AWS says hackers tried to exploit PHP security issues days before fix — as Cloudflare CEO says it saw a huge rise in targeted attack attempts
There have been millions of attempts to target PHP flaws following disclosure of major vulnerabilities.
A major PHP security vulnerability, known as php2shell, was discovered and exploited before the public disclosure of the vulnerabilities. Researchers have found evidence suggesting that the exploitation attempts began days before the official disclosure of the security flaws CVE-2026-109618 and CVE-2026-109619. Amazon has stated that they identified a PHP2Shell exploitation attempt as early as October 17, 2026, four days before the vulnerabilities were made public.
This indicates that attackers had prior knowledge of the bugs. Although real-world attacks remain limited to this point, the exploitation attempts surged rapidly after the disclosure, with millions of PHP systems remaining exposed. The PHP Foundation, along with other partners, worked on a fix for the critical vulnerabilities, which were given a severity score of 9.2/10.
Both vulnerabilities can lead to a full website takeover. Experts advise immediate patching of supported PHP versions to mitigate the risk. One factor contributing to the limited successful exploitation attempts is Address Space Layout Randomization (ASLR), a security feature that randomizes where a program's code and data are stored in memory, making it harder for attackers to execute reliable code remotely.
However, as cybercriminals adapt their tactics and exploit the vulnerabilities in various ways, the threat remains significant, and PHP administrators are urged to apply the patch as soon as possible.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
