Amazon spots PHP2Shell exploitation before disclosure

The flaws had existed for decades, but the complex chain of steps needed for exploitation was recently broken by AI‑assisted analysis, making the vulnerabilities among the most severe found in PHP.

Early exploitation discovered days before disclosure

Amazon’s threat‑intelligence team observed a PHP2Shell exploitation attempt on Oct. 17 2026, four days before the vulnerabilities were publicly disclosed on Oct. 21. The attempt came from an IP address tied to a commercial anonymization service and targeted the company’s MadPot honeypot, indicating a threat actor had access to exploit details before the advisory.

The variation in payloads and infrastructure suggested that several actors were involved, though it is unclear whether any attempts succeeded against real‑world systems.

After the vulnerability patches were released, attackers worldwide began mounting large‑scale exploitation campaigns. Cloudflare’s CEO reported thousands of attempts in the ten hours before the announcement, jumping to tens of thousands fifteen minutes later and millions within two hours.

To protect systems, the only complete fix is to upgrade to a supported PHP release. For environments that cannot patch right away, mitigations include disabling vulnerable multipart uploads, limiting request body sizes, and restarting PHP workers after configuration changes. AWS and Cloudflare provide Web Application Firewall rules that block known exploit vectors, but organizations should verify their own controls and prioritize patching.