AWS honeypots find PHP2Shell was exploited before the patch

1. 09:06
   X@swarmnetics· Discussion

   Threat actors exploited #PHP2Shell vulnerabilities days before public disclosure. Amazon researchers warn that #AI may…(opens the original post in a new tab)
2. 05:00
   X@jfernandogg· Discussion

   Cronología de PHP2Shell en una semana: del parche de PHP del 21 oct al exploit público del 25 y a 7 parches rápidos de…(opens the original post in a new tab)

1. 21:28
   X@DazedProgrammer· Discussion

   Sources: - Reported PHP2Shell hack (honeypot): https://bleepingcomputer.com/news/security/php2shell-security-flaws-now-…(opens the original post in a new tab)
2. 05:53
   X@Unit42_Intel· Discussion

   2/2 This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial acc…(opens the original post in a new tab)

1. 03:33
   X@DailyDarkWeb· Discussion

   ⚠ UPDATE: UNIT 42 CONFIRMS PHP2SHELL EXPLOITATION WITH AGENTIC AI POST-EX Unit 42's Oct 23 threat-brief update confir…(opens the original post in a new tab)

1. 07:23
   X@MaxNixon__· Discussion

   Someone was firing a PHP exploit at Amazon's honeypots on Oct 17. The patch didn't exist until Oct 21. The bug was sti…(opens the original post in a new tab)
2. 01:31
   X@GioLomidze89· Discussion

   PHP2Shell's "Defender's Window" was smaller than it sounds: • AWS saw an exploit attempt Oct 17, 4 days before disclos…(opens the original post in a new tab)
3. 01:08
   X@3kept1c· Discussion

   AWS detectó intentos de explotar PHP2Shell desde el día 17 de octubre. En la página enlazada hay una lista de IPs que p…(opens the original post in a new tab)
4. 01:00
   X@Trellix· Discussion

   The Oct 21 PHP2Shell incident shows us that patching matters more than ever, and that exploitation can start within hou…(opens the original post in a new tab)
5. 00:37
   X@aviatrixtrc· Discussion

   Exploit attempts for PHP2Shell (CVE-2026-109618/109619) were logged four days before public disclosure — scaling to mil…(opens the original post in a new tab)

1. 23:24
   WebAI Threat Watch (aithreat.io)· Media coverage

   Hackers launch attacks using a major PHP2Shell vulnerability four days ahead(opens the original post in a new tab)
2. 21:45
   X@ITConnect_fr· Discussion

   🤯 PHP2Shell : les attaquants avaient quatre jours d’avance sur le correctif Les premières attaques remontent au 17 oc…(opens the original post in a new tab)
3. 21:29
   X@aestheticedwar1· Discussion

   Check the numbers yourself: https://services.nvd.nist.gov/rest/json/cves/2.0 PHP2Shell exploitation timeline: https://…(opens the original post in a new tab)
4. 21:02
   X@threatcluster· Discussion

   Amazon logged PHP2Shell exploit traffic to MadPot on 17 Oct, four days before CVE-2026-109618/109619 disclosure. IOCs…(opens the original post in a new tab)
5. 20:58
   X@editortargett· Discussion

   Has *anyone* actually got a reliable PHP2Shell POC yet that isn't total slop? Ditto anyone seen any in-the-wild exploit…(opens the original post in a new tab)
6. 19:32
   X@E77F· Discussion

   المصدر : https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-pu…(opens the original post in a new tab)
7. 19:32
   X@E77F· Discussion

   عاجل 🚨 | أمازون تكشف رصد محاولة لاستغلال ثغرات PHP2Shell الحرجة قبل الإعلان الرسمي عنها بأربعة أيام أكد فريق استخبارات…(opens the original post in a new tab)
8. 19:08
   X@AlboWu· Discussion

   A security company's public proof-of-concept video for the vulnerability worsened the confusion, but monitoring showed there had already been suspected attack attempts targeting PHP2Shell. The PHP2Shell vulnerability leaker publicly apologized, saying they did not know there was an embargo period https://unwire.hk/2026/10/23/php2shell-hac…(opens the original post in a new tab)
9. 19:02
   X@techdefence· Discussion

   🚨 PHP2Shell: The Race to Patch AWS reported an exploitation attempt on October 17, before the public disclosure of two…(opens the original post in a new tab)
10. 18:25
    X@lucianoprado· Discussion

