Amazon Says AWS Defences Help Protect Customers Against PHP2Shell Attacks

Amazon has revealed that its threat intelligence team detected attempts to exploit two critical vulnerabilities in PHP, a programming language used by millions of websites and online applications. The vulnerabilities, known as PHP2Shell, were tracked as CVE-2026-109618 and CVE-2026-109619. According to Amazon Web Services (AWS), its MadPot honeypot network recorded an exploitation attempt on October 17, 2026, four days before the vulnerabilities were publicly disclosed. The activity originated from an IP address associated with a commercial anonymisation network. Amazon said the incident suggested that someone may have obtained information about the vulnerabilities before the official announcement, although the company has not established how the attacker acquired the information.

The PHP2Shell vulnerabilities are particularly serious because they affect PHP’s core engine rather than a single website or application. Researchers reported that successful exploitation could allow attackers to execute malicious code remotely, potentially enabling them to compromise servers, access sensitive information or disrupt online services. The vulnerabilities received a critical severity rating, and researchers warned that affected PHP installations could be exposed even when the applications running on them had no specific coding flaw. PHP is widely used by content management systems and web platforms, including WordPress-based websites. This broad adoption means that vulnerabilities in the language itself can create security risks across a substantial portion of the internet.

Amazon also reported detecting additional exploitation attempts around the time the vulnerabilities became public. Its threat intelligence team observed multiple proof-of-concept exploits on October 21, followed by further attempts from different anonymised infrastructure. The company said the attackers used varying payloads and infrastructure, suggesting that more than one threat actor was involved. However, the detection of an attempt does not automatically mean that a targeted system was successfully compromised. Amazon’s findings demonstrate how quickly attackers can begin testing newly disclosed vulnerabilities, particularly when technical details become available online. The company warned that organisations should not assume the public disclosure date marks the beginning of exploitation, as malicious activity may occur while a vulnerability is still being investigated privately.

AWS says it uses several layers of security to help protect customers, including automated threat detection, network monitoring and intelligence gathered through its MadPot honeypot network. The system is designed to identify suspicious activity and help security teams respond to emerging threats. Amazon reported that its infrastructure automatically detected and restricted malicious scanning attempts associated with PHP2Shell. However, this protection should not be interpreted as proof that every vulnerable application hosted on AWS is automatically secure. Customers remain responsible for managing software and configurations within their own environments, depending on the services they use. Amazon has advised organisations running affected PHP versions to install the appropriate security updates and examine their server logs for suspicious activity.

The incident highlights a wider change in cybersecurity: the time between the disclosure of a software vulnerability and the appearance of working exploits is becoming increasingly short. Security experts warn that artificial intelligence can help researchers discover weaknesses, but similar capabilities may also help malicious actors analyse patches and adapt existing exploits. Organisations can no longer rely solely on conventional patching schedules that allow several days or weeks for critical internet-facing systems to be updated. Amazon recommends prioritising immediate remediation, investigating potentially suspicious activity from before the public disclosure and monitoring systems for signs of unauthorised access. The PHP2Shell incident serves as a reminder that cloud security depends on cooperation between service providers, software developers and customers. Although Amazon’s monitoring provides an important layer of defence, applying security patches and investigating possible compromise remain essential steps for organisations using affected PHP software.