Amazon Logged a PHP2Shell Attempt Four Days Before the Patch; Dataminr Saw Only Scanning
Security / news
Amazon Logged a PHP2Shell Attempt Four Days Before the Patch; Dataminr Saw Only Scanning
CVE-2026-109618 and CVE-2026-109619 are rated 9.2, need no credentials, and were fixed October 21. Whether anyone has actually been compromised is still disputed.
An unauthenticated remote attacker can run code on a PHP web server through a single request, and Amazon says someone tried it on October 17, four days before PHP shipped the fix. The two flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on CVSS v4.0 and sit in the PHP runtime itself, so application code does not have to be vulnerable. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
The evidence for exploitation is split. Amazon Threat Intelligence says the flaws are "now being broadly exploited in the wild." Dataminr's TRACE team says activity since disclosure "remains limited to scanning, fingerprinting," with no known compromises. No source has confirmed a successful break-in, and neither CVE was in CISA's Known Exploited Vulnerabilities catalog as of October 22.
What Amazon saw, and what it did not say
CJ Moses, chief information security officer of Amazon Integrated Security, wrote on October 21 that its MadPot honeypot logged an attempt on October 17 from an address on a commercial anonymization network. More attempts followed between 02:00 and 08:00 UTC on October 21 from other anonymized infrastructure, with varied payloads that suggest several actors. The embargo lifted at 14:00 UTC.
Amazon gave no total attempt count and no payload breakdown. It said it is unclear how the actor obtained exploit details before disclosure, and unclear whether any attempt would have worked against a real system. Its advice is to start log reviews on October 17 rather than October 21.
How the embargo failed
The PHP team had planned the release for October 22. According to The Hacker News, a leaked post on October 20 said two PHP remote code execution flaws would be disclosed that day, and PHP moved the release forward to October 21. The leak also claimed a CVSS score of 10.0, which the PHP Foundation called incorrect, per Tenable.
Around 20:00 UTC on October 20, the research firm Calif accidentally posted a video of its working proof of concept, The Hacker News reported. Chainguard published patched images at 07:41 UTC on October 21, about six hours before the official release at 14:00 UTC.
| Date and time (UTC) | Event |
|---|---|
| Oct 17 | Amazon's MadPot logs the first attempt |
| Oct 20, about 20:00 | Calif posts a proof-of-concept video by mistake |
| Oct 21, 07:41 | Chainguard publishes patched images |
| Oct 21, 14:00 | PHP releases 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Oct 21, 14:19 | watchTowr reports active exploitation attempts |
Researchers at Wiz Research, Calif and OpenAI's Codex Security team found the flaws, according to The Hacker News. The same article reports that the PHP Foundation said a "structural failure" in its decision process delayed a fix after a core developer saw signs of the memory flaw in a 2024 external audit.
Who is affected and what the patch covers
PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all in scope. PHP rates mod_php highest, because one request can trigger the bug before application code runs. For CVE-2026-109619, a use-after-free through session upload progress handling, memory disclosure is a confirmed effect. On FPM, the code-execution path depends on an operation in the running application.
| Branch | Fix |
|---|---|
| 8.5.x | 8.5.12 |
| 8.4.x | 8.4.27 |
| 8.3.x | 8.3.36 |
| 8.2.x | 8.2.35 |
| 7.4 through 8.1 | Source backports only, no release |
| 5.4 through 7.3 | End-of-life, no fix |
Distribution packages may carry the fix under an older version number, so check the changelog for the CVE IDs. Tenable cites an estimate from Silas Cutler of over 1.3 million internet-exposed hosts that may be vulnerable.
What to do before you can upgrade
Mitigations only reduce exposure. For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override. For CVE-2026-109619, set session.upload_progress.enabled=0, and on PHP 8.5 also fatal_error_backtraces=0. Restart all workers after either change. Amazon also suggests searching form-upload POST traffic for the string PHP_SESSION_UPLOAD_PROGRESS.
The same disclosure is covered from the AI-research side in OpenAI's claim that AI found the PHP flaws first, and a separate CISA-listed deadline story is the Plex2Shell four-CVE advisory.
Amazon said its analysis is ongoing. Anyone running PHP 8.1 or earlier has no official release to move to.
Sources
More in Security
- 01Quad9 Will Stop Serving France on November 24 Rather Than Block 58 Pirate Streaming DomainsThe Swiss DNS resolver says a Paris court set a €1,000 daily penalty after beIN sought €580,000, and that it cannot tell which of its users are French.
- 02eMudhra Will Exit Public TLS Certificates; G3 Is Distrusted, G1 Still IssuesThe Bengaluru company says the business is about 1% of revenue. About 30,000 certificates for one US client had to move, and the audits that passed the keys went unnamed.
- 03CISA Gave Federal Agencies Three Days on Two Plex Flaws and 14 on Two Others in the Same Exploit ChainThe four Plex2Shell bugs score between 5.3 and 8.6 individually. Chained, they give an unauthenticated attacker code execution, and miners are already landing on unpatched servers.
- 04Node.js Patches 10 CVEs, Including a Brotli Out-of-Bounds Write OpenAI's Codex Security FoundNode rates the Brotli flaw High; GitHub's record for the same CVE carries a CVSS v4 score of 9.2. The fix also lives in Google's Brotli library, not only in Node.