Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Summary: Amazon's Threat Intelligence team detected an attempt to exploit the PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot, four days before the flaws were publicly disclosed, originating from IP address 103.216.220[.]92, geolocated to Australia and tied to a commercial anonymization network. The two PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS, allow pre-authentication remote code execution across every PHP 7.x and 8.x release, and the PHP Foundation moved its coordinated disclosure forward by one day to October 21, 2026, after CVE details and a proof-of-concept leaked.
Key Takeaway: An exploit attempt arrived four days before disclosure from an anonymized IP, and CrowdStrike notes successful exploitation leaves no authentication bypass, no session theft, and no application log entry - only a single memory-limit fatal in the web server error log that gets dismissed as noise. With Modat counting 4.38 million internet-facing PHP services as of October 20, 2026, and 79% of them on unsupported branches, the defenders' telemetry gap is the exposure.