PHP Security Flaws Were Exploited Before Patches Reached Websites
Hackers began attempting to exploit two critical PHP vulnerabilities days before patches were available, according to Amazon Threat Intelligence. The company’s security team detected the activity on October 17 through a monitoring system designed to attract attackers.
The flaws, identified in part as CVE-2026-109618, prompted websites to scramble for a patch on Wednesday. They affect PHP, a programming language used across a substantial portion of the internet, including WordPress sites.
Amazon Web Services also logged exploitation attempts involving the flaws, which attackers have referred to as the “PHP2Shell” vulnerabilities. Although attempts were observed before the patch, reporting indicates that the vulnerabilities are now being broadly exploited across the internet.