Amazon detected an attempt to exploit two critical PHP2Shell vulnerabilities on 17 October 2026, four days before the flaws were publicly released. The company's Threat Intelligence team said the activity targeted its MadPot honeypot network, but it remains a mystery how the unidentified actor obtained the exploit information so early.
The discovery raises concerns about how quickly attackers can gain access to vulnerability details before organisations have an opportunity to protect their systems.
Amazon also detected further exploitation attempts after the security fixes became available, although it has not established whether the observed attempts would have succeeded against real-world systems.
PHP2Shell Exploit Attempt Raises Questions About Early Access
Amazon's chief information security officer, CJ Moses, reported that the earliest PHP2Shell exploit attempt was detected on 17 October, four days before public disclosure. The request came from an anonymised IP address geolocated to Australia, but the operator's identity remains unclear.
Amazon said the timing suggested a threat actor had accessed exploit information early. However, there is no evidence establishing a leak, insider involvement or a breach of Amazon's systems.
‼️ ALERT - Someone tried to exploit #PHP2Shell 4 days before the vulnerabilities were publicly disclosed.
— The Hacker News (@TheHackersNews) October 22, 2026
Amazon caught the October 17 attempt. More exploit attempts followed the patch release.
Who had the exploit details early, and how?
Full story ↓ https://t.co/1C4q1ObBnr
The flaws, CVE-2026-109618 and CVE-2026-109619, each received a severity score of 9.2 and can allow unauthenticated remote code execution on vulnerable PHP systems.
Successful exploitation could let attackers run malicious code, depending on the server's configuration and permissions.
PHP2Shell Patches Arrived After Details Leaked
The PHP security release was scheduled for 21 October 2026 at 14:00 UTC. Details about the vulnerabilities emerged publicly before that deadline, but the official release date was not moved forward by a day, as some early accounts suggested.
Once the disclosure embargo ended and patches became available, Amazon observed additional proof-of-concept exploits being used against its sensors.
The company recorded further attempts between approximately 02:00 and 08:00 UTC on 21 October, with activity coming from additional anonymised infrastructure.
aws says a 7-day patch deadline is now too slow for critical bugs in anything facing the internet. it wants teams to measure patching in hours.
— Sughu (@sughanthans1) October 22, 2026
php2shell shows why. aws's honeypots logged an exploit attempt on october 17, four days before the bug went public. and aws spotted… pic.twitter.com/UvZwW9mpBx
Amazon found signs of multiple actors attempting exploitation, but no successful breaches or data theft have been confirmed. Public exploit code could help attackers adapt their methods, putting unpatched systems at greater risk.
PHP2Shell Puts Older Web Servers Under Pressure
The vulnerabilities affect multiple PHP releases, including versions that no longer receive upstream security updates. The PHP project has issued fixes for supported branches, including PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Older versions require particular attention. PHP 8.1 and earlier releases are no longer supported upstream, meaning administrators may need to migrate to a supported branch or investigate whether their software vendor provides a suitable backported fix.
Amazon recommends applying the available patches promptly and reviewing web server logs for suspicious activity.
Organisations should check for unusual processes or file changes and investigate whether internet-facing systems were targeted before public disclosure. Amazon detected the first attempt on 17 October, but how the actor learned about the flaws so early, and whether the incident was linked to the later leak, remain unanswered questions.
