Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt courtship to Oct. 17, 2026, in MadPot telemetry, four days before community disclosure of CVE-2026-109618 and CVE-2026-109619. The utilize attempt originated from an IP location connected alongside a business anonymization network. While the exposure was under embargo, the targeting of a honeypot from an anonymized IP location suggests the action was conducted by a danger actor, although it remains unclear how the performer acquired utilize data previous to disclosure.

The PHP embargo opening was set to be lifted on 2026-10-21 1400 UTC. On the day of the release, Amazon Threat Intelligence identified multiple evidence of idea exploits for the vulnerability, alongside the earliest about 2026-10-21 0200 UTC. Subsequently, from 2026-10-21 0200 UTC to 2026-10-21 0800 UTC, Amazon Threat Intelligence identified additional exploitation attempts of PHP2Shell targeting MadPot from additional anonymized infrastructure. The genuine payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical inspection is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.

The genuine publish of the embargo opening was 2026-10-21 1400 UTC. Once the embargo was lifted and the place was released, additional proof-of-concept exploits appeared inside hours, and we saw them used against our sensors nearly immediately. PHP2Shell is now being broadly exploited in the wild.

Two lessons from this event use fine beyond this one vulnerability:

1. An embargo protects defenders lone until person alternatively finds the identical bug. Coordinated disclosure is motionless the correct model. But defenders should not assume the community disclosure date is the earliest date of exploitation. With PHP2Shell, colony may predate the advisory.
2. The period from place to operating utilize is shrinking for structural reasons. In the past, most exploitation we observed came following a community evidence of idea was released. A small figure of capable actors built exploits, and everyone alternatively waited for them. That dependency is weakening. AI-assisted inspection makes it cheaper to rotate a place diff or advisory into a operating exploit. As a result, additional actors can act inside hours or equal minutes formerly specialized particulars of a exposure are disclosed.

For safety leaders, this changes multiple operating assumptions:

1. For crucial vulnerabilities in internet-facing systems, measure place and mitigation timelines in hours. A 7-day or 30-day SLA assumes a postpone that no longer exists.
2. Start investigations from the earliest known exploitation, not from the disclosure date. For PHP2Shell, examine from at smallest starting on October 17^th.
3. Invest in detections that don’t depend on a signature for a particular CVE. The archetypal exploitation volition frequently arrive before those signatures exist.

AWS deploys multiple layers of safety to assistance safeguard customers. Our inner danger intellect scheme automatically detected and restricted malicious scanning attempts targeting this vulnerability. We analyze complete 200 milliard events per infinitesimal and merge danger intellect from our MadPot honeypot network to acknowledge and obstacle known exploitation attempts in genuine time. Our honeypot scheme provides us alongside first finding of exploitation attempts, enabling fast reply and danger analysis.

1. Upgrade immediately to the fixed PHP versions. Upgrading is the lone complete remediation for the two CVE-2026-109618 and CVE-2026-109619. There are no configuration-only workarounds that completely location the two issues.
2. Consider blocking multi-part document uploads in PHP deployments that cannot be patched immediately, but decide how this would power your use previous to deploying.
3. Look for POST requests alongside the PHP_SESSION_UPLOAD_PROGRESS cord in form uploads.
4. Review web server logs for doubtful activity.
5. Check for unexpected procedure implementation or document modification on web use servers.