The PHP2Shell vulnerabilities were under attack before anyone outside the disclosure process was supposed to know they existed.
PHP2Shell is the nickname for two memory-related flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. Exploited successfully, they could let an attacker run code remotely on a server, including planting web shells (small backdoor programs) to take control of it, according to Sergey Lozhkin, a Kaspersky researcher.
The timeline is the unusual part. Someone leaked details of the flaws on the Hacker News forum before the embargoed announcement. Amazon Threat Intelligence then reported an exploitation attempt as early as October 17, before the leak, and said it "remains unclear how the actor acquired exploit information prior to disclosure." Dane Knecht, Cloudflare's chief technology officer, also reported early attacks before the PHP team released patches. Amazon's current assessment is that PHP2Shell is "now being broadly exploited in the wild."
The reach comes from PHP's footprint. Wikipedia estimates the language runs almost 70% of websites, including those built on WordPress, Drupal and Joomla.
For ordinary browser users, the danger is indirect. These flaws target servers, not your browser. But a hijacked site can be altered to steal data, redirect visitors to phishing pages, or install malware directly. So the internet is not broken, though a compromised site is a worse bet than usual.
Embargoes assume defenders get a head start. An attempt dated October 17 suggests that at least one attacker had the details first, and how remains an open question.