AWS Threat Intelligence detected PHP2Shell exploitation attempts four days before public disclosure of the two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. The earliest activity, dating to 17 October 2026, appeared in MadPot telemetry from AWS’s honeypot network. The initial target came from an IP address associated with a commercial anonymisation service, and AWS notes that the vulnerabilities were under embargo at the time.
By 21 October, multiple proof-of-concept exploits were observed, including several attempts between 02:00 and 08:00 UTC, roughly 12 hours before the scheduled public release and patch at 14:00 UTC. The payloads and anonymisation infrastructure varied, leading AWS to believe more than one actor was involved.
After the embargo lifted and fixes were released, attacks against sensors continued, with PHP2Shell described as being “broadly exploited in the wild,” though AWS cautions it has not confirmed success against real systems.
The vulnerabilities affect the PHP runtime, not a specific web application, and PHP published fixes on 21 October for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AWS states there is no configuration-only workaround that fully mitigates both CVE-2026-109618 and CVE-2026-109619, and organisations should deploy the updated PHP versions promptly. In the interim, blocking multipart file uploads may be considered where practical, but it is not a substitute for patching.
Administrators should audit web server logs for suspicious POST requests containing PHP_SESSION_UPLOAD_PROGRESS, monitor for unexpected PHP-launched processes, and look for unexplained file changes. AWS also lists six IP addresses tied to observed activity and notes that some reside on anonymisation networks, so investigation rather than automatic blocking is advised.
Cloudflare’s analysis indicates precursors to protections were in place before disclosure, underscoring the need for patched software combined with vigilant monitoring.