PHP2Shell flaws were probed before disclosure as attacks surged worldwide
publishers 27articles 27first reported 22 Oct, 02:24 UTCdeveloping since 22 Oct · 8 editions
Hackers began probing two critical PHP vulnerabilities at least four days before patches were publicly released, according to Amazon Web Services, while organizations worldwide rushed to secure systems or temporarily take services offline.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, can allow unauthenticated attackers to execute code remotely on vulnerable servers. PHP developers released fixes Wednesday and urged users to update immediately.
AWS said a review of one of its honeypots found an exploitation attempt on October 17 from an address associated with a commercial anonymization network. Additional attempts were detected in the hours before public disclosure on October 21, and AWS said the vulnerabilities are now being “broadly exploited in the wild.” The company said it remains unclear how the earlier actor obtained information about the flaws or whether the attempts succeeded on real systems.
Cloudflare reported thousands of attempts during the 10 hours before the announcement, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions. The PHP Foundation told The Verge it knew of no successful remote-code-execution attempt but said patching was imperative.
The FBI advised organizations to inventory and immediately update affected PHP installations, prioritize internet-facing systems, monitor for suspicious processes and take systems offline if they cannot be patched. Governments and companies in Europe and Asia suspended some banking, airline, rail, tax and public-sector websites as a precaution. Lithuania’s cybersecurity authority identified about 100 exposed government and business websites.
HOW THIS STORY WAS MADE
Written from 8 articles, 7 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 32 h after the record first saw the story; the editor kept it as written.
- Publishers
- 27
- Source articles
- 27
- Given to the writer
- 8, 7 with the article's own text
- Independent newsrooms
- 8
- This version written
- 32 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →