Amazon: attempt to exploit PHP2Shell recorded on October 17, four days before disclosure; the flaws are now "broadly exploited"History·PHP2Shell vulnerabilities found by SI: disclosure and attacks
Attacks on the PHP vulnerabilities found by SI began before disclosure, so defenders had less time than it seemed.
Research by Amazon Web Services published on Wednesday evening shows that at least one attacker tried to use the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) as early as October 17, four days before public disclosure; AWS noticed it while reviewing logs of one of its honeypots. According to Amazon, the vulnerabilities are now "broadly exploited in the wild" (Wired, Ars Technica). The US NSA publicly advised organizations that cannot update immediately to take their sites offline; according to Al Jazeera, authorities in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic temporarily took some government sites offline, and Japanese Prime Minister Sanae Takaichi warned of the risk. The bugs, which went unnoticed for more than ten years, were found with the help of models from OpenAI and Google (Ars Technica). In Russia, the National Coordination Center for Computer Incidents under the FSB ordered critical-infrastructure operators to temporarily take sites offline if PHP cannot be updated quickly (per Izvestia's description).