{
  "id": 16127063,
  "title": "PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions",
  "url": "https://urgent.news/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T23:27:27.000Z",
  "source": {
    "name": "SiliconANGLE",
    "slug": "siliconangle",
    "url": "https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/"
  },
  "original_language": "en",
  "account": "Attackers began exploiting PHP2Shell vulnerabilities four days before patches became available, according to Amazon.com Inc. The critical bugs, CVE-2026-109618 and CVE-2026-109619, were patched on Wednesday after details leaked ahead of a coordinated release. The vulnerabilities had been present in PHP's code for years until an August audit revealed their practical exploitability using an artificial intelligence model. Amazon's honeypot network, MadPot, recorded the earliest exploit attempt on October 17, while the vulnerabilities were still under embargo. The intention behind the early probing remains unclear, but Amazon suspects multiple actors were involved, given the variation in payloads and infrastructure. Proof-of-concept exploits surfaced within hours of the patch and were immediately detected by Amazon's sensors. The company now considers the flaws to be \"broadly exploited in the wild.\" Cloudflare logged millions of exploit attempts in the hours following the disclosure, with tens of thousands occurring within the first 45 minutes. While no confirmed breaches have been tied to the activity, several organizations have proactively taken their services offline. Major banks, rail systems, and government websites in countries like Japan, South Korea, and Finland suspended internet services as a precaution. IT professionals emphasized the importance of timely patching, particularly for systems with end-of-life PHP versions, which could lead to cascading disruptions if not addressed promptly.",
  "summary": "Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon.com Inc. has disclosed, while exploit attempts seen by Cloudflare Inc. have since climbed into the millions. PHP’s maintainers shipped fixes for the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, on Wednesday after details leaked ahead of a coordinated release. The bugs […]…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure",
        "url": "https://urgent.news/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before",
        "published": "2026-10-22T12:15:00.000Z"
      },
      {
        "outlet": "Techmeme",
        "title": "Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward (Matthew Prince/@eastdakota)",
        "url": "https://urgent.news/2026/10/22/cloudflares-matthew-prince-says-php2shell-exploit-attempts-on-its",
        "published": "2026-10-22T15:15:01.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}