PHP2Shell Vulnerabilities Exploited Before Security Patches Were Released

Cybersecurity researchers have discovered that threat actors began targeting two critical PHP vulnerabilities several days before official security patches became publicly available, raising concerns about the exposure of millions of internet-facing servers.

The vulnerabilities, collectively known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both flaws could allow attackers to execute malicious code remotely on vulnerable systems, potentially providing unauthorized access to affected servers.

According to Amazon Threat Intelligence, the first suspicious exploitation attempt was detected on October 17, four days before the PHP security team released patches on October 21.

The initial activity originated from an IP address associated with a commercial anonymization network and targeted a honeypot operated by security researchers. Investigators believe the activity may have involved a threat actor who obtained information about the vulnerabilities before their official disclosure.

The situation escalated after details about the vulnerabilities appeared online on October 20. Multiple cybersecurity organizations subsequently detected exploitation attempts using different proof-of-concept tools.

Cloudflare reported thousands of exploitation attempts during the hours preceding public disclosure. Following the release of security patches, the company observed a dramatic increase in malicious activity, reaching hundreds of thousands of attempts within two hours and eventually millions.

Although many early proof-of-concept exploits were reportedly unsuccessful, researchers warned that attackers were actively developing and testing different techniques.

The vulnerabilities created a particularly serious risk because millions of PHP installations remained exposed. Security researchers identified more than one million internet-facing PHP servers running vulnerable software, including hundreds of thousands using outdated and unsupported versions.

PHP powers a significant portion of websites worldwide, including platforms built with popular content management systems.

Security agencies urged administrators to immediately install the updated PHP versions, including 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Organizations were also advised to identify forgotten applications, restrict unnecessary permissions, monitor suspicious server activity, and investigate potential signs of compromise.

Experts warned that PHP2Shell could become a major security incident because organizations may struggle to identify every vulnerable installation, particularly outdated systems that are no longer actively maintained.