AWS: Attackers Exploited PHP2Shell CVE-2026-109618/9 in the Wild Four Days Before Oct 21 Emergency Patch

AWS analysts say at least one actor began exploiting PHP's unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619 on October 17, four days before the PHP Foundation shipped emergency patches on October 21. Both bugs are rated CVSS 9.2 and affect every PHP release since PHP 5. The vulnerabilities were originally surfaced by OpenAI frontier models under the Patch the Planet coordinated-disclosure effort, but a leak preempted the planned window and Sansec warned mass exploitation would arrive within 15 minutes of the public fix.