PHP Vulnerabilities Exploited Days Before Official Patch Release

Image: The disastrous PHP vulnerabilities were exploited days before the patch · Source

Critical PHP security flaws were targeted by hackers days before an official patch, as revealed by Amazon Threat Intelligence. The PHP Foundation emphasizes the urgent need for updates despite no confirmed successful attacks.

Two critical security vulnerabilities affecting PHP, a widely used web programming language, were exploited by hackers several days prior to the release of an official patch, according to a report from Amazon Threat Intelligence. The vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, could allow remote code execution on affected systems, posing a significant risk to websites including those running WordPress.

On October 17th, before any public disclosure or patch availability, Amazon's security team detected attempts to exploit these flaws through a specially designed honeypot monitoring system. The activity came from anonymized IP addresses, indicating possible threat actors with prior knowledge of the vulnerabilities before details became public. Additional exploitation attempts were recorded on October 21st, mere hours ahead of the patch being deployed.

The PHP Foundation initially identified the flaws in 2024 and developed potential fixes. However, they delayed releasing patches due to concerns over backward compatibility breaks, risks of denial-of-service, and the complexity of coordinating changes across numerous third-party extensions. This complex balancing act postponed the resolution despite the critical nature of the bugs.

Elizabeth Barron, the PHP Foundation's executive director, confirmed that there have been no verified successful remote code executions to date but urged users to promptly update their systems. The Foundation acknowledged the need for improved vulnerability management and pledged to expedite handling similarly complex issues in future incidents by involving leadership more directly to reach timely solutions.

The incident highlights the challenges in securing foundational web technologies where patches must be carefully developed and coordinated to avoid disruption, while attackers actively seek to exploit any window of exposure. Website administrators and developers are strongly advised to apply the released patches immediately to mitigate potential threats.