Attackers Used Anon Networks to Test PHP Flaws Days Before Oct 21 Patch Drop
Amazon says attackers targeted PHP flaws via anonymized networks days before the October 21 patch drop, with mass activity following disclosure.
Key points
- Amazon observed the first exploitation attempt on October 17, four days before patches were released.
- The flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution on PHP versions since 2014.
- Mass exploitation attempts surged after patches were released, though many proof-of-concept exploits were non-functional.
Amazon Web Services detected attempts to exploit critical PHP vulnerabilities four days before security patches were publicly released. The initial probe occurred on October 17, targeting a honeypot system from an IP address linked to a commercial anonymization network, according to Amazon Threat Intelligence.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, were patched on October 21. Amazon researchers stated that the early targeting suggests a threat actor acquired exploit information while the flaws were under embargo, though the source of that information remains unclear.
Timeline of Exploitation and Disclosure
Multiple organizations reported seeing exploitation attempts before the official disclosure. Cloudflare CEO Matthew Prince said his company observed thousands of attempts in the ten hours before the announcement. WatchTowr, Hadrian, Patchstack, and Previdian also detected unsuccessful probes prior to the patch release, according to reporting by BleepingComputer.
Amazon identified multiple proof-of-concept exploits roughly twelve hours before the scheduled disclosure on October 21. The first of these was detected at approximately 2 a.m. GMT, with further attempts hitting sensors between 2 a.m. and 8 a.m. GMT from additional infrastructure, according to Infosecurity Magazine.
Once the embargo was lifted, Amazon noted that additional proof-of-concept exploits appeared within hours and were used against sensors almost immediately. The company stated that PHP2Shell is now being broadly exploited in the wild, marking a shift from targeted probes to widespread activity.
Impact on PHP Ecosystem
The flaws could allow unauthenticated remote code execution on any website relying on PHP versions released in the last decade, including version 5.4. PHP powers approximately 69.7% of websites with known server-side languages, including major content management systems like WordPress, Drupal, and Joomla, according to W3Techs data cited by Infosecurity Magazine.
The coordinated disclosure was accelerated after details leaked online on October 20. This leak prompted organizations, including French public administrations and the Dutch National Cyber Security Centre, to take websites offline to prepare for patching, according to Infosecurity Magazine.
What should you do?
Security leaders should verify whether their infrastructure runs vulnerable PHP versions immediately. Organizations must prioritize applying the patches released on October 21 to mitigate remote code execution risks. Monitoring for anomalous traffic from anonymization networks may help detect early probing attempts.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: PHP
- Audit all web servers to identify if they are running PHP versions older than the patched releases.
- Apply the security updates released on October 21 as soon as possible to close the remote code execution vectors.
- Monitor network logs for connections originating from known anonymization or commercial VPN services that may indicate probing.
- Review firewall rules to block traffic from IP addresses associated with suspicious proof-of-concept exploit campaigns.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When did the exploitation of PHP2Shell begin?
Amazon detected the first exploitation attempt on October 17, four days before the patches were released on October 21.
Are the proof-of-concept exploits functional?
Amazon stated that broad exploitation is occurring, but WatchTowr noted that many circulating proof-of-concept exploits are non-functional or crash the target.
How many PHP versions are affected?
The vulnerabilities affect PHP versions released in the last decade, going back to version 5.4, which powers roughly 69.7% of websites.
