- Amazon Threat Intelligence detected exploit attempts targeting the PHP2Shell flaws on October 17, four days ahead of public patches.
- Cloudflare recorded millions of malicious probes, with attackers actively trying to deliver the Potassium variant of the Mirai botnet.
- Cybersecurity authorities in Germany, the Netherlands, and Japan report no confirmed breaches, but audits back to October 17 are advised.
Discovery and Timeline of Pre-Disclosure Exploitation
Security researchers at Amazon Threat Intelligence revealed that the critical security defects collectively dubbed PHP2Shell were targeted in the wild well before official patches went live. According to Amazon Chief Information Security Officer CJ Moses, the company’s MadPot honeypot infrastructure intercepted an active exploit attempt on October 17, 2026.
The early offensive originated from an IP address routed through a commercial anonymization network. While the underlying vulnerabilities were still under a non-disclosure embargo, the mechanism through which the threat actor acquired actionable exploit code remains undetermined. Activity escalated further on October 21 at approximately 02:00 UTC-ten to twelve hours prior to patch publication-when Amazon spotted multiple proof-of-concept attacks deployed across diverse anonymized infrastructure, indicating multiple independent actors were already weaponizing the flaw.
Cloudflare Telemetry and Attack Escalation
Data provided by Cloudflare Chief Executive Matthew Prince underscores an unprecedented surge in malicious traffic aimed at the dual vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Attackers have been dynamically adjusting their exploit strings based on WAF rejection telemetry to bypass edge filtering.
| Observation Window | Exploit Attempt Volume (Cloudflare) | Observed Attack Dynamics |
|---|---|---|
| 10 hours pre-disclosure | Thousands of requests | Reconnaissance via anonymization networks |
| 45 minutes post-disclosure | Tens of thousands | Automated targeting of session upload-progress |
| 2 hours post-disclosure | Hundreds of thousands | Payload mutation to circumvent WAF rules |
| Subsequent 24 hours | Millions of requests | High-volume distribution of Mirai (Potassium strain) |
Technical Impact and Threat Landscape
Carrying a critical severity score of 9.2 CVSS, both bugs reside in the PHP core runtime memory management subsystems. Because the flaws affect the language runtime itself rather than specific content management software or plugins, an enormous proportion of the web remains exposed until patched. Cybersecurity firm Hadrian confirmed wide-scale exploitation abusing PHP’s session upload-progress vector.
Telemetric analysis indicates that adversaries have tried leveraging PHP2Shell to hijack servers into a Mirai-based botnet known as Potassium. However, turning these memory flaws into reliable unauthenticated remote code execution has proven technically complex. Government cyber authorities across Germany, the Netherlands, and Japan stated that they have observed zero confirmed system compromises to date despite the millions of inbound exploit requests.
Enterprise infrastructure teams must deploy updated PHP runtime binaries immediately, as WAF mitigation rules provide only perimeter dampening. Due to confirmed pre-disclosure exploitation, security teams must not assume safety prior to patch day; incident response plans should involve reviewing server access logs and upload-progress requests dating back to October 17.
This PHP2Shell exploit news is a huge headache. I’ve been running PHP apps for years, and while PHP is incredibly versatile, these core runtime vulnerabilities are a constant worry. I’ve found that keeping WAF rules extremely tight and regularly auditing session handling helps, but it’s a constant cat-and-mouse game. My tip: don’t just patch; review your server logs for any unusual session activity *before* the official disclosure date, if possible. It’s a pain, but better safe than compromised by Mirai.