Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Amazon revealed that exploitation attempts against CVE-2026-109618 and CVE-2026-109619 began four days before public disclosure. Cloudflare documented attacks escalating from thousands pre-disclosure to millions post-disclosure within hours. Attackers are actively tweaking payloads to bypass web application firewalls and discovering new exploit paths, with primary focus on PHP's session upload-progress functionality.
Key points
- Attacks detected before vulnerabilities were publicly disclosed
- Exploitation attempts grew from thousands to millions within hours of announcement
- Attackers dynamically adapting payloads to evade detection
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
