www.it-connect.fr
PHP2Shell: Attackers Had a Four-Day Head Start Before the Patch
On October 17, 2026, an Amazon honeypot detected an attempted exploitation of the PHP2Shell vulnerabilities. That was four days before the fixes were released, and three days before the CVE identifiers were disclosed online. The attackers were already one step ahead.
As a reminder, PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow remote code execution without authentication. If you have not patched yet, now is the time to do it! This article should help, as it mentions the fixed PHP versions and the measures to apply.
The reason I am bringing this up again today is that a report published on the AWS Security Blog states that PHP2Shell is being widely exploited. Even more importantly, the first signs of exploitation date back several days before public disclosure.
An Exploitation Attempt Before Public Disclosure
A first attempt was spotted in data from MadPot, Amazon's honeypot network. It came from an IP address associated with an anonymization network, while the vulnerabilities were still under embargo. According to Amazon, everything suggests this was a real attempt carried out by a malicious actor. But one question remains unanswered: how did they get exploit information before disclosure?
In fact, the two CVE identifiers began circulating on the Web on October 20, 2026, around 3:00 p.m. UTC, and with no technical details at all. This attempt, however, dates back to October 17, 2026, so it predates the leak itself. Are some people leading double lives?
Then everything escalated quickly. On October 21, between 2:00 a.m. and 8:00 a.m. UTC, before the embargo was lifted at 2:00 p.m. UTC, Amazon observed new attempts coming from other infrastructures. Each time, the payloads varied, suggesting that several distinct groups were involved. That said, two events clearly poured fuel on the fire:
- The accidental publication of a demo video by Calif, one of the companies behind the reports
- The release by Chainguard, on October 21 at 7:41 a.m. UTC, of images that included the patch (which, incidentally, broke the embargo).
Enough to study the patch more than six hours before everyone else...
Start Investigating on October 17, Not October 21
This Amazon report provides an important detail: a server patched on the evening of October 21 may already have been targeted earlier. That means if you are conducting investigations, do not start from October 21, but from October 17.
Amazon also shared six IP addresses in its report, but be careful: these correspond to shared infrastructures (so they should not necessarily be blocked): 103.216.220.92 (October 17), then 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188 and 95.217.98.37 (October 21).
What is certain is that these PHP flaws will attract many cybercriminals, because the attack surface is huge. For its part, VirusTotal identified around 5.1 million IP addresses running PHP, including 3.8 million with at least one open port. Among the servers that expose their version, about 758,000 are running an outdated branch, between PHP 5.4 and 8.1: admittedly, these figures have probably already changed, but they give an idea of the number of potential targets. And security patches for PHP2Shell are also available for outdated versions.
