PHP2Shell Exploitation Started Days Before Patches

Amazon's threat intelligence team has disclosed that attackers were already scanning for servers vulnerable to the PHP2Shell flaws—tracked as CVE-2026-109618 and CVE-2026-109619—on October 17, a full four days before the PHP Foundation shipped fixes on October 21. The earliest probing reportedly came through anonymization infrastructure, and after the bugs leaked online on October 20, proof-of-concept code spread rapidly, prompting Cloudflare, WatchTowr, Hadrian, Patchstack, and JFrog to independently confirm mass scanning and exploitation attempts both before and immediately following the official disclosure. Cloudflare's CEO reported thousands of exploitation attempts in the ten hours before the announcement, scaling to millions shortly after, though many circulating exploits are reportedly buggy or fake. Researchers estimate over a million internet-facing PHP installations—many running end-of-life versions—remain unpatched, and CISA has pushed organizations to urgently upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with some experts comparing the potential scale of fallout to the Log4Shell incident.