PHP2Shell vulnerabilities exploited days before public disclosure

Two critical vulnerabilities in PHP, a programming language used across millions of websites, were being exploited by attackers at least four days before their public disclosure on October 21-22, 2026, according to research from Amazon Web Services.

AWS researchers detected an exploitation attempt on October 17 on one of their honeypot systems—intentionally vulnerable servers used to study attack methods. The attempt originated from an IP address linked to a commercial anonymization network, suggesting involvement by a threat actor, though AWS noted it remains unclear how the actor obtained exploit information before the vulnerabilities were publicly disclosed. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on the CVSS severity scale, were discovered by researchers from Calif, OpenAI, and Wiz. They affect all PHP 7.x and 8.x releases and allow unauthenticated remote code execution on any reachable PHP endpoint.

Exploitation attempts escalated sharply following public disclosure. Cloudflare CEO Matthew Prince reported that before the announcement, the company observed thousands of exploitation attempts across its network over a 10-hour period. Within 45 minutes of public disclosure, attempts jumped to tens of thousands. Within two hours, hundreds of thousands of attempts were detected. By the time Prince posted his update, the figure had reached millions. AWS detected multiple proof-of-concept exploits appearing on October 21, with additional waves of attempts from various anonymized IP addresses over the following six hours, indicating involvement by multiple threat actors with different attack objectives.

The early disclosure of exploits was partly triggered by Chainguard, a container security company, which publicly released pre-built images containing the PHP fix before the coordinated disclosure deadline, allowing attackers to reverse-engineer the patch while other PHP users still awaited updates. The PHP Foundation stated this "disregarded weeks of work by many parties toward a coordinated disclosure."

The widespread impact prompted urgent responses from governments and organizations. The US National Security Agency and UK National Cyber Security Centre warned all organizations using PHP to immediately update systems or take them offline. Japan's Prime Minister Sanae Takaichi urged website owners to apply updates immediately. Mitsubishi UFJ Financial Group and Japan's Finance Ministry temporarily suspended some internet services while implementing emergency security measures. Government websites in Europe and other regions went offline as operators rushed to patch vulnerable systems. AWS emphasized that AI-assisted vulnerability analysis is accelerating the time from patch release to working exploit, enabling less technically proficient actors to develop exploits within hours or minutes of disclosure.