PHP2Shell Attacks Hit Millions as Amazon Confirms Pre-Disclosure Exploitation
Servers running PHP are under sustained assault, with exploitation attempts for the critical PHP2Shell vulnerabilities now numbering in the millions. Worse, Amazon has confirmed that someone was already probing the flaws four days before patches were even available.
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carry a 9.2 severity rating. They affect how PHP handles memory at the runtime level, meaning any server running a vulnerable PHP version is potentially exposed regardless of what CMS or application sits on top of it. Unauthenticated remote code execution is on the table.
Cloudflare CEO Matthew Prince has been tracking the attack volume in near real-time. According to Prince, the company was already seeing thousands of exploitation attempts in the ten hours before public disclosure. Within 45 minutes of the vulnerabilities going public, that jumped to tens of thousands. Two hours later, hundreds of thousands. The total has since crossed into the millions.
What makes this particularly uncomfortable is that the attackers aren't just firing off a static exploit and hoping for the best. Cloudflare has observed threat actors actively modifying their payloads, apparently using blocked request feedback to work out what might slip past its web application firewall. Adaptive exploitation, at scale, within hours of disclosure.
Security firm Hadrian flagged active exploitation on October 21, noting that most observed attacks abused PHP's session upload-progress path. The company also warned that additional exploit paths are likely to surface as researchers and attackers alike dig further into the vulnerability surface.
Then there's Amazon's finding, which complicates the timeline considerably. Amazon Threat Intelligence says its MadPot honeypot network recorded an exploitation attempt on October 17, four full days before patches shipped. The source was an anonymised IP, and Amazon has been careful not to attribute it definitively, but the implication is straightforward: somebody had working exploit knowledge while the vulnerabilities were still under embargo.
On October 21, Amazon detected multiple proof-of-concept attempts starting around 0200 UTC, roughly twelve hours before patches were released. Further attempts followed over the next six hours, from different infrastructure and using varied payloads. Amazon's read is that this reflects multiple independent actors rather than a single coordinated campaign.
Whether any of those pre-patch attempts succeeded against real targets is unknown.
This sits on top of an already messy disclosure process. The PHP Foundation has accused supply-chain security vendor Chainguard of publishing patched PHP builds before the agreed embargo lifted, potentially tipping off attackers to the existence of a serious flaw. Amazon's October 17 detection suggests that at least one attacker didn't need Chainguard's help.
Cloudflare has pushed WAF rules to both free and paid plan users, but has been clear that firewall rules are a stopgap, not a fix. Patching is the only real answer.
Amazon is advising organisations not to treat October 21 as the start of their exposure window. Given the pre-disclosure activity, they're recommending a look back at suspicious traffic from at least October 17. Admins who assumed they were safe until the news broke may need to revisit that assumption.