The disastrous PHP vulnerabilities were exploited days before the patch
Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company's security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as […]
The PHP Foundation disclosed details about two critical security vulnerabilities in the programming language PHP before the patch was released, according to a report from Amazon Threat Intelligence. Hackers attempted to exploit these PHP flaws, impacting numerous websites worldwide, days before they were patched, as reported by Wired and Bleeping Computer.
On October 17th, Amazon's security team discovered a PHP2Shell exploit attempt through a monitoring system designed to lure hackers, as previously reported by Wired and Bleeping Computer. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could enable hackers to execute malicious code remotely on vulnerable devices. Elizabeth Barron, PHP Foundation's executive director, stated that to their knowledge, there had been no successful remote code execution attempts, but emphasized the importance of updating affected systems.
The PHP Foundation had previously theorized the bug in 2024, and while its security team developed potential solutions, the fix was delayed due to backward compatibility issues, potential for denial-of-service, and the difficulty of coordinating changes to numerous third-party extensions. The report from Amazon Threat Intelligence suggests that a malicious actor may have identified the vulnerability before the details started leaking, as a honeypot engagement using an anonymized IP address indicates threat actor activity.
Amazon Threat Intelligence found several other exploitation attempts on October 21st, hours before the patch's release. The PHP Foundation now prioritizes ensuring vulnerabilities requiring complex fixes are resolved more swiftly when reported in the future.
Written by urgent.news from The Verge's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
