Attackers targeted critical PHP2Shell vulnerabilities days ahead of public patches, Amazon warns

Cybercriminals launched attacks against two critical vulnerabilities in the PHP programming language four days before official fixes arrived, according to Amazon Threat Intelligence. The security flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, allow unauthenticated remote code execution and carry a 9.2 severity rating. The PHP security team released emergency updates on October 21 after details and identifier numbers leaked online, but Amazon observed initial exploitation attempts hitting its honeypots as early as October 17. [1][2][3]

Exploitation surged immediately following the release. Cloudflare Chief Executive Matthew Prince reported that attack attempts climbed from thousands prior to disclosure to millions shortly afterward, with threat actors modifying payloads to bypass firewall defenses. Amazon noted that the early pre-disclosure attacks relied on commercial anonymization networks and varied payloads, suggesting multiple groups had obtained vulnerability details while the flaws were still under embargo. Because the bugs reside within the PHP runtime itself, they jeopardize underlying web infrastructure rather than specific individual plugins. [1][2]

The threat carries sweeping implications for the broader web, as PHP powers up to 80% of all websites, and VirusTotal reports that roughly 3.8 million exposed hosts currently have ports open to attack. AWS Chief Information Security Officer CJ Moses warned system administrators to inspect logs dating back to at least October 17 rather than assuming intrusions started with public disclosure. Cybersecurity agencies, including the UK National Cyber Security Centre, have urged organizations to apply the official patches immediately or disconnect exposed servers until updates are installed. [1][2]