Security1 hOctober 23, 2026, 18:47

Amazon warns of broad exploitation of PHP vulnerabilities

Amazon said attackers are widely exploiting newly disclosed PHP flaws CVE-2026-109618 and CVE-2026-109619 that allow unauthenticated code execution. About 1.5 million of 2.6 million PHP hosts (58%) run versions without an available fix and need full software upgrades. Patches shipped on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

TechBriefly

Open source

Amazon warns of broad exploitation of PHP vulnerabilities

An exploitation attempt was detected on Oct. 17, four days before fixes
1.5 million of 2.6 million PHP hosts lack an available patch
The flaws were found using AI tools Gemini 4 Argon and GPT-5.6 Sol
PHP 8.2 reaches end of life on Dec. 31

#Amazon#PHP#WordPress#Cloudflare

Millions of PHP2Shell exploit attempts, but no confirmed break-ins

Security

NSA urges immediate PHP patching as AI-found PHP2Shell flaws hit ~70% of the web

Security

PHP2Shell shows AI finds flaws faster than maintainers can fix them

Security

Amazon warns of broad exploitation of PHP vulnerabilities

Millions of PHP2Shell exploit attempts, but no confirmed break-ins

NSA urges immediate PHP patching as AI-found PHP2Shell flaws hit ~70% of the web

PHP2Shell shows AI finds flaws faster than maintainers can fix them

PHP2Shell exposes weaknesses in coordinated vulnerability disclosure