AWS Finds PHP2Shell Exploits Started Four Days Before Public Patch Release

Amazon Web Services detected attempts to exploit critical vulnerabilities in PHP on October 17, four days before the public release of patches. This early activity suggests threat actors had access to exploit information while the flaws remained under embargo.

Research published Wednesday evening by AWS confirms that attackers began targeting systems before the fixes were publicly available. The vulnerabilities, collectively known as PHP2Shell, are now being broadly exploited across the internet according to CJ Moses, AWS chief information security officer.

Early Exploitation and Embargo Breach

AWS analysts identified the October 17 activity by reviewing logs from a honeypot, an intentionally vulnerable server used to study attack methods. The attempt originated from an IP address linked to a commercial anonymization network, such as a proxy or VPN service.

CJ Moses noted that targeting a honeypot from an anonymized address during the embargo period indicates the activity was conducted by a threat actor. It remains unclear how the actor acquired exploit information prior to the official disclosure.

Proof-of-concept exploits for PHP2Shell began emerging publicly on Wednesday, with some appearing hours before the 10 am ET disclosure. AWS researchers observed multiple exploitation attempts against their honeypots in the hours leading up to the announcement.

These attempts used various anonymization providers and seemed to have different attack goals, likely indicating multiple different actors were involved. Technical analysis is ongoing to determine if these early attempts succeeded on real-world systems.

Impact on Web Administrators

The release of fixes for the two critical PHP vulnerabilities caused a scramble among administrators and security staff to patch vulnerable websites and applications. Attackers inevitably reverse engineered the fixes to learn how to exploit the flaws after the public release.

Some governments and other groups proactively took key websites down in anticipation of the release to avoid being targeted before they could apply the patches. This defensive measure highlights the severity of the threat posed by the PHP2Shell vulnerabilities.

The PHP Foundation did not immediately respond to requests for comment regarding the early exploitation or the current state of the vulnerabilities. The rapid exploitation timeline aligns with broader trends in vulnerability utilization.

As Threat Times reported on October 21, 2026, Rapid7 data shows attackers exploit 71% of high-severity vulnerabilities within seven days of public disclosure. The PHP2Shell case fits this pattern of rapid weaponization.

What should you do?

Organizations relying on PHP should immediately verify if their systems are patched against the PHP2Shell vulnerabilities. Security teams should monitor logs for suspicious activity originating from anonymization networks or proxy services.

Administrators should review honeypot data or external attack surface management tools for signs of early exploitation attempts. Those who cannot patch immediately should consider taking critical assets offline to prevent unauthorized access.

Background: Attack surface management

Attack surface management identifies every digital entry point attackers could exploit. Small businesses benefit by mapping external assets, prioritizing risks, and delegating complex scanning to managed providers. This reduces exposure without requiring a large security team.

Read the full guide: Attack Surface Management for Small Businesses: Practical Steps

What to do and how to stay safe: PHP

• Check your PHP versions against the latest security advisories to ensure patches for PHP2Shell are applied.
• Monitor web server logs for unusual traffic patterns or connections from known proxy and VPN networks.
• Review access controls on critical web applications to limit exposure to unpatched systems.
• Once the vendor provides an update, deploy it immediately to mitigate the risk of broad exploitation.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did attackers start exploiting the PHP2Shell vulnerabilities?

AWS detected exploitation attempts on October 17, four days before the public patch release on Wednesday.

How did attackers hide their identities during the early exploitation?

Attackers used commercial anonymization networks, such as proxy services or VPNs, to mask their IP addresses.

Are the PHP2Shell vulnerabilities currently being exploited?

Yes, AWS chief information security officer CJ Moses stated that PHP2Shell is now being broadly exploited in the wild.