Amazon Threat Intelligence found exploitation activity before PHP2Shell's public disclosure in the MadPot honeypot

Amazon Threat Intelligence found PHP2Shell exploitation attempts dated October 17, 2026, in the MadPot honeypot, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The attempt came from a commercial anonymization network IP and is suspected to be the work of a threat actor; how it obtained the vulnerability information in advance remains unclear. More proof-of-concept exploits appeared within hours after the disclosure window lifted, and the vulnerability is now widely exploited in the wild. AWS says upgrading to a patched PHP version is the only complete solution that fixes both CVEs at once, and recommends checking from October 17 rather than from the disclosure date.