PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure

Someone tried to exploit two critical vulnerabilities in the PHP programming language four days before the vulnerabilities were published and the flaws are now being exploited in the wild at scale, according to Amazon. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as ‘PHP2Shell,’ could allow unauthenticated remote code execution (RCE) and server takeover on any websites relying on any PHP version released in the last decade – going back to version 5.4.

Published 22-Oct-2026 13:39 UTC · First seen 22-Oct-2026 13:38 UTC

Sources

• Infosecurity Magazine · 22-Oct-2026