Hackers Exploited PHP Vulnerabilities Days Before Patches Were Released

Amazon Web Services detected attempts to exploit the critical PHP2Shell flaws four days before fixes were available. The vulnerabilities are now being 'broadly exploited' across the internet.

By Lily Hay Newman | October 21, 2026

Early Exploitation Detected

Amazon Web Services (AWS) logged attempts to leverage the PHP2Shell vulnerabilities four days before patches were released, according to the company. These flaws, which have been described as "internet-melting," are now being "broadly exploited" across the web.

The PHP2Shell bugs affect the widely used PHP scripting language, potentially exposing countless websites and applications to remote code execution and other attacks. The early exploitation attempts suggest that attackers were already aware of the vulnerabilities before official fixes were made available, highlighting the ongoing challenge of securing open-source software in 2026's threat landscape.

Broad Exploitation Underway

Since the patches were released, exploitation attempts have escalated significantly. Security researchers warn that the vulnerabilities are being actively weaponized, with attack traffic targeting unpatched systems globally. Organizations are urged to apply the patches immediately and monitor for signs of compromise.

The incident underscores the importance of rapid patch management and threat intelligence sharing, as attackers continue to exploit known and unknown vulnerabilities with increasing speed. As of late 2026, such zero-day and n-day exploits remain a top concern for enterprises and developers alike.

This article has been updated to reflect the latest developments.

via Wired AI