Amazon Threat Intelligence detected an attempt to exploit PHP2Shell on October 17 — four days before patches were released — a finding that sharpens concern as attackers now rain millions of exploitation attempts against two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619.
Cloudflare telemetry: an explosion from thousands to millions
Cloudflare told researchers and customers it observed a dramatic escalation of activity after details of the PHP2Shell flaws began circulating. According to Cloudflare CEO Matthew Prince, the company saw thousands of exploitation attempts in the ten hours before the vulnerabilities were publicly announced; that count rose to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and has since climbed into the millions. The company also reported attackers were not simply replaying identical payloads but tweaking requests — apparently using feedback from blocked requests to probe for ways to evade web application firewall (WAF) protections.
Amazon's MadPot honeypot: pre-disclosure probing and multipronged attempts
Amazon reported the October 17 activity after its MadPot honeypots — designed to attract and record attacker behavior — logged an attempt from an anonymized IP address while the vulnerability was still under embargo. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Amazon said. The company also recorded multiple proof-of-concept exploits on October 21, with the earliest appearing around 0200 UTC — some 12 hours before the patches were released — and additional attempts over the following six hours coming from different anonymized infrastructure and using a variety of payloads. Amazon concluded this pattern points to multiple attackers rather than a single group, though it said whether any of those attempts would have worked against real-world systems remains unclear.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHadrian and the attack surface: session upload-progress path under siege
Security vendor Hadrian warned on October 21 that PHP2Shell was being "exploited in the wild at scale." Hadrian said most observed attacks abused PHP's session upload-progress path and warned that defenders should expect more exploit paths to appear both before and after fixes are deployed. The vendor's telemetry and Cloudflare's reports together suggest attackers have been both rapidly adapting payloads and exploring alternate exploit techniques against the PHP runtime itself.
Why these vulnerabilities hit so broadly
Both CVE-2026-109618 and CVE-2026-109619 carry a critical 9.2 severity rating and affect PHP's handling of memory in ways that could allow unauthenticated attackers to execute code on vulnerable servers. Because the flaws are in the PHP runtime rather than in a single plugin or content-management system, a vast set of websites and services that use PHP are potentially exposed regardless of which CMS or application they run. The scale of recorded probing and the rapid adaptation of payloads underline the risk that attackers will find and weaponize multiple exploit paths.
How Cloudflare, Amazon, and maintainers have responded
- Cloudflare has deployed WAF protections across its free and paid plans, but it emphasized these measures are no substitute for applying vendor patches.
- Amazon urged organizations to investigate suspicious activity dating back to at least October 17 rather than assuming systems were safe until public disclosure.
- The PHP Foundation has publicly accused supply-chain vendor Chainguard of publishing patched PHP builds before an agreed disclosure deadline, a separate controversy reported by The Register that has complicated the disclosure timeline.
What this means for technologists, enterprises, and defenders
- Technologists and security teams: expect large-scale, adaptive probing and prepare to hunt for signs of successful exploitation dating back to October 17; WAF rules can blunt volume but are not a replacement for applying the PHP fixes.
- Affected enterprises and procurement leaders: prioritize patching PHP runtimes across environments, because the flaws affect the runtime itself and therefore cut across CMSs and application stacks.
- Defenders and incident responders: examine logs for varied payloads and anonymized-source activity recorded on October 17 and October 21, and consider that multiple actors may have been testing different approaches in the hours surrounding disclosure.
The record in this episode is unambiguous on two points: the PHP2Shell flaws are severe, and attackers moved fast — in some cases before public disclosure — to probe and adapt their methods. With millions of attempts now recorded and developers racing to patch a runtime used broadly across the web, the immediate question for defenders is not whether exploits will emerge, but how many attack paths and variations will appear before the window for safe patching closes.
