Patch PHP Servers Now to Block Pre-Auth Remote Code Execution Flaws
Attackers attempted to exploit PHP core vulnerabilities before public disclosure, seeking remote code execution without authentication or leaving clear logs.
Key points
- Amazon detected exploitation attempts on October 17, 2026, four days before public disclosure.
- Two CVSS 9.2 flaws allow pre-authentication remote code execution on PHP 7.x and 8.x.
- Attacks leave minimal digital traces, with only a memory-limit error in server logs.
Amazon’s Threat Intelligence team recorded an attempt to exploit PHP vulnerabilities on October 17, 2026, against its MadPot honeypot service. This activity occurred four days before the flaws were publicly disclosed, indicating that threat actors had access to exploit information prior to the official release. The attempt originated from an IP address linked to a commercial anonymization network and geolocated to Australia.
The targeted weaknesses, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS scale. Researchers from Calif, OpenAI, and Google-owned Wiz discovered these issues in the PHP core. The flaws can be abused to achieve pre-authentication remote code execution, allowing attackers to run arbitrary code on affected systems without needing valid credentials or bypassing existing security controls.
Timeline and Disclosure
Details regarding the CVE identifiers and a proof-of-concept exploit leaked before the scheduled coordinated disclosure date of October 22, 2026. In response, the PHP Foundation moved the public release forward by one day. CJ Moses, CISO of Amazon Integrated Security, noted that targeting a honeypot from an anonymized IP address during the embargo period suggests deliberate activity by a threat actor, though the source of their early intelligence remains unclear.
Scope of Exposure
These shortcomings exist in every PHP release from the 7.x and 8.x series. According to CrowdStrike, the exposure affects every reachable PHP endpoint on an affected server, including static forms, login routes, and health checks. The vulnerability is independent of the content management system, framework, or plugins in use, meaning any server running these PHP versions is potentially at risk regardless of the specific application layer.
What to watch
Patches have been released for these vulnerabilities, and the flaws come under broad exploitation in the wild following the release of the patches. Small-business owners should verify that their servers are running the latest updated versions of PHP 7.x or 8.x immediately. Monitor web server error logs for single memory-limit fatal errors, which may be the only server-side trace of an attempted exploit, as application logs often record no anomalies.
What made it possible
This incident highlights the risk of vulnerabilities in core memory management and error handling components. Attackers exploit these foundational flaws to achieve remote code execution before any application logic runs. Because the compromise occurs at the interpreter level, traditional security controls like authentication checks are bypassed entirely. Teams usually find these attacks difficult to detect because they leave no session data or standard application logs, requiring specialized monitoring of system-level errors rather than typical web telemetry.
Background: Threat intelligence program
A threat intelligence program is a systematic process of collecting, analyzing, and acting on data about potential adversaries. It solves the problem of alert fatigue by providing context, helping you prioritize risks that specifically target your industry and technology stack before an attack occurs.
Read the full guide: Threat Intelligence Programs: Definition, Purpose and Core Components
What to do and how to stay safe: PHP
- Update all servers running PHP 7.x or 8.x to the latest patched versions immediately.
- Review web server error logs for unusual memory-limit fatal errors that may indicate exploitation attempts.
- Assume that any reachable PHP endpoint, including health checks and static forms, is a potential entry point.
- Monitor network traffic for connections from anonymization networks or unusual geographic sources.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific vulnerabilities are being exploited in PHP?
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale.
Do these vulnerabilities require authentication to exploit?
No, they allow pre-authentication remote code execution, meaning no credentials are needed.
Which versions of PHP are affected by these issues?
Every PHP release from the 7.x and 8.x series is affected by these core shortcomings.
