The disastrous PHP vulnerabilities were exploited days before the patch

<figure> <img alt="Illustration of a computer screen with a blue exclamation point on it and an error box." data-caption="" data-portal-copyright="Photo by Amelia Holowaty Krales / The Verge" data-has-syndication-rights="1" src="https://platform.theverge.com/wp-content/uploads/sites/2/chorus/uploads/chorus_asset/file/23318435/akrales_220309_4977_0232.jpg?quality=90&#038;strip=all&#038;crop=0,0,100,100" /> <figcaption> </figcaption> </figure> <p class="wp-block-paragraph">Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to <a href="https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/">a report from Amazon Threat Intelligence</a>. CJ Moses, Amazon chief information security officer, writes that the company's security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as <a href="https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/">reported earlier by <em>Wired</em></a> and <a href="https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/"><em>Bleeping Computer</em></a>.</p> <p class="wp-block-paragraph">On Wednesday, <a href="https://www.theverge.com/tech/1015257/php-vulnerability-patch-website-security-wordpress">websites scrambled to apply a patch</a> for <a href="https://www.theverge.com/tech/1015906/php2shell-vulnerability-october-2026">two critical security vulnerabilities affecting PHP</a>, a programming language used by a large portion of the internet, including WordPress sites. The flaws - CVE-2026-109618 and CVE-2026- …</p> <p><a href="https://www.theverge.com/tech/1016798/php-vulnerabilities-exploit-patch">Read the full story at The Verge.</a></p>