PHP2Shell flaws exploited before public disclosure

Amazon’s threat intelligence team detected active exploitation attempts against its honeypot infrastructure as early as October 17, 2026, targeting critical PHP core vulnerabilities known as PHP2Shell. This activity occurred five days before the coordinated public disclosure of the flaws, indicating that threat actors had access to exploit details while the fixes were still under embargo.

What happened

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and allow pre-authentication remote code execution. Researchers from Calif, OpenAI, and Wiz discovered the issues, which affect every PHP release in the 7.x and 8.x series. The PHP Foundation originally scheduled the coordinated disclosure for October 22, 2026, at 2:00 p.m. UTC but moved the release forward by one day after proof-of-concept exploits and CVE identifiers leaked prematurely.

Amazon recorded the earliest known probe from an IP address associated with a commercial anonymization network, geolocated to Australia. CJ Moses, CISO of Amazon Integrated Security, noted that while it remains unclear how the actor acquired the information, the use of anonymized infrastructure suggests deliberate threat activity rather than accidental scanning. Following the leak, multiple other actors launched attacks using varied payloads from different anonymized IPs within hours of the patch release.

The premature exposure was exacerbated when Chainguard published container images containing the fix before the official announcement. This allowed attackers to study the binary diff and reverse-engineer the vulnerability while most users were still unaware of the risk. The PHP Foundation criticized this move, stating it disregarded weeks of coordinated effort and gave attackers a head start in developing reliable exploits.

How it works

These flaws reside in PHP’s memory management and error handling subsystems, components that process nearly every request. Because the vulnerabilities are deep in the runtime core, they do not depend on specific content management systems, frameworks, or plugins. An attacker can trigger remote code execution on any reachable PHP endpoint, including static forms, login pages, and health checks, without needing to authenticate or steal a session.

CrowdStrike highlights that these attacks leave minimal digital traces. Since the exploit occurs before application code executes, web server logs typically show normal HTTP 200 responses and stable worker processes. The only potential indicator is a memory-limit fatal error in the web server’s error log, which administrators often dismiss as routine noise. This lack of actionable telemetry makes traditional web application firewalls and log monitoring ineffective for detection.

Key details

• The vulnerabilities affect all PHP 7.x and 8.x releases, posing risks to an estimated 4.38 million internet-facing services.
• Exploitation attempts were detected as early as October 17, 2026, five days before the public patch release.
• Attacks leave almost no trace in application logs, with only obscure server-side memory errors as potential indicators.
• Over 79% of detected internet-facing PHP services run on unsupported branches, increasing the overall attack surface.
• Multiple threat actors used anonymized networks and mutated payloads to bypass initial security protections.
• Government agencies including CISA, NCSC, and NSA have issued urgent advisories to apply patches or take systems offline.

Why it matters

For software engineers and IT leads, PHP2Shell represents a severe challenge because it bypasses many standard defense layers. Since the vulnerability exists in the runtime itself, updating a CMS plugin or adjusting framework configurations offers no protection. The sheer prevalence of PHP, which powers nearly 70% of websites, means that even small, obscure services can become entry points for broader network compromise if they run vulnerable PHP versions.

The incident also highlights a shifting dynamic in vulnerability disclosure. As CJ Moses observed, AI-assisted analysis is shrinking the time between patch release and working exploit. Attackers can now rapidly analyze binary diffs from early releases, such as those from Chainguard, to build weapons before the majority of users have applied updates. This reduces the safety window traditionally provided by coordinated disclosure and demands faster internal remediation cycles.

What you can do

• Immediately update all PHP instances to the latest patched versions, prioritizing internet-facing servers.
• Audit your infrastructure to identify any PHP services running on end-of-life branches like 5.x, 7.4, or 8.1.
• Implement process-monitoring capabilities to detect unexpected shell launches or file downloads by PHP workers.
• Review web server error logs specifically for memory-limit fatal errors that may indicate exploitation attempts.
• Use tools like OpenAI’s Codex skill or vendor-specific scanners to check local binaries and websites for vulnerability.
• Consider taking non-critical PHP services offline temporarily if immediate patching is not feasible due to compatibility constraints.