Amazon Threat Intelligence: exploitation traced to October 17
Amazon Threat Intelligence says the first exploitation attempts against the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619, began on Saturday, October 17. The company reported that multiple proof-of-concept PHP2Shell exploits were deployed hours after public disclosure from VPN-linked IP addresses and that the initial exploit attempt "originated from an IP address associated with a commercial anonymization network."
AWS chief information security officer CJ Moses framed the activity as likely the work of a threat actor and underlined uncertainty about how exploit information reached attackers prior to disclosure: "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure." Moses added that the "actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors" and warned defenders not to assume the public disclosure date was the earliest date of exploitation.
PHP security team accelerated disclosure after an October 20 leak
The PHP security team released official patches for the two critical remote-code-execution vulnerabilities on October 21. The team had urged administrators on October 20 to prepare to install updates as soon as they became available, then moved up a targeted release window beginning October 20 after "some details on the PHP2Shell security flaws (including the two CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online."
Although some proof-of-concept code appeared before patches were public, the PHP security team said those earlier proofs of concept were not functional. PHP core developer Gina Peter Banyard warned before disclosure that "applying the official security patches is the only permanent defense."
The UK National Cyber Security Centre (NCSC) issued an urgent directive for UK organisations to immediately update PHP servers or take them offline until they could be patched, reflecting the rapid escalation in risk once exploit details spread.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMultiple security firms saw early, unsuccessful attempts
Amazon's report follows detections by several other cybersecurity companies of unsuccessful exploitation attempts that occurred prior to public disclosure. Vendors named in public reporting include Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack. Those detections align with Amazon's finding that exploitation attempts preceded the October 21 patches, though Amazon emphasized that technical analysis is ongoing and "it's unclear if any of these attempts would have succeeded in real-world systems."
Scale of exposure: PHP's ubiquity and exposed hosts
The urgency is partly driven by PHP's broad footprint: the language powers up to 80% of all websites on the Internet, including sites built on popular content-management systems such as WordPress, Drupal, and Joomla. VirusTotal is tracking more than 5.1 million PHP hosts exposed online, of which roughly 3.8 million have at least one port open to attacks, presenting a large attack surface for any remotely executable flaw.
Amazon also cited the Blue Report 2026 to underscore post-compromise risk: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments, highlighting how quickly protection can erode after an initial breach.
What this means for technologists, UK organisations, and enterprise defenders
- Technologists and security teams: The PHP core team's guidance is unambiguous — apply the official security patches. Gina Peter Banyard called patching "the only permanent defense," and patches were released on October 21 following the accelerated timeline.
- UK organisations and infrastructure providers: The NCSC instructed UK organisations to update PHP servers immediately or take them offline until patched, reflecting the leakiest and most time-sensitive operational posture for critical systems.
- Enterprise defenders and incident responders: AWS CISO CJ Moses warned that the public disclosure date may not be the earliest exploitation date and that attackers used a variety of anonymization tactics and payloads. Teams should assume incidents could predate disclosure and evaluate credential misuse, since prevention effectiveness drops sharply after attackers gain valid access.
The record in the reporting is clear on timing but not on outcome: exploitation attempts began at least four days before the October 21 patches, some exploit details and mitigation guidance leaked on October 20, and multiple vendors observed unsuccessful attempts before disclosure. Technical analysis continues, and the immediate, practical takeaway remains the same the PHP team and the NCSC set out — prioritise the official updates and, where necessary, remove vulnerable PHP servers from the network until patches are applied. Amazon and other observers leave open the central question they reported: how exploit information reached attackers prior to public disclosure.
