Exploitation attempts appeared 4 days before the public disclosure of the PHP2Shell vulnerability
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon's threat intelligence team said that on October 17, 2026, 4 days before the public disclosure of the PHP2Shell vulnerability, exploitation attempts targeting its MadPot honeypot had already been detected, with source IPs linked to commercial anonymization networks, and it is not yet clear how the attackers obtained exploitation information before disclosure. The two vulnerabilities CVE-2026-109618 and CVE-2026-109619 are located in the PHP core, have a CVSS score of 9.2, enable pre-authentication remote code execution, and affect the entire PHP 7.x and 8.x series; they were discovered by researchers from Calif, OpenAI, and Google's Wiz. Because the PoC leaked early and Chainguard released an image containing the fix ahead of schedule, the PHP Foundation moved coordinated disclosure one day earlier; after the patch was released, Amazon observed multiple exploitations from anonymous infrastructure and judged that multiple threat actors were involved.