Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence . CJ Moses, Amazon chief information security officer, writes that the company’s security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer .

On Wednesday, websites scrambled to apply a patch for two critical security vulnerabilities affecting PHP , a programming language used by a large portion of the internet, including WordPress sites. The flaws — CVE-2026-109618 and CVE-2026-109619 — could allow hackers to execute malicious code remotely on vulnerable devices.…