, OpenAI and Google-owned Wiz. The buggy code had sat in PHP for years until an August audit financed by OpenAI used an AI model to show it was practically exploitable — the origin of the "PHP2Shell" name. Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Amazon's advice: upgrading PHP is the only complete remediation; investigations should start from Oct. 17; systems that can't patch yet may consider blocking multipart file uploads after testing what that breaks.
💬 Comments
No comments yet. Be the first!