Hackers attempt to exploit two critical PHP remote code execution flaws—CVE-2026-109618 and CVE-2026-109619—before the issues are publicly disclosed and patched, according to cybersecurity researchers at Amazon and other threat intelligence reporting. Multiple outlets say Amazon observed exploitation attempts starting around October 17, with the vulnerabilities later patched on October 21.
As patches roll out, security coverage increasingly focuses on practical mitigation and verification. An open-source scanner, php2shell-scanner from Searchlight Cyber, is described as testing whether hosts are exposed to the two CVEs, noting risks for PHP deployments using common web-serving setups such as Apache mod_php and PHP-FPM under default configurations. Several explainers stress that patch status depends on the PHP runtime that actually handles web requests.
Outlets largely agree on the basic timeline—attempts observed before public disclosure, followed by patches and subsequent broader activity—while differing in emphasis. Some lead with Amazon’s pre-disclosure findings, others broaden coverage to include background on how the vulnerabilities were uncovered or provide developer guidance on what to check and how to update.
