PHP2Shell Vulnerabilities Were Exploited Four Days Before Patches Were Released
AWS honeypots recorded PHP2Shell exploitation on October 17—four days before patches were released—including an attempt from an anonymization network. Multiple actors targeted systems as proof-of-concept code circulated before disclosure.
Attackers began exploiting two critical PHP vulnerabilities at least four days before patches were publicly released on Wednesday, October 22, 2026, according to research published by Amazon Web Services.
The flaws, collectively known as PHP2Shell, affect PHP, a widely used web scripting language. AWS analysts discovered the early exploitation activity while reviewing logs from one of their honeypots — intentionally vulnerable servers used to study attack methods. The logs showed an exploitation attempt on October 17, originating from an IP address linked to a commercial anonymization network such as a proxy or VPN.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” wrote CJ Moses, AWS’s chief information security officer.
When patches were released Wednesday morning at 10 am ET, administrators and security teams raced to identify and update vulnerable systems. Some governments and organizations preemptively took websites offline to avoid being targeted before patches could be applied. Despite those efforts, proof-of-concept exploits began circulating publicly — some appearing hours before the official disclosure. AWS honeypots recorded multiple exploitation attempts in the lead-up to the release, using various anonymization providers and suggesting several distinct actors were involved. Moses confirmed that “PHP2Shell is now being broadly exploited in the wild,” though AWS noted it remains unclear whether any attempts would have succeeded against real-world systems.
The PHP Foundation did not respond to a request for comment.
AWS says the incident highlights a shrinking window between patch release and active exploitation, a trend the company attributes in part to AI tools that can help less technically skilled actors analyze patches and develop working exploits faster. “In the past, most exploitation we observed came after a public proof of concept was released,” Moses wrote. “AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit.”