Amazon says PHP2Shell attacks began days before patches

Attackers have made millions of attempts to exploit the PHP2Shell vulnerabilities, two critical flaws in the PHP programming language. Amazon says the first attempt it saw came four days before patches were released. Even so, European cyber officials say hackers have had trouble turning the flaws into working attacks, which leaves open how much damage the leaked and rushed disclosure has actually caused.

A surge of attempts

Cloudflare CEO Matthew Prince said early Thursday that his company had seen "millions" of exploit attempts, Politico reported. Cloudflare counted thousands of attempts in the 10 hours before the public announcement, tens of thousands in the 45 minutes after it and hundreds of thousands within two hours, according to The Register. Cloudflare also said attackers were adjusting their payloads to try to get past its firewall rules.politico.eu+1

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 for severity and can let an attacker run code on a server without logging in. PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Security Affairs. The PHP team had to move its release date up after details of the bugs leaked online, BleepingComputer reported.bleepingcomputer.com+1

Amazon's early detection

In a blog post, Amazon Threat Intelligence said its MadPot honeypot network, a set of decoy systems built to attract attackers, recorded a PHP2Shell exploit attempt on Saturday, October 17. The attempt came from an IP address linked to a commercial anonymization network. "It remains unclear how the actor acquired exploit information prior to disclosure," wrote CJ Moses, Amazon's chief information security officer.aws.amazon.com

On October 21, Amazon saw several proof-of-concept exploits starting around 02:00 UTC, about 12 hours before the 14:00 UTC release. The payloads varied, which Amazon said points to multiple actors. The company said PHP2Shell "is now being broadly exploited in the wild" but added that it is unclear whether any of these attempts would have worked against real systems. Amazon advised organizations to look for suspicious activity going back to at least October 17, The Register reported.theregister.com

Officials see few successes

Thomas Caspers, vice president of Germany's cyber agency BSI, told Politico that the agency had seen attacks but no successful exploitation. "It seems a little bit more complicated than expected to exploit," he said. Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said there was no sign the flaw was "actively being misused," though he warned that could change.politico.eu

Several European government departments took their websites offline as a precaution. As of Thursday morning, the websites of France's justice ministry and its data protection authority were still showing maintenance notices, Politico reported.politico.eu