# Hackers tried to exploit critical PHP flaws hours before patch release

- URL: https://talkfuse.com/story/the-disastrous-php-vulnerabilities-were-exploited-days-before-the-patch/
- Published: 2026-10-22T16:49:48+00:00
- Updated: 2026-10-22T17:05:33+00:00
- Original publisher: The Verge
- Original article: https://www.theverge.com/tech/1016798/php-vulnerabilities-exploit-patch
- Topics: Americas, Business, Companies, Cybersecurity, Technology, World

## Key points

- Hackers tried to exploit two PHP flaws before a patch was released.
- Amazon detected attempts on 17 and 21 October.
- The PHP Foundation says no successful remote code execution is known.

## Summary

Amazon says hackers attempted to exploit two critical PHP vulnerabilities before a patch was released, raising questions about whether attackers obtained details before public disclosure. The flaws could let attackers run malicious code remotely on vulnerable systems, including many websites, so the PHP Foundation says installing the update is imperative.

Amazon detected a PHP2Shell exploit attempt on 17 October using a honeypot, then found several more attempts on 21 October in the hours before the patch’s release. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, had been known to the PHP Foundation since 2024, but a fix was delayed over compatibility risks and possible denial-of-service issues. The Foundation says it knows of no successful remote code execution and is changing its processes to speed up complex security fixes.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.