    @nikitabier And here's the kicker: the php2shell patch dropped on the 21st, but Amazon saw exploitation attempts on the…(opens the original post in a new tab)
11. 17:26
    X@userHandle· Discussion

    Attacks appeared 4 days before the PHP fix: enterprises cannot treat the disclosure date as the starting point. AWS found in its honeypot network that exploitation attempts related to PHP2Shell appeared on October 17, before the vulnerability was disclosed and the fix released on October 21. The two vulnerabilities could allow unauthenticated attackers to execute code remotely; whether any succeeded...(opens the original post in a new tab)
12. 17:21
    X@tony_cleal· Discussion

    https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html(opens the original post in a new tab)
13. 16:58
    X@xbulohi· Discussion

    この21日23時にAWS PHPのwebサーバーの脆弱性が公表される クラウドの高いセキュリティでも必ず安全ではなかったニュースが出てる 一般公開される前（エンバーゴ）されてても悪用の準備されてたらアウト 何が安心かより攻撃されていないか…(opens the original post in a new tab)
14. 16:26
    X@yassersstudio· Discussion

    @amazon Sources: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-pri…(opens the original post in a new tab)
15. 16:15
    X@owari_biwajima· Discussion

    Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot https://aws.amazon.co…(opens the original post in a new tab)
16. 15:46
    X@CybSecWorld· Discussion

    PHP2Shell Exploitation Attempts Began Four Days Before Patches, Amazon Says https://cybsec.world/php2shell-exploitation…(opens the original post in a new tab)
17. 15:37
    X@hadihosn· Discussion

    On PHP2Shell, AWS says it's broadly exploited. Others with good telemetry say they haven't seen confirmed exploitation.…(opens the original post in a new tab)
18. 15:33
    X@bluetouff· Discussion

    Les premières tentatives contre PHP2Shell observées par les pièges d’AWS remontent au 17 octobre, quatre jours avant le…(opens the original post in a new tab)
19. 15:06
    X@LifeboatHQ· Discussion

    Amazon says PHP2Shell exploitation began 4 days before patches https://lifeboat.com/blog/2026/10/amazon-says-php2shell-…(opens the original post in a new tab)
20. 14:16
    X@mohammadvazin· Discussion

    @troyhunt SecurityWeek reports PHP2Shell exploitation started days before the patches, so "no documented breaches yet"…(opens the original post in a new tab)
21. 14:07
    X@tonnyzhou· Discussion

    The patch hasn't been released yet, and hackers have already made their move. The two critical PHP2Shell vulnerabilities with CVSS 9.2: an Amazon honeypot found that someone was probing as early as October 17, when the patch was not yet public—someone obtained the intelligence 4 days earlier than the official release. Once the patch was released, attacks exploded: Cloudfla…(opens the original post in a new tab)
22. 14:06
    X@theomlondhe· Discussion

    PHP2Shell was exploited 4 days before the patch. The official php, WordPress and Joomla Docker images had the fix about…(opens the original post in a new tab)
23. 13:41
    X@BadgerSignalHQ· Discussion

    🚨🍯 Amazon caught attackers exploiting PHP2Shell four days before the world knew it existed Amazon's Threat Intelligenc…(opens the original post in a new tab)
24. 13:35
    X@wale_int· Discussion

    Sources: Amazon https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prio…(opens the original post in a new tab)
25. 13:08
    X@landiantech· Discussion

    Honeypots deployed by Amazon #AWS recorded attack attempts 4 days before the #php vulnerability was disclosed; it is currently impossible to confirm where the attackers obtained the vulnerability information in advance. Decoy servers deployed by Amazon's threat intelligence team recorded attack attempts targeting PHP2Shell on October 17, at which point it was [still] ... days before PH...(opens the original post in a new tab)
26. 13:03
    X@DFIR_Radar· Discussion

    PHP2Shell RCE exploitation began 4 days before public disclosure of CVE-2026-109618 and CVE-2026-109619, with AWS MadPo…(opens the original post in a new tab)
27. 12:58
    X@Frost16Frost· Discussion

    Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot - Amazon Web Services…(opens the original post in a new tab)
28. 12:47
    X@akril· Discussion

