Amazon says PHP2Shell exploitation began 4 days before patches

A BleepingComputer security news feed covering active exploitation of critical PHP2Shell and Plex2Shell vulnerabilities, a maximum-severity GitLab code execution flaw, large-scale ransomware and cybercrime operations, ClickFix social engineering, infrastructure compromise, supply-chain and certificate authority incidents, and emerging threat actor techniques. The most urgent items involve internet-facing remote code execution vulnerabilities exploited before or shortly after patch release, including PHP CVE-2026-109618 and CVE-2026-109619.