Websites across the internet scrambled this week to patch two critical vulnerabilities in PHP, the open-source scripting language that underpins a huge share of the modern web — including most of the WordPress-powered internet. But according to Amazon's threat intelligence team, someone was already trying to break in days before the fix existed.

The flaws, tracked as CVE-2026-109618 and a companion critical CVE, prompted an urgent round of emergency maintenance at hosting providers, government portals and businesses on Wednesday. Some sites went dark entirely, with visitors greeted by error pages rather than homepages.

What happened

PHP is not a household name, but it is close to unavoidable infrastructure. It runs a large portion of the world's content management systems, forums, e-commerce platforms and custom web applications — a reach that turns a memory-safety or parsing bug in the interpreter into a systemic risk rather than a niche developer headache. The New York Times framed the story for a general audience by asking the obvious question — what is PHP, and why are government and business websites going offline? — a sign of how quickly a language-level bug can become a public-facing outage.

According to The Verge, citing a report from Amazon Threat Intelligence, the company's security team detected an attempted exploitation of the PHP flaw — internally dubbed a "PHP2Shell" exploit attempt — on October 17. The detection came through a monitoring system deliberately designed to bait attackers, and was first reported by Wired and Bleeping Computer.

Amazon's security team says it observed an attempt to exploit the PHP flaw on October 17 through a monitoring system built to lure attackers — days before a patch was publicly available.

A race between researchers and attackers

The chronology is the most uncomfortable part of the story. If exploitation attempts predate the patch, the window between discovery and disclosure was not merely theoretical risk — it was live exposure. CJ Moses, Amazon's chief information security officer, detailed the finding in the company's report, which effectively confirms that at least some actors were probing for the bug while defenders had no official fix to deploy.

That detail reframes the incident. A typical vulnerability disclosure follows a familiar arc: a researcher reports, a vendor patches, the public updates. Here, the order appears to have been scrambled — detection, attempted exploitation, then remediation. For security teams, the lesson is the one that keeps recurring: patching fast is necessary but no longer sufficient when attackers are already in the queue.

Who gets credit — and why it matters

Coverage of the discovery has diverged notably. One widely syndicated headline credited OpenAI with spotting the issue, framing the AI company as the party that identified a defect in "the backbone of the internet." Other accounts center Amazon's threat intelligence unit and its honeypot detection. The two claims are not necessarily in conflict — one organization may have identified the flaw while another observed its exploitation in the wild — but the discrepancy illustrates how attribution in vulnerability research is often contested, especially when the finders are commercial entities with reputations to burnish.

The Verge's coverage leans technical, focused on the CVE identifiers, the patch timeline and the mechanics of the exploit attempt. Wired's reporting emphasizes the pre-patch exploitation, zeroing in on the gap between disclosure and defense. The Times takes the explanatory route, treating the event as a teachable moment about invisible infrastructure. Each framing is accurate; together they describe a single event with three audiences — engineers, security professionals and the general public whose tax filings and benefit portals briefly stopped loading.

The immediate response

On Wednesday, administrators rushed to apply the vendor patch, a process complicated by the sheer breadth of PHP deployments. Key concerns included:

  • Shared hosting: Millions of sites run on managed providers that control their own patch cadence, leaving individual site owners unable to act independently.
  • Legacy installations: Older PHP branches with no remaining vendor support are unlikely to receive fixes at all.
  • CMS dependencies: WordPress and other platforms depend on the underlying interpreter, meaning a language-level fix cascades through plugin and theme ecosystems.
  • Downtime trade-offs: For some operators, taking a service offline to patch was safer than leaving it exposed — which is why the outages spread beyond the directly affected code.

What comes next

The incident is likely to intensify scrutiny of how open-source infrastructure — maintained largely by small teams of volunteers — is secured and disclosed. It also adds momentum to the argument that honeypots and pre-patch threat monitoring should be standard practice rather than a premium service offered by cloud providers.

For now, the operational advice is unglamorous: verify your PHP version, apply the vendor patch, assume compromise if logs show probing before Wednesday, and audit for the indicators published alongside the Amazon report. The internet's most common language just reminded everyone how much depends on it.