Cyber Security — 2026-10-25

Attackers Exploited Critical PHP Flaws Four Days Before Public Disclosure, AWS Reports

BLUFPre-disclosure probing confirms adversary access to exploit details before patches existed, but it is unlikely that CISA adds these CVEs to its Known Exploited Vulnerabilities catalog by November 25 given no confirmed compromise.

Amazon Threat Intelligence reported a PHP2Shell exploitation attempt in its MadPot honeypot telemetry on October 17, four days before PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21 12. AWS said the attempt came from a commercial anonymization network, that varying payloads suggest multiple actors, and that it is unclear how the actors obtained exploit information or whether the attempts would have succeeded 12. BleepingComputer reported that Cloudflare, watchTowr, Previdian, Hadrian and Patchstack also detected unsuccessful pre-disclosure attempts, and that the PHP team said published proofs of concept were non-functional 2. Cloudflare CEO Matthew Prince said attempts rose from thousands in the 10 hours before the patch to millions afterward, while Dataminr TRACE reported only scanning and non-working exploits, with no known compromises 23.

Analysis
We assess with moderate confidence that post-disclosure activity is limited to scanning and non-working exploits, because reporting is consistent and no vendor has confirmed a successful attack or compromise. Sourcing is thinner than it looks: the October 17 telemetry is AWS's alone, and the outlets repeating it did not verify it independently. Defenders should treat October 17 as the start of the investigation window, since probing before the embargo suggests some actors held exploit details before patches existed. The hit may instead be opportunistic scanning or a leak-derived test by a lone actor, given PHP's statement that early proofs of concept were non-functional. It is unlikely that CISA adds CVE-2026-109618 or CVE-2026-109619 to its Known Exploited Vulnerabilities catalog by November 25, 2026. If CISA lists either CVE, federal agencies face a binding deadline and confirmed exploitation can be treated as established. If it does not, organizations should prioritize by their own exposure and patch PHP runtimes on normal emergency timelines. Exploit reliability, especially the ASLR bypass requirement, is the variable to watch.
4 sources
  1. PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports - Security Affairs
  2. Amazon says PHP2Shell exploitation began 4 days before patches - BleepingComputer
  3. AWS says hackers tried to exploit PHP security issues days before fix — as Cloudflare CEO says it saw a huge rise in targeted attack attempts - TechRadar
  4. PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation - Datadog Security Labs

View in full brief →

UNCLASSIFIED // OPEN SOURCE