PHP2Shell Vulnerabilities: Exploitation Attempt Detected Before Public Disclosure

A critical cybersecurity concern has emerged after Amazon's Threat Intelligence team reportedly detected an attempted exploitation of the PHP2Shell vulnerabilities four days before their public disclosure. The incident highlights the risks associated with leaked vulnerability information and the speed at which attackers may attempt to exploit weaknesses in widely used software.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP core components and can enable unauthenticated remote code execution on vulnerable systems. Since PHP powers numerous websites and applications, the potential exposure extends across a broad range of internet-facing services.

For the official technical details and remediation guidance, consult the PHP security advisory: www.php.net/archive/2026.php#2026-10-21-5

According to the source document, Amazon's MadPot honeypot service recorded a suspicious exploitation attempt on October 17, 2026. The activity originated from IP address 103.216.220[.]92, which was associated with an anonymization network and geolocated to Australia.

The attempt reportedly occurred while the vulnerabilities were still under coordinated disclosure. Amazon stated that the activity suggested possible threat actor involvement, although it remained unclear how the attacker obtained the exploit information before the official announcement.

The vulnerabilities were originally scheduled for disclosure on October 22. However, leaked vulnerability identifiers and proof-of-concept exploit information reportedly prompted the PHP Foundation to advance the release to October 21.

Following the release of security fixes, Amazon reportedly detected multiple exploitation attempts using different payloads and anonymized infrastructure. This activity suggested that multiple threat actors were attempting to exploit the flaws.

Both vulnerabilities carry a CVSS severity score of 9.2, placing them in the critical category. They affect PHP core functionality involving memory management and error handling, components that are central to processing requests.

The weaknesses can allow attackers to execute malicious code without authentication. As a result, exposed PHP services may be at risk regardless of the content management system, framework, or plugins they use.

Another concern is detection. The source document reports that exploitation may leave very limited evidence in conventional application logs. Requests may return HTTP 200 responses, while the only visible server-side indication could be a memory-limit fatal error in the web server's error log.

Organizations relying exclusively on traditional web logs could therefore struggle to identify attempted exploitation or determine whether a system has been compromised.

Security researchers identified millions of internet-facing PHP services, including a substantial number running unsupported versions. The source document attributes an estimate of approximately 4.38 million exposed services as of October 20, 2026, to Modat, with around 79 percent using PHP branches that were no longer supported.

Security providers also reportedly observed suspicious requests and exploitation attempts following disclosure. Pantheon blocked more than 60,000 suspicious requests, while Cloudflare observed attackers modifying payloads in attempts to bypass protections.

These reported findings demonstrate how quickly a critical vulnerability can attract widespread scanning and attempted exploitation. The numerical estimates and provider-specific observations should be checked against their original reports before publication.

Organizations should take the following steps to reduce exposure to PHP2Shell vulnerabilities.

Apply security updates: Upgrade affected PHP installations to the appropriate fixed versions and verify patches supplied by operating system and hosting vendors.

Identify exposure: Inventory all internet-facing PHP services, including legacy applications, containers, and third-party hosted environments.

Investigate suspicious activity: Review web server error logs, process execution telemetry, and unusual PHP processes launching command shells or downloading files.

Strengthen monitoring: Use endpoint detection, runtime monitoring, and web application firewall protections as additional defensive layers.

Address unsupported versions: Develop a migration plan for end-of-life PHP branches that cannot receive current security fixes.

Assess potential compromise: If exploitation is suspected, investigate affected systems and follow incident response procedures rather than assuming patching alone resolves the issue.

The PHP2Shell incident demonstrates how vulnerability information can reach attackers before coordinated disclosure is complete. With critical flaws affecting widely deployed software, organizations must combine rapid patching with accurate asset inventories, behavioral monitoring, and effective incident response.

The PHP security team released fixes for CVE-2026-109618 and CVE-2026-109619 in October 2026 security releases. Organizations should identify affected installations and apply the appropriate updates without delay.

AESPARROW CONSULTING PVT. LTD. recommends that organizations prioritize PHP2Shell remediation, validate their exposure, and strengthen monitoring to detect suspicious activity that conventional application logs may miss.