Amazon Threat Intelligence identified exploitation attempts of PHP2Shell vulnerabilities on October 17, 2026, according to an AWS Security Blog post. This detection occurred four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619 on October 21, 2026.
The initial exploitation attempt originated from an IP address associated with a commercial anonymization network, targeting Amazon’s MadPot honeypot infrastructure. While the vulnerability remained under embargo, the use of anonymized infrastructure suggests threat actor involvement, though the source said it remains unclear how the actor obtained exploit information prior to disclosure.
Following the embargo lift on October 21 at 1400 UTC, Amazon Threat Intelligence identified multiple proof-of-concept exploits, with the earliest appearing around 0200 UTC that same day. Between 0200 UTC and 0800 UTC, additional exploitation attempts targeted MadPot from multiple anonymized IP addresses using varying payloads and infrastructure, suggesting activity from multiple threat actors. According to the blog post, technical analysis is ongoing and it remains unclear whether these attempts would have succeeded against real-world systems.
Amazon identified six IP addresses associated with the exploitation activity, ranging from the initial October 17 detection to multiple addresses on October 21. The source noted these addresses represent shared anonymization infrastructure and are not exclusive to this threat activity.
The AWS blog highlighted two key lessons from the incident. First, embargo windows protect defenders only until another party discovers the same vulnerability, and organizations should not assume public disclosure marks the earliest exploitation date. Second, the time from patch release to working exploit is shrinking due to structural factors, including AI-assisted analysis making it cheaper to convert patch details into functional exploits.
Amazon recommended immediate actions including upgrading to fixed PHP versions as the only complete remediation, considering temporary blocks on multi-part file uploads if patching is delayed, and monitoring web server logs for suspicious activity. The company also advised investigating from the earliest known exploitation date rather than from the public disclosure date, and investing in detections that do not rely on specific CVE signatures.
According to the post, AWS deploys multiple protection layers including automated detection systems that analyze over 200 billion events per minute and integrate threat intelligence from MadPot to identify and block exploitation attempts in real time.
Key facts
- Amazon identified PHP2Shell exploitation on October 17, 2026, four days before public vulnerability disclosure
- The initial attack originated from an anonymized IP address, suggesting threat actor involvement
- Multiple additional attacks occurred within hours of embargo lift on October 21, using different IP addresses and payloads
- Amazon recommends immediate patching, as no configuration-only workarounds fully address both vulnerabilities
- AWS processes over 200 billion events per minute to detect exploitation attempts in real time