AWS threat report

Critical PHP remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) are under active exploitation in the wild. Amazon Threat Intelligence reports attacks began four days before patches were released on October 21, 2026. Cloudflare detected millions of exploit attempts post-disclosure, with attackers actively adapting payloads to bypass web application firewall protections. AWS deployed WAF mitigation rules and provides guidance on using AWS WAF to protect against these flaws.

• Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabili(opens in a new tab)
• Hackers pile on PHP2Shell as AWS reveals attacks began before di(opens in a new tab)
• Amazon says PHP2Shell exploitation began 4 days before patches(opens in a new tab)
• Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabili(opens in a new tab)
• PHP2Shell Attacks Started Four Days Before Public Disclosure, AW(opens in a new tab)
• Amazon caught hackers probing PHP flaw 4 days before the fix - T(opens in a new tab)