Amazon Detects PHP2Shell Exploitation 4 Days Before Disclosure as Broad Attacks Hit After 1400 UTC Patch
Updated
Updated · AWS Blog · Oct 22
Amazon Detects PHP2Shell Exploitation 4 Days Before Disclosure as Broad Attacks Hit After 1400 UTC Patch
3 articles · Updated · AWS Blog · Oct 22
Summary
Oct. 17 MadPot telemetry showed a PHP2Shell exploitation attempt from an IP tied to a commercial anonymization network, four days before CVE-2026-109618 and CVE-2026-109619 were publicly disclosed.
By 0200 UTC on Oct. 21, Amazon Threat Intelligence had already seen multiple proof-of-concept exploits, followed by more attempts through 0800 UTC from additional anonymized infrastructure, suggesting multiple actors.
After the embargo lifted and patches shipped at 1400 UTC on Oct. 21, Amazon said exploit code appeared within hours and was used against its sensors almost immediately, with broad exploitation now underway.
Amazon said the episode shows defenders should assume compromise can predate advisories, measure patching for internet-facing systems in hours rather than 7- or 30-day SLAs, and investigate activity starting at least from Oct. 17.
AWS urged immediate upgrades because no configuration-only workaround fully fixes both flaws; for unpatched systems it suggested temporary upload restrictions, log reviews for PHP_SESSION_UPLOAD_PROGRESS, and checks for unexpected processes or file changes.
How did hackers weaponize the PHP2Shell flaw days before the October 2026 patch, and was an insider leak to blame?
If unauthenticated memory leaks bypass application security entirely, is any internet-facing PHP server truly safe from the PHP2Shell fallout?
With AI shrinking the exploit window to zero, are traditional patch management strategies now completely obsolete against automated threats?
PHP2Shell Crisis: How AI-Discovered Memory Flaws in PHP Exposed 22 Million Servers to Unauthenticated RCE and Global Regulatory Upheaval
Overview
The PHP2Shell crisis began when AI-powered research teams at Calif and Wiz independently discovered critical PHP memory flaws in August 2026, leading to a coordinated embargo for patch development. However, early attack reconnaissance was detected by Amazon, and leaks on social media and a public proof-of-concept video by Calif accelerated exploit development. Cloudflare and Chainguard rushed to deploy emergency protections, but the release of pre-patched images allowed attackers to reverse-engineer the vulnerabilities before official patches. As exploits spread, governments and agencies took web portals offline, and international cybersecurity authorities issued emergency directives, highlighting the urgent need for rapid, AI-aware defense strategies.