GoKawiilAmazon detects PHP exploit attempts a week before vulnerability was publicly patched
Amazon's Threat Intelligence team says it detected an attempt to exploit two critical PHP vulnerabilities on October 17th, using a honeypot monitoring system, days before an official patch was released this week. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers remotely execute malicious code on PHP-based systems including WordPress sites. The PHP Foundation's executive director Elizabeth Barron says there's no known successful remote code execution so far, but urges all affected systems be updated immediately.
GoKawiil's interpretation of the reporting above, not reported fact.
The timing suggests someone may have discovered the vulnerability independently while it was still under embargo, rather than learning about it from the public leaks that preceded the official patch. Amazon's report frames the honeypot activity from an anonymized IP as evidence of a sophisticated threat actor, which could mean attackers had a head start on exploiting unpatched systems worldwide. Given PHP's widespread use across the web, any delay in patching broadens the window of exposure for vulnerable sites.
- Amazon detected a PHP2Shell exploit attempt on October 17th, before the official patch shipped.
- Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) could allow remote code execution on affected systems.
- The PHP Foundation says no successful remote code execution is known yet but stresses urgent patching is required.
Source: theverge.com — Emma Roth, 2026-10-22
Published there as: “The disastrous PHP vulnerabilities were exploited days before the patch”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.