The disastrous PHP vulnerabilities were exploited days before the patch
Amazon's security team detected exploitation attempts of two critical PHP flaws (CVE-2026-109618 and CVE-2026-) on October 17, using honeypot systems to identify attacker activity. The vulnerabilities impacted PHP-based sites widely, including WordPress installations. The exploits occurred before the public patch release, demonstrating the security risk posed by the flaws to the large portion of internet infrastructure running PHP.
Key points
- Hackers exploited PHP flaws days before patches released
- Exploitation detected via Amazon's security monitoring systems
- Affects WordPress and broad swath of PHP-based websites
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Verge did the reporting; read the original for the full story.
Read the full story at The Verge
