# East Japan Railway

Published articles for East Japan Railway.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions

DevFeed: [PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions](<https://devfeed.tech/articles/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions-96429.md>)

Original publisher: [Read original article](<https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/>)

Author: Duncan Riley

Published: 2026-10-22T23:27:27Z

Content type: news

Language: en

Sources: [SiliconANGLE](<https://devfeed.tech/sources/siliconangle.md>)

Topics: [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [cve remediation](<https://devfeed.tech/topics/cve-remediation.md>), [known exploitable vulnerabilities](<https://devfeed.tech/topics/known-exploitable-vulnerabilities.md>), [patches](<https://devfeed.tech/topics/patches.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [amazon](<https://devfeed.tech/tags/amazon.md>), [amazon-com](<https://devfeed.tech/tags/amazon-com.md>), [amazon-integrated-security](<https://devfeed.tech/tags/amazon-integrated-security.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [bitkom](<https://devfeed.tech/tags/bitkom.md>), [black-hills-information-security](<https://devfeed.tech/tags/black-hills-information-security.md>), [cj-moses](<https://devfeed.tech/tags/cj-moses.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [critical](<https://devfeed.tech/tags/critical.md>), [cve-2026-109618](<https://devfeed.tech/tags/cve-2026-109618.md>), [cve-2026-109619](<https://devfeed.tech/tags/cve-2026-109619.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [dataminr](<https://devfeed.tech/tags/dataminr.md>), [days](<https://devfeed.tech/tags/days.md>), [defiant](<https://devfeed.tech/tags/defiant.md>), [east-japan-railway](<https://devfeed.tech/tags/east-japan-railway.md>), [end-of-life-software](<https://devfeed.tech/tags/end-of-life-software.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [felix-kuhlenkamp](<https://devfeed.tech/tags/felix-kuhlenkamp.md>), [hannu-naumanen](<https://devfeed.tech/tags/hannu-naumanen.md>), [honeypots](<https://devfeed.tech/tags/honeypots.md>), [john-strand](<https://devfeed.tech/tags/john-strand.md>), [justin-beals](<https://devfeed.tech/tags/justin-beals.md>), [madpot](<https://devfeed.tech/tags/madpot.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [matthew-prince](<https://devfeed.tech/tags/matthew-prince.md>), [michael-centrella](<https://devfeed.tech/tags/michael-centrella.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [mitsubishi-ufj-financial-group](<https://devfeed.tech/tags/mitsubishi-ufj-financial-group.md>), [national-security-agency](<https://devfeed.tech/tags/national-security-agency.md>), [national-tax-agency](<https://devfeed.tech/tags/national-tax-agency.md>), [news](<https://devfeed.tech/tags/news.md>), [nomura-holdings](<https://devfeed.tech/tags/nomura-holdings.md>), [openai](<https://devfeed.tech/tags/openai.md>), [patches](<https://devfeed.tech/tags/patches.md>), [patching](<https://devfeed.tech/tags/patching.md>), [php](<https://devfeed.tech/tags/php.md>), [php2shell](<https://devfeed.tech/tags/php2shell.md>), [security](<https://devfeed.tech/tags/security.md>), [the-latest](<https://devfeed.tech/tags/the-latest.md>), [top-story-3](<https://devfeed.tech/tags/top-story-3.md>), [top-story-6](<https://devfeed.tech/tags/top-story-6.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Amazon's MadPot honeypots recorded PHP2Shell exploitation attempts on Oct. 17, four days before patches for CVE-2026-109618 and CVE-2026-109619 were released; Amazon says it is unclear how attackers learned of the flaws early. After disclosure, Cloudflare's observed attempts rose from thousands to millions, but none of that traffic has been tied to a confirmed break-in. Wordfence blocked more than 74,000 attempts and reported no confirmed compromises across its protected sites; Dataminr characterized activity as scanning and non-working exploits. Amazon recommends starting investigations from Oct. 17 and argues that critical internet-facing flaws need remediation measured in hours. Some agencies advised taking systems offline if they could not be updated. Updates may take days or weeks to test, can break dependent services, and may be impossible for end-of-life PHP versions, which no longer receive security fixes.

### Source excerpt

Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon.com Inc. has disclosed, while exploit attempts seen by Cloudflare Inc. have since climbed into the millions. PHP's maintainers shipped fixes for the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, on Wednesday after details leaked ahead of a coordinated release. The bugs [...] The post PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions appeared first on SiliconANGLE.