Amazon caught a PHP2Shell attack four days before the vulnerability went public
Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Amazon Threat Intelligence found a PHP2Shell exploitation attempt in MadPot honeypot telemetry dated October 17, 2026 — four days before CVE-2026-109618 and CVE-2026-109619 were disclosed. The traffic came from a commercial anonymization network, suggesting a real actor had exploit details while the embargo was still in place. Once the patch shipped, working proofs of concept appeared within hours, and PHP2Shell is now being exploited broadly in the wild.
An embargo protects defenders only until someone else finds the same bug.
- andyvanosdale
If this was being probed and/or exploited on October 17th, this throws shade on the PHP team for throwing shade on Chainguard in their public announcement.
Essentially, the PHP team is deflecting and abdicating their responsibilities in all this mess they created. "Chainguard broke embargo", "support us with money", "we are just volunteers", "we had knowledge years ago but no POC because we wanted to ship features and not security fixes". All just deflections.
This fiasco shows me that I would never use PHP for any project I'm part of. The PHP team royally messed up, and they are deflecting the blame left, right, up, and down.
- hyperpape
There's also a tweet by Matthew Prince that says Cloudflare saw thousands of attempts pre-announcement, https://x.com/eastdakota/status/2113079352682570051, then tens of thousands post announcement, and now millions.
Unfortunately, if you read the announcement as referring to 14:00 UTC, that's several hours after Chainguard published their images. I don't know if it's plausible that people saw the Chainguard builds, understood the issue from those and built exploits, but a precise timeline would help understand better.
- VladVladikoff
I’ve seen probing for it in server logs but not actual exploiting of it. I think the botnets added it to their vulnerability scanners but I have yet to see any examples of an actual working exploit. There are hundreds of vibe coded attempts on github but none of them work to the best of my knowledge. Would love someone to prove me wrong here.
Also this post from Amazon is embarrassing. They knew about it from the 17th yet failed to meet the embargo timeline and patch Amazon Linux (their patch is due to be released today the 22nd of Oct).
- decidu0us9034
"Exploitation attempt" lacks clarity. The bot scanners are constantly generating huge volumes of weird traffic. Does anyone have a portable, reliable exploit that works in real heterogeneous conditions and not a lab setup, and is that even feasible? doesn't seem like it. llms automate development of practical exploits but don't remove every constraint that makes them hard to begin with. it feels like people are missing this, idk
- menomatter
Do they differentiate between attempts and successful infiltration? I’m trying to understand whether this exploit is easy to use or not. There was an article here from yesterday that argued the exploit was not easy to use and needed LFI