--- title: Hackers pile on PHP2Shell as AWS reveals attacks began... description: Attackers are exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, at massive scale, and some began before the bugs were even disclosed. Cloudflare... canonical: https://daily.dev/posts/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure-h3kbdsh5n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure | daily.dev og:description: Attackers are exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, at massive scale, and some began before the bugs were even disclosed. Cloudflare... og:url: https://daily.dev/posts/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure-h3kbdsh5n og:image: https://api.daily.dev/og/posts/H3KBdsH5N.png og:image:alt: Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary Attackers are exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, at massive scale, and some began before the bugs were even disclosed. Cloudflare reports exploitation attempts jumped from thousands in the 10 hours before disclosure to millions, with attackers tweaking payloads to dodge its WAF. The flaws, CVE-2026-109618 and CVE-2026-109619, carry a 9.2 severity rating and potentially allow unauthenticated remote code execution via PHP's memory handling. Amazon's honeypot network detected exploitation attempts as early as October 17, four days before patches were released. Hadrian says most attacks abuse PHP's session upload-progress path. Amazon advises checking for suspicious activity back to October 17. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are CVE-2026-109618 and CVE-2026-109619 and how severe are they? These are two critical PHP vulnerabilities, nicknamed PHP2Shell, affecting how PHP handles memory. Both carry a 9.2 severity rating and allow unauthenticated attackers to execute malicious code on vulnerable servers. Because the bugs live in the PHP runtime itself rather than a plugin or CMS, they put a huge number of websites at risk regardless of what content management system they run. _Teams patching PHP runtimes can track emerging CVEs like this one on daily.dev._ ### Were PHP2Shell vulnerabilities being exploited before they were publicly disclosed? Yes. Amazon's MadPot honeypot network detected an exploitation attempt on October 17, four days before patches were released, from an anonymized IP address suggesting a threat actor who somehow had exploit information before disclosure. Amazon also saw multiple proof-of-concept exploits around 0200 UTC on October 21, roughly 12 hours before patches shipped, using varied payloads suggesting several independent attackers. _Security teams investigating pre-disclosure exposure can follow incidents like this on daily.dev._ ### What exploit technique are attackers using most against PHP2Shell? Most observed attacks abuse PHP's session upload-progress path, according to security firm Hadrian, which reported PHP2Shell being exploited in the wild at scale starting October 21. Hadrian expects more exploit paths to surface both before and after the fix fully rolls out. Cloudflare separately reported attackers tweaking payloads using feedback from blocked requests to evade its WAF. _Developers hardening PHP apps against RCE can keep tabs on exploit techniques via daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#php](https://daily.dev/tags/php), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure-h3kbdsh5n) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure","url":"https://daily.dev/posts/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure-h3kbdsh5n","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure-h3kbdsh5n"},"datePublished":"2026-10-22T12:16:41.601Z","dateModified":"2026-10-22T12:54:41.977Z","description":"Attackers are exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, at massive scale, and some began before the bugs were even disclosed. Cloudflare...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8398422060efb44dda811c8e95605c43?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8398422060efb44dda811c8e95605c43?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure-h3kbdsh5n","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,php,cloudflare","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure-h3kbdsh5n#faq","mainEntity":[{"@type":"Question","name":"What are CVE-2026-109618 and CVE-2026-109619 and how severe are they?","acceptedAnswer":{"@type":"Answer","text":"These are two critical PHP vulnerabilities, nicknamed PHP2Shell, affecting how PHP handles memory. Both carry a 9.2 severity rating and allow unauthenticated attackers to execute malicious code on vulnerable servers. Because the bugs live in the PHP runtime itself rather than a plugin or CMS, they put a huge number of websites at risk regardless of what content management system they run. Teams patching PHP runtimes can track emerging CVEs like this one on daily.dev."}},{"@type":"Question","name":"Were PHP2Shell vulnerabilities being exploited before they were publicly disclosed?","acceptedAnswer":{"@type":"Answer","text":"Yes. Amazon's MadPot honeypot network detected an exploitation attempt on October 17, four days before patches were released, from an anonymized IP address suggesting a threat actor who somehow had exploit information before disclosure. Amazon also saw multiple proof-of-concept exploits around 0200 UTC on October 21, roughly 12 hours before patches shipped, using varied payloads suggesting several independent attackers. Security teams investigating pre-disclosure exposure can follow incidents like this on daily.dev."}},{"@type":"Question","name":"What exploit technique are attackers using most against PHP2Shell?","acceptedAnswer":{"@type":"Answer","text":"Most observed attacks abuse PHP's session upload-progress path, according to security firm Hadrian, which reported PHP2Shell being exploited in the wild at scale starting October 21. Hadrian expects more exploit paths to surface both before and after the fix fully rolls out. Cloudflare separately reported attackers tweaking payloads using feedback from blocked requests to evade its WAF. Developers hardening PHP apps against RCE can keep tabs on exploit techniques via daily.dev."}}]} ```