Global internet infrastructure faced severe disruption after unidentified threat actors attempted to exploit critical vulnerabilities in PHP before security patches were publicly distributed. According to reporting from Ars Technica, Amazon Threat Intelligence confirmed that attempts to weaponize the flaw were detected on October 17, 2026, four days before the official fix went live on October 21. The activity was captured through Amazons MadPot threat lure network, originating from IP addresses tied to commercial anonymization networks. The vulnerability set, dubbed PHP2Shell, consists of CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 out of 10 on the Common Vulnerability Scoring System. These critical flaws enable pre-authentication remote code execution, allowing outsiders to run arbitrary system commands without prior credential verification.
The underlying vulnerabilities had remained hidden in PHPs core memory management and error handling routines for more than a decade until researchers from Calif, OpenAI, and Alphabet subsidiary Wiz uncovered them using artificial intelligence tools. Standard industry procedures rely on coordinated vulnerability disclosure, keeping discoveries confidential so software maintainers can finalize defenses before public revelation. However, Amazons Chief Information Security Officer CJ Moses noted that targeting honeypots through anonymizing relays while the flaws were still protected by an embargo indicates an organized operation, though how the attackers acquired penetration details prior to the public announcement remains unconfirmed. TLP:Black cofounder Costin Raiu also pointed out that artificial intelligence instruments are drastically accelerating the race to exploit software weaknesses.
In response to the emergency, the PHP Foundation published security updates on October 21 at 14:00 UTC for supported releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Despite these patches, unauthorized exploitation attempts have spread broadly in the wild, including through commercial anonymization infrastructure and an Australian IP address. The incident underscores a fundamental shift in cybersecurity risk, as AI-driven code analysis shrinks the window between vulnerability discovery and working exploit creation from weeks down to hours or minutes. Because the open source programming language powers approximately 70 percent of all websites worldwide, security teams and enterprise operators must now reconfigure traditional patching frameworks that historically assumed multiple days of response buffer.