Amazon detected PHP2Shell exploit attempts four days before public disclosure
Amazon said its MadPot honeypot network recorded an attempt to exploit two critical PHP vulnerabilities on 17 October, four days before they were publicly disclosed and patched. The company has not established how the actor obtained the exploit details or whether any attempts would have succeeded against real systems.
Bottom line — Amazon recorded further attempts after patches were released on 21 October, but has confirmed no successful breaches or data theft.
Go deeper 6
-
Amazon tracked the flaws as CVE-2026-109618 and CVE-2026-109619; each received a severity score of 9.2, according to Tech Times UK.
-
CJ Moses, Amazon’s chief information security officer, said the first attempt came from an IP address associated with a commercial anonymisation network.
-
Tech Times UK reported that the vulnerabilities can allow unauthenticated remote code execution on vulnerable PHP systems.
-
Amazon observed additional exploit attempts after fixes became available, including activity from other anonymised infrastructure, Tech Times UK reported.
-
The PHP Foundation urged organisations running PHP to update; the UK National Cyber Security Centre advised organisations to patch immediately or take servers offline, according to NewsCord.
-
Tech Times UK said fixes were issued for supported PHP branches, while PHP 8.1 and earlier are no longer supported upstream.