Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
A PHP RCE bug was exploited against an AWS honeypot four days before its CVE was even publicly disclosed.
AWS's threat intelligence team detected exploitation of a PHP remote-code-execution flaw (CVE-2026-109618/109619, dubbed PHP2Shell) in its MadPot honeypot network on October 17, four days before the vulnerability's October 21 public disclosure, with the attempt traced to anonymization infrastructure. Once the embargo lifted, multiple independent actors began exploiting it within hours, and AWS says PHP2Shell is now broadly exploited in the wild with no configuration-only fix available short of patching.
Why it matters
This shows that embargoed vulnerabilities can leak or be independently rediscovered and exploited before defenders ever see an advisory, and that the window between disclosure and mass exploitation is shrinking to hours. That undermines standard patch SLAs (7 or 30 days) for internet-facing systems and pushes defenders toward behavior-based detection rather than CVE-specific signatures.
What is verified
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt in MadPot honeypot telemetry dated October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. [1]
The pre-disclosure exploitation attempt originated from an IP address associated with a commercial anonymization network. [1]
After the embargo lifted at 2026-10-21 1400 UTC, additional proof-of-concept exploits appeared within hours and were observed against AWS sensors almost immediately, with PHP2Shell now being broadly exploited in the wild. [1]
AWS recommends upgrading immediately to fixed PHP versions as the only complete remediation, since no configuration-only workaround fully addresses both CVEs, and provides IOCs and WAF mitigation guidance. [1]
AWS states that AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit, which it says is shrinking the time from patch to working exploit. [1]
What is not
- Technical analysis of the pre-disclosure exploitation attempt is described as ongoing, and AWS states it is unclear whether any of the observed attempts would have succeeded against real-world systems.
- It remains unclear how the threat actor acquired exploit information before public disclosure, i.e. whether the embargo was breached, independently discovered, or leaked.
- No independent corroboration outside AWS's own telemetry is given; the claim about AI-assisted exploit development shrinking patch-to-exploit time is asserted by AWS without supporting data in this evidence.
- Details of the underlying PHP vulnerabilities (affected versions, CVSS, exact mechanism beyond multi-part upload and PHP_SESSION_UPLOAD_PROGRESS) are not fully specified here.
Sources
- 1AWS What's Newaws.amazon.com · Primary source
Original source published 22 October 2026 at 00:36.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.