Emergency PHP remediation is no longer a patch-only task: Amazon telemetry places exploit attempts four days before public disclosure, requiring retrospective investigation from 17 October.
What changed
Amazon Threat Intelligence says PHP2Shell exploit attempts began on 17 October, before PHP disclosed CVE-2026-109618 and CVE-2026-109619. Supported branches have fixed releases, but older branches lack an upstream fix. The conditions arise in the PHP runtime and can be reached before normal application logic provides a meaningful security boundary.
Public record through 2026-10-23. Source references count citations across published briefings, including repeated sources. Explore the record and its limits →
What We Publish / What We Sell
D
Free · Public
The Daily
Five evidence-backed selections for security leaders, every weekday.
Security.io editorial scores from 0–100. Exposure reflects reachable enterprise surface, urgency reflects the decision window, and business consequence reflects credible operational, data and trust impact across today’s five stories. Exposure: 98. Urgency: 97. Business consequence: 91. Focus the chart and use the up and down arrow keys for detail. Source: Security.io editorial scoring based on the selected sources.