PHP2Shell attempts predate emergency patches, prompting checks for earlier intrusions

Attack attempts began before the accelerated release

AWS identified a PHP2Shell exploitation attempt dated October 17 in its MadPot honeypot telemetry, four days before emergency patches became available. It also observed attempts between 02:00 and 08:00 UTC on October 21, before the scheduled 14:00 UTC disclosure, followed by broader activity after release. AWS does not know how the October 17 actor obtained exploit information or whether the analyzed attempts would have succeeded against real systems. [1]

The PHP Foundation says premature circulation of CVE identifiers on October 20 prompted it to advance the planned October 22 release by one day. Those identifiers initially carried an incorrect severity score of 10.0; PHP rates both vulnerabilities at CVSS v4.0 9.2. Our operational inference from the earlier AWS activity is that installing the fixes cannot, by itself, settle whether a system was previously compromised. [1][2][3]

The flaws affect PHP itself, with configuration-dependent paths

PHP2Shell covers two runtime vulnerabilities. CVE-2026-109618 involves memory exhaustion interrupting initialization, followed by cleanup processing invalid internal data. Its advisory describes an Apache mod_php attack path before application code executes. CVE-2026-109619 concerns references to freed request memory surviving into another request handled by the same worker. Exploitability depends on the operations, configuration and state involved, rather than every PHP website presenting an identical target. [5][6]