What happened
Amazon's Threat Intelligence team reported an attempted exploitation of the PHP2Shell vulnerabilities on October 17, 2026. The attempt was directed at one of its honeypot services. This incident was detected four days prior to the vulnerabilities being publicly disclosed, suggesting active exploitation in the wild before the release of patches. The origin of the exploitation attempt was traced to an IP address associated with a commercial anonymisation network. The incident confirms that malicious actors were attempting to leverage these flaws shortly after their emergence, highlighting the urgency of addressing exposures and monitoring for related activities.
Who is affected
Organisations running PHP2Shell deployments are susceptible to this active exploitation. While specific environments or versions are not yet identified, any affected deployment may be targeted if it remains unpatched or improperly secured. The broad exploitation in the wild underscores the importance of vigilance across all affected systems, especially those exposed to the internet or supporting web-based PHP applications.
Recommended actions
- Review network ingress points and monitor for unusual activity that could indicate exploitation attempts targeting PHP2Shell vulnerabilities.
- Implement security controls to restrict access to PHP or web server components, particularly from unauthorised sources.
- Ensure that all relevant patches or mitigations are applied as soon as they become available, and verify the configuration of PHP environments to reduce the attack surface.
- Maintain heightened awareness of unusual or suspicious traffic originating from anonymisation networks or atypical sources.
