Amazon says PHP2Shell attacks began four days before patches
Amazon Integrated Security’s MadPot honeypot network detected exploit attempts targeting the critical PHP2Shell vulnerabilities four days before patches were publicly released. Cloudflare and other security firms reported a surge in exploit traffic, reaching millions of attempts within hours of disclosure, though no confirmed breaches have been reported.
Editor, Lazyfounder
TABLE OF CONTENTS
Exploit attempts began before patches were released
Attackers began targeting the PHP2Shell vulnerabilities—tracked as CVE-2026-109618 and CVE-2026-109619—on October 17, four days before patches were released, according to Amazon Integrated Security. The vulnerabilities were discovered during an August audit financed by OpenAI Group PBC, which used an AI model to demonstrate their exploitability.
Amazon’s MadPot honeypot network recorded the earliest exploit attempt on October 17, while the vulnerabilities were still under embargo. The traffic originated from an IP address linked to a commercial anonymization network, though it remains unclear how the attacker obtained the exploit details in advance.
Exploit traffic surged after public disclosure
Cloudflare observed a dramatic rise in exploit attempts following the public disclosure of the patches. Exploit traffic increased from thousands of attempts in the 10 hours before the announcement to hundreds of thousands within two hours, eventually surpassing millions.
Amazon now describes the flaws as "being broadly exploited in the wild." Despite the surge, no confirmed break-ins have been tied to the exploit traffic. Wordfence, a security firm protecting over 5 million WordPress sites, blocked more than 74,000 exploit attempts but reported no confirmed compromises.
Global organizations took precautionary measures
Organizations worldwide, including financial institutions, transportation providers, and government agencies, temporarily took systems offline as a precaution. In Japan, Nomura Holdings, Mitsubishi UFJ Financial Group, and East Japan Railway suspended some internet services, while Finland’s state IT provider, Valtori, began restoring government web services after patching overnight.
Cybersecurity agencies, including the U.S. National Security Agency, advised organizations to take systems offline if they could not be updated immediately. South Korea raised its private-sector cybersecurity alert level, citing an elevated risk of hacking.
Challenges in patch management persist
Amazon emphasized that traditional 7- and 30-day remediation windows for critical internet-facing flaws are no longer adequate, as attackers are exploiting vulnerabilities within hours of disclosure. The company recommended that investigations start from October 17 at the latest and that patch timelines be measured in hours rather than days.
At least 1 million internet-facing hosts run on PHP versions that no longer receive security updates. Updating PHP can be complex, as plugins and dependencies may tie applications to specific versions, risking disruptions to business operations.
Michael Centrella of SecurityScorecard noted that while AI-driven tools are accelerating vulnerability discovery, organizations still struggle to patch known vulnerabilities quickly. "We’re still struggling to patch the systems we already know are vulnerable," he said.
AI-driven discovery and the gap in remediation
This incident follows earlier Lazyfounder reporting on AI tools uncovering critical PHP vulnerabilities, which triggered global cybersecurity alerts. The use of AI in identifying vulnerabilities has accelerated discovery but also highlighted the gap between detection and remediation, a challenge operators continue to face.
The August audit financed by OpenAI Group PBC demonstrated how AI models can identify vulnerabilities that may have otherwise gone unnoticed for years. However, as experts noted, finding vulnerabilities faster does not necessarily translate to faster fixes, particularly for organizations with complex dependencies.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
The PHP2Shell incident underscores a growing challenge for founders and operators: the window between vulnerability disclosure and exploitation is shrinking rapidly. Amazon’s recommendation to measure patch timelines in hours rather than days reflects a new reality where attackers act faster than traditional remediation cycles allow. For startups and enterprises relying on PHP or other widely used software, this incident is a reminder to prioritize real-time monitoring, automated patch management, and contingency planning for critical systems.
The fact that no confirmed breaches have been reported despite millions of exploit attempts suggests that proactive measures—such as those taken by Cloudflare, Wordfence, and affected organizations—can mitigate risk. However, the incident also reveals the fragility of systems tied to outdated software versions, particularly when dependencies complicate updates. Operators should assess their exposure to unsupported software and evaluate whether temporary shutdowns or alternative protections are viable stopgaps.
Related on Lazyfounder
Sources
- SiliconANGLE · 2026-10-22
PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
