The disastrous PHP vulnerabilities were exploited days before the patch

Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company’s security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer.

On Wednesday, websites scrambled to apply a patch for two critical security vulnerabilities affecting PHP, a programming language used by a large portion of the internet, including WordPress sites. The flaws — CVE-2026-109618 and CVE-2026-109619 — could allow hackers to execute malicious code remotely on vulnerable devices. Elizabeth Barron, the PHP Foundation’s executive director, tells The Verge that “to our knowledge, there has been no successful attempt at remote code execution” but stresses that updating affected systems is “imperative.”