PHP2Shell Security Vulnerability: Attacks Before Patch Release

Attackers have begun exploiting vulnerabilities in PHP2Shell four days before the release of security updates. This information comes from security researchers at Amazon Threat Intelligence, who have closely monitored the attackers' activities. The vulnerabilities in PHP2Shell have been classified as critical, meaning they could have potentially severe impacts on affected systems. Amazon researchers noted that the attacks on the vulnerabilities started on October 19, 2026, while the corresponding patches were not released until October 23.

The attackers employed various techniques to exploit the vulnerabilities, including automated scripts that specifically searched for vulnerable systems. This approach suggests that the attackers were well-prepared and possibly had extensive knowledge of the PHP2Shell architecture. The vulnerabilities have been registered under the CVE IDs CVE-2026-12345 and CVE-2026-12346. These vulnerabilities allow attackers to gain unauthorized access to systems and potentially execute malicious code.

Amazon researchers also found that the attacks were not limited to a specific region but occurred globally. This could indicate that the attackers had a broad target audience in mind and exploited the vulnerabilities in various environments. Following the release of the patches on October 23, 2026, many companies and organizations immediately began implementing the security updates. The urgency of these measures was underscored by the severity of the attacks and the potential risks to data security.

Security researchers advise all users of PHP2Shell to promptly install the latest updates to protect against potential attacks. A swift response to the released patches is crucial to ensure the integrity of systems. Amazon has announced that it will continue to monitor the attackers' activities and provide additional information about the attacks. Security research is considered vital for early detection and combating future threats. According to Amazon, the vulnerability CVE-2026-12345 affects a wide range of systems worldwide, highlighting the need for continuous improvement and updating of security practices.