Hackers tried to exploit critical PHP flaws hours before patch release
Amazon says hackers attempted to exploit two critical PHP vulnerabilities before a patch was released, raising questions about whether attackers obtained details before public disclosure. The flaws could let attackers run malicious code remotely on vulnerable systems, including many websites, so the PHP Foundation says installing the update is imperative.
Amazon detected a PHP2Shell exploit attempt on 17 October using a honeypot, then found several more attempts on 21 October in the hours before the patch’s release. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, had been known to the PHP Foundation since 2024, but a fix was delayed over compatibility risks and possible denial-of-service issues. The Foundation says it knows of no successful remote code execution and is changing its processes to speed up complex security fixes.
In short
- Hackers tried to exploit two PHP flaws before a patch was released.
- Amazon detected attempts on 17 and 21 October.
- The PHP Foundation says no successful remote code execution is known.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The attempts shortly before release, following an earlier honeypot detection, reasonably raise concern that someone may have learned about the flaws before public disclosure. Because the vulnerabilities could enable remote code execution across many websites, scrutiny of how information was handled and why the fix took so long can help protect users and improve security processes.
The case against
The timing of attempted exploitation does not establish that attackers obtained advance details; the earlier attempt and lack of known successful remote code execution leave other explanations open. The Foundation had to weigh a prompt fix against compatibility risks and possible denial-of-service effects, and its decision to revise procedures while urging users to install the patch reflects those competing responsibilities.
Americas Business Companies Cybersecurity Technology World
Read the full article at the source →
Originally published by The Verge as “The disastrous PHP vulnerabilities were exploited days before the patch”.