Hackers got a four-day head start on epic PHP2Shell vulnerability

Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon has disclosed, while exploit attempts seen by Cloudflare have since climbed into the millions. PHP’s maintainers shipped fixes for CVE-2026-109618 and CVE-2026-109619 after details leaked ahead of a coordinated release, Ars Technica reports.