    [IT-Connect] - PHP2Shell : les attaquants avaient quatre jours d’avance sur le correctif - https://www.it-connect.fr/ph…(opens the original post in a new tab)
29. 12:35
    X@OnCoinLive_· Discussion

    News Recap🚨 ：Roughly two days after PHP2Shell was disclosed, attention has shifted to early exploitation attempts and c…(opens the original post in a new tab)
30. 11:03
    X@KobinFlow· Discussion

    Let's talk about something chilling: before the vulnerability was publicly disclosed, hackers were already attacking — a full 4 days earlier. This is a real case caught by an AWS honeypot a few days ago (the PHP2Shell vulnerability was only disclosed on the 21st, but attacks came on the 17th). Even more outrageous, just hours after the official patch was released, exploit code was spreading…(opens the original post in a new tab)
31. 10:51
    X@CIDC_Ops· Discussion

    PHP2Shell Exploitation Started Days Before Patches https://www.securityweek.com/php2shell-exploitation-started-days-bef…(opens the original post in a new tab)
32. 10:51
    X@SecurityWeek· Discussion

    PHP2Shell Exploitation Started Days Before Patches https://www.securityweek.com/php2shell-exploitation-started-days-bef…(opens the original post in a new tab)
33. 10:48
    X@lcopelandjr· Discussion

    Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed https://thehackernews.com/…(opens the original post in a new tab)
34. 10:30
    X@StarSnap_1· Discussion

    🚨 Hackers were exploiting a critical PHP vulnerability before it was publicly disclosed. Amazon Threat Intelligence de…(opens the original post in a new tab)
35. 10:14
    X@GeekNewsHada· Discussion

    Amazon, PHP2Shell 공개 나흘 전의 공격 시도 흔적 확인 공격을 유인해 관측하는 MadPot 허니팟 기록에서 10/17 공격 시도를 확인. 10/21 취약점 공개 당일에도 엠바고 해제 전 공격이 관측…(opens the original post in a new tab)
36. 10:04
    X@beuchelt· Discussion

    Amazon's MadPot honeypots logged a PHP2Shell attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four da…(opens the original post in a new tab)
37. 09:49
    X@Yuki339911951· Discussion

    https://aws.amazon.com/jp/blogs/news/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-discl…(opens the original post in a new tab)
38. 09:46
    X@Benjaminliang_1· Discussion

    AWS's MadPot honeypot caught PHP2Shell exploitation on 10/17, 4 days before the vulnerability was public. The embargo was only lifted at 10/21 14:00 UTC, and multiple PoCs were already available from 02:00 UTC that day. AWS recommends that patch deadlines for severe internet-facing vulnerabilities be measured in hours…(opens the original post in a new tab)
39. 09:37
    X@mohammadvazin· Discussion

    Embargo window is the scary part. If MadPot saw PHP2Shell exploitation four days before public disclosure, someone had…(opens the original post in a new tab)
40. 09:26
    X@MadeInBot· Discussion

    AWS spotted a PHP2Shell "exploitation attempt dating to Oct. 17, 2026" on its MadPot honeypots, "four days before publi…(opens the original post in a new tab)
41. 09:15
    X@NullGuard_11· Discussion

    ‼ Amazon dice que un atacante intentó explotar PHP2Shell cuatro días antes de que PHP divulgara las dos fallas. Sus h…(opens the original post in a new tab)
42. 09:02
    X@IntCyberDigest· Discussion

    Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-pub…(opens the original post in a new tab)
43. 09:02
    X@IntCyberDigest· Discussion

    ‼ Amazon says an attacker tried to exploit PHP2Shell four days before PHP disclosed the two flaws. Its MadPot honeypo…(opens the original post in a new tab)
44. 08:52
    X@Jacky8048· Discussion

    It's on. On October 21, PHP urgently released four versions to fix an unauthenticated remote code execution vulnerability with a CVSS of 9.2; seventy percent of websites worldwide run it, and about 1.5 million hosts have not yet been patched. Amazon honeypots recorded attack attempts as early as the 17th, but the PoC leaked early, forcing disclosure to be moved up by a day. AI finds holes and also patches them—this counts as the first…(opens the original post in a new tab)
45. 08:47
    X@ImposeCost· Discussion

    "The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in custo…(opens the original post in a new tab)
46. 08:41
    WebAI Threat Watch (aithreat.io)· Media coverage

