Amazon's PHP2Shell RCE Patches Arrived Four Days After Threat Actors Tested Flaws

Threat actors began probing for two critical remote code execution vulnerabilities in PHP four days before security patches were released, according to Amazon. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute code on affected servers.

What happened

Amazon Threat Intelligence detected the first exploitation attempt on 17 October, while the vulnerabilities remained under embargo. This initial probe originated from an IP address linked to a commercial anonymisation network, suggesting deliberate action by a threat actor. Amazon noted that it remained unclear how the attacker acquired exploit information before disclosure.

On 21 October, patches for the PHP2Shell flaws were released. Within hours, multiple proof-of-concept exploits appeared online and were used against sensors. Amazon observed variations in payloads and origins, indicating multiple threat actors were involved in the testing phase. Mass exploitation activity followed shortly after the public release of the fixes.

Why it matters

The PHP2Shell vulnerabilities affect any PHP version released in the last decade, including version 5.4. This exposes a vast number of websites, as PHP powers approximately 69.7% of sites with known server-side languages. Content management systems like WordPress, Drupal, Joomla and Magento are among the platforms at risk.

The early detection of probing activity highlights the difficulty of maintaining secrecy during coordinated vulnerability disclosure. Multiple organisations, including Cloudflare and WatchTowr, reported unsuccessful exploitation attempts before the patches were available. The leak of details on 20 October accelerated the circulation of exploit code.

Next steps

• Verify if your servers run vulnerable PHP versions released prior to the October 21 update.
• Monitor logs for traffic originating from anonymisation networks or unusual geographic locations.
• Check for signs of proof-of-concept code execution in web server access logs.

Detection notes

Teams should monitor web server logs for anomalous request patterns that do not match normal user behaviour. Look for repeated attempts to access specific PHP endpoints or unusual parameter strings in HTTP requests. Alert on connections from known anonymisation services or VPN providers, as threat actors often use these to hide their origin. Check for spikes in error rates or server crashes, which may indicate failed exploitation attempts. Review authentication logs for unexpected remote code execution signatures. Containment involves isolating affected servers from the network to prevent lateral movement while investigating the breach scope.

What to do and how to stay safe: PHP

• Audit all web servers to identify installations running PHP versions prior to the patched release.
• Implement network-level rules to block traffic from known anonymisation services and high-risk IP ranges.
• Enable detailed logging on web servers to capture full request payloads for forensic analysis.
• Validate that web application firewalls are configured to detect and block common PHP exploitation patterns.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did the first PHP2Shell exploitation attempts occur?

The first attempts were detected on 17 October, four days before the patches were released on 21 October.

Which PHP versions are affected by these vulnerabilities?

Any PHP version released in the last decade, including version 5.4, is affected by the PHP2Shell flaws.

Did the proof-of-concept exploits succeed before patches were available?

Multiple organisations observed exploitation attempts before disclosure, but they reported these attempts were unsuccessful.