PHP developers issue emergency patches as hackers exploit flaws before release

PHP maintainers rolled out fixes for two high‑severity vulnerabilities, but AWS data shows attackers were probing the bugs from October 17.

By Felo News Desk · Published Thu, 22 Oct 2026 09:40:27 GMT

PHP developers announced emergency patches for two critical code‑execution vulnerabilities on 21 October 2026, while Amazon Web Services (AWS) reported that attackers began exploiting the flaws as early as 17 October, four days before the public disclosure.

What happened

The PHP security team scheduled patches for 4 pm South African time (2 pm GMT) on 21 October, rating both flaws 9.2 out of 10 on the CVSS v4 scale. The vulnerabilities, identified as CVE‑2026‑109618 and CVE‑2026‑109619, affect every PHP version from PHP 5 onward. The EU Computer Emergency Response Team (CERT‑EU) warned that the flaws enable unauthenticated remote code execution and urged organisations unable to patch to take affected sites offline. The PHP Foundation later released emergency patches fixing the issues in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with limited source‑code fixes for self‑compiled builds of PHP 7.4, 8.0 and 8.1.

What the reports add

TechCentral noted that the PHP team said details of the affected versions and the fixed releases would be published when the patches are issued. It also reported that the Australian Cyber Security Centre (ACSC) said it was not aware of active exploitation at the time of the advisory. Cloudflare’s CTO Dane Knecht said on X that the company was updating firewall rules as a stop‑gap, adding, “We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a stopgap only. Patch as soon as PHP releases the update.” GoDaddy warned that the flaws could let attackers execute code on servers over the internet, potentially leading to data theft, defacement or full system compromise. Wordfence highlighted that every WordPress site runs on a server with PHP installed and that WordPress’s automatic updates would not apply the PHP fix.
Wired reported that AWS analysts, reviewing activity on a honeypot, observed exploitation attempts on 17 October from an IP linked to a commercial anonymisation network, indicating that attackers were reverse‑engineering the vulnerabilities before the official embargo lifted. The research named the bugs “PHP2Shell” and said multiple anonymised IPs targeted the honeypot, suggesting several actors were involved.

What was said

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,”

— Huntress, blog post, cited by TechCentral.

“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,”

— CJ Moses, AWS chief information security officer, research post, cited by Wired.

“Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real‑world systems,”

— CJ Moses, Wired.

“The time from patch to working exploit is shrinking for structural reasons. AI‑assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit,”

— CJ Moses, Wired.

How it came about

Felo’s earlier coverage on 21 October detailed the planned emergency patches and listed the affected CVE identifiers (see PHP critical security patches) and the specific fixed versions (see PHP emergency patches). Those articles noted the rapid release schedule and the broad impact on PHP‑based applications, providing the context for the exploitation findings reported by AWS.

Key facts

PHP released emergency patches for two critical vulnerabilities on 21 October 2026. (techcentral.co.za)
Both vulnerabilities received a CVSS v4 score of 9.2. (techcentral.co.za)
AWS detected exploitation attempts on 17 October 2026, four days before the public patch release. (wired.com)

Timeline

2026-10-17 — AWS honeypot logs show exploitation attempts from an anonymised IP.
2026-10-21 — PHP security team schedules and releases emergency patches for two critical flaws.
2026-10-21 — CERT‑EU advisory warns of unauthenticated remote code execution risk.