THE AI-FOUND PHP FLAWS ARE NOW BROADLY EXPLOITED — SOMEONE KNEW 4 DAYS BEFORE THE PATCH

Amazon's chief information security officer CJ Moses says the two AI-found PHP flaws — CVE-2026-109618 and CVE-2026-109619, which let attackers run code on a server without logging in — are 'now being broadly exploited in the wild.'

Amazon's MadPot honeypot network caught the first attempt on October 17 — four days before PHP shipped patches — arriving from an IP tied to a commercial anonymization network. Amazon does not know how the attacker learned of the bugs while they were still under embargo. VirusTotal counts more than 5.1 million PHP hosts exposed online.