PHP2Shell Was Probed Four Days Before the Patch Existed

PHP2Shell was already being probed four days before anyone had a patch to install.

• CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in core PHP at CVSS 9.2. No flaw in your own application is needed.
• Amazon’s honeypots caught an attempt on October 17 from a commercial anonymization network, while both bugs were still under embargo. Patches shipped on October 21.
• Cloudflare went from thousands of attempts before the release to hundreds of thousands within two hours, then millions.
• Patching the binary is half the job. One of the flaws leaves state behind in a worker process that the next request on that worker reuses, so restart the pool.
• More than a million internet facing hosts run a PHP branch that no longer receives security updates.

Amazon’s advice is the part to pass upward. Measure remediation for internet facing flaws in hours, not the seven or thirty days most patch standards still assume.

Read the full analysis, PHP2Shell Was Exploited Four Days Before Anyone Could Patch It.