Hackers exploited PHP2Shell bugs four days before patches released
Hackers began probing the PHP2Shell vulnerabilities on October 17, 2026, four days before security patches were released on Wednesday. Amazon Web Services logged exploitation attempts against its MadPot honeypot and reports indicate the bugs are now being broadly exploited across the internet. Security teams are scrambling to remediate the two critical PHP flaws.
Why it matters: Unpatched PHP systems are at immediate risk of compromise, so rapid patching and monitoring are essential for tech professionals.
Read the coverage
Ars TechnicaHackers got a four-day head start on epic PHP2Shell vulnerability ↗arstechnica.com · 14h ago
WiredHackers Exploited the PHP Vulnerabilities Days Before They Were Patched ↗wired.com · 27h ago
BleepingComputerAmazon says PHP2Shell exploitation began 4 days before patches ↗bleepingcomputer.com · 16h ago
Dark Reading'PHP2Shell' Bugs Signal Red Alert for Security Industry ↗darkreading.com · 34h ago
The Hacker NewsSomeone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed ↗thehackernews.com · 23h ago
SecurityWeekPHP2Shell Exploitation Started Days Before Patches ↗securityweek.com · 19h ago
The RegisterHackers pile on PHP2Shell as AWS reveals attacks began before disclosure ↗theregister.com · 17h ago
This story so far
How it developed, day by day.
Sunday 25 October
Critical PHP bugs threaten widespread web servicesSaturday 24 October
PHP team releases mitigation steps for new remote code execution flawFriday 23 October
Hackers exploited PHP2Shell bugs four days before patches released (this page)
Thursday 22 October
PHP releases emergency patches for two critical PHP2Shell RCE flaws (CVE‑2026‑109618, CVE‑2026‑109619)Wednesday 21 October
PHP warns of two critical flaws, emergency patches due tomorrow
More in Tech
Tech11h ago3 sources
Tech10h ago3 sources
Tech10h ago3 sources