PHP2Shell: two critical PHP flaws exploited before patches
Event Brief generated 50 s read
Written by an AI. It was merged from the 4 sources on this page and has not been reviewed by a person.
The short version
- PHP shipped emergency patches for CVE-2026-109618 and CVE-2026-109619, tracked as PHP2Shell.
- Krebs on Security says about 70 percent of websites need to update core software, and exploits are already in the wild.
- Amazon Threat Intelligence says exploitation began four days before patches were released on Wednesday.
What happened
The PHP security team released emergency patches for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, tracked together as PHP2Shell. Krebs on Security reports that nearly 70 percent of websites need to update core software and that working exploits exist. Amazon Threat Intelligence says attackers began targeting the flaws four days before the patches were released on Wednesday. CISA separately warns that attackers are exploiting four Plex Media Server flaws in a chain.
Why it might matter
Many sites run PHP, so unpatched servers may be taken over. Exploitation that started before the patch date means some servers may already be compromised, not only exposed.
What we don’t know yet
The sources do not give the number of affected servers or confirmed compromises. The sources also do not say which PHP versions are affected. Amazon’s four-day timeline is its own finding. Krebs and BBC say the flaw is widely exploited, but do not give counts.
