Attackers are exploiting two critical PHP vulnerabilities at scale, with Amazon reporting that at least one attempt reached its honeypot network four days before the flaws were publicly disclosed. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell, affect the PHP runtime rather than a particular content-management system or plugin.
Amazon Threat Intelligence said MadPot detected an exploitation attempt on October 17, while the vulnerabilities remained under embargo. The request came from a commercial anonymization network, making it difficult to identify the operator or determine how exploit information was obtained ahead of disclosure. Amazon later observed multiple proof-of-concept attempts from different anonymized infrastructure on October 21, a pattern that suggests several actors were testing the flaws rather than a single identified group.
Cloudflare separately reported a rapid escalation in exploitation attempts after details began circulating. The company saw thousands of requests before public disclosure, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and millions thereafter. Researchers also observed attackers modifying payloads in response to blocked requests, indicating active efforts to bypass web application firewall rules. Hadrian described PHP2Shell as being exploited in the wild at scale, although neither company has publicly attributed the activity to a named threat actor.
Both vulnerabilities carry a critical CVSS score of 9.2. CVE-2026-109618 involves memory corruption during out-of-memory handling, while CVE-2026-109619 involves stale global state that can be reused after memory is freed. Under the right conditions, unauthenticated remote attackers can achieve code execution on PHP systems serving web requests, including deployments using PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP and LiteSpeed. Technical details are summarized in the Canadian Centre for Cyber Security advisory.
The PHP project released fixes on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Systems running earlier releases in those branches should be upgraded immediately; the US Cybersecurity and Infrastructure Security Agency said the vulnerabilities affect PHP installations serving web requests and urged organizations to patch without delay. Cloudflare and AWS have described filtering and web-application-firewall protections that can reduce exposure, but those controls are temporary measures rather than substitutes for upgrading.
Defenders should investigate web and application-server activity from at least October 17, rather than treating public disclosure as the start of the risk window. Amazon recommends reviewing suspicious multipart upload requests containing PHP_SESSION_UPLOAD_PROGRESS, unexpected process execution and unauthorized file changes. Organizations unable to patch immediately should assess whether disabling multipart uploads is operationally feasible, while recognizing that Amazon says upgrading is the only complete remediation for both flaws.
