Amazon warns that hackers tried exploiting PHP2Shell bugs before disclosure
Amazon just spotted hackers trying to exploit new PHP bugs, called PHP2Shell, even before the flaws were made public.
These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were targeted starting October 17, days ahead of their official announcement.
Amazon is urging organizations running PHP to "upgrade to patched PHP versions immediately" to avoid getting caught up in these attacks.
Amazon advises considering blocking multipart uploads
The first hacking attempt came from an anonymized network, and between 2am and 8am UTC on October 21, more attempts came from different anonymized sources, so it's not just one group behind this.
Amazon says the window between patch releases and real-world attacks is shrinking fast, so quick updates are key.
They also recommend that organizations unable to patch right away consider blocking multi-part file uploads after assessing the impact on their applications, checking your server logs for anything weird, and being careful about investigating linked IP addresses since they're all connected.