Amazon says critical PHP2Shell flaws are now "broadly exploited in the wild"

As of 8:39 p.m. ET, Wednesday, Oct. 21, 2026

Two critical flaws in the PHP programming language, known as PHP2Shell, are "now being broadly exploited in the wild," Amazon said in a security blog post on Wednesday, adding that it had seen an attack attempt four days before the flaws were made public.

The post, by CJ Moses, chief information security officer of Amazon Integrated Security, said Amazon's MadPot honeypot network recorded an exploitation attempt dating to Oct. 17 from an IP address associated with a commercial anonymization network. The flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed Wednesday, when PHP released fixes. Amazon said "it remains unclear how the actor acquired exploit information prior to disclosure."

Exploitation in the wild

Amazon said it identified multiple proof-of-concept exploits starting around 10 PM ET on Oct. 20 (02:00 UTC Oct. 21), before the embargo on the flaws lifted at 10 AM ET (14:00 UTC) on Wednesday. Between then and 4 AM ET Wednesday (08:00 UTC), it recorded more attempts from other anonymized infrastructure, with payloads and infrastructure that varied, "suggesting these were multiple actors," the post said.

Amazon said its technical analysis was ongoing and "it's unclear if any of these attempts would have succeeded in real-world systems." After the patch was released, "additional proof-of-concept exploits appeared within hours, and we saw them used against our sensors almost immediately," the post said.

What Amazon recommends

Amazon urged organizations to upgrade immediately to the fixed PHP versions, saying upgrading is the only complete fix for both flaws and "there are no configuration-only workarounds that fully address both issues." It said investigations should start from the earliest known exploitation rather than the disclosure date: "For PHP2Shell, investigate from at least starting on October 17th."

PHP's security advisory says versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the two flaws, which can allow unauthenticated remote code execution, and that all PHP installations serving web requests are at risk.

What is not known

Amazon did not say how many systems had been targeted or compromised, and it did not name any affected organizations. It is not known how the Oct. 17 actor obtained exploit details before disclosure, or whether the early attempts Amazon recorded would have worked against real systems.