Amazon says PHP2Shell exploitation began 4 days before patches

Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the

Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise

<p>The PHP project shipped emergency fixes this morning (Oct 21, 2026, about 9:35 AM ET) for two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, now

<a href="https://news.ycombinator.com/item?id=50180836">Comments</a>

<a href="https://news.ycombinator.com/item?id=50187708">Comments</a>