Amazon Threat Intelligence says its MadPot honeypots recorded an attempted PHP2Shell exploit on October 17, 2026, four days before public disclosure and PHP’s October 21 security release. The activity targeted AWS honeypot infrastructure. AWS said it could not determine whether the attempts would have succeeded against real-world systems.
What the October 17 observation establishes
MadPot recorded an attempted exploit, not a confirmed compromise of a production website. The source IP was associated with a commercial anonymization network, according to Amazon Threat Intelligence. That association does not make the address unique to this activity: AWS says its listed IPs include shared infrastructure and recommends investigating connections rather than blocking them automatically.
AWS’s recommended look-back
AWS recommends investigating PHP2Shell activity from at least October 17. Its suggested checks include requests and system activity around the same period:
| Indicator | What to examine |
| POST requests | Requests containing PHP_SESSION_UPLOAD_PROGRESS |
| Web-server activity | Suspicious activity in web-server logs |
| Process execution | Unexpected processes or commands launched by the server |
| File changes | Unexpected modifications to files |
These are signals to investigate in context. An IP match alone is not a definitive indicator, since the addresses AWS lists include shared anonymization infrastructure.
The PHP releases that fixed the flaws
The PHP Foundation identified PHP2Shell as two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and said PHP released fixes on October 21, 2026. The affected flaws could allow unauthenticated remote code execution on PHP servers under the right conditions. The Foundation describes the first as out-of-memory corruption and the second as a stale-global-state issue involving use-after-free.
The fixed versions are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. NeoTeo’s earlier coverage of the PHP security releases details the patched branches and the flaws they address.
How the disclosure unfolded after October 17
The later disclosure timeline began on October 20, when the CVE identifiers started circulating online around 15:00 UTC without technical details. At 19:30 UTC, PHP published a pre-announcement and moved the planned release forward from October 22 to October 21 at 14:00 UTC.
Around 20:00 UTC, Calif mistakenly published a limited proof-of-concept demonstration video; copies of the deleted video then circulated. The PHP Foundation said mitigation advice sent around 23:00 UTC to a few critical-infrastructure providers may also have leaked. On October 21 at 07:41 UTC, Chainguard published built images containing the fix, before PHP released the corrected versions at 14:00 UTC.
