Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Amazon Threat Intelligence detected exploitation attempts targeting a PHP vulnerability in their honeypot network days before the official public disclosure. The activity involved multiple actors using anonymized infrastructure, highlighting the risks of pre-disclosure leaks.
Why it matters
This event demonstrates how threat actors monitor and exploit vulnerabilities immediately upon or even before public disclosure, forcing security teams to rethink embargo and patching strategies.
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in