Threat actors attempted to exploit two critical PHP vulnerabilities four days before information about the flaws was made public.
Amazon Threat Intelligence said it observed possible PHP2Shell exploitation attempt on October 17, 2026, four days before the vulnerabilities were publicly disclosed. The activity was detected through honeypot monitoring, but it remains unclear how the attacker may have obtained information about the flaws before public disclosure.
“Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619,” the team said. “The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.”
The PHP security team released emergency updates on October 21 to fix two critical remote code execution vulnerabilities, known as PHP2Shell.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to run malicious code on vulnerable servers without authentication.
The vulnerabilities affect PHP web server setups, including PHP-FPM, Apache, and LiteSpeed. Both are linked to memory handling issues that can leave systems vulnerable to attacks.
Administrators are strongly recommended to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. Systems running PHP 7 or older should move to a fixed version or check with their software vendor for available security updates.