Details of Preemptive Attacks
Reports issued by the Amazon Threat Intelligence team confirmed that threat actors attempted to exploit critical security vulnerabilities in the PHP programming language days before the official updates were released. Amazon's monitoring systems detected attempts to exploit a vulnerability known as PHP2Shell on October 17, prior to the official announcement of the patch.
The discovered vulnerabilities relate to identifiers CVE-2026-109618 and CVE-2026-109619, which allow attackers to execute malicious code remotely on affected systems. Although Elizabeth Baron, Executive Director of the PHP Foundation, confirmed that there is no evidence of successful remote code execution operations so far, she emphasized the necessity of updating systems immediately.
Why Was the Patch Delayed?
The PHP Foundation explained that the vulnerabilities had been known theoretically since 2024, but addressing these flaws faced complex technical challenges, including maintaining backward compatibility, avoiding the triggering of denial-of-service attacks, and the difficulty of coordinating with third-party extension developers. As the release date for the solution approached, details of the vulnerabilities began to leak through forums and social media platforms, giving attackers an opportunity to exploit them before protection was available.
What Changes Practically?
The PHP Foundation acknowledged a flaw in security crisis management and pledged to change its internal processes to ensure that critical vulnerabilities requiring complex solutions reach leadership faster. The goal is to accelerate decision-making and overcome difficult technical trade-offs that might hinder the release of updates in a timely manner.
This incident serves as a stark reminder of the risks of "information leakage" before responsible disclosure, as the Amazon report indicated that attackers may have identified the vulnerability before public leaks began, suggesting the existence of actors who closely monitor changes in source code repositories or exploit embargo periods to search for undisclosed vulnerabilities.