Amazon detected PHP exploit attempt before patches

Amazon said it detected an attempt to exploit two serious PHP vulnerabilities on October 17, four days before fixes were released, raising concern that someone had access to exploit information before public disclosure. The attempt targeted a decoy server monitored by Amazon Threat Intelligence and came from an internet address associated with a commercial anonymization network, the company said. The flaws, tracked as CVE-2026-10961 and CVE-2026-10962 and known collectively as PHP2Shell, can let attackers run code on vulnerable systems without logging in. PHP released fixed versions on October 21. Amazon said it did not know how the actor behind the October 17 attempt obtained information about the vulnerabilities while they were under embargo. Amazon also reported finding multiple proof-of-concept exploits around the day the fixes were released. Differences in their payloads and anonymization infrastructure suggested that several actors were involved, the company said. Its technical analysis had not established whether the attempts would have succeeded against real-world systems. Security researchers cited in reporting said some circulating exploit code appeared unreliable,...