Critical PHP vulnerabilities were exploited just days prior to the release of a fix.

Hackers were reportedly trying to take advantage of vulnerabilities in PHP just days before they were patched, as highlighted by Amazon’s Threat Intelligence. CJ Moses, Amazon’s chief information security officer, noted that their security team detected an attempt to exploit PHP2Shell on October 17 through a monitoring system set up to attract hackers.

On Wednesday, many websites rushed to implement a patch for two significant security flaws in PHP, a programming language widely used across the internet, including on WordPress sites. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could enable hackers to execute malicious code remotely on affected devices. Elizabeth Barron, executive director of the PHP Foundation, stated that “to our knowledge, there has been no successful attempt at remote code execution,” but emphasized the critical need for affected systems to be updated.

The PHP Foundation had initially identified the bug in 2024, and while their security team proposed potential solutions, the release of a fix was postponed due to concerns over backward compatibility, new denial-of-service risks, and the challenges of coordinating changes across numerous third-party extensions. As the PHP Foundation prepared to roll out the fix this week, information about the vulnerabilities began to surface on forums and social media, with some security firms sharing details ahead of the official announcement.

However, the report from Amazon Threat Intelligence indicates that a malicious actor may have discovered the vulnerability before the information was publicly available. Moses pointed out that the targeting of a honeypot from an anonymized IP address while the vulnerability was under embargo suggests that the attacker had prior knowledge of the exploit, although it remains uncertain how they obtained this information. Amazon Threat Intelligence also noted several other attempts to exploit the vulnerabilities on October 21, just hours before the patch was released.

The PHP Foundation expressed confidence that serious vulnerabilities requiring complex fixes will now be escalated to leadership more quickly, stating, “We are changing processes so leadership can help steer the situation to a timely resolution.” They are now prioritizing measures to ensure that similarly complex vulnerabilities are addressed more swiftly in the future.