PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions

PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions

Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon.com Inc. has disclosed, while exploit attempts seen by Cloudflare Inc. have since climbed into the millions.

PHP’s maintainers shipped fixes for the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, on Wednesday after details leaked ahead of a coordinated release. The bugs had sat in PHP’s code for years until an August audit financed by OpenAI Group PBC used an artificial intelligence model to show they could be exploited in practice.

Amazon’s MadPot honeypot network recorded the earliest attempt on Oct. 17, while the vulnerabilities were still under embargo. The traffic came from an IP address tied to a commercial anonymization network. CJ Moses, chief information security officer of Amazon Integrated Security, wrote in a blog post that it is unclear how the attacker obtained exploit information before disclosure.

More probes reached the honeypots in the hours before Wednesday’s release, and their payloads and anonymized infrastructure varied enough that Amazon suspects more than one actor was involved. Whether any of those early attempts would have worked on a real system is still unknown. Fresh proof-of-concept exploits surfaced within hours of the patch and were turned on Amazon’s sensors almost immediately. The company now describes the flaws as “being broadly exploited in the wild.”

Amazon wants investigations to start from Oct. 17 at the latest. Seven- and 30-day remediation windows for critical internet-facing flaws assume a delay that attackers no longer give, the company said, arguing that patch timelines should be measured in hours.

Exploit traffic seen by Cloudflare rose by orders of magnitude once the disclosure went public. The network logged “thousands of attempts” in the 10 hours beforehand, Chief Executive Matthew Prince wrote on X late Wednesday. Tens of thousands followed in the 45 minutes after the announcement and hundreds of thousands within two hours. By the time he posted, the count had passed into the millions.

None of that traffic has yet been tied to a confirmed break-in. WordPress security company Defiant Inc. said today that its Wordfence firewall has blocked more than 74,000 exploit and probing attempts. Across the more than 5 million WordPress sites it protects, the company has not seen a single confirmed compromise. Real-time event and risk detection company Dataminr Inc. described observed activity as “limited to scanning, fingerprinting, and use of non-working exploits.” Working attacks are “only a matter of time,” it said.

Organizations around the world have been pulling services offline anyway. Several cybersecurity agencies, including the U.S. National Security Agency, advised on Wednesday that systems be taken offline if they could not be updated immediately, and Reuters reported that banking, rail and government services were taken down as a precaution from Tokyo to Helsinki. In Japan, brokerage Nomura Holdings Inc., lender Mitsubishi UFJ Financial Group Inc. and East Japan Railway Co. suspended some internet services today, and the National Tax Agency temporarily took its service down. South Korea raised its private-sector cybersecurity alert level, citing a higher risk of hacking.

Finland’s state IT services provider, Valtori, began lifting its blocks on government web services after patching overnight. Director General Hannu Naumanen said restoring them “can take days or even weeks” because the systems need careful testing.

Microsoft Corp. Chief Executive Satya Nadella said at an event in Germany today that he had “not seen anything like this in a long, long time,” according to Reuters. For IT and security staff, he said, it was “a long day and a long night.”

Michael Centrella, head of public policy at SecurityScorecard Inc. and a former assistant director of the U.S. Secret Service, told SiliconANGLE that agencies should rank exposed systems by mission impact, including public safety, health and payments. “What looks like hundreds of separate vulnerabilities could represent a smaller number of common points of failure capable of creating cascading disruption,” he said.

A long tail of servers may never take the fix. Felix Kuhlenkamp, head of security at German digital industry association Bitkom, told Reuters that many smaller operators “run a website using PHP but don’t really keep a close eye on it.” Where a site sits on an old version with no security update, he said, “the entire system must be updated.”

“The end-of-life count should stop people,” Justin Beals, founder and chief executive of Strike Graph Inc., told SiliconANGLE. He pointed to figures from vulnerability intelligence company VulnCheck Inc. showing at least 1 million internet-facing hosts on PHP versions that no longer get updates. “Anything end-of-life belongs on a risk register with a named owner and a retirement date,” Beals said.

Plugins and other dependencies can tie applications to specific PHP versions, so updating PHP itself can break something a business relies on, according to John Strand, owner of Black Hills Information Security Inc. “‘Just patch it’ sounds great until the update takes down your website,” Strand told SiliconANGLE. “Finding vulnerabilities faster doesn’t mean organizations can fix them faster. We’re still struggling to patch the systems we already know are vulnerable. As an industry, we’re not ready for that gap to keep growing.”

Image: SiliconANGLE/GPT Image 2.5