    PHP2Shell exposes the weakness in coordinated vulnerability disclosure(opens the original post in a new tab)
47. 08:13
    X@luckyland· Discussion

    It appears PHP2Shell attack attempts have already been observed since the 17th https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began…(opens the original post in a new tab)
48. 08:07
    X@Adizah_Tejani· Discussion

    A good read. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-…(opens the original post in a new tab)
49. 08:04
    X@winzheng_lab· Discussion

    Hackers are 4 days faster than the patch! AWS caught PHP2Shell attacks in advance, and the vulnerability has already been widely exploited. Millions of PHP websites face remote code execution risk, and the zero-day window is being ravaged by hackers. #PHPVulnerability #ZeroDayAttack #Cybersecurity(opens the original post in a new tab)
50. 07:44
    X@zinviex· Discussion

    According to Amazon, exploitation of PHP2Shell began 4 days before the patch was applied! There are also reports that honeypots detected it about 4 months ago, and security is getting interesting in various ways. https://www.bleepingcomputer.com/n…(opens the original post in a new tab)
51. 07:10
    X@EverySynthetic· Discussion

    Sources: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-pu…(opens the original post in a new tab)
52. 06:45
    X@l0rdmalware· Discussion

    Amazon detectó un intento de explotar PHP2Shell en sus honeypots el 17 oct, 4 días antes de la divulgación, desde una r…(opens the original post in a new tab)
53. 06:31
    X@kal25252· Discussion

    Received an attack packet believed to target PHP2Shell (CVE-2026-109618). It is considered part of an attack that exploits a PHP memory management vulnerability and ultimately aims to execute OS commands. The source IP address of the attack is 85.11.16…(opens the original post in a new tab)
54. 06:03
    WebITmedia AI+· Media coverage

    PHP2Shell: exploitation attempts 4 days before public disclosure — Amazon: "Investigate retroactively before the disclosure date"(opens the original post in a new tab)
55. 06:00
    X@LittleLee_x· Discussion

    Before the PHP high-risk vulnerability was even made public, hackers had already acted 4 days in advance! The PHP2Shell incident that shocked the cybersecurity world has revealed another astonishing inside story! On October 20, Hacker News user petecooper exposed the IDs of two PHP remote code execution vulnerabilities in advance, causing the original…(opens the original post in a new tab)
56. 05:59
    X@moton· Discussion

    Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed - https://thehackernews.co…(opens the original post in a new tab)
57. 05:52
    X@rst_cloud· Discussion

    #threatreport #LowCompleteness Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure…(opens the original post in a new tab)
58. 05:23
    X@InfraWatchHQ· Discussion

    watchTowr now lists PHP2Shell exploitation as "In The Wild" and has seen it on its honeypots since Oct 21. Patch expose…(opens the original post in a new tab)
59. 05:07
    X@ThruntingLabs· Discussion

    Yesterday, we promised free PHP2Shell hunting material. Today, we’ve created a Hunt Lead covering successful exploitati…(opens the original post in a new tab)
60. 04:31
    X@zerohuntai· Discussion

    PHP2Shell, one day on: the public exploits don't work on a default PHP install (Sansec), but watchTowr and Amazon confi…(opens the original post in a new tab)
61. 04:23
    X@PrevidianCyber· Discussion

    We’ve seen plenty of php2shell probes and exploitation attempts in our honeypots. At the time of writing, we’ve obser…(opens the original post in a new tab)
62. 04:20
    X@troyhunt· Discussion

    Have we seen any documented breaches / exploitation traced back to either PHP2Shell or the eMudhra debacle? Massive hea…(opens the original post in a new tab)
63. 03:29
    X@autumn_good_35· Discussion

    『The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors.』 Amazo…(opens the original post in a new tab)
64. 03:11
    X@tchsignal· Discussion

    PHP2Shell: Hackers Started Exploiting Critical PHP Flaws Four Days Before Disclosure Hackers were already attempting t…(opens the original post in a new tab)
65. 02:28
    X@anitdotguru· Discussion

    "A massive cybersecurity emergency is unfolding across the internet due to two newly discovered critical vulnerabilitie…(opens the original post in a new tab)
66. 02:23
    X@maricarmen_dev· Discussion

