GoKawiilAmazon detects PHP2Shell exploitation attempts before public disclosure
Amazon Threat Intelligence found an exploitation attempt against the PHP2Shell vulnerability (CVE-2026-109618/CVE-2026-109619) in its MadPot honeypot telemetry dated Oct. 17, 2026, four days before the embargoed flaw was publicly disclosed. The attempt came from an IP tied to a commercial anonymization service. After the embargo lifted on Oct. 21, Amazon observed multiple proof-of-concept exploits and additional attacks from varied anonymized infrastructure within hours, and the vulnerability is now reportedly being exploited broadly in the wild.