Amazon says PHP2Shell exploitation began 4 days before patches
Read original article ↗AI Summary
Attackers began exploiting the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) as early as October 17, 2026, four days before official patches were released. The vulnerabilities, which allow remote code execution, were actively targeted using proof-of-concept exploits from anonymized IP addresses shortly after disclosure. Amazon Threat Intelligence observed exploitation attempts originating from commercial anonymization networks, indicating possible advanced threat actors. While some pre-disclosure activity has been detected, it remains unclear how widespread successful compromises are, though the risk is high due to PHP's extensive use across the web.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.