Amazon Web Services (AWS) analysts reported that attackers began exploiting two critical vulnerabilities, dubbed PHP2Shell, on October 17—four days before the flaws were publicly disclosed and patched. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect a wide range of PHP versions and can allow remote code execution. PHP is a scripting language used by a majority of websites.
The early exploitation gave hackers a head start before security teams and system administrators knew about the threat. Details of the flaws leaked on October 20, a day ahead of the scheduled disclosure, prompting an emergency patch release on October 21.
Security researchers are now observing broad scanning and exploitation attempts across the internet. Organizations are urged to update their PHP installations immediately to reduce the significant risk of site takeovers or data theft.