Technology and Scienceupdated 50m ago3 min read
Amazon Threat Intelligence Says Hackers Exploited PHP2Shell Four Days Before Patches
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Exploitation attempts against PHP2Shell were detected four days before official vulnerability disclosure. Vulnerabilities CVE-2026-109618/109619 enable remote code execution and were disclosed Oct 21.
Save coverage image
Where the coverage agrees
Explore source coverage 6 source types
Directory totals describe our source library, not outlets checked for this story.
24 outlets told this the same way.
Outlets did split on Marco Rubio Says Elon Musk Controls Ukraine Starlink And Starshield Access →
Four-day early exploitation
Amazon warned that PHP vulnerabilities discovered using AI tools were being “broadly exploited” as governments and companies rushed to secure their systems, and it said it identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon Threat Intelligence said attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday, and it tracked the two critical vulnerabilities as CVE-2026-109618 and CVE-2026-109619. Amazon said the first exploitation attempts began on Saturday, October 17, and it reported that the vulnerabilities are “now being broadly exploited in the wild.”
CJ Moses, Amazon’s chief information security officer, said the exploit attempt “originated from an IP address associated with a commercial anonymization network,” and he added that the targeting of a honeypot suggested a threat actor was behind the activity. The PHP developers responsible for maintaining PHP released software updates to patch the vulnerabilities earlier on Wednesday, after the PHP security team patched them on October 21.
Patch rush and warnings
The US National Security Agency and UK authorities warned that the vulnerabilities had left websites around the world critically exposed to hacking, and some governments in Europe were reportedly taking sites offline while they patched the two security flaws. The UK National Cyber Security Centre (NCSC) asked UK organizations to immediately update PHP servers or take them offline until they can be patched, and the PHP security team said applying the official security patches is the only permanent defense. Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, said the incident illustrates “how AI is accelerating the ability of vulnerability researchers” while also boosting bad actors’ capacity to exploit security flaws.
The PHP Foundation said on Wednesday that it had released fixes for the vulnerabilities, and it told organizations: “If you run PHP, it is imperative that you update now.” The FBI’s cyber threat division acknowledged the vulnerabilities on X and said they expose websites and apps to interference from cybercriminals who can remotely insert malware into PHP's source code.
Scale, uncertainty, and next steps
CBS News said the PHP bug affects a programming language called PHP, short for “Personal Home Page,” which powers up to 70% of the world’s websites and web applications, including those used by government agencies and social media platforms such as Facebook. The Hacker News said Amazon detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17 against its MadPot honeypot service, and it quoted CJ Moses saying the exploit attempt “originated from an IP address associated with a commercial anonymization network.” Amazon’s report left uncertainty about impact, because it said it remains unclear how the actor acquired exploit information prior to disclosure and it is unclear if any of these attempts would have succeeded in real-world systems.
The PHP Foundation’s fixes included instructions on how to update systems, and Amazon Threat Intelligence said defenders should not assume the public disclosure date is the earliest date of exploitation. Organizations were urged to patch immediately or take servers offline, and the FBI encouraged organizations that can't immediately patch their sites to temporarily take them offline.