Amazon’s threat intelligence team says the first exploit attempt hit its honeypots on 17 October, four days before the flaws were disclosed and patched, and that they now face broad exploitation attempts.
Amazon Threat Intelligence says attackers began targeting the two critical PHP flaws known as php2shell (CVE-2026-109618 and CVE-2026-109619) on Saturday 17 October, four days before they were publicly disclosed and the PHP project released fixes on 21 October. The first attempt hit an Amazon honeypot from an IP address linked to a commercial anonymisation network; CJ Moses, chief information security officer of Amazon Integrated Security, wrote that it “remains unclear how the actor acquired exploit information prior to disclosure.” Amazon says “PHP2Shell is now seeing broad exploitation attempts in the wild,” while adding it is unclear whether those attempts would succeed against real systems. Separately, Dataminr’s threat research team said on Thursday that activity it has seen since disclosure is limited to scanning, fingerprinting and non-working exploits, with no known compromises. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Sources: AWS Security Blog · Dataminr · BleepingComputer · CISA
Related: Critical PHP flaws let attackers run code on web servers without logging in; CISA says patch now