Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's threat intelligence unit reported catching a probe against its MadPot honeypot on October 17, 2026, targeting the PHP2Shell flaws four days before they were officially disclosed, raising suspicion that someone had obtained exploit details while the issue was still under embargo. The two bugs, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2, affect PHP core across all 7.x and 8.x releases and allow unauthenticated remote code execution on virtually any reachable PHP endpoint, including login pages and health-check routes. The disclosure timeline was further disrupted when exploit details leaked online and Chainguard published fixed container images ahead of the embargoed release, pushing the PHP Foundation to ship patches a day early on October 21. Following the release, Amazon, Cloudflare, Pantheon, VulnCheck and others observed widespread active scanning and exploitation attempts from multiple anonymized sources, prompting urgent advisories from CISA, NCSC, FBI and NSA urging immediate patching given PHP's presence on the majority of the world's websites.