Overview
- Security teams discovered two critical PHP engine bugs tracked as CVE-2026-109618 and CVE-2026-109619 that let an attacker send a crafted web request and run commands directly on vulnerable servers.
- Amazon Threat Intelligence says exploitation attempts began before public disclosure, with activity recorded on Saturday, Oct. 17, showing attackers probed honeypots while fixes were still under embargo.
- The PHP project released emergency fixes on Oct. 21 for supported branches and vendors and volunteer packagers issued backports, but many internet-facing and end-of-life PHP versions remain unpatched.
- Defenders have seen massive automated scanning and exploit bursts reported by Cloudflare and others, while researchers produced advanced exploits that can bypass protections and threat actors tested Mirai-style botnet payloads, though no widespread confirmed compromises have been reported.
- The incident highlights how frontier AI sped both discovery and exploit development, increasing pressure on open-source maintenance and forcing organizations to patch runtimes, review logs for signs of intrusion, and adopt temporary WAF or configuration mitigations.