Overview
- Amazon Threat Intelligence says attackers targeted a PHP honeypot on Saturday, October 17, 2026, four days before the public advisory for CVE‑2026‑109618 and CVE‑2026‑109619.
- PHP maintainers released emergency fixes on Wednesday, October 21, 2026, and vendors including AWS advise that upgrading to the patched PHP versions is the only complete remediation.
- Cloudflare and other telemetry show probes rose from thousands to millions of exploit attempts within hours of the patch release, indicating rapid weaponization and widespread automated scanning.
- Researchers have published proof‑of‑concepts that can bypass protections like ASLR and analysts observed attempted delivery of a Mirai‑derived payload called Potassium, although security vendors report no publicly confirmed successful real‑world remote code executions so far.
- Defenders should patch immediately, apply layered protections such as WAFs and network mitigations, search logs and processes for signs of compromise going back to October 17, and account for embedded or vendor PHP builds that may not update automatically.