GoKawiilAmazon says PHP2Shell flaws were exploited four days before official patches
Amazon Threat Intelligence reports that attackers began targeting the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, four days before PHP released fixes on October 21. The PHP team had to move up its disclosure timeline after details including the CVE IDs and mitigation guidance leaked online two days early, and researchers say functional exploits appeared within hours of the patch release.
GoKawiil's interpretation of the reporting above, not reported fact.
The early exploitation suggests some attackers had access to vulnerability details before the public embargo lifted, which could mean a leak reached threat actors as well as critical infrastructure providers. Amazon's finding that a honeypot was probed from an anonymized IP during the embargo period implies the activity may have come from a sophisticated actor monitoring disclosure channels, though this remains an inference rather than confirmed attribution.
- Exploitation of PHP2Shell flaws reportedly started October 17, before the October 21 patch release
- A premature leak of CVE details and mitigation advice forced PHP to accelerate its disclosure timeline
- Multiple security firms observed pre-disclosure probing, and NCSC urged immediate patching or taking servers offline
Source: bleepingcomputer.com, 2026-10-22
Published there as: “Amazon says PHP2Shell exploitation began 4 days before patches”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.