Amazon detects PHP2Shell exploitation four days before disclosure

Amazon Threat Intelligence detected PHP2Shell exploitation attempts on October 17, 2026—four days before the official disclosure of CVE-2026-109618 and CVE-2026-109619. The early attack originated from a commercial anonymization network, indicating a threat actor, though how they obtained exploit information before the embargo remains unclear.

Upon the embargo’s October 21 lift at 1400 UTC, additional proof-of-concept exploits emerged within hours. Amazon identified multiple exploitation attempts across a six-hour window using varying payloads and anonymization infrastructure, pointing to involvement of multiple actors. PHP2Shell has now entered broad wild exploitation.

The incident underscores two critical shifts in threat response. Defenders cannot assume public disclosure marks the beginning of real-world attacks—exploitation may start days earlier. Additionally, AI-assisted analysis is shortening the window from patch release to working exploits, forcing security teams to treat critical internet-facing vulnerabilities with hour-scale response times instead of traditional week or month-long SLAs. Amazon recommends immediate patching as the only complete remediation, launching investigations from earliest known exploitation, and developing detections independent of specific CVE signatures.