# Exploitation signals, in order

Every signal of php2shell exploitation in the captured sources, from an Amazon honeypot hit on 17 October to the KEV catalog, with what exploitation would look like on a host.

# Exploitation: the signals, in order

A remote code execution bug is not an invisibility cloak. If millions of systems were being exploited, the signals would be everywhere: honeypots, WAF logs, national CERTs, the KEV catalog. What the captured sources carry is 20 signals, from one honeypot hit four days before disclosure to one agency's unattributed *reports of active exploitation*, and no confirmed compromise of a named system. That is the state as of the latest capture, and this page will change.

| When (UTC) | Who | What | Kind | Status | Sources |
|---|---|---|---|---|---|
| 2026-10-17 | Amazon (CJ Moses, AWS Security Blog) | One exploit attempt against a MadPot honeypot from a commercial anonymisation network, four days before disclosure; 'it remains unclear how the actor acquired exploit information prior to disclosure'. | attempt | reported (primary party) | [Amazon](../sources/aws-security-blog-madpot/index.html) |
| 2026-10-17 | Amazon (CJ Moses, via The Hacker News) | One exploit attempt against a MadPot honeypot from an IP on a commercial anonymisation network, geolocated to Australia, four days before disclosure. 'It remains unclear how the actor acquired exploit information prior to disclosure.' | attempt | reported | [THN](../sources/thehackernews-php2shell-4days/index.html) |
| 2026-10-20 to 21 | Cloudflare | 'We observed attack traffic targeting our customers' after the leak, and attackers 'mutating the attack payload to try to bypass our protections'. No volumes given. | attack traffic | reported (primary party) | [Cloudflare](../sources/cloudflare-blog-php2shell-waf/index.html) |
| 2026-10-21 | CISA (alert) | 'CISA has not observed exploitation of these vulnerabilities as of the time of publication.' Neither CVE is in the Known Exploited Vulnerabilities catalog (version 2026.10.21, fetched 2026-10-22T08:15Z). | negative finding | confirmed (primary) | [CISA](../sources/cisa-alert-php-20261021/index.html) [CISA](../sources/cisa-kev-json/index.html) [CISA](../sources/cisa-kev-catalog/index.html) |
| 2026-10-21 | CCCS (Canada) | 'a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.' | assessment | confirmed (primary) | [CCCS](../sources/cccs-al26-026/index.html) |
| 2026-10-21 | PHP Foundation | 'did not identify any functional exploits at the time of release/public disclosure.' | negative finding | reported (primary party) | [PHP Foundation](../sources/php-foundation-blog-security-release/index.html) |
| 2026-10-21 | Imperva | No traffic matching the exploit patterns during pre-disclosure monitoring of customer traffic. | negative finding | reported (primary party) | [Imperva Threat Research](../sources/imperva-blog-php2shell/index.html) |
| 2026-10-21 | watchTowr | Active exploitation attempts; the flaws listed as exploited in the wild. | claim | unverified: the site blocks capture | [watchTowr](../sources/watchtowr-php2shell/index.html) |
| 2026-10-21 02:00 UTC | Amazon (via The Hacker News) | Proof-of-concept attempts begin, then six hours of attempts from anonymised infrastructure; 'multiple threat actors'. | attempts | reported | [THN](../sources/thehackernews-php2shell-4days/index.html) |
| 2026-10-21 08:36 UTC | ELLIO (via The Hacker News and a comment under the PHP Foundation post) | First sensor hit, about 55 minutes after Chainguard's images. | sensor hit | reported | [THN](../sources/thehackernews-php2shell-4days/index.html) [PHP Foundation](../sources/phpfoundation-blog-security-release-leak/index.html) |
| 2026-10-21 14:34 UTC | CISA (ADP, SSVC on the CVE record) | Exploitation: none. Automatable: no. Technical impact: total. | assessment | confirmed (primary) | [CVE record](../sources/cve-cve-2026-109618/index.html) [CVE record](../sources/cve-cve-2026-109619/index.html) |
| 2026-10-21 20:00 UTC | CERT.LV (Latvia) | Automated exploitation attempts seen in Latvia; no reports of successful attacks. | attempts | confirmed (primary) | [CERT.LV](../sources/certlv-php-preventive/index.html) |
| 2026-10-21 20:15 UTC | NCSC New Zealand | 'The NCSC is aware of reports of active exploitation.' Whose reports is not said. | claim of exploitation | reported, sole agency | [NCSC New Zealand](../sources/ncsc-nz-alert-php/index.html) |
| 2026-10-21 20:30 UTC | Huntress | No exploitation observed on partner systems; no public exploit code known. | negative finding | reported (primary party) | [Huntress](../sources/huntress-php2shell-rapid-response/index.html) |
| 2026-10-22 | ASD's ACSC (Australia) | 'not aware of successful active exploitation within Australia'. | negative finding | confirmed (primary) | [ACSC](../sources/acsc-alert-php/index.html) |
| 2026-10-22 | Alan Woodward, on the BBC | Amazon and Cloudflare saw sites being probed for the flaw. | second-hand | reported; Cloudflare's own post confirms attack traffic, Amazon's own post not found | [BBC News](../sources/bbc-live-ckgel5xp2xv9t/index.html) [Cloudflare](../sources/cloudflare-blog-php2shell-waf/index.html) [THN](../sources/thehackernews-php2shell-4days/index.html) |
| 2026-10-22 | unnamed researchers, on the BBC | Criminals are using AI to 'vibe code' an attack method. | claim | unverified | [BBC News](../sources/bbc-live-ckgel5xp2xv9t/index.html) |
| 2026-10-22 | Dan Lorenc, Chainguard, via The Register | Chainguard's honeypots trapped IPs from China and Russia; several unnamed vendors reported exploits in the wild. | claim | reported, second-hand | [The Register](../sources/theregister-php-blames-chainguard/index.html) |
| 2026-10-22 01:25 UTC | Matthew Prince, Cloudflare | Thousands of attempts in the ten hours before announcement; tens of thousands within 45 minutes after; hundreds of thousands within two hours; millions now. | attempts | reported (primary party) | [Matthew Prince , Cloudflare CEO on](../sources/x-eastdakota-php2shell-stats/index.html) |
| 2026-10-22 07:00 UTC | Ryan Austin, Calif, on BBC Radio 4 | No evidence of exploitation yet: 'Not at the moment'. | statement | reported | [BBC News](../sources/bbc-live-ckgel5xp2xv9t/index.html) |

