Amazon Detected Hackers Before PHP Vulnerabilities Were Fixed

On October 17, Amazon's security team discovered hacking attempts aimed at exploiting vulnerabilities in the PHP programming language. This occurred four days before a public patch was released. This was reported by CJ Moses, Chief Information Security Officer at Amazon Integrated Security.

The new vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute code on vulnerable servers without needing to log in. According to Amazon, proof-of-concept exploits were circulating by 2:00 UTC on October 21—about 12 hours before the official release of patches. “PHP2Shell is currently being widely exploited on the internet,” Moses wrote. He also explained why the window of opportunity is shrinking: “AI analysis makes it cheaper to turn a patch or recommendation into a working exploit.”

The vulnerabilities were discovered by Wiz, a company owned by Alphabet, using its proprietary AI tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. According to Wiz, the vulnerabilities date back to PHP 5.4 and have been hidden in the code for over a decade. “Applying the PHP security update remains the only complete way to address the issue,” the firm noted.

Organizations, including the National Cyber Security Centre of the Netherlands, the Port of Rotterdam, the Overheid nl portal, and several hospitals, temporarily shut down websites on October 21. At 14:00 UTC the same day, PHP released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

According to W3Techs, PHP is used on approximately 75% of websites with a recognizable programming language. Meanwhile, Censys estimates that out of 2.6 million hosts, about 1.5 million (approximately 58%) are running a version of PHP without an available patch—they cannot simply be patched and require a full upgrade to a newer version.

According to Tiffany Farriss, interim CEO of the Drupal Association, “all servers using any version of PHP released in the last 20 years will be vulnerable.” Costa Raju, co-founder of TLP:Black, warned that the next phase could result in “massive compromise of every vulnerable web server on the internet.”

Cloudflare reported that attackers have begun changing payloads to bypass filters. For those using PHP 8.2 or older, it is recommended to schedule an upgrade: support for PHP 8.2 will end on December 31.