The disastrous PHP vulnerabilities were exploited days before the patch

Websites still running unpatched PHP versions face immediate risk of malicious code execution.

Hackers attempted to exploit critical security vulnerabilities in the PHP programming language days before a patch was released, according to Amazon Threat Intelligence. The PHP Foundation discovered the flaws, identified as CVE-2026-109618 and CVE-2026-109619, in 2024, but a fix was delayed due to compatibility concerns and the difficulty of coordinating changes across numerous third-party extensions. On October 17th, Amazon's security team detected an exploit attempt targeting a honeypot from an anonymized IP, suggesting a threat actor may have known about the vulnerability before public disclosure. Further exploitation attempts were observed on October 21st, just hours before the patch was made available. Websites worldwide, including those using WordPress, scrambled to apply the update to prevent remote code execution. The PHP Foundation stated that, to their knowledge, no successful remote code execution had occurred, but emphasized the necessity of updating affected systems and is now revising processes to expedite future complex fixes.

The attempted exploitation of PHP vulnerabilities days before a patch highlights a critical gap in the vulnerability disclosure and patching lifecycle, especially for widely used open-source software. The delay in releasing a fix due to complex compatibility issues and the subsequent information leak underscore the challenges in securing the internet's foundational technologies. This event may push for faster security response protocols within the PHP Foundation and similar organizations, potentially involving earlier communication with key infrastructure providers.

The incident serves as a stark reminder that the vast majority of the web remains reliant on software with long development cycles and complex interdependencies. The fact that attackers may have gained access to exploit details prior to the official patch indicates a potential need for more robust security measures during the remediation process itself. We can anticipate increased scrutiny on how major software foundations handle critical vulnerabilities and their communication strategies with the public and security researchers.