The disastrous PHP vulnerabilities were exploited days before the patch
Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company's security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer. On…
Key points
- Amazon Threat Intelligence found a PHP2Shell exploit attempt on October 17th, days before a patch was released.
- The two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, could allow remote code execution.
- The PHP Foundation says there has been no known successful remote code execution attempt.
Hackers tried to exploit critical PHP vulnerabilities days before a patch was released this week, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon's chief information security officer, wrote that the company's security team detected a PHP2Shell exploit attempt on October 17th using a monitoring system designed to lure attackers.
On Wednesday, websites rushed to apply a patch for two critical flaws affecting PHP, a programming language used by a large portion of the internet, including WordPress sites. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could let hackers run malicious code remotely on vulnerable devices.
What the PHP Foundation said
Elizabeth Barron, the PHP Foundation's executive director, told The Verge that "to our knowledge, there has been no successful attempt at remote code execution" but stressed that updating affected systems is "imperative."
The PHP Foundation first theorized the bug in 2024. A fix was delayed due to "backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate."
to our knowledge, there has been no successful attempt at remote code execution
— Elizabeth Barron
Exploit attempts before the patch
As the PHP Foundation prepared to ship the fix this week, details about the bugs began appearing on forums and social media, with some security firms releasing information before the official release. Amazon Threat Intelligence found several other exploitation attempts on October 21st in the hours before the patch's release.
Moses wrote that targeting a honeypot from an anonymized IP address while the vulnerability was under embargo suggests a threat actor was involved, though it remains unclear how the actor obtained exploit information before disclosure. The PHP Foundation said it is changing processes so leadership can help steer such situations to a timely resolution and is prioritizing faster fixes for similarly complex vulnerabilities in the future.
