PHP2Shell flaws were targeted before patches, triggering global security rush

Hackers attempted to exploit two critical PHP vulnerabilities four days before patches were publicly released, according to Amazon Web Services, as governments and companies rushed to secure websites and online services.

AWS said its MadPot honeypot detected an attempt targeting the flaws, collectively called PHP2Shell, on October 17 from an address linked to a commercial anonymization network. Additional attempts appeared in the hours before the October 21 disclosure, and AWS said the vulnerabilities are now being “broadly exploited in the wild.” It remains unclear how the earlier actor learned of the flaws or whether those attempts succeeded on real systems.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated attackers to execute malicious code remotely on vulnerable servers. The PHP Foundation said details leaked before fixes were released. Executive director Elizabeth Barron told The Verge that the foundation knew of no successful remote-code-execution attack but called immediate updates imperative.

Cloudflare reported that exploitation attempts rose from thousands before the announcement to millions afterward. Governments and businesses temporarily suspended some websites and services while applying patches, including organizations in Japan and Europe.

The FBI, the US National Security Agency and Singapore’s cybersecurity authorities urged organizations to update affected PHP installations immediately. The FBI advised taking systems offline if they cannot be patched, monitoring for unusual PHP processes, isolating compromised machines and preserving server logs for investigation.