The First PHP2Shell Exploit Attempt Came October 17. Millions Followed Within Hours.
The attackers kept their own calendar: a lone probe on October 17, multiple actors by the morning of October 21, millions of attempts within hours of disclosure — and a warning that compromise may predate the advisory.
Amazon’s threat-intelligence team found it in its own trap: a PHP2Shell exploitation attempt dated October 17, four days before the flaws were publicly disclosed. The request came from an IP address tied to a commercial anonymization network, geolocated to Australia, and hit MadPot, Amazon’s network of decoy servers built to lure attackers and record what they do. While the vulnerability was still under embargo, the team wrote, the targeting of a honeypot from an anonymized address “suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.” An Amazon spokesperson later described the October 17 activity as largely a one-off probe. One probe, four days early. No one can say how the attacker knew.
The flaws (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the severity scale) were under a coordinated embargo set to lift at 14:00 UTC on October 21. Maintainers, security firms and AI labs had spent two months preparing fixes in the quiet before anyone went public.
By 02:00 UTC on October 21, about twelve hours before the embargo lifted, Amazon was seeing multiple proof-of-concept exploits in the MadPot telemetry. Between 02:00 and 08:00, more attempts arrived from other anonymized infrastructure, and the payloads and anonymization choices differed enough that Amazon read them as multiple separate actors. Whether any of those attempts would have worked against a real system is still unknown. The analysis is ongoing.
At 03:02 UTC that morning, Cloudflare switched on default firewall protections for the two flaws, hours before any patch existed. The company has since said attackers are tweaking their payloads to slip past its web application firewall, apparently using feedback from blocked requests to work out what might get through. “Cloudflare has observed exploit attempts, including spikes of thousands of attempts,” Daniele Molteni, the company’s director of project management, told USA Today. “We also saw attackers modifying their tactics to try to bypass protections.”
The day’s cleanest before-and-after came from watchTowr. At 11:26 UTC on October 21, the firm reported no exploitation in the wild. At 14:00, PHP published the fixes: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. At 14:19, nineteen minutes after the patches shipped, watchTowr reported active exploitation attempts against both flaws.
At 22:36 UTC, Amazon declared PHP2Shell broadly exploited in the wild. Security firm Hadrian, which had warned the same day that the flaws were being “exploited in the wild at scale,” said most of the attacks it observes abuse PHP’s session upload-progress path and that it expects more exploit paths to appear before and after the fix ships. VulnCheck, meanwhile, said it had built a working exploit for CVE-2026-109618 that bypasses ASLR on x86-64 machines, and is sharing it privately with some customers.
Matthew Prince posted the count on October 22. “Some stats on #php2shell,” the Cloudflare CEO wrote on X. “In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.” The curve crosses two orders of magnitude in about two hours.
None of the October 20 leak channels can explain the October 17 probe. The two CVE numbers began circulating online around 15:00 UTC on October 20, with a wrong severity score of 10.0 instead of 9.2 and no technical details. PHP issued its advance warning at 19:30 that evening and moved the release forward a day. Around 20:00, Calif mistakenly published a video of its working proof of concept, which spread after it was deleted. Every public channel postdates the first probe. What remains is the embargoed coalition itself — or an attacker who found the flaw independently. Amazon doesn’t say, and neither does anyone else.
CrowdStrike’s description of the exposure is the starkest in the field: “There is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover. The exposure is independent of the CMS, framework, or plug-ins in use.” An attack exploiting the flaws, the firm added, leaves virtually no digital traces. Amazon published the six source addresses behind the attempts it logged: 103.216.220.92 on October 17, and 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188 and 95.217.98.37 on October 21 — with a note that they are shared anonymization infrastructure, not attacker infrastructure, and that defenders should investigate sightings rather than block them.
The servers absorbing all of this are, overwhelmingly, the ones that can’t be fixed. At patch time, OX Security’s Shodan sweep found 245 patched servers out of roughly two million (99.99 percent unpatched), and about 99 percent of the identified affected hosts were still unpatched a day later. VulnCheck’s scans put more than 1.1 million hosts on outdated, unsupported PHP versions against 403,000 on versions 8.2 through 8.5 that can actually be updated.
Amazon drew two lessons from the week, and published both. “An embargo protects defenders only until someone else finds the same bug,” the team wrote. “Defenders should not assume the public disclosure date is the earliest date of exploitation. With PHP2Shell, compromise may predate the advisory.” The second: “AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed.” The prescription that follows is blunt: for critical internet-facing flaws, measure patch and mitigation timelines in hours, because “a 7-day or 30-day SLA assumes a delay that no longer exists” — start investigations from October 17 at the latest, and build detections that don’t wait for a CVE-specific signature, because “the first exploitation will often come before those signatures exist.”
The patch sprint left its own casualties. Mitsubishi UFJ Financial Group temporarily suspended some internet services as an emergency measure, and Japan’s Finance Ministry took parts of its websites down while security work was done. BambooHR took services offline, and the Dutch anonymous crime-reporting site Meld Misdaad Anoniem was still dark on Thursday morning. “Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches,” Binance founder Changpeng Zhao wrote on X on October 21, naming the two CVEs. His warning points at the visitor, not the server: a compromised machine can serve a fake version of a real site.
Neither flaw was in CISA’s Known Exploited Vulnerabilities catalog as of October 22; the catalog’s last release had gone out on October 21 at 14:04 UTC. Germany’s BSI, updating its advisory the same day, said it knew of no successful exploitation at scale yet.
