Amazon says PHP2Shell attacks began four days before the patch

Defenders who waited for the public disclosure date may have been exposed for days before they knew the flaws existed.

Amazon Threat Intelligence reports that attempts to exploit the two critical PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619, started on October 17, four days before the PHP security team released patches on October 21. The bugs allow remote code execution, and the earliest probes came from an anonymized IP address that hit a honeypot while the issue was still under embargo, which suggests a threat actor had the exploit details before disclosure. Several proof-of-concept exploits were then deployed within hours of disclosure, though the PHP team said none of the published ones worked. Amazon now describes the flaws as being broadly exploited in the wild and advises defenders not to treat the public disclosure date as the first day of exploitation. PHP powers a large share of websites, including WordPress, Drupal and Joomla installs, and VirusTotal counts over 5.1 million exposed PHP hosts, about 3.8 million with at least one open port.