AWS Detected PHP2Shell Attack Attempts Four Days Before Patches

Amazon Web Services says attempts to exploit two critical PHP vulnerabilities began four days before patches became public on October 21, 2026. The findings put the earliest observed activity ahead of the disclosure that prompted administrators to rush updates across websites and applications.

AWS identified the October 17 attempt retrospectively in MadPot, its network of decoy systems used to observe malicious activity. The request came through commercial anonymization infrastructure, but researchers have not established how the sender obtained information about the flaws before disclosure.

The vulnerabilities, collectively called PHP2Shell, affect the widely used web scripting language. PHP’s official advisory identifies them as CVE-2026-109618 and CVE-2026-109619 and warns that they can enable attackers to execute code without authentication.

PHP maintainers say installations serving web requests are at risk, including deployments using PHP-FPM, Apache’s mod_php and other server integrations. They identify mod_php as the highest-risk configuration, citing a demonstrated attack that can run before application code begins processing a request.

The two bugs involve different failures in PHP’s handling of internal data. One concerns memory corruption during an out-of-memory condition; the other allows stale internal state to survive and potentially be reused by a later request handled by the same worker process.

AWS’s findings do not establish that the observed attempts successfully compromised production systems. Elizabeth Barron, executive director of the PHP Foundation, told WIRED that the organization knew of no successful remote-code-execution attempt, while agreeing that upgrading was imperative.

The disclosure nevertheless triggered a wider operational response. WIRED reported that some organizations temporarily removed websites from public access while preparing fixes, reflecting concern that attackers could reach exposed services before administrators completed their updates.

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Maintainers advise organizations using older branches to check whether their distribution or long-term-support vendor supplies backported fixes, or move to a supported release rather than assume an older installation is protected.

Temporary defenses have limits. AWS says web application firewall rules can reduce exposure to certain malicious upload requests, but cannot inspect PHP’s internal memory or cover every attack path. Its guidance treats those controls as additional protection during patching, not a substitute for upgrading.

For administrators, the response now includes checking for earlier intrusion as well as installing fixes. AWS recommends reviewing activity from at least October 17; its technical analysis remains ongoing, leaving the effectiveness of the observed attempts and the origin of the advance exploit information unresolved.