Overview
- The PHP project issued emergency releases on October 21 that fix two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 which allow unauthenticated remote code execution.
- Amazon Threat Intelligence detected exploitation attempts beginning October 17, indicating attackers probed systems before public disclosure and reducing the defenders’ response window.
- Independent researchers reported confirmed successful RCE against at least some Apache mod_php hosts, but the total number and impact of real compromises remain under investigation.
- Frontier AI models materially accelerated exploit development for multiple research teams, which sped both defensive analysis and the creation of working proof-of-concept code that spread quickly after disclosure.
- Immediate mitigation requires installing the October 21 fixes, restarting or replacing web-worker processes and container images to ensure the patched binary is active, and hunting logs back to October 17 for signs of pre-patch compromise.