In a significant development in cybersecurity, two critical vulnerabilities in the widely-used PHP programming language have been exploited in the wild, creating concern among organizations globally. This information was disclosed by Amazon, which reported that the exploits were targeted just four days prior to the public announcement of the vulnerabilities.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, and collectively referred to as ‘PHP2Shell,’ pose serious threats by allowing unauthenticated remote code execution (RCE) and potential server takeovers on websites utilizing any version of PHP released over the past decade, including as far back as version 5.4. According to W3Techs data, PHP is utilized by approximately 69.7% of websites that have a known server-side programming language, signifying the scale of potential impact. Many popular content management systems (CMS), such as WordPress, Drupal, Joomla, and Magento, as well as various e-commerce platforms, rely on PHP.
The discovery of these vulnerabilities came from collaboration among researchers at the California-based security firm Calif, Google Cloud’s Wiz, and OpenAI’s Patch the Planet project, with the vulnerabilities originally identified in August. Public disclosure of the vulnerabilities was planned for October 21, coinciding with the anticipated release of security patches by the PHP Foundation. However, on October 20, a pseudonymous user on the Hacker News forum leaked information about the vulnerabilities before the patches could be finalized.
In light of these vulnerabilities, numerous organizations, including French public administrations, the Dutch National Cyber Security Centre, and the University of Vienna, proactively took their websites offline to prepare for the imminent patches. Once the patches were released, the Amazon Threat Intelligence team confirmed that attempts to exploit the PHP2Shell vulnerabilities had already begun on October 17, detected through MadPot, an internal honeypot system designed by Amazon Web Services (AWS) for monitoring and disrupting cybercrime.
The exploit attempts originated from an IP address linked to a commercial anonymization network, an indication that the activity was likely conducted by a threat actor. While the exact methods of how this actor obtained exploit information prior to its public disclosure remain unclear, Amazon’s researchers noted that they saw multiple proof-of-concept (PoC) exploits for PHP2Shell begin to emerge on October 21, roughly 12 hours before the vulnerabilities were set to be publicly unveiled.
Detection of the earliest exploits occurred around 2 AM GMT on October 21, with subsequent attempts identified between 2 AM and 8 AM GMT from various infrastructures. The variations in the payloads and anonymization tactics used suggested that multiple threat actors might be involved, although the likelihood of these attempts succeeding against real-world systems remained uncertain. Subsequent PoC exploits further proliferated following the release of the patches, with immediate targeting of Amazon’s sensors observed.
Reports indicate an alarming uptick in exploitation attempts. Matthew Prince, co-founder and CEO of Cloudflare, noted that his organization recorded thousands of attempts to exploit these vulnerabilities within a short time frame before the official disclosure. Prince described how the attempts escalated drastically post-announcement, culminating in millions of attempts within a matter of hours.
Other cybersecurity entities, such as Beelzebub, Ellio, Recorded Future, VulnCheck, and WatchTowr, have corroborated evidence of exploitation attempts in the wild pertaining to both vulnerabilities.
While a detailed analysis of these exploitation attempts’ effectiveness in real-world scenarios is still pending, experts in the field, including independent researchers, have released PoC exploits for public review, a double-edged sword that could be leveraged by malicious actors targeting unpatched PHP versions.
Organizations operating with affected PHP versions are being strongly advised to apply available security patches immediately. Security fixes have been implemented for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, as it is stressed by PHP developers that updating is the sole remedy for these vulnerabilities. However, it’s crucial to note that official fixes are only available for supported PHP branches, specifically for versions 8.2 and later. Those on versions 8.1 or earlier, encompassing all PHP 7 and PHP 5 releases, are instructed to migrate urgently to a supported version, as they will not receive official fixes.
For organizations unable to apply patches promptly, additional security measures can help minimize exposure risk. Recommendations include disabling vulnerable functionalities, ensuring PHP workers are restarted post-configuration changes, and bolstering perimeter defenses by restricting unnecessary requests while maintaining appropriate resource limits to counter potential memory exhaustion.
Some vendors, such as Cloudflare, have proactively implemented security hardening measures for their customers, ensuring that users of both free and paid web application firewalls (WAF) receive protection against PHP2Shell vulnerabilities by default. However, organizations are reminded to conduct due diligence on their own security protocols and prioritize the upgrade to patched PHP versions wherever feasible to fortify their defenses against these and future threats.