PHP2Shell was probed 4 days before disclosure: Amazon logged an attempt on Oct 17

Four days early

Someone fired a PHP2Shell exploit at an Amazon honeypot on October 17. PHP did not disclose the flaws until October 21.

Amazon made this public on October 21 at 22:36 UTC, in a post by Amazon CISO CJ Moses. The Hacker News reported it on October 22.

PHP2Shell is the nickname for two PHP core flaws, CVE-2026-109618 and CVE-2026-109619. PHP rates each CVSS 9.2. Both can allow unauthenticated remote code execution. Our main PHP2Shell explainer covers fixed versions and mitigations.

So who had working exploit details while the bugs were still secret? And how?

What Amazon saw

Amazon runs a large honeypot network called MadPot. Honeypots are decoy systems. Nobody legitimate should attack them.

Amazon says MadPot recorded the PHP2Shell attempt on October 17. It did not give a time of day.

The request came from an IP address on a commercial anonymization network. Amazon notes the flaws were under embargo at the time. It reads the honeypot target and the hidden origin as signs of a threat actor, not a researcher.

Amazon did not say whether this attempt, or any later one, would have worked on a real server. It says its technical analysis is still going.

Who had the details early?

Amazon's answer: it does not know. It says plainly that it is unclear how the actor got exploit information before disclosure.

Here is what the record does show:

• Many parties had advance access. PHP shared the fix with distributors ahead of time. Cloudflare says it built WAF rules from early October.
• The fix was finished after the attempt. ELLIO says PHP's final fix commit landed on October 18, one day after Amazon's sighting.
• The leak came later. The PHP Foundation says the two CVE IDs began circulating around 15:00 UTC on October 20. That is three days after the attempt.
• The leak's content is disputed. PHP says no technical details leaked. ELLIO and The Hacker News say details and a proof of concept did. Either way, it does not explain October 17.

Speculation, clearly labeled: the early actor could have found the same bugs on their own. They could also have had access through someone in the disclosure chain. No source has shown either. Amazon only says that an embargo protects defenders until someone else finds the same bug. ThreatWire makes no claim about who it was.

Timeline

All times UTC. Sources are in brackets.

• Oct 17: MadPot logs an exploit attempt from anonymized infrastructure [Amazon].
• Oct 18: PHP's final fix commit [ELLIO].
• Oct 20, ~15:00: the CVE IDs leak online. PHP moves the release up a day, to October 21 at 14:00 [PHP Foundation].
• Oct 21, ~02:00: Amazon sees several PoC exploits. Attempts from more anonymized hosts follow until about 08:00. Payloads vary, which points to several actors [Amazon].
• Oct 21, 03:02: Cloudflare's WAF protection is on by default for customers [Cloudflare].
• Oct 21, 07:41: Chainguard publishes fixed images early, breaking the embargo [PHP Foundation].
• Oct 21, 08:36: the first PHP2Shell request hits ELLIO's sensors [ELLIO].
• Oct 21, 14:00: PHP releases the fixes and advisories [PHP].
• After 14:00: more PoCs appear within hours and hit Amazon's sensors almost at once [Amazon]. ELLIO sees exploit-shaped traffic from 16:05 and a multi-bug bot by 20:40.
• Oct 22, 02:08: Pantheon says it has blocked over 60,000 probing requests [Pantheon].

After the patch

Amazon now says PHP2Shell is being broadly exploited in the wild.

Other telemetry fits. VulnCheck's canaries saw a scanner with a PHP2Shell user agent from 08:37 UTC on October 21. Cloudflare says attackers kept changing payloads to slip past its rules. VulnCheck says it had a working exploit for CVE-2026-109618 for its paying customers by early October 22.

Defenders also have an awkward gap. Several of the October 21 attempts came before the 14:00 UTC release, after the IDs leaked.

Verified vs. not verified

Verified by primary sources:

• Amazon logged a PHP2Shell attempt on October 17 from an anonymization network.
• Multiple actors sent PoC exploits from about 02:00 UTC on October 21.
• Amazon calls exploitation broad and in the wild.
• Neither CVE is in the CISA KEV catalog (catalog 2026.10.21, checked October 22).
• CISA's October 21 alert said it had not seen exploitation at publication time.

Not verified:

• How the October 17 actor got the details.
• The exact time of the October 17 attempt.
• Whether any attempt led to a real compromise. No confirmed breach is public.
• Which of the two CVEs the October 17 attempt targeted. Amazon does not say.

Indicators, at a high level

Amazon published six IP addresses: one from October 17 and five from October 21. Amazon says they belong to shared anonymization infrastructure. It advises investigating hits rather than blocking them outright. The full list is in Amazon's post.

Amazon also suggests checking for POST form uploads that carry PHP's session upload progress field. That is the feature behind one path of CVE-2026-109619.

What to do now

1. Patch in hours, not weeks. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's fixed build. Restart every PHP worker.
2. Start your hunt on October 17. Do not assume nothing happened before October 21. Amazon says compromise may predate the advisory.
3. Search logs for Amazon's IPs. Treat a hit as a lead to investigate, not proof.
4. Look at behavior, not signatures. Watch for PHP workers starting shells or download tools. Look for memory-limit errors after unusual multipart POSTs, and unexpected files in web roots.
5. If you cannot patch today, consider blocking multipart uploads where your app allows it. Use a WAF as a bridge only. Follow the interim settings in our PHP2Shell explainer.
6. If you find signs of compromise, isolate the server, keep logs, and rotate secrets it handled.

Related coverage

Full records: CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state).

Background and fixes: PHP fixes two critical RCE flaws (PHP2Shell). Track exploitation in the actively exploited CVEs list and the CVE tracker.

Sources: Amazon Threat Intelligence, AWS, the PHP Foundation, PHP's php-src advisories, CISA, Cloudflare, ELLIO, VulnCheck, Pantheon and The Hacker News. Links are in the references list.