Amazon reports attempted exploitation of PHP2Shell vulnerabilities as early as October 17

Amazon recorded an attempt to exploit the PHP2Shell vulnerabilities on October 17, 2026, on its MadPot honeypot network, its Threat Intelligence team said in a post published on October 21. It reports further attempts on October 21, between 2 a.m. and 8 a.m. UTC, as well as after the PHP patches were released.

MadPot uses decoy systems to attract and observe attacks. The October 17 attempt preceded the public leak of the vulnerabilities on October 20. Amazon does not know whether the attempts would have worked against real servers.

SecurityWeek also reports attempts detected by other companies. WatchTowr observed no successful exploitation, the outlet says.

How the vulnerabilities affect PHP

The vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect the PHP engine. A memory error can interrupt a request while internal data is improperly initialized. State associated with an earlier request can also persist after its memory is freed. Under certain conditions, these flaws can allow remote code execution, memory reads or service disruption.

PHP installations that process web requests are affected depending on how they are exposed. PHP considers the risk particularly high for mod_php, which integrates PHP into the Apache server. In a demonstration described by the project, an unauthenticated request triggers the attack before the application code runs.

As of October 22, W3Techs estimates that PHP is used by 69.3% of websites whose server-side language is known. This measure gives an idea of PHP's prevalence, but does not count vulnerable sites.

Vulnerabilities discovered with AI assistance

As part of OpenAI's Patch the Planet program, Calif discovered one of the vulnerabilities with GPT-5.6 Sol, OpenAI says, adding that Wiz independently discovered both vulnerabilities. Wiz describes using artificial intelligence models to develop and adapt proof-of-exploit demonstrations. It has not been established whether the actors behind the attempts observed by Amazon used AI.

The PHP Foundation notes that a related underlying issue was identified in 2024, with no exploitation demonstrated at the time.

Patches for several versions

On October 21, PHP released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators can inventory their environments, install the appropriate update, restart processes and check the version actually running.

For PHP 8.1 and older versions, administrators can look for a backported patch from their vendor or migrate to a supported version. PHP also provides minimal source patches for versions 7.4, 8.0 and 8.1.

Configuration changes alone do not constitute a complete fix. Amazon also recommends examining logs from October 17 onward for suspicious activity.