Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are being exploited at massive scale, with Cloudflare recording millions of attack attempts since disclosure earlier this week and attackers actively tweaking payloads to bypass firewall protections. Amazon has revealed that exploitation attempts were detected as early as October 17th — four days before patches were released — suggesting at least one threat actor had prior knowledge of the flaws. Administrators are being urged to patch immediately and investigate suspicious activity dating back to at least October 17th, as the vulnerabilities affect the PHP runtime itself, putting a vast number of websites at risk.
