AWS found PHP2Shell exploitation before public disclosure

MadPot telemetry picked up a PHP2Shell exploitation attempt on Oct. 17, 2026, AWS Threat Intelligence said, ahead of the public disclosure and patch release on October 21, 2026.

The PHP2Shell flaws are CVE-2026-109618 and CVE-2026-109619, critical remote code execution bugs in PHP, and both carry a 9.2 score on CVSS v4.0. The flaws affect versions from 5.4 onward, and PHP 8.1 or older no longer receive official PHP updates.

As of mid-2026, PHP runs on 70.8% of all websites with a known server-side programming language, spanning hundreds of millions of live systems. WordPress runs entirely on PHP and powers more than 43% of sites across the internet.

A CybelAngel count found roughly 2.24 million internet-facing PHP hosts, and about 1.5 million of them reported a version. Among those reporting, 883,717, or 59%, ran unsupported branches. The United States made up 228,770 of the hosts running unsupported PHP branches. WordPress.org statistics show that 35.1% of WordPress sites use an unsupported PHP version, and 16.46% of those remain on PHP 7.4.

Fixes shipped on October 21, 2026, for supported branches as versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. An emergency release was set for October 21, 2026, at 14:00 UTC, yet details leaked on October 20, 2026, before patches were available.

The first attempt used an IP address on a commercial anonymization network while the embargo period was active. AWS Threat Intelligence saw more attempts between 2026-10-21 0200 UTC and 2026-10-21 0800 UTC through different anonymized infrastructure, which AWS said points to multiple actors.

Proof-of-concept exploits appeared within hours after the embargo release at 14:00 UTC on October 21, 2026, and showed up against AWS sensors almost immediately. AWS said broad exploitation attempts appeared in the wild after disclosure. On October 21, 2026, watchTowr said it saw both CVE-2026-109618 and CVE-2026-109619 being exploited in the wild, and Datadog reported active exploitation plus broad untargeted scanning as of that date.

A detected exploitation attempt does not automatically mean a successful compromise occurred. AWS said it remains unclear whether any pre-disclosure attempts succeeded against real-world systems.

AI-assisted analysis can convert a patch or advisory into a working exploit, allowing more actors to act within hours or minutes after details become public. AI does not explain every case of early exploitation, and not every attack should be assumed to be AI-driven. Ransomnews said SOCRadar documented ransomware affiliates using commercial coding assistants for reconnaissance planning and exploit work four days before the Security Affairs piece.

Ransomnews said, according to Cloudflare, researchers at Calif.io, Wiz, OpenAI and Quarkslab disclosed the flaws on 21 October, and one of the four organizations credited with the disclosure is OpenAI. About nine hours before public disclosure, Cloudflare deployed protections after observing attack traffic. Cloudflare’s managed WAF rules have been on by default for all plans starting 03:02 UTC on 21 October.

For CVE-2026-109618, memory exhaustion partway through request setup leaves half-built internal data that cleanup code then trusts. For CVE-2026-109619, stale internal state survives the request memory it references so the next request handled by the same worker can act on that remaining data. Network access to the server is enough for exploitation, with no account or prior access needed.

Apache mod_php carries the highest demonstrated risk because an attacker request can succeed before application code runs. The Session Upload Progress feature in PHP, enabled by default, offers one confirmed path to trigger CVE-2026-109619.

Datadog said its reproduction triggers CVE-2026-109618 on PHP 8.5.11 using an unauthenticated HTTP POST request, and the request never reaches the target application’s code. Datadog said both flaws share one pattern: a fatal error interrupts PHP mid-operation, and PHP later treats the incomplete state as valid.

Datadog said a PHP worker handles many requests during its lifetime, and if PHP frees request memory without clearing worker-wide fields, a later request can follow a stale pointer into freed memory, a class of bug called a use-after-free. Datadog said successful command execution does not always crash the worker, and memory disclosure including the PHPSESSID technique can provide addresses needed for exploitation.

Remote command execution lets an attacker run commands on the server using the web process’s privileges, potentially stealing data, installing malware, altering websites, or using the server to attack other systems. Signs of detection include large multipart POST requests, memory-exhaustion errors with an Unknown line 0 location, and shells spawned by web-server worker processes.

Patching is the only complete fix because configuration-only changes do not fully address both issues. Organizations should investigate logs and suspicious activity going back to at least Oct. 17, 2026, because attacks may predate public disclosure. Defenders should measure patch timelines in hours instead of days or weeks because schedules built for delays measured in weeks are too slow for internet-facing systems.

Defenders should inventory internet-facing PHP systems, restrict access, apply temporary mitigations, and test incident response plans. Datadog said an inventory should include containers and applications that bundle their own PHP interpreter, and teams should not rely solely on the command-line PHP installation because it can use a different version or configuration than the runtime serving the web application. Some distributions ship fixed packages under existing version strings, so a host showing PHP 8.3.6 may be patched or still exposed based on the package build.

Datadog said PHP’s temporary guidance for CVE-2026-109618 is to enforce memory_limit=-1 at administrator level. It also said to pair that with request limits at the frontend and memory limits on the container, and to limit the size of decoded request bodies including requests without a usable Content-Length header. For CVE-2026-109619, Datadog said PHP’s temporary guidance calls for setting session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, applying both in configuration that loads before PHP parses the request and then restarting every worker.

watchTowr said teams should preserve PHP and web server logs, configuration snapshots and suspicious files before making changes, and should check affected systems for fresh web shells, cron jobs that were not expected or accounts created and tied to PHP processes. It also said to restart each PHP worker after teams install the update to make the fix take effect across the whole environment.

AWS recommended considering a block on multipart file uploads in PHP deployments that cannot receive immediate patches, after determining how it would affect the application. The company also recommended looking for POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string in form uploads as a detection signal. It recommended looking for unexpected process execution or file modification on web application servers.

AWS said identified IP addresses cover shared anonymization infrastructure and are not exclusive to this threat activity, so organizations should investigate observations involving these addresses rather than blocking them. AWS said its internal threat intelligence system analyzes over 200 billion events per minute through MadPot threat intelligence. AWS recommended investing in detections that do not rely on a signature for a specific CVE since the first exploitation often comes before those signatures exist.

Cloudflare added this on 23 October. CVE-2026-115560, a related flaw in the upload-progress feature, affects fully patched releases including 8.5.12 and requires a further PHP update.

UK NCSC urged organizations on October 21, 2026 to update PHP immediately or take systems offline if patching was impossible. CERT-EU advises isolating internet-facing applications when immediate remediation is not possible.

Sansec said mass exploitation would likely start within 15 minutes after the patch release. Datadog expects more such flaws to surface because the pattern leaves the door open to similar bugs in PHP. Datadog says older PHP versions may see instances of this pattern found and left unpatched.

Ransomware affiliates on hosts that never update will continue to have a long-term supply of entry points in these flaws. Users face exposure if their personal data resides on an affected system, and business impacts include service disruption, financial losses, and reputational damage.

watchTowr CEO Benjamin Harris said, “we can confirm that these vulnerabilities are indeed real.” AWS said, “Our internal threat intelligence system automatically detected and restricted malicious scanning attempts targeting this vulnerability.”