Amazon says PHP flaws were targeted before patch release
Amazon Threat Intelligence says attackers tried to exploit two critical PHP vulnerabilities days before this week's patch, while the PHP Foundation says bug details leaked ahead of the fix.
The flaws, CVE-2026-109618 and CVE-2026-109619, affect PHP, a programming language used by a large portion of the internet, including WordPress sites. They could allow hackers to execute malicious code remotely on vulnerable devices. Websites scrambled on Wednesday to apply the patch, The Verge reported.
CJ Moses, Amazon's chief information security officer, wrote that the company's security team found a PHP2Shell exploit attempt through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Moses wrote. Amazon Threat Intelligence also found several other exploitation attempts on Oct. 21 in the hours before the patch's release.
Elizabeth Barron, the PHP Foundation's executive director, told The Verge that "to our knowledge, there has been no successful attempt at remote code execution" but stressed that updating affected systems is "imperative." The foundation said it initially theorized the bug in 2024. Its security team came up with potential solutions, but a fix was delayed due to "backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate."
As the foundation prepared to ship the fix this week, details about the bugs began trickling out on forums and social media, with some security firms releasing information before the official release. The foundation said it is changing processes so that a serious vulnerability with a fix stuck on hard trade-offs would reach its leadership much sooner. "We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future," it said.
The Amazon report suggests a bad actor may have identified the vulnerability before details started leaking. The PHP Foundation said it had no knowledge of a successful remote code execution attempt. Updating affected systems remains the remedy, Barron said, according to The Verge.