Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

What happened

Attackers are sending millions of attempts to exploit two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Cloudflare, a company that protects websites from attacks, says the number of attempts rose very fast after the details spread. Amazon also found an attack that started four days before the patches came out.

Key numbers and facts

• Cloudflare saw thousands of attack attempts in the 10 hours before the bugs were announced.
• Within 45 minutes of the announcement, the number rose to tens of thousands.
• Within two hours, it reached hundreds of thousands. It has now passed one million.
• Amazon saw an attack attempt on October 17, four days before the patches were released.
• Both bugs have a severity score of 9.2 out of 10, which is critical.

What is PHP2Shell?

PHP is a language used to build many websites. A bug in PHP itself is serious because it can affect many sites at once. These bugs can let an attacker run harmful code on a server without logging in. Unlike bugs in one plugin or app, these bugs sit in the core of PHP.

Why it matters

Attackers are changing their attacks to get past security tools, so simple blocks may not be enough. The early attack shows that someone may have learned about the bugs before the public knowew. Website owners need to install the patches quickly. It is still unclear whether these attacks would work on real systems.

What to watch

• Whether more attacks succeed after the patches are installed.
• How the attacker learned about the bugs before they were public.
• New attack methods that try to get past web security tools.
• The dispute between the PHP Foundation and Chainguard over early patch releases.