Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities , with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed.

Cloudflare says it has recorded a staggering increase in attacks targeting the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, since details began circulating earlier this week.

According to Cloudflare CEO Matthew Prince , the company spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced.

That figure jumped to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and has since climbed into the millions.

And the attackers aren't simply recycling the same exploit.

Cloudflare said it has seen miscreants tweaking their payloads in an attempt to sneak past its web application firewall (WAF) protections, apparently using feedback from blocked requests to work out what might get through.

Security outfit Hadrian also sounded the alarm on October 21, reporting that PHP2Shell was being "exploited in the wild at scale." "Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships," the company warned.

More worrying, some attackers appear to have started before the vulnerabilities were even public knowledge.

Amazon Threat Intelligence says it detected an attempt to exploit PHP2Shell on October 17, four days before patches were released.

The activity was picked up by MadPot, Amazon's network of honeypots designed to lure attackers and record what they get up to.

"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Amazon said.

The retail and cloud giant said it detected multiple proof-of-concept exploits on October 21, with the earliest appearing around 0200 UTC, some 12 hours before the patches were released.

Over the following six hours, further attempts arrived from different anonymized infrastructure, using a variety of payloads.

Amazon reckons this points to multiple attackers rather than a single group.