Amazon Spotted Hackers Using PHP Flaws Four Days Before They Were Public

Amazon says it detected attackers using two severe security flaws in PHP, CVE-2026-109618 and CVE-2026-109619, on October 17, 2026, four days before public disclosure. PHP is a programming language that powers many websites. The attempt targeted MadPot, Amazon's decoy monitoring system, from a masked internet address. Amazon's findings point to a deliberate attacker, not just automated probing.