Amazon Threat Intelligence reported that hackers attempted to exploit PHP vulnerabilities days before an official patch was released. The company security team detected a PHP2Shell exploit attempt on October 17th using a honeypot system.
The security flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow for remote code execution. These vulnerabilities impact a significant portion of the internet, including websites running on WordPress.
The PHP Foundation stated that while they theorized the bugs in 2024, the release of a fix was delayed due to concerns regarding backward compatibility and the need for extensive changes to third-party extensions.
Details about the flaws leaked on social media and forums before the official patch. Amazon also recorded additional exploitation attempts on October 21st, just hours before the fix was made public.
The PHP Foundation confirmed that they are currently changing internal processes to ensure that complex security issues are resolved more quickly and receive leadership attention sooner in the future.
