{
  "id": 16191786,
  "title": "AWS says hackers tried to exploit PHP security issues days before fix — as Cloudflare CEO says it saw a huge rise in targeted attack attempts",
  "url": "https://urgent.news/2026/10/23/aws-says-hackers-tried-to-exploit-php-security-issues-days-before-fix",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T14:05:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/aws-says-hackers-tried-to-exploit-php-security-issues-days-before-fix-as-cloudflare-ceo-says-it-saw-a-huge-rise-in-targeted-attack-attempts"
  },
  "original_language": "en",
  "account": "A major PHP security vulnerability, known as php2shell, was discovered and exploited before the public disclosure of the vulnerabilities. Researchers have found evidence suggesting that the exploitation attempts began days before the official disclosure of the security flaws CVE-2026-109618 and CVE-2026-109619. Amazon has stated that they identified a PHP2Shell exploitation attempt as early as October 17, 2026, four days before the vulnerabilities were made public. This indicates that attackers had prior knowledge of the bugs. Although real-world attacks remain limited to this point, the exploitation attempts surged rapidly after the disclosure, with millions of PHP systems remaining exposed. The PHP Foundation, along with other partners, worked on a fix for the critical vulnerabilities, which were given a severity score of 9.2/10. Both vulnerabilities can lead to a full website takeover. Experts advise immediate patching of supported PHP versions to mitigate the risk. One factor contributing to the limited successful exploitation attempts is Address Space Layout Randomization (ASLR), a security feature that randomizes where a program's code and data are stored in memory, making it harder for attackers to execute reliable code remotely. However, as cybercriminals adapt their tactics and exploit the vulnerabilities in various ways, the threat remains significant, and PHP administrators are urged to apply the patch as soon as possible.",
  "summary": "There have been millions of attempts to target PHP flaws following disclosure of major vulnerabilities.",
  "key_points": [
    "Hackers exploited PHP security issues days before public disclosure",
    "AWS identified exploitation attempt on October 17, 2026",
    "PHP vulnerabilities pose risk of full website takeover"
  ],
  "editors_take": "The exploitation of these vulnerabilities before public disclosure signals that attackers are increasingly leveraging prior knowledge to target widespread systems before administrators can implement critical security patches.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}