Add as a preferred source on GoogleAmazon Logged PHP Exploit Attempts Before Oct. 21 Fixes
The PHP Foundation moved its planned release up one day after the flaws’ CVE identifiers began circulating on Oct. 20.
Amazon’s MadPot honeypot network recorded an attempted PHP2Shell exploit on Oct. 17, four days before fixes for two vulnerabilities that allow unauthenticated remote code execution on servers handling web requests became available.
The traffic came from an IP address associated with a commercial anonymization network. The honeypot observation does not establish that anyone compromised a live PHP server.
The PHP Foundation moved its planned security release from 10 a.m. ET Oct. 22 to 10 a.m. ET Oct. 21 (1400 UTC), after the CVE identifiers began circulating around 11 a.m. ET Oct. 20 (1500 UTC). The fixes cover PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Amazon recorded multiple proof-of-concept exploit attempts beginning around 10 p.m. ET Oct. 20 (0200 UTC Oct. 21), with additional activity against MadPot through 4 a.m. ET Oct. 21 (0800 UTC). CVE-2026-109618 involves out-of-memory corruption, while CVE-2026-109619 involves stale global state. Both carry a 9.2 Critical rating under CVSS v4.0.
The later attempts followed MadPot’s Oct. 17 pre-disclosure detection.
Simon Yoon
ReporterSimon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to info@tokenpost.com.