TechNewsSecurityThe disastrous PHP vulnerabilities were exploited days before the patchThe PHP Foundation says details about the bugs were leaked before it could release a patch.The PHP Foundation says details about the bugs were leaked before it could release a patch.by Emma RothOct 22, 2026, 4:49 PM UTCShareGiftPhoto by Amelia Holowaty Krales / The VergePart OfPHP: The three little letters wreaking havoc across the websee all updates Emma Roth is a news writer who covers the streaming wars, consumer tech, crypto, social media, and much more. Previously, she was a writer and editor at MUO.Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company’s security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer.On Wednesday, websites scrambled to apply a patch for two critical security vulnerabilities affecting PHP, a programming language used by a large portion of the internet, including WordPress sites. The flaws — CVE-2026-109618 and CVE-2026-109619 — could allow hackers to execute malicious code remotely on vulnerable devices.
Elizabeth Barron, the PHP Foundation’s executive director, tells The Verge that “to our knowledge, there has been no successful attempt at remote code execution” but stresses that updating affected systems is “imperative.”The PHP Foundation initially theorized the bug in 2024, and while its security team came up with potential solutions, a fix was delayed due to “backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate.” As the PHP Foundation prepared to ship the fix this week, details about the bugs began trickling out on forums and social media, with some security firms releasing information about them before the official release.RelatedPHP: The three letters that shut down sites all over the internet todayBut the report from Amazon Threat Intelligence suggests a bad actor may have identified the vulnerability before details started leaking. “While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Moses writes. Amazon Threat Intelligence discovered several other exploitation attempts on October 21st in the hours before the patch’s release.“We are confident that a serious vulnerability with a fix stuck on hard trade-offs would now reach the PHP Foundation leadership much sooner, as we’re changing processes so leadership can help steer the situation to a timely resolution,” the PHP Foundation says. “We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.”Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Emma RothNewsSecurityTechWebThe Internet Archive was briefly forced offline because of PHP.Terrence O’BrienAn hour agoTwo old-school Japanese mobile games are shutting down over the PHP exploit.Terrence O’Brien1:42 PM UTCThe PHP2Shell exploit hit Cloudflare hard.Jess Weatherbed10:01 AM UTCMost PopularThe iPhone Duo is a messy, expensive, good timeEA is shutting down BioWareApple Music has a new logoAirbnb bans making guests do dishes and take out the trashPHP: The three letters that shut down sites all over the internet todayAdvertiser Content FromThis is the title for the native ad
Leave a Reply