PHP2Shell attacks began four days before the patch. Check your PHP servers’ logs back to October 17

By George Bailey   Published: 10/23/26   3 min read
Cyber News

We flagged the PHP2Shell patches yesterday and told you to confirm every PHP server was on the new version. Amazon now says that was not the whole job. Its honeypots caught an exploit attempt on October 17, four days before PHP shipped the fix.

A patched server can still have been hit while it waited. Amazon’s advice is to start any investigation on October 17, not on the October 21 release date.

Amazon caught a PHP2Shell exploit attempt four days before the patch. If your server was online, check its logs back to October 17.

Amazon saw PHP2Shell attacks four days before the patch

Amazon Threat Intelligence says its MadPot honeypots recorded a PHP2Shell attempt on October 17 from an IP address tied to a commercial anonymization network. It is not clear how the attacker had exploit details while the bugs were under embargo.

Between 02:00 and 08:00 UTC on October 21, before the 14:00 UTC release, Amazon saw more attempts from other anonymized infrastructure with different payloads, which it reads as several actors. AWS CISO CJ Moses says PHP2Shell is now seeing broad exploitation attempts in the wild. Amazon says it is unclear whether any of the early attempts would have worked on real systems.

PHP servers that were online before they were patched

BleepingComputer, citing VirusTotal, says more than 5.1 million PHP hosts are exposed online. The fix only arrived on October 21, so any server that was online on October 17 had at least four days in which an attacker could have planted a web shell. Updating PHP does not remove one.

CISA’s alert asks defenders to watch for PHP worker processes launching shells or downloading tools. That check now needs to cover the days before the patch too.

Search web and process logs back to October 17

Forward this

For whoever runs our websites: Amazon says attackers were trying the PHP2Shell flaw four days before the patch came out. Being patched now is not enough; can we check our PHP servers’ logs and files back to October 17 for signs someone got in?

Details

Hunt / verify

Source: Amazon Threat Intelligence, October 21, 2026; CISA alert

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].