{"id":3707,"date":"2026-10-22T16:16:53","date_gmt":"2026-10-22T16:16:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3707"},"modified":"2026-10-22T16:16:53","modified_gmt":"2026-10-22T16:16:53","slug":"someone-tried-to-exploit-php2shell-4-days-before-the-vulnerabilities-were-publicly-disclosed","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3707","title":{"rendered":"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed"},"content":{"rendered":"
\n
<\/a><\/div>\n

Amazon’s Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot<\/a> honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.<\/p>\n

\u00abThe exploit attempt originated from an IP address associated with a commercial anonymization network,\u00bb CJ Moses, CISO of Amazon Integrated Security, said<\/a> in a post shared with The Hacker News.<\/p>\n

\u00abWhile the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.\u00bb<\/p>\n

The attempt, Amazon said, was recorded from \u00ab103.216.220[.]92<\/a>,\u00bb an IP address geolocated to Australia.<\/p>\n

The activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618<\/a> and CVE-2026-109619<\/a> and discovered by researchers from Calif<\/a>, OpenAI<\/a>, and Google-owned Wiz<\/a>, the flaws can be abused to achieve pre-authentication remote code execution on affected systems.<\/p>\n

The shortcomings are present in every PHP release from the 7.x and 8.x series, and pose a risk to every reachable PHP endpoint on an affected server, including static forms, login routes, and health checks. According to CrowdStrike, an attack exploiting the flaws leaves virtually no digital traces.<\/p>\n

\u00abThere is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover,\u00bb CrowdStrike said<\/a>. \u00abThe exposure is independent of the CMS, framework, or plug-ins in use.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abWorker processes remain stable, responses return HTTP 200, and application logs record no anomalies, because no application code ever ran. The only server-side trace is a single memory-limit fatal in the web server’s error log, which is routinely dismissed as noise, leaving defenders without actionable web telemetry to identify compromised endpoints.\u00bb<\/p>\n

<\/p>\n

Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC, details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time<\/a>, prompting the PHP Foundation to move the release forward by one day.<\/p>\n

\u00abBoth issues sit in parts of PHP that nearly every request touches: memory management and error handling,\u00bb the PHP Foundation said<\/a>. \u00abTheir central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.\u00bb<\/p>\n

Amazon said it detected multiple PoC exploits for PHP2Shell coinciding with the day of the release of the fixes, with the earliest attempt flagged around October 21, 2026, at 2 a.m. UTC.<\/p>\n

This was followed by additional exploitation attempts from anonymized infrastructure over the next six hours. The variety of payloads and the anonymization infrastructure used indicate that multiple threat actors are involved, Amazon Threat Intelligence said.<\/p>\n

The attempts have been recorded from the following IP addresses on October 21, 2026 –<\/p>\n