    Qué buscar según AWS: POSTs con PHP_SESSION_UPLOAD_PROGRESS y procesos o archivos raros. El fix está en 8.5.12, 8.4.27,…(opens the original post in a new tab)
67. 02:20
    X@Tylertruthfx· Discussion

    The most worth reading today is that **the internet was blown up by a mine buried for 14 years**; everything else is a side dish. --- ## 1. Something big happened to PHP: global emergency patching (today's biggest event) **CVE-2026-109618 / CVE-2026-109619, codename "php2s…"(opens the original post in a new tab)
68. 01:46
    X@2Workly· Discussion

    Amazon observed active in-the-wild exploitation of new critical PHP flaws four days before disclosure. Attackers gain d…(opens the original post in a new tab)
69. 01:29
    X@techaiwire· Discussion

    Amazon's MadPot honeypots logged a PHP2Shell exploit attempt on October 17, four days before PHP shipped the fixes. If…(opens the original post in a new tab)
70. 01:24
    X@JoeBeOne· Discussion

    Amazon Threat Intel saw PHP2Shell exploit attempts on 17-Oct, four days before public disclosure. For affected: patch u…(opens the original post in a new tab)
71. 01:03
    X@aviatrixtrc· Discussion

    Attackers exploited CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) four days before public disclosure — sending crafte…(opens the original post in a new tab)
72. 00:44
    WebAI Threat Watch (aithreat.io)· Media coverage

    Que se cache-t-il derrière la faille PHP qui a secoué Internet ?(opens the original post in a new tab)
73. 00:00
    X@betterhn50· Discussion

    Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure https://aws.amazon.com/blogs/security/amazon…(opens the original post in a new tab)

1. 23:30
   X@mmaunder· Discussion

   The pareto frontier in cyber just got a third axis: time to discovery. AWS honeypot saw php2shell attacks days before t…(opens the original post in a new tab)
2. 23:30
   X@DiarioBitcoin· Discussion

   🚨 AWS detectó intentos contra PHP2Shell antes de su divulgación MadPot registró actividad el 17 de octubre, cuatro día…(opens the original post in a new tab)
3. 23:25
   Ars Technica AI

   Hackers gained a four-day head start on the critical PHP2Shell vulnerability

   Researchers at the two U.S. cybersecurity organizations Calif and Wiz discovered the PHP2Shell series of vulnerabilities in PHP; OpenAI said that, to its knowledge, frontier AI discovered these vulnerabilities before attackers, and worked with PHP, Calif and Wiz to verify them and develop patches, but hackers still acted four days earlier. Wiz estimates that PHP supports about 70% of websites worldwide, mainly because WordPress is written in PHP. The NSA said such vulnerabilities can often lead directly to a server's file system or database, and advised taking systems offline when immediate updates are not possible; the U.K. NCSC said the vulnerabilities could let hackers control website servers without login credentials such as passwords, and urged U.K. organizations to act immediately. The White House said federal agencies are assessing the potential impact of the vulnerabilities on government systems and critical infrastructure; OpenAI also cautioned that the same AI capabilities could help attackers rapidly develop attack tools.

4. 23:16
   X@betterhn20· Discussion

   Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure https://aws.amazon.com/blogs/security/amazon…(opens the original post in a new tab)
5. 22:25
   X@ChandanHegde_· Discussion

   🚨 CRITICAL ALERT: PHP2Shell (CVSS 9.2) is actively being exploited! A engine-level flaw is allowing unauthenticated RCE…(opens the original post in a new tab)
6. 22:23
   X@christinayiotis· Discussion

   "Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, f…(opens the original post in a new tab)
7. 21:57
   X@DailyDarkWeb· Discussion

   PHP2Shell: AWS reports an attack attempt four days before disclosure Amazon says its MadPot honeypots recorded a PHP2S…(opens the original post in a new tab)
8. 21:32
   X@LandscapeThreat· Discussion

   Amazon Threat Intelligence spotted a PHP2Shell (CVE-2026-109618 / CVE-2026-109619) exploitation attempt on October 17,…(opens the original post in a new tab)
9. 21:31
   X@RDIAMONDFNF· Discussion

   Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed https://thehackernews.com/…(opens the original post in a new tab)
10. 21:09
    X@BleepinComputer· Discussion

    Amazon says PHP2Shell exploitation began 4 days before patches https://www.bleepingcomputer.com/news/security/amazon-sa…(opens the original post in a new tab)
11. 21:09
    WebBleepingComputer· Media coverage

