Exploitation signals: every version

# Exploitation signals, in order

Every signal of php2shell exploitation in the captured sources, from an Amazon honeypot hit on 17 October to the KEV catalog, with what exploitation would look like on a host.

# Exploitation: the signals, in order

A remote code execution bug is not an invisibility cloak. If millions of systems were being exploited, the signals would be everywhere: honeypots, WAF logs, national CERTs, the KEV catalog. What the captured sources carry is 14 signals, from one honeypot hit four days before disclosure to one agency's unattributed *reports of active exploitation*, and no confirmed compromise of a named system. That is the state as of the latest capture, and this page will change.

| When (UTC) | Who | What | Kind | Status | Sources |
|---|---|---|---|---|---|
| 2026-10-17 | Amazon (CJ Moses, via The Hacker News) | One exploit attempt against a MadPot honeypot from an IP on a commercial anonymisation network, geolocated to Australia, four days before disclosure. 'It remains unclear how the actor acquired exploit information prior to disclosure.' | attempt | reported | THN |
| 2026-10-20 to 21 | Cloudflare | 'We observed attack traffic targeting our customers' after the leak, and attackers 'mutating the attack payload to try to bypass our protections'. No volumes given. | attack traffic | reported (primary party) | Cloudflare |
| 2026-10-21 | CISA (alert) | 'CISA has not observed exploitation of these vulnerabilities as of the time of publication.' Neither CVE is in the Known Exploited Vulnerabilities catalog (version 2026.10.21, fetched 2026-10-22T08:15Z). | negative finding | confirmed (primary) | CISA CISA CISA |
| 2026-10-21 | CCCS (Canada) | 'a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.' | assessment | confirmed (primary) | CCCS |
| 2026-10-21 | PHP Foundation | 'did not identify any functional exploits at the time of release/public disclosure.' | negative finding | reported (primary party) | PHP Foundation |
| 2026-10-21 02:00 UTC | Amazon (via The Hacker News) | Proof-of-concept attempts begin, then six hours of attempts from anonymised infrastructure; 'multiple threat actors'. | attempts | reported | THN |
| 2026-10-21 08:36 UTC | ELLIO (via The Hacker News and a comment under the PHP Foundation post) | First sensor hit, about 55 minutes after Chainguard's images. | sensor hit | reported | THN PHP Foundation |
| 2026-10-21 14:34 UTC | CISA (ADP, SSVC on the CVE record) | Exploitation: none. Automatable: no. Technical impact: total. | assessment | confirmed (primary) | CVE record CVE record |
| 2026-10-21 20:00 UTC | CERT.LV (Latvia) | Automated exploitation attempts seen in Latvia; no reports of successful attacks. | attempts | confirmed (primary) | CERT.LV |
| 2026-10-21 20:15 UTC | NCSC New Zealand | 'The NCSC is aware of reports of active exploitation.' Whose reports is not said. | claim of exploitation | reported, sole agency | NCSC New Zealand |
| 2026-10-22 | ASD's ACSC (Australia) | 'not aware of successful active exploitation within Australia'. | negative finding | confirmed (primary) | ACSC |
| 2026-10-22 | Alan Woodward, on the BBC | Amazon and Cloudflare saw sites being probed for the flaw. | second-hand | reported; Cloudflare's own post confirms attack traffic, Amazon's own post not found | BBC News Cloudflare THN |
| 2026-10-22 | unnamed researchers, on the BBC | Criminals are using AI to 'vibe code' an attack method. | claim | unverified | BBC News |
| 2026-10-22 07:00 UTC | Ryan Austin, Calif, on BBC Radio 4 | No evidence of exploitation yet: 'Not at the moment'. | statement | reported | BBC News |

## What exploitation would look like

- **On the host:** CISA's signal is *PHP worker processes launching shells or downloading tools*. The exploit runs as the web worker, so a worker spawning `sh`, `curl` or `wget`, or writing outside its document root, is the thing to alert on.

- **In the request log:** CERT-FR's workaround is to block or monitor multipart requests, because the confirmed session path rides on session upload progress; php.net's limits are on decoded request size, field count, multipart part count, header count and nesting depth. Unusual values of those are the request-side signal for the OOM path.

- **What a clean log does not prove:** JPCERT warns that with several exploit paths, one detection rule can miss an attack and the absence of traces does not prove the absence of compromise. The UK NCSC says a system that cannot be patched or disabled should be assessed for backdoors.

- **Upstream:** Cloudflare says its rules blocked the traffic it saw and that attackers mutated payloads; a WAF is a signal source as well as a control, and the Swiss agency's caveat is that it is not a sufficient control on its own.

CISA CERT-FR php.net JPCERT/CC NCSC UK Cloudflare BACS

## The Known Exploited Vulnerabilities catalog

CISA adds a CVE to KEV when it has reliable evidence of exploitation in the wild. At catalog version 2026.10.21, released 2026-10-21 14:04:39 UTC and fetched 2026-10-22 08:15 UTC, neither CVE-2026-109618 nor CVE-2026-109619 is listed; the catalog has 1,754 entries and its newest additions are dated 20 October. CISA's vulnerability-enrichment assessment on both CVE records at 14:34 UTC says exploitation *none*. This is a point-in-time negative finding; the vault keeps the file and its hash so that the time can be proven later. CISA CISA CVE record