Hackers attempted to utilize the PHP flaws impacting sites throughout the web days before they were patched, according to a study from Amazon Threat Intelligence. CJ Moses, Amazon chief data safety officer, writes that the company’s safety squad established a PHP2Shell utilize attempt on October 17th through a monitoring scheme designed to bait hackers, as reported before by Wired and Bleeping Computer.
On Wednesday, websites scrambled to use a patch for two crucial safety vulnerabilities affecting PHP, a programming tongue used by a ample part of the internet, including WordPress sites. The flaws — CVE-2026-109618 and CVE-2026-109619 — could authorize hackers to execute malicious code remotely on susceptible devices. Elizabeth Barron, the PHP Foundation’s administrator director, tells The Verge that “to our knowledge, there has been no prosperous attempt at distant code execution” but stresses that updating affected systems is “imperative.”
The PHP Foundation initially theorized the bug in 2024, and during its safety squad came up alongside possible solutions, a fix was delayed due to “backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed unattainable to coordinate.” As the PHP Foundation prepared to container the fix this week, particulars concerning the bugs began trickling out on forums and social media, alongside several safety firms releasing data concerning them before the authoritative release.
But the study from Amazon Threat Intelligence suggests a bad performer may have identified the exposure before particulars started leaking. “While the exposure was under embargo, the targeting of a honeypot from an anonymized IP location suggests the action was conducted by a danger actor, although it remains unclear how the performer acquired utilize data previous to disclosure,” Moses writes. Amazon Threat Intelligence discovered multiple another exploitation attempts on October 21st in the hours before the patch’s release.
“We are assured that a grave exposure alongside a fix stuck on difficult trade-offs would now attain the PHP Foundation guidance much sooner, as we’re changing processes so guidance can assistance steer the circumstance to a timely resolution,” the PHP Foundation says. “We are now prioritizing measures to create certain vulnerabilities that need likewise complex fixes get resolved faster whenever they are reported in the future.”
Follow topics and authors from this narrative to see additional akin this in your personalized homepage nourish and to obtain email updates.
