Amazon Finds PHP2Shell Exploitation Attempts Four Days Before Emergency Security Patches
Amazon's threat intelligence researchers have uncovered evidence that attackers attempted to exploit the critical PHP2Shell vulnerabilities four days before emergency security patches were publicly released. The discovery raises concerns about the effectiveness of coordinated vulnerability disclosure when threat actors may obtain technical information before defenders receive official advisories.
The suspicious activity was detected on October 17, 2026, through Amazon's MadPot honeypot infrastructure, while the PHP development team did not release emergency security updates until October 21. The incident suggests that at least one operator was investigating or attempting to exploit the vulnerabilities before their public disclosure.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP's internal memory management and request-processing mechanisms. Both received critical severity assessments because successful exploitation under vulnerable conditions could potentially enable remote code execution on web servers.
The timing is particularly significant because PHP remains a foundational technology for websites, content management systems, and enterprise applications. A vulnerability in the underlying runtime can expose systems even when their application code does not contain an independently exploitable weakness.
Although Amazon observed early exploitation attempts, the findings do not establish that the attacks succeeded or that the operator obtained advance knowledge through a specific leak. Nevertheless, they provide evidence that the threat to vulnerable PHP installations emerged before the coordinated patch release.
Early Exploitation Detected Through Amazon's Honeypot Network
Amazon identified the October 17 activity while analyzing telemetry collected by MadPot, its global network of honeypots designed to attract malicious traffic and identify emerging attack techniques.
The suspicious requests originated from an IP address geolocated to Australia and associated with a commercial anonymization service. Such infrastructure can make attribution difficult because the apparent source of a connection may not reveal the attacker's actual location or identity.
Researchers described the activity as an isolated probing attempt rather than evidence of a widespread campaign at that stage. However, the payloads were sufficiently distinctive to connect them to the PHP2Shell vulnerabilities that would become public several days later.
The observation raises an important question: how did the operator identify the attack technique before the official disclosure?
Several explanations remain possible. The attacker may have independently discovered the vulnerability, obtained information through an unauthorized disclosure, or acquired technical details from another source. Amazon has not established which explanation is correct.
The distinction matters because early exploitation does not automatically prove that a coordinated disclosure process was compromised. Independent vulnerability discovery can occur, particularly when multiple researchers are investigating the same widely deployed software.
Amazon's findings nevertheless demonstrate that organizations cannot assume an undisclosed vulnerability remains unknown to attackers. Security teams may be exposed to exploitation attempts even while software maintainers are still preparing patches and coordinating their release.
PHP2Shell Disclosure Complicated by Premature Information Leaks
The discovery came amid an unusually complicated disclosure process involving the PHP development team, security researchers, and software distribution companies.
The vulnerabilities were originally scheduled for public disclosure on October 22. However, information about the flaws began circulating ahead of schedule, prompting PHP maintainers to accelerate the emergency release to October 21.
The situation became more difficult when technical materials and patched software artifacts appeared before the coordinated announcement. These included an accidentally published proof-of-concept demonstration and early container images distributed by software supply chain security company Chainguard.
PHP maintainers criticized Chainguard for releasing patched images before the agreed disclosure time, arguing that the action could allow attackers to reverse-engineer the fixes while many organizations remained unaware of the vulnerabilities.
This concern reflects a longstanding challenge in vulnerability management. Security patches reveal which parts of a program have changed, and researchers can sometimes analyze those differences to identify the underlying weakness.
Attackers may use the same technique, known as patch diffing, to develop exploits before vulnerable organizations complete their updates.
However, Amazon's October 17 observation predates the reported October 20 and 21 disclosure problems. The earlier attempt therefore cannot be explained solely by Chainguard's premature publication or the later appearance of technical materials.
The chronology suggests that at least some interest in exploiting PHP2Shell existed independently of the final disclosure disruptions, although the precise source of the attacker's knowledge remains unknown.
Attack Activity Increased Rapidly After Public Disclosure
Following the emergency release, security researchers observed a sharp increase in attempts to exploit PHP2Shell.
Amazon reported additional activity on October 21, including attempts using different proof-of-concept techniques. The variation in payloads and source infrastructure suggested that multiple operators were experimenting with the vulnerabilities.
Other cybersecurity organizations reported similar trends. Cloudflare detected malicious requests targeting customer environments and observed attackers modifying payloads in attempts to bypass protective controls.
VulnCheck also identified exploitation attempts against its honeypots, while Pantheon reported blocking tens of thousands of suspicious requests shortly after the vulnerabilities became public.
The rapid escalation illustrates how quickly attackers can react when technical information about a critical vulnerability becomes available. Automated scanning tools allow operators to identify potentially vulnerable systems across large portions of the internet, while publicly available exploitation research can reduce the effort required to test attack techniques.
Some researchers also reported attempts to deploy malware associated with the Mirai botnet through vulnerable PHP installations. Such activity demonstrates how attackers may attempt to convert a web application vulnerability into broader infrastructure compromise.
Nevertheless,attempted exploitation should not be confused with confirmed successful compromise. Security vendors observing malicious requests cannot necessarily determine whether an attack succeeded unless they have sufficient visibility into the targeted environment.
The available findings establish substantial malicious interest in PHP2Shell, but they do not provide a reliable global count of successfully compromised systems.
Why PHP2Shell Presents a Difficult Detection Challenge
The PHP2Shell vulnerabilities are particularly concerning because they affect the PHP runtime rather than a specific application or plugin.
PHP executes server-side code for a wide range of web platforms, including content management systems, e-commerce applications, and custom enterprise services. When a vulnerability exists in the interpreter itself, applications may remain exposed even if their individual dependencies are current.
The flaws involve memory corruption associated with error handling and internal request state. Under vulnerable conditions, specially crafted requests can interfere with the way PHP manages memory and potentially create opportunities for arbitrary code execution.
These characteristics complicate detection because exploitation may occur before ordinary application logic begins executing. Security mechanisms implemented within a web framework may therefore have limited visibility into the malicious behavior.
Researchers have also warned that some exploitation attempts may produce relatively few obvious indicators. PHP worker processes may continue operating, web responses can appear normal, and application logs may not contain clear evidence of an intrusion.
In certain cases, unusual memory-limit errors or unexpected process behavior may provide useful investigative clues, but their absence does not conclusively rule out exploitation.
This creates an additional burden for security teams. Monitoring application logs alone may not be sufficient to identify attacks against the underlying runtime, particularly when the attacker is attempting to execute code without triggering visible application errors.
Organizations must therefore combine patch management with host-level monitoring, process execution telemetry, and network activity analysis to improve their ability to detect suspicious behavior.