The disastrous PHP vulnerabilities were exploited days before the patch

Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company’s security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer. On Wednesday, websites scrambled to apply a patch for two critical security vulnerabilities affecting PHP, a programming language used by a large portion of the internet, including WordPress sites. The flaws — CVE-2026-109618 and CVE-2026-109619 — could allow hackers to execute malicious code remotely on vulnerable devices. Elizabeth Barron, the PHP Foundation’s executive director, tells The Verge that “to our knowledge, there has been no successful attempt at remote code execution” but stresses that updating affected systems is “imperative.” The PHP Foundation initially theorized the bug in 2024, and while its security team came up with potential solutions, a fix was delayed due to “backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate.” As the PHP Foundation prepared to ship the fix this week, details about the bugs began trickling out on forums and social media, with some security firms releasing information about them before the official release. But the report from Amazon Threat Intelligence suggests a bad actor may have identified the vulnerability before details started leaking. “While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Moses writes. Amazon Threat Intelligence discovered several other exploitation attempts on October 21st in the hours before the patch’s release. “We are confident that a serious vulnerability with a fix stuck on hard trade-offs would now reach the PHP Foundation leadership much sooner, as we’re changing processes so leadership can help steer the situation to a timely resolution,” the PHP Foundation says. “We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.”