JP — ITmedia
PHP2Shell Exploitation Attempts Observed 4 Days Before Disclosure; Amazon Urges Investigations Reaching Back Before Public Announcement
Security2 min read
Amazon says attackers tried to exploit two serious PHP flaws, nicknamed "PHP2Shell," four days before the flaws were made public. Amazon urges security teams to check their systems back to the earliest known attack, not the public announcement date.
What happened
Amazon's threat intelligence team said it saw attempts to use two "critical" PHP flaws on October 17, four days before the public announcement. The attempts were spotted by Amazon's trap system called MadPot. The PHP developers had kept the flaw details secret until they released a fix. After the fix came out, new attack code appeared within hours, and many attacks followed.
Key numbers and facts
- Two "critical" PHP flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
- The first attack attempt was seen on October 17, four days before the flaws were announced on October 21.
- Attack code started circulating on October 21 at about 11 a.m. Japan time, and more attempts were seen until about 5 p.m.
- After the fix was released, new attack code appeared within a few hours.
- Amazon says the early attempts came from IP addresses linked to a commercial anonymity network.
Some background
A flaw is a weakness in software that attackers can use to break in. Companies usually have a set time, such as 7 or 30 days, to fix serious flaws. Amazon's security chief, CJ Moses, says that AI tools can now help attackers turn a fix into attack code very quickly.
Why it matters
Keeping a flaw secret only protects people until someone else finds the same bug. Attacks can now start within hours, or even minutes, after a fix is released. Amazon says companies should track serious flaws in hours, not days. They should also look for attacks starting from the first known misuse, and invest in detection that does not depend only on patterns for each flaw. Amazon also says its own systems automatically spotted and limited scans aimed at this flaw.
What to watch
- Whether Amazon or others find out how attackers got the flaw details before the announcement.
- How many more attacks use PHP2Shell after the fix.
- Whether companies that run PHP check their systems back to October 17.
Glossary
- PHP
- A popular programming language used to build many websites.
- MadPot
- Amazon's honeypot, a trap system that lures attackers so their methods can be seen.
- CVE
- A standard code number that gives each known security flaw its own name.