# Hackers Exploit PHP Flaw

> Hackers probe PHP vulnerabilities as sites scramble to patch security flaws.
- Title: Hackers Exploit PHP Flaw · PCMAG | Shortify
- Summary: Hackers probe PHP vulnerabilities as sites scramble to patch security flaws. Hackers have attempted to exploit two serious PHP vulnerabilities before…
- Keywords: php, php2shell, vulnerability, hackers, security, php foundation, amazon, cloudflare, vulncheck, madpot, technology, Exploit
- Source: PCMAG — https://pcmag.com/news/hackers-already-trying-to-exploit-serious-php-flaw
- Author: Michael Kan
- Published: 2026-10-21T22:03:43+00:00
- Read time: 1 min
- Topics: php, php2shell, vulnerability, hackers, security, php foundation, amazon, cloudflare, vulncheck, madpot, technology
## Hackers probe PHP flaws
Hackers have quickly pounced on a major flaw in PHP, a scripting language used across the web, probing vulnerable sites and trying to exploit them.
## Amazon detects early exploit attempt
Amazon uncovered signs that someone tried to abuse the flaw four days earlier on Saturday before the threat was publicly known.
## Cybersecurity vendors spot activity
A growing number of cybersecurity providers and researchers have spotted suspicious activity as the IT industry scrambles to patch two high-severity vulnerabilities in PHP.
## VulnCheck sets up honeypots
VulnCheck has set up honeypots, or fake vulnerable systems, to track if hackers are targeting the PHP flaws.
## Honeypots show Canadian and Dutch IPs
Two IP addresses from Canada and the Netherlands, flagged as malicious, were frequently connecting to the honeypots to probe for vulnerabilities.
## Chinese IP attempts exploit
VulnCheck observed at least one attempted exploit coming from an IP address based in China that abused the first PHP flaw, CVE-2026-109618.
## Exploit attempt failed
The exploit attempt failed because it tried to read the file back through a file disclosure path, but the path did not exist, so the attempt received a 404.
## Amazon's earlier exploit attempt
Amazon discovered an earlier exploitation attempt dating to Oct. 17, 2026 in the company's Madpot honeypot security tool.
## Amazon explains exploit origin
The exploit attempt originated from an IP address associated with a commercial anonymization network, suggesting the activity was conducted by a threat actor.
## Key takeaway

Hackers have attempted to exploit two serious PHP vulnerabilities before official patches were released, prompting some websites to go offline temporarily.