PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions

PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions

Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon.com Inc. has disclosed, while exploit attempts seen by Cloudflare Inc. have since climbed into the millions.

PHP’s maintainers shipped fixes for the two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, on Wednesday after details leaked ahead of a coordinated release. The bugs had sat in PHP’s code for years until an August audit financed…