## What exploitation would look like

- **On the host:** CISA's signal is *PHP worker processes launching shells or downloading tools*. The exploit runs as the web worker, so a worker spawning `sh`, `curl` or `wget`, or writing outside its document root, is the thing to alert on.

- **In the request log:** CERT-FR's workaround is to block or monitor multipart requests, because the confirmed session path rides on session upload progress; php.net's limits are on decoded request size, field count, multipart part count, header count and nesting depth. Unusual values of those are the request-side signal for the OOM path.

- **What a clean log does not prove:** JPCERT warns that with several exploit paths, one detection rule can miss an attack and the absence of traces does not prove the absence of compromise. The UK NCSC says a system that cannot be patched or disabled should be assessed for backdoors.

- **Upstream:** Cloudflare says its rules blocked the traffic it saw and that attackers mutated payloads; a WAF is a signal source as well as a control, and the Swiss agency's caveat is that it is not a sufficient control on its own.

[CISA](../sources/cisa-alert-php-20261021/index.html) [CERT-FR](../sources/certfr-2026-ale-014/index.html) [php.net](../sources/php-net-advisory/index.html) [JPCERT/CC](../sources/jpcert-at260033/index.html) [NCSC UK](../sources/ncsc-news-php/index.html) [Cloudflare](../sources/cloudflare-blog-php2shell-waf/index.html) [BACS](../sources/ch-bacs-warnung-php/index.html)

## The Known Exploited Vulnerabilities catalog

CISA adds a CVE to KEV when it has reliable evidence of exploitation in the wild. At catalog version 2026.10.21, released 2026-10-21 14:04:39 UTC and fetched 2026-10-22 08:15 UTC, neither CVE-2026-109618 nor CVE-2026-109619 is listed; the catalog has 1,754 entries and its newest additions are dated 20 October. CISA's vulnerability-enrichment assessment on both CVE records at 14:34 UTC says exploitation *none*. This is a point-in-time negative finding; the vault keeps the file and its hash so that the time can be proven later. [CISA](../sources/cisa-kev-json/index.html) [CISA](../sources/cisa-kev-catalog/index.html) [CVE record](../sources/cve-cve-2026-109618/index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/exploitation/index.html