Hackers Targeted PHP Vulnerabilities Days Before Patch Release
Cyberattackers attempted to exploit critical PHP flaws as early as October 17, according to Amazon Threat Intelligence. The discovery, made via a security honeypot, occurred days before developers issued an official patch for the vulnerabilities, which potentially allow for remote code execution on millions of websites globally.
Amazon’s CISO CJ Moses confirmed that the company’s monitoring systems detected a PHP2Shell exploit attempt on October 17. Additional attacks were recorded on October 21, hours before the official release of the fix. These vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, represent a significant risk to the vast ecosystem of sites relying on PHP, including those running on WordPress. While the PHP Foundation noted that these bugs were identified as early as 2024, implementation of a fix faced repeated delays due to technical hurdles regarding backward compatibility and the risk of breaking third-party extensions.
Information concerning the flaws began circulating on social media and security forums prematurely, complicating the release process. Elizabeth Barron, executive director of the PHP Foundation, stated there is no evidence of successful remote code execution to date, though she emphasized that immediate updates remain essential. In response to the incident, the Foundation is overhauling its internal processes to ensure that complex security issues reach leadership faster, preventing similar bottlenecks in future update cycles.
Comments (0)
No comments yet. Be the first!