GoKawiilAmazon detects PHP2Shell exploitation attempts before public disclosure
Amazon Threat Intelligence found an exploitation attempt against the PHP2Shell vulnerability (CVE-2026-109618/CVE-2026-109619) in its MadPot honeypot telemetry dated Oct. 17, 2026, four days before the embargoed flaw was publicly disclosed. The attempt came from an IP tied to a commercial anonymization service. After the embargo lifted on Oct. 21, Amazon observed multiple proof-of-concept exploits and additional attacks from varied anonymized infrastructure within hours, and the vulnerability is now reportedly being exploited broadly in the wild.
GoKawiil's interpretation of the reporting above, not reported fact.
The pre-disclosure attack suggests, according to Amazon, that at least one threat actor obtained exploit knowledge during the embargo period, though how remains unknown, which could undermine assumptions that coordinated disclosure fully protects defenders until advisories go public. Amazon argues this points to a broader trend of shrinking time between patch release and working exploits, meaning organizations may need to treat the public disclosure date as a late indicator rather than the starting point of risk.
- Amazon detected PHP2Shell exploitation attempts four days before the CVEs were publicly disclosed.
- Multiple distinct actors appeared to exploit the flaw within hours of the embargo lifting on Oct. 21, 2026.
- Amazon says defenders should not assume public disclosure marks the earliest possible exploitation date.
Source: aws.amazon.com, 2026-10-22
Published there as: “Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.