Amazon says PHP2Shell exploitation began 4 days before patches

The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are critical remote code execution flaws in PHP. Exploitation attempts began on October 17, 2026, four days before patches were released on October 21. The PHP security team had to expedite patch deployment due to leaked exploit information and proof-of-concept code appearing before the coordinated disclosure. Although early exploitation attempts were unsuccessful, the vulnerabilities are now broadly exploited in the wild. The PHP team and UK NCSC recommend immediate patching or taking vulnerable PHP servers offline. The vulnerabilities impact PHP versions prior to the October 21, 2026 patches, affecting a large portion of web servers globally. Official patches are the only permanent defense against these flaws.

Successful exploitation allows attackers to execute arbitrary code remotely on vulnerable PHP servers, potentially leading to full system compromise. Given PHP's widespread use powering up to 80% of websites, including major CMS platforms, the impact is significant. Early exploitation attempts before patch release indicate active interest from multiple threat actors. Post-disclosure, the vulnerabilities are broadly exploited in the wild, increasing risk to unpatched systems.

Official security patches for the PHP2Shell vulnerabilities were released on October 21, 2026, and applying these patches is the only permanent mitigation. The PHP security team and UK National Cyber Security Centre recommend immediate updating of PHP servers. Organizations unable to patch immediately should take vulnerable servers offline until patched. No alternative mitigations are confirmed effective. Monitoring for exploitation attempts is advised but does not replace patching.