PHP2Shell: Critical Vulnerabilities Exploited Prior to Official Disclosure

Amazon Web Services (AWS) reported detecting attempts to exploit critical vulnerabilities in the PHP language on October 17, 2026, four days before their public disclosure on October 21. The flaws, collectively known as PHP2Shell, allow remote code execution without authentication on vulnerable configurations.

Following the official publication of the vulnerabilities, observed attack attempts across the network have increased significantly. Cloudflare has described large-scale scanning and exploitation activity. Both companies recommend that users urgently apply the available patches by updating to PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 depending on the branch in use.

PHP is an open-source programming language primarily used for web development, powering millions of websites and applications worldwide. Its widespread adoption makes it a prime target for cyberattacks. PHP2Shell vulnerabilities represent a particularly severe threat because they allow an attacker to execute arbitrary code on vulnerable servers without requiring login credentials.

This type of vulnerability fits into a long history of security flaws in PHP, which periodically emerge and are exploited by hackers. What makes this case unique is that exploitation attempts were detected before the official disclosure, suggesting that attackers may have already been aware of the flaws through non-public channels. The prompt response of technology companies in reporting the issue and recommending updates is crucial to limiting potential damage.