PHP ships fixes for the PHP2Shell flaws, and Amazon says someone probed them four days before disclosure

The PHP project released patches on Wednesday for CVE-2026-109618 and CVE-2026-109619, two remote code execution flaws known as PHP2Shell. Both are rated 9.2 on the CVSS v4.0 scale. TechCrunch reports that the bugs have been present in every PHP version since PHP 5, released in 2004. The US National Security Agency warned that websites that cannot be patched right away should be taken offline until they can be. The recommended version is PHP 8.5.12. According to SecurityWeek, Amazon saw the first exploitation attempt against a honeypot on October 17, while the flaws were still under embargo. It came from a commercial anonymization network, and Amazon says it is unclear how the actor got exploit information. Details leaked online on October 20, proof-of-concept exploits spread, and mass scanning began shortly after the patches were released. The organizations that observed the activity said the attempts were unsuccessful. CISA said it had not seen exploitation as of Wednesday. Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected, but it has not yet shipped fixes. Fortinet is still checking 12 products, and Cisco is checking 31 products and cloud services. OpenAI said the security firm Calif found one of the flaws using GPT-5.6 Sol under its Patch the Planet program, and Wiz reported both. OpenAI also proposed a five-stage framework for disclosing vulnerabilities found by AI.