PHP released emergency fixes for two critical flaws that could let attackers run code on web servers without logging in, as CISA urged immediate updates and Amazon reported an attempted exploit four days before the flaws became public.
The flaws, named CVE-2026-109618 and CVE-2026-109619 and called “PHP2Shell,” affect PHP installations that handle web requests. They have a severity score of 9.2 out of 10. CISA urged organizations to prioritize systems that can be reached over the internet and install PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
CISA also advised taking systems offline if they cannot be updated quickly. Amazon said its MadPot network of decoy systems recorded an attempted attack on October 17. The flaws became public on October 21.
Amazon does not know how the attacker got the information. The company also does not know whether the attempt would have worked against a real system. The disclosure followed a leak of flaw details, which led PHP to release its fixes one day earlier than planned.
Cloudflare reported that attempted attacks rose from thousands before disclosure to millions afterward. It said attackers changed the data they sent in their attacks in attempts to get past defenses. The increase shows how quickly attackers can act once information about a serious flaw spreads.
It remains unclear whether the activity before public disclosure led to any confirmed system breaches.