Security researchers at **Amazon Threat Intelligence** have revealed that threat actors began exploiting critical **PHP2Shell** flaws as early as October 17, four days prior to the official patch release on October 21. These vulnerabilities, tracked as **CVE-2026-109618** and **CVE-2026-109619**, allow attackers to achieve remote code execution (RCE) on vulnerable systems. The **PHP** security team issued emergency patches on October 21, following a warning to administrators to prepare for immediate updates. **PHP** core developer **Gina Peter Banyard** emphasized that official security patches are the only permanent defense, while the **UK National Cyber Security Centre (NCSC)** urged UK organizations to update their **PHP** servers or take them offline. ### Premature Disclosure and Exploitation Attempts According to the **PHP** team, the coordinated disclosure plan was disrupted two days before the scheduled release when details about the **PHP2Shell** flaws, including CVE IDs and mitigation advice for critical infrastructure providers, leaked online. While some proof-of-concept (PoC) exploits were published before patches were available, the **PHP** security team stated that none were functional at that time. However, **Amazon Threat Intelligence** detected exploitation attempts beginning on Saturday, October 17. These attempts originated from IP addresses associated with commercial anonymization networks, targeting honeypots. **CJ Moses**, AWS Chief Information Security Officer, noted, "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure." ### Widespread Activity, Unclear Success Following public disclosure, attackers deployed multiple **PHP2Shell** exploits from VPN IP addresses. **Moses** added that the vulnerabilities are "now being broadly exploited in the wild," though the success rate of these attacks remains unclear. He warned that "defenders should not assume the public disclosure date is the earliest date of exploitation." Other cybersecurity firms, including **Cloudflare**, **watchTowr**, and **Hadrian**, also detected unsuccessful exploitation attempts before the public disclosure. ### Ongoing Monitoring and Impact **Dataminr's Threat Research and Cyber Engineering (TRACE)** team reported that observed activity since disclosure has been limited to scanning, fingerprinting, and the use of non-working exploits, with no known compromises. However, they anticipate that "it remains only a matter of time for working POCs or successful exploitation activity to emerge." **PHP** (Hypertext Preprocessor) is a crucial open-source web development language, powering approximately 80% of all websites, including popular Content Management Systems like **WordPress**, **Drupal**, and **Joomla**. **VirusTotal** currently tracks over 5.1 million **PHP** hosts exposed online, with roughly 3.8 million having at least one open port vulnerable to attacks. This early exploitation underscores the critical need for immediate patching and continuous vigilance in the cybersecurity landscape.