Amazon Threat Intelligence recently identified exploitation attempts of a PHP vulnerability, referred to as PHP2Shell, dating back to October 17, 2026. This activity was detected via MadPot, a honeypot network used by Amazon to monitor and analyze malicious traffic. Notably, these attempts occurred four days before the public disclosure of the associated vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which were under an embargo until October 21, 2026.
The detection of these attempts from anonymized infrastructure while the vulnerability was still under embargo suggests that threat actors may have acquired exploit information prematurely. Following the official release of the embargo, Amazon observed a surge in proof-of-concept exploits and immediate exploitation attempts against their sensors. The variety in payloads and anonymization infrastructure used during these events suggests that multiple distinct actors were involved in targeting the vulnerability.
This image represents the Amazon Web Services security infrastructure used to detect the PHP2Shell exploitation attempts.
Amazon's analysis points to a structural shift in the cybersecurity landscape: the time between a patch being released and a working exploit becoming available is shrinking. The report attributes this to AI-assisted analysis, which makes it significantly cheaper and faster for actors to turn a patch diff or security advisory into a functional exploit. Consequently, Amazon advises security leaders to shift their operational assumptions, recommending that patch and mitigation timelines for critical internet-facing systems be measured in hours rather than days or weeks. They also suggest starting investigations from the earliest known exploitation date rather than the date of public disclosure to ensure comprehensive incident response.
To mitigate these risks, Amazon recommends immediate upgrades to fixed PHP versions, as no configuration-only workarounds fully address both CVEs. For systems that cannot be patched immediately, they suggest considering the blocking of multi-part file uploads and monitoring for specific indicators, such as POST requests containing the 'PHP_SESSION_UPLOAD_PROGRESS' string. Amazon also noted that while they use internal threat intelligence to block known attempts in real-time, the first exploitation of a new vulnerability often occurs before security signatures are available, necessitating a shift toward detection methods that do not rely solely on specific CVE signatures.
While the primary source focuses on the early detection of these attempts, it remains unclear whether any of the pre-disclosure exploitation attempts successfully compromised real-world systems. Furthermore, the report notes that the identified IP addresses are part of shared anonymization infrastructure and are not exclusive to this specific threat activity, meaning organizations should use them as part of a broader investigation rather than as a definitive basis for blocking.