PHP2Shell Exploitation Started Days Before Patches
Threat actors started probing for servers affected by two critical remote code execution (RCE) vulnerabilities in PHP four days before the fixes, Amazon reports.
Patches for the two flaws, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, were released on October 21, after the PHP Foundation and industry partners scrambled for weeks to build, verify, and validate them.
On October 20, both issues were leaked online, which accelerated the circulation of proof-of-concept (PoC) exploits. Multiple organizations observed the activity, but said the exploitation attempts were unsuccessful.
According to Amazon, the first PHP2Shell exploitation occurred on October 17, while the security defects were still under embargo, and originated from a commercial anonymization network.
“The targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Amazon says.
Roughly...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