    Amazon says PHP2Shell exploitation began 4 days before patches(opens the original post in a new tab)
12. 20:39
    X@burnrate_ai· Discussion

    Amazon Threat Intelligence: a PHP2Shell exploit attempt hit its MadPot honeypot on Oct. 17, four days before the CVEs w…(opens the original post in a new tab)
13. 20:31
    X@Younik4we· Discussion

    Latest update on PHP2Shell, after reading it I fell silent 😨 The patch had not yet been born, and the attack ran 4 days ahead. On October 17, Amazon's honeypot had already caught someone exploiting this vulnerability, while the official patch was only released on October 21. In other words, the hackers set off a full 4 days before the patch. Even more outrageous is that this vulnerability's earliest... [truncated](opens the original post in a new tab)
14. 20:00
    X@GurkhaCyberFrc· Discussion

    🚨 PHP2Shell: Attackers aren't waiting for security patches! Amazon Threat Intelligence detected an exploitation attemp…(opens the original post in a new tab)
15. 19:50
    Hacker NewsHacker News· Discussion

    Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure(opens the original post in a new tab)
16. 19:42
    X@Cybernews· Discussion

    Amazon Web Services (AWS) said it had detected an attempted attack on October 17th against a decoy server, MadPot, desi…(opens the original post in a new tab)
17. 19:29
    X@cyberscastx· Discussion

    قالت Amazon Threat Intelligence إن شبكتها MadPot رصدت في 17 أكتوبر محاولة استغلال لثغرتي PHP2Shell، أي قبل أربعة أيام م…(opens the original post in a new tab)
18. 15:03
    X@Lurk_Moar_Sperg· Discussion

    In my opinion the timing wasn’t random. PHP2Shell (CVE-2026-109618 / CVE-2026-109619): unauthenticated RCE in PHP core…(opens the original post in a new tab)
19. 14:34
    The Hacker News

    Exploitation attempts appeared 4 days before the public disclosure of the PHP2Shell vulnerability

    Amazon's threat intelligence team said that on October 17, 2026, 4 days before the public disclosure of the PHP2Shell vulnerability, exploitation attempts targeting its MadPot honeypot had already been detected, with source IPs linked to commercial anonymization networks, and it is not yet clear how the attackers obtained exploitation information before disclosure. The two vulnerabilities CVE-2026-109618 and CVE-2026-109619 are located in the PHP core, have a CVSS score of 9.2, enable pre-authentication remote code execution, and affect the entire PHP 7.x and 8.x series; they were discovered by researchers from Calif, OpenAI, and Google's Wiz. Because the PoC leaked early and Chainguard released an image containing the fix ahead of schedule, the PHP Foundation moved coordinated disclosure one day earlier; after the patch was released, Amazon observed multiple exploitations from anonymous infrastructure and judged that multiple threat actors were involved.

20. 10:24
    WIRED Security and AI

    AWS honeypot data shows PHP vulnerability was exploited days before the patch was released

    AWS honeypot data shows that 4 days before the patch was released (October 17), attackers had already attempted to exploit two critical PHP vulnerabilities (collectively called PHP2Shell). The patch was released on Wednesday, and some proof-of-concept exploit code had already appeared publicly before disclosure; AWS says PHP2Shell has been widely exploited in the wild. AWS notes that AI-assisted analysis is shortening the time from patch to exploit code, and more attackers are able to act within hours or even minutes after disclosure.

21. 06:36
    AWS Security

    Amazon Threat Intelligence found exploitation activity before PHP2Shell's public disclosure in the MadPot honeypot

    Amazon Threat Intelligence found PHP2Shell exploitation attempts dated October 17, 2026, in the MadPot honeypot, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The attempt came from a commercial anonymization network IP and is suspected to be the work of a threat actor; how it obtained the vulnerability information in advance remains unclear. More proof-of-concept exploits appeared within hours after the disclosure window lifted, and the vulnerability is now widely exploited in the wild. AWS says upgrading to a patched PHP version is the only complete solution that fixes both CVEs at once, and recommends checking from October 17 rather than from the disclosure date.

Current attention 64·Peak in the comparable period 65 (Oct 23 13:00)·Change over the comparable past 24 hours –