Amazon Says PHP2Shell Was Attacked Four Days Before the Public Knew

Amazon Threat Intelligence says it recorded an attempt to exploit the PHP2Shell flaws on Oct. 17, 2026, four days before the vulnerabilities were made public and patched. The company published the finding Oct. 21, 2026, on the AWS Security Blog, in a post signed by CJ Moses, Amazon's chief information security officer.

Amazon's advice to security teams follows from that date: begin investigations from the earliest known exploitation rather than from the day a flaw is disclosed, which for PHP2Shell means Oct. 17, 2026. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, let an attacker run commands on a vulnerable web server.

Amazon says the attempt reached MadPot, its network of decoy servers, and came from an address belonging to a commercial anonymization service. Because the target was a decoy and the flaws were still under embargo, the company reads the activity as the work of a threat actor. It says it remains unclear how whoever was behind it obtained exploit information before disclosure.

Amazon says more attempts followed on the day of disclosure, hours before the embargo was due to lift. They came from other anonymized infrastructure and carried different payloads, which the company reads as the work of several actors. Its technical analysis is continuing, and Amazon says it is unclear whether any of the attempts would have succeeded against real systems.

Dataminr's Threat Research and Cyber Engineering team published a different reading on Oct. 22, 2026. It reported that activity seen since the flaws were disclosed has been limited to scanning, fingerprinting and exploits that do not work, with no known compromises, and that working exploit code is only a matter of time.

The PHP project released emergency patches for both flaws when the embargo lifted. Amazon says upgrading to the fixed PHP versions is the only complete remediation, and that no configuration change on its own covers both bugs.