Amazon Threat Intelligence detected an attempt to exploit the PHP2Shell vulnerabilities on October 17, 2026, targeting its MadPot honeypot service. This activity occurred while the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were still under embargo. The initial exploit attempt originated from an IP address linked to a commercial anonymization network, suggesting a deliberate action by a threat actor. How the actor obtained exploit information before public disclosure remains unclear.
The PHP Foundation announced an out-of-band security release for October 21, 2026, to address the two critical remote code execution (RCE) flaws. Both vulnerabilities received a CVSS v4.0 score of 9.2, indicating their severity. They allow an unauthenticated attacker to run code on a PHP web server. The vulnerabilities affect all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Details of the vulnerabilities, including their CVE identifiers, leaked online on October 20, 2026, ahead of the scheduled disclosure. This leak accelerated the circulation of proof-of-concept (PoC) exploits. Roughly 12 hours before the public disclosure, Amazon identified multiple PoCs for PHP2Shell from additional anonymized infrastructure, indicating involvement from multiple threat actors. After the embargo was lifted and patches were released, additional PoC exploits appeared rapidly and were immediately used against Amazon's sensors, leading to widespread exploitation.
In response to the vulnerabilities, several European governments, including the Netherlands, Denmark, France, and Finland, temporarily took some websites offline as a preventive measure. In Canada, the Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, announced that some federal government websites were taken offline temporarily as a precaution. Solomon urged all organizations using PHP to update their systems as soon as possible. The US Cybersecurity & Infrastructure Security Agency (CISA) also encouraged organizations to apply the new patch from the PHP Foundation.
The flaws had reportedly existed in the PHP codebase for years, with some tracing the vulnerable code back to PHP 5.4, released in 2012. Cybersecurity firms Calif and Wiz independently discovered the vulnerabilities with the assistance of AI tools. Wiz researchers stated that exploiting these flaws required a complex chain of steps, pushing the boundaries of what human researchers could practically achieve.
The PHP security team released emergency updates for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Experts advise immediate application of these updates and investigation for signs of compromise. Controls that limit what web-facing processes can launch, access, or connect to can reduce an attacker's options, but are not a substitute for patching. As of October 21, 2026, more than 1 million PHP servers were running unpatched software releases, with a significant portion running end-of-life PHP versions that will not receive official fixes.