PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions

Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon.com Inc. has disclosed, while exploit attempts seen by Cloudflare Inc. have since climbed into the millions. PHP’s maintainers shipped fixes for the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, on Wednesday after details leaked ahead of a coordinated release. The bugs had sat in PHP’s code for years until an August audit financed by OpenAI Group PBC used an artificial intelligence model to show they could be exploited in practice. Amazon’s MadPot honeypot network recorded the earliest attempt on Oct. 17, while the vulnerabilities were still under…