Critical PHP Flaws Were Targeted Days Before the Patch Was Released
Amazon's security team detected exploitation attempts against two critical flaws in the PHP programming language before a fix was published. The PHP Foundation says no successful remote code execution is known and urges systems to be updated.
Amazon Threat Intelligence, the company's cybersecurity research unit, reports that hackers tried to exploit two critical vulnerabilities in PHP, a widely used web programming language, days before a patch was released. The tech outlet The Verge covered the findings. The flaws affect sites across the internet, including those running the WordPress content management system.
On Wednesday, websites rushed to apply a fix for the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. They could let attackers remotely run malicious code on vulnerable devices.
What Amazon found
CJ Moses, Amazon's chief information security officer, writes that the company's security team spotted a PHP2Shell exploit attempt on October 17th using a honeypot, a monitoring system designed to bait hackers. Several more attempts were recorded on October 21st, in the hours before the patch was released.
Moses notes that the honeypot was targeted from an anonymized IP address, which suggests a threat actor was behind it. It remains unclear how the actor obtained exploit information while the vulnerability was still under embargo.
The PHP Foundation's explanation
The PHP Foundation, the organization that supports PHP's development, first theorized the bug in 2024. Its security team devised possible solutions, but a fix was delayed because of backward compatibility breaks, new denial-of-service potential, or the need to change many third-party extensions that seemed impossible to coordinate.
As the fix was being prepared, details about the bugs began to appear on forums and social media, and some security firms published information before the official release.
Elizabeth Barron, the PHP Foundation's executive director, told The Verge that, to the organization's knowledge, there has been no successful remote code execution attempt, but that updating affected systems is imperative. The foundation also said it is changing its processes so that complex vulnerabilities reach leadership sooner and are resolved faster.
