# Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

- URL: https://talkfuse.com/story/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/
- Published: 2026-10-22T12:15:00+00:00
- Updated: 2026-10-22T12:29:04+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749
- Topics: Cybersecurity, Technology

## Key points

- Exploit attempts have climbed into the millions.
- Amazon detected an attempt four days before disclosure.
- The critical PHP flaws could enable unauthenticated code execution.

## Summary

Hackers are making millions of attempts to exploit two critical PHP vulnerabilities, and Amazon says it detected an attempt four days before the flaws were publicly disclosed. The early activity raises concerns that attackers may have obtained exploit information before patches were available, leaving organisations with a longer period of potential exposure to investigate.

Cloudflare recorded thousands of attempts in the 10 hours before disclosure, rising to tens of thousands within 45 minutes and hundreds of thousands within two hours. The flaws, CVE-2026-109618 and CVE-2026-109619, have a severity rating of 9.2 and could let unauthenticated attackers run code on vulnerable servers. Amazon’s honeypots also detected multiple proof-of-concept attempts on 21 October, suggesting more than one attacker; it advises organisations to review suspicious activity from at least 17 October. Cloudflare has added firewall protections, but says patching remains necessary.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.