Amazon Threat Intelligence has disclosed that attackers were already probing a critical flaw in PHP, dubbed PHP2Shell, days before the software's maintainers shipped a fix. The finding, drawn from Amazon's MadPot honeypot network, pushes back the known start of exploitation and complicates efforts by security teams to establish when their own systems were first exposed.
According to Amazon, the first exploitation attempts were detected on 17 October 2026, four days before PHP released official patches on 21 October. The initial attack was carried out through an IP address masked by a commercial anonymity network, which has made attribution difficult. The vulnerability is tracked under two identifiers, CVE-2026-109618 and CVE-2026-109619, and carries a severity score of 9.2 out of 10. It allows remote code execution and affects every version of PHP from version 5 onward, putting hundreds of thousands of servers worldwide at theoretical risk.
CJ Moses, Amazon's Chief Information Security Officer, oversees the threat intelligence effort that identified the early activity. Separately, the security firm watchTowr confirmed active exploitation through its own monitoring network, Attacker Eye, beginning on 21 October, the day the patch was made public. Proof-of-concept exploits began circulating publicly only a few hours after the patch was released at 14:00 UTC, giving defenders a narrow window to apply fixes before working code was widely available.
A revised timeline for defenders
The four-day gap between first exploitation and patch release is the detail unsettling security teams. Investigations that assumed systems were safe until 21 October now need to be reopened to cover the preceding days, a process that is slower and costlier once logs have aged or rotated out of retention windows.
For European operators, including firms running bitcoin-adjacent infrastructure built on PHP, the revised timeline matters because it means any compromise assessment anchored to the patch date alone would miss the earliest activity. Given PHP's broad footprint across web services, exchanges, custodial tools and back-office systems that touch crypto operations across the continent, the practical question for many teams is no longer whether they patched in time, but whether they are looking far enough back.
Charles Guillemet, Chief Technology Officer at Ledger, holds a role that places him among the industry figures tracking infrastructure risk of this kind, underscoring that the exposure extends beyond conventional web hosting into environments adjacent to digital asset custody.
Amazon and watchTowr have not disclosed how early details of the flaw may have reached attackers ahead of the public patch, and no further specifics on the scope of confirmed compromises have been released.
