Amazon says PHP2Shell exploitation began 4 days before patches

Amazon's threat intelligence team reports that attackers began probing the so-called PHP2Shell flaws on October 17, four days before PHP shipped emergency fixes on October 21. The two critical bugs, CVE-2026-109618 and CVE-2026-109619, allow remote code execution and affect the PHP runtime that underpins the vast majority of websites, including those built on WordPress, Drupal, and Joomla. According to Amazon's CISO, exploit attempts came from VPN-masked IP addresses while the issue was still under embargo, and multiple actors appear to have launched varied payloads within hours of disclosure—evidence that the flaws are now being actively exploited in the wild. The PHP Foundation says disclosure details leaked early, forcing it to rush out the release, and is urging organizations not to assume public disclosure marks the start of attacks but to patch immediately.