Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to October 17, 2026, in Mad Pot honeypot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The attempt came from an IP address tied to a commercial anonymization network. Although the vulnerability was under embargo, the targeting of a honeypot suggests a threat actor was active, and it remains unclear how that actor obtained exploit information before disclosure.
The PHP embargo was set to lift on October 21, 2026 at 14:00 UTC. Amazon Threat Intelligence observed multiple proof-of-concept exploits on release day, the earliest around 02:00 UTC. Between 02:00 and 08:00 UTC, additional exploitation attempts targeting Mad Pot came from further anonymized infrastructure. Varying payloads suggest multiple actors, and technical analysis is ongoing to determine whether any attempts would have succeeded against real systems.
Within hours of the patch release, more proof-of-concept exploits appeared and were used against Amazon's sensors almost immediately. PHP2Shell is now being broadly exploited in the wild. Amazon draws two lessons: an embargo protects defenders only until someone else finds the same bug, and the public disclosure date may not be the earliest date of exploitation. Because AI-assisted analysis is making it cheaper to turn patches into working exploits, the gap between patch and attack is shrinking.
Security teams should measure patch timelines for critical internet-facing vulnerabilities in hours rather than days, begin investigations from the earliest known exploitation, and deploy detections that do not depend on CVE-specific signatures. Upgrading to fixed PHP versions is the only complete remediation. Where patching is not immediately possible, teams should consider blocking multi-part file uploads after assessing application impact, and review logs for POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string.
Source: Hacker News · Summarized by HeadlinesBriefing