Two serious vulnerabilities in PHP, disclosed on October 21st, had been targeted by attacks for four days. Amazon Web Services (AWS) detected the first suspicious activity on October 17th while analyzing its monitoring systems.
These flaws, known as PHP2Shell, allow attackers to attempt remote code execution on vulnerable servers and were rated with a severity of 9.2 out of 10, forcing companies and public entities to accelerate the update of their systems.
AWS identified the first attempt originating from an IP address linked to a commercial anonymization service. Although Amazon considers this behavior a possible malicious action, it is not yet clear how those responsible learned about the vulnerability before the public announcement.
The situation escalated on Wednesday when AWS identified multiple pieces of evidence and new exploitation attempts coming from other infrastructures. The diversity of codes and services used points to the possible involvement of several actors.
Despite the numerous detected attempts, there is no confirmation that these initial actions managed to compromise actual servers. Elizabeth Barron, Executive Director of the PHP Foundation, told The Verge that no confirmed cases of successful exploitation have been registered yet.
After the patches were published, code capable of exploiting the flaws emerged quickly. The vulnerabilities are designated as CVE-2026-109618 and CVE-2026-109619, and their impact is worrying, given that PHP is the foundation of much of the web and popular platforms like WordPress, which is used to manage everything from blogs to online stores.
In Brazil, there were service interruptions at Anatel and the Electronic Information System (SEI) went offline while government agencies updated their servers to mitigate risks.
AWS reports that PHP2Shell is being exploited on a large scale across the internet. Even without proof of successful remote code execution, the volume of attempts reinforces the urgent need for administrators who have not yet applied the fixes.
Amazon also highlighted the role of artificial intelligence in this emerging scenario. According to the company, AI-assisted tools reduce the time required to discover an efficient attack method.
The issues that led to PHP2Shell had been debated since 2024. Previous correction attempts faced the dilemma of potentially causing incompatibility with existing systems and generating new security flaws. The PHP Foundation expressed its intention to review its procedures to ensure that critical vulnerabilities receive faster decisions in the future.
The PHP project released versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix the two flaws, recommending immediate updates. Developers warn that no configuration can completely eliminate risks without installing these new versions.
Additionally, AWS advises users to review their server logs, look for unexpected process executions, and check for any suspicious file modifications dating back to October 17, 2026.