PHP2Shell flaws face millions of attacks as AWS confirms pre-disclosure exploitation
Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 are facing millions of daily exploitation attempts. Cloudflare reports attack volumes surged from thousands to millions within hours of disclosure, while AWS detected attacks beginning four days earlier. Attackers are actively tuning payloads to bypass web application firewalls. Security firm Hadrian warns that session upload-progress abuse is common, predicting further exploit paths will emerge before patches fully deploy.
Key points
- Cloudflare, led by CEO Matthew Prince, recorded thousands of PHP2Shell exploitation attempts in the ten hours before public disclosure, which escalated to millions within two days.
- Amazon Threat Intelligence detected initial exploitation attempts four days before the vulnerabilities were officially disclosed, indicating early insider or advanced threat activity.
- The two critical flaws, identified as CVE-2026-109618 and CVE-2026-109619, are primarily abused via PHP's session upload-progress path, according to security firm Hadrian.
- Attackers are dynamically adjusting their payloads using feedback from blocked requests to evade Cloudflare's web application firewall protections.
- Hadrian warned that additional exploit paths are expected to appear both before and after the official fix ships, suggesting the threat landscape will remain volatile.
A wave of attacks targeting critical PHP vulnerabilities, dubbed PHP2Shell, has intensified as security firms report millions of daily exploitation attempts. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed earlier this week, but Amazon Threat Intelligence revealed that exploitation began four days prior to the announcement. This early activity suggests that sophisticated attackers or insiders had access to the details before the broader community was aware.
Cloudflare, which monitors global web traffic, observed a dramatic spike in attack volume following the disclosure. CEO Matthew Prince noted that thousands of attempts were recorded in the ten hours before the announcement. Within 45 minutes of the public release, this number jumped to tens of thousands, reaching hundreds of thousands within two hours and climbing into the millions since. Notably, the attackers are not using static scripts; they are tweaking payloads based on feedback from blocked requests to bypass web application firewall rules.
Security outfit Hadrian, which first flagged the issue on October 21, warned that most attacks abuse PHP's session upload-progress path. The firm expects more exploit paths to emerge before and after the fix ships. For global developers, this means patching is urgent, but monitoring for novel attack vectors remains critical until the ecosystem stabilizes.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
