Amazon Threat Intelligence traces PHP2Shell exploit to days before public release
Amazon Threat Intelligence detected exploitation of the PHP2Shell vulnerability on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial attack originated from a commercial anonymization network, suggesting a targeted threat actor. Following the embargo lift on October 21, multiple actors deployed varied proof-of-concept exploits. While technical analysis continues, the early activity indicates sophisticated pre-disclosure reconnaissance, raising questions about how exploit details were acquired before official release.
Key points
- Amazon Threat Intelligence, the security division of Amazon Web Services, identified a PHP2Shell exploitation attempt on October 17, 2026, in its MadPot honeypot telemetry.
- This detection occurred four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619, with the initial exploit originating from an IP address linked to a commercial anonymization network.
- The PHP embargo window was scheduled to lift on October 21, 2026, at 14:00 UTC, but multiple proof-of-concept exploits appeared as early as 02:00 UTC on that same day.
- Between 02:00 and 08:00 UTC on October 21, additional exploitation attempts from different anonymized infrastructure targeted MadPot, with varying payloads suggesting multiple distinct threat actors were involved.
- Analysts note that the use of anonymized IPs during the embargo suggests a targeted threat actor, though it remains unclear how they acquired exploit information prior to the official release.
- Technical analysis is ongoing to determine if these early attempts would have succeeded in real-world systems, but PHP2Shell is now being broadly exploited following the patch release.
Amazon Threat Intelligence has revealed that exploitation of the PHP2Shell vulnerability began before its official public disclosure. The security team identified an initial exploitation attempt on October 17, 2026, within its MadPot honeypot telemetry. This detection occurred four days prior to the public release of CVE-2026-109618 and CVE-2026-109619. The earliest attack originated from an IP address associated with a commercial anonymization network, a detail that suggests the activity was conducted by a specific threat actor rather than random background noise. However, the exact method by which this actor acquired exploit information during the embargo period remains under investigation.
The embargo window was set to lift on October 21, 2026, at 14:00 UTC. However, Amazon Threat Intelligence observed multiple proof-of-concept exploits appearing as early as 02:00 UTC on that day. Between 02:00 and 08:00 UTC, additional exploitation attempts targeted MadPot from different anonymized infrastructure. The variation in payloads and anonymization choices indicates that multiple distinct actors were likely involved in these early waves of attacks. Once the official patch was released at 14:00 UTC, new proof-of-concept exploits appeared within hours and were immediately used against Amazon’s sensors.
The early detection highlights the complexity of modern vulnerability management, where threat actors can leverage anonymized networks to test exploits before the wider community is aware. While technical analysis continues to determine the success rate of these early attempts in real-world environments, the broad exploitation of PHP2Shell following the patch release underscores the rapid pace of post-disclosure attacks. For global IT teams, this timeline suggests that patching alone may not be sufficient, as sophisticated actors may have already probed systems during the pre-disclosure window.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
