PHP2Shell: Amazon says attacks began four days before PHP shipped fixes

Attackers were already trying to exploit the PHP2Shell flaws in the PHP programming language before fixes were released, Amazon's threat intelligence team said after the PHP project shipped patches on 21 October 2026. Amazon said its network of decoy servers, called MadPot, recorded an exploitation attempt dated 17 October 2026, four days before public disclosure, and that it is now seeing broad attempts from what appear to be several different attackers. Security firm watchTowr also reported first exploitation attempts reaching its sensors as the patches landed, though it said it had not seen a successful attack. The fixes are in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

PHP is the language behind a very large share of the world's websites, including sites built on popular content management systems and countless company portals, online shops and government pages. Wiz, the security firm that helped find the flaws, has said they affect around 70% of the internet and every PHP version released in the past decade. That makes PHP2Shell one of the most serious web vulnerabilities of the year for businesses of every size.

The new development is timing. Until the patch day, the working assumption was that companies had a window to fix their servers before attackers caught up. Amazon's report that someone tried to exploit the flaw on 17 October means that window may never have existed for some targets. With detailed information leaked on 20 October and attack attempts now widespread, any business running an unpatched PHP server should assume it is being probed.

The story also shows how artificial intelligence is changing security. The weaknesses sat in PHP's code for more than a decade; researchers at Wiz and the firm Calif have said AI tools helped them understand the flaws and build a working exploit. The same tools are available to attackers, which shortens the time between discovery and attack.

For Indian businesses, the risk is direct. Many websites in India, including those of small companies and start-ups, run on PHP, often on shared hosting where the hosting company controls the PHP version. Owners of such sites need to check with their host that the update has been applied.

Short-term: IT teams and hosting providers face an urgent round of updates. Companies on old, unsupported PHP versions are most exposed and may need emergency upgrades or firewall rules.

Long-term: PHP2Shell is likely to push more companies to keep software up to date as a routine and to plan for faster attacks driven by AI. It may also increase demand for managed hosting and security services.

Who is affected: Website owners, online shops, start-ups and small businesses using PHP; hosting companies; government and institutional websites; and their customers, whose data could be exposed if servers are compromised.

Questions and Answers