PHP2Shell Exploits Detected Before Public Disclosure

• •Exploitation attempts began four days before public disclosure on October 17, 2026.
• •Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution.
• •Multiple proof-of-concept exploits were detected immediately after the patches were released.

Amazon Threat Intelligence reported that attempts to exploit two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, began on October 17, 2026, four days prior to their public disclosure. The exploit attempts originated from an anonymized IP address, indicating a potential threat actor's early access to the vulnerability details. On October 21, 2026, further proof-of-concept exploits were detected shortly before the scheduled patch release. The vulnerabilities allow unauthenticated remote code execution, posing significant risks to affected PHP systems. AWS has not confirmed whether the exploitation attempts would have succeeded against real-world systems. The PHP project has issued patches for supported versions, while older, unsupported versions remain at risk. Organizations are advised to apply the patches promptly and monitor for suspicious activity.