- Evidence suggests PHP2Shell exploitation began days before public disclosure, indicating prior attacker knowledge
- Researchers say real-world attacks remain limited, though exploitation attempts rapidly surged after disclosure
- Millions of PHP systems remain exposed, with experts urging immediate patching of supported versions
The exploitation of php2shell began four days before the vulnerabilities were made public, Amazon has claimed, meaning someone knew well in advance about the bugs in the popular software.
The company has released its own analysis which shows that the attacks actually started several days earlier.
“Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619,” the company said in an advisory. “The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.”
Attacks four days prior
On the day of the patch release, four days into the disaster, Amazon Threat Intelligence discovered multiple proof-of-concept (PoC) exploits, and since the payloads and choices in anonymization infrastructure varied, it was most likely the work of multiple threat actors. The company is currently analyzing the payloads to see if they would have been successful in the wild or not.
Together with a handful of partners, PHP Foundation was working on a fix for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed ‘php2shell’. Both have a severity score of 9.2/10, and both can be used for full website takeover. Given that PHP is a programming language used to write a significant majority of all websites in existence, the bugs were quite dangerous, and required carefully coordinated disclosure and patching.
The patch was supposed to be released on October 21, and those who were aware of it, were asked not to disclose the details until it was released. However, a few hours before that embargo were to be lifted, security outfit Chainguard allegedly published container images containing fixes for the flaws. At approximately the same time, news started breaking that cybercriminals were actively exploiting php2shell to target websites.
All hell broke loose - many major government, education, and healthcare websites around the world preventively shut down, while PHP Foundation issued an alert telling admins to prepare and apply the patch as soon as it becomes available.
What is ASLR and why is it important for p2pshell?
One of the reasons why we’re yet to see many successful exploitation attempts is apparently ASLR. Short for Address Space Layout Randomization, it is a security feature that randomly changes where a program’s code and data are stored in memory every time it runs. This is according to Yotam Perkal, Director of Security Research at Pluto Security.
“PHP2Shell doesn't seem trivial to exploit. I believe that part of the reason we’ve yet to see successful exploitation is that reliable code execution requires getting past ASLR, a memory protection that randomizes where code sits in memory,” Perkal said. “That's hard to do remotely, and most of the public PoCs floating around (many of them vibe coded) simply don't work reliably on real systems.”
“I wouldn't count on it staying that way, though. Exploits will get better, and most PHP servers out there are still unpatched, so teams should patch and restart their PHP workers now. But compared with all the drama before and after the release, real-world exploitation so far looks pretty limited.”
At the same time, Cloudflare has said the number of attacks launched in the hours after disclosure was staggering and growing at an unprecedented rate. Company CEO Matthew Prince said in a post on X that the team saw thousands of exploitation attempts in the 10 hours before the patch was announced. This grew to tens of thousands within an hour of disclosure, and hundreds of thousands within two hours. Now, it’s gone into the millions.
To make matters worse, different threat actors are approaching the flaws in different ways and are adapting on the go. According to Cloudflare, some threat actors were modifying their payloads based on feedback from blocked requests, all in order to find a way past web application firewalls (WAF).
Via The Register