The ACSC published an alert on 21 October covering the two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0 and together dubbed PHP2Shell, which allow unauthenticated remote code execution on sites running PHP versions released over the past decade. Amazon Threat Intelligence then confirmed it observed a PHP2Shell exploitation attempt on 17 October — four days before the scheduled disclosure — from an IP associated with a commercial anonymisation network, in its MadPot honeypot fleet. Multiple proof-of-concept exploits appeared around twelve hours before the planned release, with payload variation suggesting more than one actor; CISA said it had not itself observed exploitation. French public administrations, the Dutch national cyber security centre and the University of Vienna took sites offline ahead of patching. PHP underpins roughly 69.7% of websites whose server-side language is known.

• Source article