Early Detection of PHP2Shell Exploitation by Amazon Threat Intelligence

Amazon Threat Intelligence has uncovered evidence that threat actors were attempting to exploit PHP2Shell vulnerabilities before the official public announcement. These attempts were captured via MadPot telemetry.

📅 Timeline of Events

The exploitation attempts began well before the official disclosure of CVE-2026-109618 and CVE-2026-109619.

Analysis of Early Activity

The initial attempt on October 17 originated from a commercial anonymization network. Because this occurred while the vulnerability was still under embargo, it strongly suggests a deliberate effort by a threat actor. It remains a mystery how the actor obtained the exploit details before the official release.

⚠️ Critical Shifts in the Threat Landscape

The speed at which vulnerabilities are weaponized is accelerating. Amazon notes a fundamental change in how exploits are developed:

Previously, most attacks occurred only after a public PoC was released, as only a few elite actors could build exploits from scratch.

Now, the gap between a patch and a working exploit is shrinking. This is largely due to AI-assisted analysis, which allows a wider range of actors to convert a patch diff or a security advisory into a functional exploit within minutes or hours.

Key Takeaway for Security Leaders:

1. Patching windows for internet-facing systems must now be measured in hours, not days.
2. Forensic investigations should begin from the earliest known exploitation date (e.g., Oct 17), not the disclosure date.
3. Prioritize detections that do not rely on specific CVE signatures, as the first wave of attacks often precedes the signature.

🛡️ How AWS Safeguards Customers

AWS employs a multi-layered defense strategy to protect its ecosystem. Our internal systems automatically identify and mitigate malicious scans.

The scale of this operation is massive: $\text{Events Processed per Minute} \approx 2 \times 10^{11}$

By integrating data from the MadPot honeypot network, AWS can identify and block known exploitation patterns in real-time, providing an early warning system for the broader community.

🛠️ Immediate Remediation Steps

To secure your environment, follow these steps:

• Upgrade PHP: Immediately move to the fixed versions of PHP. This is the only comprehensive fix for both CVE-2026-109618 and CVE-2026-109619.
• Evaluate Uploads: If immediate patching is impossible, consider blocking multi-part file uploads (verify application impact first).
• Monitor Traffic: Scan logs for POST requests containing the string PHP_SESSION_UPLOAD_PROGRESS.
• Audit Servers: Check for unauthorized file modifications or unexpected process executions.

Example Detection Query

You can use a command like the following to search your web server logs for the specific indicator:

grep "PHP_SESSION_UPLOAD_PROGRESS" /var/log/apache2/access.log

🔍 Indicators of Compromise (IOCs)

The following IP addresses were observed during the exploitation attempts.

Warning: These IPs belong to shared anonymization services. Do not block them blindly; instead, investigate any traffic associated with them.

For further guidance on using the AWS Web Application Firewall (WAF) to mitigate these RCE vulnerabilities, please refer to our detailed technical blog post. If you require assistance, please contact AWS Support or start a discussion on AWS re:Post.